HackCon 2016 - angry-reverser does not work

[leithon]

When I run the yolomolo example, an error occurred as below.

/home/leizhao/.virtualenvs/angr/local/lib/python2.7/site-packages/pyvex/block.py:75: UserWarning: implicit cast from 'char *' to a different pointer type: will be forbidden in the future (check that the types are as you expect; use an explicit ffi.cast() if they are correct)
1)
Launching exploration
ERROR | 2016-11-10 18:49:27,830 | angr.simos | Syscall 101 is not found for arch AMD64
ERROR | 2016-11-10 18:49:27,832 | angr.simos | Syscall 101 is not found for arch AMD64
Traceback (most recent call last):
File "yolomolo-solve.py", line 42, in
assert main() == "HACKCON{VVhYS04ngrY}"
File "yolomolo-solve.py", line 35, in main
final = ex.found[0].state
IndexError: list index out of range

BTW, I found a similar issue (#91). The difference is that the error message of my example didn't include the segment fault.

[cq674350529]

Did you solve it? I met the same problem.

[rtzbyte]

i met the same problem,
the amd64 syscall table in simos.py, There is no Syscall to No. 101(ptrace), have anyone solve it? and How do I hook a system calls such as ptrace in angr.

[zardus]

My guess is that this example was not verified when we checked it in, and the author had implemented their own ptrace stub.

There is actually ptrace support being worked on right now (angr/simuvex#78). You can try to pull that into simuvex, and add the right entry to the table in simos.

An alternative would be to add BYPASS_UNSUPPORTED_SYSCALL to the state options -- it might allow it to get over that hurdle (at the cost of unnecessary symbolic data in the state).

[rtzbyte]

thank you very much @zardus

[saullocarvalho]

This example is working!