Questions tagged [angr]

angr is a Python binary analysis framework developed by the Computer Security Lab at UC Santa Barbara and their associated CTF team, Shellphish. project URL: https://github.com/angr/angr

9 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
658 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
3
votes
0answers
488 views

Using Angr in Vulnerability Research

I would like to use angr for vulnerability research. I was thinking that if I did the following: p = angr.Project('a.out', auto_load_libs=False) sm = p.factory.simulation_manager() while len(sm....
3
votes
0answers
464 views

How to prevent angr from taking dozens of hours and GB of memory solving a (seemingly) simple CTF problem

I was recently working on a (seemingly) simple CTF challenge where the input was a base64 encoded file and the binary would check for correctness in one function call. The catch is that the checking ...
2
votes
0answers
147 views

Reverse engineering a command line argument using angr for an aarch64 binary

I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument....
1
vote
0answers
114 views

Angr Use argv as initialstate

I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "...
1
vote
0answers
316 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...
0
votes
0answers
101 views

Symbolic gloabal variables in angr

I am learning angr and for that I wrote a code containing two global variables. char pwd[8]; char flag[16]; int main() { printf("\n\nEnter your password and the flag: "); ...
0
votes
1answer
149 views

Proper workflow for x64dbg to Angr?

I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set ...
0
votes
0answers
134 views

Control flow graph of entire binary file

Is it possible to get the control flow graph of the entire binary file using any disassembler? IDA Pro generates the CFG for each function. Can we use it to get the CFG of the entire program?