This question pertains to the symbolic execution platform angr. Particularly, I want to ask two questions:
To give some more background, I am using the Simulation Manager, where at any point, there are a list of states in stashes. Let us consider any one particular state st0. This state stores the symbolic state as per the sequence of instructions leading up to the last instruction, say the load mov (rdx), rax. Now, external information (which angr does not have) has informed me that the address accessed is actually 0xdeadbeef.
Therefore, the steps I think I need to do are:
s0.addr, figure out the instruction, and its address operand. From this, I get a symbolic bitvector for s0.regs._rax. The question is basically, how do I figure out that the address used by the load was rax?rax == 0xdeadbeef. Thankfully, angr state has a nice add_constraint function. The question is, how do I express my constraint in code?User contributions licensed under CC BY-SA 3.0