angr 系列教程(一）核心概念及模块解读

>>> import angr
>>> proj = angr.Project('/bin/true')

>>> proj.arch
>>> proj.entry
>>> proj.filename

>>> proj.loader
<Loaded true, maps [0x400000:0x5004000]>

>>> proj.loader.shared_objects
OrderedDict([('true', <ELF Object true, maps [0x400000:0x60721f]>), ('libc.so.6', <ELF Object libc-2.27.so, maps [0x1000000:0x13f0adf]>), ('ld-linux-x86-64.so.2', <ELF Object ld-2.27.so, maps [0x2000000:0x222916f]>)])
>>> proj.loader.min_addr
>>> proj.loader.max_addr

>>> block = proj.factory.block(proj.entry)
<Block for 0x4017b0, 42 bytes>

>>> block.
block.BLOCK_MAX_SIZE          block.instruction_addrs       block.serialize_to_cmessage(
block.addr                    block.instructions            block.size
block.arch                    block.parse(                  block.thumb
block.bytes                   block.parse_from_cmessage(    block.vex
block.capstone                block.pp(                     block.vex_nostmt
block.codenode                block.serialize(

>>> state = proj.factory.entry_state()
<SimState @ 0x401670>

>>> state.regs.rip
<BV64 0x4017b0>
>>> state.regs.rax
<BV64 0x1c>
>>> state.mem[proj.entry].int.resolved
<BV32 0x8949ed31>

>>> bv = state.solver.BVV(0x1234, 32)       # create a 32-bit-wide bitvector with value 0x1234
<BV32 0x1234>                               # BVV stands for bitvector value
>>> state.solver.eval(bv)                # convert to python int
0x1234

>>> state.regs.rsi = state.solver.BVV(3, 64)
>>> state.regs.rsi
<BV64 0x3>
>>> state.mem[0x1000].long = 4
>>> state.mem[0x1000].long.resolved
<BV64 0x4>

>>> simgr = proj.factory.simulation_manager(state)
>>> simgr.active
[<SimState @ 0x4017b0>]

>>> simgr.step()

>>> simgr.active
[<SimState @ 0x1021ab0>]
>>> simgr.active[0].regs.rip
<BV64 0x1021ab0>
>>> state.regs.rip          
<BV64 0x4017b0>

>>> proj.analyses.
proj.analyses.BackwardSlice(              proj.analyses.Decompiler(                 proj.analyses.VFG(
proj.analyses.BasePointerSaveSimplifier(  proj.analyses.DefUseAnalysis(             proj.analyses.VSA_DDG(
proj.analyses.BinDiff(                    proj.analyses.Disassembly(               proj.analyses.VariableRecovery(
proj.analyses.BinaryOptimizer(            proj.analyses.DominanceFrontier(         proj.analyses.VariableRecoveryFast(       .....

>>> obj = proj.loader.main_object
<ELF Object true, maps [0x400000:0x60721f]>
>>> obj = proj.loader.all_objects
[<ELF Object true, maps [0x400000:0x60721f]>, <ExternObject Object cle##externs, maps [0x1000000:0x1008000]>, <ELFTLSObject Object cle##tls, maps [0x2000000:0x2015010]>, <KernelObject Object cle##kernel, maps [0x3000000:0x3008000]>]

>>> obj.sections                     
<Regions: [<Unnamed | offset 0x0, vaddr 0x400000, size 0x0>, <.interp | offset 0x238, vaddr 0x400238, size 0x1c>, <.note.ABI-tag | offset 0x254, vaddr 0x400254, size 0x20>, <.note.gnu.build-id | offset 0x274, vaddr 0x400274, size 0x24>, <.gnu.hash | offset 0x298, vaddr 0x400298, size 0x64>,...

>>> obj.plt
{'__uflow': 0x401400,
 'getenv': 0x401410,
 'free': 0x401420,
 'abort': 0x401430,
 '__errno_location': 0x401440,
 'strncmp': 0x401450,
 '_exit': 0x401460,

>>> obj.linked_base
0x0
>>> 
>>> obj.mapped_base
0x400000
>>> obj.max_addr
0x60721f

>>> malloc = proj.loader.find_symbol('malloc')
<Symbol "malloc" in extern-address space at 0x10002c0>

malloc = proj.loader.main_object.get_symbol('malloc')

>>> malloc.
malloc.is_common           malloc.is_local            malloc.owner_obj           malloc.resolvedby
malloc.is_export           malloc.is_static           malloc.rebased_addr        malloc.size
malloc.is_extern           malloc.is_weak             malloc.relative_addr       malloc.subtype
malloc.is_forward          malloc.linked_addr         malloc.resolve(            malloc.type
malloc.is_function         malloc.name                malloc.resolve_forwarder(  
malloc.is_import           malloc.owner               malloc.resolved

>>> malloc.rebased_addr
0x10002c0
>>> malloc.linked_addr 
0x2c0     
>>> malloc.relative_addr
0x2c0

>>> proj = angr.Project('/bin/true')
>>> proj.loader.shared_objects
OrderedDict([('true', <ELF Object true, maps [0x400000:0x60721f]>), ('libc.so.6', <ELF Object libc-2.27.so, maps [0x1000000:0x13f0adf]>), ('ld-linux-x86-64.so.2', <ELF Object ld-2.27.so, maps [0x2000000:0x222916f]>)])
>>> proj = angr.Project('/bin/true', load_options={"auto_load_libs": False})
>>> proj.loader.shared_objects
OrderedDict([('true', <ELF Object true, maps [0x400000:0x60721f]>)])

>>> angr.Project('examples/fauxware/fauxware', main_opts={'backend': 'blob', 'arch': 'i386'}, lib_opts={'libc.so.6': {'backend': 'elf'}})
<Project examples/fauxware/fauxware>

>>> angr.procedures.
angr.procedures.SIM_PROCEDURES  angr.procedures.java_lang       angr.procedures.stubs
angr.procedures.SimProcedures   angr.procedures.java_util       angr.procedures.testing
angr.procedures.advapi32        angr.procedures.libc            angr.procedures.tracer
angr.procedures.cgc             angr.procedures.linux_kernel    angr.procedures.uclibc
angr.procedures.definitions     angr.procedures.linux_loader    angr.procedures.win32
angr.procedures.glibc           angr.procedures.msvcr           .......

>>> angr.procedures.libc.malloc
<module 'angr.procedures.libc.malloc' from '/home/angr/angr-dev/angr/angr/procedures/libc/malloc.py'>
>>> angr.SIM_PROCEDURES['libc']['malloc']
<class 'angr.procedures.libc.malloc.malloc'>

>>> stub_func = angr.SIM_PROCEDURES['stubs']['ReturnUnconstrained'] # this is a CLASS
>>> proj.hook(0x10000, stub_func())  # hook with an instance of the class
>>> proj.is_hooked(0x10000)            # these functions should be pretty self-explanitory
True
>>> proj.hooked_by(0x10000)
<ReturnUnconstrained>
>>> proj.unhook(0x10000)
>>> @proj.hook(0x20000, length=5)
... def my_hook(state):
...     state.regs.rax = 1
>>> proj.is_hooked(0x20000)
True

>>> state.regs.r  
state.regs.r10                state.regs.r13w               state.regs.r9d
state.regs.r10b               state.regs.r14                state.regs.r9w
state.regs.r10d               state.regs.r14b               state.regs.rax
state.regs.r10w               state.regs.r14d               state.regs.rbp

>>> state.regs.rip
<BV64 0x4017b0>

def load(self, addr, size=None, condition=None, fallback=None, add_constraints=None, action=None, endness=None,
             inspect=True, disable_actions=False, ret_on_segv=False):
        """
        Loads size bytes from dst.
        :param addr:             The address to load from. #读取的地址
        :param size:            The size (in bytes) of the load. #大小
        :param condition:       A claripy expression representing a condition for a conditional load.
        :param fallback:        A fallback value if the condition ends up being False. 
        :param add_constraints: Add constraints resulting from the merge (default: True).
        :param action:          A SimActionData to fill out with the constraints.
        :param endness:         The endness to load with. #端序
       ....

def store(self, addr, data, size=None, condition=None, add_constraints=None, endness=None, action=None,
              inspect=True, priv=None, disable_actions=False):
        """
        Stores content into memory.
        :param addr:        A claripy expression representing the address to store at. #内存地址
        :param data:        The data to store (claripy expression or something convertable to a claripy expression).#写入的数据
        :param size:        A claripy expression representing the size of the data to store. #大小
        ...

>>> s = proj.factory.blank_state()
>>> s.memory.store(0x4000, s.solver.BVV(0x0123456789abcdef0123456789abcdef, 128))
>>> s.memory.load(0x4004, 6) # load-size is in bytes
<BV48 0x89abcdef0123>

>>> import archinfo
>>> s.memory.load(0x4000, 4, endness=archinfo.Endness.LE)
<BV32 0x67453201>

>>> angr.options.
Display all 143 possibilities? (y or n)
angr.options.ABSTRACT_MEMORY
angr.options.ABSTRACT_SOLVER
angr.options.ACTION_DEPS
angr.options.ALLOW_SEND_FAILURES
angr.options.ALL_FILES_EXIST
angr.options.APPROXIMATE_FIRST
angr.options.APPROXIMATE_GUARDS
....

>>> s.options.add(angr.options.LAZY_SOLVES)
# Create a new state with lazy solves enabled
>>> s = proj.factory.entry_state(add_options={angr.options.LAZY_SOLVES})
# Create a new state without simplification options enabled
>>> s = proj.factory.entry_state(remove_options=angr.options.simplification)

for addr in state.history.bbl_addrs: 
    print hex(addr)

>>> simgr = proj.factory.simulation_manager(state)
<SimulationManager with 1 active>

>>> simgr = proj.factory.simgr()
>>> simgr.active
[<SimState @ 0x4017b0>]

>>> simgr.move(from_stash='deadended', to_stash='authenticated', filter_func=lambda s: b'Welcome' in s.posix.dumps(1))
>>> simgr
<SimulationManager with 2 authenticated, 1 deadended>

def explore(self, stash='active', n=None, find=None, avoid=None, find_stash='found', avoid_stash='avoid', cfg=None,
                num_find=1, **kwargs):

>>> one = state.solver.BVV(1, 64)
 <BV64 0x1>
>>> one_hundred = state.solver.BVV(100, 64)
<BV64 0x64>
>>> weird_nine = state.solver.BVV(9, 27)
<BV27 0x9>

>>> one + one_hundred
<BV64 0x65>
>>> one_hundred + 0x100
<BV64 0x164>
>>> one_hundred - one*200
<BV64 0xffffffffffffff9c>

>>> x = state.solver.BVS("x", 64)
<BV64 x_9_64>
>>> y = state.solver.BVS("y", 64)
<BV64 y_10_64>

>>> x + one
<BV64 x_9_64 + 0x1>
>>> (x + one) / 2
<BV64 (x_9_64 + 0x1) / 0x2>
>>> x - y
<BV64 x_9_64 - y_10_64>

>>> x == 1
<Bool x_9_64 == 0x1>
>>> x == one
<Bool x_9_64 == 0x1>
>>> x > 2
<Bool x_9_64 > 0x2>
>>> x + y == one_hundred + 5
<Bool (x_9_64 + y_10_64) == 0x69>

>>> state.solver.add(x > y)
>>> state.solver.add(y > 2)
>>> state.solver.add(10 > x)
>>> state.solver.eval(x)

# get a fresh state without constraints
>>> state = proj.factory.entry_state()
>>> input = state.solver.BVS('input', 64)
>>> operation = (((input + 4) * 3) >> 1) + input
>>> output = 200
>>> state.solver.add(operation == output)
>>> state.solver.eval(input)
0x3333333333333381

>>> import angr
>>> p = angr.Project('/bin/true', load_options={'auto_load_libs': False})
>>> cfg = p.analyses.CFGFast()

>>> import angr
# Load the project
>>> b = angr.Project("examples/fauxware/fauxware", load_options={"auto_load_libs": False})

# Generate a CFG first. In order to generate data dependence graph afterwards, you’ll have to:
# - keep all input states by specifying keep_state=True.
# - store memory, register and temporary values accesses by adding the angr.options.refs option set.
# Feel free to provide more parameters (for example, context_sensitivity_level) for CFG 
# recovery based on your needs.
>>> cfg = b.analyses.CFGEmulated(keep_state=True, 
...                              state_add_options=angr.sim_options.refs, 
...                              context_sensitivity_level=2)

# 生成控制流依赖图
>>> cdg = b.analyses.CDG(cfg)

# 生成数据流依赖图
>>> ddg = b.analyses.DDG(cfg)

# See where we wanna go... let’s go to the exit() call, which is modeled as a 
# SimProcedure.
>>> target_func = cfg.kb.functions.function(name="exit")
# We need the CFGNode instance
>>> target_node = cfg.get_any_node(target_func.addr)

# Let’s get a BackwardSlice out of them!
# `targets` is a list of objects, where each one is either a CodeLocation 
# object, or a tuple of CFGNode instance and a statement ID. Setting statement 
# ID to -1 means the very beginning of that CFGNode. A SimProcedure does not 
# have any statement, so you should always specify -1 for it.
>>> bs = b.analyses.BackwardSlice(cfg, cdg=cdg, ddg=ddg, targets=[ (target_node, -1) ])

# Here is our awesome program slice!
>>> print(bs)

>>> import angr

# get all the matches
>>> p = angr.Project("../binaries/tests/i386/identifiable")
>>> idfer = p.analyses.Identifier()
# note that .run() yields results so make sure to iterate through them or call list() etc
>>> for addr, symbol in idfer.run():
...     print(hex(addr), symbol)

0x8048e60 memcmp
0x8048ef0 memcpy
0x8048f60 memmove
0x8049030 memset
0x8049320 fdprintf
0x8049a70 sprintf
0x8049f40 strcasecmp
....