angr_symbolic_execution_find_path_to_welcome_output.py

1import angr
2
3# Load the project
4# Note: 'path/to/binary' should be replaced with the actual path to the binary file
5proj = angr.Project('path/to/binary', auto_load_libs=False)
6
7# Start execution from the entry point
8state = proj.factory.entry_state()
9
10# Create a simulation manager to control execution
11simgr = proj.factory.simulation_manager(state)
12
13# Explore the binary until a state that prints "Welcome" is found
14# Replace 'Welcome' with the string or address you are looking for
15simgr.explore(find=lambda s: b"Welcome" in s.posix.dumps(1))
16
17# Check if a solution was found
18if simgr.found:
19    solution_state = simgr.found[0]
20    # Print the stdin that results in the "found" state
21    print(solution_state.posix.dumps(0))
22else:
23    print("No solution found.")