https://github.com/angr/angr

https://docs.angr.io/introductory-errata/install

# dependencysudo apt-get install python3-dev libffi-dev build-essential virtualenvwrapper# install# we'd better use it in virtual environmentmkvirtualenv --python=$(which python3) angr && pip install angr# more see https://docs.angr.io/INSTALL.html

# install dockercurl -sSL https://get.docker.com/ | sudo sh
# pull the docker imagesudo docker pull angr/angr
# run itsudo docker run -it angr/angr

$ export WORKON_HOME=~/Envs$ mkdir -p $WORKON_HOME$ source /usr/share/virtualenvwrapper/virtualenvwrapper.sh$ mkvirtualenv angr

python3 -m pip install angr

https://github.com/angr/angr-management

https://github.com/angr/angr-management/releases

python3 -m pip install angr-management

python3 -m angrmanagement

>>> import angr>>> proj = angr.Project('/bin/true')

>>> proj.arch<Arch AMD64 (LE)>>>> proj.entry0x401670>>> proj.filename'/bin/true'>>> proj.loader<Loaded true, maps [0x400000:0x5004000]>
>>> proj.loader.shared_objects # may look a little different for you!{'ld-linux-x86-64.so.2': <ELF Object ld-2.24.so, maps [0x2000000:0x2227167]>, 'libc.so.6': <ELF Object libc-2.24.so, maps [0x1000000:0x13c699f]>}
>>> proj.loader.min_addr0x400000>>> proj.loader.max_addr0x5004000
>>> proj.loader.main_object  # we've loaded several binaries into this project. Here's the main one!<ELF Object true, maps [0x400000:0x60721f]>
>>> proj.loader.main_object.execstack  # sample query: does this binary have an executable stack?False>>> proj.loader.main_object.pic  # sample query: is this binary position-independent?True

angr.Project(main_opts={'backend': 'ida', 'custom_arch': 'i386'}, lib_opts={'libc.so.6': {'backend': 'elf'}})

# This is the "main" object, the one that you directly specified when loading the project>>> proj.loader.main_object<ELF Object true, maps [0x400000:0x60105f]>>>> obj = proj.loader.main_object
# The entry point of the object>>> obj.entry0x400580
>>> obj.min_addr, obj.max_addr(0x400000, 0x60105f)
# Retrieve this ELF's segments and sections>>> obj.segments<Regions: [<ELFSegment offset=0x0, flags=0x5, filesize=0xa74, vaddr=0x400000, memsize=0xa74>,           <ELFSegment offset=0xe28, flags=0x6, filesize=0x228, vaddr=0x600e28, memsize=0x238>]>>>> obj.sections<Regions: [<Unnamed | offset 0x0, vaddr 0x0, size 0x0>,           <.interp | offset 0x238, vaddr 0x400238, size 0x1c>,           <.note.ABI-tag | offset 0x254, vaddr 0x400254, size 0x20>,            ...etc
# You can get an individual segment or section by an address it contains:>>> obj.find_segment_containing(obj.entry)<ELFSegment offset=0x0, flags=0x5, filesize=0xa74, vaddr=0x400000, memsize=0xa74>>>> obj.find_section_containing(obj.entry)<.text | offset 0x580, vaddr 0x400580, size 0x338>
# Get the address of the PLT stub for a symbol>>> addr = obj.plt['__libc_start_main']>>> addr0x400540>>> obj.reverse_plt[addr]'__libc_start_main'
# Show the prelinked base of the object and the location it was actually mapped into memory by CLE>>> obj.linked_base0x400000>>> obj.mapped_base0x400000

# All loaded objects>>> proj.loader.all_objects[<ELF Object fauxware, maps [0x400000:0x60105f]>, <ELF Object libc.so.6, maps [0x1000000:0x13c42bf]>, <ELF Object ld-linux-x86-64.so.2, maps [0x2000000:0x22241c7]>, <ELFTLSObject Object cle##tls, maps [0x3000000:0x300d010]>, <KernelObject Object cle##kernel, maps [0x4000000:0x4008000]>, <ExternObject Object cle##externs, maps [0x5000000:0x5008000]>

# This is a dictionary mapping from shared object name to object>>> proj.loader.shared_objects{ 'libc.so.6': <ELF Object libc.so.6, maps [0x1000000:0x13c42bf]>  'ld-linux-x86-64.so.2': <ELF Object ld-linux-x86-64.so.2, maps [0x2000000:0x22241c7]>}
# Here's all the objects that were loaded from ELF files# If this were a windows program we'd use all_pe_objects!>>> proj.loader.all_elf_objects[<ELF Object true, maps [0x400000:0x60105f]>, <ELF Object libc.so.6, maps [0x1000000:0x13c42bf]>, <ELF Object ld-linux-x86-64.so.2, maps [0x2000000:0x22241c7]>]
# Here's the "externs object", which we use to provide addresses for unresolved imports and angr internals>>> proj.loader.extern_object<ExternObject Object cle##externs, maps [0x5000000:0x5008000]>
# This object is used to provide addresses for emulated syscalls>>> proj.loader.kernel_object<KernelObject Object cle##kernel, maps [0x4000000:0x4008000]>
# Finally, you can to get a reference to an object given an address in it>>> proj.loader.find_object_containing(0x400000)<ELF Object true, maps [0x400000:0x60105f]>

>>> malloc = proj.loader.find_symbol('malloc')>>> malloc<Symbol "malloc" in libc.so.6 at 0x1054400>

>>> malloc.name'malloc'
>>> malloc.owner_obj<ELF Object libc.so.6, maps [0x1000000:0x13c42bf]>
# .rebased_addr is its address in the global address space. This is what is shown in the print output.>>> malloc.rebased_addr0x1054400# .linked_addr is its address relative to the prelinked base of the binary. This is the address reported in, for example, readelf(1)>>> malloc.linked_addr0x54400# .relative_addr is its address relative to the object base. This is known in the literature (particularly the Windows literature) as an RVA (relative virtual address).>>> malloc.relative_addr0x54400

>>> malloc.is_exportTrue>>> malloc.is_importFalse
# On Loader, the method is find_symbol because it performs a search operation to find the symbol.# On an individual object, the method is get_symbol because there can only be one symbol with a given name.>>> main_malloc = proj.loader.main_object.get_symbol("malloc")>>> main_malloc<Symbol "malloc" in true (import)>>>> main_malloc.is_exportFalse>>> main_malloc.is_importTrue>>> main_malloc.resolvedby<Symbol "malloc" in libc.so.6 at 0x1054400>

backend name  description  requires custom_arch?elf  Static loader for ELF files based on PyELFTools  nope  Static loader for PE files based on PEFile  nomach-o  Static loader for Mach-O files. Does not support dynamic linking or rebasing.  nocgc  Static loader for Cyber Grand Challenge binaries  nobackedcgc  Static loader for CGC binaries that allows specifying memory and register backers  noelfcore  Static loader for ELF core dumps  noida  Launches an instance of IDA to parse the file  yesblob  Loads the file into memory as a flat image  yes

>>> stub_func = angr.SIM_PROCEDURES['stubs']['ReturnUnconstrained'] # this is a CLASS>>> proj.hook(0x10000, stub_func())  # hook with an instance of the class
>>> proj.is_hooked(0x10000)            # these functions should be pretty self-explanitoryTrue>>> proj.unhook(0x10000)>>> proj.hooked_by(0x10000)<ReturnUnconstrained>
# length keyword argument to make execution jump some number of bytes forward after your hook finishes.>>> @proj.hook(0x20000, length=5)... def my_hook(state):...     state.regs.rax = 1
>>> proj.is_hooked(0x20000)True

>>> import angr>>> proj = angr.Project('/bin/true')>>> state = proj.factory.entry_state()
# copy rsp to rbp>>> state.regs.rbp = state.regs.rsp
# store rdx to memory at 0x1000>>> state.mem[0x1000].uint64_t = state.regs.rdx
# dereference rbp>>> state.regs.rbp = state.mem[state.regs.rbp].uint64_t.resolved
# add rax, qword ptr [rsp + 8]>>> state.regs.rax += state.mem[state.regs.rsp + 8].uint64_t.resolved

>>> proj = angr.Project('examples/fauxware/fauxware')>>> state = proj.factory.entry_state()>>> while True:...     succ = state.step()...     if len(succ.successors) == 2:...         break...     state = succ.successors[0]
>>> state1, state2 = succ.successors>>> state1<SimState @ 0x400629>>>> state2<SimState @ 0x400699>

>>> s = proj.factory.blank_state()>>> s.memory.store(0x4000, s.solver.BVV(0x0123456789abcdef0123456789abcdef, 128))>>> s.memory.load(0x4004, 6) # load-size is in bytes<BV48 0x89abcdef0123>>>> import archinfo>>> s.memory.load(0x4000, 4, endness=archinfo.Endness.LE)<BV32 0x67453201>

# Example: enable lazy solves, an option that causes state satisfiability to be checked as infrequently as possible.# This change to the settings will be propagated to all successor states created from this state after this line.>>> s.options.add(angr.options.LAZY_SOLVES)
# Create a new state with lazy solves enabled>>> s = proj.factory.entry_state(add_options={angr.options.LAZY_SOLVES})
# Create a new state without simplification options enabled>>> s = proj.factory.entry_state(remove_options=angr.options.simplification)

# 64-bit bitvectors with concrete values 1 and 100>>> one = state.solver.BVV(1, 64)>>> one <BV64 0x1>>>> one_hundred = state.solver.BVV(100, 64)>>> one_hundred <BV64 0x64>
# create a 27-bit bitvector with concrete value 9>>> weird_nine = state.solver.BVV(9, 27)>>> weird_nine<BV27 0x9>

>>> one + one_hundred<BV64 0x65>
# You can provide normal python integers and they will be coerced to the appropriate type:>>> one_hundred + 0x100<BV64 0x164>
# The semantics of normal wrapping arithmetic apply>>> one_hundred - one*200<BV64 0xffffffffffffff9c>
# use extend to extent the length of bitvector# also there is sign_extend>>> weird_nine.zero_extend(64 - 27)<BV64 0x9>>>> one + weird_nine.zero_extend(64 - 27)<BV64 0xa>

# Create a bitvector symbol named "x" of length 64 bits>>> x = state.solver.BVS("x", 64)>>> x<BV64 x_9_64>>>> y = state.solver.BVS("y", 64)>>> y<BV64 y_10_64>

>>> x + one<BV64 x_9_64 + 0x1>
>>> (x + one) / 2<BV64 (x_9_64 + 0x1) / 0x2>
>>> x - y<BV64 x_9_64 - y_10_64>

>>> tree = (x + 1) / (y + 2)>>> tree<BV64 (x_9_64 + 0x1) / (y_10_64 + 0x2)>>>> tree.op'__div__'>>> tree.args(<BV64 x_9_64 + 0x1>, <BV64 y_10_64 + 0x2>)>>> tree.args[0].op'__add__'>>> tree.args[0].args(<BV64 x_9_64>, <BV64 0x1>)>>> tree.args[0].args[1].op'BVV'>>> tree.args[0].args[1].args(1, 64)

>>> x == 1<Bool x_9_64 == 0x1>>>> x == one<Bool x_9_64 == 0x1>>>> x > 2<Bool x_9_64 > 0x2>>>> x + y == one_hundred + 5<Bool (x_9_64 + y_10_64) == 0x69>>>> one_hundred > 5<Bool True>>>> one_hundred > -5<Bool False>

>>> yes = one == 1>>> no = one == 2>>> maybe = x == y>>> state.solver.is_true(yes)True>>> state.solver.is_false(yes)False>>> state.solver.is_true(no)False>>> state.solver.is_false(no)True>>> state.solver.is_true(maybe)False>>> state.solver.is_false(maybe)False

>>> state.solver.add(x > y)>>> state.solver.add(y > 2)>>> state.solver.add(10 > x)>>> state.solver.eval(x)4
# get a fresh state without constraints>>> state = proj.factory.entry_state()>>> input = state.solver.BVS('input', 64)>>> operation = (((input + 4) * 3) >> 1) + input>>> output = 200>>> state.solver.add(operation == output)>>> state.solver.eval(input)0x3333333333333381# If we add conflicting or contradictory constraints>>> state.solver.add(input < 2**32)>>> state.satisfiable()False

>>> simgr = proj.factory.simgr(state) # TODO: change name before merge<SimulationManager with 1 active>

>>> simgr.active[<SimState @ 0x401670>]>>> simgr.active[0].regs.rip                 # new and exciting!<BV64 0x1020300>>>> state.regs.rip                           # still the same!<BV64 0x401670>

>>> simgr.step()
# Step until the first symbolic branch>>> while len(simgr.active) == 1:...    simgr.step()
>>> simgr<SimulationManager with 2 active>>>> simgr.active[<SimState @ 0x400692>, <SimState @ 0x400699>]
# Step until everything terminates>>> simgr.run()>>> simgr<SimulationManager with 3 deadended>

>>> simgr.move(from_stash='deadended', to_stash='authenticated', filter_func=lambda s: 'Welcome' in s.posix.dumps(1))>>> simgr<SimulationManager with 2 authenticated, 1 deadended>

>>> for s in simgr.deadended + simgr.authenticated:...     print hex(s.addr)0x10000300x10000780x1000078# If you prepend the name of a stash with one_, you will be given the first state in the stash. >>> simgr.one_deadended<SimState @ 0x1000030>#  If you prepend the name of a stash with mp_, you will be given a mulpyplexed version of the stash.>>> simgr.mp_authenticatedMP([<SimState @ 0x1000078>, <SimState @ 0x1000078>])>>> simgr.mp_authenticated.posix.dumps(0)MP(['\x00\x00\x00\x00\x00\x00\x00\x00\x00SOSNEAKY\x00',    '\x00\x00\x00\x00\x00\x00\x00\x00\x00S\x80\x80\x80\[email protected]\[email protected]\x00'])

dx, dword ptr [edx*4 + 0x81fe260]al, byte ptr [0x81fe6e0]dl, byte ptr [0x81fe6e4]

1.使用qira+ida进行人工分析，2.或使用“movfuscator的反混淆器”3.使用Makefile+二进制插桩4.angr求解是建立在对程序逆向的理解程度

#!/usr/bin/env python# coding=utf-8import angr
p = angr.Project('./signal.exe')good = (0x0040179E)bad = (0x004016E6)
start = 0x00401760
state = p.factory.blank_state(addr=start)simgr = p.factory.simulation_manager(state)simgr.explore(find=good, avoid=bad)result = simgr.found[0]
for i in range(3):    print (result.posix.dumps(i))

import angrimport sysbinary = './angr_0'good = 0x401329
p = angr.Project(binary)state = p.factory.entry_state()simulation = p.factory.simgr(state)simulation.explore(find=good)if simulation.found:    solution_state = simulation.found[0]    for i in range(3):        print (solution_state.posix.dumps(i))else:    raise Exception("Could not find the solution")

import angrimport sysbinary = './angr_1'
good = (0x4012D0)bad = (0x40127B)
p = angr.Project(binary)state = p.factory.entry_state()simulation = p.factory.simgr(state)simulation.explore(find=good, avoid=bad)if simulation.found:    solution_state = simulation.found[0]    for i in range(3):        print (solution_state.posix.dumps(i))else:    raise Exception("Could not find the solution")

import angrimport sysbinary = './angr_2'
good = (0x401245,0x4013C7)bad = (0x4013B0)
def is_good(state):    return b'Good Job' in state.posix.dumps(1)def is_bad(state):    return b'Try again' in state.posix.dumps(1)    p = angr.Project(binary)state = p.factory.entry_state()simulation = p.factory.simgr(state)simulation.explore(find=is_good, avoid=is_bad)if simulation.found:    solution_state = simulation.found[0]    for i in range(3):        print (solution_state.posix.dumps(i))else:    raise Exception("Could not find the solution")

import angrimport sysimport claripy
binary = './angr_3'start = 0x4015BDgood = (0x401621)bad = (0x40160B)
def is_good(state):    print(state.posix.dumps(1))    return b'Good Job' in state.posix.dumps(sys.stdout.fileno())def is_bad(state):    print(state.posix.dumps(1))    return b'Try again' in state.posix.dumps(sys.stdout.fileno())    p = angr.Project(binary)state = p.factory.blank_state(addr=start)bits = 32password0 = claripy.BVS('password0', bits)password1 = claripy.BVS('password1', bits)password2 = claripy.BVS('password2', bits)state.regs.eax = password0state.regs.ebx = password1state.regs.edx = password2

simulation = p.factory.simgr(state)simulation.explore(find=good, avoid=bad)if simulation.found:    solution_state = simulation.found[0]    solution0 = solution_state.se.eval(password0)    solution1 = solution_state.se.eval(password1)    solution2 = solution_state.se.eval(password2)    solution = ' '.join(map('{:x}'.format, [ solution0, solution1, solution2]))    print(solution)else:    raise Exception("Could not find the solution")

import angrimport sysimport claripy
binary = './angr_4'start = 0x4013FBgood = (0x401447)bad = (0x401433)
def is_good(state):    print(state.posix.dumps(1))    return b'Good Job' in state.posix.dumps(sys.stdout.fileno())def is_bad(state):    print(state.posix.dumps(1))    return b'Try again' in state.posix.dumps(sys.stdout.fileno())    p = angr.Project(binary)state = p.factory.blank_state(addr=start)state.stack_push(state.regs.ebp)state.regs.ebp = state.regs.espstate.regs.esp -= 0x8
bits = 32password0 = claripy.BVS('password0', bits)password1 = claripy.BVS('password1', bits)state.stack_push(password0)state.stack_push(password1)

simulation = p.factory.simgr(state)simulation.explore(find=good, avoid=bad)if simulation.found:    solution_state = simulation.found[0]    solution0 = solution_state.se.eval(password0)    solution1 = solution_state.se.eval(password1)    solution = ' '.join(map('{:}'.format, [ solution0, solution1]))    print(solution)else:    raise Exception("Could not find the solution")