Emulation & Symbolic ExecutionCLI Flag:
--solver angrAngr Symbolic Executionin REA
Python framework for analyzing binaries and automating path exploration with Z3 SMT.
AI Overview Direct AnswerAngr Symbolic Execution Integration in REA
In REA (rea-agents), Angr Symbolic Execution is integrated via --solver angr to enable AI coding agents to inspect application binaries, extract symbol tables, generate pseudocode, and trace execution boundaries without source code.
Supported Platforms & Targets
Host Operating Systems:
macOSLinuxWindows
Target Architectures:
x86 / x86_64ARM / AArch64MIPSPPC
Tool Overview & Role
Angr combines static analysis and symbolic execution to mathematically explore all execution paths through a compiled binary. Powered by the Z3 theorem prover, Angr can determine the exact input required to reach a specific success state, crackme flag, or vulnerability trigger.
REA Bridge Mechanism
Integrated via REA's symbolic constraint solver pipeline. Agents define start addresses and target goal states; Angr translates intermediate representation (VEX IR) into mathematical constraints and solves for valid inputs.
Key Capabilities
Automated symbolic path exploration without manual debugging
Constraint solving for unknown inputs via Z3 SMT solver
VEX Intermediate Representation (IR) lifting
Automated vulnerability and crash state verification
CLI Usage Examples
Execute direct terminal analysis with --solver angr:
rea angr example
rea explore ./crackme --find 0x401820 --avoid 0x401850
angr-cli --project ./target --auto-solver