Decompilation - angr Management

The Pseudocode View displays decompiled C-like code generated from binary assembly, making it easier to understand program logic and structure.

Overview

angr Management’s decompiler transforms assembly code into readable pseudocode:

From This

push rbp
mov rbp, rsp
sub rsp, 0x10
mov [rbp-4], edi

To This

int main(int argc) {
    int local_4 = argc;
    ...

Opening the Pseudocode View

Quick Access
Command Palette
First Time

Press Tab while in disassembly view
View → Pseudocode
Right-click function → “Decompile”

Press Ctrl+Shift+P
Type “View: Pseudocode”
Press Enter

Within Pseudocode

Scroll

Use mouse wheel or arrow keys to navigate

Jump to Function

Double-click on function calls to decompile that function

Jump to Address

Double-click on constants that represent addresses

Jump to Variable

Double-click on memory-backed variables to jump to their address

The pseudocode view maintains its own navigation history:

Back: Press Esc or use the back button
Forward: Use the forward button
History dropdown: Click the dropdown to see recent functions

Switching to Disassembly

Press Tab to switch back to disassembly at the current instruction.

Syntax Highlighting

Code elements are color-coded for readability:

Element	Default Color	Example
Keywords	Blue	`if`, `while`, `return`
Functions	Blue	`sub_401000()`
Library Functions	Magenta	`printf()`
Types	Blue	`int`, `char*`
Variables	Black	`local_var_4`
Global Variables	Blue	`global_data`
Comments	Green	`// comment`
Strings	Green	`"hello"`
Labels	Blue	`label_1:`

Colors are customizable in File → Preferences → Theme.

Cursor Highlighting

When you click on a code element:

All references to that element are highlighted
Variable uses are shown with yellow background
Function calls show all occurrences
Constants highlight identical values

Selection Synchronization

Clicking on code in pseudocode:

Highlights the corresponding assembly instruction
Updates synchronized views
Shows the instruction address in the status bar

Editing and Annotations

Renaming Variables

Select Variable

Click on any variable reference

Open Rename Dialog

Press N or right-click → “Rename”

Enter New Name

Type the new variable name

Apply

Press Enter - all references update immediately

Renaming Functions

Same process as variables:

Click on function name
Press N or right-click → “Rename”
Enter new name
All call sites update

Retyping Variables

Change variable types for better decompilation:

How to Retype

Right-click on variable
Select “Retype Variable”
Enter C type (e.g., char*, struct my_struct*)
Decompiler regenerates with new type information

Retyping variables triggers automatic redecompilation to propagate type changes.

Comments

Add comments to pseudocode:

Right-click on a line
Select “Add Comment”
Type your comment
Comments persist across sessions

Decompilation Options

Customize decompilation behavior via the options panel:

Display
Access

Show/Hide Options:

Decompilation Options panel
Toggle with the options button

Available Settings:

Variable recovery mode
Optimization passes
Display preferences

Optimization Passes

Select which optimization passes to apply:

Default Passes

Dead code elimination
Expression simplification
Copy propagation
Constant folding

Advanced Passes

Loop structuring
Switch statement recovery
Structure recovery
Goto elimination

Disabling optimization passes may result in more verbose but more accurate code.

Redecompiling

Force redecompilation with different settings:

Modify options in the options panel
Options panel shows “dirty” indicator
Redecompilation occurs automatically
Or manually trigger via Analyze → Decompile

Multiple Decompilation Flavors

angr can produce different decompilation outputs:

Pseudocode
Source Code

Standard C-like output

Structured control flow
Variable names and types
Optimized for readability

Default flavor, best for most analysis.

Switch between flavors:

Press Space to cycle through available flavors
Or use the flavor dropdown in the status bar

AI-Assisted Decompilation

angr Management can use Large Language Models to improve decompilation:

AI features require configuring an LLM client in File → Preferences → LLM.

Available AI Features

Suggest Variable Names

AI analyzes context and suggests meaningful variable names

Suggest Function Names

AI infers function purpose and suggests descriptive names

Suggest Variable Types

AI infers variable types from usage patterns

Summarize Function

AI generates natural language description of function behavior

Using AI Features

Manual Refinement:

Navigate to AI menu
Select desired refinement:
- LLM Suggest Variable Names
- LLM Suggest Function Name
- LLM Suggest Variable Types
- LLM Summarize Function
- LLM Refine All (runs all improvements)
Wait for AI processing
Review and accept/reject suggestions

Automatic Refinement: Enable in Preferences → LLM:

Auto-rename variables
Auto-rename functions
Auto-retype variables
Auto-summarize functions

Automatic AI refinement runs on every decompilation and may slow down the process.

Function Summaries

When AI summarization is enabled:

Function summary appears in a panel above the code
Toggle panel visibility with the summary button
Summaries are cached and persist across sessions
Edit summaries manually if needed

Advanced Features

Structure Recovery

angr attempts to recover structure definitions:

struct mystruct {
    int field_0;
    char* field_8;
    int field_10;
};

void func(struct mystruct* arg0) {
    arg0->field_0 = 0;
    ...
}

Improve structure recovery:

Define structures in Types view
Apply types to variables
Retype function parameters
Redecompile with updated type info

Inline Functions

Control which functions are inlined:

Navigate to function in Functions view
Right-click → “Inline in decompilation”
Redecompile calling functions
Inlined function code appears directly in caller

Inlining small utility functions can make code more readable.

Calling Convention Analysis

angr automatically determines calling conventions:

Detected conventions shown in function signatures
Manual override available in function properties
Custom conventions can be defined

Performance Considerations

Large Functions

Decompilation time increases with:

Function size
Number of basic blocks
Complexity of control flow

Tip: Consider disabling some optimization passes for faster results.

First Decompilation

Initial decompilation is slower because:

Variable recovery must run
Type analysis is performed
Results are cached afterward

Tip: Let the first decompilation complete for best results.

Keyboard Shortcuts

Key	Action
`Tab`	Switch to/from disassembly
`Space`	Cycle decompilation flavors
`G`	Jump to address (opens in disassembly)
`Esc`	Navigate back in history
`N`	Rename variable/function

Exporting Pseudocode

Save decompiled code:

Right-click in pseudocode view
Select “Copy” to copy to clipboard
Or select “Export” to save to file
Choose format (C, HTML, etc.)

Troubleshooting

Decompilation Failed

Possible causes:

Obfuscated code
Indirect jumps
Missing function boundaries

Solutions:

Run CFG analysis first
Define function boundaries manually
Try disabling optimization passes

Poor Variable Names

angr uses generic names like local_4Solutions:

Use AI variable name suggestions
Manually rename important variables
Enable accurate variable recovery mode

Incorrect Types

Variables show as int when they should be pointersSolutions:

Manually retype variables
Use AI type suggestions
Define structures in Types view
Enable advanced type inference

Next Steps

Debugging

Debug decompiled code with breakpoints

Patching

Apply patches based on pseudocode analysis

Configuration

Customize pseudocode colors and fonts

Disassembly

Return to disassembly view guide

Get Started

User Guide

Features

​Overview

From This

To This

​Opening the Pseudocode View

​Navigation

​Within Pseudocode

​Navigation History

​Switching to Disassembly

​Syntax Highlighting

​Code Navigation Features

​Cursor Highlighting

​Selection Synchronization

​Editing and Annotations

​Renaming Variables

​Renaming Functions

​Retyping Variables

​Comments

​Decompilation Options

​Optimization Passes

​Redecompiling

​Multiple Decompilation Flavors

​AI-Assisted Decompilation

​Available AI Features

Suggest Variable Names

Suggest Function Names

Suggest Variable Types

Summarize Function

​Using AI Features

​Function Summaries

​Advanced Features

​Structure Recovery

​Inline Functions

​Calling Convention Analysis

​Performance Considerations

Large Functions

First Decompilation

​Keyboard Shortcuts

​Exporting Pseudocode

​Troubleshooting

​Next Steps

Debugging

Patching

Configuration

Disassembly

Build docs developers (and LLMs) love

Overview

Opening the Pseudocode View

Navigation

Within Pseudocode

Navigation History

Switching to Disassembly

Syntax Highlighting

Code Navigation Features

Cursor Highlighting

Selection Synchronization

Editing and Annotations

Renaming Variables

Renaming Functions

Retyping Variables

Comments

Decompilation Options

Optimization Passes

Redecompiling

Multiple Decompilation Flavors

AI-Assisted Decompilation

Available AI Features

Using AI Features

Function Summaries

Advanced Features

Structure Recovery

Inline Functions

Calling Convention Analysis

Performance Considerations

Keyboard Shortcuts

Exporting Pseudocode

Troubleshooting

Next Steps