z3 - understanding the angr memory map -

i'm working on 1 of angr-doc challenges (https://github.com/angr/angr-doc/blob/2d45c9e6d9f91e83988719aa19940aec2cfd8747/examples/ekopartyctf2015_rev100/solve.py) in approach have situation:

mov     rdx, [rbp+var_150]; mov     rdx, [rdx]; mov     rdx, [rdx+8]; movsx   esi, byte ptr [rdx] 

where need set esi symbolic (esi contains value).

i've tried this:

#mov     rdx, [rbp+var_150] p1 = init_state.memory.load(init_state.regs.rbp-0x150, 8, endness=p.arch.memory_endness) #mov     rdx, [rdx] p2 = init_state.memory.load(p1, 8, endness=p.arch.memory_endness) #mov     rdx, [rdx+8] p3 = init_state.memory.load(p2+8, 8, endness=p.arch.memory_endness) #movsx   esi, byte ptr [rdx] r1 = init_state.memory.load(p3, 8, endness=p.arch.memory_endness) 

but doesn't work also, i've tried set each pointer bitvector value (bvv), didn't work either.

what doing wrong?

i found solution. i've misunderstanding of memory layout. though memory symbolic, expecting access multiples ptr resolve "autmagicaly". fix problem creating bitvector values , storing in rpb-0x150, , in pointers. here example:

#mov     rdx, [rbp+var_150] ptr_v_2 = claripy.bvv(0xe000000000, 64) init_state.memory.store(init_state.regs.rbp-0x150, ptr_v_2) p3 = init_state.memory.load(init_state.regs.rbp-0x150, 8, endness=p.arch.memory_endness)  #mov     rdx, [rdx] ptr_v_1 = claripy.bvv(0xd000000000, 64) init_state.memory.store(p3, ptr_v_1) p2 = init_state.memory.load(p3, 8, endness=p.arch.memory_endness)  #mov     rdx, [rdx+8] ptr_v = claripy.bvv(0xc000000000, 64) init_state.memory.store(p2+8, ptr_v) p1 = init_state.memory.load(p2+8, 8, endness=p.arch.memory_endness) 

now, i'm trying undestand how set memory sybolic