From 04b26b8e293adcbd2810b568c88320e8d7d69153 Mon Sep 17 00:00:00 2001 From: sa-llo Date: Sat, 17 May 2025 17:16:39 +0800 Subject: [PATCH 1/3] tried solving it, still failed using validate script --- lab8/solve.py | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index 9ab3ee2..2d305cf 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -1,11 +1,38 @@ #!/usr/bin/env python3 -import angr,sys +import angr +import claripy +import sys def main(): - secret_key = b"" - sys.stdout.buffer.write(secret_key) + project = angr.Project('./chal', auto_load_libs=False) + + input_len = 8 + input_chars = [claripy.BVS('', 8) for _ in range(input_len)] + sym_input = claripy.Concat(*input_chars) + + # Explicitly use SimFileStream with has_end=False + stdin_stream = angr.SimFileStream(name='stdin', content=sym_input, has_end=False) + + state = project.factory.full_init_state(stdin=stdin_stream) + + + for c in input_chars: + state.solver.add(c >= 0x20) + state.solver.add(c <= 0x7e) + + simgr = project.factory.simgr(state) + + def is_successful(state): + return b"Correct!" in state.posix.dumps(1) + + simgr.explore(find=is_successful) + + if simgr.found: + found = simgr.found[0] + result = found.solver.eval(sym_input, cast_to=bytes) + sys.stdout.buffer.write(result) if __name__ == '__main__': - main() + main() \ No newline at end of file From 940d3980a34077234834e79027768d05b3f8ddd6 Mon Sep 17 00:00:00 2001 From: sa-llo Date: Sat, 17 May 2025 17:25:42 +0800 Subject: [PATCH 2/3] tried solving it, still failed using validate script --- lab8/solve.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index 2d305cf..1e8e373 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -9,12 +9,12 @@ def main(): input_len = 8 input_chars = [claripy.BVS('', 8) for _ in range(input_len)] - sym_input = claripy.Concat(*input_chars) + sym_input = claripy.Concat(*input_chars, claripy.BVV(0, 8)) # Explicitly use SimFileStream with has_end=False stdin_stream = angr.SimFileStream(name='stdin', content=sym_input, has_end=False) - state = project.factory.full_init_state(stdin=stdin_stream) + state = project.factory.entry_state(stdin=stdin_stream) for c in input_chars: @@ -29,9 +29,10 @@ def is_successful(state): simgr.explore(find=is_successful) if simgr.found: - found = simgr.found[0] - result = found.solver.eval(sym_input, cast_to=bytes) - sys.stdout.buffer.write(result) + sol = simgr.found[0].solver.eval(claripy.Concat(*input_chars), cast_to=bytes) + print(sol.decode(), end='') + else: + print("[-] No solution found.", end='') if __name__ == '__main__': From c16e0eea8c7ef61340c13dde582bbfecc4a209c7 Mon Sep 17 00:00:00 2001 From: sa-llo Date: Sat, 17 May 2025 17:27:55 +0800 Subject: [PATCH 3/3] tried solving it, still failed using validate script --- lab8/solve.py | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index 1e8e373..082f2d2 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -8,32 +8,27 @@ def main(): project = angr.Project('./chal', auto_load_libs=False) input_len = 8 - input_chars = [claripy.BVS('', 8) for _ in range(input_len)] - sym_input = claripy.Concat(*input_chars, claripy.BVV(0, 8)) + chars = [claripy.BVS('', 8) for _ in range(input_len)] + buf = claripy.Concat(*chars, claripy.BVV(0, 8)) # Add null terminator! - # Explicitly use SimFileStream with has_end=False - stdin_stream = angr.SimFileStream(name='stdin', content=sym_input, has_end=False) + state = project.factory.entry_state(stdin=buf) - state = project.factory.entry_state(stdin=stdin_stream) - - - for c in input_chars: - state.solver.add(c >= 0x20) - state.solver.add(c <= 0x7e) + for c in chars: + state.solver.add(c >= 0x20) + state.solver.add(c <= 0x7e) simgr = project.factory.simgr(state) - def is_successful(state): - return b"Correct!" in state.posix.dumps(1) - - simgr.explore(find=is_successful) + simgr.explore( + find=lambda s: b"Correct!" in s.posix.dumps(1), + avoid=lambda s: b"Wrong key" in s.posix.dumps(1) + ) if simgr.found: - sol = simgr.found[0].solver.eval(claripy.Concat(*input_chars), cast_to=bytes) - print(sol.decode(), end='') + sol = simgr.found[0].solver.eval(buf, cast_to=bytes) + print(sol.decode(), end='') # Print cleanly else: print("[-] No solution found.", end='') - if __name__ == '__main__': - main() \ No newline at end of file + main()