What problem does it solve?
Symbolic execution often turns CTF binaries into unsolved puzzles because you must correctly model inputs, memory state, and failure/success conditions to automatically recover secrets like flags or keys.
Core Features & Use Cases
- Angr playbook for input modeling and state setup: Use entry/blank/full-init states, symbolic stdin/argv, and memory stores to model the exact way a challenge reads data.
- Z3 constraint solving patterns: Translate validation logic into solvable constraints (bit-vectors, boolean logic, XOR, modular arithmetic) and extract concrete solutions.
- Unicorn Engine emulation for speed and unpacking: Emulate specific routines/regions to quickly deobfuscate or analyze code paths with less symbolic overhead.
Use case: Recover a flag from a stripped crackme where success/failure strings appear only after complex checks by combining angr exploration with careful hooking of libc calls and then extracting the symbolic input with solver evaluation.
Quick Start
Ask the AI to produce an angr script that models the challenge’s actual input method (stdin/argv/file), hooks any libc functions that break analysis, and uses find/avoid addresses (or output predicates) to recover the correct flag bytes.
