6d45a3c53e
Follow-up to 90359a2b0, addressing code-review findings against the lowering pass itself. - LowerInsert tagged only the top-level Or with the original tags, so the generated Convert/Shl/And/Const nodes carried no ins_addr and the codegen's expression-to-address map had no entry for them. Every generated node now carries **expr.tags. - The width cutoff gated on arch.bits, which refused ordinary 64-bit Inserts on 32-bit targets even though they are plain long long arithmetic. Those reached the backend as _INSERT across the whole 32-bit family. The cutoff is now the widest C integer type. - _lower_residual_inserts discarded walk()'s return value. Handlers for nodes that cannot be rewritten in place (LoopNode above all) return a fresh node, so a replacement produced at the root was dropped and the lowering silently did not happen for it. - _lower_block built a fresh _PeepholeExprsWalker per block, rebuilding the dispatch table each time. It now reuses a cached walker, matching AILBlockSimplifier. Not addressed here: the stack-base and uninitialized-base bail-outs still let Inserts reach the C backend as _INSERT. Both defer to a rendering in _handle_Stmt_Assignment that is keyed on the assignment destination, which an expression-level peephole rule cannot see, so the fix belongs in the backend rather than in these bail-outs. Co-Authored-By: Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .github | ||
| angr | ||
| corpus_tests | ||
| docs | ||
| native | ||
| tests | ||
| .dockerignore | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| .readthedocs.yml | ||
| Cargo.lock | ||
| Cargo.toml | ||
| COPYRIGHT | ||
| LICENSE | ||
| MANIFEST.in | ||
| pyproject.toml | ||
| README.md | ||
| rust-toolchain.toml | ||
| SECURITY.md | ||
| setup.py | ||
angr
angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot.
Project Links
Homepage: https://angr.io
Project repository: https://github.com/angr/angr
Documentation: https://docs.angr.io
API Documentation: https://docs.angr.io/en/latest/api.html
What is angr?
angr is a suite of Python 3 libraries that let you load a binary and do a lot of cool things to it:
- Disassembly and intermediate-representation lifting
- Program instrumentation
- Symbolic execution
- Control-flow analysis
- Data-dependency analysis
- Value-set analysis (VSA)
- Decompilation
The most common angr operation is loading a binary: p = angr.Project('/bin/bash') If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the top-level-accessible methods and their docstrings.
The short version of "how to install angr" is mkvirtualenv --python=$(which python3) angr && python -m pip install angr.
Example
angr does a lot of binary analysis stuff. To get you started, here's a simple example of using symbolic execution to get a flag in a CTF challenge.
import angr
project = angr.Project("angr-doc/examples/defcamp_r100/r100", auto_load_libs=False)
@project.hook(0x400844)
def print_flag(state):
print("FLAG SHOULD BE:", state.posix.dumps(0))
project.terminate_execution()
project.execute()
Quick Start
- Install Instructions
- Documentation as HTML and sources in the angr Github repository
- Dive right in: top-level-accessible methods
- Examples using angr to solve CTF challenges.
- API Reference
- awesome-angr repo