c1951b8da0
A SLEIGH specification names its own address spaces, and most processors declare
more than one addressable space. The AIL converter recognized only `ram` and
`mem`, so a block touching any other processor space failed to convert:
* RISC-V `csrrw` reads and writes a `csreg` varnode. `_convert_varnode` raised
NotImplementedError, which the op dispatcher logs and swallows, so the
temporary the CSR was copied into was never defined and the next op died on
"Cannot find the source unique variable".
* Z80 `in`/`out` and classic BPF packet loads reach `_convert_load` and
`_convert_store` with the `io` and `packet` spaces, which tripped an assert
on the space name.
Every space a processor's specification declares is a ram_space, so treat
everything that is not `const`, `register`, `unique` or a Ghidra internal as
processor memory, and record the space it came from in a `pcode_space` tag,
since an AIL address alone cannot tell Z80 io[0x10] apart from ram[0x10].
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .github | ||
| angr | ||
| corpus_tests | ||
| docs | ||
| native | ||
| tests | ||
| .dockerignore | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| .readthedocs.yml | ||
| Cargo.lock | ||
| Cargo.toml | ||
| COPYRIGHT | ||
| LICENSE | ||
| MANIFEST.in | ||
| pyproject.toml | ||
| README.md | ||
| rust-toolchain.toml | ||
| SECURITY.md | ||
| setup.py | ||
angr
angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot.
Project Links
Homepage: https://angr.io
Project repository: https://github.com/angr/angr
Documentation: https://docs.angr.io
API Documentation: https://docs.angr.io/en/latest/api.html
What is angr?
angr is a suite of Python 3 libraries that let you load a binary and do a lot of cool things to it:
- Disassembly and intermediate-representation lifting
- Program instrumentation
- Symbolic execution
- Control-flow analysis
- Data-dependency analysis
- Value-set analysis (VSA)
- Decompilation
The most common angr operation is loading a binary: p = angr.Project('/bin/bash') If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the top-level-accessible methods and their docstrings.
The short version of "how to install angr" is mkvirtualenv --python=$(which python3) angr && python -m pip install angr.
Example
angr does a lot of binary analysis stuff. To get you started, here's a simple example of using symbolic execution to get a flag in a CTF challenge.
import angr
project = angr.Project("angr-doc/examples/defcamp_r100/r100", auto_load_libs=False)
@project.hook(0x400844)
def print_flag(state):
print("FLAG SHOULD BE:", state.posix.dumps(0))
project.terminate_execution()
project.execute()
Quick Start
- Install Instructions
- Documentation as HTML and sources in the angr Github repository
- Dive right in: top-level-accessible methods
- Examples using angr to solve CTF challenges.
- API Reference
- awesome-angr repo