cd8e13da13
_executable_memory_regions took every section of an executable Mach-O segment without asking anything about the section, unlike the ELF, PE/COFF and XBE branches beside it. The whole of __TEXT is r-x, so the regions to analyze covered the constant pools, string literals, unwind tables and Objective-C and Swift metadata sitting beside the code: 73,172 bytes over eleven regions on tests/aarch64/ReverseOneSignal.app/Frameworks/OneSignalCore.framework/OneSignalCore against the 55,984 bytes in four that the file states hold instructions, and 2,195,844 against 1,699,668 on a larger dylib. Requires the cle change that makes MachOSection.is_executable answer from the section's own S_ATTR_*INSTRUCTIONS bits; against a cle without it this filter is a no-op, because every section of an r-x segment still reports as executable. Over every Mach-O in binaries the regions shrink to exactly the sections that state instructions, and the blocks that go with them are 33 that began in __unwind_info, __cstring, __objc_methname and __objc_classname, plus one on armhf/FileProtection-05.armv7.macho that began in the last word of __stub_helper and ran 194 bytes into __objc_methname. Eight fixtures gain a four-byte block at the last word of __objc_stubs, a brk #1 the merged region caused the scan to step over. No block that begins inside a section stating instructions is lost. |
||
|---|---|---|
| .github | ||
| angr | ||
| corpus_tests | ||
| docs | ||
| native | ||
| tests | ||
| .dockerignore | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| .readthedocs.yml | ||
| Cargo.lock | ||
| Cargo.toml | ||
| COPYRIGHT | ||
| LICENSE | ||
| MANIFEST.in | ||
| pyproject.toml | ||
| README.md | ||
| rust-toolchain.toml | ||
| SECURITY.md | ||
| setup.py | ||
angr
angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot.
Project Links
Homepage: https://angr.io
Project repository: https://github.com/angr/angr
Documentation: https://docs.angr.io
API Documentation: https://docs.angr.io/en/latest/api.html
What is angr?
angr is a suite of Python 3 libraries that let you load a binary and do a lot of cool things to it:
- Disassembly and intermediate-representation lifting
- Program instrumentation
- Symbolic execution
- Control-flow analysis
- Data-dependency analysis
- Value-set analysis (VSA)
- Decompilation
The most common angr operation is loading a binary: p = angr.Project('/bin/bash') If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the top-level-accessible methods and their docstrings.
The short version of "how to install angr" is mkvirtualenv --python=$(which python3) angr && python -m pip install angr.
Example
angr does a lot of binary analysis stuff. To get you started, here's a simple example of using symbolic execution to get a flag in a CTF challenge.
import angr
project = angr.Project("angr-doc/examples/defcamp_r100/r100", auto_load_libs=False)
@project.hook(0x400844)
def print_flag(state):
print("FLAG SHOULD BE:", state.posix.dumps(0))
project.terminate_execution()
project.execute()
Quick Start
- Install Instructions
- Documentation as HTML and sources in the angr Github repository
- Dive right in: top-level-accessible methods
- Examples using angr to solve CTF challenges.
- API Reference
- awesome-angr repo