angr系列

00_angr_find

01_angr_avoid

02_angr_find_condition

03_angr_symbolic_registers

04_angr_symbolic_stack

05_angr_symbolic_memory

06_angr_symbolic_dynamic_memory

07_angr_symbolic_file

08_angr_constraints

09_angr_hooks

10_angr_simprocedures

13_angr_static_binary

文章目錄

• • angr系列
  • • 00_angr_find
    • 01_angr_avoid
    • 02_angr_find_condition
    • 03_angr_symbolic_registers
    • 04_angr_symbolic_stack
    • 05_angr_symbolic_memory
    • 06_angr_symbolic_dynamic_memory
    • 07_angr_symbolic_file
    • 08_angr_constraints
    • 09_angr_hooks
    • 10_angr_simprocedures
    • 13_angr_static_binary
  • 偽代碼分析
  • 腳本
  • 驗證

偽代碼分析

這里利用函數名字來進行hook操作：

check_symbol='check_equals_ORSDDWXHZURJRBDH'

然后把相應的hook替換函數進行申明：

p.hook_symbol(check_symbol,mySimPro())

實現替換函數：

class mySimPro(angr.SimProcedure):def run(self,user_input,user_input_length):angr_bvs=self.state.memory.load(user_input,user_input_length)desired='ORSDDWXHZURJRBDH'return claripy.If(desired==angr_bvs,claripy.BVV(1,32),claripy.BVV(0,32))

腳本

import angr import sys import claripy def main(argv):bin_path=argv[1]p=angr.Project(bin_path)init_state=p.factory.entry_state()class mySimPro(angr.SimProcedure):def run(self,user_input,user_input_length):angr_bvs=self.state.memory.load(user_input,user_input_length)desired='ORSDDWXHZURJRBDH'return claripy.If(desired==angr_bvs,claripy.BVV(1,32),claripy.BVV(0,32))check_symbol='check_equals_ORSDDWXHZURJRBDH'p.hook_symbol(check_symbol,mySimPro())sm=p.factory.simgr(init_state)def is_good(state):return b'Good Job.' in state.posix.dumps(1)def is_bad(state):return b'Try again.' in state.posix.dumps(1)sm.explore(find=is_good,avoid=is_bad)if sm.found:found_state=sm.found[0]password=found_state.posix.dumps(0)print("Solution:{}".format(password.decode("utf-8")))else:raise Exception("Solution not found")if __name__=='__main__':main(sys.argv)

MSWKNJNAVTTOZMRY

驗證

總結

以上是生活随笔為你收集整理的angr学习笔记（11）（SimProcedure）的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。