import angr

import sys

# 加载可执行文件路径

path_to_binary = "./00_angr_find"

project = angr.Project(path_to_binary)

# 找到入口

initial_state = project.factory.entry_state()

# 创建模拟管理器，支持搜索和执行

simulation = project.factory.simgr(initial_state)

# 设置要进入的位置:integer (probably in hexadecimal)

simulation.explore(find=0x08048678)

# 查看结果状态

solution_state = simulation.found[0]

# 输出结果

print(solution_state.posix.dumps(sys.stdin.fileno()))

import angr

import sys

# 加载可执行文件路径

path_to_binary = "./01_angr_avoid"

project = angr.Project(path_to_binary)

# 找到入口

initial_state = project.factory.entry_state()

# 创建模拟管理器，支持搜索和执行

simulation = project.factory.simgr(initial_state)

# 设置要进入的位置，回避的函数

simulation.explore(find=0x80485f7,avoid=0x80485bf)

# 查看结果状态

solution_state = simulation.found[0]

# 输出结果

print(solution_state.posix.dumps(sys.stdin.fileno()))

import angr

import sys

def Go():

    path_to_binary = "./02_angr_find_condition"

    project = angr.Project(path_to_binary, auto_load_libs=False)

    initial_state = project.factory.entry_state()

    simulation = project.factory.simgr(initial_state)

    def is_successful(state):

        stdout_output = state.posix.dumps(sys.stdout.fileno())#输出内容放到变量中

        if b'Good Job.' in stdout_output:

            return True

        else:

            return False

    def should_abort(state):

        stdout_output = state.posix.dumps(sys.stdout.fileno())

        if b'Try again.' in  stdout_output:

            return True

        else:

            return False

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:

        solution_state = simulation.found[0]

        solution = solution_state.posix.dumps(sys.stdin.fileno())

        print("Solution is: {}".format(solution.decode("utf-8")))

    else:

        raise Exception('Could not find the solution')

if __name__ == "__main__":

    Go()

import sys

import angr

import claripy

def is_successful(state):

    stdout_output = state.posix.dumps(sys.stdout.fileno())

    if b'Good Job.\n' in stdout_output:

        return True

    else:

        return False

def should_abort(state):

    stdout_output = state.posix.dumps(sys.stdout.fileno())

    if b'Try again.\n' in stdout_output:

        return True

    else:

        return False

def Go():

    path_to_binary = "./03_angr_symbolic_registers"

    project = angr.Project(path_to_binary)

    start_address = 0x80488c7 

    initial_state = project.factory.blank_state(addr=start_address)

    passwd_size_in_bits = 32

    passwd0 = claripy.BVS('passwd0', passwd_size_in_bits)

    passwd1 = claripy.BVS('passwd1', passwd_size_in_bits)

    passwd2 = claripy.BVS('passwd2', passwd_size_in_bits)

    initial_state.regs.eax = passwd0

    initial_state.regs.ebx = passwd1

    initial_state.regs.edx = passwd2

    simulation = project.factory.simgr(initial_state)

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:

        for i in simulation.found:

            solution_state = i

            solution0 = format(solution_state.solver.eval(passwd0), 'x')

            solution1 = format(solution_state.solver.eval(passwd1), 'x')

            solution2 = format(solution_state.solver.eval(passwd2), 'x')

            solution = solution0 + " " + solution1 + " " + solution2

            print("[+] Success! Solution is: {}".format(solution))

            # print(simgr.found[0].posix.dumps(0))

    else:

        raise Exception('Could not find the solution')

if __name__ == '__main__':

    Go()

import angr

import claripy

filename = "04_angr_symbolic_stack"

p = angr.Project(filename)

startAddr = 0x080486AE

init_state = p.factory.blank_state(addr=startAddr) 

init_state.stack_push(init_state.regs.ebp)

init_state.regs.ebp = init_state.regs.esp

init_state.regs.esp -= 8

pass1 = init_state.solver.BVS('pass1', 32)

pass2 = init_state.solver.BVS('pass2', 32)

init_state.stack_push(pass1)

init_state.stack_push(pass2)

sm = p.factory.simulation_manager(init_state)

def is_good(state):

    return b'Good Job' in state.posix.dumps(1)

def is_bad(state):

    return b'Try again' in state.posix.dumps(1)

sm.explore(find=is_good, avoid=is_bad)

if sm.found:

    found_state = sm.found[0]

    passwodr1 = found_state.solver.eval(pass1)

    passwodr2 = found_state.solver.eval(pass2)

    print("Solution:",int(passwodr1), int(passwodr2))

else:

    raise Exception("No solution found!")

import angr

import claripy

def is_successful(state):

    stdout_output = state.posix.dumps(1)

    if b'Good Job.\n' in stdout_output:

        return True

    else:

        return False

def should_abort(state):

    stdout_output = state.posix.dumps(1)

    if b'Try again.\n' in stdout_output:

        return True

    else:

        return False

def Go():

    path_to_binary = "./05_angr_symbolic_memory"

    project = angr.Project(path_to_binary, auto_load_libs=False)

    start_address = 0x08048618

    initial_state = project.factory.blank_state(addr=start_address)

    passwd_size_in_bits = 64

    passwd0 = claripy.BVS('passwd0', passwd_size_in_bits)

    passwd1 = claripy.BVS('passwd1', passwd_size_in_bits)

    passwd2 = claripy.BVS('passwd2', passwd_size_in_bits)

    passwd3 = claripy.BVS('passwd3', passwd_size_in_bits)

    passwd0_address = 0x0AB232C0 # user_input addr

    initial_state.memory.store(passwd0_address, passwd0)

    initial_state.memory.store(passwd0_address + 0x8, passwd1)

    initial_state.memory.store(passwd0_address + 0x10, passwd2)

    initial_state.memory.store(passwd0_address + 0x18, passwd3)

    simulation = project.factory.simgr(initial_state)

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:

        for i in simulation.found:

            solution_state = i

            solution0 = solution_state.solver.eval(passwd0, cast_to=bytes)

            solution1 = solution_state.solver.eval(passwd1, cast_to=bytes)

            solution2 = solution_state.solver.eval(passwd2, cast_to=bytes)

            solution3 = solution_state.solver.eval(passwd3, cast_to=bytes)

            solution = solution0 + b" " + solution1 + b" " + solution2 + b" " + solution3

            print("[+] Success! Solution is: {}".format(solution.decode("utf-8")))

            # print(solution0, solution1, solution2, solution3)

    else:

        raise Exception('Could not find the solution')

if __name__ == "__main__":

    Go()

import angr

import claripy

import sys

def main(argv):

  path_to_binary = "./06_angr_symbolic_dynamic_memory"

  project = angr.Project(path_to_binary)

  start_address = 0x80486af

  initial_state = project.factory.blank_state(

    addr=start_address,

    add_options = { angr.options.SYMBOL_FILL_UNCONSTRAINED_MEMORY,

                    angr.options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS}

  )

  password0 = claripy.BVS('password0', 8*8)

  password1 = claripy.BVS('password0', 8*8)

  fake_heap_address0 = 0x4444444

  pointer_to_malloc_memory_address0 = 0xa2def74

  initial_state.memory.store(pointer_to_malloc_memory_address0, fake_heap_address0, endness=project.arch.memory_endness, size=4)

  fake_heap_address1 = 0x4444454

  pointer_to_malloc_memory_address1 = 0xa2def7c

  initial_state.memory.store(pointer_to_malloc_memory_address1, fake_heap_address1, endness=project.arch.memory_endness, size=4)

  initial_state.memory.store(fake_heap_address0, password0)

  initial_state.memory.store(fake_heap_address1, password1)

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):

    stdout_output = state.posix.dumps(sys.stdout.fileno())

    return 'Good Job.'.encode() in stdout_output

  def should_abort(state):

    stdout_output = state.posix.dumps(sys.stdout.fileno())

    return 'Try again.'.encode() in stdout_output

  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:

    solution_state = simulation.found[0]

    solution0 = solution_state.solver.eval(password0,cast_to=bytes).decode()

    solution1 = solution_state.solver.eval(password1,cast_to=bytes).decode()

    solution = ' '.join([ solution0, solution1 ])

    print(solution)

  else:

    raise Exception('Could not find the solution')

if __name__ == '__main__':

  main(sys.argv)

# 1. 确定 fread 读取的文件

# 2. 使用 Angr 模拟一个文件系统，让读取的文件被我们自己的文件替换

# 3. 使用符号值初始化文件，该值将使用 fread 读取

# 4. 求解符号输入以确定密码

import angr

import claripy

import sys

def main(argv):

  path_to_binary = "./07_angr_symbolic_file"

  project = angr.Project(path_to_binary)

  start_address = 0x80488bc

  initial_state = project.factory.blank_state(

    addr=start_address,

    add_options = { angr.options.SYMBOL_FILL_UNCONSTRAINED_MEMORY,

                    angr.options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS}

  )

  filename = 'FOQVSBZB.txt'  # :string

  symbolic_file_size_bytes = 8

  password = claripy.BVS('password', symbolic_file_size_bytes * 8)

  password_file = angr.storage.SimFile(filename, content=password)

  initial_state.fs.insert(filename, password_file)

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):

    stdout_output = state.posix.dumps(sys.stdout.fileno())

    return 'Good Job.'.encode() in stdout_output

  def should_abort(state):

    stdout_output = state.posix.dumps(sys.stdout.fileno())

    return 'Try again.'.encode() in stdout_output

  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:

    solution_state = simulation.found[0]

    solution = solution_state.solver.eval(password,cast_to=bytes).decode()

    print(solution)

  else:

    raise Exception('Could not find the solution')

if __name__ == '__main__':

  main(sys.argv)

import angr

import claripy

import sys

def main(argv):

  path_to_binary = "./08_angr_constraints"

  project = angr.Project(path_to_binary)

  start_address = 0x804863c

  initial_state = project.factory.blank_state(

    addr=start_address,

    add_options = { angr.options.SYMBOL_FILL_UNCONSTRAINED_MEMORY,

                    angr.options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS}

  )

  password = claripy.BVS('password', 8*16)

  password_address = 0x804a040

  initial_state.memory.store(password_address, password)

  simulation = project.factory.simgr(initial_state)

  # Angr will not be able to reach the point at which the binary prints out

  # 'Good Job.'. We cannot use that as the target anymore.

  # (!)

  address_to_check_constraint = 0x8048683

  simulation.explore(find=address_to_check_constraint)

  if simulation.found:

    solution_state = simulation.found[0]

    constrained_parameter_address = 0x804a040

    constrained_parameter_size_bytes = 16

    constrained_parameter_bitvector = solution_state.memory.load(

      constrained_parameter_address,

      constrained_parameter_size_bytes

    )

    # We want to constrain the system to find an input that will make

    # constrained_parameter_bitvector equal the desired value.

    # (!)

    constrained_parameter_desired_value = 'OSIWHBXIFOQVSBZB'.encode() # :string (encoded)

    solution_state.add_constraints(constrained_parameter_bitvector == constrained_parameter_desired_value)

    solution = solution_state.solver.eval(password,cast_to=bytes).decode()

    print(solution)

  else:

    raise Exception('Could not find the solution')

if __name__ == '__main__':

  main(sys.argv)

@project.hook(check_equals_called_address, length=instruction_to_skip_length)

    def skip_check_equals_(state):

        user_input_buffer_address = 0x804A054

        user_input_buffer_length = 16

        user_input_string = state.memory.load(

            user_input_buffer_address,

            user_input_buffer_length

        )

        check_against_string = 'XKSPZSJKJYQCQXZV'

        register_size_bit = 32

        state.regs.eax = claripy.If(

            user_input_string == check_against_string,

            claripy.BVV(1, register_size_bit),

            claripy.BVV(0, register_size_bit)

        )#不再循环了

    simulation = project.factory.simgr(initial_state)

import angr

import claripy

import sys

def main(argv):

  path_to_binary = "./09_angr_hooks"

  project = angr.Project(path_to_binary)

  # Since Angr can handle the initial call to scanf, we can start from the

  # beginning.

  initial_state = project.factory.entry_state(

    add_options = { angr.options.SYMBOL_FILL_UNCONSTRAINED_MEMORY,

                    angr.options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS}

  )

  # Hook the address of where check_equals_ is called.

  # (!)

  check_equals_called_address = 0x80486ca

  # The length parameter in angr.Hook specifies how many bytes the execution

  # engine should skip after completing the hook. This will allow hooks to

  # replace certain instructions (or groups of instructions). Determine the

  # instructions involved in calling check_equals_, and then determine how many

  # bytes are used to represent them in memory. This will be the skip length.

  # (!)

  instruction_to_skip_length = 5

  @project.hook(check_equals_called_address, length=instruction_to_skip_length)

  def skip_check_equals_(state):

    user_input_buffer_address = 0x804a044 

    user_input_buffer_length = 16

    user_input_string = state.memory.load(

      user_input_buffer_address,

      user_input_buffer_length

    )

    check_against_string = 'OSIWHBXIFOQVSBZB'.encode() # :string

    state.regs.eax = claripy.If(

      user_input_string == check_against_string, 

      claripy.BVV(1, 32), 

      claripy.BVV(0, 32)

    )

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):

    stdout_output = state.posix.dumps(sys.stdout.fileno())

    return 'Good Job.'.encode() in stdout_output

  def should_abort(state):

    stdout_output = state.posix.dumps(sys.stdout.fileno())

    return 'Try again.'.encode() in stdout_output

  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:

    solution_state = simulation.found[0]

    # Since we are allowing Angr to handle the input, retrieve it by printing

    # the contents of stdin. Use one of the early levels as a reference.

    solution = solution_state.posix.dumps(sys.stdin.fileno()).decode()

    print(solution)

  else:

    raise Exception('Could not find the solution')

if __name__ == '__main__':

  main(sys.argv)

import angr

import sys

import claripy

def Go():

    path_to_binary = "./09_angr_hooks"

    project = angr.Project(path_to_binary, auto_load_libs=False)

    initial_state = project.factory.entry_state()

    check_equals_called_address = 0x80486CA

    instruction_to_skip_length = 5

    @project.hook(check_equals_called_address, length=instruction_to_skip_length)

    def skip_check_equals_(state):

        user_input_buffer_address = 0x804A044

        user_input_buffer_length = 16

        user_input_string = state.memory.load(

            user_input_buffer_address,

            user_input_buffer_length

        )

        check_against_string = 'OSIWHBXIFOQVSBZB'.encode()

        register_size_bit = 32

        state.regs.eax = claripy.If(

            user_input_string == check_against_string,

            claripy.BVV(1, register_size_bit),

            claripy.BVV(0, register_size_bit)

        )

    simulation = project.factory.simgr(initial_state)

    def is_successful(state):

        stdout_output = state.posix.dumps(1)

        if b'Good Job.' in stdout_output:

            return True

        else:

            return False

    def should_abort(state):

        stdout_output = state.posix.dumps(1)

        if b'Try again.' in  stdout_output:

            return True

        else:

            return False

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:

        for i in simulation.found:

            solution_state = i

            solution = solution_state.posix.dumps(0)

            print("[+] Success! Solution is: {0}".format(solution.decode('utf-8')))

            #print(solution0)

    else:

        raise Exception('Could not find the solution')

if __name__ == "__main__":

    Go()

import angr

import time

import claripy

time_strat = time.perf_counter()

def good(state):

    tag = b'Good' in state.posix.dumps(1)

    return True if tag else False

def bad(state):

    tag = b'Try' in state.posix.dumps(1)

    return True if tag else False

path_to_binary = './10_angr_simprocedures'

p = angr.Project(path_to_binary, auto_load_libs=False)

init_state = p.factory.entry_state()

class Hook(angr.SimProcedure):

    def run(self, addr, size):

        # 后两个参数即为 check_equals 函数的参数

        input_buffer = addr

        input_size = size

        # 从内存中读取输入

        input_str = self.state.memory.load(input_buffer, input_size)

        right_str = 'OSIWHBXIFOQVSBZB'.encode()

        # 比较返回符号约束

        result = claripy.If(input_str == right_str, claripy.BVV(1, 32),

                            claripy.BVV(0, 32))

        return result

# funcname 一定要相同，可在 IDA 中查看

hooked_funcname = 'check_equals_OSIWHBXIFOQVSBZB'

p.hook_symbol(hooked_funcname, Hook())

simgr = p.factory.simgr(init_state)

simgr.explore(find=good, avoid=bad)

if simgr.found:

    solution_state = simgr.found[0]

    flag = solution_state.posix.dumps(0)

    print(flag)

import angr

import claripy

def good(state):

    tag = b'Good' in state.posix.dumps(1)

    return True if tag else False

def bad(state):

    tag = b'Try' in state.posix.dumps(1)

    return True if tag else False

path_to_binary = './11_angr_sim_scanf'

project = angr.Project(path_to_binary, auto_load_libs=False)

initial_state = project.factory.entry_state()

class ReplacementScanf(angr.SimProcedure):

    # 第一个参数是 scanf 的格式化字符串，接着是两个 buffer 地址

    def run(self, format_string, scanf0_address, scanf1_address):

        # 在 run 中完成 scanf 的功能，即向目标地址写入符号

        # 定义两个符号变量，用于写入 buffer

        scanf0 = claripy.BVS('scanf0', 32)

        scanf1 = claripy.BVS('scanf1', 32)

        # 写入内存，最后一个参数指定字节序

        self.state.memory.store(scanf0_address,

                                scanf0,

                                endness=project.arch.memory_endness)

        self.state.memory.store(scanf1_address,

                                scanf1,

                                endness=project.arch.memory_endness)

        # 保存变量到全局，方便后续约束求解

        self.state.globals['solution0'] = scanf0

        self.state.globals['solution1'] = scanf1

# scanf 的函数名称，可在 ida 中查看

scanf_symbol = '__isoc99_scanf'

project.hook_symbol(scanf_symbol, ReplacementScanf())

simulation = project.factory.simgr(initial_state)

simulation.explore(find=good, avoid=bad)

if simulation.found:

    solution_state = simulation.found[0]

    # 对符号变量进行约束求解

    stored_solutions0 = solution_state.globals['solution0']

    stored_solutions1 = solution_state.globals['solution1']

    scanf0_solution = solution_state.solver.eval(stored_solutions0)

    scanf1_solution = solution_state.solver.eval(stored_solutions1)

    print(scanf0_solution, scanf1_solution)

else:

    raise Exception('Could not find the solution')

import angr

import claripy

import sys

def test():

	file='12_angr_veritesting'

	project=angr.Project(file)

	initial_state=project.factory.entry_state()

	#Veritesting 结合了静态符合执行与动态符号执行，减少了路径爆炸的影响

	simulation=project.factory.simgr(initial_state,veritesting=True)

	def succ(state):

		return b'Good Job.' in state.posix.dumps(sys.stdout.fileno())

	def fail(state):

		return b'Try again.' in state.posix.dumps(sys.stdout.fileno())

	simulation.explore(find=succ,avoid=fail)

	if simulation.found:

		solution_state=simulation.found[0]

		solution = solution_state.posix.dumps(sys.stdin.fileno())

		print('Solution is {0}'.format(solution.decode('utf-8')))

	else:

		raise Exception('Could not find the solution')

if __name__=="__main__":

	test()