angr学习（四）

import angr,sys,claripy
def ():
	
	pro=angr.Project("./05_angr_symbolic_memory")
	
	entry_point=pro.factory.blank_state(addr=0x08048606)
	
	input=claripy.BVS('input',32*8)
	entry_point.memory.store(0x0A29FAA0,input)
	
	state=pro.factory.simgr(entry_point)
	
	
	def is_success(state):
		res_output=state.posix.dumps(sys.stdout.fileno())
		return 'Good Job' in res_output
		
	def is_avoid(state):
		res_output=state.posix.dumps(sys.stdout.fileno())
		return 'Try again' in res_output
	
	state=pro.factory.simgr(entry_point)
	state.explore(find=is_success,avoid=is_avoid)
	
	if state.found:
		res=state.found[0]
		
		#cats_to：强制转换类型
		res_input=res.se.eval(input,cast_to=str)
		
		input=[]
		
		for i in range(1,33):
			input.append(res_input[i-1])
			if i%8==0 and i!=0:
				input.append(' ')
		
		print ''.join(input)
		
if __name__ == '__main__':
	main()