本文共 694 字，大约阅读时间需要 2 分钟。

angr系列

拖进ida

JXWVXRKX

代码1

import angrp=angr.Project("00_angr_find")init_state=p.factory.entry_state()sm=p.factory.simulation_manager(init_state)sm.explore(find=0x08048678,avoid=0x08048666)found_state=sm.found[0]print(found_state.posix.dumps(0))print(found_state.posix.dumps(1))

JXWVXRKX

代码2

import angrp=angr.Project("00_angr_find")init_state=p.factory.entry_state()sm=p.factory.simulation_manager(init_state)def is_good(state):        return b'Good Job' in state.posix.dumps(1)def is_bad(state):        return b'Try again' in state.posix.dumps(1)    sm.explore(find=is_good,avoid=is_bad)found_state=sm.found[0]print(found_state.posix.dumps(0))print(found_state.posix.dumps(1))

JXWVXRKX

验证

转载地址：http://itve.baihongyu.com/