Debugging - angr Management

angr Management provides powerful debugging capabilities that combine traditional debugging with symbolic execution, allowing you to analyze both concrete and symbolic program states.

Debugging Modes

angr Management supports multiple debugging approaches:

Symbolic Execution
Trace Replay
Concrete Execution

Explore program paths symbolically

Create symbolic states
Set find/avoid addresses
Explore multiple paths simultaneously
Solve for inputs that reach targets

Best for: Finding inputs, vulnerability discovery, path exploration

Breakpoints

Breakpoint Types

angr Management supports three types of breakpoints:

Execution

Break when instruction is executed

Read

Break when memory is read

Write

Break when memory is written

Setting Breakpoints

In Disassembly
In Hex View
Breakpoints View
Via Console

Quick method:

Click on instruction
Press F2
Breakpoint toggles on/off

Or right-click:

Right-click instruction
Select “Toggle Breakpoint”
Choose breakpoint type

# Execution breakpoint
workspace.add_breakpoint(0x401000)

# Read breakpoint on global_var (8 bytes)
workspace.add_breakpoint('global_var', 'read', 8)

# Write breakpoint
workspace.add_breakpoint(0x404000, 'write', 4)

Managing Breakpoints

In the Breakpoints View (View → Breakpoints):

View All

See all breakpoints in a table with type, address, size, and comments

Edit

Double-click a breakpoint to modify its properties

Delete

Right-click → “Remove breakpoint” or select and press Delete

Enable/Disable

Toggle breakpoints without removing them

Breakpoint Visualization

Breakpoints are shown throughout the interface:

Disassembly: Red dot next to instruction
Hex View: Cyan highlight over address range
Breakpoints View: Complete list with details

Execution Control

Control program execution with these commands:

Action	Shortcut	Description
Continue	`F9`	Run until next breakpoint
Step Forward	`F7`	Execute one instruction
Step Over	`F8`	Step over function calls
Run to Cursor	Right-click → Run to Here	Execute until cursor position

Execution control is available when a debugger is active (symbolic or trace-based).

Symbolic Execution

Creating Symbolic States

Open Dialog

Right-click in disassembly → “New State”
Or use View → States

Configure State

Starting address (default: current instruction)
Input configuration (stdin, files, arguments)
Environment variables
Memory initialization

Create

Click “Create” to generate the symbolic state

Execute

State appears in Symbolic Execution view, ready to explore

Find/Avoid Addresses

Guide symbolic execution to desired locations:

Find Addresses
Avoid Addresses

Addresses you want to reach:

Right-click target instruction
Select “Set as Find Address”
Green marker appears
Symbolic execution prioritizes paths to this address

Programmatic:

workspace.add_find_address(0x401234)

Addresses to skip:

Right-click unwanted instruction
Select “Set as Avoid Address”
Red marker appears
Symbolic execution avoids these paths

Programmatic:

workspace.add_avoid_address(0x401500)

Symbolic Execution View

The Symbolic Execution view (View → Symbolic Execution) shows:

Simulation Managers

Active simulation managers
State organization (active, found, avoided, etc.)
State counts for each category

State Tree

Hierarchical view of states
Parent-child relationships
State divergence points

Execution Control

Step states forward
Explore paths
Merge states
Drop unwanted states

State Inspection

Registers View

View → Registers shows current CPU register values:

Display

All architecture registers
Current values (hex and decimal)
Changed values highlighted
Symbolic expressions shown

Modification

Double-click to edit
Set concrete values
View constraints on symbolic values

Stack View

View → Stack displays the current stack:

Stack pointer location
Return addresses
Local variables
Stack frame boundaries
Scroll to explore stack

Features:

Click addresses to navigate
Highlight stack frames
Show ASCII representation
Export stack contents

Memory Inspection

Use the Hex View (View → Hex) to inspect memory:

Enter address or symbol name
View bytes and ASCII representation
Edit values directly
See highlighted regions for:
- Breakpoints
- Patches
- Modified data

Constraint Viewer

For symbolic states, view constraints:

Select state in States view
Right-click → “View Constraints”
See all path constraints
Solve for satisfying values

Trace Debugging

Loading Traces

Open Trace

File → Load a new trace

Select File

Choose bintrace (.trace) file

Create Debugger

angr creates a trace debugger automatically

Navigate

Step through the recorded execution

Trace Map View

View → Trace Map shows execution coverage:

Visualization

Heat map of executed code
Color intensity shows execution frequency
Identify hot paths and loops

Navigation

Click to jump to code
Zoom and pan
Filter by execution count

Comparing Traces

Load multiple traces to compare:

Load first trace
Load second trace
Switch between traces in Traces view
Use Trace Map to visualize differences

Debugging Workflows

Finding Crash Inputs

Load Binary

Open the crashing binary

Create Symbolic State

Create state with symbolic input at entry point

Set Avoid

Mark the crash location as “avoid” address

Explore

Run symbolic execution

Check States

States that reach “avoided” addresses may trigger crash

Get Input

Solve for concrete input values from the state

Analyzing Function Behavior

Navigate

Jump to function start in disassembly

Set Breakpoint

Press F2 on first instruction

Create State

Right-click → “New State” with symbolic arguments

Set Find

Mark return instruction as “find” address

Execute

Step through or continue to see different paths

Inspect

Examine return values and constraints

Debugging Patches

Apply Patch

Modify code in disassembly view

Set Breakpoint

Break before patched code

Create State

New state at breakpoint

Step Through

Single-step through patched code

Verify

Check registers and memory for expected behavior

Advanced Debugging

Hooks

Intercept execution at specific addresses:

Creating Hooks

Right-click instruction → “Hook”
Enter Python code to execute
Access state via state variable
Return value controls execution flow

Example:

# Log function calls
print(f"Called at {hex(state.addr)}")
print(f"First arg: {state.regs.rdi}")

Simulation Manager Control

Advanced state management via console:

# Access simulation manager
simgr = workspace.main_instance.simgrs[0].am_obj

# Step all active states
simgr.step()

# Move states between stashes
simgr.move('active', 'found', lambda s: s.addr == 0x401234)

# Merge states
simgr.merge()

# Explore with constraints
simgr.explore(find=0x401234, avoid=[0x401500, 0x401600])

State Hierarchy

View state relationships:

Open States view
See parent-child relationships
Understand where states diverged
Track constraint additions

Debugging Tips

Performance

Speed up symbolic execution:

Use concrete values where possible
Set find/avoid addresses early
Limit exploration depth
Drop unreachable states
Enable state merging

Accuracy

Improve results:

Use accurate calling conventions
Define function signatures
Initialize memory correctly
Model library functions
Add constraints based on knowledge

Troubleshooting

Breakpoint Not Hit

Possible causes:

Code never executes
Wrong address
Breakpoint disabled

Solutions:

Verify code path in disassembly
Check Breakpoints view for status
Ensure debugger is active

Too Many States

Symbolic execution explodes:Solutions:

Set find/avoid addresses
Reduce symbolic input size
Use concrete values for some inputs
Enable aggressive state merging
Limit exploration depth

Solver Timeout

Constraint solving takes too long:Solutions:

Simplify constraints if possible
Reduce symbolic input complexity
Use concrete values where feasible
Increase solver timeout in settings

Next Steps

Symbolic Execution

Deep dive into symbolic execution

Patching

Apply patches to fix bugs

Scripting

Automate debugging with scripts

Configuration

Configure debugging options

Get Started

User Guide

Features

​Debugging Modes

​Breakpoints

​Breakpoint Types

Execution

Read

Write

​Setting Breakpoints

​Managing Breakpoints

​Breakpoint Visualization

​Execution Control

​Symbolic Execution

​Creating Symbolic States

​Find/Avoid Addresses

​Symbolic Execution View

​State Inspection

​Registers View

Display

Modification

​Stack View

​Memory Inspection

​Constraint Viewer

​Trace Debugging

​Loading Traces

​Trace Map View

Visualization

Navigation

​Comparing Traces

​Debugging Workflows

​Finding Crash Inputs

​Analyzing Function Behavior

​Debugging Patches

​Advanced Debugging

​Hooks

​Simulation Manager Control

​State Hierarchy

​Debugging Tips

Performance

Accuracy

​Troubleshooting

​Next Steps

Symbolic Execution

Patching

Scripting

Configuration

Build docs developers (and LLMs) love

Debugging Modes

Breakpoints

Breakpoint Types

Setting Breakpoints

Managing Breakpoints

Breakpoint Visualization

Execution Control

Symbolic Execution

Creating Symbolic States

Find/Avoid Addresses

Symbolic Execution View

State Inspection

Registers View

Stack View

Memory Inspection

Constraint Viewer

Trace Debugging

Loading Traces

Trace Map View

Comparing Traces

Debugging Workflows

Finding Crash Inputs

Analyzing Function Behavior

Debugging Patches

Advanced Debugging

Hooks

Simulation Manager Control

State Hierarchy

Debugging Tips

Troubleshooting

Next Steps