angr
Star9.2k

// open-source binary analysis

Demystify binaries.

angr is a powerful Python platform for analyzing binaries, combining decompilation, symbolic execution, and more into one scriptable toolkit.

Install angr View on GitHub
BSD
licensed
8+
guest architectures
1
pip install away
fauxware (C) — angr
angr decompile fauxware --functions main authenticate rejected accepted
int main(unsigned int a0, unsigned long long a1)
{
    unsigned long long v0;  // [bp-0x48]
    unsigned int v1;  // [bp-0x3c]
    char v2;  // [bp-0x2c], Other Possible Types: unsigned int
    char v3;  // [bp-0x28]
    char v4;  // [bp-0x20]
    char v5;  // [bp-0x18]
    char v6;  // [bp-0x10]

    v1 = a0;
    v0 = a1;
    v6 = 0;
    v4 = 0;
    puts("Username: ");
    read(0, &v5, 8);
    read(0, &v2, 1);
    puts("Password: ");
    read(0, &v3, 8);
    read(0, &v2, 1);
    v2 = authenticate(&v5, &v3, &v3);
    if (!v2)
        rejected(); /* do not return */
    return accepted();
}

extern char *sneaky;

unsigned int authenticate(char *a0, char *a1)
{
    unsigned int v5;  // edx
    char v0[8];  // [bp-0x18]
    char v1;  // [bp-0x10]
    unsigned int v2;  // [bp-0xc]

    v1 = 0;
    if (strcmp(a1, sneaky))
    {
        v2 = open(a0, 0, v5);
        read(v2, v0, 8);
        return (!strcmp(a1, v0) ? 1 : 0);
    }
    return 1;
}

void rejected(void)
{
    printf("Go away!");
    exit(1); /* do not return */
}

void accepted(void)
{
    puts("Welcome to the admin console, trusted user!");
    return;
}
angr decompile fauxware --functions main authenticate rejected accepted
Interface
Written in
Analysis

// the toolkit

Your new swiss army knife

angr provides static and dynamic techniques in a single library. Mix and match to solve your problems.

  • Symbolic Execution

    A powerful concolic engine: explore every path at once, solve constraints, and reason about inputs that reach any state.

  • Decompilation

    Lift machine code to angr's AIL and recover readable pseudocode as C or Rust.

  • CFG Recovery

    Reconstruct control-flow graphs and call graphs with advanced static analyses, even on stripped and obfuscated targets.

  • Disassembly & Lifting

    Disassemble and lift to AIL, the angr intermediate language, giving every architecture one uniform analysis surface.

  • Multi-Architecture

    x86 / x86-64, ARM & AArch64, MIPS, PowerPC, and more — any host can analyze any guest.

  • Extensible by Design

    Hook anything, register custom analyses, SimProcedures, and exploration techniques. If you can script it in Python, angr can run it.

  • Pythonic API

    A clean, scriptable Python interface. Drop into a REPL, wire angr into your tooling, or build something entirely new on top.

  • Free & Open Source

    Released under the permissive BSD license and developed in the open. Battle-tested in research, CTFs, and the DARPA CGC.

// get started

Up and running in seconds

angr is a Python 3.12+ package. Install it into a virtual environment and you're ready to analyze. Works on Linux, macOS, and Windows.

Install guide Documentation
$ pip install angr

# then import angr and go

// angr-management

A full GUI, powered by angr

Prefer to point and click? angr-management is the official graphical interface. Control the whole platform, made visual and interactive. Disassemble, decompile to C or Rust, patch, and explore, all without leaving the window. It runs natively on Linux, macOS, and Windows.

  • Customizable decompilation to C or Rust
  • Linear and graph-based disassembly
  • Hex editor and interactive binary patching
  • Plugins, scripting, and more...
Get angr-management
fauxware — angr management
angr-management showing a disassembly view alongside a hex view and recovered strings
angr-management showing decompiled C pseudocode beside a control-flow graph with selectable optimization passes
Disassembly, hex & strings

// model context protocol

angr for your AI assistant

angr ships an MCP server, so assistants like Claude can drive it directly — loading binaries, recovering control-flow graphs, decompiling functions, and chasing xrefs. It's not just a natural language control interface, it's a meaningful expansion to your toolkit. And that's special.

angr — mcp
# expose angr over MCP (stdio — for Claude Desktop, etc.)
$ python -m angr.mcp

# ...or over HTTP / SSE for remote clients
$ python -m angr.mcp --transport http

Tools it exposes

  • Decompilation
  • Control-flow graphs
  • Disassembly
  • Cross-references
  • Strings
  • Imports & exports
  • Call graphs
  • Function search

Works with any MCP client. Point yours at the server and ask it to reverse a binary.

// modular design

The Power of Composition

angr is built from focused subprojects, each one usable on its own. Take the whole stack, or just the piece you need.

// join in

With and For Our Community

angr is developed by researchers and hackers around the world. Ask questions, share what you've built, or send your first pull request. Find community and make a difference!

Chat on Discord Contribute on GitHub

// professional support

angr, backed by its core team

Emotion Labs is the company behind angr. We, the same maintainers who build it, offer support, development, and training to put binary analysis to work for your team.

Visit Emotion Labs

  • Support

    Expert help and maintenance from the humans behind angr.

  • Development

    Custom analyses, features, and integrations built on top of angr.

  • Training

    Hands-on courses in binary analysis and reverse engineering.