# angrybird (RE 125)
###ENG
We are faced with x64 ELF binary.
Binary is obviously corrupted - it exits right at the beginning. Unfortunatelly I don't have non-patched binary anymore,but I had to NOP a lot of code at the beginning:
```asm55                push    rbp48 89 E5          mov     rbp, rsp48 83 C4 80       add     rsp, 0FFFFFFFFFFFFFF80h64 48 8B 04 25 28+mov     rax, fs:28h48 89 45 F8       mov     [rbp+var_8], rax90                nop90                nop90                nop90                nop90                nop90                nop90                nop90                nop90                nop90                nop90                nop48 C7 45 90 18 60+mov     [rbp+var_70], offset strncmpp48 C7 45 98 20 60+mov     [rbp+var_68], offset putsp48 C7 45 A0 28 60+mov     [rbp+var_60], offset stack_chk_fail48 C7 45 A8 38 60+mov     [rbp+var_58], offset startmainB8 00 00 00 00    mov     eax, 0E8 4B FF FF FF    call    should_return_2189 45 8C          mov     [rbp+n], eaxB8 00 00 00 00    mov     eax, 090                nop90                nop90                nop90                nop90                nopB8 00 00 00 00    mov     eax, 0```
And patch function `should return 21` (because according to debug string, it should return 21):
```asm                  should_return_21 proc near55                push    rbp48 89 E5          mov     rbp, rspBF 64 50 40 00    mov     edi, offset s   ; "you should return 21 not 1 :("E8 8C FE FF FF    call    _puts8B 05 56 59 20 00 mov     eax, cs:const_15D                pop     rbpC3                retn                  should_return_21 endp```
Now binary is working correctly: it reads flag, and does a lot of checks, one char at a time:
![](./screen1.png)
This looks easy enough, right?Well, let's zoom out:
![](./screen2.png)
Wait, what? Let's zoom out even more:
![](./screen3.png)
`O_o`.
Ok, we might need to do this more intelligently.
Turns out that if you think hard enough, everything is trivial. Or maybe just angr creators are genius, I don't know.Anyway, I created this very basic angr script (my second angr experience ever):
```pythonimport angr
main = 0x4007DAfind = 0x404FABfind = 0x404FC1avoid = [0x400590]
p = angr.Project('./angrybird2')init = p.factory.blank_state(addr=main)pg = p.factory.path_group(init, threads=8)ex = pg.explore(find=find, avoid=avoid)
final = ex.found[0].stateflag = final.posix.dumps(0)
print("Flag: {0}".format(final.posix.dumps(1)))```
And, just like that, it worked (almost) first time and shown the flag:
```╭─msm@mercury /home/msm/codegate2017  ‹system›╰─$ python angrdo.pyWARNING | 2017-02-13 19:40:46,155 | simuvex.plugins.symbolic_memory | Concretizing symbolic length. Much sad; think about implementing.Flag: you typed : Im_so_cute&pretty_:) @  @@```