Skip to content

Commit be02417

Browse files
committed
tried solving it, still failed using validate script
1 parent c16e0ee commit be02417

1 file changed

Lines changed: 8 additions & 10 deletions

File tree

lab8/solve.py

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,27 +8,25 @@ def main():
88
project = angr.Project('./chal', auto_load_libs=False)
99

1010
input_len = 8
11-
chars = [claripy.BVS('', 8) for _ in range(input_len)]
12-
buf = claripy.Concat(*chars, claripy.BVV(0, 8)) # Add null terminator!
11+
input_chars = [claripy.BVS('', 8) for _ in range(input_len)]
12+
sym_input = claripy.Concat(*input_chars)
13+
full_input = claripy.Concat(sym_input, claripy.BVV(0, 8))
1314

14-
state = project.factory.entry_state(stdin=buf)
15+
state = project.factory.entry_state(stdin=full_input)
1516

16-
for c in chars:
17+
for c in input_chars:
1718
state.solver.add(c >= 0x20)
1819
state.solver.add(c <= 0x7e)
1920

2021
simgr = project.factory.simgr(state)
21-
2222
simgr.explore(
23-
find=lambda s: b"Correct!" in s.posix.dumps(1),
23+
find=lambda s: b"CTF{" in s.posix.dumps(1),
2424
avoid=lambda s: b"Wrong key" in s.posix.dumps(1)
2525
)
2626

2727
if simgr.found:
28-
sol = simgr.found[0].solver.eval(buf, cast_to=bytes)
29-
print(sol.decode(), end='') # Print cleanly
30-
else:
31-
print("[-] No solution found.", end='')
28+
solution = simgr.found[0].solver.eval(sym_input, cast_to=bytes)
29+
print(solution.decode(), end='')
3230

3331
if __name__ == '__main__':
3432
main()

0 commit comments

Comments
 (0)