#!/usr/bin/env python3

import angr
import os

base_addr = 0x400000
main_fun = base_addr +  0x10a0

binarypath = "./lineq1"

# Load the binary
p = angr.Project(binarypath, auto_load_libs=False)

# If you want debug output
import logging
logging.getLogger('angr').setLevel('INFO')

proto = "int calc_flag(void)" # Example for main

## Initialize call state with useful options
#   ZERO_FILL_UNCONSTRAINED_MEMORY: Memory that is used but not initialized is set to 0
#   ZERO_FILL_UNCONSTRAINED_REGISTERS: Registers that are used but are not initialized are set to 0, this prevents warnings whencallee-saved registers are pushed onto the stack
#   LAZY_SOLVES: This is somewhat of a magic "hack": Do not query the constrained solver unless really necessary. If you're trying to go through a specific code path, this can save tons of time! Experiment with and without it!
state = p.factory.call_state(main_fun, prototype=proto,
                             add_options=({angr.options.ZERO_FILL_UNCONSTRAINED_MEMORY,
                                           angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS,
                                           angr.options.LAZY_SOLVES}),
                             )


# Initialize a simulation manager with the state
sm = p.factory.simulation_manager(state)


# Perform explore
print("Starting explore...")

# Try to find a state that fulfills a certain condition via exploration
# Useful: s.posix.dumps(1) to access stdout and s.posix.dumps(2) to access stderr
# Note: find and avoid can also have single integers (addresses) or lists of integers
sm.explore(find=lambda s: b'Success' in s.posix.dumps(1))
# dump stdin and stdout of found states
for s in sm.found:
    print(s.posix.dumps(1))
    print(s.posix.dumps(0).strip(b'\x00').decode())