Questions tagged [angr]

angr is a Python binary analysis framework developed by the Computer Security Lab at UC Santa Barbara and their associated CTF team, Shellphish. project URL: https://github.com/angr/angr

Filter by
Sorted by
Tagged with
0 votes
1 answer
52 views

How can valid inputs be generated using the simulation manager in angr?

I have a binary compiled for x86_64 that looks like this: #include <stdio.h> #include <string.h> void options(char *input) { if (strcmp(input, "A") == 0) { printf(&...
user avatar
0 votes
0 answers
33 views

Using angr as a pure concrete emulator

I am able to successfully run my target binary under Qiling, an emulator that supplements Unicorn with hooks for system libraries. I would like to do the same thing under angr. I don't need any ...
user avatar
0 votes
0 answers
156 views

Symbolic gloabal variables in angr

I am learning angr and for that I wrote a code containing two global variables. char pwd[8]; char flag[16]; int main() { printf("\n\nEnter your password and the flag: "); ...
user avatar
  • 1
0 votes
1 answer
188 views

Proper workflow for x64dbg to Angr?

I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set ...
user avatar
  • 1
1 vote
1 answer
120 views

Using angr/radare2 to estimate values given chunks of assembly

I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or ...
user avatar
1 vote
1 answer
243 views

Basic `angr` framework question- is something wrong with my solver?

I'm new to reverse engineering and I've just recently learned about angr, a framework that uses symbolic execution to get the input for a given output. I'm trying to complete a crackme using angr. My ...
user avatar
  • 13
1 vote
1 answer
420 views

How to restrict angr to printable characters

I have a binary that scanfs and then does some checks and returns either FAIL or SUCCESS that has SUCCESS for multiple inputs. Although only one of the inputs has only printable characters. How do I ...
user avatar
2 votes
0 answers
180 views

Reverse engineering a command line argument using angr for an aarch64 binary

I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument....
user avatar
1 vote
2 answers
1k views

Simple angr example not working

I am trying to learn angr from beginning. Due to lack of simple tutorials I programmed my own little executable which angr should solve. The C code looks as follows: #include <stdio.h> #...
user avatar
1 vote
1 answer
1k views

How to export disassembly using angr

I would like to know how to export angr's disassembly in say txt file. I looked at the angr documentation - https://angr.io/api-doc/angr.html#module-angr.analyses I found that there are some ...
user avatar
  • 1,427
1 vote
0 answers
151 views

Angr Use argv as initialstate

I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "...
user avatar
4 votes
3 answers
314 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
user avatar
3 votes
0 answers
549 views

Using Angr in Vulnerability Research

I would like to use angr for vulnerability research. I was thinking that if I did the following: p = angr.Project('a.out', auto_load_libs=False) sm = p.factory.simulation_manager() while len(sm....
user avatar
2 votes
1 answer
2k views

angr | populate int array with constraints

How do I populate memory address using angr with array of integers (?) and add a constraint so each int will be positive & less than 17 ? I hope it's clear I need to find out the in_array ...
user avatar
3 votes
0 answers
545 views

How to prevent angr from taking dozens of hours and GB of memory solving a (seemingly) simple CTF problem

I was recently working on a (seemingly) simple CTF challenge where the input was a base64 encoded file and the binary would check for correctness in one function call. The catch is that the checking ...
user avatar
4 votes
2 answers
1k views

Angr - Solve for function return value

I'm trying to create an angr script to solve this test program: #include <stdio.h> #include <stdlib.h> #include <string.h> int main(int argc, char *argv[]) { int value = atoi(...
user avatar
  • 323
0 votes
2 answers
1k views

Solve an angr function with string parameters

Look at this C code: #include <stdio.h> #include <string.h> int my_function(char *s); int my_function(char *s) { for (int i=0;i<strlen(s);i++) { s[i]++; } if (...
user avatar
  • 583
1 vote
1 answer
518 views

Solve a function with angr [closed]

Look at this c program: #include <stdio.h> int my_function(int a, int b); int my_function(int a, int b) { // Imagine a very complex calculation on 'a' and 'b' if (a==0x41 && b=...
user avatar
  • 583
1 vote
1 answer
534 views

Start Symbolic Analysis at a Given Address with Angr

Lets suppose I have a very big binary and I want to reverse just a part of this binary. Is there a way to tell angr to start symbolic analysis at a given address ?
user avatar
  • 583
2 votes
1 answer
365 views

angr with a golang target

Here is a very basic golang program: package main import "fmt" func main() { var s1 string fmt.Scanln(&s1) if s1=="goodpassword" { fmt.Println("Good") } else { ...
user avatar
  • 583
1 vote
1 answer
560 views

Angr never finishes

I create the following c program as a proof of concept. When I try to analyze it with anger it never finishes. #include <string.h> #include <stdlib.h> #include <stdio.h> char *...
user avatar
4 votes
0 answers
717 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
user avatar
3 votes
1 answer
266 views

angr multiple reads same variable

I'm writing a script to solve a binary that asks for multiple strings like the following c code, My problem I can't dump the 'second_pass, I just get "first_pass". probably due of the use of the same ...
user avatar
2 votes
1 answer
1k views

problem with scanf/fgets in angr stdin exploration

I want to solve this very basic crackme using angr: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buffer[64]; printf("Mot de passe:\n"); ...
user avatar
  • 583
1 vote
0 answers
341 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...
user avatar
  • 583
2 votes
2 answers
1k views

Password Bruteforce using angr

I am having a binary which takes an input from user and checks every bit of our character using the check_value function which does some stuff. The disassembly of the interested function is: .text:...
user avatar
  • 23
5 votes
1 answer
966 views

How can I get the shared libraries' function calls using angr

I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like: import sys, angr import networkx as nx proj = angr....
user avatar
  • 53