Skip to main content
The Disassembly View is the core of angr Management, providing a powerful interface for examining assembly code with multiple display modes and representation levels.

​
Display Modes

The Disassembly View supports two primary display modes:
Control Flow Graph Visualization
  • Visual representation of basic blocks
  • Color-coded edges (true/false/direct jumps)
  • Block relationships at a glance
  • Zoom and pan controls
  • Minimap for navigation
Perfect for:
  • Understanding program flow
  • Identifying loops and conditionals
  • Finding code patterns
Toggle between modes: Press Space or click the view mode button.

​
Representation Levels

View assembly code at different abstraction levels:

Machine Code

Native assembly instructions for the target architecture.
push    rbp
mov     rbp, rsp
sub     rsp, 0x10
mov     dword ptr [rbp-4], edi
Use when: You need to see exact CPU instructions.
VEX intermediate representation used by angr internally.
t0 = GET:I64(rsp)
t1 = Sub64(t0,0x0000000000000008)
PUT(rsp) = t1
STle(t1) = GET:I64(rbp)
Use when: Debugging angr analyses or understanding lifting.
Higher-level representation closer to C code.
rsp = (rsp - 8)
*(uint64_t*)rsp = rbp
rbp = rsp
Use when: Analyzing program logic at a higher level.
Switch levels:
  • View → View Machine Code
  • View → View Lifter IR
  • View → View AIL
  • Or use the command palette (Ctrl+Shift+P)

​
Graph View Features

1

Pan

Click and drag on the background
2

Zoom

  • Mouse wheel to zoom in/out
  • Ctrl + + / - for precise zoom
  • Ctrl + 0 to reset zoom
3

Jump

  • Click on call/jump targets
  • Press G to jump to address
  • Use Alt+Left/Right for history

​
Minimap

The minimap provides:
  • Bird’s-eye view of entire function
  • Current viewport indicator (red rectangle)
  • Quick navigation by clicking
  • Visual function complexity indicator
Toggle the minimap with Disassembly: Toggle Minimap command.

​
Edge Colors

Edges are color-coded to show control flow:
ColorMeaning
Blue (Cyan)True branch / conditional taken
RedFalse branch / conditional not taken
GrayDirect jump / unconditional
OrangeException edge
Yellow/GoldBack edge / loop

​
Block Highlighting

  • Gray border: Normal block
  • Dark border: Selected block
  • Blue background: Selected instruction
  • Colored backgrounds: User-defined highlights

​
Linear View Features

  • Scroll: Mouse wheel or scrollbar
  • Jump: Press G and enter address
  • Search: Ctrl+F to find instructions
  • Page Up/Down: Navigate by page

​
Address Display

Each line shows:
  • Address: Memory address in hex
  • Bytes: Raw instruction bytes (optional)
  • Mnemonic: Instruction name
  • Operands: Instruction arguments
  • Comments: User annotations

​
Smart Highlighting

Smart highlighting shows relationships between code elements:
Click on a variable to highlight:
  • All uses of the same variable
  • Definitions and assignments
  • Related memory operations
Toggle: Press A or use Disassembly: Toggle Smart Highlighting

​
Display Options

​
Addresses

Toggle address display:
  • Show: Addresses visible before each instruction
  • Hide: More compact view, better for reading code
Toggle: Disassembly: Toggle Addresses command

​
Variables

Control variable display:

Show Variables

Display variable names instead of registers/offsets

Show Identifiers

Show variable IDs for disambiguation
Commands:
  • Disassembly: Toggle Variables
  • Disassembly: Toggle Variable Identifiers

​
Exception Edges

Control display of exception handling:
  • Show: Display exception edges and exception-only blocks
  • Hide: Cleaner graph, focus on normal flow
Toggle: Disassembly: Toggle Exception Edges

​
Context Menus

​
Instruction Context Menu

Right-click on an instruction:
  • Decompile function
  • Run dependency analysis
  • View function documentation
  • Add comment
  • Rename label
  • Patch instruction
  • Set breakpoint
  • Toggle execution breakpoint
  • Create new state here
  • Set as find/avoid address

​
Label Context Menu

Right-click on a label or function name:
  • Rename function/label
  • Jump to references
  • Show function info
  • Copy address

​
Annotations

The disassembly view displays various annotations:

​
Comments

Add comments to instructions:
  1. Click on instruction (or press ;)
  2. Type your comment
  3. Press Enter to save
Comment Types:
  • Inline: Appear after instruction
  • Block: Appear before basic block
  • Function: Appear before function

​
Cross-References

XREF annotations show:
  • Where functions are called from
  • Where data is accessed
  • Jump sources

​
Breakpoints

Active breakpoints shown with:
  • Red dot icon
  • Highlighted instruction
  • Tooltip with breakpoint details

​
Hooks

Hooked addresses marked with:
  • Hook icon
  • Custom background color
  • Hook type in tooltip

​
Keyboard Shortcuts

KeyAction
GJump to address
SpaceToggle graph/linear view
TabSwitch to pseudocode
;Add/edit comment
NRename label
XShow cross-references
AToggle smart highlighting
CDefine as code
UUndefine code
Alt+LeftNavigate back
Alt+RightNavigate forward
EscNavigate back

​
Working with Functions

​
Displaying Functions

  1. From Functions View: Double-click function
  2. By Address: Press G and enter address
  3. From References: Click on call/jump target
  4. From History: Use Alt+Left/Right

​
Function Information

The status bar shows:
  • Current function name
  • Function address
  • Function size
  • Number of basic blocks

​
Defining Functions

If code isn’t recognized as a function:
  1. Navigate to the address
  2. Use Analysis → Define Function
  3. Or right-click and select “Define Function”

​
Variable Recovery

The disassembly view integrates variable information:
Quick variable recovery:
  • Register-based variables
  • Stack variables with simple offsets
  • Minimal type inference
Default mode, automatically runs.

​
Patching Instructions

Modify assembly code directly:
1

Open Patch Dialog

Right-click instruction → “Patch Instruction”
2

Enter New Code

Type assembly code (e.g., nop, mov rax, 0)
3

Apply

Patch is applied and visible immediately
4

Review

View all patches in the Patches view
Patches modify the in-memory representation but don’t change the original file. Use File → Save Patched Binary to export.

​
View Synchronization

Synchronize multiple disassembly views:
  1. Open multiple disassembly views
  2. Right-click → “Synchronize with”
  3. Select target view
  4. Cursor and selection stay in sync
Use Cases:
  • Compare different functions
  • View same code at different levels
  • Multi-monitor analysis

​
Performance Tips

Large Functions

  • Use linear view for very large functions
  • Disable minimap if slow
  • Hide exception edges to simplify graph

Complex Graphs

  • Zoom out for overview
  • Use jump history instead of scrolling
  • Consider decompilation for readability

​
Next Steps

Decompilation

Learn about the pseudocode view

Debugging

Debug binaries with breakpoints

Patching

Modify and patch binaries

Configuration

Customize disassembly colors and fonts

Build docs developers (and LLMs) love

Get started for freeTalk to us