Symbolic Execution Tools

# angr Cookbook — Ready-to-Use Script Patterns for CTF Challenges

> **AI LOAD INSTRUCTION**: Load this when you need drop-in angr script templates for common CTF challenge patterns. Each recipe includes the scenario description, complete script, and adaptation notes. Assumes the main [SKILL.md](./SKILL.md) is already loaded for angr fundamentals.

---

## Recipe 1: Basic find/avoid by Address

**Scenario**: Binary prints "Correct" at 0x401234, "Wrong" at 0x401300. Input via stdin.

```python
import angr

proj = angr.Project('./challenge', auto_load_libs=False)
state = proj.factory.entry_state()
simgr = proj.factory.simulation_manager(state)

simgr.explore(find=0x401234, avoid=[0x401300])

if simgr.found:
    print(simgr.found[0].posix.dumps(0))  # fd 0 = stdin
```

---

## Recipe 2: Find by stdout Content

**Scenario**: Success/failure messages not at fixed addresses (PIE binary or indirect calls).

```python
import angr

proj = angr.Project('./challenge', auto_load_libs=False)
state = proj.factory.entry_state()
simgr = proj.factory.simulation_manager(state)

simgr.explore(
    find=lambda s: b"Correct" in s.posix.dumps(1),
    avoid=lambda s: b"Wrong" in s.posix.dumps(1)
)

if simgr.found:
    print(simgr.found[0].posix.dumps(0))
```

---

## Recipe 3: Symbolic stdin with Printable Constraint

**Scenario**: Flag is 32 printable characters read via scanf/fgets.

```python
import angr
import claripy

proj = angr.Project('./challenge', auto_load_libs=False)

FLAG_LEN = 32
flag = claripy.BVS("flag", 8 * FLAG_LEN)

state = proj.factory.entry_state(stdin=flag)

for i in range(FLAG_LEN):
    byte = flag.get_byte(i)
    state.solver.add(byte >= 0x20)
    state.solver.add(byte <= 0x7e)

simgr = proj.factory.simulation_manager(state)
simgr.explore(find=0x401234, avoid=[0x401300])

if simgr.found:
    solution = simgr.found[0].solver.eval(flag, cast_to=bytes)
    print(f"Flag: {solution}")
```

---

## Recipe 4: Symbolic argv

**Scenario**: Binary takes flag as command-line argument `./challenge FLAG`.

```python
import angr
import claripy

proj = angr.Project('./challenge', auto_load_libs=False)

flag = claripy.BVS("flag", 8 * 32)
state = proj.factory.full_init_state(
    args=['./challenge', flag],
    add_options=angr.options.unicorn
)

for i in range(32):
    b = flag.get_byte(i)
    state.solver.add(b >= 0x20, b <= 0x7e)

simgr = proj.factory.simulation_manager(state)
simgr.explore(find=0x401234, avoid=[0x401300])

if simgr.found:
    print(simgr.found[0].solver.eval(flag, cast_to=bytes))
```

---

## Recipe 5: Symbolic File Input

**Scenario**: Binary reads flag from a file.

```python
import angr
import claripy

proj = angr.Project('./challenge', auto_load_libs=False)

flag = claripy.BVS("flag", 8 * 64)
sim_file = angr.SimFile("flag.txt", content=flag)

state = proj.factory.entry_state(fs={'/tmp/flag.txt': sim_file})

simgr = proj.factory.simulation_manager(state)
simgr.explore(find=0x401234, avoid=[0x401300])

if simgr.found:
    print(simgr.found[0].solver.eval(flag, cast_to=bytes))
```

---

## Recipe 6: Hook scanf

**Scenario**: Custom scanf that angr's default SimProcedure handles incorrectly.

```python
import angr
import claripy

class MyScanf(angr.SimProcedure):
    def run(self, fmt, ptr):
        buf = claripy.BVS("scanf_input", 8 * 32)
        self.state.memory.store(ptr, buf)
        self.state.globals['scanf_buf'] = buf
        return 1

proj = angr.Project('./challenge', auto_load_libs=False)
proj.hook_symbol('__isoc99_scanf', MyScanf())

state = proj.factory.entry_state()
simgr = proj.factory.simulation_manager(state)
simgr.explore(find=0x401234, avoid=[0x401300])

if simgr.found:
    found = simgr.found[0]
    buf = found.globals['scanf_buf']
    print(found.solver.eval(buf, cast_to=bytes))
```

---

## Recipe 7: Hook strcmp to Leak Expected Value

**Scenario**: Binary compares input against computed value. Hook strcmp to extract the expected string.

```python
import angr
import claripy

class LeakStrcmp(angr.Si