Symbolic Execution Tools

This is a practical playbook for symbolic execution in CTF reversing challenges and binary analysis. It covers angr, Z3, and Unicorn Engine with actual code patterns for common scenarios like recovering serial keys, bypassing authentication checks, and automated unpacking. The angr cookbook includes hook templates for libc functions and strategies for managing path explosion, which base models typically get wrong with broken state initialization. You get decision tables for choosing between pure constraint solving with Z3, full path exploration with angr, or fast emulation with Unicorn. Most useful when you're staring at a binary that would take hours to reverse manually but has solvable constraints you can throw symbolic execution at.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill symbolic-execution-tools --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Symbolic Execution Tools — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert symbolic execution techniques using angr, Z3, and Unicorn Engine. Covers CTF challenge automation, constraint solving patterns, function hooking, SimProcedure replacement, and emulation-based unpacking. Base models often produce broken angr scripts due to incorrect state initialization or missing hooks for libc functions.

0. RELATED ROUTING

anti-debugging-techniques when anti-debug checks need to be symbolically bypassed
code-obfuscation-deobfuscation when using symbolic execution for deobfuscation
vm-and-bytecode-reverse when applying angr to custom VM challenges