Tweet
Tweet

Slide 1

Slide 1 text

No content

Slide 2

Slide 2 text

• • • • •

Slide 3

Slide 3 text

void congrats() { puts("congrats!"); } int main(int argc, char *argv[]) { char username[256]; char password[256]; scanf("%s", username); scanf("%s", password); (strcmp(username, "admin") == 0 && strcmp(password, "l33t") == 0) ? congrats() : exit(1); return 0; }

Slide 4

Slide 4 text

List of functions: [(4195592L, ), (4195648L, ), (4195664L, ), (4195680L, ), (4195696L, ), (4195712L, ), (4195728L, ), (4195744L, ), (4195760L, ), (4195808L, ), (4195920L, ), (4195952L, ), (4195997L, ), (4196013L, ), (4196224L, ), (67108864L, ), (67108880L, ), (67108896L, ), (67108912L, ), (67108928L, ), (67108944L, ), (67108976L, )] Dump stdin at congrats(): 'admin¥x00¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x0 1¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x0 1¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01l33t¥x00¥x00¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01 ¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01 ¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x00¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01 ¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x00¥x01¥x01¥x00' import angr b = angr.Project('./test') cfg = b.analyses.CFG() print "List of functions:" print [x for x in cfg.functions.iteritems()] addr_congrats = b.loader.main_bin.get_symbol("congrats").addr e = b.surveyors.Explorer(find = addr_congrats) e.run() if len(e.found) > 0: print "Dump stdin at congrats():" print "%r" % e.found[0].state.posix.dumps(0)

Slide 5

Slide 5 text

int main(int argc, char *argv[]) { char username[256]; char password[256]; srand((unsigned int)time(NULL)); int y = rand()%1000; scanf("%s", username); scanf("%s", password); while(y > 1) { if(y % 2 == 1) y = 3 * y + 1; else y = y / 2; (y == 1 && strcmp(username, "admin") == 0 && strcmp(password, "l33t") == 0) ? congrats() : exit(1); } return 0; }

Slide 6

Slide 6 text

ERROR | 2016-04-27 05:40:51,491 | angr.analyses.cfg | Caught an AngrError during CFG recovery at 0xffffffffff600400 (No section) Traceback (most recent call last): File "/home/angr/angr-dev/angr/angr/analyses/cfg_accurate.py", line 2268, in _get_simrun sim_run = self.project.factory.sim_run(current_entry.state, jumpkind=jumpkind) File "/home/angr/angr-dev/angr/angr/factory.py", line 131, in sim_run r = self.sim_block(state, addr=addr, **block_opts) File "/home/angr/angr-dev/angr/angr/factory.py", line 71, in sim_block **block_opts) File "/home/angr/angr-dev/angr/angr/lifter.py", line 83, in lift raise AngrMemoryError("No bytes in memory for block starting at 0x%x." % addr) AngrMemoryError: No bytes in memory for block starting at 0xffffffffff600400. ERROR | 2016-04-27 05:40:51,674 | angr.analyses.cfg | Caught an AngrError during CFG recovery at 0xffffffffff600400 (No section) Traceback (most recent call last): File "/home/angr/angr-dev/angr/angr/analyses/cfg_accurate.py", line 2268, in _get_simrun sim_run = self.project.factory.sim_run(current_entry.state, jumpkind=jumpkind) File "/home/angr/angr-dev/angr/angr/factory.py", line 131, in sim_run r = self.sim_block(state, addr=addr, **block_opts) File "/home/angr/angr-dev/angr/angr/factory.py", line 71, in sim_block **block_opts) File "/home/angr/angr-dev/angr/angr/lifter.py", line 83, in lift raise AngrMemoryError("No bytes in memory for block starting at 0x%x." % addr) AngrMemoryError: No bytes in memory for block starting at 0xffffffffff600400. List of functions: [(4195752L, ), (4195840L, ), (4195888L, ), (4195904L, ), (4195968L, ), (4196016L, ), (4196128L, ), (4196160L, ), (4196221L, ), (4196608L, ), (67108896L, ), (67108976L, ), (67109072L, ), (18446744073699066880L, )]

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

// srand((unsigned int)time(NULL)); // int y = rand()%1000; int y = 1000;