标签：nod 执行 .class stand filename his bind dep 数据
>>> import monkeyhex # this will format numerical results in hexadecimal >>> proj.arch <Arch AMD64 (LE)> >>> proj.entry 0x401670 >>> proj.filename ‘/bin/true‘
>>> proj.loader <Loaded true, maps [0x400000:0x5004000]> >>> proj.loader.shared_objects # may look a little different for you! {‘ld-linux-x86-64.so.2‘: <ELF Object ld-2.24.so, maps [0x2000000:0x2227167]>, ‘libc.so.6‘: <ELF Object libc-2.24.so, maps [0x1000000:0x13c699f]>} >>> proj.loader.min_addr 0x400000 >>> proj.loader.max_addr 0x5004000 >>> proj.loader.main_object # we‘ve loaded several binaries into this project. Here‘s the main one! <ELF Object true, maps [0x400000:0x60721f]> >>> proj.loader.main_object.execstack # sample query: does this binary have an executable stack? False >>> proj.loader.main_object.pic # sample query: is this binary position-independent? True
>>> block = proj.factory.block(proj.entry) # lift a block of code from the program‘s entry point <Block for 0x401670, 42 bytes> >>> block.pp() # pretty-print a disassembly to stdout 0x401670: xor ebp, ebp 0x401672: mov r9, rdx 0x401675: pop rsi 0x401676: mov rdx, rsp 0x401679: and rsp, 0xfffffffffffffff0 0x40167d: push rax 0x40167e: push rsp 0x40167f: lea r8, [rip + 0x2e2a] 0x401686: lea rcx, [rip + 0x2db3] 0x40168d: lea rdi, [rip - 0xd4] 0x401694: call qword ptr [rip + 0x205866] >>> block.instructions # how many instructions are there? 0xb >>> block.instruction_addrs # what are the addresses of the instructions? [0x401670, 0x401672, 0x401675, 0x401676, 0x401679, 0x40167d, 0x40167e, 0x40167f, 0x401686, 0x40168d, 0x401694]
>>> block.capstone # capstone disassembly <CapstoneBlock for 0x401670> >>> block.vex # VEX IRSB (that‘s a python internal address, not a program address) <pyvex.block.IRSB at 0x7706330>
>>> state = proj.factory.entry_state()
<SimState @ 0x401670>
>>> state.regs.rip # get the current instruction pointer <BV64 0x401670> >>> state.regs.rax <BV64 0x1c> >>> state.mem[proj.entry].int.resolved # interpret the memory at the entry point as a C int <BV32 0x8949ed31>
>>> bv = state.solver.BVV(0x1234, 32) # create a 32-bit-wide bitvector with value 0x1234 <BV32 0x1234> # BVV stands for bitvector value >>> state.solver.eval(bv) # convert to python int 0x1234
>>> state.regs.rsi = state.solver.BVV(3, 64) >>> state.regs.rsi <BV64 0x3> >>> state.mem[0x1000].long = 4 >>> state.mem[0x1000].long.resolved <BV64 0x4>
>>> state.regs.rdi
<BV64 reg_48_11_64{UNINITIALIZED}>
>>> simgr = proj.factory.simgr(state) # TODO: change name before merge <SimulationManager with 1 active> >>> simgr.active [<SimState @ 0x401670>]
造函数会参数一个state或state列表。
>>> simgr.step()
>>> simgr.active [<SimState @ 0x1020300>] >>> simgr.active[0].regs.rip # new and exciting! <BV64 0x1020300> >>> state.regs.rip # still the same! <BV64 0x401670>
>>> proj.analyses. # Press TAB here in ipython to get an autocomplete-listing of everything: proj.analyses.BackwardSlice proj.analyses.CongruencyCheck proj.analyses.reload_analyses proj.analyses.BinaryOptimizer proj.analyses.DDG proj.analyses.StaticHooker proj.analyses.BinDiff proj.analyses.DFG proj.analyses.VariableRecovery proj.analyses.BoyScout proj.analyses.Disassembly proj.analyses.VariableRecoveryFast proj.analyses.CDG proj.analyses.GirlScout proj.analyses.Veritesting proj.analyses.CFG proj.analyses.Identifier proj.analyses.VFG proj.analyses.CFGAccurate proj.analyses.LoopFinder proj.analyses.VSA_DDG proj.analyses.CFGFast proj.analyses.Reassembler
# Originally, when we loaded this binary it also loaded all its dependencies into the same virtual address space # This is undesirable for most analysis. >>> proj = angr.Project(‘/bin/true‘, auto_load_libs=False) >>> cfg = proj.analyses.CFGFast() <CFGFast Analysis Result at 0x2d85130> # cfg.graph is a networkx DiGraph full of CFGNode instances # You should go look up the networkx APIs to learn how to use this! >>> cfg.graph <networkx.classes.digraph.DiGraph at 0x2da43a0> >>> len(cfg.graph.nodes()) 951 # To get the CFGNode for a given address, use cfg.get_any_node >>> entry_node = cfg.get_any_node(proj.entry) >>> len(list(cfg.graph.successors(entry_node))) 2
翻译自：https://docs.angr.io
标签：nod 执行 .class stand filename his bind dep 数据
原文地址：http://www.cnblogs.com/fancystar/p/7851736.html
