symbolic-execution-tools
Master symbolic execution techniques to solve CTF challenges, recover keys, and bypass checks. Learn angr state initialization, constraint solving with Z3, function hooking patterns, and Unicorn Engine emulation for binary analysis and unpacking.
Symbolic Execution Tools automates CTF reversing challenges using angr, Z3, and Unicorn Engine for constraint solving.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Symbolic Execution Tools automates CTF reversing challenges using angr, Z3, and Unicorn Engine for constraint solving. Master symbolic execution techniques to solve CTF challenges, recover keys, and bypass checks. Learn angr state initialization, constraint solving with Z3, function hooking patterns, and Unicorn Engine emulation for binary analysis and unpacking.
Use it when
- symbolic-execution-tools uses angr's path exploration to systematically discover execution paths through a binary.
- symbolic-execution-tools leverages Z3 to solve constraint systems extracted during symbolic execution.
Verify before relying
Read SKILL.md below before installing (2 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/symbolic-execution-tools · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is symbolic-execution-tools and how does it help with CTF reversing?
symbolic-execution-tools is an MIT-licensed collection of techniques and frameworks for automating CTF reversing challenges. It combines angr for symbolic execution, Z3 for constraint solving, and Unicorn Engine for code emulation. These tools let you explore program paths symbolically, recover cryptographic keys, and bypass anti-debugging checks without manual reverse engineering.
How can angr symbolic execution help find and avoid specific paths?
symbolic-execution-tools uses angr's path exploration to systematically discover execution paths through a binary. You can use find() to locate paths reaching a target address and avoid() to skip paths hitting failure states. This automates the discovery process in CTF challenges, letting you focus on constraint setup rather than manual tracing.
How does symbolic-execution-tools solve constraint systems and recover keys with Z3?
symbolic-execution-tools leverages Z3 to solve constraint systems extracted during symbolic execution. Once angr collects constraints on symbolic variables—such as XOR key recovery or password validation—Z3 finds satisfying assignments. This enables automated key extraction and constraint-based challenge solving without brute force.
What role does Unicorn Engine play in symbolic-execution-tools?
symbolic-execution-tools uses Unicorn Engine for lightweight code emulation and unpacking. Unicorn executes shellcode, decrypts payloads, and emulates binary code regions without full system simulation. This is especially useful for firmware analysis and extracting obfuscated code before symbolic analysis.
How does symbolic-execution-tools manage path explosion in angr?
symbolic-execution-tools addresses path explosion through state pruning, targeted exploration with find/avoid, and SimProcedure hooks that replace expensive library functions. By reducing the state space and guiding exploration toward relevant paths, you avoid combinatorial blowup in large binaries.
Can symbolic-execution-tools bypass anti-debugging and obfuscation?
symbolic-execution-tools enables deobfuscation and anti-debug bypass via symbolic analysis. By hooking debug checks and analyzing obfuscated logic symbolically rather than executing it, you can recover the original intent without triggering anti-analysis protections. This supports firmware analysis and reversing hardened binaries.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Symbolic Execution Tools — Expert Analysis Playbook
> AI LOAD INSTRUCTION: Expert symbolic execution techniques using angr, Z3, and Unicorn Engine. Covers CTF challenge automation, constraint solving patterns, function hooking, SimProcedure replacement, and emulation-based unpacking. Base models often produce broken angr scripts due to incorrect state initialization or missing hooks for libc functions.
0. RELATED ROUTING
- anti-debugging-techniques when anti-debug checks need to be symbolically bypassed
- code-obfuscation-deobfuscation when using symbolic execution for deobfuscation
- vm-and-bytecode-reverse when applying angr to custom VM challenges
Advanced Reference
Also load ANGR_COOKBOOK.md when you need: - 15+ ready-to-use angr script patterns for common
(truncated - see the full file via the links below)
File tree — 2 files
skills/symbolic-execution-tools/ANGR_COOKBOOK.md
skills/symbolic-execution-tools/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Automate CTF reversing challenges using symbolic execution”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
ctf-reverse equips you with techniques for analyzing compiled, obfuscated, packed, and virtualized targets in CTF competitions. It covers static analysis tools like GDB and Ghidra, dynamic approaches with Frida and angr, emulation frameworks, anti-analysis bypass strategies, and language-specific reversing for Python bytecode, WASM, Android, and compiled languages. Use this when understanding the target's behavior is the blocker before exploitation.
Master techniques for analyzing and defeating code obfuscation in protected binaries. Learn to identify junk code, opaque predicates, self-modifying code, control flow flattening, movfuscator, VM protectors like VMProtect and Themida, string encryption, and import hiding. Covers both static analysis patterns and dynamic deobfuscation strategies using symbolic execution, emulation, and trace-based recovery.
Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.
This skill teaches systematic techniques for analyzing custom virtual machines and bytecode interpreters found in CTF challenges and commercial protectors. Learn to identify dispatcher patterns, map opcodes to operations, extract bytecode programs, and write custom disassemblers to understand stack-based, register-based, and esoteric VM architectures. Includes methods for solving maze-style challenges embedded in VM implementations.
Learn to exploit kernel vulnerabilities like use-after-free, out-of-bounds access, and race conditions for privilege escalation. This skill covers environment setup with QEMU, building exploitation primitives, bypassing mitigations like KASLR and SMEP, and executing kernel ROP chains to achieve root access.
Identify and solve classical ciphers encountered in CTF challenges through systematic analysis. The skill covers cipher identification via character set, frequency distribution, and index of coincidence, then applies targeted attacks for monoalphabetic substitution, Caesar/ROT variants, polyalphabetic ciphers like Vigenere, and transposition methods. Includes Kasiski examination for key-length recovery and known-plaintext techniques.