<reponame>moshekaplan/angr_playing
import angr

def symbolize_int():
    # This is the address right after the call to atoi()
    BEFORE_IS_MAGICAL_CALL_ADDR = 0x080484B9
    FIND_ADDR = 0x080484CE
    AVOID_ADDR = 0x080484E0

    # Load the binary
    proj = angr.Project('magic_number', load_options={'auto_load_libs':False})
    # Start right before the data comes in:
    state = proj.factory.blank_state(addr=BEFORE_IS_MAGICAL_CALL_ADDR)

    # Approach 1 - create a symbolic value for eax.
    number = state.se.BVS("number", 8 * 4)
    state.regs.eax = number
    # Create a path group 
    path_group = proj.factory.path_group(state)
    # Step until the explorer finds one of the addresses we are looking for or all paths are deadended
    path_group.explore(find=FIND_ADDR, avoid=AVOID_ADDR)

    solution_path = path_group.found[0]
    solution_state = solution_path.state

    print solution_state.se.any_int(number)
    # prints 874742785
    """
    (venv) ./magic_number 874742785
    Your number is magical!
    """

def symbolize_stack_param():
    # This is the address right before the call to is_magical()
    BEFORE_IS_MAGICAL_CALL_ADDR = 0x080484C2
    FIND_ADDR = 0x080484CE
    AVOID_ADDR = 0x080484E0

    # Load the binary
    proj = angr.Project('magic_number', load_options={'auto_load_libs':False})
    # Start right before the data comes in:
    state = proj.factory.blank_state(addr=BEFORE_IS_MAGICAL_CALL_ADDR)

    # Approach 2 - create a symbolic value for the parameter.
    number = state.se.BVS("number", 8 * 4)
    state.stack_push(number)
    # Create a path group 
    path_group = proj.factory.path_group(state)
    # Step until the explorer finds one of the addresses we are looking for or all paths are deadended
    path_group.explore(find=FIND_ADDR, avoid=AVOID_ADDR)

    solution_path = path_group.found[0]
    solution_state = solution_path.state

    print solution_state.se.any_int(number)
    # prints 874742785
    """
    (venv) ./magic_number 874742785
    Your number is magical!
    """

symbolize_int()
symbolize_stack_param()

import angr

def symbolize_int():
    # This is the address right after the call to atoi()
    BEFORE_IS_MAGICAL_CALL_ADDR = 0x080484B9
    FIND_ADDR = 0x080484CE
    AVOID_ADDR = 0x080484E0

    # Load the binary
    proj = angr.Project('magic_number', load_options={'auto_load_libs':False})
    # Start right before the data comes in:
    state = proj.factory.blank_state(addr=BEFORE_IS_MAGICAL_CALL_ADDR)

    # Approach 1 - create a symbolic value for eax.
    number = state.se.BVS("number", 8 * 4)
    state.regs.eax = number
    # Create a path group 
    path_group = proj.factory.path_group(state)
    # Step until the explorer finds one of the addresses we are looking for or all paths are deadended
    path_group.explore(find=FIND_ADDR, avoid=AVOID_ADDR)

    solution_path = path_group.found[0]
    solution_state = solution_path.state

    print solution_state.se.any_int(number)
    # prints 874742785
    """
    (venv) ./magic_number 874742785
    Your number is magical!
    """

def symbolize_stack_param():
    # This is the address right before the call to is_magical()
    BEFORE_IS_MAGICAL_CALL_ADDR = 0x080484C2
    FIND_ADDR = 0x080484CE
    AVOID_ADDR = 0x080484E0

    # Load the binary
    proj = angr.Project('magic_number', load_options={'auto_load_libs':False})
    # Start right before the data comes in:
    state = proj.factory.blank_state(addr=BEFORE_IS_MAGICAL_CALL_ADDR)

    # Approach 2 - create a symbolic value for the parameter.
    number = state.se.BVS("number", 8 * 4)
    state.stack_push(number)
    # Create a path group 
    path_group = proj.factory.path_group(state)
    # Step until the explorer finds one of the addresses we are looking for or all paths are deadended
    path_group.explore(find=FIND_ADDR, avoid=AVOID_ADDR)

    solution_path = path_group.found[0]
    solution_state = solution_path.state

    print solution_state.se.any_int(number)
    # prints 874742785
    """
    (venv) ./magic_number 874742785
    Your number is magical!
    """

symbolize_int()
symbolize_stack_param()
# This is the address right after the call to atoi() # Load the binary # Start right before the data comes in: # Approach 1 - create a symbolic value for eax. # Create a path group # Step until the explorer finds one of the addresses we are looking for or all paths are deadended # prints 874742785 (venv) ./magic_number 874742785
     Your number is magical! # This is the address right before the call to is_magical() # Load the binary # Start right before the data comes in: # Approach 2 - create a symbolic value for the parameter. # Create a path group # Step until the explorer finds one of the addresses we are looking for or all paths are deadended # prints 874742785 (venv) ./magic_number 874742785
     Your number is magical!