What problem does it solve?
This Skill helps you recover correct inputs or bypass checks in CTF/reversing binaries by turning program behavior into solvable constraints and controllable execution traces.
Core Features & Use Cases
- Angr symbolic execution playbook: Set up entry/blank/full-init states, model symbolic stdin/argv/files/buffers, and drive
explore(find=..., avoid=...) to reach success conditions.
- Z3 constraint modeling and solving: Encode key/flag rules, XOR/linear/modular relations, and extract models to recover exact bytes.
- Unicorn emulation acceleration: Emulate specific code regions or decryption routines quickly and inspect register/memory outcomes.
- Practical failure-mode guidance: Hook problematic libc/utility functions with SimProcedures, constrain inputs to reduce path explosion, and avoid common hangs/incorrect initialization issues.
Use Case: Recover a flag by modeling scanf-read bytes as printable constraints, exploring for the branch that prints "Correct", and extracting the satisfying symbolic buffer once found.
Quick Start
Use it to produce a working angr script that targets your binary’s success output, constrains your symbolic input appropriately, and prints the recovered bytes as the final solution.
