master
serr 2025-03-05 11:42:15 +03:00
parent e5ecc75c0c
commit 5fac86d978
1 changed files with 96 additions and 0 deletions

96
crackmes/study/6/solve.py Normal file
View File

@ -0,0 +1,96 @@
# в случае успеха в файл "example.txt" печатается строка "Full"
import angr
import sys, time
import claripy
GREEN = "\033[92m"
PURPLE = "\033[35m"
RESET = "\033[0m"
RED = "\033[31m"
INPUT_SIZE = None
MAX_INPUT_SIZE = 20
# ключи - имена функций инпута, значения - словари вида {"input_data": BVS, "addr": int},
# где input_data - символический битовый вектор, а "addr" - адрес функции
INPUTS = {}
def CreateFileW(state: angr.SimState):
state.regs.rax = claripy.BVV(1, 64)
def ReadFile(state: angr.SimState):
input_data = state.solver.BVS('input_data', 8 * INPUT_SIZE)
state.memory.store(state.regs.rdx, input_data)
state.memory.eax = claripy.BVV(1, 32)
func_name = sys._getframe().f_code.co_name
INPUTS[func_name] = {"input_data": input_data,
"addr": int(state.regs.rip.concrete_value)}
def memchr(state: angr.SimState):
buf, val, maxCount = state.regs.rcx, state.regs.dl, state.regs.r8
bytes_list = INPUTS["ReadFile"]["input_data"].chop(8)
constraint = claripy.Or(*[byte == val for byte in bytes_list])
state.solver.add(constraint)
def WriteFile(state: angr.SimState):
state.memory.eax = claripy.BVV(1, 32)
def CloseHandle(state: angr.SimState):
state.memory.eax = claripy.BVV(1, 32)
if __name__ == "__main__":
# Загрузка бинарного файла
print(f"{GREEN}Uploading executable file to angr...{RESET}")
proj = angr.Project('test6.exe', auto_load_libs=False)
print(f"{GREEN}The executable has been uploaded to angr!{RESET}")
ENTRY_POINT = 0x140001000 # Адрес функции main
TARGET_ADDR = 0x1400010BA # Целевой адрес, нахождение на нем означает что программа взломана
# Хуки
proj.hook(0x140001046, CreateFileW, length=6)
proj.hook(0x140001071, ReadFile, length=6)
proj.hook(0x140001089, memchr, length=5)
proj.hook(0x1400010AD, WriteFile, length=6)
proj.hook(0x1400010BA, CloseHandle, length=6)
for INPUT_SIZE in range(1, MAX_INPUT_SIZE+1):
INPUTS.clear()
print(f"{GREEN}Trying input size: {INPUT_SIZE}{RESET}")
# Создаем начальное состояние
state = proj.factory.entry_state(
addr=ENTRY_POINT,
add_options={angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS,
angr.options.ZERO_FILL_UNCONSTRAINED_MEMORY}
)
# Инициализация стека
state.regs.rbp = 0x7ffffffffffffff
state.regs.rsp = 0x7ffffffffffffff
# Запуск симуляции
simgr = proj.factory.simulation_manager(state)
start_time = time.time()
simgr.explore(find=TARGET_ADDR, avoid=0x1400010C4)
elapsed = time.time() - start_time
# Проверка результата
if simgr.found:
found_state = simgr.found[0]
for input in INPUTS:
input_data = found_state.solver.eval(INPUTS[input]['input_data'], cast_to=bytes)
print(f"{GREEN}Success cracked! {PURPLE}"
f"input data = {input_data} "
f"[0x{INPUTS[input]['addr']:X}]{PURPLE}{RESET}")
print(f"{GREEN}Pwd cracking time = {elapsed}{RESET}")
break
else:
print(f"{RED}Failed with input size {INPUT_SIZE}{RESET}")
else:
print(f"{RED}Failed to find a solution with input sizes from 1 to {MAX_INPUT_SIZE}{RESET}")