Phase 4 x86_64.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# x86_64: Phase 4"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Imports\n",
    "\n",
    "import angr\n",
    "import claripy"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We push the input values to the stack and then pop them right before the function exits. Since no value is pushed onto the stack during the execution of the function, we can safely manipulate the stack in the way we planned."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Load the binary."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "project = angr.Project('bomb64')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Define the address for the start of the execution path."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "# The address where the symbolic execution shall begin. It is the beginning of the func4 function.\n",
    "addr_start = 0x400FCE\n",
    "\n",
    "# The address of the return of func4.\n",
    "addr_target = 0x401007\n",
    "\n",
    "# The address of the first instruction of the explode_bomb function, which is to be avoided.\n",
    "addr_bomb = 0x40143A"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Define a blank state for the simulation, a state with most of it's data uninitialized. Pass the address where the state is initialized, along with the user input to be given via standard input."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [],
   "source": [
    "state = project.factory.blank_state(addr=addr_start)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Move a symbolic value into the relevant register."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [],
   "source": [
    "num_1 = claripy.BVS(\"num_1\", 32)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Setup the state of the registers as they were right before the function call."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [],
   "source": [
    "state.regs.edx = 0xE\n",
    "state.regs.esi = 0\n",
    "state.regs.edi = num_1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a simulation manager with this blank state that would help us manage the symbolic execution."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [],
   "source": [
    "simgr = project.factory.simulation_manager(state)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We call the explore method of the simulation manager, tasked with finding an execution path that reaches the target address and avoids the address which explodes the bomb."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "WARNING | 2020-06-15 04:17:44,537 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mThe program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:44,538 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mangr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:44,539 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32m1) setting a value to the initial state\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:44,540 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32m2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:44,542 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32m3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messages.\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:44,544 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 36 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:44,549 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 68 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:44,558 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 76 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<SimulationManager with 3 active, 1 found>"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "simgr.explore(find=addr_target, avoid=addr_bomb, enable_veritesting=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We dereference the execution path \"found\" by the simulation manager and dump the stack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [],
   "source": [
    "found = simgr.found[0]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "7"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "found.solver.eval(num_1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "This is the first number. Since we already know the second number is 0, the user input that passes the fourth phase is ```7 0```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's progressively add constraints to reach different possible end values. Add the constraint for the new value to be smaller than the one in previous iteration.\n",
    "\n",
    "In the form: state.solver.add(num_1 < x), where x is the integer value discovered in the previous iteration.\n",
    "\n",
    "Let's put it in a loop to get the all the values."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "WARNING | 2020-06-15 04:17:46,821 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 36 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:46,825 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 68 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:46,836 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 76 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "7 0\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "WARNING | 2020-06-15 04:17:48,801 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 36 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:48,802 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 68 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:48,813 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 76 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "3 0\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "WARNING | 2020-06-15 04:17:51,163 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 36 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:51,164 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 68 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:51,170 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 76 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "1 0\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "WARNING | 2020-06-15 04:17:53,566 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 36 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:53,567 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 68 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n",
      "WARNING | 2020-06-15 04:17:53,572 | \u001b[32mangr.state_plugins.symbolic_memory\u001b[0m | \u001b[32mFilling register 76 with 4 unconstrained bytes referenced from 0x400fce (func4+0x0 in bomb64 (0x400fce))\u001b[0m\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0 0\n"
     ]
    }
   ],
   "source": [
    "x = 10\n",
    "while x > 0:\n",
    "    \n",
    "    # Load the binary.\n",
    "    project = angr.Project('bomb64')\n",
    "\n",
    "    # Init the addresses.\n",
    "    addr_start = 0x400FCE\n",
    "    addr_target = 0x401007\n",
    "    addr_bomb = 0x40143A\n",
    "\n",
    "    \n",
    "    # Init a blank state.\n",
    "    state = project.factory.blank_state(addr=addr_start)\n",
    "\n",
    "    # Define the symbolic value.\n",
    "    num_1 = claripy.BVS(\"num_1\", 32)\n",
    "\n",
    "    # Setup the registers.\n",
    "    state.regs.edx = 0xE\n",
    "    state.regs.esi = 0\n",
    "    state.regs.edi = num_1\n",
    "    \n",
    "    # Add the constraint.\n",
    "    state.solver.add(num_1<x)\n",
    "    \n",
    "    # Init the simulation manager.\n",
    "    simgr = project.factory.simulation_manager(state)\n",
    "\n",
    "    # Let Angr explore.\n",
    "    simgr.explore(find=addr_target, avoid=addr_bomb, enable_veritesting=True)\n",
    "\n",
    "    # Get the answer from the found state.\n",
    "    found = simgr.found[0]\n",
    "    x = found.solver.eval(num_1)\n",
    "    print(x, \"0\")\n",
    "    "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "And there we go, more possible end values."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}