how to use angr to solve ctf problem while the target elf has PIE?
See original GitHub issueI try to solve this ctf challenage with angr,but find it has PIE with checksec,I try to solve it with below code,but it does not give me the answer,can you help me?
import angr
main = 0xe04
find = (0x10c8,)
avoid = (0x10bc,)
p = angr.Project('./my_secret')
#state = p.factory.entry_state()
state= p.factory.blank_state(addr=main)
state.posix.files[0].read_from(30)
pg = p.factory.simgr(state, threads=8)
ex = pg.explore(find=find, avoid=avoid)
#ex=pg.explore(find=lambda s:"it is my secret" in s.posix.dumps(1))
output = ex.found[0].posix.dumps(1)
print(output)
inp = ex.found[0].posix.files[0].all_bytes()
print ex.found[0].solver.eval(inp,cast_to = str)
Issue Analytics
- State:
- Created 6 years ago
- Comments:8 (6 by maintainers)
Top Results From Across the Web
More angr - Defeating 5 ELF Crackmes - Binary Research
The purpose of this post is to demonstrate how emulation can be used to quickly find solutions to simple keygenme-style programs.
Read more >Examples - angr Documentation
These are examples that use angr to solve reverse engineering challenges. There are a lot of these. We've chosen the most unique ones,...
Read more >Google CTF - BEGINNER Reverse Engineering w/ ANGR
Hang with our community on Discord! https://johnhammond.org/discordIf you would like to support me, please like, comment & subscribe, ...
Read more >CTFtime.org / InCTF 2020 / ArchRide / Writeup
First part seems reasonably simple -> we could use Z3 or just angr to solve this. It somewhat works, but it turns out...
Read more >[Symbolic Execution 0x0] Solving easy CTFs with Angr and ...
The following example shows a CTF challenge I got form a random site, to spare the contestants of the site I won't mention...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
angr automatically loads PIE binaries at 0x400000. angr has no trouble dealing with PIE binaries.
I think the more pressing issue after “angr cannot just solve this binary outright” is that you’re using addresses copied from IDA - in the case of PIEs, IDA will load the binary at a base address of 0 while angr will load it at a base address of 0x400000. You see a warning about this when loading a PIE in angr.