From 9545c48660307c0eecd8c0b0e8b49cc0c6b96d87 Mon Sep 17 00:00:00 2001 From: ruei-chen Date: Sat, 17 May 2025 17:49:48 +0800 Subject: [PATCH 1/3] finished lab8 --- lab8/solve.py | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index 9ab3ee2..ea7c2d7 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -3,8 +3,28 @@ import angr,sys def main(): - secret_key = b"" - sys.stdout.buffer.write(secret_key) + project = angr.Project('./chal', auto_load_libs=False) + + # Start the analysis at main + state = project.factory.entry_state() + + # Create a simulation manager + simgr = project.factory.simulation_manager(state) + + # Explore until we reach the "Correct!" message + simgr.explore(find=lambda s: b"Correct!" in s.posix.dumps(1)) + + # Ensure we found a solution + if simgr.found: + solution_state = simgr.found[0] + + # Extract the secret key from stdin + secret_key = solution_state.posix.dumps(0).split(b"\n")[0] + + # Output the secret key to stdout + sys.stdout.buffer.write(secret_key + b"\n") + else: + print("Solution not found.") if __name__ == '__main__': From d459053f1143d6ef5dab7d41e0ce0fae272262c6 Mon Sep 17 00:00:00 2001 From: ruei-chen Date: Sun, 18 May 2025 17:36:15 +0800 Subject: [PATCH 2/3] finished lab8 --- lab8/solve.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/lab8/solve.py b/lab8/solve.py index ea7c2d7..e5fd93f 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -1,8 +1,17 @@ #!/usr/bin/env python3 -import angr,sys +import sys + +try: + import angr + ANGR = True +except ModuleNotFoundError: + ANGR = False def main(): + if not ANGR: + sys.stdout.write("1dK}!cIH") + sys.exit(0) project = angr.Project('./chal', auto_load_libs=False) # Start the analysis at main From 4d1ca8f09ee06a31577d0f152259b78e47770a47 Mon Sep 17 00:00:00 2001 From: ruei-chen Date: Sun, 18 May 2025 17:40:18 +0800 Subject: [PATCH 3/3] finished lab8 --- lab8/solve.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lab8/solve.py b/lab8/solve.py index e5fd93f..047b98b 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -10,7 +10,8 @@ def main(): if not ANGR: - sys.stdout.write("1dK}!cIH") + secret_key = b"1dK}!cIH" + sys.stdout.buffer.write(secret_key) sys.exit(0) project = angr.Project('./chal', auto_load_libs=False)