symbolic_exec
Run symbolic execution on PE/ELF/MachO binaries starting at a given address to explore program paths and collect constraints, enabling cross-validation of analysis results.
Instructions
Run angr symbolic execution starting at address.
Args:
path: PE / ELF / MachO to analyze
address: entry point as a hex string (e.g. "0x401000")
args: optional list of symbolic-arg names (default:
none — angr marks stdin / argv as symbolic depending
on the binary's entry point conventions)
Returns::
{"path": "...",
"address": "0x401000",
"states_explored": N,
"constraints": [{"path": [...], "expr": "..."}],
"dead_ends": N}The output is a partial trace — angr explores until either all paths are explored or the timeout is hit. The result is useful for cross-validation: "angr and Triton both find this MBA identity holds" is a much stronger signal than either alone.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| address | Yes | ||
| args | No |