symbolic-execution-tools

A playbook for symbolic execution and constraint solving aimed at CTF reversing challenges and automated binary analysis. It centers on three tools: angr for binaries with control flow, Z3 for pure constraint and equation systems, and Unicorn Engine for fast emulation of specific code regions, with Qiling noted for full-system kernel or firmware emulation. Typical goals include recovering keys, bypassing checks, and solving reversing challenges without brute force.

For angr, it lays out the core pipeline (Project, entry_state or blank_state, SimulationManager, explore with find/avoid, then solver.eval) and shows essential setup: creating entry, blank, and full-init states; defining symbolic bitvectors with claripy; constraining input to printable ASCII; wiring symbolic stdin; hooking functions by address; replacing library calls with SimProcedures such as strcmp, printf, scanf, and puts; and reading and writing memory and registers. The Z3 section covers the solver API and common CTF patterns such as serial-key validation, XOR key recovery, and systems of modular equations, plus Optimize for minimizing a satisfying value. The Unicorn section covers mapping memory, setting registers, starting emulation, and hooking memory accesses and instructions for use cases like unpacking shellcode, decrypting strings, and brute-forcing short keys.

Use it when a challenge or target is better solved by exploring paths and solving constraints than by manual analysis, for instance when a base model would otherwise produce broken angr scripts from incorrect state initialization or missing libc hooks. A guidance table maps scenarios to the best tool, and an ANGR_COOKBOOK.md reference offers 15+ ready-to-use script patterns, hook templates, symbolic input patterns, and path-explosion optimization tricks. Related routing points to anti-debugging, deobfuscation, and VM-reversing skills.