BYUCTF: Angr Management

fgets(buf, 5, stdin)      ; up to 4 chars + NUL
strcspn(buf, "\n")        ; strip newline
strtol(buf, &end, 10)     ; -> returns an integer in eax

$ echo AAAA | ./angr_management_test
Arrived at 0
That's not a valid destination

mov    $0x0,%esi                 ; room id N
lea    "Arrived at %d\n",%rdi
call   printf
call   get_input                 ; your destination number -> eax
cmpl   $0x100,-0x4(%rbp)         ; input == 256 ?
jne    .next
jmp    6c68                      ; valid edge: goto another room
.next:
cmpl   $0x58,-0x4(%rbp)          ; input == 88 ?
je     3192                      ; second valid edge
puts("That's not a valid destination")
exit(1)

ede5: mov $0x270,%esi ; "Arrived at 624"
edf9: call printf
edfe: lea 0xf047 (the flag string)
ee08: call puts
ee12: leave ; ret

import re
from collections import deque
lines = open('main.asm').read().splitlines()          # objdump -d --no-show-raw-insn
rx = re.compile(r'^\s+([0-9a-f]+):\t(.*)$')
insns = [(int(m.group(1),16), m.group(2).strip()) for l in lines if (m:=rx.match(l))]
idx = {a:i for i,(a,_) in enumerate(insns)}

# a "room" = `mov $imm,%esi` that feeds the "Arrived at %d" printf (# f019)
rooms = {}
for i,(a,t) in enumerate(insns):
    if (m:=re.match(r'mov\s+\$0x([0-9a-f]+),%esi$', t)) and \
       any('# f019' in insns[j][1] for j in range(i, min(i+4, len(insns)))):
        rooms[a] = int(m.group(1),16)
starts = sorted(rooms)
WIN = next(a for a,r in rooms.items() if r == 0x270)

# jump targets land on the room's mov-esi or the nop just before it
tgt2room = {}
for a in starts:
    tgt2room[a] = a
    if insns[idx[a]-1][1].startswith('nop'):
        tgt2room[insns[idx[a]-1][0]] = a

# edges: after get_input, collect (cmp value -> jmp target) until exit
adj = {}
for k,a in enumerate(starts):
    end = idx[starts[k+1]] if k+1 < len(starts) else len(insns)
    j = idx[a]
    while j < end and 'get_input' not in insns[j][1]: j += 1
    el, pend = [], None
    while j < end:
        t = insns[j][1]
        if (mc := re.match(r'cmpl\s+\$0x([0-9a-f]+),-0x4\(%rbp\)$', t)):
            pend = int(mc.group(1),16)
        elif (mj := re.match(r'jne\s+([0-9a-f]+)', t)) and pend is not None:
            if (mt := re.match(r'jmp\s+([0-9a-f]+)', insns[j+1][1])):
                el.append((pend, tgt2room.get(int(mt.group(1),16)))); pend = None
        elif (mje := re.match(r'je\s+([0-9a-f]+)', t)) and pend is not None:
            el.append((pend, tgt2room.get(int(mje.group(1),16)))); pend = None
        elif 'exit@plt' in t: break
        j += 1
    adj[a] = el

START = 0x1323
prev, mv, q = {START:None}, {}, deque([START])
while q:
    cur = q.popleft()
    if cur == WIN: break
    for val, room in adj.get(cur, []):
        if room is not None and room not in prev:
            prev[room], mv[room] = cur, val; q.append(room)

path, c = [], WIN
while c is not None: path.append(c); c = prev[c]
path.reverse()
moves = [mv[path[i]] for i in range(1, len(path))]
open('moves.txt','w').write('\n'.join(map(str, moves)) + '\n')
print(len(moves), "moves")   # -> 72

import socket
moves = open('moves.txt').read().split()
s = socket.create_connection(('<remote-host>', 1368))
for m in moves: s.sendall(m.encode()+b'\n')
# ... recv -> byuctf{g3t_w1th_th3_c0ntr01_fl0w}