angr symbolic argv test

solve_test.py

#!/usr/bin/env python

import angr

p = angr.Project('test')

key_str = angr.StringSpec(sym_length=20)
initial_state = p.factory.entry_state(args=['./test', key_str])
pg = p.factory.path_group(initial_state)

# find_addr should be adjusted to the basic block that prints 'win.'
find_addr = 0x4005f8 
pg.explore(find=find_addr)
if hasattr(pg, 'found'): 
    print 'yay'
    fs = pg.found[0].state
    key = fs.se.any_str(key_str)
    print key
else:
    print 'nope.'

test.c

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(int argc, const char *argv[]) {

    if ((argc < 2) || strcmp(argv[1], "this_is_a_test")) {
        exit(1);
    }

    printf("win.\n");
    return 0;
}

Pass the argument immutable=False when you create the PathGroup. Otherwise it only returns the new PathGroup with the found state.

The other problem is that you can't call any_str() on a StringSpec object, but that's something we should fix.

In your case you can get the key from rdi, since rdi won't be changed during the strcmp simprocedure.

print fs.se.any_str(fs.memory.load(fs.regs.rdi,20))

Or you can get it by reading from argv on the stack, but it's a little more work...

argv_loc = fs.mem[fs.regs.rbp-0x10].qword.resolved
argv1_loc = fs.mem[argv_loc+0x8].qword.resolved
print fs.se.any_str(fs.memory.load(argv1_loc, 20))