Tags: baby angr reverse
Rating: 1.2
I was lazy, sorry :
```
#!/usr/bin/env python
# coding: utf-8
import angr
import claripy
import time
def main():
p = angr.Project('./chall')
flag_chars = [claripy.BVS('flag{%d}' % i, 8) for i in range(46)]
flag = claripy.Concat(*flag_chars + [claripy.BVV(b'\n')] )
st = p.factory.full_init_state(
args=['./chall'],
stdin=flag,
)
for k in flag_chars:
st.solver.add(k != 0)
st.solver.add(k != 10)
st.solver.add(k >= 32)
st.solver.add(k <= 128)
sm = p.factory.simulation_manager(st)
sm.run()
for pp in sm.deadended:
stdin = pp.posix.dumps(0)
stdout = pp.posix.dumps(1)
if 'Yay!' in stdout:
print stdin
if __name__ == "__main__":
main()
```
