#!/usr/bin/env python3

# Author: David Manouchehri <manouchehri@protonmail.com>
# Modern Binary Exploitation
# http://security.cs.rpi.edu/courses/binexp-spring2015/

import angr

FIND_ADDR = 0x08048533 # mov dword [esp], str.Congrats_ ; [0x8048654:4]=0x676e6f43 LEA str.Congrats_ ; "Congrats!" @ 0x8048654
AVOID_ADDR = 0x08048554 # mov dword [esp], str.Wrong_ ; [0x804865e:4]=0x6e6f7257 LEA str.Wrong_ ; "Wrong!" @ 0x804865e


def main():
	proj = angr.Project('crackme0x00a', load_options={"auto_load_libs": False})
	sm = proj.factory.simulation_manager()
	sm.explore(find=FIND_ADDR, avoid=AVOID_ADDR)
	return sm.found[0].posix.dumps(0).split(b'\0')[0] # stdin

def test():
	assert main() == b'g00dJ0B!'

if __name__ == '__main__':
	print(main())

560607cce5128d6b1946d8b64b592e30904e0ef4
<mask token>


def main():
    proj = angr.Project('crackme0x00a', load_options={'auto_load_libs': False})
    sm = proj.factory.simulation_manager()
    sm.explore(find=FIND_ADDR, avoid=AVOID_ADDR)
    return sm.found[0].posix.dumps(0).split(b'\x00')[0]


def test():
    assert main() == b'g00dJ0B!'


<mask token>

<mask token>


def main():
    proj = angr.Project('crackme0x00a', load_options={'auto_load_libs': False})
    sm = proj.factory.simulation_manager()
    sm.explore(find=FIND_ADDR, avoid=AVOID_ADDR)
    return sm.found[0].posix.dumps(0).split(b'\x00')[0]


def test():
    assert main() == b'g00dJ0B!'


if __name__ == '__main__':
    print(main())

<mask token>
FIND_ADDR = 134513971
AVOID_ADDR = 134514004


def main():
    proj = angr.Project('crackme0x00a', load_options={'auto_load_libs': False})
    sm = proj.factory.simulation_manager()
    sm.explore(find=FIND_ADDR, avoid=AVOID_ADDR)
    return sm.found[0].posix.dumps(0).split(b'\x00')[0]


def test():
    assert main() == b'g00dJ0B!'


if __name__ == '__main__':
    print(main())

import angr
FIND_ADDR = 134513971
AVOID_ADDR = 134514004


def main():
    proj = angr.Project('crackme0x00a', load_options={'auto_load_libs': False})
    sm = proj.factory.simulation_manager()
    sm.explore(find=FIND_ADDR, avoid=AVOID_ADDR)
    return sm.found[0].posix.dumps(0).split(b'\x00')[0]


def test():
    assert main() == b'g00dJ0B!'


if __name__ == '__main__':
    print(main())

#!/usr/bin/env python3

# Author: David Manouchehri <manouchehri@protonmail.com>
# Modern Binary Exploitation
# http://security.cs.rpi.edu/courses/binexp-spring2015/

import angr

FIND_ADDR = 0x08048533 # mov dword [esp], str.Congrats_ ; [0x8048654:4]=0x676e6f43 LEA str.Congrats_ ; "Congrats!" @ 0x8048654
AVOID_ADDR = 0x08048554 # mov dword [esp], str.Wrong_ ; [0x804865e:4]=0x6e6f7257 LEA str.Wrong_ ; "Wrong!" @ 0x804865e


def main():
	proj = angr.Project('crackme0x00a', load_options={"auto_load_libs": False})
	sm = proj.factory.simulation_manager()
	sm.explore(find=FIND_ADDR, avoid=AVOID_ADDR)
	return sm.found[0].posix.dumps(0).split(b'\0')[0] # stdin

def test():
	assert main() == b'g00dJ0B!'

if __name__ == '__main__':
	print(main())
