Angr Solver

A binary analysis tool in Python to automatically find paths to code

Angr is really useful for quickly solving some Reverse Engineering challenges. The most useful function allows you to define an address in a Linux binary, and it will run the binary with different inputs to slowly make progress toward that goal.

For a CTF challenge, you could point the goal to be after some if statements that you would otherwise have to reverse engineer. Then Angr will find a valid input that gets to the code after the if statements, solving the challenge for you.

A presentation about Z3 and Angr that shows practical code

Template

This template lets Angr do the magic to solve it automatically without much effort, but for more advanced examples see their documentation.

Examples

When you can and can't use Angr is something you just need to get a feel for, by trying it sometimes and seeing if it works. In most cases, you're looking for some check on an input you're giving, and finding how to get past that if statement is a tedious process. Here are some examples of decompiled code where Angr could be used:

Another example of the CrackThePassword challenge solved with Angr

One more writeup of a reversing challenge that was easily solved using Angr:

Last updated