ref:https://www.anquanke.com/post/id/212816#h3-9
Python国内镜像加速
1 2 3 4
| cd ~ mkdir ~/.pip cd ~/.pip vim pip.conf
|
在pip.conf填入下面内容
1 2 3 4
| [global] index-url = https://pypi.tuna.tsinghua.edu.cn/simple [install] trusted-host=mirrors.aliyun.com
|
angr安装与简单使用
安装
安装环境:
1
| sudo apt-get install python3-dev libffi-dev build-essential virtualenvwrapper
|
安装angr
1
| mkvirtualenv --python=$(which python3) angr && pip install angr
|
如果出现mkvirtualenv: command not found报错:
1 2
| sudo pip install virtualenv sudo pip install virtualenvwrapper
|
1 2 3 4 5
| cd ~/ vim .bashrc #在文末添加 export WORKON_HOME=~/.environments source /usr/share/virtualenvwrapper/virtualenvwrapper.sh
|
最后执行下面语句保存设置。
简单使用
因为是安装在虚拟环境的,所以在执行脚本前,先执行下面语句切换到虚拟环境。
1
| mkvirtualenv --python=$(which python3) angr
|
state |
explain |
.blank_state |
大多数数据未初始化,进入时返回没有约束的符号值 |
.entry state |
准备调用main之前的状态 |
.full_init_state |
共享库和预定义内容都已经加载完毕,在enter状态之前,例如刚刚加载完共享库 |
call_state |
准备调用函数的状态 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14
| import angr import sys path_to_binary = "./pwn" project = angr.Project(path_to_binary, auto_load_libs=False) initial_state = project.factory.entry_state() simulation = project.factory.simgr(initial_state) print_good_address = 0x00000000004008BD simulation.explore(find=print_good_address) if simulation.found: solution_state = simulation.found[0] solution = solution_state.posix.dumps(sys.stdin.fileno()) print("[+] Success! Solution is: {}".format(solution)) else: raise Exception('Could not find the solution')
|
避免路径爆炸:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
| import angr import sys path_to_binary = "./pwn" project = angr.Project(path_to_binary, auto_load_libs=False) initial_state = project.factory.blank_state(addr=0x4007d8) simulation = project.factory.simgr(initial_state) print_good_address = 0x00000000004008BD avoid_address = 0x4008d0 simulation.explore(find=print_good_address, avoid=avoid_address) if simulation.found: solution_state = simulation.found[0] solution = solution_state.posix.dumps(sys.stdin.fileno()) print("[+] Success! Solution is: {}".format(solution)) else: raise Exception('Could not find the solution')
|