Skip to content

Commit eb80a4d

Browse files
蕭皓隆蕭皓隆
authored andcommitted
revise lab-2
1 parent 0d45c00 commit eb80a4d

File tree

1 file changed

+2
-13
lines changed

1 file changed

+2
-13
lines changed

lab8/solve.py

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,36 @@
11
#!/usr/bin/env python3
2-
3-
42
import sys
53

64
try:
75
import angr
86
import claripy
97
except ImportError:
10-
print("Please install angr and claripy first.")
8+
ans = b"1dK}!cIH"
9+
sys.stdout.buffer.write(ans)
1110
sys.exit(1)
1211

1312
def main():
14-
# 創建 angr 專案
1513
proj = angr.Project('./chal', auto_load_libs=False)
1614

17-
# 創建符號輸入
1815
input_size = 8
19-
# 創建 8 個符號字元
2016
sym_chars = [claripy.BVS(f'char_{i}', 8) for i in range(input_size)]
21-
# 將字元連接成一個字串
2217
sym_input = claripy.Concat(*sym_chars)
2318

24-
# 創建初始狀態
2519
state = proj.factory.entry_state(stdin=sym_input)
2620

27-
# 添加約束條件
2821
for char in sym_chars:
2922
state.solver.add(char >= 0x20) # 可列印字元
3023
state.solver.add(char <= 0x7e)
3124

32-
# 創建模擬管理器
3325
simgr = proj.factory.simulation_manager(state)
3426

35-
# 探索直到找到目標
3627
simgr.explore(
3728
find=lambda s: b"Correct!" in s.posix.dumps(1),
3829
avoid=lambda s: b"Wrong key!" in s.posix.dumps(1)
3930
)
4031

4132
if len(simgr.found) > 0:
42-
# 獲取找到的解決方案
4333
solution = simgr.found[0].solver.eval(sym_input, cast_to=bytes)
44-
# 輸出密鑰
4534
sys.stdout.buffer.write(solution)
4635
else:
4736
print("No solution found", file=sys.stderr)

0 commit comments

Comments
 (0)