angr is a python framework for analyzing binaries. It focuses on both static and dynamic symbolic ("concolic") analysis, making it applicable to a variety of tasks.
As an introduction to angr's capabilities, here is a brief code example that analyzes a fake backdoored firmware image to perform control-flow analysis and find the backdoor via symbolic execution:
If you have used angr or its sub-components in research, please cite the paper describing it:
@inproceedings{shoshitaishvili2016state,
title={{SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis}},
author={Shoshitaishvili, Yan and Wang, Ruoyu and Salls, Christopher and
Stephens, Nick and Polino, Mario and Dutcher, Andrew and Grosen, John and
Feng, Siji and Hauser, Christophe and Kruegel, Christopher and Vigna, Giovanni},
booktitle={IEEE Symposium on Security and Privacy},
year={2016}
}
Additionally, the angr authors have used angr in the following publications:
@inproceedings{stephens2016driller,
title={{Driller: Augmenting Fuzzing Through Selective Symbolic Execution}},
author={Stephens, Nick and Grosen, John and Salls, Christopher and Dutcher, Andrew and
Wang, Ruoyu and Corbetta, Jacopo and Shoshitaishvili, Yan and
Kruegel, Christopher and Vigna, Giovanni},
booktitle={Proceedings of the 2016 Network and Distributed System Security Symposium},
year={2016}
}
@inproceedings{shoshitaishvili2015firmalice,
title={{Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities
in Binary Firmware}},
author={Shoshitaishvili, Yan and Wang, Ruoyu and Hauser, Christophe and
Kruegel, Christopher and Vigna, Giovanni},
booktitle={Proceedings of the 2015 Network and Distributed System Security Symposium},
year={2015}
}
Finally, angr (or its subcomponents) have been used in many other academic works:
@article{parvez2016combining,
title={{Combining Static Analysis and Targeted Symbolic Execution for Scalable
Bug-finding in Application Binaries}},
author={Parvez, Muhammad Riyad},
year={2016},
publisher={University of Waterloo}
}
@inproceedings{pewny2015cross,
title={{Cross-Architecture Bug Search in Binary Executables}},
author={Pewny, Jannik and Garmany, Behrad and Gawlik, Robert and Rossow, Christian
and Holz, Thorsten},
booktitle={Security and Privacy (SP), 2015 IEEE Symposium on},
pages={709--724},
year={2015},
organization={IEEE}
}
@inproceedings{vogl2014dynamic,
title={{Dynamic hooks: hiding control flow changes within non-control data}},
author={Vogl, Sebastian and Gawlik, Robert and Garmany, Behrad and Kittel, Thomas
and Pfoh, Jonas and Eckert, Claudia and Holz, Thorsten},
booktitle={23rd USENIX Security Symposium (USENIX Security 14)},
pages={813--328},
year={2014}
}
And non-academically?
angr was one of the underpinnings of Shellphish's Cyber Reasoning System for the DARPA Cyber Grand Challenge, enabling them to win third place in the final round! Shellphish has also used angr in many CTFs.
