ctf/angr/examples/b01lersctf2020_little_engine wsl2 kali

wsl2 kali linux 默认是4g内存，1g swap，运行b01lersctf2020_little_engine内存不足被杀。修改配置增加3g，成功运行。
1.打开Windows资源管理器,地址栏输入 %UserProfile% 回车,在该目录下创建一个文件, 名字为 .wslconfig ,写入内容示例如下 (我电脑8GB内存,分给WSL内存2GB,另外设置交换分区6GB)

[wsl2]
memory=2GB
swap=6GB
localhostForwarding=true

cmd执行 wsl --shutdown 关闭WSL,再重新打开即可
然后修改wp脚本

#!/usr/bin/env python
# coding: utf-8
import angr
import claripy
import time
import logging
import psutil
import os
import sys

#compiled on ubuntu 18.04 system:
#https://github.com/b01lers/b01lers-ctf-2020/tree/master/rev/100_little_engine

def main():
    #setup of addresses used in program
    #addresses assume base address of
    base_addr = 0x100000

    #length of desired input is 75 as found from reversing the binary in ghidra，
    #need to add 4 times this size, since the actual array is 4 times the size。实际上经过测试，这个长度并不对，如果改成222，而不是301，运行时间反而缩短了。222的最终输入：x.posix.dumps(0) b'??p?c?t?f?{?t?h?3?_?m?0?d?3?r?n?_?s?t?3?4?m?_?3?n?g?1?n?3?_?w?4?5?_?1?n?v030n0t030d0_010n0_010609080_0b0u0T0_0t0h030_0b030s0t0_000n030_0i0n0_010904000}00000000000000000000000000000000000000000000000000000000000000000000000\n'。实际长度应该是1+75*2
    #1 extra byte for first input
    input_len = 1+75*4

    #seting up the angr project
    # auto_load_libs can't be disabled as the test fails.
    p = angr.Project('./engine', main_opts={'base_addr': base_addr}, auto_load_libs=True)

    #looking at the code/binary, we can tell the input string is expected to fill 22 bytes,
    # thus the 8 byte symbolic size. Hopefully we can find the constraints the binary
    # expects during symbolic execution
    flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(input_len)]

    #extra \n for first input, then find the flag!
    flag = claripy.Concat( *flag_chars + [claripy.BVV(b'\n')])

    # enable unicorn engine for fast efficient solving
    st = p.factory.full_init_state(
            args=['./engine'],
            add_options=angr.options.unicorn,
            stdin=flag
           )

    #constrain to non-newline bytes
    #constrain to ascii-only characters
    for k in flag_chars:
        st.solver.add(k < 0x7f)
        st.solver.add(k > 0x20)

    # Construct a SimulationManager to perform symbolic execution.
    # Step until there is nothing left to be stepped.
    sm = p.factory.simulation_manager(st, veritesting=True)
    # sm.run()
    # for i in range(200):
    while sm.active:
    # while len(sm.deadended) <1:
        sm.step()
        print(sm.active)
        print('psutil.virtual_memory(): ', psutil.virtual_memory())
        print('psutil.swap_memory(): ', psutil.swap_memory())
        # print(sys.getsizeof(sm) / 1024 / 1024, 'MB')
        print(u'Process(os.getpid()).memory_info: %.4f GB' % (psutil.Process(os.getpid()).memory_info().rss / 1024 / 1024 / 1024) )
        print('len(sm.deadended): ', len(sm.deadended))

        # if len(sm.deadended)>0:
            # break

    #grab all finished states, that have the win function output in stdout
    y = []
    print('sm.deadended',len(sm.deadended), sm.deadended)
    for x in sm.deadended:
        print('x.posix.dumps(1)',x.posix.dumps(1))
        if b"Chugga" in x.posix.dumps(1):
            y.append(x)

    #grab the first output
    valid = y[0].posix.dumps(0)

    #parse and turn into final flag
    bt = [ chr(valid[i]) for i in range(0,len(valid),2)]
    flag = ''.join(bt)[1:76]
    return flag

def test():
    assert main() == "pctf{th3_m0d3rn_st34m_3ng1n3_w45_1nv3nt3d_1n_1698_buT_th3_b3st_0n3_in_1940}"

if __name__ == "__main__":
    before = time.time()
    # set some debug messages so that we know what's going on
    logging.getLogger('angr.sim_manager').setLevel('DEBUG')
    print(main())
    after = time.time()
    print("Time elapsed: {}".format(after - before))

结果如下

psutil.virtual_memory():  svmem(total=1999572992, available=18796544, percent=99.1, used=1875640320, free=67670016, active=176431104, inactive=1476464640, buffers=626688, cached=55635968, shared=118784, slab=70893568)
psutil.swap_memory():  sswap(total=6442450944, used=3220795392, free=3221655552, percent=50.0, sin=14468882432, sout=14932557824)
Process(os.getpid()).memory_info: 1.5066 GB
sm.deadended 2 [<SimState @ 0xa00098>, <SimState @ 0xa00098>]
x.posix.dumps(1) b"Welcome! We're doing things a little differently here, you're going to tell me a tidbit about trains. Are you ready?\nNow, I hope you're a total trainiac. Give me your best tidbit: Chugga chugga choo choo you're the little engine that CAN!\n"
x.posix.dumps(1) b"Welcome! We're doing things a little differently here, you're going to tell me a tidbit about trains. Are you ready?\nNow, I hope you're a total trainiac. Give me your best tidbit: I guess you don't know anything about trains...go do some TRAINing you non-conductor :(\n"
pctf{th3_m0d3rn_st34m_3ng1n3_w45_1nv3nt3d_1n_1698_buT_th3_b3st_0n3_in_1940}
Time elapsed: 1051.057656288147

另一个脚本解法：

import angr
import claripy
import sys

def Go():
    path_to_binary = "./engine" 
    project = angr.Project(path_to_binary, auto_load_libs=True)

    #length of desired input is 75 as found from reversing the binary in ghidra
    #need to add 4 times this size, since the actual array is 4 times the size
    #1 extra byte for first input
    input_len = 1+75*4
    #looking at the code/binary, we can tell the input string is expected to fill 22 bytes,
    # thus the 8 byte symbolic size. Hopefully we can find the constraints the binary
    # expects during symbolic execution
    flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(input_len)]

    #extra \n for first input, then find the flag!
    flag = claripy.Concat( *flag_chars + [claripy.BVV(b'\n')])

    initial_state = project.factory.entry_state(
            add_options=angr.options.unicorn,
            stdin=flag
    )
    #constrain to non-newline bytes
    #constrain to ascii-only characters
    for k in flag_chars:
        initial_state.solver.add(k < 0x7f)
        initial_state.solver.add(k > 0x20)
    simulation = project.factory.simgr(initial_state, veritesting=True)

    def is_successful(state):
        stdout_output = state.posix.dumps(1)
        if b'Chugga' in stdout_output:
            return True
        else: 
            return False

    def should_abort(state):
        stdout_output = state.posix.dumps(1)
        if b'know anything' in  stdout_output:
            return True
            
        else:
            return False

    simulation.explore(find=is_successful, avoid=should_abort)

    if simulation.found:
        for i in simulation.found:
            solution_state = i
            solution = solution_state.posix.dumps(0)
            print("[+] Success! Solution is: {0}".format(solution))
            #print(scanf0_solution, scanf1_solution)
            #grab the first output
            valid = solution_state.posix.dumps(0)

            #parse and turn into final flag
            bt = [ chr(valid[i]) for i in range(0,len(valid),2)]
            flag = ''.join(bt)[1:76]
            print('flag', flag)
    else:
        raise Exception('Could not find the solution')

if __name__ == "__main__":
    Go()

结果：

[+] Success! Solution is: b'??p?c?t?f?{?t?h?3?_?m?0?d?3?r?n?_?s?t?3?4?m?_?3?n?g?1?n?3?_?w?4?5?_?1?n?v030n0t030d0_010n0_010609080_0b0u0T0_0t0h030_0b030s0t0_000n030_0i0n0_010904000}000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n'
flag pctf{th3_m0d3rn_st34m_3ng1n3_w45_1nv3nt3d_1n_1698_buT_th3_b3st_0n3_in_1940}

gdb

sharti
layout asm or ctrl+x ctrl+a 两个快捷键一起切换asm窗口
n ni
s si
run c 
b __libc_start_main
b __libc_start_call_main
b *__libc_start_call_main+9  这个没有用，进入b __libc_start_call_main
用n 或者s可以进入main
info files可以看到base addr        Entry point: 0x555555555410
   0x5555555552f0    endbr64
? 0x5555555552f4    push   rbp
   0x5555555552f5    sub    rsp, 0x20
   0x5555555552f9    mov    rax, qword ptr fs:[0x28]
   0x555555555302    mov    qword ptr [rsp + 0x18], rax
   0x555555555307    xor    eax, eax
   0x555555555309    mov    rbp, rsp
   0x55555555530c    call   0x5555555556b0                <0x5555555556b0>   ? 0x7ffff7ae3237 <__libc_start_main+119>    mov    rdi, qword ptr [rsp]
   0x7ffff7ae323b <__libc_start_main+123>    mov    rdx, rbx
   0x7ffff7ae323e <__libc_start_main+126>    mov    esi, ebp
   0x7ffff7ae3240 <__libc_start_main+128>    call   __libc_start_call_main                <__libc_start_call_main>
? 0x7ffff7ae3170 <__libc_start_call_main+96>     mov    rax, qword ptr [rip + 0x1aae11]
   0x7ffff7ae3177 <__libc_start_call_main+103>    mov    rsi, qword ptr [rsp + 0x18]
   0x7ffff7ae317c <__libc_start_call_main+108>    mov    edi, dword ptr [rsp + 0x14]
   0x7ffff7ae3180 <__libc_start_call_main+112>    mov    rdx, qword ptr [rax]
   0x7ffff7ae3183 <__libc_start_call_main+115>    mov    rax, qword ptr [rsp + 8]
   0x7ffff7ae3188 <__libc_start_call_main+120>    call   rax