DYNAMIC BINARY
ANALYSIS USING
ANGR
Presented by :
Siddharth M
Cysinfo Meetup - July ‘17
1

About me
●Siddharth M ( @tr3x)
●2nd Year BTech CSE student at Amrita
University
●Member of team bi0s
●Focusing on Reverse Engineering
2

www.ctftime.org3

Outline
●What is Binary Analysis ?
●Introduction to Angr
●Various uses of Angr
●Symbolic Execution
●Using Angr to perform SE
●Hooking
●Using Angr to perform Hooking
4

“ Process of analysing an
executable to gain a better
idea of its working is called
Binary analysis
5

Why do we need to Automate it?
●Save a lot of time and effort
●Avoid human error
●Cost - effective
●Boring
●All factors accounted for
6

Angr
●Shellphish’s entry for DARPA’s CGC - came 3rd
●Python based framework
●Open Source
●Can detect and exploit vulnerabilities
Installation instructions at angr.io
www.angr.io7

Various uses of Angr
●Control Flow Graph recovery
●Symbolic Execution
●ROP chain generation
●Binary Hardening
●Exploit Generation
8

Symbolic Execution
Analysing a program to determine the input/inputs
to be given to make each part of the program to
execute.
9

www.shellstorm.org
10

Angr and Symbolic Execution
● Symbolic variables
● Finds paths that are important
● Makes constrains related to the variable
● Solves those constraints using z3
11

Demo
Challenge : unbreakable-enterprise
Google CTF 2016
12

Hooking
Hooking is a technique used while reverse
engineering where certain instructions/calls are
replaced with custom made functions and calls.
13

Hooking is used for
●Faster Reverse Engineering
●Tracing function calls
●Parameter checking
●Logging
14

Demo 2
15

Summary
●Angr uses symbolic variables and constraints to
find out more about executable.
●Angr can hook functions
●Paths , Path groups
●States - entry state , blank state
●explore - find, avoid
●se - solver engine
● Claripy
●Library functions
16