2

I have some binary files, each of them contain instructions of a function, (may be a little more in the end). The begining of the file also is the start point of the function.

This files were extracted from a ELF file.The platform is arm64.

So, how to load and analyze this file using angr?
I upload a sample file here: xfrank.pythonanywhere.com/bin


The original target:

Every function has a "switch case statement", the target is to get all intergers of the case expression.

Example(C code):

void func1(int cmd){
    switch (cmd) {
    case 1:
        xxxx
        break;
    case 10:
        yyyy;
        break;
    }
}

Result: 1,10

2
  • Can you share some of these binary files with us?
    – julian
    Commented Feb 15, 2017 at 19:29
  • I upload a sample file here: xfrank.pythonanywhere.com/bin
    – Swing
    Commented Feb 18, 2017 at 8:38

1 Answer 1

3

Here are the steps I would normally do:

  • Load the binary in angr.
  • Build a CFG.
  • For each function you care about, first, get a reference of the function (func = cfg.functions[addr] or func = cfg.functions.function(name=the_name)), and then traverse the graph (func.graph or func.transition_graph).
2
  • How to load the binary in angr without any 'head' info?
    – Swing
    Commented Aug 17, 2017 at 11:23
  • What's head info? Are you talking about loading binary blobs directly? You can manually specify format facts when loading, like architecture, loading offsets, etc. This is not well-documented currently in angr-docs, but it is documented in the doc-strings of angr.Project() and cle.Loader.
    – Fish
    Commented Aug 18, 2017 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.