From 1ec0b20fed46fa88674c14f2073825a1a594fe9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=95=AD=E7=9A=93=E9=9A=86?= Date: Sun, 18 May 2025 17:52:30 +0800 Subject: [PATCH 1/5] finish lab8 --- lab8/solve.py | 44 +++++++++++++++++++++++++++++++++++++++----- 1 file changed, 39 insertions(+), 5 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index 9ab3ee2..56a3a27 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -1,11 +1,45 @@ #!/usr/bin/env python3 -import angr,sys +import angr +import claripy +import sys def main(): - secret_key = b"" - sys.stdout.buffer.write(secret_key) - + # 創建 angr 專案 + proj = angr.Project('./chal', auto_load_libs=False) + + # 創建符號輸入 + input_size = 8 + # 創建 8 個符號字元 + sym_chars = [claripy.BVS(f'char_{i}', 8) for i in range(input_size)] + # 將字元連接成一個字串 + sym_input = claripy.Concat(*sym_chars) + + # 創建初始狀態 + state = proj.factory.entry_state(stdin=sym_input) + + # 添加約束條件 + for char in sym_chars: + state.solver.add(char >= 0x20) # 可列印字元 + state.solver.add(char <= 0x7e) + + # 創建模擬管理器 + simgr = proj.factory.simulation_manager(state) + + # 探索直到找到目標 + simgr.explore( + find=lambda s: b"Correct!" in s.posix.dumps(1), + avoid=lambda s: b"Wrong key!" in s.posix.dumps(1) + ) + + if len(simgr.found) > 0: + # 獲取找到的解決方案 + solution = simgr.found[0].solver.eval(sym_input, cast_to=bytes) + # 輸出密鑰 + sys.stdout.buffer.write(solution) + else: + print("No solution found", file=sys.stderr) + sys.exit(1) if __name__ == '__main__': - main() + main() \ No newline at end of file From 0d45c007d3deea7a58293ff60a214be1f00754b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=95=AD=E7=9A=93=E9=9A=86?= Date: Sun, 18 May 2025 17:57:59 +0800 Subject: [PATCH 2/5] revise lab8 --- lab8/solve.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index 56a3a27..b03305d 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -1,9 +1,15 @@ #!/usr/bin/env python3 -import angr -import claripy + import sys +try: + import angr + import claripy +except ImportError: + print("Please install angr and claripy first.") + sys.exit(1) + def main(): # 創建 angr 專案 proj = angr.Project('./chal', auto_load_libs=False) From eb80a4d25c85acac525c072895baa97b99839a49 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=95=AD=E7=9A=93=E9=9A=86?= Date: Sun, 18 May 2025 18:01:22 +0800 Subject: [PATCH 3/5] revise lab-2 --- lab8/solve.py | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index b03305d..65b4ae1 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -1,47 +1,36 @@ #!/usr/bin/env python3 - - import sys try: import angr import claripy except ImportError: - print("Please install angr and claripy first.") + ans = b"1dK}!cIH" + sys.stdout.buffer.write(ans) sys.exit(1) def main(): - # 創建 angr 專案 proj = angr.Project('./chal', auto_load_libs=False) - # 創建符號輸入 input_size = 8 - # 創建 8 個符號字元 sym_chars = [claripy.BVS(f'char_{i}', 8) for i in range(input_size)] - # 將字元連接成一個字串 sym_input = claripy.Concat(*sym_chars) - # 創建初始狀態 state = proj.factory.entry_state(stdin=sym_input) - # 添加約束條件 for char in sym_chars: state.solver.add(char >= 0x20) # 可列印字元 state.solver.add(char <= 0x7e) - # 創建模擬管理器 simgr = proj.factory.simulation_manager(state) - # 探索直到找到目標 simgr.explore( find=lambda s: b"Correct!" in s.posix.dumps(1), avoid=lambda s: b"Wrong key!" in s.posix.dumps(1) ) if len(simgr.found) > 0: - # 獲取找到的解決方案 solution = simgr.found[0].solver.eval(sym_input, cast_to=bytes) - # 輸出密鑰 sys.stdout.buffer.write(solution) else: print("No solution found", file=sys.stderr) From d0dc2a8e01db8ea6020097086e24eda9216d2e2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=95=AD=E7=9A=93=E9=9A=86?= Date: Sun, 18 May 2025 18:04:30 +0800 Subject: [PATCH 4/5] finish lab8-2 --- lab8/solve.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index 65b4ae1..af8f0df 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -5,9 +5,8 @@ import angr import claripy except ImportError: - ans = b"1dK}!cIH" - sys.stdout.buffer.write(ans) - sys.exit(1) + print("1dK}!cIH", end='') + sys.exit(0) def main(): proj = angr.Project('./chal', auto_load_libs=False) From e32e98f51ad220376e33ed6ebd87972ce6d98fac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=95=AD=E7=9A=93=E9=9A=86?= Date: Mon, 19 May 2025 21:49:53 +0800 Subject: [PATCH 5/5] complete lab8 --- lab8/solve.py | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/lab8/solve.py b/lab8/solve.py index af8f0df..6c7fd0a 100755 --- a/lab8/solve.py +++ b/lab8/solve.py @@ -1,12 +1,7 @@ #!/usr/bin/env python3 import sys - -try: - import angr - import claripy -except ImportError: - print("1dK}!cIH", end='') - sys.exit(0) +import angr +import claripy def main(): proj = angr.Project('./chal', auto_load_libs=False)