{{#include ../../../banners/hacktricks-training.md}} Sehemu ya cheatsheet hii inategemea [angr documentation](https://docs.angr.io/_/downloads/en/stable/pdf/). # Usanidi ```bash sudo apt-get install python3-dev libffi-dev build-essential python3 -m pip install --user virtualenv python3 -m venv ang source ang/bin/activate pip install angr ``` # Vitendo vya Msingi ```python import angr import monkeyhex # this will format numerical results in hexadecimal #Load binary proj = angr.Project('/bin/true') #BASIC BINARY DATA proj.arch #Get arch "" proj.arch.name #'AMD64' proj.arch.memory_endness #'Iend_LE' proj.entry #Get entrypoint "0x4023c0" proj.filename #Get filename "/bin/true" #There are specific options to load binaries #Usually you won't need to use them but you could angr.Project('examples/fauxware/fauxware', main_opts={'backend': 'blob', 'arch': 'i386'}, lib_opts={'libc.so.6': {'backend': 'elf'}}) ``` # Taarifa za Kitu Kilichopakiwa na Kitu Kikuu ## Takwimu Zilizopakiwa ```python #LOADED DATA proj.loader # proj.loader.min_addr #0x400000 proj.loader.max_addr #0x5004000 proj.loader.all_objects #All loaded proj.loader.shared_objects #Loaded binaries """ OrderedDict([('true', ), ('libc.so.6', ), ('ld-linux-x86-64.so.2', ), ('extern-address space', ), ('cle##tls', )]) """ proj.loader.all_elf_objects #Get all ELF objects loaded (Linux) proj.loader.all_pe_objects #Get all binaries loaded (Windows) proj.loader.find_object_containing(0x400000)#Get object loaded in an address "" ``` ## Kitu Kikuu ```python #Main Object (main binary loaded) obj = proj.loader.main_object # obj.execstack #"False" Check for executable stack obj.pic #"True" Check PIC obj.imports #Get imports obj.segments #, , ]> obj.find_segment_containing(obj.entry) #Get segment by address obj.sections #, <.interp | offset 0x238, vaddr 0x400238, size 0x1c>, <.note.ABI-tag | offset 0x254, vaddr 0x400254, size 0x20>, <.note.gnu.build-id ... obj.find_section_containing(obj.entry) #Get section by address obj.plt['strcmp'] #Get plt address of a funcion (0x400550) obj.reverse_plt[0x400550] #Get function from plt address ('strcmp') ``` ## Alama na Mabadiliko ```python strcmp = proj.loader.find_symbol('strcmp') # strcmp.name #'strcmp' strcmp.owne # strcmp.rebased_addr #0x1089cd0 strcmp.linked_addr #0x89cd0 strcmp.relative_addr #0x89cd0 strcmp.is_export #True, as 'strcmp' is a function exported by libc #Get strcmp from the main object main_strcmp = proj.loader.main_object.get_symbol('strcmp') main_strcmp.is_export #False main_strcmp.is_import #True main_strcmp.resolvedby # ``` ## Blocks ```python #Blocks block = proj.factory.block(proj.entry) #Get the block of the entrypoint fo the binary block.pp() #Print disassembly of the block block.instructions #"0xb" Get number of instructions block.instruction_addrs #Get instructions addresses "[0x401670, 0x401672, 0x401675, 0x401676, 0x401679, 0x40167d, 0x40167e, 0x40167f, 0x401686, 0x40168d, 0x401694]" ``` # Uchambuzi wa Kineti ## Meneja wa Simulizi, Hali ```python #Live States #This is useful to modify content in a live analysis state = proj.factory.entry_state() state.regs.rip #Get the RIP state.mem[proj.entry].int.resolved #Resolve as a C int (BV) state.mem[proj.entry].int.concreteved #Resolve as python int state.regs.rsi = state.solver.BVV(3, 64) #Modify RIP state.mem[0x1000].long = 4 #Modify mem #Other States project.factory.entry_state() project.factory.blank_state() #Most of its data left uninitialized project.factory.full_init_statetate() #Execute through any initializers that need to be run before the main binary's entry point project.factory.call_state() #Ready to execute a given function. #Simulation manager #The simulation manager stores all the states across the execution of the binary simgr = proj.factory.simulation_manager(state) #Start simgr.step() #Execute one step simgr.active[0].regs.rip #Get RIP from the last state ``` ## Kuita kazi - Unaweza kupitisha orodha ya hoja kupitia `args` na kamusi ya mabadiliko ya mazingira kupitia `env` katika `entry_state` na `full_init_state`. Thamani katika muundo hii zinaweza kuwa nyuzi au bitvectors, na zitaandikwa katika hali kama hoja na mazingira ya utekelezaji wa kuigwa. `args` ya kawaida ni orodha tupu, hivyo ikiwa programu unayoichambua inatarajia kupata angalau `argv[0]`, unapaswa kila wakati kutoa hiyo! - Ikiwa ungependa kuwa `argc` ni ya alama, unaweza kupitisha bitvector ya alama kama `argc` kwa wajenzi wa `entry_state` na `full_init_state`. Kuwa makini, ingawa: ikiwa utafanya hivi, unapaswa pia kuongeza kizuizi kwa hali inayotokana ambayo thamani yako ya argc haiwezi kuwa kubwa zaidi ya idadi ya hoja ulizopitisha katika `args`. - Ili kutumia hali ya wito, unapaswa kuitwa na `.call_state(addr, arg1, arg2, ...)`, ambapo `addr` ni anwani ya kazi unayotaka kuita na `argN` ni hoja ya Nth kwa kazi hiyo, iwe kama nambari ya python, nyuzi, au array, au bitvector. Ikiwa unataka kuwa na kumbukumbu iliyotengwa na kwa kweli kupitisha kiashiria kwa kitu, unapaswa kuifunga katika PointerWrapper, yaani `angr.PointerWrapper("point to me!")`. Matokeo ya API hii yanaweza kuwa yasiyotabirika kidogo, lakini tunafanya kazi juu yake. ## BitVectors ```python #BitVectors state = proj.factory.entry_state() bv = state.solver.BVV(0x1234, 32) #Create BV of 32bits with the value "0x1234" state.solver.eval(bv) #Convert BV to python int bv.zero_extend(30) #Will add 30 zeros on the left of the bitvector bv.sign_extend(30) #Will add 30 zeros or ones on the left of the BV extending the sign ``` ## BitVectors za Kihisia na Vikwazo ```python x = state.solver.BVS("x", 64) #Symbolic variable BV of length 64 y = state.solver.BVS("y", 64) #Symbolic oprations tree = (x + 1) / (y + 2) tree # tree.op #'__floordiv__' Access last operation tree.args #(, ) tree.args[0].op #'__add__' Access of dirst arg tree.args[0].args #(, ) tree.args[0].args[1].op #'BVV' tree.args[0].args[1].args #(1, 64) #Symbolic constraints solver state = proj.factory.entry_state() #Get a fresh state without constraints input = state.solver.BVS('input', 64) operation = (((input + 4) * 3) >> 1) + input output = 200 state.solver.add(operation == output) state.solver.eval(input) #0x3333333333333381 state.solver.add(input < 2**32) state.satisfiable() #False #Solver solutions solver.eval(expression) #one possible solution solver.eval_one(expression) #solution to the given expression, or throw an error if more than one solution is possible. solver.eval_upto(expression, n) #n solutions to the given expression, returning fewer than n if fewer than n are possible. solver.eval_atleast(expression, n) #n solutions to the given expression, throwing an error if fewer than n are possible. solver.eval_exact(expression, n) #n solutions to the given expression, throwing an error if fewer or more than are possible. solver.min(expression) #minimum possible solution to the given expression. solver.max(expression) #maximum possible solution to the given expression. ``` ## Hooking ```python >>> stub_func = angr.SIM_PROCEDURES['stubs']['ReturnUnconstrained'] # this is a CLASS >>> proj.hook(0x10000, stub_func()) # hook with an instance of the class >>> proj.is_hooked(0x10000) # these functions should be pretty self-explanitory True >>> proj.hooked_by(0x10000) >>> proj.unhook(0x10000) >>> @proj.hook(0x20000, length=5) ... def my_hook(state): ... state.regs.rax = 1 >>> proj.is_hooked(0x20000) True ``` Zaidi ya hayo, unaweza kutumia `proj.hook_symbol(name, hook)`, ukitoa jina la alama kama hoja ya kwanza, kuunganisha anwani ambapo alama hiyo inapatikana # Mifano {{#include ../../../banners/hacktricks-training.md}}