Welcome to angr’s documentation!¶
Welcome to angr’s documentation! This documentation is intended to be a guide for learning angr, as well as a reference for the API. If you’re new to angr,
The angr team maintains a number of libraries that are used as part of angr. These libraries are:
archinfo - Information about CPU architectures
pyvex - Python bindings to the VEX IR
pypcode - Python bindings to the Pcode IR
ailment - angr’s high-level intermediate language
cle - Many-platform binary loader
claripy - Solver abstraction layer
angr also has a GUI! Check out angr-management.
- Introduction
- Getting Started
- Core Concepts
- Build-in Analyses
- Advanced Topics
- Gotchas when using angr
- Understanding the Execution Pipeline
- What’s Up With Mixins, Anyway?
- Optimization considerations
- Working with File System, Sockets, and Pipes
- Intermediate Representation
- Working with Data and Conventions
- Solver Engine
- Symbolic memory addressing
- Java Support
- Symbion: Interleaving symbolic and concrete execution
- Debug variable resolution
- Variable visibility
- Extending angr
- angr examples
- Frequently Asked Questions
- Why is it named angr?
- How should “angr” be stylized?
- Why isn’t symbolic execution doing the thing I want?
- How can I get diagnostic information about what angr is doing?
- Why is angr so slow?
- How do I find bugs using angr?
- Why did you choose VEX instead of another IR (such as LLVM, REIL, BAP, etc)?
- Why are some ARM addresses off-by-one?
- How do I serialize angr objects?
- What does
UnsupportedIROpError("floating point support disabled")
mean? - Why is angr’s CFG different from IDA’s?
- Why do I get incorrect register values when reading from a state during a SimInspect breakpoint?
- Appendix
- API Reference
SimProcedure
BP
SimStatePlugin
Project
load_shellcode()
AngrError
AngrRuntimeError
AngrValueError
AngrLifterError
AngrExitError
AngrPathError
AngrVaultError
PathUnreachableError
SimulationManagerError
AngrInvalidArgumentError
AngrSurveyorError
AngrAnalysisError
AngrBladeError
AngrBladeSimProcError
AngrAnnotatedCFGError
AngrBackwardSlicingError
AngrCallableError
AngrCallableMultistateError
AngrSyscallError
AngrSimOSError
AngrAssemblyError
AngrTypeError
AngrMissingTypeError
AngrIncongruencyError
AngrForwardAnalysisError
AngrSkipJobNotice
AngrDelayJobNotice
AngrJobMergingFailureNotice
AngrJobWideningFailureNotice
AngrCFGError
AngrVFGError
AngrVFGRestartAnalysisNotice
AngrDataGraphError
AngrDDGError
AngrLoopAnalysisError
AngrExplorationTechniqueError
AngrExplorerError
AngrDirectorError
AngrTracerError
AngrDBError
AngrCorruptDBError
AngrIncompatibleDBError
TracerEnvironmentError
SimError
SimStateError
SimMergeError
SimMemoryError
SimMemoryMissingError
SimAbstractMemoryError
SimRegionMapError
SimMemoryLimitError
SimMemoryAddressError
SimFastMemoryError
SimEventError
SimPosixError
SimFilesystemError
SimSymbolicFilesystemError
SimFileError
SimHeapError
SimUnsupportedError
SimSolverError
SimSolverModeError
SimSolverOptionError
SimValueError
SimUnsatError
SimOperationError
UnsupportedIROpError
SimExpressionError
UnsupportedIRExprError
SimCCallError
UnsupportedCCallError
SimUninitializedAccessError
SimStatementError
UnsupportedIRStmtError
UnsupportedDirtyError
SimMissingTempError
SimEngineError
SimIRSBError
SimTranslationError
SimProcedureError
SimProcedureArgumentError
SimShadowStackError
SimFastPathError
SimIRSBNoDecodeError
AngrUnsupportedSyscallError
UnsupportedSyscallError
SimReliftException
SimSlicerError
SimActionError
SimCCError
SimUCManagerError
SimUCManagerAllocationError
SimUnicornUnsupport
SimUnicornError
SimUnicornSymbolic
SimEmptyCallStackError
SimStateOptionsError
SimException
SimSegfaultException
SimSegfaultError
SimZeroDivisionException
AngrNoPluginError
SimConcreteMemoryError
SimConcreteRegisterError
SimConcreteBreakpointError
AngrDecompilationError
UnsupportedNodeTypeError
Blade
SimOS
Block
SimulationManager
Analysis
register_analysis()
ExplorationTechnique
StateHierarchy
SimState
default_cc()
PointerWrapper
SimCC
SimFileBase
SimFile
SimPackets
SimFileStream
SimPacketsStream
SimFileDescriptor
SimFileDescriptorDuplex
SimMount
SimHostFilesystem
SimHeapBrk
SimHeapPTMalloc
PTChunk
Server
KnowledgeBase
- Project
- Plugin Ecosystem
- Program State
- Storage
- Memory Mixins
- Concretization Strategies
- Simulation Manager
- Exploration Techniques
- Simulation Engines
- Simulation Logging
- Procedures
- Calling Conventions and Types
- Knowledge Base
- Serialization
- Analysis
- SimOS
- Function Signature Matching
- Utils
- Errors
- Distributed analysis