Start Symbolic Analysis at a Given Address with Angr

Question

Lets suppose I have a very big binary and I want to reverse just a part of this binary.

Is there a way to tell angr to start symbolic analysis at a given address ?

Answer 1

There sure is.

p = angr.Project("target_binary")
state = p.factory.blank_state(addr=0x400770)

I strongly recommend reading the State Presets section of the docs for more information. Crucially, all of the state preset constructors can take the addr argument; depending what you're doing, there may be a better preset to use than blank_state.

Further resources:

API docs

Examples from the angr team that include starting analysis at a specific address:

• Example 1
• Example 2
• Example 3