Angr安装与使用之使用篇（四）

针对angr提供的练习题，现在进行求解03_angr_symbolic_registers，它也是关于符号寄存器的问题，需要使用angr求解出正确密码。但是需要提供排除地址以减少路径求解时间。

参考博客点这里

具体代码如下所示

# Angr doesn't currently support reading multiple things with scanf (Ex:
# scanf("%u %u).) You will have to tell the simulation engine to begin the
# program after scanf is called and manually inject the symbols into registers.import angr
import claripy
import sysdef main(argv):path_to_binary = argv[1]project = angr.Project(path_to_binary)# Sometimes, you want to specify where the program should start. The variable# start_address will specify where the symbolic execution engine should begin.# Note that we are using blank_state, not entry_state.# (!)start_address = 0x08048980  # :integer (probably hexadecimal)initial_state = project.factory.blank_state(addr=start_address)# Create a symbolic bitvector (the datatype Angr uses to inject symbolic# values into the binary.) The first parameter is just a name Angr uses# to reference it. # You will have to construct multiple bitvectors. Copy the two lines below# and change the variable names. To figure out how many (and of what size)# you need, dissassemble the binary and determine the format parameter passed# to scanf.# (!)password0_size_in_bits = 32  # :integerpassword0 = claripy.BVS('password0', password0_size_in_bits)password1_size_in_bits = 32  # :integerpassword1 = claripy.BVS('password1', password1_size_in_bits)password2_size_in_bits = 32  # :integerpassword2 = claripy.BVS('password2', password2_size_in_bits)# Set a register to a symbolic value. This is one way to inject symbols into# the program.# initial_state.regs stores a number of convenient attributes that reference# registers by name. For example, to set eax to password0, use:## initial_state.regs.eax = password0## You will have to set multiple registers to distinct bitvectors. Copy and# paste the line below and change the register. To determine which registers# to inject which symbol, dissassemble the binary and look at the instructions# immediately following the call to scanf.# (!)initial_state.regs.eax = password0initial_state.regs.ebx = password1initial_state.regs.edx = password2simulation = project.factory.simgr(initial_state)def is_successful(state):stdout_output = state.posix.dumps(sys.stdout.fileno())return 'Good Job.' in stdout_outputdef should_abort(state):stdout_output = state.posix.dumps(sys.stdout.fileno())return 'Try again.' in stdout_outputsimulation.explore(find=is_successful, avoid=should_abort)if simulation.found:solution_state = simulation.found[0]# Solve for the symbolic values. If there are multiple solutions, we only# care about one, so we can use eval, which returns any (but only one)# solution. Pass eval the bitvector you want to solve for.# (!)solution0 = solution_state.se.eval(password0)solution1 = solution_state.se.eval(password1) solution2 = solution_state.se.eval(password2)# Aggregate and format the solutions you computed above, and then print# the full string. Pay attention to the order of the integers, and the# expected base (decimal, octal, hexadecimal, etc).solution = ' '.join(map('{:x}'.format, [ solution0, solution1, solution2 ]))  # :stringprint solutionelse:raise Exception('Could not find the solution')if __name__ == '__main__':main(sys.argv)

此时的，start_address取 0x08048980，为输入的下一个指令地址，如下所示。

下面验证实验结果
执行刚刚写好的程序，保存为scaffold03.py，并将其与03_angr_symbolic_registers放于同一文件夹中，具体如下图所示。

再执行03_angr_symbolic_registers，然后需要我们输入angr刚刚求解出的密码，结果为Good Job。

至此，求解03_angr_symbolic_registers已全部完成。

Angr安装与使用之使用篇（四）相关推荐

计算机未安装OCR应用程序,电脑应用指南篇四：天若OCR使用指南（扫描图片转文字）...
电脑应用指南篇四:天若OCR使用指南(扫描图片转文字) 2020-04-08 10:44:34 7点赞 82收藏 15评论到了一个新的单位,每天需要面对的场景就是老板突然拿出一份文件对我说,你把这 ...
科宇扫地机器人_我的三年16台智能扫地机器人使用回忆录篇四：扫地谁更精准更干净？新一代3D视讯+激光成像 PK 老式激光扫描，万字实测对比分享...
我的三年16台智能扫地机器人使用回忆录篇四:扫地谁更精准更干净?新一代3D视讯+激光成像 PK 老式激光扫描,万字实测对比分享 2019-05-23 11:22:00 37点赞 166收藏 53评论 ...
华硕无线路由打印机服务器,享受DIY的快乐篇四：当普通打印机遇上智能路由器——网络打印机配置教程（以华硕AC66U B1为例）...
享受DIY的快乐篇四:当普通打印机遇上智能路由器--网络打印机配置教程(以华硕AC66U B1为例) 2020-07-15 15:27:48 21点赞 238收藏 41评论创作立场声明:本文系作者 ...
Android日志[进阶篇]四-获取错误报告
Android日志[进阶篇]一-使用 Logcat 写入和查看日志 Android日志[进阶篇]二-分析堆栈轨迹(调试和外部堆栈) Android日志[进阶篇]三-Logcat命令行工具 Androi ...
服务器存储满了进不去系统,解决PC常见问题篇四十五：建议收藏！手贱升级进不去系统？两步简单恢复黑群晖！...
解决PC常见问题篇四十五:建议收藏!手贱升级进不去系统?两步简单恢复黑群晖! 2021-07-19 16:40:32 47点赞 302收藏 15评论创作立场声明:本文属于原创文章,无任何利益关系, ...
计算机专业用移动硬盘,评测篇四十三：国产之光，看这款可做移动硬盘又可系统盘的Orico SSD...
评测篇四十三:国产之光,看这款可做移动硬盘又可系统盘的Orico SSD 2020-03-22 21:26:50 5点赞 7收藏 17评论移动存储一直是我们生活中的热门话题,在伴随最近几年的云盘不 ...
更换matlab版本需要注意事项,AMD 篇四：更换Matlab调用MKL库版本
AMD 篇四:更换Matlab调用MKL库版本 2020-03-01 23:37:51 4点赞 5收藏 4评论前言这次说一下如何更换MATLAB调用的MKL库.MATLAB所调用的MKL库通常不会 ...
计算机各种办公软件都很卡,垃圾佬软件推荐篇四：百分之99高性能电脑卡顿的原因找到了，快看看你有没有中招...
垃圾佬软件推荐篇四:百分之99高性能电脑卡顿的原因找到了,快看看你有没有中招 2021-01-06 18:38:04 8点赞 38收藏 16评论创作立场声明:原创 1 2345 头号流氓软件几乎 ...
jsp的安装，何志强篇
<script type="text/javascript"> google_ad_client = "pub-8800625213955058"; ...
DirectX5.0最新游戏编程指南 DirectDraw篇四、DirectDraw高级特性 (转)
DirectX5.0最新游戏编程指南 DirectDraw篇四.DirectDraw高级特性 (转)[@more@] 四.DirectDraw高级特性 1.直接内存访问DMA 有些显示设备能够在 ...

Angr安装与使用之使用篇（四）

Angr安装与使用之使用篇（四）相关推荐

最新文章

热门文章