import
angr
from
angrmanagement.utils.graph
import
to_supergraph
from
binascii
import
b2a_hex
def
get_system_addr(cfg):
for
func_addr
in
cfg.functions:
func
=
cfg.functions.get(func_addr)
if
func.name
=
=
'system'
:
return
func_addr
return
None
def
get_avoid_list(cfg, start, target):
if
start.addr
=
=
target:
return
(
True
, [])
succs
=
list
(cfg.successors(start))
if
len
(succs)
=
=
0
:
return
(
False
, [start.addr])
elif
len
(succs)
=
=
1
:
can_reach_target, avoid_list
=
get_avoid_list(cfg, succs[
0
], target)
if
can_reach_target:
return
(
True
, avoid_list)
else
:
avoid_list.append(start.addr)
return
(
False
, avoid_list)
elif
len
(succs)
=
=
2
:
can_reach_target0, avoid_list0
=
get_avoid_list(cfg, succs[
0
], target)
can_reach_target1, avoid_list1
=
get_avoid_list(cfg, succs[
1
], target)
if
can_reach_target0
and
can_reach_target1:
return
(
True
, [])
elif
not
can_reach_target0
and
not
can_reach_target1:
avoid_list
=
avoid_list0
+
avoid_list1
avoid_list.append(start.addr)
return
(
False
, avoid_list)
else
:
avoid_list
=
avoid_list0
+
avoid_list1
return
(
True
, avoid_list)
else
:
exit(
0
)
def
explore_func(proj, target_func, target_block, target_cfg):
can_reach_target, avoid_list
=
get_avoid_list(target_cfg,
list
(target_cfg.nodes)[
0
], target_block)
state
=
proj.factory.call_state(target_func)
simgr
=
proj.factory.simgr(state)
simgr.use_technique(angr.exploration_techniques.DFS())
simgr.explore(find
=
target_block, avoid
=
avoid_list)
payload_list
=
[]
for
found
in
simgr.found:
payload_list.append(found.posix.dumps(
0
))
return
payload_list
def
explore_payload(bin_path):
proj
=
angr.Project(bin_path, load_options
=
{
'auto_load_libs'
:
False
})
proj_cfg
=
proj.analyses.CFGFast()
system_addr
=
get_system_addr(proj_cfg)
if
system_addr
=
=
None
:
return
[]
print
(f
'Found system function in {hex(system_addr)}.'
)
payload_list
=
[]
for
func_addr
in
proj_cfg.functions:
try
:
func
=
proj_cfg.functions.get(func_addr)
cfg
=
func.transition_graph
cfg
=
to_supergraph(cfg)
for
node
in
cfg.nodes:
block
=
proj.factory.block(node.addr)
for
inst
in
block.capstone.insns:
if
inst.mnemonic
=
=
'call'
and
inst.op_str
=
=
hex
(system_addr):
target_func
=
func_addr
target_block
=
block.addr
target_cfg
=
cfg
print
(f
'Found target function in {hex(target_func)}'
)
print
(f
'Found target block in {hex(target_block)}'
)
payload_list
+
=
explore_func(proj, target_func, target_block, target_cfg)
except
Exception as ex:
print
(ex)
return
payload_list
def
angr_run():
payload_list
=
explore_payload(
'./bin1'
)
print
(payload_list)
for
payload
in
payload_list:
print
(
'payload='
+
b2a_hex(payload).decode())
angr_run()