angr

Background

angr is an open-source binary analysis framework written in Python. It was developed by researchers affiliated with the Computer Security Lab at the University of California, Santa Barbara (UCSB) and the SEFCOM lab at Arizona State University. The project grew out of academic work on automated binary analysis and program understanding, with core contributors including Yan Shoshitaishvili and Ruoyu Wang, working under the guidance of professors Giovanni Vigna and Christopher Kruegel. The tool's development is closely associated with Shellphish, a hacking team founded by Vigna at UC Santa Barbara in 2005 that has competed extensively in Capture The Flag (CTF) competitions, including DEF CON CTF.

Purpose and Design

angr combines static analysis techniques, such as control-flow graph recovery and disassembly, with dynamic symbolic execution, allowing users to reason about program behavior across many possible execution paths without necessarily running the target binary in a traditional sense. It supports lifting machine code from multiple CPU architectures into an intermediate representation (via the VEX IR, through its companion library pyvex), loading binaries through the CLE loader, and solving path constraints using the constraint-solving library claripy. This architecture allows angr to be largely platform-agnostic, supporting analysis of binaries compiled for x86, x86-64, ARM, MIPS, and other architectures.

Public Debut and Early Reception

angr was introduced publicly to the wider security community around 2015, with presentations at security conferences including DEF CON and Black Hat. Its open-source release, hosted on GitHub under a BSD-2-Clause license, made a sophisticated symbolic execution engine freely available to researchers, students, and practitioners who previously had to rely on proprietary or narrowly scoped academic tools.

Role in the DARPA Cyber Grand Challenge

angr gained significant visibility through its use as a core component of Mechanical Phish, the autonomous Cyber Reasoning System fielded by Shellphish in DARPA's Cyber Grand Challenge (CGC), a competition to build fully automated systems capable of finding and patching software vulnerabilities without human intervention. Shellphish has described Mechanical Phish as one of the first publicly available systems of its kind, and angr's symbolic execution and binary analysis capabilities underpinned the vulnerability discovery components of that system.

Ecosystem and Continued Development

Over time, angr expanded into a broader ecosystem of associated tools and libraries, including angr-management, a graphical interface for interactive binary analysis, and related research tools such as Driller, which combined angr's symbolic execution with fuzzing to improve vulnerability discovery coverage. The project has continued to be maintained collaboratively by academic contributors and the open-source community, with ongoing releases, documentation at docs.angr.io, and use in both CTF play and professional vulnerability research workflows.

Significance and Legacy

angr is widely cited in academic and practitioner literature on automated binary analysis and symbolic execution, and it remains one of the most actively used open-source frameworks in that space. Its origins in a university CTF team illustrate a recurring pattern in the history of hacking and security research, in which competitive hacking communities produce tools and techniques that later find broader application in both academic research and industrial security practice.

Timeline

• 2005Shellphish is founded at UC Santa Barbara by Professor Giovanni Vigna as a CTF team.
• 2015angr is publicly released as an open-source binary analysis framework and presented at security conferences including DEF CON and Black Hat.
• 2016Shellphish competes in the DARPA Cyber Grand Challenge final event using Mechanical Phish, an autonomous Cyber Reasoning System built with angr as a core component.