AwesomeREA.org

Tool

AngryGhidra

Ghidra extension that runs angr symbolic execution from a CodeBrowser panel. The analyst marks a destination address, an optional start address and addresses to avoid with hotkeys, and can make program arguments, memory ranges or registers symbolic, write concrete values into memory and registers, hook instructions or apply bytes patched in Ghidra to the angr project. A bundled Python script runs angr's explorer on the program's original file, the listing highlights the instructions along the path it finds, and the panel shows the argument, memory and stdin values that reach the destination.

Requirements & limits

  • Latest release at review: 1.1, published 2024-02-13, with prebuilt extension archives for Ghidra 11.0 and 11.0.1; the older 0.1 release carries builds for Ghidra 9.1.2 through 10.3. The reviewed master commit of 2024-07-29 is two commits later, changing the plugin type and the README. Compatibility with newer Ghidra releases is not stated.
  • Install angr with pip for Python 3 and put python3 on the PATH; the plugin starts the bundled angryghidra.py as an external process and passes the analyst's settings through a temporary angr_options.json file. No angr version is pinned. Building from source uses Gradle with GHIDRA_INSTALL_DIR, followed by File → Install Extensions in Ghidra; if no new-plugin prompt appears, enable AngryGhidraPlugin under File → Configure → Miscellaneous.
  • angr loads the binary from the path Ghidra recorded at import, so the original file must still be there; raw binaries are loaded as blobs with the architecture of the Ghidra language. The analyst supplies the binary and chooses the find, avoid, hook and symbolic-input settings. Path explosion, unmodeled environment behavior and solver limits remain angr's, and a found path gives one satisfying input rather than a proof about the program.
  • The README demonstrates it on the SecurityFest 2016 fairlight CTF challenge from angr's examples; no other results or tests are published. MIT license. Neither the extension nor angr was run for this entry.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Nalen98/AngryGhidra · Revision 0e6dc9c
  2. angryghidra_script/angryghidra.py GitHub · Nalen98/AngryGhidra · Revision 0e6dc9c
  3. src/main/java/angryghidra/AngrProcessing.java GitHub · Nalen98/AngryGhidra · Revision 0e6dc9c
  4. src/main/java/angryghidra/AngryGhidraProvider.java GitHub · Nalen98/AngryGhidra · Revision 0e6dc9c
  5. build.gradle GitHub · Nalen98/AngryGhidra · Revision 0e6dc9c
  6. extension.properties GitHub · Nalen98/AngryGhidra · Revision 0e6dc9c
  7. LICENSE.md GitHub · Nalen98/AngryGhidra · Revision 0e6dc9c
  8. https://github.com/Nalen98/AngryGhidra/releases/tag/1.1
  9. https://github.com/Nalen98/AngryGhidra/releases/tag/0.1

More in Native binaries

All 114 entries in Native binaries