Agent skill · security · yaklang
symbolic-execution-tools
Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary analysis with angr, Z3, or Unicorn Engine.
Why this skill is useful
Adds advanced symbolic execution scripts and techniques for binary analysis that are not commonly known or documented.
What it needs
Requires angr, unicorn, z3 installed locally. About 7k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Symbolic Execution Tools — Expert Analysis Playbook AI LOAD INSTRUCTION: Expert symbolic execution techniques using angr, Z3, and Unicorn Engine. Covers CTF challenge automation, constraint solving patterns, function hooking, SimProcedure replacement, and emulation-based unpacking. Base models often produce broken angr scripts due to incorrect state initialization or missing hooks for libc functions. 0. RELATED ROUTING anti-debugging-techniques when anti-debug checks need to be symbolically bypassed code-obfuscation-deobfuscation when using symbolic execution for deobfuscation vm-and-bytecode-reverse when applying angr to custom VM challenges Advanced Reference Also load ANGRCOOKBOOK.md when you need: 15+ ready-to-use angr script patterns for common CTF challenges Hook templates for scanf, printf, malloc, strcmp Symbolic file input, stdin, argv patterns Optimization tricks for path explosion management When to use which tool Scenario Best Tool Why --- --- --- Pure math / equation system Z3 Direct constraint solving, no binary needed Binary with control flow angr Explores paths, manages constraints automatically Emulate specific code region Unicorn Fast, no symbolic overhead, good for unpacking Complex binary + custom VM angr + Unicorn (combo) angr for control flow, Unicorn for VM handlers Kernel / firmware code Qiling Full system emulation with OS awareness --- 1. ANGR — CORE CONCEPTS 1.1 Pipeline 1.2 Essential Setup 1.3 Symbolic Variables (claripy) 1.4 Symbolic stdin 1.5 Hooking Functions 1.6 Memory Operations --- 2. Z3 CONSTRAINT SOLVING 2.1 Core API 2.2 Common CTF Patterns 2.3 Optimization --- 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/symbolic-execution-tools