x86_64: Phase 5

In [1]:
# Imports

import angr
import claripy

We push the input values to the stack and then pop them right before the function exits. Since no value is pushed onto the stack during the execution of the function, we can safely manipulate the stack in the way we planned.

Load the binary.

In [2]:
project = angr.Project('bomb64')

Define the address for the start of the execution path.

In [3]:
# The address where the symbolic execution shall begin. It is the beginning of the phase_5 function.
addr_start = 0x401062

# The address of the return block of phase_5.
addr_target = 0x4010D9

# The address of the first instruction of the explode_bomb function, which is to be avoided.
addr_bomb = 0x40143A

Define a blank state for the simulation, a state with most of it's data uninitialized. Pass the address where the state is initialized, along with the user input to be given via standard input.

In [4]:
state = project.factory.blank_state(addr=addr_start)

Move a symbolic value into the relevant register.

In [5]:
# A BitVectorSymbol is declared of max allowed lenght of 6 characters * 8 bits.
# Length of input in restricted at 6.
user_input = claripy.BVS('user_input', 8 * 6)

Store the string in the memory and then save it's address in the register so as to pass it as a parameter.

In [6]:
state.memory.store(0x6038c0, user_input)
state.regs.rdi = 0x6038c0

Create a simulation manager with this blank state that would help us manage the symbolic execution.

In [7]:
simgr = project.factory.simulation_manager(state)

We call the explore method of the simulation manager, tasked with finding an execution path that reaches the target address and avoids the address which explodes the bomb.

In [8]:
simgr.explore(find=addr_target, avoid=addr_bomb, enable_veritesting=True)

WARNING | 2020-06-15 04:14:15,241 | angr.state_plugins.symbolic_memory | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.
WARNING | 2020-06-15 04:14:15,242 | angr.state_plugins.symbolic_memory | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING | 2020-06-15 04:14:15,243 | angr.state_plugins.symbolic_memory | 1) setting a value to the initial state
WARNING | 2020-06-15 04:14:15,246 | angr.state_plugins.symbolic_memory | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING | 2020-06-15 04:14:15,246 | angr.state_plugins.symbolic_memory | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messages.
WARNING | 2020-06-15 04:14:15,247 | angr.state_plugins.symbolic_memory | Filling register rbx with 8 unconstrained bytes referenced from 0x401062 (phase_5+0x0 in bomb64 (0x401062))
WARNING | 2020-06-15 04:14:15,904 | angr.state_plugins.symbolic_memory | Filling memory at 0x7fffffffffeffd1 with 7 unconstrained bytes referenced from 0x401092 (phase_5+0x30 in bomb64 (0x401092))
WARNING | 2020-06-15 04:14:17,126 | angr.state_plugins.symbolic_memory | Filling register r12 with 8 unconstrained bytes referenced from 0x401338 (strings_not_equal+0x0 in bomb64 (0x401338))
WARNING | 2020-06-15 04:14:17,129 | angr.state_plugins.symbolic_memory | Filling register rbp with 8 unconstrained bytes referenced from 0x40133a (strings_not_equal+0x2 in bomb64 (0x40133a))
Out[8]:
<SimulationManager with 1 found, 12 avoid>

We dereference the execution path "found" by the simulation manager and dump the stack.

In [9]:
found = simgr.found[0]
In [10]:
found.solver.eval(user_input, cast_to=bytes)
Out[10]:
b'\t\x0f\x0e\x05\x06\x07'

Angr gets us the bare essential required to reach the target address. Since the and operation was being done on the lower nibble only, Angr got us the values required for the lower nibble. Adding a 0x40 to all the bytes to convert it into an ASCII form so it could be given as an input by the user:

In [11]:
chr(0x49)+chr(0x4f)+chr(0x4e)+chr(0x45)+chr(0x46)+chr(0x47)
Out[11]:
'IONEFG'

And that's the string we have to give as input to pass the fifth phase.