for v10 in range(66):
        v11 = v5
        v12 = (v5 + BOX[(v3 + v10) & 0x3F]) & 0x3F
        v13 = (v3 + 1) & 0x3F
        v14 = BOX[((result + BOX[v12 + 64]) & 0x3F) + 128]
        if(ans[j] == b64box[v14]):
            print(chr(b64box[v10]))
            BOX[192] = v13
            break
        elif(v10 == 65):
            print('erorr')
            exit(0)
    if(not v13):
      v5 = (v5 + 1) & 0x3F
      BOX[193] = v5
      if(((v11 + 1) & 0x3F) == 0):
        result = (result + 1) & 0x3F
        BOX[194] = result

s = Solver()
flag = [BitVec('flag[%d]' % i,64) for i in range(16)]

def check():
    global ip
    global code
    global ex
    if ip + 2 >= 374 :
        print('ip out of range')
        exit(0)
    s.add(ex[code[ip+1]] == ex[code[ip+2]])

 if ip >= 374:
        if s.check() == sat:
            print(s.model())
            break
        else:
            print('no')
            break

import subprocess

ans = 'this is answer'        '''比较数据'''
hexs = '0123456789abcdef-'		'''约束范围，输入其他的程序会提前退出'''
hexs = list(hexs)
for i in range(17):
    hexs[i] = ord(hexs[i])

real_flag="flag{"
cur_index = 5		'''当前位置'''
k = 0

while cur_index < 42:
    for i in hexs:				
        real_flag_arr = [0] * 42

        for j in range(len(real_flag)):					'''爆破储存位置'''
            real_flag_arr[j] = ord(real_flag[j])
        real_flag_arr[len(real_flag_arr)-1] = ord("}")

        for j in range(len(real_flag_arr)-2,cur_index,-1):
            real_flag_arr[j] = 48				'''未知位填充0'''
        
        real_flag_arr[cur_index] = i
        real_flag_arr_s = ''.join(chr(k) for k in real_flag_arr)
        p = subprocess.Popen(["C:\\Users\\Second_BC\\Desktop\\analgo.exe"], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        p.stdin.write(real_flag_arr_s.encode())		'''输入程序'''
        p.stdin.close()
        out = p.stdout.read()		'''读取输出'''
        out = list(out)

        if (out[k] == ans[k] ):
            real_flag += chr(i)
            k += 1
            cur_index += 1
            print(real_flag)
            break

import sys
import angr

def main(argv):
    # 目标文件的路径
    path_to_binary = '../program/00_angr_find'
    # 创建angr项目
    project = angr.Project(path_to_binary)
    
    # 设置项目起点，entry_state代表程序的入口点，即main函数
    initial_state = project.factory.entry_state()
    # 设置模拟器
    simulation = project.factory.simgr(initial_state)
    
    # 设置目标地址
    print_good_addr = 0x0804867D
    simulation.explore(find=print_good_addr)
    
    # 如果到达目标地址，打印此时的符号向量
    if simulation.found:
        solution_state = simulation.found[0]
        print(solution_state.posix.dumps(sys.stdin.fileno()))
    # 否者抛出失败异常
    else:
        raise Exception('Could not find solution')
    
if __name__ == '__main__':
    main(sys.argv)

import sys
import angr

def main(argv):
    # 目标文件的路径
    path_to_binary = '../program/01_angr_avoid'
    # 创建angr项目
    project = angr.Project(path_to_binary)
    
    # 设置项目起点，entry_state代表程序的入口点，即main函数
    initial_state = project.factory.entry_state()
    # 设置模拟器
    simulation = project.factory.simgr(initial_state)
    
    # 设置目标地址
    print_good_addr = 0x080485E0
    aovid_me_addr = 0x080485A8
    
    # simulation.explore(find=print_good_addr)
    # avoid=try_again_addr
    # 在这里可以添加 avoid 来约束到达的目的地址 
    simulation.explore(find=print_good_addr, avoid=aovid_me_addr)
    # 如果到达目标地址，打印此时的符号向量
    if simulation.found:
        solution_state = simulation.found[0]
        print(solution_state.posix.dumps(sys.stdin.fileno()))
    # 否者抛出失败异常
    else:
        raise Exception('Could not find solution')
    
if __name__ == '__main__':
    main(sys.argv)

import sys
import angr

# 到达目标地址，打印此时的符号向量
def good_job(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Good Job' in str(stdout_output)

# 否则抛出失败异常
def try_again(state): 
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Try again' in str(stdout_output)

def main(argv):
    path_to_binary = './02_angr_find_condition'
    # 创建angr项目
    project = angr.Project(path_to_binary)
    # 设置项目起点，entry_state代表程序的入口点，即main函数
    initial_state = project.factory.entry_state()
    # 设置模拟器
    simulation = project.factory.simgr(initial_state)
    # 设置目标地址
    simulation.explore(find=good_job, avoid=try_again) 
    if simulation.found:
        solution_state = simulation.found[0]
        print(solution_state.posix.dumps(sys.stdin.fileno()))
    else:
        raise Exception('Could not find solution')
    
if __name__ == '__main__':
    main(sys.argv)

import sys
import angr
import claripy

def main():
    binary_path = '../program/03_angr_symbolic_registers'
    project = angr.Project(binary_path)
	
    # 设置项目开始地址
    start_addr = 0x0804890E
    initial_state = project.factory.blank_state(addr=start_addr)
	
    
   # 将寄存器符号化
    bit_length = 32
    psd0 = claripy.BVS('psd0', bit_length)
    psd1 = claripy.BVS('psd1', bit_length)
    psd2 = claripy.BVS('psd2', bit_length)
	# 将符号化的寄存器对应到相应的寄存器
    initial_state.regs.eax = psd0
    initial_state.regs.ebx = psd1
    initial_state.regs.edx = psd2
	# 设置模拟
    simulation = project.factory.simgr(initial_state)

    def good_job(state):
        stdout_content = state.posix.dumps(sys.stdout.fileno())
        return b'Good Job.' in stdout_content

    def fail(state):
        stdout_content = state.posix.dumps(sys.stdout.fileno())
        return b'Try again.' in stdout_content

    simulation.explore(find=good_job, avoid=fail)
    
    if simulation.found:
        solution_state = simulation.found[0]
        solution0 = solution_state.se.eval(psd0)
        solution1 = solution_state.se.eval(psd1)
        solution2 = solution_state.se.eval(psd2)

        solution = '%x %x %x' % (solution0, solution1, solution2)
        print(solution)
    else:
        raise Exception('Could not find the solution')
            
if __name__ == '__main__':
    main()

import sys
import angr
import claripy


def main():
    binary_path = './04_angr_symbolic_stack'
    project = angr.Project(binary_path)

    start_addr = 0x08048697 #scanf之后的地址
    initial_state = project.factory.blank_state(addr=start_addr)

    initial_state.regs.ebp = initial_state.regs.esp # 初始化栈，令ebp等于esp

    password0 = claripy.BVS('password0', 32) # 初始化两个位向量
    password1 = claripy.BVS('password1', 32)

    padding_length_in_bytes = 8 # 填充栈，8字节，2个int数据
    initial_state.regs.esp -= padding_length_in_bytes 

    initial_state.stack_push(password0) # 将位向量压入栈中
    initial_state.stack_push(password1)

    simulation = project.factory.simgr(initial_state)

    def is_successful(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Good Job' in stdout_output

    def should_abort(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Try again' in stdout_output

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        solution_state = simulation.found[0]

        solution0 = solution_state.se.eval(password0)
        solution1 = solution_state.se.eval(password1)

        solution = '%u %u' % (solution0, solution1)
        print(solution)
    else:
        raise Exception('could not find the solution')

if __name__ == '__main__':
    main()

import angr
import sys
import claripy
from Crypto.Util.number import long_to_bytes

def main():
    binary_path = './05_angr_symbolic_memory'
    project = angr.Project(binary_path)

    start_addr = 0x08048601
    initial_state = project.factory.blank_state(addr=start_addr)

    password0 = claripy.BVS('password0', 64) # 64 = 8(8个字符) * 1(每个字符一字节) * 8(每个字节8比特)
    password1 = claripy.BVS('password1', 64)
    password2 = claripy.BVS('password2', 64)
    password3 = claripy.BVS('password3', 64)

    password0_addr = 0x09FD92A0
    password1_addr = 0x09FD92A8
    password2_addr = 0x09FD92B0
    password3_addr = 0x09FD92B8

    initial_state.memory.store(password0_addr, password0) # 将位向量存入内存
    initial_state.memory.store(password1_addr, password1)
    initial_state.memory.store(password2_addr, password2)
    initial_state.memory.store(password3_addr, password3)

    simulation = project.factory.simgr(initial_state)

    def is_successful(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Good Job.' in stdout_output

    def should_abort(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Try again.' in stdout_output

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        solution_state = simulation.found[0]

        solution0 = solution_state.se.eval(password0)
        solution1 = solution_state.se.eval(password1)
        solution2 = solution_state.se.eval(password2)
        solution3 = solution_state.se.eval(password3)
        solution = long_to_bytes(solution0)+b' '+long_to_bytes(solution1)+b' '+long_to_bytes(solution2)+b' '+long_to_bytes(solution3)
        print(solution.decode())
    else:
        raise Exception('Could not find solution')

if __name__ == '__main__':
    main()

import sys
import angr
import claripy
from Crypto.Util.number import long_to_bytes

def main():
    binary_path = '../program/06_angr_symbolic_dynamic_memory'
    project = angr.Project(binary_path)

    start_addr = 0x08048699
    initial_state = project.factory.blank_state(addr=start_addr)

    password0 = claripy.BVS('password0', 64)
    password1 = claripy.BVS('password1', 64)
    fake0_addr = 0x09FD9160 # 伪造malloc得来的内存
    fake1_addr = 0x09FD9180

    buffer0_addr = 0x09FD92AC # 指向伪造内存的指针
    buffer1_addr = 0x09FD92B4
    initial_state.memory.store(buffer0_addr, fake0_addr, endness=project.arch.memory_endness) # 将指针指向伪造的内存
    initial_state.memory.store(buffer1_addr, fake1_addr, endness=project.arch.memory_endness)

    initial_state.memory.store(fake0_addr, password0) # 将伪造的内存符号化
    initial_state.memory.store(fake1_addr, password1)

    simulation = project.factory.simgr(initial_state)

    def is_successful(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Good Job.' in stdout_output

    def should_abort(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Try again.' in stdout_output

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        solution_state = simulation.found[0]

        solution0 = solution_state.se.eval(password0)
        solution1 = solution_state.se.eval(password1)

        solution = long_to_bytes(solution0) + b' ' + long_to_bytes(solution1)
        print(solution)
        print(solution.decode())
    else:
        raise Exception('Could not find solution')

if __name__ == '__main__':
    main()

import sys
import angr
import claripy
from Crypto.Util.number import long_to_bytes

def main():
    binary_path = '../program/07_angr_symbolic_file'
    project = angr.Project(binary_path)

    start_addr = 0x080488EA

    filename = 'MRXJKZYR.txt' # 文件名称
    symbolic_file_size_bytes = 64 # 文件大小(字节)

    password = claripy.BVS('password', symbolic_file_size_bytes * 8) # 初始化位向量
    password_file = angr.SimFile(filename, content=password, size=symbolic_file_size_bytes) # 符号化文件

    initial_state = project.factory.blank_state(addr=start_addr, fs={filename: password_file}) # 再初始状态中添加一个虚拟的文件系统
    simulation = project.factory.simgr(initial_state)

    def is_successful(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Good Job.' in stdout_output

    def should_abort(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Try again.' in stdout_output

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        solution_state = simulation.found[0]

        solution = long_to_bytes(solution_state.solver.eval(password))
        print(solution.decode())
    else:
        raise Exception('Could not find solution')
    
if __name__ == '__main__':
    main()

import sys
import angr
import claripy
from Crypto.Util.number import long_to_bytes

def main():
    binary_path = './08_angr_constraints'
    project = angr.Project(binary_path)

    start_addr = 0x08048625 # 在输入函数之后
    initial_state = project.factory.blank_state(addr=start_addr)

    password = claripy.BVS('password', 16*8)
    password_addr = 0x0804A050
    initial_state.memory.store(password_addr, password)

    simulation = project.factory.simgr(initial_state)

    addr_to_check_constraint = 0x08048669 # 在检查函数之前
    simulation.explore(find=addr_to_check_constraint)

    if simulation.found:
        solution_state = simulation.found[0]

        constrained_parameter_addr = 0x0804A050 # 加密后的password的地址
        constrained_parameter_size_bytes = 16   # password的长度(字节)
        constrained_parameter_bitvector = solution_state.memory.load(constrained_parameter_addr, constrained_parameter_size_bytes)  # 从内存中加载password

        constrained_parameter_desired_value = 'MRXJKZYRKMKENFZR'  # reference string

        constrained_expression = constrained_parameter_bitvector == constrained_parameter_desired_value                               # 约束表达式

        solution_state.add_constraints(constrained_expression)    # 添加约束

        solution = long_to_bytes(solution_state.se.eval(password))
        print(solution.decode())
    else:
        raise Exception('Could not find the sokution')

if __name__ == '__main__':
    main()

import sys
import angr
import claripy


def main():
    binary_path = './09_angr_hooks'
    project = angr.Project(binary_path)

    initial_state = project.factory.entry_state()

    # 绕过函数的地址
    check_equals_caller_addr = 0x080486A9
    # 通过 hook 跳过目标函数的长度
    instruction_to_skip_length = 0x080486BB - 0x080486A9

    # 创建一个 hook 函数
    # 参数为绕过函数的地址,绕过函数长度
    @project.hook(check_equals_caller_addr, length = instruction_to_skip_length)
    def skip_check_equals(state):
        user_input_buffer_addr = 0x0804A054  # 保存输入变量地址
        user_input_buffer_length = 16  # 第一个 scanf 的输入长度，此处为字节大小
        # 将输入载入内存
        user_input_string = state.memory.load(
            user_input_buffer_addr,
            user_input_buffer_length
        )
        # 目的字符串
        check_against_string = 'MRXJKZYRKMKENFZB'
        # 创建判断条件 -> 字符串的比较
        state.regs.eax = claripy.If(
            user_input_string == check_against_string,
            claripy.BVV(1, 32),  # 程序的返回值是给寄存器 eax 保存
            claripy.BVV(0, 32)  # eax 为 32 bit 的寄存器，所以大小设置为 32
        )  # claripy.BVV(返回数据,返回 bit 大小)
    
    

    def is_successful(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Good Job.' in stdout_output

    def should_abort(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Try again.' in stdout_output
    # 开始模拟
    simulation = project.factory.simgr(initial_state)
    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        solution_state = simulation.found[0]

        solution = solution_state.posix.dumps(sys.stdin.fileno())

        print(solution.decode())
    else:
        raise Exception('Could not find the solution')


if __name__ == '__main__':
    main()

import angr
import sys
import claripy


def main():
    binary_path = './09_angr_hooks'
    project = angr.Project(binary_path)
    initial_state = project.factory.entry_state()

    # 创建一个类
    class mySimPro(angr.SimProcedure):
        def run(self, user_input_addr, user_input_length):
            # angr 输入的符号向量
            angr_bvs = self.state.memory.load(
                user_input_addr,
                user_input_length
            )
            # 目标字符串
            desired = 'MRXJKZYRKMKENFZB'
            return claripy.If(
                desired == angr_bvs, # 条件判断
                claripy.BVV(1,32), # 返回值设置
                claripy.BVV(0,32)
            )
    
    # hook 的函数名
    check_symbol = 'check_equals_MRXJKZYRKMKENFZB'
    # 创建 hook
    project.hook_symbol(check_symbol,mySimPro())    # 创建一个类来继承 angr.SimProcedure
    simulation = project.factory.simgr(initial_state)

    def is_successful(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Good Job.' in stdout_output

    def should_abort(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Try again.' in stdout_output

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        solution_state = simulation.found[0]

        solution = solution_state.posix.dumps(sys.stdin.fileno())

        print(solution.decode())
    else:
        raise Exception('Could not find the solution')


if __name__ == '__main__':
    main()

import angr
import sys
import claripy

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  initial_state = project.factory.entry_state()

  class ReplacementScanf(angr.SimProcedure):

    def run(self, format_string, scanf0_address, scanf1_address ):
      scanf0 = claripy.BVS('scanf0', 4 * 8)
      scanf1 = claripy.BVS('scanf1', 4 * 8)

      self.state.memory.store(scanf0_address, scanf0, endness=project.arch.memory_endness)
      self.state.memory.store(scanf1_address, scanf1, endness=project.arch.memory_endness)

      self.state.globals['solution0'] = scanf0
      self.state.globals['solution1'] = scanf1

  scanf_symbol = '__isoc99_scanf'
  project.hook_symbol(scanf_symbol, ReplacementScanf())

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Good Job' in str(stdout_output)

  def should_abort(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Try again' in str(stdout_output)

  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:
    solution_state = simulation.found[0]
    stored_solutions0 = solution_state.globals['solution0']
    stored_solutions1 = solution_state.globals['solution1']
    solution0 = solution_state.se.eval(stored_solutions0)
    solution1 = solution_state.se.eval(stored_solutions1)

    print(solution0,solution1)
    
  else:
        raise Exception('Could not find the solution')
        
        
if __name__ == '__main__':
    main()

import sys
import angr

def main():
    binary_path = './/12_angr_veritesting'
    project = angr.Project(binary_path)

    initial_state = project.factory.entry_state()
    simulation = project.factory.simgr(initial_state, veritesting=True) # 设置自动合并路径

    def is_successful(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Good Job.' in stdout_output

    def should_abort(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        return b'Try again.' in stdout_output

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        solution_state = simulation.found[0]

        solution = solution_state.posix.dumps(sys.stdin.fileno())
        print(solution)
    else:
        raise Exception('Could not find the solution')

if __name__ == '__main__':
    main()

import angr
import sys


project = angr.Project(sys.argv[1])
initial_state = project.factory.entry_state()
simulation = project.factory.simgr(initial_state,veritesting = True)

project.hook(0x804ed40, angr.SIM_PROCEDURES['libc']['printf']())
project.hook(0x804ed80, angr.SIM_PROCEDURES['libc']['scanf']())
project.hook(0x804f350, angr.SIM_PROCEDURES['libc']['puts']())
project.hook(0x8048d10, angr.SIM_PROCEDURES['glibc']['__libc_start_main']())

def is_successful(state):
  stdout_output = state.posix.dumps(sys.stdout.fileno())
  return 'Good Job.' in str(stdout_output)  # :boolean

def should_abort(state):
  stdout_output = state.posix.dumps(sys.stdout.fileno())
  return 'Try again.' in str(stdout_output)  # :boolean

simulation.explore(find = is_successful,avoid = should_abort)

if simulation.found :
  solution_state = simulation.found[0]
  print(solution_state.posix.dumps(sys.stdin.fileno()))

def main(argv):
  path_to_binary = sys.argv[1]  #  注意是要load so 库而不是执行程序

  base = 0x400000  #  base 基址是随意定的,可以随意修改
  project = angr.Project(path_to_binary, load_options={
    'main_opts' : {
      'custom_base_addr' : base
    }
  })

  buffer_pointer = claripy.BVV(0x3000000, 32)  #  创建一个buffer 指针值
  validate_function_address = base + 0x6D7
  initial_state = project.factory.call_state(validate_function_address, buffer_pointer,claripy.BVV(8, 32))  #  调用validate_function,因为函数声明validata_function(buffer_point,buffer_length) ,所以构造出调用validata_function(0x3000000,0x8) .

  password = claripy.BVS('password', 8 * 8)  #  创建一个求解对象,大小为8 字节
  initial_state.memory.store(buffer_pointer, password)  #  保存到0x30000000

  simulation = project.factory.simgr(initial_state)

  simulation.explore(find = base + 0x783)  #  执行到validate 函数的RETN 指令

  if simulation.found:
    solution_state = simulation.found[0]

    solution_state.add_constraints(solution_state.regs.eax != 0)  #  记得,要求validate 函数的返回值为1 的时候就是有解的,那么就需要在求解的时候添加上这么一个求解约束条件EAX 不能为False .
    solution = solution_state.se.eval(password)
    print(solution)

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  initial_state = project.factory.entry_state()

  class ReplacementScanf(angr.SimProcedure):  #  实现Scanf Hook 函数

    def run(self, format_string, check_key_address,input_buffer_address):
      scanf0 = claripy.BVS('scanf0', 4 * 8)   # check_key
      scanf1 = claripy.BVS('scanf1', 20 * 8)  # input_buffer

      for char in scanf1.chop(bits=8):
        self.state.add_constraints(char >= '0', char <= 'z')  #  对input_buffer 的输入约束

      self.state.memory.store(check_key_address, scanf0, endness=project.arch.memory_endness)
      self.state.memory.store(input_buffer_address, scanf1,endness=project.arch.memory_endness)  #  保存求解变量到指定的内存中

      self.state.globals['solution0'] = scanf0  #  保存这两个变量到state 中,后续求解需要用到
      self.state.globals['solution1'] = scanf1

  scanf_symbol = '__isoc99_scanf'
  project.hook_symbol(scanf_symbol, ReplacementScanf())  #  Hook scanf 函数

  def check_puts(state):
    puts_parameter = state.memory.load(state.regs.esp + 4, 4, endness=project.arch.memory_endness)  #  获取puts() 函数的参数

    if state.se.symbolic(puts_parameter):  #  检查这个参数是否为符号化对象
      good_job_string_address = 0x4D525854B

      copied_state = state.copy()  #  复制执行状态上下文进行约束求解,不影响原理的执行上下文

      copied_state.add_constraints(puts_parameter == good_job_string_address)  #  puts 的参数地址是否可以被指定为0x4D525854B ,如果可以的话,那就证明这个值是可控的

      if copied_state.satisfiable():  #  判断添加了上面这个约束是否有解
        state.add_constraints(puts_parameter == good_job_string_address)  #  如果有解的话就保存到执行的那个状态对象
        return True 
      else:
        return False
    else:
      return False

  simulation = project.factory.simgr(initial_state)
    
  def is_successful(state):
    puts_address = 0x8048370  #  当程序执行到puts() 函数时,就认为路径探索到了这里,然后再去通过check_puts() 判断这里是否存在漏洞,告诉Angr这是不是需要找的那条执行路径
    
    if state.addr == puts_address:
      return check_puts(state)
    else:
      return False

  simulation.explore(find=is_successful)

  if simulation.found:
    solution_state = simulation.found[0]

    solution0 = solution_state.se.eval(solution_state.globals['solution0'])
    solution1 = solution_state.se.eval(solution_state.globals['solution1'],cast_to=bytes)  #  输出字符串序列化的内容

    print(solution0,solution1)

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)
  initial_state = project.factory.entry_state()

  class ReplacementScanf(angr.SimProcedure):

    def run(self, format_string, check_key ,input_buffer):
      scanf0 = claripy.BVS('scanf0', 4 * 8)
      scanf1 = claripy.BVS('scanf1', 20 * 8)

      for char in scanf1.chop(bits=8):
        self.state.add_constraints(char >= '0', char <= 'z')

      self.state.memory.store(check_key, scanf0, endness=project.arch.memory_endness)
      self.state.memory.store(input_buffer, scanf1, endness=project.arch.memory_endness)

      self.state.globals['solution0'] = scanf0
      self.state.globals['solution1'] = scanf1

  scanf_symbol = '__isoc99_scanf'
  project.hook_symbol(scanf_symbol, ReplacementScanf())

  def check_strncpy(state):
    strncpy_dest = state.memory.load(state.regs.esp + 4, 4, endness=project.arch.memory_endness)  #  获取strncpy() 的参数,strncpy_dest ..
    strncpy_src  = state.memory.load(state.regs.esp + 8, 4, endness=project.arch.memory_endness)
    strncpy_len  = state.memory.load(state.regs.esp + 12, 4, endness=project.arch.memory_endness)
    src_contents = state.memory.load(strncpy_src, strncpy_len)  #  因为参数中只保存了地址,需要根据这个地址去获取内容

    if state.se.symbolic(strncpy_dest) and state.se.symbolic(src_contents) :  #  判断dest 和src 的内容是不是符号化对象
      if state.satisfiable(extra_constraints=(src_contents[ -1 : -64 ] == 'KZYRKMKE' ,strncpy_dest == 0x4D52584C)):  #  尝试求解,其中strncpy_dest == 0x4D52584C 的意思是判断dest 是否可控为password 的地址;src_contents[ -1 : -64 ] == 'KZYRKMKE' 是判断input_buffer 的内容是否可控为'KZYRKMKE' ,因为这块内存是倒序,所以需要通过[ -1 : -64 ] 倒转(contentes 的内容是比特,获取8 字节的大小为:8*8 = 64),然后判断该值是否为字符串'KZYRKMKE'
        state.add_constraints(src_contents[ -1 : -64 ] == 'KZYRKMKE',strncpy_dest == 0x4D52584C)
        return True
      else:
        return False
    else:
      return False

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):
    strncpy_address = 0x8048410

    if state.addr == strncpy_address:
      return check_strncpy(state)
    else:
      return False

  simulation.explore(find=is_successful)

  if simulation.found:
    solution_state = simulation.found[0]
    solution0 = solution_state.se.eval(solution_state.globals['solution0'])
    solution1 = solution_state.se.eval(solution_state.globals['solution1'],cast_to=bytes)

    print(solution0,solution1)

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)
  initial_state = project.factory.entry_state()

  simulation = project.factory.simgr(
    initial_state,
    save_unconstrained=True,
    stashes={
      'active' : [initial_state],
      'unconstrained' : [],
      'found' : [],
      'not_needed' : []
    }
  )

  class ReplacementScanf(angr.SimProcedure):

    def run(self, format_string, input_buffer_address):
      input_buffer = claripy.BVS('input_buffer', 64 * 8)  #  设置一个较大的input_buffer

      for char in input_buffer.chop(bits=8):
        self.state.add_constraints(char >= '0', char <= 'z')

      self.state.memory.store(input_buffer_address, input_buffer, endness=project.arch.memory_endness)

      self.state.globals['solution'] = input_buffer

  scanf_symbol = '__isoc99_scanf'
  project.hook_symbol(scanf_symbol, ReplacementScanf())  #  对scanf() 做Hook

  while (simulation.active or simulation.unconstrained) and (not simulation.found):  #  
    for unconstrained_state in simulation.unconstrained:
      def should_move(s):
        return s is unconstrained_state
      
      simulation.move('unconstrained', 'found', filter_func=should_move)  #  保存

    simulation.step()  #  步进执行

  if simulation.found:
    solution_state = simulation.found[0]

    solution_state.add_constraints(solution_state.regs.eip == 0x4D525849)  #  判断EIP 地址是否可控

    solution = solution_state.se.eval(solution_state.globals['solution'],cast_to = bytes)  #  生成Payload
    print(solution)