Test a POV

Test a POV

Filter all writes to memory and split them to symbolic memory bytes and flag memory bytes. :return: None

Determine if the memory buffer has enough freedom, i.e., is "unconstrained enough", to store shellcode in the future. :param

[CGC only] checks if an ast contains 4 contiguous flag bytes if so returns the offset in bytes, otherwise returns None :retu

identify the size of bytes we control before overwriting return address

input state is at the basic block moving input to ip

[CGC only] Point an arbitrary-read location at the flag page. :param state: angr SimState instance. :param violati

Initialization steps. - Create a new angr project. - Load or collect ROP gadgets. - Restore states from a previous ch

generate a rop chain to invoke system(cmd_addr)

Return True if any process is listening on TCP `port`.

use the linked function gets to read in more global data :return: tuple of the address and constraints to add

use the linked function read to read in more global data :return: tuple of the address and constraints to add

Crash triaging. Fill in crash_types. :return: None

Block until a process is listening on TCP `port`. We check the socket state rather than connecting, because the target accept()s exactly one

windup state to a state just about to make a syscall

Perform tracing, memory write filtering, and crash triaging. :return: None

write @data into globally addressable memory using ROP :return: tuple of the address of the string and the constraint which adds the

modify the initial angr state for later symbolic tracing

Performs checks to determine whether this technique can be applied on the target binary with the given crash. Returning False will pr

collect a concrete trace

create an angr project through archr

create an initial angr state for later symbolic tracing

Creates a simple C file to do the type1 exploit :param filename: dumps the code to this path if filename is not None :return:

dumb tracer does not have information about the constraints on the input so it has to use concrete execution to identify the bad byte

identify the bad bytes by inspecting constraints in an unconstrained state the extracted bad bytes are used to help angrop filter gad

Use angrop to generate ROP gadgets and such for the target binary. :return: An angr.analyses.ROP instance.

determine what symbolic memory we control which is at a constant address in libc if libc_rop is enabled TODO: be able to specify tha

The idea here is there could be constraints such as no "\n" or no null bytes So we will try to claim control of a max of 7/8 bits in

Restore from a checkpoint file. :param str path: Path to the file which saves intermediate states. :return: No