angr cannot find the answer for fauxware written in c++

Hi, I wrote a simplified version of fauxware both in C and in C++, which only checks a password. However angr was not able to find the password, SOSNEAKY, for the one written in c++. Is this because angr does not fully support stdlibc++ yet or I might be doing something wrong?

// fauxware2.c - A simplified fauxware written in C
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

char *sneaky = "SOSNEAKY";

int authenticate(char *password) {
	// evil back d00r
	if (strcmp(password, sneaky) == 0) 
		return 1;
	else
		return 0;
}

int accepted() {
	printf("Welcome to the admin console, trusted user!\n");
}

int rejected() {
	printf("Go away!");
	exit(1);
}

int main(int argc, char **argv) {
	char username[9];
	char password[9];
	int authed;

	username[8] = 0;
	password[8] = 0;

	printf("Username: \n");
	read(0, username, 8);
	printf("Password: \n");
	read(0, password, 8);

	authed = authenticate(password);
	if (authed) 
            accepted();
	else 
            rejected();
    return 0;
}

Here is the same version of fauxware written in c++.

// fauxware.cc - A simplified fauxware written in C++
#include <iostream>
#include <cstring>
#include <cstdlib>

std::string sneaky = "SOSNEAKY";

int authenticate(std::string username, std::string password) {
	// evil back d00r
	if (std::strcmp(password.c_str(), sneaky.c_str()) == 0) 
           return 1;
	else
	   return 0;
}

int accepted() {
	std::cout << "Welcome to the admin console, trusted user!\n";
}

int rejected() {
	std::cout << "Go away!";
	exit(1);
}

int main(int argc, char **argv) {
	std::string username;
	std::string password;
	int authed;

	std::cout<<"Username: \n";
        getline(std::cin, username);
	std::cout<<"Password: \n";
        getline(std::cin, password);

	authed = authenticate(username, password);
	if (authed) 
            accepted();
	else 
            rejected();

    return 0;
}

And I set auto_load_libs as True when loading a binary and used full_init_state instead of entry_state when initializing a state.

import angr

def fauxware(binpath):
    p = angr.Project(binpath, load_options={"auto_load_libs": True})

    simFile = angr.SimFile('/dev/stdin')
    state = p.factory.full_init_state(stdin=simFile)

    while True:
        succ = state.step()
        if len(succ.successors) == 2:
            break
        state = succ.successors[0]

    state1, state2 = succ.successors
    input_data = state1.posix.stdin.load(0, state.posix.stdin.size)
    print state1.solver.eval(input_data, cast_to=str)
    print state2.solver.eval(input_data, cast_to=str)

if __name__ == '__main__':
    fauxware('fauxware2')
    fauxware('fauxware_cc')

Note that both were compiled with gcc and ld.bfd in ELF executable for x86-64, and dynamically linked. Thanks!

[ltfish]

angr does not have enough function summaries (SimProcedures) implemented for C++. We also did not spend enough time implementing and testing the support of C++ programs of angr.

[rhelmot]

I just pushed a fix for that bug, which had already been reported as #1167.

Yes, we will run initializers if you’re using a full_init_state.