added few ctfs

training/IntroAngr/.python-version

@@ -0,0 +1 @@
+3.13

training/IntroAngr/Angr.rep/idata/00/00000000.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="839fc9f1f99c208616946397875" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="lineq1" />
+    </BASIC_INFO>
+</FILE_INFO>

training/IntroAngr/Angr.rep/idata/00/00000001.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="839fc9f1fae2210338683770166" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="lineq2" />
+    </BASIC_INFO>
+</FILE_INFO>

training/IntroAngr/Angr.rep/idata/~index.bak

@@ -0,0 +1,6 @@
+VERSION=1
+/
+  00000000:lineq1:839fc9f1f99c208616946397875
+  00000001:lineq2:839fc9f1fae2210338683770166
+NEXT-ID:2
+MD5:d41d8cd98f00b204e9800998ecf8427e

training/IntroAngr/Angr.rep/idata/~index.dat

@@ -0,0 +1,6 @@
+VERSION=1
+/
+  00000000:lineq1:839fc9f1f99c208616946397875
+  00000001:lineq2:839fc9f1fae2210338683770166
+NEXT-ID:2
+MD5:d41d8cd98f00b204e9800998ecf8427e

training/IntroAngr/Angr.rep/project.prp

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="OWNER" TYPE="string" VALUE="cato" />
+    </BASIC_INFO>
+</FILE_INFO>

training/IntroAngr/Angr.rep/user/00/00000000.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="839fc9f1fae1210323390182625" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_839fc9f1f99c208616946397875" />
+    </BASIC_INFO>
+</FILE_INFO>

training/IntroAngr/Angr.rep/user/00/00000001.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="839fc9f1ce22223344391292291" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_839fc9f1fae2210338683770166" />
+    </BASIC_INFO>
+</FILE_INFO>

training/IntroAngr/Angr.rep/user/~index.bak

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

training/IntroAngr/Angr.rep/user/~index.dat

@@ -0,0 +1,5 @@
+VERSION=1
+/
+  00000000:udf_839fc9f1f99c208616946397875:839fc9f1fae1210323390182625
+NEXT-ID:1
+MD5:d41d8cd98f00b204e9800998ecf8427e

training/IntroAngr/Angr.rep/user/~journal.bak

@@ -0,0 +1,2 @@
+IADD:00000000:/udf_839fc9f1f99c208616946397875
+IDSET:/udf_839fc9f1f99c208616946397875:839fc9f1fae1210323390182625

training/IntroAngr/Angr.rep/user/~journal.dat

@@ -0,0 +1,2 @@
+IADD:00000001:/udf_839fc9f1fae2210338683770166
+IDSET:/udf_839fc9f1fae2210338683770166:839fc9f1ce22223344391292291

training/IntroAngr/Angr.rep/versioned/~index.bak

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

training/IntroAngr/Angr.rep/versioned/~index.dat

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

training/IntroAngr/challs/lineq1.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+
+import angr
+import os
+
+base_addr = 0x400000
+main_fun = base_addr +  0x10a0
+
+binarypath = "./lineq1"
+
+# Load the binary
+p = angr.Project(binarypath, auto_load_libs=False)
+
+# If you want debug output
+import logging
+logging.getLogger('angr').setLevel('INFO')
+
+proto = "int calc_flag(void)" # Example for main
+
+## Initialize call state with useful options
+#   ZERO_FILL_UNCONSTRAINED_MEMORY: Memory that is used but not initialized is set to 0
+#   ZERO_FILL_UNCONSTRAINED_REGISTERS: Registers that are used but are not initialized are set to 0, this prevents warnings whencallee-saved registers are pushed onto the stack
+#   LAZY_SOLVES: This is somewhat of a magic "hack": Do not query the constrained solver unless really necessary. If you're trying to go through a specific code path, this can save tons of time! Experiment with and without it!
+state = p.factory.call_state(main_fun, prototype=proto,
+                             add_options=({angr.options.ZERO_FILL_UNCONSTRAINED_MEMORY,
+                                           angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS,
+                                           angr.options.LAZY_SOLVES}),
+                             )
+
+
+# Initialize a simulation manager with the state
+sm = p.factory.simulation_manager(state)
+
+
+# Perform explore
+print("Starting explore...")
+
+# Try to find a state that fulfills a certain condition via exploration
+# Useful: s.posix.dumps(1) to access stdout and s.posix.dumps(2) to access stderr
+# Note: find and avoid can also have single integers (addresses) or lists of integers
+sm.explore(find=lambda s: b'Success' in s.posix.dumps(1))
+# dump stdin and stdout of found states
+for s in sm.found:
+    print(s.posix.dumps(1))
+    print(s.posix.dumps(0).strip(b'\x00').decode())

training/IntroAngr/challs/lineq2.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+
+import angr
+import claripy
+import os
+
+base_addr = 0x400000
+main_fun = base_addr + 0x1080
+
+binarypath = "./lineq2"
+
+# Load the binary
+p = angr.Project(binarypath, auto_load_libs=False)
+
+# If you want debug output
+import logging
+logging.getLogger('angr').setLevel('INFO')
+
+
+
+class ConcretizationHandler(object):
+    def __init__(self, dbg_addr=0xDEADAFFE0000):
+        self.DEBUG_ADDR = dbg_addr
+
+    def before_address_concretization(self, state):
+        self.index_expr = state.inspect.address_concretization_expr
+        state.inspect.address_concretization_expr = self.DEBUG_ADDR
+
+    """
+    Angr API:
+
+
+    """
+    def after_address_concretization(self, state):
+        ## TODO
+        # Set self.DEBUG_ADDR to a value modeling the array access / mathematical operation that is actually performed
+        # memory can be set via state.mem[addr].uint8_t = ..., state.mem[addr].uint16_t = ..., etc.
+
+        # Do not add new path constraints
+        state.inspect.address_concretization_add_constraints = False
+        # Specify our DEBUG_ADDR as the target of the concretization
+        state.inspect.address_concretization_result = [self.DEBUG_ADDR]
+
+
+
+
+
+
+
+proto = "int check_flag(void)" # Example for main
+
+## Initialize call state with useful options
+#   ZERO_FILL_UNCONSTRAINED_MEMORY: Memory that is used but not initialized is set to 0
+#   ZERO_FILL_UNCONSTRAINED_REGISTERS: Registers that are used but are not initialized are set to 0, this prevents warnings whencallee-saved registers are pushed onto the stack
+#   LAZY_SOLVES: This is somewhat of a magic "hack": Do not query the constrained solver unless really necessary. If you're trying to go through a specific code path, this can save tons of time! Experiment with and without it!
+state = p.factory.call_state(main_fun, prototype=proto,
+                             add_options=({angr.options.ZERO_FILL_UNCONSTRAINED_MEMORY,
+                                           angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS,
+                                           angr.options.LAZY_SOLVES}),
+                             )
+
+# Register concretization hooks
+conc_handler = ConcretizationHandler()
+state.inspect.b('address_concretization', when=angr.BP_BEFORE, action=conc_handler.before_address_concretization)
+state.inspect.b('address_concretization', when=angr.BP_AFTER, action=conc_handler.after_address_concretization)
+
+
+
+# Initialize a simulation manager with the state
+sm = p.factory.simulation_manager(state)
+
+
+# Perform explore
+print("Starting explore...")
+
+# Try to find a state that fulfills a certain condition via exploration
+# Useful: s.posix.dumps(1) to access stdout and s.posix.dumps(2) to access stderr
+# Note: find and avoid can also have single integers (addresses) or lists of integers
+sm.explore(find=lambda s: False, avoid=lambda s: False) # TODO
+
+# dump stdin and stdout of found states
+for s in sm.found:
+    print(s.posix.dumps(1))
+    print(s.posix.dumps(0).strip(b'\x00').decode())

training/IntroAngr/cheatsheet.md

@@ -0,0 +1,49 @@
+Angr + Claripy Cheatsheet
+===
+
+Also available at: https://pad.sec.in.tum.de/V1nxhCWqRM2FWski2iHysg#
+
+To be completed
+
+# Angr
+
+ - Read/Write Register: `state.regs.<regname>`
+ - Write memory: `state.mem[addr].uintX_t = value`
+ - Read memory: `value = state.mem[addr].uintX_t.resolved.args[0]`
+ - Add constraint/condition: `state.solver.add(constraint)`
+ - Get possible value of symbolic expression in state: `state.solver.eval(expr)`
+ - Read stdin/stdout/stderr in found state: `state.posix.dumps(<fd>)`
+
+ - Single-Step: `next_states = project.factory.successors(state, num_inst=1)`
+
+ - Increase libc symbolic buffer max size: `state.libc.buf_symbolic_bytes = 0x100`
+
+ - Provide stdin: In state initializer, add `stdin=flag_bvv`
+
+
+## Concretization hacks:
+
+ - hooking:
+    - `state.inspect.b('address_concretization', when=angr.BP_BEFORE, action=func)`
+    - `state.inspect.b('address_concretization', when=angr.BP_AFTER, action=func)`
+
+
+
+# Claripy
+Note: In general, bit vectors are **big-endian**!
+
+Values:
+ - Create symbolic variable: `claripy.BVS('sym_arg', bitsize)`
+ - Create constant value: `claripy.BVV(value, bitsize)`
+ - Create constant value from bytes: `claripy.BVV(bytes)`
+ - Combine multiple values: `flag = claripy.Concat(*flag_bytes)`
+
+Expressions:
+ - Check if expression is constant `expr.op == 'BVV'`
+ - Access expression children: `expr.args`
+ - Split bitvector into smaller bitvectors (big-endian!), e.g. bytes: `expr.chop(8)`
+ - If-then-else: `claripy.If(cond, then, else)
+ - Normal arithmetic: Use python operators; generally mimics `z3` behavior
+
+
+API-Reference: https://docs.angr.io/projects/claripy/en/latest/api.html

training/IntroAngr/homework/.gitignore

@@ -0,0 +1 @@
+lineq3

training/IntroAngr/pyproject.toml

@@ -0,0 +1,11 @@
+[project]
+name = "IntroAngr"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.10"
+dependencies = [
+    "angr==9.2.154",
+    "jupyterlab>=4.4.2",
+    "unicorn>=2.1.3",
+]

training/IntroAngr/templatecode/angr_basic.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+
+import angr
+import os
+
+base_addr = 0x400000
+main_fun = base_addr + 0x0 #TODO
+
+binarypath = "" # TODO
+
+# Load the binary
+p = angr.Project(binarypath, auto_load_libs=False)
+
+# If you want debug output
+#import logging
+#logging.getLogger('angr').setLevel('DEBUG')
+
+proto = "int main()" # Example for main
+
+## Initialize call state with useful options
+#   ZERO_FILL_UNCONSTRAINED_MEMORY: Memory that is used but not initialized is set to 0
+#   ZERO_FILL_UNCONSTRAINED_REGISTERS: Registers that are used but are not initialized are set to 0, this prevents warnings whencallee-saved registers are pushed onto the stack
+#   LAZY_SOLVES: This is somewhat of a magic "hack": Do not query the constrained solver unless really necessary. If you're trying to go through a specific code path, this can save tons of time! Experiment with and without it!
+state = p.factory.call_state(main_fun, prototype=proto,
+                             add_options=({angr.options.ZERO_FILL_UNCONSTRAINED_MEMORY,
+                                           angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS,
+                                           angr.options.LAZY_SOLVES}),
+                             )
+
+
+# Initialize a simulation manager with the state
+sm = p.factory.simulation_manager(state)
+
+
+# Perform explore
+print("Starting explore...")
+
+# Try to find a state that fulfills a certain condition via exploration
+# Useful: s.posix.dumps(1) to access stdout and s.posix.dumps(2) to access stderr
+# Note: find and avoid can also have single integers (addresses) or lists of integers
+sm.explore(find=lambda s: False, avoid=lambda s: False) # TODO
+
+# dump stdin and stdout of found states
+for s in sm.found:
+    print(s.posix.dumps(1))
+    print(s.posix.dumps(0).strip(b'\x00').decode())

training/IntroAngr/templatecode/angr_concretization.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+
+import angr
+import claripy
+import os
+
+base_addr = 0x400000
+main_fun = base_addr + 0x0 #TODO
+
+binarypath = "" # TODO
+
+# Load the binary
+p = angr.Project(binarypath, auto_load_libs=False)
+
+# If you want debug output
+#import logging
+#logging.getLogger('angr').setLevel('DEBUG')
+
+
+
+class ConcretizationHandler(object):
+    def __init__(self, dbg_addr=0xDEADAFFE0000):
+        self.DEBUG_ADDR = dbg_addr
+
+    def before_address_concretization(self, state):
+        self.index_expr = state.inspect.address_concretization_expr
+        state.inspect.address_concretization_expr = self.DEBUG_ADDR
+
+    """
+    Angr API:
+
+
+    """
+    def after_address_concretization(self, state):
+        ## TODO
+        # Set self.DEBUG_ADDR to a value modeling the array access / mathematical operation that is actually performed
+        # memory can be set via state.mem[addr].uint8_t = ..., state.mem[addr].uint16_t = ..., etc.
+
+        # Do not add new path constraints
+        state.inspect.address_concretization_add_constraints = False
+        # Specify our DEBUG_ADDR as the target of the concretization
+        state.inspect.address_concretization_result = [self.DEBUG_ADDR]
+
+
+
+
+
+
+
+proto = "int main()" # Example for main
+
+## Initialize call state with useful options
+#   ZERO_FILL_UNCONSTRAINED_MEMORY: Memory that is used but not initialized is set to 0
+#   ZERO_FILL_UNCONSTRAINED_REGISTERS: Registers that are used but are not initialized are set to 0, this prevents warnings whencallee-saved registers are pushed onto the stack
+#   LAZY_SOLVES: This is somewhat of a magic "hack": Do not query the constrained solver unless really necessary. If you're trying to go through a specific code path, this can save tons of time! Experiment with and without it!
+state = p.factory.call_state(main_fun, prototype=proto,
+                             add_options=({angr.options.ZERO_FILL_UNCONSTRAINED_MEMORY,
+                                           angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS,
+                                           angr.options.LAZY_SOLVES}),
+                             )
+
+# Register concretization hooks
+conc_handler = ConcretizationHandler()
+state.inspect.b('address_concretization', when=angr.BP_BEFORE, action=conc_handler.before_address_concretization)
+state.inspect.b('address_concretization', when=angr.BP_AFTER, action=conc_handler.after_address_concretization)
+
+
+
+# Initialize a simulation manager with the state
+sm = p.factory.simulation_manager(state)
+
+
+# Perform explore
+print("Starting explore...")
+
+# Try to find a state that fulfills a certain condition via exploration
+# Useful: s.posix.dumps(1) to access stdout and s.posix.dumps(2) to access stderr
+# Note: find and avoid can also have single integers (addresses) or lists of integers
+sm.explore(find=lambda s: False, avoid=lambda s: False) # TODO
+
+# dump stdin and stdout of found states
+for s in sm.found:
+    print(s.posix.dumps(1))
+    print(s.posix.dumps(0).strip(b'\x00').decode())