Core Views
Disassembly View
The primary view for examining assembly code.Features
- Graph and linear display modes
- Multiple representation levels (machine code, VEX IR, AIL)
- Smart highlighting and cross-references
- Integrated variable information
- Comment and annotation support
Pseudocode View
Displays decompiled C-like code for easier analysis.Features
- Syntax highlighting
- Variable and function renaming
- Type annotations
- Navigation to/from disassembly
- Multiple decompilation flavors
- AI-assisted refinement
Hex View
Classic hex editor for viewing and modifying raw binary data.Features
- Byte and ASCII representation
- Patch creation and modification
- Breakpoint highlighting
- Synchronized cursor with other views
- Data source selection (loader/debugger)
Navigation Views
Functions View
- Overview
- Function Types
Lists all functions detected in the binary with:
- Function addresses and names
- Size information
- Color-coded by type (syscall, PLT, SimProcedure)
- Sortable columns
- Search and filter capabilities
- Double-click to navigate to a function
- Right-click for context menu
- Multi-select for batch operations
Strings View
Displays all strings found in the binary:- String content and address
- Length and encoding information
- Context (which functions reference each string)
- Click to jump to string location
- Export functionality
Analysis Views
Proximity View
Visualizes data flow and relationships around a function:Data Dependency View
Shows data flow analysis results:- Variable dependencies
- Memory operations
- Register usage
- Taint propagation
Requires the Operation Mango plugin for full functionality.
Call Explorer View
Interactive call graph exploration:- Function call hierarchy
- Caller/callee relationships
- Path exploration
- Call depth visualization
Types View
Manage type information:- View and edit type definitions
- Create custom structures
- Import type libraries
- Apply types to variables
Debugging Views
Breakpoints View
Manage all breakpoints in one place:Breakpoint Types
- Execution breakpoints
- Read breakpoints
- Write breakpoints
Management
- Add/remove/edit breakpoints
- Enable/disable toggles
- Comments and descriptions
Registers View
Displays CPU register values during debugging:- Current register state
- Value changes highlighted
- Support for all architecture registers
- Modify register values
Stack View
Shows the current stack state:- Stack frame visualization
- Return addresses
- Local variables
- Stack pointer tracking
States View
Manages symbolic execution states:- Active simulation managers
- State hierarchy
- Constraints and conditions
- State exploration controls
Traces View
Work with execution traces:- Load and visualize traces
- Step through execution
- Compare different runs
- Export trace data
Trace Map View
Visual representation of code coverage:- Heat map of executed code
- Identify hot paths
- Coverage analysis
- Interactive navigation
Modification Views
Patches View
Manage all binary patches:Patch Operations
Patch Operations
- View all applied patches
- Revert individual patches
- Merge adjacent patches
- Add comments to patches
- Export patched binary
- Address and size
- Original vs. new bytes
- Comments
- Status indicators
Symbolic Execution Views
Symbolic Execution View
Control symbolic execution:- Simulation manager interface
- State management
- Path exploration controls
- Find/avoid address configuration
- Constraints viewer
Utility Views
Console View
Interactive IPython console:- Full Python environment
- Direct access to angr APIs
- Current function context
- Tab completion
- Command history
Log View
Displays logging output:- Analysis progress messages
- Warning and error messages
- Debug information
- Filterable by log level
- Timestamp formatting
Jobs View
Monitors background analysis jobs:- Active and queued jobs
- Progress indicators
- Job cancellation
- Completion status
- Error reporting
Signature Analysis
Signatures View
Manage FLIRT signatures:- Detected library functions
- Signature matches
- Confidence scores
- Apply/remove signatures
- Import signature files
View Management
Opening Views
Arranging Views
- Drag and Drop: Drag view tabs to reposition
- Dock Areas: Drop zones appear when dragging
- Floating Windows: Drag outside main window to float
- Auto-Hide: Right-click view title bar
View Synchronization
Some views support synchronization:
Synchronized Features:
- Cursor position
- Highlight regions
- Address navigation
Creating New Views
Some views support multiple instances:- New Disassembly (Graph): Create additional disassembly views
- New Disassembly (Linear): Create linear disassembly views
- New Hex: Create additional hex editors
View Shortcuts
Quick access to views via keyboard:| Command | Action |
|---|---|
| View: Disassembly (Graph) | Show graph disassembly |
| View: Disassembly (Linear) | Show linear disassembly |
| View: Pseudocode | Show decompiled code |
| View: Hex | Show hex editor |
| View: Functions | Show functions list |
| View: Console | Show Python console |
| View: Breakpoints | Show breakpoints table |
Next Steps
Disassembly
Deep dive into the disassembly view
Decompilation
Master the pseudocode view
Debugging
Learn debugging workflows
Patching
Modify binaries with patches