Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
angr documentation
angr documentation
  • Introduction
  • Getting Started
    • Installing angr
    • Reporting Bugs
    • Developing angr
    • Help Wanted
  • Core Concepts
    • Core Concepts
    • Loading a Binary
    • Symbolic Expressions and Constraint Solving
    • Machine State - memory, registers, and so on
    • Simulation Managers
    • Simulation and Instrumentation
    • Analyses
    • Symbolic Execution
    • A final word of advice
  • Build-in Analyses
    • Control-flow Graph Recovery (CFG)
    • Backward Slicing
    • Identifier
    • angr Decompiler
  • Advanced Topics
    • Gotchas when using angr
    • Understanding the Execution Pipeline
    • What’s Up With Mixins, Anyway?
    • Optimization considerations
    • Working with File System, Sockets, and Pipes
    • Intermediate Representation
    • Working with Data and Conventions
    • Solver Engine
    • Symbolic memory addressing
    • Java Support
    • Symbion: Interleaving symbolic and concrete execution
    • Debug variable resolution
    • Variable visibility
  • Extending angr
    • Hooks and SimProcedures
    • State Plugins
    • Extending the Environment Model
    • Writing Analyses
  • angr examples
  • Frequently Asked Questions
  • Appendix
    • Cheatsheet
    • List of Claripy Operations
    • List of State Options
    • CTF Challenge Examples
    • Changelog
    • Migrating to angr 9.1
    • Migrating to angr 8
    • Migrating to angr 7
  • API Reference
Back to top
View this page

Appendix¶

  • Cheatsheet
  • List of Claripy Operations
  • List of State Options
  • CTF Challenge Examples
  • Changelog
  • Migrating to angr 9.1
  • Migrating to angr 8
  • Migrating to angr 7
Next
Cheatsheet
Previous
Frequently Asked Questions
Copyright © 2025, The angr Project contributors
Made with Sphinx and @pradyunsg's Furo