https://github.com/ercoppa/symbolic-execution-tutorial

Tutorial on Symbolic Execution. Hands-on session is based on the angr framework.
https://github.com/ercoppa/symbolic-execution-tutorial

angr binary lecture-notes slides symbolic-execution testing tutorial

Last synced: 24 days ago
JSON representation

Tutorial on Symbolic Execution. Hands-on session is based on the angr framework.

• Host: GitHub
• URL: https://github.com/ercoppa/symbolic-execution-tutorial
• Owner: ercoppa
• Created: 2018-11-28T10:04:43.000Z (about 6 years ago)
• Default Branch: master
• Last Pushed: 2021-05-14T09:59:05.000Z (over 3 years ago)
• Last Synced: 2024-08-04T23:11:04.622Z (4 months ago)
• Topics: angr, binary, lecture-notes, slides, symbolic-execution, testing, tutorial
• Language: Python
• Homepage:
• Size: 2.92 MB
• Stars: 127
• Watchers: 7
• Forks: 18
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-security-collection - **47**星 - on session is based on the angr framework. (<a id="9f9fed5b730bc5bfceaaf77da3aa719e"></a>笔记&&文章&&教程)

README

        
# Symbolic Execution

## Slides

Current version of the slides is available [here](https://docs.google.com/presentation/d/e/2PACX-1vR7ZG-wQu9SvGA2wv7GFn2pLU9z3N_yAfoqiHRgn5I3RU-9k9XTEsjdKHZBUshau3TBY1fLZe2vnHmx/pub?start=false&loop=false&delayms=3000).

Download slides:

* revision 2020-05-16: [PDF](symbolic-execution-2020-05-16.pdf)

* revision 2019-12-05: [PDF](symbolic-execution-2018-12-05.pdf)

* revision 2018-11-29: [PDF](symbolic-execution-2018-11-29.pdf)

## Hands-on

### Setup

See [setup/README.md](setup/README.md).

### Slide example

You can find the source code, binary (Linux x86_64) and an angr script in the `slide-example` directory. `solve-example.py` ***must*** be customized, replacing {XXX, YYY, ZZZ} placeholders.

### Logic bomb

A Windows PE-32 logic bomb can be found in the `bomb/` directory. A very similar bomb for Linux/x86_64 can be found in the `linux-bomb/` directory.

Source code is not available. The angr script for solving the first phase is called `phase-1.py` (replace {XXX, YYY, ZZZ} placeholders!).