Tags: python angr 

Rating:

```
#!/usr/bin/env python

import angr

def dummy_function(state):
pass

flag_address = 0x6cee40
find = (0x00401694, )
avoid = (0x004016a0, )
checking_address = 0x00401378
function_addresses = (0x00400a62, 0x00400aa8, 0x00400aee, 0x00400b71, 0x00400bb7, 0x00400bfd, 0x00400c43, 0x00400c89, 0x00400ccf, 0x00400d15, 0x00400d5b, 0x00400da1, 0x00400de7, 0x00400e2d, 0x00400e73, 0x00400eb9, 0x00400eff, 0x00400f45, 0x00400f8b, 0x00400fd1, 0x00401017, 0x0040105d, 0x004010a3, 0x004010e9, 0x0040112f, 0x00401175, 0x004011bb, 0x00401201, 0x00401247, 0x0040128d, 0x004012d3, 0x00401319)

p = angr.Project("./rhapsody")

for function_address in function_addresses:
p.hook(function_address, dummy_function, length=5)

state = p.factory.blank_state(addr=checking_address)
flag = state.se.BVS("flag_string", 35 * 8)
state.memory.store(flag_address, flag)
pg = p.factory.path_group(state)
pg.explore(find=find, avoid=avoid)

if len(pg.found) > 0:
found_path = pg.found[0]
flag_found = found_path.state.se.any_str(flag)
print "Flag found: {}".format(flag_found)
else:
print "Try smarter!!!"
```