Proper workflow for x64dbg to Angr?

Question

I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set breakpoints in the plugin DLL, use the main program to trigger the breakpoint, and now I am at a breakpoint in x64dbg in the DLL of interest.

Using the call stack info, I want Angr's entry point to be a couple of levels up, still inside the plugin DLL (instead of starting at the default entry point of the main application, which I assume will generate way too many paths for Angr). I want Angr to find a path from there to the breakpoint. Here is where I become a bit confused.

• when I run angr.Project("file_to_debug") should "file_to_debug" be the main application EXE or the plugin DLL I am interested in?
• If I want to start execution at a given address that I got from x64dbg, I run state = proj.factory.entry_state(addr=start_at)? But how do I get the memory state into Angr? From x64dbg I can dump the program memory, but I end up with a .bin file. It looks like I can use Scylla as well, but I am unclear how.

Then to find a path from an earlier point to the breakpoint address, I do something like

sim_mgr = proj.factory.simulation_manager(state)
sim_mgr.explore(find=failure_condition_from_original_breakpoint)

But I just end up with sim_mgr.errored = saying <State errored with "No bytes in memory for block starting at 0x7ffd8dfb0f29">

I suspect I am missing a few major concepts but any suggestions would be greatly appreciated.

Answer 1

After doing some more research, it looks like this is what I'm looking for:
symbion: fusing concrete and symbolic execution.

It seems that if you can provide angr (or symbion?) with programmatic access to a running debugger, I can use angr just for the part of code that I am interested in. They provide a "concrete target" for gdb server, but not x64dbg. There is a python plugin for x64dbg, but that looks like it supports python 2.7 instead of python 3 where angr seems to support python 3 at this point, so there might be some issue there.

So long story short, I think I need to use symbion and make a concrete target for x64dbg. A bit of a rabbit hole.