Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
angr documentation
angr documentation
  • Introduction
  • Getting Started
    • Installing angr
    • Reporting Bugs
    • Developing angr
    • Help Wanted
  • Core Concepts
    • Core Concepts
    • Loading a Binary
    • Symbolic Expressions and Constraint Solving
    • Machine State - memory, registers, and so on
    • Simulation Managers
    • Simulation and Instrumentation
    • Analyses
    • Symbolic Execution
    • A final word of advice
  • Build-in Analyses
    • Control-flow Graph Recovery (CFG)
    • Backward Slicing
    • Identifier
    • angr Decompiler
  • Advanced Topics
    • Gotchas when using angr
    • Understanding the Execution Pipeline
    • What’s Up With Mixins, Anyway?
    • Optimization considerations
    • Working with File System, Sockets, and Pipes
    • Intermediate Representation
    • Working with Data and Conventions
    • Solver Engine
    • Symbolic memory addressing
    • Java Support
    • Debug variable resolution
    • Variable visibility
  • Extending angr
    • Hooks and SimProcedures
    • State Plugins
    • Extending the Environment Model
    • Writing Analyses
  • angr examples
  • Frequently Asked Questions
  • Appendix
    • Cheatsheet
    • List of Claripy Operations
    • List of State Options
    • CTF Challenge Examples
    • Changelog
    • Migrating to angr 9.1
    • Migrating to angr 8
    • Migrating to angr 7
  • API Reference
    • angr.ail_callable
    • angr.ailment
      • angr.ailment.block
      • angr.ailment.block_walker
      • angr.ailment.constant
      • angr.ailment.converter_common
      • angr.ailment.converter_pcode
      • angr.ailment.converter_vex
      • angr.ailment.expression
      • angr.ailment.manager
      • angr.ailment.statement
      • angr.ailment.tagged_object
      • angr.ailment.utils
    • angr.analyses
      • angr.analyses.analysis
      • angr.analyses.backward_slice
      • angr.analyses.binary_optimizer
      • angr.analyses.bindiff
      • angr.analyses.boyscout
      • angr.analyses.callee_cleanup_finder
      • angr.analyses.calling_convention
        • angr.analyses.calling_convention.calling_convention
        • angr.analyses.calling_convention.fact_collector
        • angr.analyses.calling_convention.utils
      • angr.analyses.cdg
      • angr.analyses.cfg
        • angr.analyses.cfg.cfb
        • angr.analyses.cfg.cfg
        • angr.analyses.cfg.cfg_arch_options
        • angr.analyses.cfg.cfg_base
        • angr.analyses.cfg.cfg_emulated
        • angr.analyses.cfg.cfg_fast
        • angr.analyses.cfg.cfg_fast_soot
        • angr.analyses.cfg.cfg_job_base
        • angr.analyses.cfg.indirect_jump_resolvers
          • angr.analyses.cfg.indirect_jump_resolvers.aarch64_macho_got
          • angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got
          • angr.analyses.cfg.indirect_jump_resolvers.amd64_pe_iat
          • angr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast
          • angr.analyses.cfg.indirect_jump_resolvers.const_resolver
          • angr.analyses.cfg.indirect_jump_resolvers.constant_value_manager
          • angr.analyses.cfg.indirect_jump_resolvers.default_resolvers
          • angr.analyses.cfg.indirect_jump_resolvers.jumptable
          • angr.analyses.cfg.indirect_jump_resolvers.memload_resolver
          • angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast
          • angr.analyses.cfg.indirect_jump_resolvers.mips_elf_got
          • angr.analyses.cfg.indirect_jump_resolvers.propagator_utils
          • angr.analyses.cfg.indirect_jump_resolvers.resolver
          • angr.analyses.cfg.indirect_jump_resolvers.syscall_resolver
          • angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt
          • angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat
        • angr.analyses.cfg.meta_structs
        • angr.analyses.cfg.pe_msvc_eh_structs
      • angr.analyses.cfg_slice_to_sink
        • angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink
        • angr.analyses.cfg_slice_to_sink.graph
        • angr.analyses.cfg_slice_to_sink.transitions
      • angr.analyses.class_identifier
      • angr.analyses.code_tagging
      • angr.analyses.codecave
      • angr.analyses.complete_calling_conventions
      • angr.analyses.congruency_check
      • angr.analyses.data_dep
        • angr.analyses.data_dep.data_dependency_analysis
        • angr.analyses.data_dep.dep_nodes
        • angr.analyses.data_dep.sim_act_location
      • angr.analyses.datagraph_meta
      • angr.analyses.ddg
      • angr.analyses.decompiler
        • angr.analyses.decompiler.ail_simplifier
        • angr.analyses.decompiler.ailgraph_walker
        • angr.analyses.decompiler.block_io_finder
        • angr.analyses.decompiler.block_similarity
        • angr.analyses.decompiler.block_simplifier
        • angr.analyses.decompiler.callsite_maker
        • angr.analyses.decompiler.ccall_rewriters
          • angr.analyses.decompiler.ccall_rewriters.amd64_ccalls
          • angr.analyses.decompiler.ccall_rewriters.arm_ccalls
          • angr.analyses.decompiler.ccall_rewriters.rewriter_base
          • angr.analyses.decompiler.ccall_rewriters.x86_ccalls
        • angr.analyses.decompiler.clinic
        • angr.analyses.decompiler.condition_processor
        • angr.analyses.decompiler.counters
          • angr.analyses.decompiler.counters.boolean_counter
          • angr.analyses.decompiler.counters.call_counter
          • angr.analyses.decompiler.counters.expression_counters
          • angr.analyses.decompiler.counters.seq_cf_structure_counter
        • angr.analyses.decompiler.decompilation_cache
        • angr.analyses.decompiler.decompilation_options
        • angr.analyses.decompiler.decompiler
        • angr.analyses.decompiler.dephication
          • angr.analyses.decompiler.dephication.dephication_base
          • angr.analyses.decompiler.dephication.graph_dephication
          • angr.analyses.decompiler.dephication.graph_rewriting
          • angr.analyses.decompiler.dephication.graph_vvar_mapping
          • angr.analyses.decompiler.dephication.rewriting_engine
          • angr.analyses.decompiler.dephication.seqnode_dephication
        • angr.analyses.decompiler.dirty_rewriters
          • angr.analyses.decompiler.dirty_rewriters.amd64_dirty
          • angr.analyses.decompiler.dirty_rewriters.rewriter_base
        • angr.analyses.decompiler.empty_node_remover
        • angr.analyses.decompiler.expression_narrower
        • angr.analyses.decompiler.goto_manager
        • angr.analyses.decompiler.graph_region
        • angr.analyses.decompiler.jump_target_collector
        • angr.analyses.decompiler.jumptable_entry_condition_rewriter
        • angr.analyses.decompiler.label_collector
        • angr.analyses.decompiler.node_replacer
        • angr.analyses.decompiler.notes
          • angr.analyses.decompiler.notes.decompilation_note
          • angr.analyses.decompiler.notes.deobfuscated_strings
        • angr.analyses.decompiler.optimization_passes
          • angr.analyses.decompiler.optimization_passes.base_ptr_save_simplifier
          • angr.analyses.decompiler.optimization_passes.call_stmt_rewriter
          • angr.analyses.decompiler.optimization_passes.code_motion
          • angr.analyses.decompiler.optimization_passes.condition_constprop
          • angr.analyses.decompiler.optimization_passes.const_derefs
          • angr.analyses.decompiler.optimization_passes.const_prop_reverter
          • angr.analyses.decompiler.optimization_passes.cross_jump_reverter
          • angr.analyses.decompiler.optimization_passes.deadblock_remover
          • angr.analyses.decompiler.optimization_passes.determine_load_sizes
          • angr.analyses.decompiler.optimization_passes.div_simplifier
          • angr.analyses.decompiler.optimization_passes.duplication_reverter
            • angr.analyses.decompiler.optimization_passes.duplication_reverter.ail_merge_graph
            • angr.analyses.decompiler.optimization_passes.duplication_reverter.duplication_reverter
            • angr.analyses.decompiler.optimization_passes.duplication_reverter.errors
            • angr.analyses.decompiler.optimization_passes.duplication_reverter.similarity
            • angr.analyses.decompiler.optimization_passes.duplication_reverter.utils
          • angr.analyses.decompiler.optimization_passes.eager_std_string_concatenation
          • angr.analyses.decompiler.optimization_passes.eager_std_string_eval
          • angr.analyses.decompiler.optimization_passes.engine_base
          • angr.analyses.decompiler.optimization_passes.expr_op_swapper
          • angr.analyses.decompiler.optimization_passes.flip_boolean_cmp
          • angr.analyses.decompiler.optimization_passes.inlined_memcpy_simplifier
          • angr.analyses.decompiler.optimization_passes.inlined_memset_simplifier
          • angr.analyses.decompiler.optimization_passes.inlined_strcpy_simplifier
          • angr.analyses.decompiler.optimization_passes.inlined_string_transformation_simplifier
          • angr.analyses.decompiler.optimization_passes.inlined_strlen_simplifier
          • angr.analyses.decompiler.optimization_passes.inlined_wcscpy_simplifier
          • angr.analyses.decompiler.optimization_passes.ite_expr_converter
          • angr.analyses.decompiler.optimization_passes.ite_region_converter
          • angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier
          • angr.analyses.decompiler.optimization_passes.mips_gp_setting_simplifier
          • angr.analyses.decompiler.optimization_passes.mod_simplifier
          • angr.analyses.decompiler.optimization_passes.optimization_pass
          • angr.analyses.decompiler.optimization_passes.peephole_simplifier
          • angr.analyses.decompiler.optimization_passes.register_save_area_simplifier
          • angr.analyses.decompiler.optimization_passes.register_save_area_simplifier_adv
          • angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier
          • angr.analyses.decompiler.optimization_passes.ret_deduplicator
          • angr.analyses.decompiler.optimization_passes.return_duplicator_base
          • angr.analyses.decompiler.optimization_passes.return_duplicator_high
          • angr.analyses.decompiler.optimization_passes.return_duplicator_low
          • angr.analyses.decompiler.optimization_passes.stack_canary_simplifier
          • angr.analyses.decompiler.optimization_passes.static_vvar_rewriter
          • angr.analyses.decompiler.optimization_passes.switch_default_case_duplicator
          • angr.analyses.decompiler.optimization_passes.switch_reused_entry_rewriter
          • angr.analyses.decompiler.optimization_passes.tag_slicer
          • angr.analyses.decompiler.optimization_passes.win_stack_canary_simplifier
          • angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier
        • angr.analyses.decompiler.peephole_optimizations
          • angr.analyses.decompiler.peephole_optimizations.a_div_const_add_a_mul_n_div_const
          • angr.analyses.decompiler.peephole_optimizations.a_mul_const_div_shr_const
          • angr.analyses.decompiler.peephole_optimizations.a_mul_const_sub_a
          • angr.analyses.decompiler.peephole_optimizations.a_shl_const_sub_a
          • angr.analyses.decompiler.peephole_optimizations.a_sub_a_div
          • angr.analyses.decompiler.peephole_optimizations.a_sub_a_shr_const_shr_const
          • angr.analyses.decompiler.peephole_optimizations.a_sub_a_sub_n
          • angr.analyses.decompiler.peephole_optimizations.arm_cmpf
          • angr.analyses.decompiler.peephole_optimizations.base
          • angr.analyses.decompiler.peephole_optimizations.basepointeroffset_add_n
          • angr.analyses.decompiler.peephole_optimizations.basepointeroffset_and_mask
          • angr.analyses.decompiler.peephole_optimizations.bitwise_inserts
          • angr.analyses.decompiler.peephole_optimizations.bitwise_or_to_logical_or
          • angr.analyses.decompiler.peephole_optimizations.bool_expr_xor_1
          • angr.analyses.decompiler.peephole_optimizations.bswap
          • angr.analyses.decompiler.peephole_optimizations.cas_intrinsics
          • angr.analyses.decompiler.peephole_optimizations.cmpord_rewriter
          • angr.analyses.decompiler.peephole_optimizations.coalesce_adjacent_shrs
          • angr.analyses.decompiler.peephole_optimizations.coalesce_same_cascading_ifs
          • angr.analyses.decompiler.peephole_optimizations.concat_simplifier
          • angr.analyses.decompiler.peephole_optimizations.constant_derefs
          • angr.analyses.decompiler.peephole_optimizations.conv_a_sub0_shr_and
          • angr.analyses.decompiler.peephole_optimizations.conv_shl_shr
          • angr.analyses.decompiler.peephole_optimizations.eager_eval
          • angr.analyses.decompiler.peephole_optimizations.evaluate_const_conversions
          • angr.analyses.decompiler.peephole_optimizations.extended_byte_and_mask
          • angr.analyses.decompiler.peephole_optimizations.inlined_strcpy
          • angr.analyses.decompiler.peephole_optimizations.inlined_strcpy_consolidation
          • angr.analyses.decompiler.peephole_optimizations.invert_negated_logical_conjuction_disjunction
          • angr.analyses.decompiler.peephole_optimizations.modulo_simplifier
          • angr.analyses.decompiler.peephole_optimizations.one_sub_bool
          • angr.analyses.decompiler.peephole_optimizations.optimized_div_simplifier
          • angr.analyses.decompiler.peephole_optimizations.remove_cascading_conversions
          • angr.analyses.decompiler.peephole_optimizations.remove_const_insert
          • angr.analyses.decompiler.peephole_optimizations.remove_cxx_destructor_calls
          • angr.analyses.decompiler.peephole_optimizations.remove_empty_if_body
          • angr.analyses.decompiler.peephole_optimizations.remove_noop_conversions
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_bitmasks
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_conversions
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_derefs
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_insert
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_ite_branch
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_ite_comparisons
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_nots
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_reinterprets
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_shifts
          • angr.analyses.decompiler.peephole_optimizations.remove_redundant_shifts_around_comparators
          • angr.analyses.decompiler.peephole_optimizations.rewrite_bit_extractions
          • angr.analyses.decompiler.peephole_optimizations.rewrite_conv_mul
          • angr.analyses.decompiler.peephole_optimizations.rewrite_cxx_operator_calls
          • angr.analyses.decompiler.peephole_optimizations.rewrite_mips_gp_loads
          • angr.analyses.decompiler.peephole_optimizations.rol_ror
          • angr.analyses.decompiler.peephole_optimizations.sar_to_signed_div
          • angr.analyses.decompiler.peephole_optimizations.shl_to_mul
          • angr.analyses.decompiler.peephole_optimizations.simplify_pc_relative_loads
          • angr.analyses.decompiler.peephole_optimizations.single_bit_cond_to_boolexpr
          • angr.analyses.decompiler.peephole_optimizations.single_bit_xor
          • angr.analyses.decompiler.peephole_optimizations.tidy_stack_addr
          • angr.analyses.decompiler.peephole_optimizations.utils
        • angr.analyses.decompiler.presets
          • angr.analyses.decompiler.presets.basic
          • angr.analyses.decompiler.presets.fast
          • angr.analyses.decompiler.presets.full
          • angr.analyses.decompiler.presets.malware
          • angr.analyses.decompiler.presets.preset
        • angr.analyses.decompiler.redundant_label_remover
        • angr.analyses.decompiler.region_identifier
        • angr.analyses.decompiler.region_simplifiers
          • angr.analyses.decompiler.region_simplifiers.cascading_cond_transformer
          • angr.analyses.decompiler.region_simplifiers.cascading_ifs
          • angr.analyses.decompiler.region_simplifiers.expr_folding
          • angr.analyses.decompiler.region_simplifiers.goto
          • angr.analyses.decompiler.region_simplifiers.if_
          • angr.analyses.decompiler.region_simplifiers.ifelse
          • angr.analyses.decompiler.region_simplifiers.loop
          • angr.analyses.decompiler.region_simplifiers.node_address_finder
          • angr.analyses.decompiler.region_simplifiers.region_simplifier
          • angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier
          • angr.analyses.decompiler.region_simplifiers.switch_expr_simplifier
        • angr.analyses.decompiler.region_walker
        • angr.analyses.decompiler.return_maker
        • angr.analyses.decompiler.semantic_naming
          • angr.analyses.decompiler.semantic_naming.array_index_naming
          • angr.analyses.decompiler.semantic_naming.boolean_naming
          • angr.analyses.decompiler.semantic_naming.call_result_naming
          • angr.analyses.decompiler.semantic_naming.naming_base
          • angr.analyses.decompiler.semantic_naming.orchestrator
          • angr.analyses.decompiler.semantic_naming.pointer_naming
          • angr.analyses.decompiler.semantic_naming.region_loop_counter_naming
          • angr.analyses.decompiler.semantic_naming.size_naming
        • angr.analyses.decompiler.seq_to_blocks
        • angr.analyses.decompiler.sequence_walker
        • angr.analyses.decompiler.ssailification
          • angr.analyses.decompiler.ssailification.consts
          • angr.analyses.decompiler.ssailification.rewriting
          • angr.analyses.decompiler.ssailification.rewriting_engine
          • angr.analyses.decompiler.ssailification.rewriting_state
          • angr.analyses.decompiler.ssailification.ssailification
          • angr.analyses.decompiler.ssailification.traversal
          • angr.analyses.decompiler.ssailification.traversal_engine
          • angr.analyses.decompiler.ssailification.traversal_state
        • angr.analyses.decompiler.stack_item
        • angr.analyses.decompiler.structured_codegen
          • angr.analyses.decompiler.structured_codegen.base
          • angr.analyses.decompiler.structured_codegen.c
          • angr.analyses.decompiler.structured_codegen.dummy
          • angr.analyses.decompiler.structured_codegen.dwarf_import
          • angr.analyses.decompiler.structured_codegen.rust
        • angr.analyses.decompiler.structurer_nodes
        • angr.analyses.decompiler.structuring
          • angr.analyses.decompiler.structuring.dream
          • angr.analyses.decompiler.structuring.phoenix
          • angr.analyses.decompiler.structuring.recursive_structurer
          • angr.analyses.decompiler.structuring.sailr
          • angr.analyses.decompiler.structuring.structurer_base
        • angr.analyses.decompiler.utils
      • angr.analyses.deobfuscator
        • angr.analyses.deobfuscator.api_obf_finder
        • angr.analyses.deobfuscator.api_obf_peephole_optimizer
        • angr.analyses.deobfuscator.api_obf_type2_finder
        • angr.analyses.deobfuscator.data_transformation_embedder
        • angr.analyses.deobfuscator.hash_lookup_api_deobfuscator
        • angr.analyses.deobfuscator.irsb_reg_collector
        • angr.analyses.deobfuscator.scope_ops_analyzer
        • angr.analyses.deobfuscator.string_obf_finder
        • angr.analyses.deobfuscator.string_obf_opt_passes
        • angr.analyses.deobfuscator.string_obf_peephole_optimizer
      • angr.analyses.disassembly
      • angr.analyses.disassembly_utils
      • angr.analyses.dominance_frontier
      • angr.analyses.fcp
        • angr.analyses.fcp.fcp
      • angr.analyses.find_objects_static
      • angr.analyses.flirt
        • angr.analyses.flirt.consts
        • angr.analyses.flirt.flirt
        • angr.analyses.flirt.flirt_function
        • angr.analyses.flirt.flirt_matcher
        • angr.analyses.flirt.flirt_module
        • angr.analyses.flirt.flirt_node
        • angr.analyses.flirt.flirt_sig
        • angr.analyses.flirt.flirt_utils
      • angr.analyses.forward_analysis
        • angr.analyses.forward_analysis.forward_analysis
        • angr.analyses.forward_analysis.job_info
        • angr.analyses.forward_analysis.visitors
          • angr.analyses.forward_analysis.visitors.call_graph
          • angr.analyses.forward_analysis.visitors.function_graph
          • angr.analyses.forward_analysis.visitors.graph
          • angr.analyses.forward_analysis.visitors.loop
          • angr.analyses.forward_analysis.visitors.single_node_graph
      • angr.analyses.identifier
        • angr.analyses.identifier.custom_callable
        • angr.analyses.identifier.errors
        • angr.analyses.identifier.func
        • angr.analyses.identifier.functions
          • angr.analyses.identifier.functions.atoi
          • angr.analyses.identifier.functions.based_atoi
          • angr.analyses.identifier.functions.fdprintf
          • angr.analyses.identifier.functions.free
          • angr.analyses.identifier.functions.int2str
          • angr.analyses.identifier.functions.malloc
          • angr.analyses.identifier.functions.memcmp
          • angr.analyses.identifier.functions.memcpy
          • angr.analyses.identifier.functions.memset
          • angr.analyses.identifier.functions.printf
          • angr.analyses.identifier.functions.recv_until
          • angr.analyses.identifier.functions.skip_calloc
          • angr.analyses.identifier.functions.skip_realloc
          • angr.analyses.identifier.functions.skip_recv_n
          • angr.analyses.identifier.functions.snprintf
          • angr.analyses.identifier.functions.sprintf
          • angr.analyses.identifier.functions.strcasecmp
          • angr.analyses.identifier.functions.strcmp
          • angr.analyses.identifier.functions.strcpy
          • angr.analyses.identifier.functions.strlen
          • angr.analyses.identifier.functions.strncmp
          • angr.analyses.identifier.functions.strncpy
          • angr.analyses.identifier.functions.strtol
        • angr.analyses.identifier.identify
        • angr.analyses.identifier.runner
      • angr.analyses.init_finder
      • angr.analyses.language_detector
      • angr.analyses.loop_analysis
        • angr.analyses.loop_analysis.loop_analysis
      • angr.analyses.loop_unroller
        • angr.analyses.loop_unroller.loop_unroller
      • angr.analyses.loopfinder
      • angr.analyses.outliner
        • angr.analyses.outliner.outliner
      • angr.analyses.patchfinder
      • angr.analyses.pathfinder
      • angr.analyses.propagator
        • angr.analyses.propagator.engine_base
        • angr.analyses.propagator.engine_vex
        • angr.analyses.propagator.propagator
        • angr.analyses.propagator.top_checker_mixin
        • angr.analyses.propagator.values
        • angr.analyses.propagator.vex_vars
      • angr.analyses.proximity_graph
      • angr.analyses.purity
        • angr.analyses.purity.analysis
        • angr.analyses.purity.engine
      • angr.analyses.reaching_definitions
        • angr.analyses.reaching_definitions.call_trace
        • angr.analyses.reaching_definitions.dep_graph
        • angr.analyses.reaching_definitions.engine_ail
        • angr.analyses.reaching_definitions.engine_vex
        • angr.analyses.reaching_definitions.external_codeloc
        • angr.analyses.reaching_definitions.function_handler
        • angr.analyses.reaching_definitions.function_handler_library
          • angr.analyses.reaching_definitions.function_handler_library.stdio
          • angr.analyses.reaching_definitions.function_handler_library.stdlib
          • angr.analyses.reaching_definitions.function_handler_library.string
          • angr.analyses.reaching_definitions.function_handler_library.unistd
        • angr.analyses.reaching_definitions.heap_allocator
        • angr.analyses.reaching_definitions.rd_initializer
        • angr.analyses.reaching_definitions.rd_state
        • angr.analyses.reaching_definitions.reaching_definitions
        • angr.analyses.reaching_definitions.subject
      • angr.analyses.reassembler
      • angr.analyses.s_liveness
      • angr.analyses.s_propagator
      • angr.analyses.s_reaching_definitions
        • angr.analyses.s_reaching_definitions.s_rda_model
        • angr.analyses.s_reaching_definitions.s_rda_view
        • angr.analyses.s_reaching_definitions.s_reaching_definitions
      • angr.analyses.smc
      • angr.analyses.soot_class_hierarchy
      • angr.analyses.stack_pointer_tracker
      • angr.analyses.static_hooker
      • angr.analyses.typehoon
        • angr.analyses.typehoon.dfa
        • angr.analyses.typehoon.simple_solver
        • angr.analyses.typehoon.translator
        • angr.analyses.typehoon.typeconsts
        • angr.analyses.typehoon.typehoon
        • angr.analyses.typehoon.typevars
        • angr.analyses.typehoon.variance
      • angr.analyses.unpacker
        • angr.analyses.unpacker.obfuscation_detector
        • angr.analyses.unpacker.packing_detector
      • angr.analyses.variable_recovery
        • angr.analyses.variable_recovery.annotations
        • angr.analyses.variable_recovery.engine_ail
        • angr.analyses.variable_recovery.engine_base
        • angr.analyses.variable_recovery.engine_vex
        • angr.analyses.variable_recovery.irsb_scanner
        • angr.analyses.variable_recovery.variable_recovery
        • angr.analyses.variable_recovery.variable_recovery_base
        • angr.analyses.variable_recovery.variable_recovery_fast
      • angr.analyses.veritesting
      • angr.analyses.vfg
      • angr.analyses.vsa_ddg
      • angr.analyses.vtable
      • angr.analyses.xrefs
    • angr.angrdb
      • angr.angrdb.db
      • angr.angrdb.models
      • angr.angrdb.serializers
        • angr.angrdb.serializers.cfg_model
        • angr.angrdb.serializers.comments
        • angr.angrdb.serializers.funcs
        • angr.angrdb.serializers.kb
        • angr.angrdb.serializers.labels
        • angr.angrdb.serializers.loader
        • angr.angrdb.serializers.structured_code
        • angr.angrdb.serializers.variables
        • angr.angrdb.serializers.xrefs
    • angr.annocfg
    • angr.blade
    • angr.block
    • angr.callable
    • angr.calling_conventions
    • angr.code_location
    • angr.codenode
    • angr.concretization_strategies
      • angr.concretization_strategies.any
      • angr.concretization_strategies.any_named
      • angr.concretization_strategies.base
      • angr.concretization_strategies.controlled_data
      • angr.concretization_strategies.eval
      • angr.concretization_strategies.logging
      • angr.concretization_strategies.max
      • angr.concretization_strategies.nonzero
      • angr.concretization_strategies.nonzero_range
      • angr.concretization_strategies.norepeats
      • angr.concretization_strategies.norepeats_range
      • angr.concretization_strategies.range
      • angr.concretization_strategies.signed_add
      • angr.concretization_strategies.single
      • angr.concretization_strategies.solutions
      • angr.concretization_strategies.unlimited_range
    • angr.distributed
      • angr.distributed.server
      • angr.distributed.worker
    • angr.emulator
    • angr.engines
      • angr.engines.ail
        • angr.engines.ail.callstack
        • angr.engines.ail.engine_light
        • angr.engines.ail.engine_successors
        • angr.engines.ail.setup
      • angr.engines.engine
      • angr.engines.failure
      • angr.engines.hook
      • angr.engines.icicle
      • angr.engines.light
        • angr.engines.light.data
        • angr.engines.light.engine
      • angr.engines.pcode
        • angr.engines.pcode.behavior
        • angr.engines.pcode.cc
        • angr.engines.pcode.emulate
        • angr.engines.pcode.engine
        • angr.engines.pcode.lifter
      • angr.engines.procedure
      • angr.engines.soot
        • angr.engines.soot.engine
        • angr.engines.soot.exceptions
        • angr.engines.soot.expressions
          • angr.engines.soot.expressions.arrayref
          • angr.engines.soot.expressions.base
          • angr.engines.soot.expressions.binop
          • angr.engines.soot.expressions.cast
          • angr.engines.soot.expressions.condition
          • angr.engines.soot.expressions.constants
          • angr.engines.soot.expressions.instanceOf
          • angr.engines.soot.expressions.instancefieldref
          • angr.engines.soot.expressions.invoke
          • angr.engines.soot.expressions.length
          • angr.engines.soot.expressions.local
          • angr.engines.soot.expressions.new
          • angr.engines.soot.expressions.newArray
          • angr.engines.soot.expressions.newMultiArray
          • angr.engines.soot.expressions.paramref
          • angr.engines.soot.expressions.phi
          • angr.engines.soot.expressions.staticfieldref
          • angr.engines.soot.expressions.thisref
          • angr.engines.soot.expressions.unsupported
        • angr.engines.soot.field_dispatcher
        • angr.engines.soot.method_dispatcher
        • angr.engines.soot.statements
          • angr.engines.soot.statements.assign
          • angr.engines.soot.statements.base
          • angr.engines.soot.statements.goto
          • angr.engines.soot.statements.identity
          • angr.engines.soot.statements.if_
          • angr.engines.soot.statements.invoke
          • angr.engines.soot.statements.return_
          • angr.engines.soot.statements.switch
          • angr.engines.soot.statements.throw
        • angr.engines.soot.values
          • angr.engines.soot.values.arrayref
          • angr.engines.soot.values.base
          • angr.engines.soot.values.constants
          • angr.engines.soot.values.instancefieldref
          • angr.engines.soot.values.local
          • angr.engines.soot.values.paramref
          • angr.engines.soot.values.staticfieldref
          • angr.engines.soot.values.strref
          • angr.engines.soot.values.thisref
      • angr.engines.successors
      • angr.engines.syscall
      • angr.engines.unicorn
      • angr.engines.vex
        • angr.engines.vex.claripy
          • angr.engines.vex.claripy.ccall
          • angr.engines.vex.claripy.datalayer
          • angr.engines.vex.claripy.irop
        • angr.engines.vex.heavy
          • angr.engines.vex.heavy.actions
          • angr.engines.vex.heavy.concretizers
          • angr.engines.vex.heavy.dirty
          • angr.engines.vex.heavy.heavy
          • angr.engines.vex.heavy.inspect
          • angr.engines.vex.heavy.resilience
          • angr.engines.vex.heavy.super_fastpath
        • angr.engines.vex.lifter
        • angr.engines.vex.light
          • angr.engines.vex.light.light
          • angr.engines.vex.light.resilience
          • angr.engines.vex.light.slicing
    • angr.errors
    • angr.exploration_techniques
      • angr.exploration_techniques.base
      • angr.exploration_techniques.bucketizer
      • angr.exploration_techniques.common
      • angr.exploration_techniques.dfs
      • angr.exploration_techniques.director
      • angr.exploration_techniques.driller_core
      • angr.exploration_techniques.explorer
      • angr.exploration_techniques.lengthlimiter
      • angr.exploration_techniques.local_loop_seer
      • angr.exploration_techniques.loop_seer
      • angr.exploration_techniques.manual_mergepoint
      • angr.exploration_techniques.memory_watcher
      • angr.exploration_techniques.oppologist
      • angr.exploration_techniques.slicecutor
      • angr.exploration_techniques.spiller
      • angr.exploration_techniques.spiller_db
      • angr.exploration_techniques.stochastic
      • angr.exploration_techniques.stub_stasher
      • angr.exploration_techniques.suggestions
      • angr.exploration_techniques.tech_builder
      • angr.exploration_techniques.threading
      • angr.exploration_techniques.timeout
      • angr.exploration_techniques.tracer
      • angr.exploration_techniques.unique
      • angr.exploration_techniques.veritesting
    • angr.factory
    • angr.flirt
      • angr.flirt.build_sig
    • angr.keyed_region
    • angr.knowledge_base
    • angr.knowledge_plugins
      • angr.knowledge_plugins.callsite_prototypes
      • angr.knowledge_plugins.cfg
        • angr.knowledge_plugins.cfg.block_id
        • angr.knowledge_plugins.cfg.cfg_manager
        • angr.knowledge_plugins.cfg.cfg_model
        • angr.knowledge_plugins.cfg.cfg_node
        • angr.knowledge_plugins.cfg.indirect_jump
        • angr.knowledge_plugins.cfg.memory_data
        • angr.knowledge_plugins.cfg.spilling_cfg
        • angr.knowledge_plugins.cfg.spilling_digraph
        • angr.knowledge_plugins.cfg.types
      • angr.knowledge_plugins.comments
      • angr.knowledge_plugins.custom_strings
      • angr.knowledge_plugins.data
      • angr.knowledge_plugins.debug_variables
      • angr.knowledge_plugins.functions
        • angr.knowledge_plugins.functions.function
        • angr.knowledge_plugins.functions.function_manager
        • angr.knowledge_plugins.functions.function_parser
        • angr.knowledge_plugins.functions.soot_function
      • angr.knowledge_plugins.indirect_jumps
      • angr.knowledge_plugins.key_definitions
        • angr.knowledge_plugins.key_definitions.atoms
        • angr.knowledge_plugins.key_definitions.constants
        • angr.knowledge_plugins.key_definitions.definition
        • angr.knowledge_plugins.key_definitions.environment
        • angr.knowledge_plugins.key_definitions.heap_address
        • angr.knowledge_plugins.key_definitions.key_definition_manager
        • angr.knowledge_plugins.key_definitions.live_definitions
        • angr.knowledge_plugins.key_definitions.liveness
        • angr.knowledge_plugins.key_definitions.rd_model
        • angr.knowledge_plugins.key_definitions.tag
        • angr.knowledge_plugins.key_definitions.undefined
        • angr.knowledge_plugins.key_definitions.unknown_size
        • angr.knowledge_plugins.key_definitions.uses
      • angr.knowledge_plugins.labels
      • angr.knowledge_plugins.obfuscations
      • angr.knowledge_plugins.patches
      • angr.knowledge_plugins.plugin
      • angr.knowledge_plugins.propagations
        • angr.knowledge_plugins.propagations.prop_value
        • angr.knowledge_plugins.propagations.propagation_manager
        • angr.knowledge_plugins.propagations.propagation_model
        • angr.knowledge_plugins.propagations.states
      • angr.knowledge_plugins.rtdb
        • angr.knowledge_plugins.rtdb.rtdb
      • angr.knowledge_plugins.structured_code
      • angr.knowledge_plugins.types
      • angr.knowledge_plugins.variables
        • angr.knowledge_plugins.variables.variable_access
        • angr.knowledge_plugins.variables.variable_manager
      • angr.knowledge_plugins.xrefs
        • angr.knowledge_plugins.xrefs.xref
        • angr.knowledge_plugins.xrefs.xref_manager
        • angr.knowledge_plugins.xrefs.xref_types
    • angr.llm_client
    • angr.llm_models
    • angr.mcp
      • angr.mcp.errors
      • angr.mcp.serializers
      • angr.mcp.server
      • angr.mcp.session
    • angr.misc
      • angr.misc.ansi
      • angr.misc.autoimport
      • angr.misc.bug_report
      • angr.misc.hookset
      • angr.misc.loggers
      • angr.misc.picklable_lock
      • angr.misc.plugins
      • angr.misc.telemetry
      • angr.misc.testing
      • angr.misc.ux
    • angr.procedures
      • angr.procedures.advapi32
      • angr.procedures.cgc
        • angr.procedures.cgc.allocate
        • angr.procedures.cgc.deallocate
        • angr.procedures.cgc.fdwait
        • angr.procedures.cgc.random
        • angr.procedures.cgc.receive
        • angr.procedures.cgc.transmit
      • angr.procedures.definitions
        • angr.procedures.definitions.cgc
        • angr.procedures.definitions.gnulib
        • angr.procedures.definitions.libstdcpp
        • angr.procedures.definitions.linux_kernel
        • angr.procedures.definitions.linux_loader
        • angr.procedures.definitions.macho_libsystem
        • angr.procedures.definitions.msvcr
        • angr.procedures.definitions.parse_glibc
        • angr.procedures.definitions.parse_syscalls_from_local_system
        • angr.procedures.definitions.parse_win32json
        • angr.procedures.definitions.types_stl
      • angr.procedures.glibc
        • angr.procedures.glibc.dynamic_loading
        • angr.procedures.glibc.scanf
        • angr.procedures.glibc.sscanf
      • angr.procedures.gnulib
        • angr.procedures.gnulib.xalloc_die
        • angr.procedures.gnulib.xstrtol_fatal
      • angr.procedures.java
        • angr.procedures.java.unconstrained
      • angr.procedures.java_io
        • angr.procedures.java_io.read
        • angr.procedures.java_io.write
      • angr.procedures.java_jni
        • angr.procedures.java_jni.array_operations
        • angr.procedures.java_jni.class_and_interface_operations
        • angr.procedures.java_jni.field_access
        • angr.procedures.java_jni.global_and_local_refs
        • angr.procedures.java_jni.method_calls
        • angr.procedures.java_jni.not_implemented
        • angr.procedures.java_jni.object_operations
        • angr.procedures.java_jni.string_operations
        • angr.procedures.java_jni.version_information
      • angr.procedures.java_lang
        • angr.procedures.java_lang.character
        • angr.procedures.java_lang.double
        • angr.procedures.java_lang.exit
        • angr.procedures.java_lang.getsimplename
        • angr.procedures.java_lang.integer
        • angr.procedures.java_lang.load_library
        • angr.procedures.java_lang.math
        • angr.procedures.java_lang.string
        • angr.procedures.java_lang.stringbuilder
        • angr.procedures.java_lang.system
      • angr.procedures.java_util
        • angr.procedures.java_util.collection
        • angr.procedures.java_util.iterator
        • angr.procedures.java_util.list
        • angr.procedures.java_util.map
        • angr.procedures.java_util.random
        • angr.procedures.java_util.scanner_nextline
      • angr.procedures.libc
        • angr.procedures.libc.abort
        • angr.procedures.libc.access
        • angr.procedures.libc.atoi
        • angr.procedures.libc.atol
        • angr.procedures.libc.calloc
        • angr.procedures.libc.closelog
        • angr.procedures.libc.err
        • angr.procedures.libc.error
        • angr.procedures.libc.exit
        • angr.procedures.libc.fclose
        • angr.procedures.libc.feof
        • angr.procedures.libc.fflush
        • angr.procedures.libc.fgetc
        • angr.procedures.libc.fgets
        • angr.procedures.libc.fopen
        • angr.procedures.libc.fprintf
        • angr.procedures.libc.fputc
        • angr.procedures.libc.fputs
        • angr.procedures.libc.fread
        • angr.procedures.libc.free
        • angr.procedures.libc.fscanf
        • angr.procedures.libc.fseek
        • angr.procedures.libc.ftell
        • angr.procedures.libc.fwrite
        • angr.procedures.libc.getchar
        • angr.procedures.libc.getdelim
        • angr.procedures.libc.getegid
        • angr.procedures.libc.geteuid
        • angr.procedures.libc.getgid
        • angr.procedures.libc.gets
        • angr.procedures.libc.getuid
        • angr.procedures.libc.isalnum
        • angr.procedures.libc.isalpha
        • angr.procedures.libc.isascii
        • angr.procedures.libc.isblank
        • angr.procedures.libc.iscntrl
        • angr.procedures.libc.isdigit
        • angr.procedures.libc.isgraph
        • angr.procedures.libc.islower
        • angr.procedures.libc.isprint
        • angr.procedures.libc.ispunct
        • angr.procedures.libc.isspace
        • angr.procedures.libc.isupper
        • angr.procedures.libc.isxdigit
        • angr.procedures.libc.malloc
        • angr.procedures.libc.memccpy
        • angr.procedures.libc.memchr
        • angr.procedures.libc.memcmp
        • angr.procedures.libc.memcpy
        • angr.procedures.libc.memmove
        • angr.procedures.libc.mempcpy
        • angr.procedures.libc.memset
        • angr.procedures.libc.openlog
        • angr.procedures.libc.perror
        • angr.procedures.libc.printf
        • angr.procedures.libc.putchar
        • angr.procedures.libc.puts
        • angr.procedures.libc.rand
        • angr.procedures.libc.realloc
        • angr.procedures.libc.rewind
        • angr.procedures.libc.scanf
        • angr.procedures.libc.setbuf
        • angr.procedures.libc.setvbuf
        • angr.procedures.libc.snprintf
        • angr.procedures.libc.sprintf
        • angr.procedures.libc.srand
        • angr.procedures.libc.sscanf
        • angr.procedures.libc.stpcpy
        • angr.procedures.libc.strcat
        • angr.procedures.libc.strchr
        • angr.procedures.libc.strcmp
        • angr.procedures.libc.strcoll
        • angr.procedures.libc.strcpy
        • angr.procedures.libc.strlen
        • angr.procedures.libc.strncat
        • angr.procedures.libc.strncmp
        • angr.procedures.libc.strncpy
        • angr.procedures.libc.strnlen
        • angr.procedures.libc.strstr
        • angr.procedures.libc.strtok
        • angr.procedures.libc.strtol
        • angr.procedures.libc.strtoul
        • angr.procedures.libc.strxfrm
        • angr.procedures.libc.system
        • angr.procedures.libc.time
        • angr.procedures.libc.tmpnam
        • angr.procedures.libc.tolower
        • angr.procedures.libc.toupper
        • angr.procedures.libc.ungetc
        • angr.procedures.libc.vsnprintf
        • angr.procedures.libc.wchar
      • angr.procedures.libstdcpp
        • angr.procedures.libstdcpp.std____throw_bad_alloc
        • angr.procedures.libstdcpp.std____throw_bad_cast
        • angr.procedures.libstdcpp.std____throw_length_error
        • angr.procedures.libstdcpp.std____throw_logic_error
        • angr.procedures.libstdcpp.std__terminate
      • angr.procedures.linux_kernel
        • angr.procedures.linux_kernel.access
        • angr.procedures.linux_kernel.arch_prctl
        • angr.procedures.linux_kernel.arm_user_helpers
        • angr.procedures.linux_kernel.brk
        • angr.procedures.linux_kernel.cwd
        • angr.procedures.linux_kernel.fstat
        • angr.procedures.linux_kernel.fstat64
        • angr.procedures.linux_kernel.futex
        • angr.procedures.linux_kernel.getegid
        • angr.procedures.linux_kernel.geteuid
        • angr.procedures.linux_kernel.getgid
        • angr.procedures.linux_kernel.getpid
        • angr.procedures.linux_kernel.getrlimit
        • angr.procedures.linux_kernel.gettid
        • angr.procedures.linux_kernel.getuid
        • angr.procedures.linux_kernel.iovec
        • angr.procedures.linux_kernel.lseek
        • angr.procedures.linux_kernel.mmap
        • angr.procedures.linux_kernel.mprotect
        • angr.procedures.linux_kernel.munmap
        • angr.procedures.linux_kernel.openat
        • angr.procedures.linux_kernel.set_tid_address
        • angr.procedures.linux_kernel.sigaction
        • angr.procedures.linux_kernel.sigprocmask
        • angr.procedures.linux_kernel.stat
        • angr.procedures.linux_kernel.sysinfo
        • angr.procedures.linux_kernel.tgkill
        • angr.procedures.linux_kernel.time
        • angr.procedures.linux_kernel.uid
        • angr.procedures.linux_kernel.uname
        • angr.procedures.linux_kernel.unlink
        • angr.procedures.linux_kernel.vsyscall
      • angr.procedures.linux_loader
        • angr.procedures.linux_loader.sim_loader
        • angr.procedures.linux_loader.tls
      • angr.procedures.msvcr
        • angr.procedures.msvcr.fmode
      • angr.procedures.ntdll
        • angr.procedures.ntdll.exceptions
      • angr.procedures.posix
        • angr.procedures.posix.accept
        • angr.procedures.posix.bind
        • angr.procedures.posix.bzero
        • angr.procedures.posix.chroot
        • angr.procedures.posix.close
        • angr.procedures.posix.closedir
        • angr.procedures.posix.dup
        • angr.procedures.posix.fcntl
        • angr.procedures.posix.fdopen
        • angr.procedures.posix.fileno
        • angr.procedures.posix.fork
        • angr.procedures.posix.getenv
        • angr.procedures.posix.gethostbyname
        • angr.procedures.posix.getpass
        • angr.procedures.posix.getsockopt
        • angr.procedures.posix.htonl
        • angr.procedures.posix.htons
        • angr.procedures.posix.inet_ntoa
        • angr.procedures.posix.listen
        • angr.procedures.posix.mmap
        • angr.procedures.posix.open
        • angr.procedures.posix.opendir
        • angr.procedures.posix.poll
        • angr.procedures.posix.pread64
        • angr.procedures.posix.pthread
        • angr.procedures.posix.pwrite64
        • angr.procedures.posix.read
        • angr.procedures.posix.readdir
        • angr.procedures.posix.recv
        • angr.procedures.posix.recvfrom
        • angr.procedures.posix.select
        • angr.procedures.posix.send
        • angr.procedures.posix.setsockopt
        • angr.procedures.posix.sigaction
        • angr.procedures.posix.sim_time
        • angr.procedures.posix.sleep
        • angr.procedures.posix.socket
        • angr.procedures.posix.strcasecmp
        • angr.procedures.posix.strdup
        • angr.procedures.posix.strncasecmp
        • angr.procedures.posix.strndup
        • angr.procedures.posix.strtok_r
        • angr.procedures.posix.syslog
        • angr.procedures.posix.tz
        • angr.procedures.posix.unlink
        • angr.procedures.posix.usleep
        • angr.procedures.posix.write
      • angr.procedures.procedure_dict
      • angr.procedures.stubs
        • angr.procedures.stubs.CallReturn
        • angr.procedures.stubs.NoReturnUnconstrained
        • angr.procedures.stubs.Nop
        • angr.procedures.stubs.PathTerminator
        • angr.procedures.stubs.Redirect
        • angr.procedures.stubs.ReturnChar
        • angr.procedures.stubs.ReturnUnconstrained
        • angr.procedures.stubs.UnresolvableCallTarget
        • angr.procedures.stubs.UnresolvableJumpTarget
        • angr.procedures.stubs.UserHook
        • angr.procedures.stubs.b64_decode
        • angr.procedures.stubs.caller
        • angr.procedures.stubs.crazy_scanf
        • angr.procedures.stubs.format_parser
        • angr.procedures.stubs.syscall_stub
      • angr.procedures.testing
        • angr.procedures.testing.manyargs
        • angr.procedures.testing.retreg
      • angr.procedures.tracer
        • angr.procedures.tracer.random
        • angr.procedures.tracer.receive
        • angr.procedures.tracer.transmit
      • angr.procedures.uclibc
      • angr.procedures.win32
        • angr.procedures.win32.EncodePointer
        • angr.procedures.win32.ExitProcess
        • angr.procedures.win32.GetCommandLine
        • angr.procedures.win32.GetCurrentProcessId
        • angr.procedures.win32.GetCurrentThreadId
        • angr.procedures.win32.GetLastInputInfo
        • angr.procedures.win32.GetModuleHandle
        • angr.procedures.win32.GetProcessAffinityMask
        • angr.procedures.win32.InterlockedExchange
        • angr.procedures.win32.IsProcessorFeaturePresent
        • angr.procedures.win32.VirtualAlloc
        • angr.procedures.win32.VirtualProtect
        • angr.procedures.win32.critical_section
        • angr.procedures.win32.dynamic_loading
        • angr.procedures.win32.file_handles
        • angr.procedures.win32.gethostbyname
        • angr.procedures.win32.heap
        • angr.procedures.win32.is_bad_ptr
        • angr.procedures.win32.local_storage
        • angr.procedures.win32.mutex
        • angr.procedures.win32.sim_time
        • angr.procedures.win32.system_paths
      • angr.procedures.win32_kernel
        • angr.procedures.win32_kernel.ExAllocatePool
        • angr.procedures.win32_kernel.ExFreePoolWithTag
      • angr.procedures.win_user32
        • angr.procedures.win_user32.chars
        • angr.procedures.win_user32.keyboard
        • angr.procedures.win_user32.messagebox
    • angr.project
    • angr.protos
      • angr.protos.cfg_pb2
      • angr.protos.function_pb2
      • angr.protos.primitives_pb2
      • angr.protos.variables_pb2
      • angr.protos.xrefs_pb2
    • angr.rust
      • angr.rust.analyses
        • angr.rust.analyses.cleanup_function_identification
        • angr.rust.analyses.flirt_sig_propagation
        • angr.rust.analyses.rust_calling_convention
          • angr.rust.analyses.rust_calling_convention.fact_collector
          • angr.rust.analyses.rust_calling_convention.pathfinder
          • angr.rust.analyses.rust_calling_convention.rust_calling_convention
          • angr.rust.analyses.rust_calling_convention.rust_calling_convention_model
        • angr.rust.analyses.rust_symbol_recovery
        • angr.rust.analyses.rust_type_hints
        • angr.rust.analyses.rustc_version_identification
        • angr.rust.analyses.struct_builder
        • angr.rust.analyses.type_db_loader
      • angr.rust.knowledge_plugins
        • angr.rust.knowledge_plugins.clinic_factory
        • angr.rust.knowledge_plugins.known_structs
        • angr.rust.knowledge_plugins.librust
        • angr.rust.knowledge_plugins.rust_calling_conventions
        • angr.rust.knowledge_plugins.type_hints
      • angr.rust.mixins
        • angr.rust.mixins.cfa_mixin
        • angr.rust.mixins.cfg_transformation_mixin
        • angr.rust.mixins.dfa_mixin
        • angr.rust.mixins.srda_mixin
        • angr.rust.mixins.ssa_variable_mixin
      • angr.rust.optimization_passes
        • angr.rust.optimization_passes.cleanup_code_remover
        • angr.rust.optimization_passes.combo_register_rewriter
        • angr.rust.optimization_passes.deref_coercion_simplifier
        • angr.rust.optimization_passes.deref_coercion_simplifier_uninlined
        • angr.rust.optimization_passes.error_propagation_simplifier
        • angr.rust.optimization_passes.function_prototype_inference
        • angr.rust.optimization_passes.macro
          • angr.rust.optimization_passes.macro.format_macro_simplifier
        • angr.rust.optimization_passes.outliners
          • angr.rust.optimization_passes.outliners.string_cmp_outliner
          • angr.rust.optimization_passes.outliners.string_literal_outliner
          • angr.rust.optimization_passes.outliners.string_outliner
          • angr.rust.optimization_passes.outliners.unwrap_outliner
          • angr.rust.optimization_passes.outliners.vec_outliner
        • angr.rust.optimization_passes.pattern_match_simplifier
        • angr.rust.optimization_passes.pre_pattern_match_simplifier
        • angr.rust.optimization_passes.redundant_block_remover
        • angr.rust.optimization_passes.ret_expr_rewriter
        • angr.rust.optimization_passes.rust_calling_convention
        • angr.rust.optimization_passes.security_check_remover
        • angr.rust.optimization_passes.str_argument_simplifier
        • angr.rust.optimization_passes.struct_instantiation_simplifier
        • angr.rust.optimization_passes.struct_return_simplifier
        • angr.rust.optimization_passes.utils
      • angr.rust.sim_type
      • angr.rust.structuring
        • angr.rust.structuring.structurer_nodes
      • angr.rust.typehoon
        • angr.rust.typehoon.translator
        • angr.rust.typehoon.typehoon
      • angr.rust.utils
        • angr.rust.utils.ail
        • angr.rust.utils.demangler
        • angr.rust.utils.rust_sigs
    • angr.rustylib
    • angr.serializable
    • angr.sim_manager
    • angr.sim_options
    • angr.sim_procedure
    • angr.sim_state
    • angr.sim_state_options
    • angr.sim_type
    • angr.sim_variable
    • angr.simos
      • angr.simos.cgc
      • angr.simos.javavm
      • angr.simos.linux
      • angr.simos.simos
      • angr.simos.snimmuc_nxp
      • angr.simos.userland
      • angr.simos.windows
      • angr.simos.xbox
    • angr.slicer
    • angr.state_hierarchy
    • angr.state_plugins
      • angr.state_plugins.callstack
      • angr.state_plugins.cgc
      • angr.state_plugins.debug_variables
      • angr.state_plugins.edge_hitmap
      • angr.state_plugins.filesystem
      • angr.state_plugins.gdb
      • angr.state_plugins.globals
      • angr.state_plugins.heap
        • angr.state_plugins.heap.heap_base
        • angr.state_plugins.heap.heap_brk
        • angr.state_plugins.heap.heap_freelist
        • angr.state_plugins.heap.heap_libc
        • angr.state_plugins.heap.heap_ptmalloc
        • angr.state_plugins.heap.utils
      • angr.state_plugins.history
      • angr.state_plugins.icicle
      • angr.state_plugins.inspect
      • angr.state_plugins.javavm_classloader
      • angr.state_plugins.jni_references
      • angr.state_plugins.libc
      • angr.state_plugins.light_registers
      • angr.state_plugins.log
      • angr.state_plugins.loop_data
      • angr.state_plugins.plugin
      • angr.state_plugins.posix
      • angr.state_plugins.preconstrainer
      • angr.state_plugins.scratch
      • angr.state_plugins.sim_action
      • angr.state_plugins.sim_action_object
      • angr.state_plugins.sim_event
      • angr.state_plugins.solver
      • angr.state_plugins.symbolizer
      • angr.state_plugins.trace_additions
      • angr.state_plugins.uc_manager
      • angr.state_plugins.unicorn_engine
      • angr.state_plugins.view
    • angr.storage
      • angr.storage.file
      • angr.storage.memory_mixins
        • angr.storage.memory_mixins.actions_mixin
        • angr.storage.memory_mixins.address_concretization_mixin
        • angr.storage.memory_mixins.bvv_conversion_mixin
        • angr.storage.memory_mixins.conditional_store_mixin
        • angr.storage.memory_mixins.convenient_mappings_mixin
        • angr.storage.memory_mixins.default_filler_mixin
        • angr.storage.memory_mixins.dirty_addrs_mixin
        • angr.storage.memory_mixins.hex_dumper_mixin
        • angr.storage.memory_mixins.inspect_mixin
        • angr.storage.memory_mixins.javavm_memory_mixin
        • angr.storage.memory_mixins.keyvalue_memory_mixin
        • angr.storage.memory_mixins.label_merger_mixin
        • angr.storage.memory_mixins.memory_mixin
        • angr.storage.memory_mixins.multi_value_merger_mixin
        • angr.storage.memory_mixins.name_resolution_mixin
        • angr.storage.memory_mixins.paged_memory
          • angr.storage.memory_mixins.paged_memory.page_backer_mixins
          • angr.storage.memory_mixins.paged_memory.paged_memory_mixin
          • angr.storage.memory_mixins.paged_memory.paged_memory_multivalue_mixin
          • angr.storage.memory_mixins.paged_memory.pages
            • angr.storage.memory_mixins.paged_memory.pages.base
            • angr.storage.memory_mixins.paged_memory.pages.cooperation
            • angr.storage.memory_mixins.paged_memory.pages.history_tracking_mixin
            • angr.storage.memory_mixins.paged_memory.pages.ispo_mixin
            • angr.storage.memory_mixins.paged_memory.pages.list_page
            • angr.storage.memory_mixins.paged_memory.pages.multi_values
            • angr.storage.memory_mixins.paged_memory.pages.mv_list_page
            • angr.storage.memory_mixins.paged_memory.pages.permissions_mixin
            • angr.storage.memory_mixins.paged_memory.pages.refcount_mixin
            • angr.storage.memory_mixins.paged_memory.pages.ultra_page
          • angr.storage.memory_mixins.paged_memory.privileged_mixin
          • angr.storage.memory_mixins.paged_memory.stack_allocation_mixin
        • angr.storage.memory_mixins.regioned_memory
          • angr.storage.memory_mixins.regioned_memory.abstract_address_descriptor
          • angr.storage.memory_mixins.regioned_memory.abstract_merger_mixin
          • angr.storage.memory_mixins.regioned_memory.region_category_mixin
          • angr.storage.memory_mixins.regioned_memory.region_data
          • angr.storage.memory_mixins.regioned_memory.region_meta_mixin
          • angr.storage.memory_mixins.regioned_memory.regioned_address_concretization_mixin
          • angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin
          • angr.storage.memory_mixins.regioned_memory.static_find_mixin
        • angr.storage.memory_mixins.simple_interface_mixin
        • angr.storage.memory_mixins.simplification_mixin
        • angr.storage.memory_mixins.size_resolution_mixin
        • angr.storage.memory_mixins.slotted_memory
        • angr.storage.memory_mixins.smart_find_mixin
        • angr.storage.memory_mixins.symbolic_merger_mixin
        • angr.storage.memory_mixins.top_merger_mixin
        • angr.storage.memory_mixins.underconstrained_mixin
        • angr.storage.memory_mixins.unwrapper_mixin
      • angr.storage.memory_object
    • angr.tablespecs
    • angr.utils
      • angr.utils.ail
      • angr.utils.algo
      • angr.utils.balancer
      • angr.utils.bits
      • angr.utils.constants
      • angr.utils.cowdict
      • angr.utils.cpp
      • angr.utils.doms
      • angr.utils.dynamic_dictlist
      • angr.utils.endness
      • angr.utils.enums_conv
      • angr.utils.env
      • angr.utils.formatting
      • angr.utils.funcid
      • angr.utils.graph
      • angr.utils.ins_addr_list
      • angr.utils.json_utils
      • angr.utils.lazy_import
      • angr.utils.library
      • angr.utils.loader
      • angr.utils.mp
      • angr.utils.orderedset
      • angr.utils.smart_cache
      • angr.utils.ssa
        • angr.utils.ssa.tmp_uses_collector
        • angr.utils.ssa.vvar_extra_defs_collector
        • angr.utils.ssa.vvar_uses_collector
      • angr.utils.strings
      • angr.utils.tagged_interval_map
      • angr.utils.timing
      • angr.utils.types
      • angr.utils.vex
    • angr.vaults
Back to top
View this page

angr.procedures.win32_kernel¶

These procedures implement functions from the Windows kernel.

Submodules

ExAllocatePool

ExFreePoolWithTag

Next
angr.procedures.win32_kernel.ExAllocatePool
Previous
angr.procedures.win32.system_paths
Copyright © 2026, The angr Project contributors
Made with Sphinx and @pradyunsg's Furo