$ show angr/angr
angr is a platform-agnostic binary analysis framework developed by the Shellphish research group at UC Santa Barbara. It provides a comprehensive suite of program analysis capabilities including disassembly and IR lifting (via VEX), control-flow graph construction (CFG fast/emulated), symbolic execution, data-dependency analysis, value-set analysis, and a full decompiler pipeline that produces C-like pseudocode. The framework supports multiple architectures (x86, ARM, MIPS, PowerPC, etc.) and operating systems (Linux, Windows, CGC, FreeBSD, Java VM, UEFI) through a modular SimOS layer and extensive library procedure models (libc, POSIX, Linux kernel, Windows API, C++ stdlib, Java/JNI). The architecture is built around a mixin-based engine composition pattern, where execution engines (VEX, AIL, Soot, Pcode, unicorn) are combined into an UberEngine. Analyses are registered via an AnalysesHub and instantiated as project.analyses.Name. A knowledge-base plugin system stores functions, variables, types, cross-references, and other analysis results. The decompiler is particularly sophisticated, with dozens of optimization passes, peephole optimizations, region simplifiers, and multiple structuring algorithms (SAILR, Phoenix, Dream). Native Rust components (clarirs-core, clarirs-vsa, clarirs-z3) provide high-performance symbolic reasoning and solver integration. Key entry points include angr.Project for loading binaries, project.factory for block/engine creation, project.analyses for running analyses, and simulation_manager for symbolic execution. The framework also includes an MCP server for LLM integration, a distributed analysis framework, and database persistence via AngrDB. External dependencies include claripy (solver abstraction), cle (binary loader), pyvex (VEX IR), capstone/keystone (disassembly/assembly), unicorn (concrete execution), and Z3 (SMT solver).
The LLM identified 6 files worth highlighting for reuse:
Base class for all exploration techniques in angr's simulation manager. Provides a clean hook-based interface (setup, step_state, filter, successors, etc.) that allows customizing symbolic execution behavior. The pattern is reusable for any state-space search problem: define hooks that are called at specific points in the exploration loop, with a simple registration mechanism. Demonstrates the Template Method pattern with sensible defaults.
Base class for all knowledge-base plugins in angr. Provides a lightweight plugin system with automatic registration via register_default, copy/merge semantics, and integration with the project's knowledge base. The pattern is reusable for any system that needs extensible, typed storage of analysis results. Demonstrates a clean plugin architecture with minimal boilerplate.
Base classes for peephole optimizations in the decompiler (PeepholeOptimizationExprBase, PeepholeOptimizationStmtBase). Each optimization is a class with a NAME, a list of expression/statement classes to match, and an optimize method. The framework automatically applies all registered optimizations in a fixed-point loop. This pattern is reusable for any tree-rewriting system where small, composable transformations are applied to an AST. Demonstrates the Visitor pattern combined with a registry.
An efficient data structure for mapping intervals to tags, supporting insert, delete, and query operations. Uses a sorted list of intervals with binary search for O(log n) lookups. The implementation handles interval merging, splitting, and tag deduplication. This is a self-contained utility that can be extracted for any project needing interval-based tagging (e.g., address ranges, time intervals). Demonstrates careful algorithmic design with clear documentation.
A generic framework for forward data-flow analysis. Provides a base class that handles worklist iteration, state merging, and termination detection. Subclasses implement transfer functions and join operations. The framework is parameterized by the graph type (call graph, function graph, loop) and supports multiple visitors. This pattern is reusable for any monotone data-flow analysis (e.g., reaching definitions, constant propagation, liveness). Demonstrates a clean separation of analysis logic from iteration strategy.
Provides AILBlockWalker, AILBlockViewer, and AILBlockRewriter classes for traversing and transforming AIL (angr Intermediate Language) blocks. The walker visits all expressions and statements in a block, calling handler methods for each node type. The rewriter extends the walker to allow in-place modification. This pattern is reusable for any AST traversal and transformation task, and is used extensively in the decompiler's optimization passes. Demonstrates the Visitor pattern with support for both read-only and rewriting modes.