How to export disassembly using angr

Question

I would like to know how to export angr's disassembly in say txt file.

I looked at the angr documentation - https://angr.io/api-doc/angr.html#module-angr.analyses

I found that there are some endpoints like - Disassembly, cfgfast under proj.analyses. I want to get objdump like disassembled input. This paper says that they used cfgfast for their analysis. So, I checked that class, but couldn't find particular methods to print the assembly. For e.g. in radare2, I can do -

r2.cmd('aaa')
r2.cmd(f'pd $s > {filename+"_radare.txt"}')

to get the disassembly after analysis.

Answer 1

In angr, there are multiple ways to print out what you want. You can reference functions or basic blocks. All you need to print out disassembly is an address:

import angr
p = angr.Project("/bin/true",auto_load_libs=False)
block = p.factory.block(p.entry)
block.pp()

In this case, I load the true binary, excluding its dynamic libraries, and I ask it for the disassembly at the entry address of the binary. The pp function stands for pretty print, and it will allow you to print assembly in a pretty format.

Now getting every disassembled address in a linear format, like objdump, is much more hacky in angr. It would be much more advisable to use angr-management and copy the linear disassembly from the GUI, but for the sake of this question, here is a hacky script to get every basic blocks disassembly:

import angr
p = angr.Project("/bin/true",auto_load_libs=False)
cfg = p.analyses.CFGFast()
cfg.normalize()
for func_node in cfg.functions.values():
    if func_node.name.startswith("__"):
        continue
    else:
        for block in func_node.blocks:             
            block.pp() 

It is important to note that the disassembly may not be in order, though it will specify it's address -- this is because we disassemble in the order angr discovers functions.