Reputation: 11
I want the Angr to timeout during symbol execution due to path explosion. For example, for the following symbol execution function, I would like to modify its source code to cause symbol execution to fail.
int target(int a){
printf("%d\n",a);
}
I found a way to use the 3x+1 conjecture to make the program have multiple branches.
unsigned long long collatz_conjecture(){
srand(time(NULL));
unsigned long long random_number1 = rand();
unsigned long long random_number2 = rand();
unsigned long long large_random_number = (random_number1 << 32) | random_number2;
while (large_random_number != 1) {
if (large_random_number % 2 == 0) {
large_random_number /= 2;
printf("%llu\n",large_random_number);
}
else {
large_random_number = large_random_number * 3 + 1;
printf("%llu\n", large_random_number);
}
return large_random_number;
}
int target(int a){
unsigned long long ret = collatz_conjecture();
if(ret!=1){
return 0;
}
printf("%d\n",a);
}
But after the modification, the target function can still be successfully symbol executed using Angr after compilation.How should I write a simple C language function to make compiled functions fail when using Angr for symbolic execution.
May I know how to modify it? Thank you very much
Upvotes: 1
Views: 77