本文共 3071 字，大约阅读时间需要 10 分钟。

angr系列

分析伪代码

.text:080485C0 push    offset user_input ; s.text:080485C5 call    _memset.text:080485CA add     esp, 10h.text:080485CD sub     esp, 0Ch.text:080485D0 push    offset aEnterThePasswo ; "Enter the password: ".text:080485D5 call    _printf.text:080485DA add     esp, 10h.text:080485DD sub     esp, 0Ch.text:080485E0 push    offset unk_A1BA1D8.text:080485E5 push    offset unk_A1BA1D0.text:080485EA push    offset unk_A1BA1C8.text:080485EF push    offset user_input.text:080485F4 push    offset a8s8s8s8s ; "%8s %8s %8s %8s".text:080485F9 call    ___isoc99_scanf.text:080485FE add     esp, 20h.text:08048601 mov     [ebp+var_C], 0.text:08048608 jmp     short loc_8048637

一个字符是一字节，8个字符也就是8字节，也就是64位。需要符号化的内存单元地址为：

.text:080485E0 push    offset unk_A1BA1D8.text:080485E5 push    offset unk_A1BA1D0.text:080485EA push    offset unk_A1BA1C8.text:080485EF push    offset user_input

所以这里需要去符号化这四个内存地址单元：

1. 先申请四个变量

p1=init_state.solver.BVS('p1',64)      p2=init_state.solver.BVS('p2',64)    p3=init_state.solver.BVS('p3',64)    p4=init_state.solver.BVS('p4',64)

2. 把内存单元的地址值和变量之间进行一定关系的绑定

p4_addr=0x0A1BA1D8    p3_addr=0x0A1BA1D0    p2_addr=0x0A1BA1C8    p1_addr=0x0A1BA1C0    init_state.memory.store(p1_addr,p1)    init_state.memory.store(p2_addr,p2)    init_state.memory.store(p3_addr,p3)    init_state.memory.store(p4_addr,p4)

对比一下符号化寄存器：

pass1=claripy.BVS('pass1',32)    pass2=claripy.BVS('pass2',32)    pass3=claripy.BVS('pass3',32)    init_state.regs.eax=pass1    init_state.regs.ebx=pass2    init_state.regs.edx=pass3

最后再来对变量进行求解：

pass1=found_state.solver.eval(p1,cast_to=bytes)        pass2=found_state.solver.eval(p2,cast_to=bytes)        pass3=found_state.solver.eval(p3,cast_to=bytes)        pass4=found_state.solver.eval(p4,cast_to=bytes)

脚本

import angrimport sysdef main(argv):    bin_path=argv[1]    p=angr.Project(bin_path)    start_addr=0x08048601    init_state=p.factory.blank_state(addr=start_addr)    p1=init_state.solver.BVS('p1',64)      p2=init_state.solver.BVS('p2',64)    p3=init_state.solver.BVS('p3',64)    p4=init_state.solver.BVS('p4',64)    p4_addr=0x0A1BA1D8    p3_addr=0x0A1BA1D0    p2_addr=0x0A1BA1C8    p1_addr=0x0A1BA1C0    init_state.memory.store(p1_addr,p1)    init_state.memory.store(p2_addr,p2)    init_state.memory.store(p3_addr,p3)    init_state.memory.store(p4_addr,p4)    sm=p.factory.simgr(init_state)    def is_good(state):        return b'Good Job.' in state.posix.dumps(1)    def is_bad(state):        return b'Try again.' in state.posix.dumps(1)    sm.explore(find=is_good,avoid=is_bad)    if sm.found:        found_state=sm.found[0]        pass1=found_state.solver.eval(p1,cast_to=bytes)        pass2=found_state.solver.eval(p2,cast_to=bytes)        pass3=found_state.solver.eval(p3,cast_to=bytes)        pass4=found_state.solver.eval(p4,cast_to=bytes)        print("Solution:{} {} {} {}".format(pass1.decode('utf-8'),pass2.decode('utf-8'),pass3.decode('utf-8'),pass4.decode('utf-8')))    else:        raise Exception("Solution not found")if __name__=="__main__":    main(sys.argv)

NAXTHGNR JVSFTPWE LMGAUHWC XMDCPALU

测试：