buxxxi
buxxxi

Reputation: 11

How to write a simple C language function that explodes when using Angr tool to execute symbols

I want the Angr to timeout during symbol execution due to path explosion. For example, for the following symbol execution function, I would like to modify its source code to cause symbol execution to fail.

int target(int a){
    printf("%d\n",a);
}

I found a way to use the 3x+1 conjecture to make the program have multiple branches.

unsigned long long collatz_conjecture(){
    srand(time(NULL));
    unsigned long long random_number1 = rand();
    unsigned long long random_number2 = rand();
    unsigned long long large_random_number = (random_number1 << 32) | random_number2;
    while (large_random_number != 1) {
        if (large_random_number % 2 == 0) {
            large_random_number /= 2;
            printf("%llu\n",large_random_number);
        }
        else {
            large_random_number = large_random_number * 3 + 1;
            printf("%llu\n", large_random_number);
        }
        return large_random_number;
    }

int target(int a){
    unsigned long long ret = collatz_conjecture();
    if(ret!=1){
        return 0;
    }
    printf("%d\n",a);
}

But after the modification, the target function can still be successfully symbol executed using Angr after compilation.How should I write a simple C language function to make compiled functions fail when using Angr for symbolic execution.

May I know how to modify it? Thank you very much

Upvotes: 1

Views: 77

Answers (0)

Related Questions