symbolic-execution-tools

Create an angr.Project with auto_load_libs=False, build an entry_state with a symbolic claripy bitvector as stdin, constrain bytes to printable ASCII, then call simgr.explore with find and avoid addresses. Extract the solution with found[0].solver.eval on the symbolic variable.

Use Z3 for pure math or equation systems without a binary, angr for binaries with control flow that need path exploration, and Unicorn for fast emulation of specific code regions like decryption routines. Combine angr with Unicorn for mostly-concrete execution paths.

For argv, use full_init_state with a claripy bitvector in the args list. For file input, create an angr.SimFile with symbolic content and pass it through the fs parameter of entry_state. Both patterns are covered in the cookbook recipes.

Path explosion from loops or many conditional branches is the usual cause. Add avoid addresses for dead ends, constrain the input space, hook complex functions with SimProcedures, or switch to DFS or Veritesting exploration techniques.

Define a custom angr.SimProcedure subclass implementing run(), then register it with proj.hook_symbol for the target function name. You can also hook by address with @proj.hook(addr, length=N) to skip or replace specific code blocks.

Avoid it when binaries have unbounded symbolic memory reads, heavy non-linear constraints that make Z3 return unknown, or kernel and firmware code requiring full OS awareness. In those cases use Qiling for system emulation or manual debugger-based analysis.