symbolic-execution-tools
Master symbolic execution techniques to solve CTF challenges, recover keys, and bypass checks. Learn angr state initialization, constraint solving with Z3, function hooking patterns, and Unicorn Engine emulation for binary analysis and unpacking.
Symbolic Execution Tools automates CTF reversing challenges using angr, Z3, and Unicorn Engine for constraint solving.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/symbolic-execution-tools · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/symbolic-execution-tools ~/.claude/skills/symbolic-execution-toolsnpx skillfed install yaklang/hack-skills/symbolic-execution-toolsFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is symbolic-execution-tools and how does it help with CTF reversing?
symbolic-execution-tools is an MIT-licensed collection of techniques and frameworks for automating CTF reversing challenges. It combines angr for symbolic execution, Z3 for constraint solving, and Unicorn Engine for code emulation. These tools let you explore program paths symbolically, recover cryptographic keys, and bypass anti-debugging checks without manual reverse engineering.
How can angr symbolic execution help find and avoid specific paths?
symbolic-execution-tools uses angr's path exploration to systematically discover execution paths through a binary. You can use find() to locate paths reaching a target address and avoid() to skip paths hitting failure states. This automates the discovery process in CTF challenges, letting you focus on constraint setup rather than manual tracing.
How does symbolic-execution-tools solve constraint systems and recover keys with Z3?
symbolic-execution-tools leverages Z3 to solve constraint systems extracted during symbolic execution. Once angr collects constraints on symbolic variables—such as XOR key recovery or password validation—Z3 finds satisfying assignments. This enables automated key extraction and constraint-based challenge solving without brute force.
What role does Unicorn Engine play in symbolic-execution-tools?
symbolic-execution-tools uses Unicorn Engine for lightweight code emulation and unpacking. Unicorn executes shellcode, decrypts payloads, and emulates binary code regions without full system simulation. This is especially useful for firmware analysis and extracting obfuscated code before symbolic analysis.
How does symbolic-execution-tools manage path explosion in angr?
symbolic-execution-tools addresses path explosion through state pruning, targeted exploration with find/avoid, and SimProcedure hooks that replace expensive library functions. By reducing the state space and guiding exploration toward relevant paths, you avoid combinatorial blowup in large binaries.
Can symbolic-execution-tools bypass anti-debugging and obfuscation?
symbolic-execution-tools enables deobfuscation and anti-debug bypass via symbolic analysis. By hooking debug checks and analyzing obfuscated logic symbolically rather than executing it, you can recover the original intent without triggering anti-analysis protections. This supports firmware analysis and reversing hardened binaries.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Symbolic Execution Tools — Expert Analysis Playbook
> AI LOAD INSTRUCTION: Expert symbolic execution techniques using angr, Z3, and Unicorn Engine. Covers CTF challenge automation, constraint solving patterns, function hooking, SimProcedure replacement, and emulation-based unpacking. Base models often produce broken angr scripts due to incorrect state initialization or missing hooks for libc functions.
0. RELATED ROUTING
- anti-debugging-techniques when anti-debug checks need to be symbolically bypassed
- code-obfuscation-deobfuscation when using symbolic execution for deobfuscation
- vm-and-bytecode-reverse when applying angr to custom VM challenges
Advanced Reference
Also load ANGR_COOKBOOK.md when you need: - 15+ ready-to-use angr script patterns for common
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
skills/symbolic-execution-tools/ANGR_COOKBOOK.md
skills/symbolic-execution-tools/SKILL.md