Bomb CMU - Phase 6 - SimMemoryAddressError

Hello! I’m trying to solve phase 6 with angr but I get a lot of warnings like the following and angr actually never finishes the execution.

WARNING | 2016-12-21 23:09:53,895 | simuvex.vex.irsb | <SimIRSB 0x401176> hit an error while analyzing statement 3
SimMemoryAddressError: Unable to concretize address for load with the provided strategies.

What am I doing wrong?

This is the script I’ve done (still a WIP so some constraints are missing).

import angr, logging, claripy, simuvex
from IPython import embed

class custom_hook(simuvex.SimProcedure):
    def run(self, addr):
        for i in range(6):
            bvs = claripy.BVS("int{}".format(i), 8*4*6, explicit_name=True)
            self.state.add_constraints(bvs.get_bytes(0, 4) >= 1, bvs.get_bytes(0,4) <= 6)
            self.state.memory.store(bvs, addr+i*4, endness=self.state.arch.memory_endness)
        return addr

def solve_flag_6():
    start = 0x4010f4
    read_num = 0x40145c
    find = 0x4011f7
    avoid = (0x4011e9, 0x401140, 0x401123,)
        
    p = angr.Project("./bomb", load_options={'auto_load_libs':False})
    p.hook(read_num, custom_hook)
    state = p.factory.blank_state(addr=0x4010f4)
    pg = p.factory.path_group(state, threads=4)
    pg.explore(find=find, avoid=avoid)
    print(pg)
    return 0
    
def main():
    print("Flag 6:" + str(solve_flag_6()))

if __name__ == '__main__':
    logging.getLogger('angr.path_group').setLevel(logging.DEBUG)
    main()

Thanks guys!

[rhelmot]

Another thing @ocean1 didn’t mention is that your arguments to self.state.memory.store were incorrect. You said store(bvs, addr + i * 4), but it should actually be store(addr + i * 4, bvs).

[peperunas]

Closing the issue again since It could be related to an unfeasible path. My bad, sorry guys!