@@ -8,27 +8,25 @@ def main():
88 project = angr .Project ('./chal' , auto_load_libs = False )
99
1010 input_len = 8
11- chars = [claripy .BVS ('' , 8 ) for _ in range (input_len )]
12- buf = claripy .Concat (* chars , claripy .BVV (0 , 8 )) # Add null terminator!
11+ input_chars = [claripy .BVS ('' , 8 ) for _ in range (input_len )]
12+ sym_input = claripy .Concat (* input_chars )
13+ full_input = claripy .Concat (sym_input , claripy .BVV (0 , 8 ))
1314
14- state = project .factory .entry_state (stdin = buf )
15+ state = project .factory .entry_state (stdin = full_input )
1516
16- for c in chars :
17+ for c in input_chars :
1718 state .solver .add (c >= 0x20 )
1819 state .solver .add (c <= 0x7e )
1920
2021 simgr = project .factory .simgr (state )
21-
2222 simgr .explore (
23- find = lambda s : b"Correct! " in s .posix .dumps (1 ),
23+ find = lambda s : b"CTF{ " in s .posix .dumps (1 ),
2424 avoid = lambda s : b"Wrong key" in s .posix .dumps (1 )
2525 )
2626
2727 if simgr .found :
28- sol = simgr .found [0 ].solver .eval (buf , cast_to = bytes )
29- print (sol .decode (), end = '' ) # Print cleanly
30- else :
31- print ("[-] No solution found." , end = '' )
28+ solution = simgr .found [0 ].solver .eval (sym_input , cast_to = bytes )
29+ print (solution .decode (), end = '' )
3230
3331if __name__ == '__main__' :
3432 main ()
0 commit comments