List of State Options

State Modes

These may be enabled by passing mode=xxx to a state constructor.

Mode name	Description
symbolic	The default mode. Useful for most emulation and analysis tasks.
symbolic_approximating	Symbolic mode, but enables approximations for constraint solving.
static	A preset useful for static analysis. The memory model becomes an abstract region-mapping system, “fake return” successors skipping calls are added, and more.
fastpath	A preset for extremely lightweight static analysis. Executing will skip all intensive processing to give a quick view of the behavior of code.
tracing	A preset for attempting to execute concretely through a program with a given input. Enables unicorn, enables resilience options, and will attempt to emulate access violations correctly.

Option Sets

These are sets of options, found as angr.options.xxx.

Set name	Description
common_options	Options necessary for basic execution
symbolic	Options necessary for basic symbolic execution
resilience	Options that harden angr’s emulation against unsupported operations, attempting to carry on by treating the result as an unconstrained symbolic value and logging the occasion to state.history.events.
refs	Options that cause angr to keep a log of all the memory, register, and temporary references complete with dependency information in history.actions. This option consumes a lot of memory, so be careful!
approximation	Options that enable approximations of constraint solves via value-set analysis instead of calling into z3
simplification	Options that cause data to be run through z3’s simplifiers before it reaches memory or register storage
unicorn	Options that enable the unicorn engine for executing on concrete data

Options

These are individual option objects, found as angr.options.XXX.

Option name	Description	Sets	Modes	Implicit adds
ABSTRACT_MEMORY	Use SimAbstractMemory to model memory as discrete regions		static
ABSTRACT_SOLVER	Allow splitting constraint sets during simplification		static
ACTION_DEPS	Track dependencies in SimActions
APPROXIMATE_GUARDS	Use VSA when evaluating guard conditions
APPROXIMATE_MEMORY_INDICES	Use VSA when evaluating memory indices	approximation	symbolic_approximating
APPROXIMATE_MEMORY_SIZES	Use VSA when evaluating memory load/store sizes	approximation	symbolic_approximating
APPROXIMATE_SATISFIABILITY	Use VSA when evaluating state satisfiability	approximation	symbolic_approximating
AST_DEPS	Enables dependency tracking for all claripy ASTs			During execution
AUTO_REFS	An internal option used to track dependencies in SimProcedures			During execution
AVOID_MULTIVALUED_READS	Return a symbolic value without touching memory for any read that has a symbolic address		fastpath
AVOID_MULTIVALUED_WRITES	Do not perform any write that has a symbolic address		fastpath
BEST_EFFORT_MEMORY_STORING	Handle huge writes of symbolic size by pretending they are actually smaller		static, fastpath
BREAK_SIRSB_END	Debug: trigger a breakpoint at the end of each block
BREAK_SIRSB_START	Debug: trigger a breakpoint at the start of each block
BREAK_SIRSTMT_END	Debug: trigger a breakpoint at the end of each IR statement
BREAK_SIRSTMT_START	Debug: trigger a breakpoint at the start of each IR statement
BYPASS_ERRORED_IRCCALL	Treat clean helpers that fail with errors as returning unconstrained symbolic values	resilience	fastpath, tracing
BYPASS_ERRORED_IROP	Treat operations that fail with errors as returning unconstrained symbolic values	resilience	fastpath, tracing
BYPASS_UNSUPPORTED_IRCCALL	Treat unsupported clean helpers as returning unconstrained symbolic values	resilience	fastpath, tracing
BYPASS_UNSUPPORTED_IRDIRTY	Treat unsupported dirty helpers as returning unconstrained symbolic values	resilience	fastpath, tracing
BYPASS_UNSUPPORTED_IREXPR	Treat unsupported IR expressions as returning unconstrained symbolic values	resilience	fastpath, tracing
BYPASS_UNSUPPORTED_IROP	Treat unsupported operations as returning unconstrained symbolic values	resilience	fastpath, tracing
BYPASS_UNSUPPORTED_IRSTMT	Treat unsupported IR statements as returning unconstrained symbolic values	resilience	fastpath, tracing
BYPASS_UNSUPPORTED_SYSCALL	Treat unsupported syscalls as returning unconstrained symbolic values	resilience	fastpath, tracing
BYPASS_VERITESTING_EXCEPTIONS	Discard emulation errors during veritesting	resilience	fastpath, tracing
CACHELESS_SOLVER	enable SolverCacheless
CALLLESS	Emulate call instructions as an unconstraining of the return value register
CGC_ENFORCE_FD	CGC: make sure all reads and writes go to stdin and stdout, respectively
CGC_NON_BLOCKING_FDS	CGC: always report “data available” in fdwait
CGC_NO_SYMBOLIC_RECEIVE_LENGTH	CGC: always read the maximum amount of data requested in the receive syscall
COMPOSITE_SOLVER	Enable SolverComposite for independent constraint set optimization	symbolic	all except static
CONCRETIZE	Concretize all symbolic expressions encountered during emulation
CONCRETIZE_SYMBOLIC_FILE_READ_SIZES	Concreteize the sizes of file reads
CONCRETIZE_SYMBOLIC_WRITE_SIZES	Concretize the sizes of symbolic writes to memory
CONSERVATIVE_READ_STRATEGY	Do not use SimConcretizationStrategyAny for reads; in case of read address concretization failures, return an unconstrained symbolic value
CONSERVATIVE_WRITE_STRATEGY	Do not use SimConcretizationStrategyAny for writes; in case of write address concretization failures, treat the store as a no-op
CONSTRAINT_TRACKING_IN_SOLVER	Set track=True for making claripy Solvers; enable use of unsat_core
COW_STATES	Copy states instead of mutating the initial state directly	common_options	all
DOWNSIZE_Z3	Downsize the claripy solver whenever possible to save memory
DO_CCALLS	Perform IR clean calls	symbolic	all except fastpath
DO_GETS	Perform IR register reads	common_options	all
DO_LOADS	Perform IR memory loads	common_options	all
DO_OPS	Perform IR computation operations	common_options	all
DO_PUTS	Perform IR register writes	common_options	all
DO_RET_EMULATION	For each Ijk_Call successor, add a corresponding Ijk_FakeRet successor		static, fastpath
DO_STORES	Perform IR memory stores	common_options	all
EFFICIENT_STATE_MERGING	Keep in memory any state that might be a common ancestor in a merge			Veritesting
ENABLE_NX	When in conjunction with STRICT_PAGE_ACCESS, raise a SimSegfaultException on executing non-executable memory			Automatically if supported
EXCEPTION_HANDLING	Ask all SimExceptions raised during execution to be handled by the SimOS		tracing
FAST_MEMORY	Use SimFastMemory for memory storage
FAST_REGISTERS	Use SimFastMemory for register storage		fastpath
INITIALIZE_ZERO_REGISTERS	Treat the initial value of registers as zero instead of unconstrained symbolic	unicorn	tracing
KEEP_IP_SYMBOLIC	Don’t try to concretize successor states with symbolic instruction pointers
KEEP_MEMORY_READS_DISCRETE	In abstract memory, handle failed loads by returning a DCIS?
LAZY_SOLVES	Don’t check satisfiability until absolutely necessary
MEMORY_SYMBOLIC_BYTES_MAP	Maintain a mapping of symbolic variable to which memory address it “really” corresponds to, at the paged memory level?
NO_SYMBOLIC_JUMP_RESOLUTION	Do not attempt to flatten symbolic-ip successors into discrete targets		fastpath
NO_SYMBOLIC_SYSCALL_RESOLUTION	Do not attempt to flatten symbolic-syscall-number successors into discrete targets		fastpath
OPTIMIZE_IR	Use LibVEX’s optimization	common_options	all
REGION_MAPPING	Maintain a mapping of symbolic variable to which memory region it corresponds to, at the abstract memory level		static
REPLACEMENT_SOLVER	Enable SolverReplacement
REVERSE_MEMORY_HASH_MAP	Maintain a mapping from AST hash to which addresses it is present in
REVERSE_MEMORY_NAME_MAP	Maintain a mapping from symbolic variable name to which addresses it is present in, required for memory.replace_all		static
SIMPLIFY_CONSTRAINTS	Run added constraints through z3’s simplifcation
SIMPLIFY_EXIT_GUARD	Run branch guards through z3’s simplification
SIMPLIFY_EXIT_STATE	Perform simplification on all successor states generated
SIMPLIFY_EXIT_TARGET	Run jump/call/branch targets through z3’s simplification
SIMPLIFY_EXPRS	Run the results of IR expressions through z3’s simplification
SIMPLIFY_MEMORY_READS	Run the results of memory reads through z3’s simplification
SIMPLIFY_MEMORY_WRITES	Run values stored to memory through z3’s simplification	simplification, common_options	symbolic, symbolic_approximating, tracing
SIMPLIFY_REGISTER_READS	Run values read from registers through z3’s simplification
SIMPLIFY_REGISTER_WRITES	Run values written to registers through z3’s simplification	simplification, common_options	symbolic, symbolic_approximating, tracing
SIMPLIFY_RETS	Run values returned from SimProcedures through z3’s simplification
STRICT_PAGE_ACCESS	Raise a SimSegfaultException when attempting to interact with memory in a way not permitted by the current permissions		tracing
SUPER_FASTPATH	Only execute the last four instructions of each block
SUPPORT_FLOATING_POINT	When disabled, throw an UnsupportedIROpError when encountering floating point operations	common_options	all
SYMBOLIC	Enable constraint solving?	symbolic	symbolic, symbolic_approximating, fastpath
SYMBOLIC_INITIAL_VALUES	make state.solver.Unconstrained return a symbolic value instead of zero	symbolic	all
SYMBOLIC_TEMPS	Treat each IR temporary as a symbolic variable; treat stores to them as constraint addition
SYMBOLIC_WRITE_ADDRESSES	Allow writes with symbolic addresses to be processed by concretization strategies; when disabled, only allow for variables annotated with the “multiwrite” annotation
TRACK_CONSTRAINTS	When disabled, don’t keep any constraints added to the state	symbolic	all
TRACK_CONSTRAINT_ACTIONS	Keep a SimAction for each constraint added	refs
TRACK_JMP_ACTIONS	Keep a SimAction for each jump or branch	refs
TRACK_MEMORY_ACTIONS	Keep a SimAction for each memory read and write	refs
TRACK_MEMORY_MAPPING	Keep track of which pages are mapped into memory and which are not	common_options	all
TRACK_OP_ACTIONS	Keep a SimAction for each IR operation		fastpath
TRACK_REGISTER_ACTIONS	Keep a SimAction for each register read and write	refs
TRACK_SOLVER_VARIABLES	Maintain a listing of all the variables in all the constraints in the solver
TRACK_TMP_ACTIONS	Keep a SimAction for each temporary variable read and write	refs
TRUE_RET_EMULATION_GUARD	With DO_RET_EMULATION, add fake returns with guard condition true instead of false		static
UNDER_CONSTRAINED_SYMEXEC	Enable under-constrained symbolic execution
UNICORN	Use unicorn engine to execute symbolically when data is concrete	unicorn	tracing	Oppologist
UNICORN_AGGRESSIVE_CONCRETIZATION	Concretize any register variable unicorn tries to access			Oppologist
UNICORN_HANDLE_TRANSMIT_SYSCALL	CGC: handle the transmit syscall without leaving unicorn	unicorn	tracing
UNICORN_SYM_REGS_SUPPORT	Attempt to stay in unicorn even in the presence of symbolic registers by checking that the tainted registers are unused at every step	unicorn	tracing
UNICORN_THRESHOLD_CONCRETIZATION	Concretize variables if they prevent unicorn from executing too often
UNICORN_TRACK_BBL_ADDRS	Keep state.history.bbl_addrs up to date when using unicorn	unicorn	tracing
UNICORN_TRACK_STACK_POINTERS	Track a list of the stack pointer’s value at each block in state.scratch.stack_pointer_list	unicorn
UNICORN_ZEROPAGE_GUARD	Prevent unicorn from mapping the zero page into memory
UNINITIALIZED_ACCESS_AWARENESS	Broken/unused?
UNSUPPORTED_BYPASS_ZERO_DEFAULT	When using the resilience options, return zero instead of an unconstrained symbol
USE_SIMPLIFIED_CCALLS	Use a “simplified” set of ccalls optimized for specific cases		static
USE_SYSTEM_TIMES	In library functions and syscalls and hardware instructions accessing clock data, retrieve the real value from the host system.		tracing
VALIDATE_APPROXIMATIONS	Debug: When performing approximations, ensure that the approximation is sound by calling into z3
ZERO_FILL_UNCONSTRAINED_MEMORY	Make the value of memory read from an uninitialized address zero instead of an unconstrained symbol		tracing