Tags: angr symbolic_execution 

Rating:

```
import angr
import claripy
import sys
project = angr.Project('./autorev_assemble')

input_ = claripy.BVS('input', 256)

init_state = project.factory.entry_state()

def is_successful(state):
stdout_output = state.posix.dumps(sys.stdout.fileno())
if b'SOLVED' in stdout_output:
return True
else: return False

def should_abort(state):
stdout_output = state.posix.dumps(sys.stdout.fileno())
if b'INSUFFICIENT' in stdout_output:
return True
else: return False

simulation = project.factory.simgr(init_state)

simulation.explore(find=is_successful,avoid= should_abort)

if simulation.found:
found = simulation.found[0]
print repr(found.state.posix.dumps(0))

```