import angr
import claripy

p = angr.Project("unknown")
#flag = [claripy.BVS('flag_%d' % i, 8) for i in range(56)]
flag = claripy.BVS('flag', 8*56)
simgr = p.factory.simulation_manager(p.factory.full_init_state(args=[p.filename, flag]))

target_addr= 0x401cb7
addr_avoid = 0x401c90
simgr.explore(find=target_addr, avoid=0x401cab)
print simgr.found[0].solver.eval(flag, cast_to=bytes)

