0

I am a student studying angr, first time.

I'm watching the code in this url.

https://github.com/Dvd848/CTFs/blob/master/2020_GoogleCTF/Beginner.md

import angr
import claripy

FLAG_LEN = 15
STDIN_FD = 0

base_addr = 0x100000 # To match addresses to Ghidra

proj = angr.Project("./a.out", main_opts={'base_addr': base_addr}) 

flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(FLAG_LEN)]
flag = claripy.Concat( *flag_chars + [claripy.BVV(b'\n')]) # Add \n for scanf() to accept the input

state = proj.factory.full_init_state(
        args=['./a.out'],
        add_options=angr.options.unicorn,
        stdin=flag,
)

# Add constraints that all characters are printable
for k in flag_chars:
    state.solver.add(k >= ord('!'))
    state.solver.add(k <= ord('~'))

simgr = proj.factory.simulation_manager(state)
find_addr  = 0x101124 # SUCCESS
avoid_addr = 0x10110d # FAILURE
simgr.explore(find=find_addr, avoid=avoid_addr)

if (len(simgr.found) > 0):
    for found in simgr.found:
        print(found.posix.dumps(STDIN_FD))

https://github.com/google/google-ctf/tree/master/2020/quals/reversing-beginner/attachments

Which is the answer of googlectf beginner.

But, the above code does not work. It doesn't give me the answer.

I want to know why the code is not working.

When I execute this code, the output was empty.

I run the code with python3 in Ubuntu 20.04 in wsl2

Thank you.

4

0 回答 0