angr进阶（5）内存操作

angr也可以将符号写在内存里，控制内存中的值，结合任意位置开始有奇效，但就是慢sym-write

    p = angr.Project('./issue', load_options={"auto_load_libs": False})
    state = p.factory.entry_state(add_options={angr.options.SYMBOLIC_WRITE_ADDRESSES})
    u = claripy.BVS("u", 8)
    state.memory.store(0x804a021, u)

 因为最近好像要开始0ctf了，再分析一道0ctf的题目，0ctf_trace

这个题目两个文件，一个.bin的看起来像是二进制文件，其中trace是MIPS指令集。上万行，头大。

首先通过grep jal可以得到所调用的所有函数的起始地址，接着grep jr r31得到函数的结束地址

trace中总共三个函数，有一个函数运行了100多次，虽然每个函数还是很长就是了

然后分析函数得到Flag的地址，程序首先对常量字符初始化了，然后加上了一串未知字符串，就是flag

#!/usr/bin/env python2

from __future__ import print_function
import struct
import angr

MAIN_START = 0x4009d4
MAIN_END = 0x00400c18

FLAG_LOCATION = 0x400D80
FLAG_PTR_LOCATION = 0x410EA0

def load_trace():
    res = []
    delay_slots = set()
    with open("./trace_8339a701aae26588966ad9efa0815a0a.log") as f:
        for line in f:
            if line.startswith('[INFO]'):
                addr = int(line[6:6+8], 16)

                res.append(addr)

                if ("move r1, r1" in line):
                    delay_slots.add(addr)

    return res, delay_slots

def main():
    trace_log, delay_slots = load_trace()

    project = angr.Project("./data.bin", load_options={
        'main_opts': {
            'backend': 'blob',
            'base_addr': 0x400770,
            'arch': 'mipsel',
        },
    })

    state = project.factory.blank_state(addr=MAIN_START)
    state.memory.store(FLAG_LOCATION, state.solver.BVS("flag", 8*32))
    state.memory.store(FLAG_PTR_LOCATION, struct.pack("<I", FLAG_LOCATION))

    sm = project.factory.simulation_manager(state)
    choices = [state]

    print("Tracing...")
    for i, addr in enumerate(trace_log):
        if addr in delay_slots:
            continue

        for s in choices:
            if s.addr == addr:
                break

        else:
            raise ValueError("couldn't advance to %08x, line %d" % (addr, i+1))

        if s.addr == MAIN_END:
            break

        if s.addr + 4 in delay_slots:
            choices = project.factory.successors(s, num_inst=2).successors
        else:
            choices = project.factory.successors(s, num_inst=1).successors

    state = s

    print("Running solver...")

    solution = state.solver.eval(state.memory.load(FLAG_LOCATION, 32), cast_to=bytes).rstrip(b'').decode('ascii')
    print("The flag is", solution)

    return solution

def test():
    assert main() == "0ctf{tr135m1k5l96551s9l5r}"

if __name__ == "__main__":
    main()