Closed h311d1n3r closed 11 months ago
Hey there! Are you sure you can actually hit that breakpoint (0x11e9) with the input given to the program?
Yes, I'm pretty sure 👍 I tried setting the breakpoint almost everywhere (also tried before the fgets taking input)
Also, when running test "test_concrete_not_packed_elf64.py" on the angr docker image, I get the following error trace :
(angr) angr@78a39cee8109:~/angr-dev/angr-targets/tests$ python3 test_concrete_not_packed_elf64.py
CRITICAL | 2023-08-24 20:38:00,075 | avatar.targets.GDBTarget0.GDBResponseListener | Catched unknown async message: {'type': 'notify', 'message': 'breakpoint-deleted', 'payload': {'id': '1'}, 'token': None, 'stream': 'stdout'}
2023-08-24 20:38:00,075 | avatar.targets.GDBTarget0.GDBResponseListener.CRITICAL | Catched unknown async message: {'type': 'notify', 'message': 'breakpoint-deleted', 'payload': {'id': '1'}, 'token': None, 'stream': 'stdout'}
CRITICAL | 2023-08-24 20:38:01,232 | avatar.targets.GDBTarget0.GDBResponseListener | Catched unknown async message: {'type': 'notify', 'message': 'breakpoint-deleted', 'payload': {'id': '2'}, 'token': None, 'stream': 'stdout'}
2023-08-24 20:38:01,232 | avatar.targets.GDBTarget0.GDBResponseListener.CRITICAL | Catched unknown async message: {'type': 'notify', 'message': 'breakpoint-deleted', 'payload': {'id': '2'}, 'token': None, 'stream': 'stdout'}
CRITICAL | 2023-08-24 20:38:02,233 | avatar.targets.GDBTarget0.GDBResponseListener | Catched unknown async message: {'type': 'notify', 'message': 'breakpoint-deleted', 'payload': {'id': '3'}, 'token': None, 'stream': 'stdout'}
2023-08-24 20:38:02,233 | avatar.targets.GDBTarget0.GDBResponseListener.CRITICAL | Catched unknown async message: {'type': 'notify', 'message': 'breakpoint-deleted', 'payload': {'id': '3'}, 'token': None, 'stream': 'stdout'}
Okay, I solved my issue. In fact, you can't specify a base address to your angr project when using Symbion (at the moment) because GDB and Angr won't be synchronized on that point. What I did was disabling ASLR and dumping mapped addresses from GDB. Also, I couldn't manage to specify an input (in stdin) so what I did was reaching the libc read function in a first concrete execution, then modify the state as the read function would and resume the process in a second execution. Anyway, thanks for the great project ;)
Perfect, glad you figured it out :)
Description
Hi, When I try running the following script :
the process seems to exit before reaching my "breakpoint". Here is the complete error trace :