zero-a-one/angrctf_fitm

Angr CTF From introduction to mastery

👋 Hi there, I am ...

😄 ZERO-A-ONE

🧑‍💻 Security Researcher | Developer | CTF Player

Education

🎓 Undergraduate - Fuzhou University [Project 211] (2018~2022): School of Computer and Big Data - Information Security

Work

🏢 HUAWEI TECHNOLOGIES CO.LTD. - HUAWEI Cloud BG (2021): Cloud Computing Development Engineer

🏢 Alibaba Cloud Intelligence - Chaitin Tech (2022~2024): Security Research Engineer

🏢 Xiaohongshu Inc. - Intelligence and Offensive Defense Lab (2024~): Mobile Security Development Engineer

Blog

📕 360 Blog (Stop updating) : 360 anquanke

📕 CSDN Blog : CSDN

Organization

⚔️ Member of ROIS (2018~Now): ::ROIS::

Publications

[ASE 2023] "Scene-Driven Exploration and GUI Modeling for Android Apps", Xiangyu Zhang, Lingling Fan*, Sen Chen, Yucheng Su, and Boyuan Li, In Proceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE 2023), 2023. （CCF A / SCI District 1）

angrctf_fitm's Issues

15_angr_arbitrary_read，本题有一个问题想请教一下

任意读这道题目，我的脚本如下

import angr
import sys
import claripy
def main(argv):
    path_to_binary = "./15_angr_arbitrary_read" 
    project = angr.Project(path_to_binary, auto_load_libs=False)
    initial_state = project.factory.entry_state()

    class ReplacementScanf(angr.SimProcedure):
        def run(self, format_string, key_address, v4_address):
            scanf0 = claripy.BVS('key', 32)
            scanf1 = claripy.BVS('v4', 20*8)
            for char in scanf1.chop(bits=8):
                self.state.add_constraints(char >= 0x20, char <= 0x7e)
            self.state.memory.store(key_address, scanf0, endness=project.arch.memory_endness)
            self.state.memory.store(v4_address, scanf1)

            self.state.globals['solutions'] = (scanf0, scanf1)

    scanf_symbol = '__isoc99_scanf'
    project.hook_symbol(scanf_symbol, ReplacementScanf())

    simulation = project.factory.simgr(initial_state)

    # 为什么这样直接暴力不能得到最终结果
    def is_successful(state):
        stdout_output = state.posix.dumps(1)
        return (b'Good Job.' in stdout_output)

    def should_abort(state):
        stdout_output = state.posix.dumps(1)
        return (b'Try again.' in stdout_output)

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        solution_state = simulation.found[0]
        (scanf0, scanf1) = solution_state.globals['solutions']
        solution0 = (solution_state.solver.eval(scanf0))
        solution1 = (solution_state.solver.eval(scanf1,cast_to=bytes))
        print("[+] Success! Solution is: {0} {1}".format(solution0, solution1))
    else:
        raise Exception('Could not find the solution')

if __name__ == "__main__":
    main(sys.argv)

主要修改的就是 is_successful 函数那里，我直接暴力地看看它输出有没有 Good Job. 但是请问为什么这样做是错的呢？