Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def init(initial_state):
""" define constraints for symbolic ARGV before execution """
# determine argv[1] from state.input_symbols by label name
argv1 = next(sym for sym in initial_state.input_symbols if sym.name == "ARGV1")
if argv1 is None:
raise Exception("ARGV was not made symbolic")
# apply constraint for only ASCII characters
for i in range(20):
initial_state.constrain(operators.AND(ord(" ") <= argv1[i], argv1[i] <= ord("}")))
# store argv1 in global state
with m.locked_context() as context:
context["argv1"] = argv1
# manually inject symbolic variable in place of input
with m.locked_context() as context:
solution = state.new_symbolic_buffer(max_length)
# constrain flag format
state.constrain(solution[0] == ord("h"))
state.constrain(solution[1] == ord("x"))
state.constrain(solution[2] == ord("p"))
state.constrain(solution[3] == ord("{"))
# constrain characters to be printable ASCII or null byte
for i in range(max_length):
state.constrain(
operators.OR(
solution[i] == 0,
operators.AND(ord(" ") <= solution[i], solution[i] <= ord("}")),
)
)
address = state.cpu.RSP + 0x30
context["input_address"] = address
print("[+] input address: " + hex(state.cpu.RSP + 0x30))
state.cpu.write_bytes(address, solution)