Tags: angr symbolic_execution
Rating:
```
import angr
import claripy
import sys
project = angr.Project('./autorev_assemble')
input_ = claripy.BVS('input', 256)
init_state = project.factory.entry_state()
def is_successful(state):
stdout_output = state.posix.dumps(sys.stdout.fileno())
if b'SOLVED' in stdout_output:
return True
else: return False
def should_abort(state):
stdout_output = state.posix.dumps(sys.stdout.fileno())
if b'INSUFFICIENT' in stdout_output:
return True
else: return False
simulation = project.factory.simgr(init_state)
simulation.explore(find=is_successful,avoid= should_abort)
if simulation.found:
found = simulation.found[0]
print repr(found.state.posix.dumps(0))
```