I have some binary files, each of them contain instructions of a function, (may be a little more in the end). The begining of the file also is the start point of the function.

This files were extracted from a ELF file.The platform is arm64.

So, how to load and analyze this file using angr?
I upload a sample file here: xfrank.pythonanywhere.com/bin

The original target:

Every function has a "switch case statement", the target is to get all intergers of the case expression.

Example(C code):

void func1(int cmd){
    switch (cmd) {
    case 1:
    case 10:

Result: 1,10


1 Answer 1


Here are the steps I would normally do:

  • Load the binary in angr.
  • Build a CFG.
  • For each function you care about, first, get a reference of the function (func = cfg.functions[addr] or func = cfg.functions.function(name=the_name)), and then traverse the graph (func.graph or func.transition_graph).
  • How to load the binary in angr without any 'head' info?
    – Swing
    Aug 17, 2017 at 11:23
  • What's head info? Are you talking about loading binary blobs directly? You can manually specify format facts when loading, like architecture, loading offsets, etc. This is not well-documented currently in angr-docs, but it is documented in the doc-strings of angr.Project() and cle.Loader.
    – Fish
    Aug 18, 2017 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.