ANGR
this is a challnge from the last picoctf 2024 its named crackme101
import angr
import claripy
import sys
proj = angr.Project("./crackme100", auto_load_libs=False)
flag = claripy.BVS('flag', 8*50)
state = proj.factory.full_init_state(
add_options=angr.options.unicorn,
stdin=angr.SimPackets(name='stdin', content=[(flag, 50)]),
#remove_options={angr.options.LAZY_SOLVES}
)
for i in range(50):
state.solver.add(flag.get_byte(i) >=b'a')
state.solver.add(flag.get_byte(i) <=b'z')
def is_successful(state):
stdout_output = state.posix.dumps(sys.stdout.fileno())
return b"SUCCESS" in stdout_output
def should_abort(state):
stdout_output = state.posix.dumps(sys.stdout.fileno())
return b"FAILED!" in stdout_output
sm = proj.factory.simulation_manager(state)
sm.explore(find=is_successful, avoid=should_abort)
sm.run()
if sm.found:
sol = sm.found[0]
print(sol.posix.dumps(sys.stdin.fileno()))
else:
print("no sol")