Package: angr-zelos-target
Zelos Concrete Execution Engine for angrProvides support for usingzelos(a python-based binary instrumentation and emulation platform) as a concrete execution engine inangrvia thesymbioninterface. Symbion provides an interface that enablesangrto get and set program state from an external execution engine. Conversely, this enableszelosto take advantage of the symbolic execution capabilities ofangr.InstallationYou first needangrwithsymbion. Their documentation recommends installation in a separate virtual environment, as several python packages are customized, includingunicorn. This is the boilerplate to setup angr in a new virtual environment (**). Refer to their documentation for more comprehensive instructions.$sudoapt-getinstallpython3-devlibffi-devbuild-essentialcmakegdb-multiarch
$gitclonehttps://github.com/angr/angr-targets.git

$python3-mvenv~/.venv/angr&&source~/.venv/angr/bin/activate(angr)$pipinstallwheel&&pipinstallangr&&pipinstall-eangr-targets(**) As of this writing, thepiprelease ofsymbionis not working. Instead, use the development version, which already includesangr-targets:$gitclonehttps://github.com/angr/angr-dev.git
$cdangr-dev&&./setup.sh-i-eangr
$source~/.virtualenvs/angr/bin/activateOnce you have theangrenvironment setup, install theangr-zelos-targetpackage within the environment to enablezelosas a concrete target:(angr)$pipinstallangr-zelos-targetInstall thezelos emulatorin a separate virtual environment, e.g.:(zelos)$pipinstallzelosBasic UsageWrite yourangrscripts as you usually would, but specify thezelosconcrete target when creating the project:fromangr_zelos_targetimportZelosConcreteTarget...zelos_target=ZelosConcreteTarget()project=angr.Project(filepath,concrete_target=zelos_target,use_sim_procedures=True,)Use theangr.exploration_techniques.Symbionexploration technique when you want to concretely execution inzelos.Before running yourangrscript, start thezeloszdbserveron the target binary:(zelos)$python-mzelos.zdbserverFILENAMEThezdbserverandangrscripts can run on the same system, but be sure to run them in separate python environments, as both packages use different versions of theunicornCPU emulator.Symbion Tutorial: "Fusing Concrete and Symbolic Execution"As an example, we have reimplemented thesymbion tutorialusing thezelosconcrete engine. In that tutorial, the goal is to force execution of a binary down the path that prints "Executing stage 2 fake malware V2" instead of the default message:$./not_packed_elf64[+]Parsingmalwareconfiguration[+]Virtualenvironmentdetected!Thenot_packed_elf64binary is duplicated from theangr-binariesrepository. The reimplemented tutorialexamplescript will concretely execute up to the decision point, solve for a value that will ultimately drive excution to the desired path, write that value into zelos, then resume execution in zelos. The basic workflow is to start the binary via thezelos.zdbserver, then run theangrscript that utilizes thezdbserver, for instance:Terminal 1 (zelos):(zelos)$python-mzelos.zdbservernot_packed_elf64Terminal 2 (angr):(angr)$python3-mangr_zelos_target.exampleTerminal 2 Output:[0]Createdangr_zelosprojectfor'angr_zelos_target/example/not_packed_elf64'[1]Gottodecisionpointconcretely.[2]Symbolicallyfindingsecondstage@0x400bb6[3]Executingconcretelyuntilexit@0x65310d[4]DONE.Terminal 1 Output:[main] [SYSCALL]brk(addr=0x0)->0x900000a4[main] [SYSCALL]openat(dirfd=0xffffff9c,pathname=0xb229170("not_packed_elf64"),flags=0x80000)->18...
...
[main] [SYSCALL]brk(addr=0x90022000)->0x90022000Breakpoint"bp_400af3"[StdOut]:'bytearray(b'[+]Parsingmalwareconfiguration\n\n[+]Executingstage2fakemalwareV2\n\n')'[main] [SYSCALL]write(fd=0x1,buf=0x90000310("[+]Parsing malware configuration [+] Executing stage 2 fake malware V2"),count=0x3a)->3a[main] [SYSCALL]exit_group(status=0x0)->voidLicenseAGPL v3