1

I would like to know how to export angr's disassembly in say txt file.

I looked at the angr documentation - https://angr.io/api-doc/angr.html#module-angr.analyses

I found that there are some endpoints like - Disassembly, cfgfast under proj.analyses. I want to get objdump like disassembled input. This paper says that they used cfgfast for their analysis. So, I checked that class, but couldn't find particular methods to print the assembly. For e.g. in radare2, I can do -

r2.cmd('aaa')
r2.cmd(f'pd $s > {filename+"_radare.txt"}')

to get the disassembly after analysis.

| improve this question | | | | |
3

In angr, there are multiple ways to print out what you want. You can reference functions or basic blocks. All you need to print out disassembly is an address:

import angr
p = angr.Project("/bin/true",auto_load_libs=False)
block = p.factory.block(p.entry)
block.pp()

In this case, I load the true binary, excluding its dynamic libraries, and I ask it for the disassembly at the entry address of the binary. The pp function stands for pretty print, and it will allow you to print assembly in a pretty format.

Now getting every disassembled address in a linear format, like objdump, is much more hacky in angr. It would be much more advisable to use angr-management and copy the linear disassembly from the GUI, but for the sake of this question, here is a hacky script to get every basic blocks disassembly:

import angr
p = angr.Project("/bin/true",auto_load_libs=False)
cfg = p.analyses.CFGFast()
cfg.normalize()
for func_node in cfg.functions.values():
    if func_node.name.startswith("__"):
        continue
    else:
        for block in func_node.blocks:             
            block.pp() 

It is important to note that the disassembly may not be in order, though it will specify it's address -- this is because we disassemble in the order angr discovers functions.

| improve this answer | | | | |
  • thanks, but I tried that. In that case it doesn't give me disassembly of the whole binary. I think it just prints a block – R4444 Apr 9 at 22:36
  • 1
    @R4444 so you want the entire binaries disass? May I ask why? angr is not particularly better at producing linear assembly as opposed to objdump. If you want a more CFG feel, try angr-managment (which will get you all the assembly plus decompliation). – mahaloz Apr 10 at 2:40
  • I am working on a project, where we are testing the capabilities of angr. As angr is mentioned in the mentioned usenix paper, we were trying on different options. Although your explanation helps. – R4444 Apr 10 at 3:01
  • 1
    @R4444 I edited my answer to give you every basic block. It would be much more advisable to do this through angr-managment, but if you need automation, CFG recovery then parsing is your best bet :). – mahaloz Apr 10 at 5:59
  • thanks mahaloz, :-) – R4444 Apr 10 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.