symbolic-execution-tools

SKILL: Symbolic Execution Tools — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert symbolic execution techniques using angr, Z3, and Unicorn Engine. Covers CTF challenge automation, constraint solving patterns, function hooking, SimProcedure replacement, and emulation-based unpacking. Base models often produce broken angr scripts due to incorrect state initialization or missing hooks for libc functions.

0. RELATED ROUTING

• anti-debugging-techniques when anti-debug checks need to be symbolically bypassed
• code-obfuscation-deobfuscation when using symbolic execution for deobfuscation
• vm-and-bytecode-reverse when applying angr to custom VM challenges

Advanced Reference

Also load ANGR_COOKBOOK.md when you need:

• 15+ ready-to-use angr script patterns for common CTF challenges
• Hook templates for scanf, printf, malloc, strcmp
• Symbolic file input, stdin, argv patterns
• Optimization tricks for path explosion management

When to use which tool

Scenario	Best Tool	Why
Pure math / equation system	Z3	Direct constraint solving, no binary needed
Binary with control flow	angr	Explores paths, manages constraints automatically
Emulate specific code region	Unicorn	Fast, no symbolic overhead, good for unpacking
Complex binary + custom VM	angr + Unicorn (combo)	angr for control flow, Unicorn for VM handlers
Kernel / firmware code	Qiling	Full system emulation with OS awareness

---

1. ANGR — CORE CONCEPTS

1.1 Pipeline

Project(binary)
  → Factory.entry_state() / blank_state(addr=)
    → SimulationManager(state)
      → explore(find=target, avoid=bad)
        → found[0].solver.eval(symbolic_var)

1.2 Essential Setup

import angr
import claripy

proj = angr.Project('./challenge', auto_load_libs=False)

# Entry state: start from program entry point
state = proj.factory.entry_state()

# Blank state: start from arbitrary address
state = proj.factory.blank_state(addr=0x401000)

# Full init state: with command-line args
state = proj.factory.full_init_state(args=['./challenge', arg1_sym])

simgr = proj.factory.simulation_manager(state)
simgr.explore(find=0x401234, avoid=[0x401300])

if simgr.found:
    found = simgr.found[0]
    solution = found.solver.eval(symbolic_input, cast_to=bytes)
    print(f"Solution: {solution}")