GitHub

angr_ctf题解

从第三章开始我本地(ubuntu20.04)编译出来后跑angr跑不出结果。原因是在main函数开头有以下代码

call    __x86_get_pc_thunk_bx
add     eax, (offset _GLOBAL_OFFSET_TABLE_ - $)

然后_GLOBAL_OFFSET_TABLE_的地址就一直保存在ebx中.也就是说从中间开始执行需要设置下ebx ps:基于IP寻址(IP-relative addressing modes)似乎是x64引入，x86并不支持

Name		Name	Last commit message	Last commit date
Latest commit History 7 Commits
00_angr_find		00_angr_find
01_angr_avoid		01_angr_avoid
02_angr_find_condition		02_angr_find_condition
03_angr_symbolic_registers		03_angr_symbolic_registers
04_angr_symbolic_stack		04_angr_symbolic_stack
05_angr_symbolic_memory		05_angr_symbolic_memory
06_angr_symbolic_dynamic_memory		06_angr_symbolic_dynamic_memory
07_angr_symbolic_file		07_angr_symbolic_file
08_angr_constraints		08_angr_constraints
09_angr_hooks		09_angr_hooks
10_angr_simprocedures		10_angr_simprocedures
11_angr_sim_scanf		11_angr_sim_scanf
12_angr_veritesting		12_angr_veritesting
13_angr_static_binary		13_angr_static_binary
14_angr_shared_library		14_angr_shared_library
15_angr_arbitrary_read		15_angr_arbitrary_read
16_angr_arbitrary_write		16_angr_arbitrary_write
17_angr_arbitrary_jump		17_angr_arbitrary_jump
dist		dist
solutions		solutions
xx_angr_segfault		xx_angr_segfault
LICENSE		LICENSE
NOTES		NOTES
README.md		README.md
SymbolicExecution.pptx		SymbolicExecution.pptx
package.py		package.py
requirements.txt		requirements.txt
solve.py		solve.py

Provide feedback