Vulnerability analysis

Running the binary

Waiting on input. 😑

Binary info

main

Python>hex(end-fisrt)
0x18fL
Python>0x18f
399

A loop runs 0x14 times and reads into unk_212E0. That buffer is 400 bytes.

After the 400-byte read, main calls sub_850(unk_212E0) and prints the flag when the return value is non-zero. Between prints you also see sub_10FF6.

That helper SHA-256-hashes output. The interesting question is which conditions on the input make the hash path succeed.

sub_850

_start

_end

Start-to-end span is 67,493 bytes. Huge.

The prologue alone allocates 0x1E60 of stack and initializes a pile of locals.

A repeating pattern: loop, compare, and on mismatch mov [rbp+var_1E49], 0. On match, set mov [rbp+var_1E48], 0 and keep going toward ret.

The returned value follows the same pattern. We need a non-zero result driven by the input logic — specifically paths that can reach movzx eax, [rbp+var_1E49] successfully rather than the zeroing stores.

Solution

Approach

Use angr and treat sub_850 as a Boolean SAT problem.

• True targets: the jz-taken sites that do mov eax, [...]
• False / avoid sites: the untaken path that does mov [rbp+var_1E49], 0

The avoid bytes are thankfully identical everywhere: C6 85 B7 E1 FF FF 00.

True sites sit seven bytes after each False store. Do not accept every True address — skip the first two of each triplet and keep the third.

Solved code 1

import angr
from pwn import *
PATH='./sakura'
 
def main():
    global PATH
		# 바이트로 읽어오도록 한다.
    data = open("./sakura", "rb").read()
 
    find_list = []
    avoid_list = []
    idx = 0
    cnt = 0
 
    while True:
				# avoid 할 패턴
        res = data.find(b"\xC6\x85\xB7\xE1\xFF\xFF\x00", idx)
        if res == -1:
            break
        # 베이스 주소는 0x100000을 하든 상관 없다.
        avoid_list.append(0x400000 + res)
        # find 조건 
        if cnt % 3 == 2:
            find_list.append(0x400000 + res + 7)
            
        cnt += 1
        idx = res + 1 # aovid 패턴의 오프셋만큼 더해가면서 다음 오프셋을 찾아낸다.
 
    p = angr.Project('./sakura')
    state = p.factory.entry_state()
 
    for find in find_list:
        sm=p.factory.simgr(state)
				# 순차적으로 find조건을 만족 하는지르 확인하기 위해 for문을 돌렸다.
				# 루프를 돌리지 않고 한번에 바로 해도 된다.
        sm.explore(find=find, avoid=avoid_list)
        state=sm.found[0]
				print(state)
        
    p=process(PATH) # 프로세스 attach
    p.send(state.posix.dumps(0)) # 출력 값을 read 함수로 보내버린다.
    flag = p.recvline() # 응답 받고 출력
    log.info(repr(flag))
 
if __name__ == "__main__":
    main()