Add flake to cmu_binary_bomb challenge

ctfhacker · ctfhacker · commit f2fc7e9f498a · 2024-08-18T16:53:35.000-05:00
diff --git a/cmu-binary-bomb/.envrc b/cmu-binary-bomb/.envrc
@@ -0,0 +1 @@
+use flake
diff --git a/cmu-binary-bomb/flag2.py b/cmu-binary-bomb/flag2.py
@@ -1,13 +1,12 @@
 ## Full writeup found on http://www.ctfhacker.com
 ## Binary found here: http://csapp.cs.cmu.edu/3e/bomb.tar
 
-import angr, logging
-from subprocess import Popen, PIPE
-from itertools import product
-import struct
+import angr
+import logging
+import claripy
 
 def main():
-    proj = angr.Project('bomb', load_options={'auto_load_libs':False})
+    proj = angr.Project('bomb', auto_load_libs=False)
 
     logging.basicConfig()
     logging.getLogger('angr.surveyors.explorer').setLevel(logging.DEBUG)
@@ -19,22 +18,20 @@ def main():
 
     # Sscanf is looking for '%d %d %d %d %d %d' which ends up dropping 6 ints onto the stack
     # We will create 6 symbolic values onto the stack to mimic this 
-    for i in xrange(6):
-        state.stack_push(state.se.BVS('int{}'.format(i), 4*8))
+    for i in range(6):
+        state.memory.store(state.regs.rsp + i * 4, state.solver.BVS(f'int{i}', 32))
 
     # Attempt to find a path to the end of the phase_2 function while avoiding the bomb_explode
-    path = proj.factory.path(state=state)
-    ex = proj.surveyors.Explorer(start=path, find=(0x400f3c,),
-                                 avoid=(bomb_explode,),
-                                 enable_veritesting=True)
-    ex.run()
-    if ex.found:
-        found = ex.found[0].state
+    ex = proj.factory.simulation_manager(state)
+    ex.explore(find=0x400f3c, avoid=bomb_explode)
 
+    if ex.found:
+        found = ex.found[0]
+    
         answer = []
 
-        for x in xrange(3):
-            curr_int = found.se.any_int(found.stack_pop())
+        for _ in range(3):
+            curr_int = found.solver.eval(found.stack_pop())
 
             # We are popping off 8 bytes at a time
             # 0x0000000200000001
diff --git a/cmu-binary-bomb/flake.lock b/cmu-binary-bomb/flake.lock
diff --git a/cmu-binary-bomb/flake.nix b/cmu-binary-bomb/flake.nix
@@ -0,0 +1,35 @@
+{
+  description = "ctf dev environment";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { nixpkgs, flake-utils, ... }:
+    flake-utils.lib.eachDefaultSystem (system:
+    let
+      pkgs = import nixpkgs { inherit system; };
+
+      python = pkgs.python311.withPackages (p: with p; [ 
+        angr
+        ipython 
+        ipdb
+        python-lsp-server
+      ]);
+    in
+    {
+      devShells.default = pkgs.mkShell {
+        buildInputs = [ 
+          python 
+          pkgs.radare2 
+        ];
+
+        shellHook = ''
+          echo "Welcome to the pwn.college dev shell!"
+          export PYTHONPATH=$PWD
+        '';
+      };
+    });
+}
+
