e272212d6f
A linker's function-start table is the only record of where a stripped image's functions begin, and CFGFast had no use for one. Fed in unfiltered it is worse than nothing: ld64 records the address of every atom it placed in an executable section, so a Haskell closure's info table and a Swift offset table are entries beside the functions, and seeding those puts function heads on data. Consume FunctionHintSource.FUNCTION_STARTS hints the way the .eh_frame ones are consumed -- after the worklist drains, skipping an address already decoded -- with one added test: the bytes at the address have to be a range something enters as code. The decode runs over the distance to the next recorded address, which is not a size and is never used as one, and stops where a real decoder would: at a byte capstone refuses, at a word it names undefined, and at an instruction encoded entirely in zero bytes, which is what a table is padded and filled with. The range is code if the decode reaches an instruction after which control does not fall through, or consumes the extent without one of those stops. Neither half of that is sufficient alone -- an info table decodes as x86 arithmetic to the end of a range it fits exactly, and an AArch64 function ending in a call that does not return reaches no terminator. An architecture whose terminators are not established here gets no hints at all, rather than a decision made with another architecture's set. |
||
|---|---|---|
| .github | ||
| angr | ||
| corpus_tests | ||
| docs | ||
| native | ||
| tests | ||
| .dockerignore | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| .readthedocs.yml | ||
| Cargo.lock | ||
| Cargo.toml | ||
| COPYRIGHT | ||
| LICENSE | ||
| MANIFEST.in | ||
| pyproject.toml | ||
| README.md | ||
| rust-toolchain.toml | ||
| SECURITY.md | ||
| setup.py | ||
angr
angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot.
Project Links
Homepage: https://angr.io
Project repository: https://github.com/angr/angr
Documentation: https://docs.angr.io
API Documentation: https://docs.angr.io/en/latest/api.html
What is angr?
angr is a suite of Python 3 libraries that let you load a binary and do a lot of cool things to it:
- Disassembly and intermediate-representation lifting
- Program instrumentation
- Symbolic execution
- Control-flow analysis
- Data-dependency analysis
- Value-set analysis (VSA)
- Decompilation
The most common angr operation is loading a binary: p = angr.Project('/bin/bash') If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the top-level-accessible methods and their docstrings.
The short version of "how to install angr" is mkvirtualenv --python=$(which python3) angr && python -m pip install angr.
Example
angr does a lot of binary analysis stuff. To get you started, here's a simple example of using symbolic execution to get a flag in a CTF challenge.
import angr
project = angr.Project("angr-doc/examples/defcamp_r100/r100", auto_load_libs=False)
@project.hook(0x400844)
def print_flag(state):
print("FLAG SHOULD BE:", state.posix.dumps(0))
project.terminate_execution()
project.execute()
Quick Start
- Install Instructions
- Documentation as HTML and sources in the angr Github repository
- Dive right in: top-level-accessible methods
- Examples using angr to solve CTF challenges.
- API Reference
- awesome-angr repo