angr 9.2.101__py3-none-manylinux2014_x86_64.whl → 9.2.103__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +1 -1
- angr/analyses/analysis.py +7 -6
- angr/analyses/calling_convention.py +33 -35
- angr/analyses/cdg.py +2 -4
- angr/analyses/cfg/cfb.py +4 -3
- angr/analyses/cfg/cfg_base.py +14 -14
- angr/analyses/cfg/cfg_emulated.py +3 -4
- angr/analyses/cfg/cfg_fast.py +46 -46
- angr/analyses/cfg/cfg_fast_soot.py +1 -2
- angr/analyses/cfg/cfg_job_base.py +2 -2
- angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +14 -13
- angr/analyses/cfg/indirect_jump_resolvers/mips_elf_fast.py +5 -5
- angr/analyses/cfg_slice_to_sink/cfg_slice_to_sink.py +3 -3
- angr/analyses/complete_calling_conventions.py +13 -12
- angr/analyses/data_dep/data_dependency_analysis.py +24 -24
- angr/analyses/data_dep/dep_nodes.py +3 -3
- angr/analyses/ddg.py +1 -2
- angr/analyses/decompiler/ail_simplifier.py +35 -34
- angr/analyses/decompiler/block_io_finder.py +20 -20
- angr/analyses/decompiler/block_similarity.py +4 -6
- angr/analyses/decompiler/block_simplifier.py +17 -16
- angr/analyses/decompiler/callsite_maker.py +25 -10
- angr/analyses/decompiler/ccall_rewriters/amd64_ccalls.py +1 -3
- angr/analyses/decompiler/ccall_rewriters/rewriter_base.py +2 -4
- angr/analyses/decompiler/clinic.py +250 -45
- angr/analyses/decompiler/condition_processor.py +15 -8
- angr/analyses/decompiler/decompilation_cache.py +7 -7
- angr/analyses/decompiler/decompilation_options.py +4 -4
- angr/analyses/decompiler/decompiler.py +19 -15
- angr/analyses/decompiler/expression_counters.py +10 -9
- angr/analyses/decompiler/goto_manager.py +2 -4
- angr/analyses/decompiler/graph_region.py +9 -9
- angr/analyses/decompiler/jump_target_collector.py +1 -2
- angr/analyses/decompiler/optimization_passes/__init__.py +4 -3
- angr/analyses/decompiler/optimization_passes/code_motion.py +5 -6
- angr/analyses/decompiler/optimization_passes/const_derefs.py +4 -4
- angr/analyses/decompiler/optimization_passes/deadblock_remover.py +73 -0
- angr/analyses/decompiler/optimization_passes/engine_base.py +25 -3
- angr/analyses/decompiler/optimization_passes/expr_op_swapper.py +6 -5
- angr/analyses/decompiler/optimization_passes/flip_boolean_cmp.py +2 -2
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +3 -0
- angr/analyses/decompiler/optimization_passes/ite_expr_converter.py +2 -2
- angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +17 -17
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +12 -13
- angr/analyses/decompiler/optimization_passes/register_save_area_simplifier.py +25 -21
- angr/analyses/decompiler/optimization_passes/ret_addr_save_simplifier.py +3 -3
- angr/analyses/decompiler/optimization_passes/ret_deduplicator.py +1 -2
- angr/analyses/decompiler/optimization_passes/return_duplicator_base.py +7 -7
- angr/analyses/decompiler/optimization_passes/spilled_register_finder.py +18 -0
- angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py +2 -3
- angr/analyses/decompiler/optimization_passes/win_stack_canary_simplifier.py +1 -2
- angr/analyses/decompiler/optimization_passes/x86_gcc_getpc_simplifier.py +2 -2
- angr/analyses/decompiler/peephole_optimizations/__init__.py +4 -3
- angr/analyses/decompiler/peephole_optimizations/base.py +13 -15
- angr/analyses/decompiler/peephole_optimizations/bswap.py +1 -3
- angr/analyses/decompiler/peephole_optimizations/cmpord_rewriter.py +72 -0
- angr/analyses/decompiler/peephole_optimizations/const_mull_a_shift.py +1 -2
- angr/analyses/decompiler/peephole_optimizations/eager_eval.py +1 -1
- angr/analyses/decompiler/peephole_optimizations/inlined_strcpy.py +5 -10
- angr/analyses/decompiler/peephole_optimizations/inlined_strcpy_consolidation.py +3 -4
- angr/analyses/decompiler/peephole_optimizations/inlined_wstrcpy.py +7 -10
- angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py +2 -3
- angr/analyses/decompiler/peephole_optimizations/sar_to_signed_div.py +1 -2
- angr/analyses/decompiler/peephole_optimizations/tidy_stack_addr.py +4 -4
- angr/analyses/decompiler/redundant_label_remover.py +4 -5
- angr/analyses/decompiler/region_identifier.py +4 -5
- angr/analyses/decompiler/region_simplifiers/cascading_cond_transformer.py +1 -2
- angr/analyses/decompiler/region_simplifiers/expr_folding.py +19 -20
- angr/analyses/decompiler/region_simplifiers/goto.py +2 -3
- angr/analyses/decompiler/region_simplifiers/loop.py +1 -2
- angr/analyses/decompiler/region_simplifiers/node_address_finder.py +1 -2
- angr/analyses/decompiler/region_simplifiers/region_simplifier.py +1 -3
- angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +19 -19
- angr/analyses/decompiler/return_maker.py +1 -2
- angr/analyses/decompiler/structured_codegen/base.py +5 -6
- angr/analyses/decompiler/structured_codegen/c.py +39 -38
- angr/analyses/decompiler/structuring/__init__.py +1 -1
- angr/analyses/decompiler/structuring/dream.py +17 -16
- angr/analyses/decompiler/structuring/phoenix.py +45 -46
- angr/analyses/decompiler/structuring/recursive_structurer.py +4 -4
- angr/analyses/decompiler/structuring/structurer_base.py +16 -15
- angr/analyses/decompiler/structuring/structurer_nodes.py +10 -9
- angr/analyses/decompiler/utils.py +17 -16
- angr/analyses/disassembly.py +7 -6
- angr/analyses/flirt.py +9 -9
- angr/analyses/forward_analysis/forward_analysis.py +15 -14
- angr/analyses/forward_analysis/visitors/function_graph.py +1 -2
- angr/analyses/forward_analysis/visitors/graph.py +16 -15
- angr/analyses/propagator/engine_ail.py +30 -26
- angr/analyses/propagator/outdated_definition_walker.py +8 -7
- angr/analyses/propagator/propagator.py +11 -13
- angr/analyses/proximity_graph.py +21 -21
- angr/analyses/reaching_definitions/__init__.py +3 -3
- angr/analyses/reaching_definitions/call_trace.py +3 -6
- angr/analyses/reaching_definitions/dep_graph.py +41 -48
- angr/analyses/reaching_definitions/engine_ail.py +11 -5
- angr/analyses/reaching_definitions/engine_vex.py +9 -8
- angr/analyses/reaching_definitions/function_handler.py +51 -34
- angr/analyses/reaching_definitions/heap_allocator.py +3 -4
- angr/analyses/reaching_definitions/rd_initializer.py +8 -8
- angr/analyses/reaching_definitions/rd_state.py +57 -58
- angr/analyses/reaching_definitions/reaching_definitions.py +18 -17
- angr/analyses/reaching_definitions/subject.py +2 -3
- angr/analyses/stack_pointer_tracker.py +15 -6
- angr/analyses/typehoon/dfa.py +4 -4
- angr/analyses/typehoon/simple_solver.py +48 -52
- angr/analyses/typehoon/translator.py +3 -6
- angr/analyses/typehoon/typeconsts.py +13 -14
- angr/analyses/typehoon/typehoon.py +9 -9
- angr/analyses/typehoon/typevars.py +18 -17
- angr/analyses/variable_recovery/engine_ail.py +5 -5
- angr/analyses/variable_recovery/engine_base.py +25 -21
- angr/analyses/variable_recovery/irsb_scanner.py +8 -9
- angr/analyses/variable_recovery/variable_recovery.py +1 -2
- angr/analyses/variable_recovery/variable_recovery_base.py +14 -13
- angr/analyses/variable_recovery/variable_recovery_fast.py +8 -8
- angr/analyses/veritesting.py +1 -2
- angr/analyses/vfg.py +57 -56
- angr/analyses/xrefs.py +1 -2
- angr/angrdb/db.py +7 -7
- angr/angrdb/serializers/kb.py +16 -13
- angr/angrdb/serializers/loader.py +1 -2
- angr/angrdb/serializers/structured_code.py +2 -2
- angr/annocfg.py +1 -2
- angr/block.py +16 -6
- angr/calling_conventions.py +27 -27
- angr/code_location.py +8 -8
- angr/codenode.py +1 -2
- angr/concretization_strategies/max.py +1 -3
- angr/distributed/server.py +1 -3
- angr/distributed/worker.py +1 -2
- angr/engines/engine.py +2 -3
- angr/engines/light/engine.py +4 -4
- angr/engines/pcode/behavior.py +20 -2
- angr/engines/pcode/emulate.py +1 -1
- angr/engines/pcode/engine.py +7 -7
- angr/engines/pcode/lifter.py +78 -77
- angr/engines/vex/claripy/ccall.py +1 -2
- angr/engines/vex/claripy/datalayer.py +1 -2
- angr/engines/vex/light/light.py +1 -2
- angr/exploration_techniques/tracer.py +4 -4
- angr/factory.py +12 -15
- angr/flirt/__init__.py +8 -8
- angr/flirt/build_sig.py +2 -3
- angr/keyed_region.py +2 -2
- angr/knowledge_base/knowledge_base.py +3 -3
- angr/knowledge_plugins/callsite_prototypes.py +4 -6
- angr/knowledge_plugins/cfg/cfg_manager.py +19 -6
- angr/knowledge_plugins/cfg/cfg_model.py +26 -27
- angr/knowledge_plugins/cfg/cfg_node.py +2 -2
- angr/knowledge_plugins/cfg/indirect_jump.py +6 -8
- angr/knowledge_plugins/cfg/memory_data.py +8 -9
- angr/knowledge_plugins/custom_strings.py +1 -3
- angr/knowledge_plugins/debug_variables.py +2 -2
- angr/knowledge_plugins/functions/function.py +21 -22
- angr/knowledge_plugins/functions/function_manager.py +5 -5
- angr/knowledge_plugins/indirect_jumps.py +1 -3
- angr/knowledge_plugins/key_definitions/atoms.py +7 -7
- angr/knowledge_plugins/key_definitions/definition.py +14 -14
- angr/knowledge_plugins/key_definitions/environment.py +5 -7
- angr/knowledge_plugins/key_definitions/heap_address.py +1 -3
- angr/knowledge_plugins/key_definitions/key_definition_manager.py +3 -2
- angr/knowledge_plugins/key_definitions/live_definitions.py +60 -59
- angr/knowledge_plugins/key_definitions/liveness.py +16 -16
- angr/knowledge_plugins/key_definitions/rd_model.py +15 -15
- angr/knowledge_plugins/key_definitions/uses.py +11 -11
- angr/knowledge_plugins/patches.py +4 -8
- angr/knowledge_plugins/propagations/prop_value.py +10 -9
- angr/knowledge_plugins/propagations/propagation_manager.py +3 -5
- angr/knowledge_plugins/propagations/propagation_model.py +9 -9
- angr/knowledge_plugins/propagations/states.py +52 -22
- angr/knowledge_plugins/structured_code/manager.py +2 -2
- angr/knowledge_plugins/sync/sync_controller.py +3 -3
- angr/knowledge_plugins/variables/variable_access.py +4 -4
- angr/knowledge_plugins/variables/variable_manager.py +56 -39
- angr/knowledge_plugins/xrefs/xref.py +9 -11
- angr/knowledge_plugins/xrefs/xref_manager.py +3 -4
- angr/misc/ansi.py +1 -2
- angr/misc/autoimport.py +3 -3
- angr/misc/plugins.py +9 -9
- angr/procedures/definitions/__init__.py +16 -16
- angr/procedures/definitions/linux_kernel.py +1 -1
- angr/procedures/definitions/parse_win32json.py +1 -1
- angr/procedures/java_jni/__init__.py +1 -1
- angr/procedures/java_jni/array_operations.py +1 -2
- angr/procedures/java_jni/method_calls.py +1 -2
- angr/procedures/posix/inet_ntoa.py +1 -2
- angr/procedures/stubs/format_parser.py +3 -3
- angr/project.py +13 -11
- angr/sim_manager.py +12 -12
- angr/sim_procedure.py +7 -3
- angr/sim_state.py +2 -2
- angr/sim_type.py +60 -45
- angr/sim_variable.py +5 -5
- angr/simos/simos.py +1 -2
- angr/simos/userland.py +1 -2
- angr/state_plugins/callstack.py +3 -2
- angr/state_plugins/history.py +1 -2
- angr/state_plugins/solver.py +34 -34
- angr/storage/memory_mixins/__init__.py +4 -3
- angr/storage/memory_mixins/actions_mixin.py +1 -3
- angr/storage/memory_mixins/address_concretization_mixin.py +1 -3
- angr/storage/memory_mixins/convenient_mappings_mixin.py +3 -4
- angr/storage/memory_mixins/default_filler_mixin.py +1 -1
- angr/storage/memory_mixins/label_merger_mixin.py +2 -2
- angr/storage/memory_mixins/multi_value_merger_mixin.py +4 -3
- angr/storage/memory_mixins/paged_memory/page_backer_mixins.py +9 -8
- angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +12 -11
- angr/storage/memory_mixins/paged_memory/pages/cooperation.py +8 -8
- angr/storage/memory_mixins/paged_memory/pages/history_tracking_mixin.py +2 -3
- angr/storage/memory_mixins/paged_memory/pages/list_page.py +10 -11
- angr/storage/memory_mixins/paged_memory/pages/multi_values.py +11 -10
- angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +18 -17
- angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +12 -11
- angr/storage/memory_mixins/regioned_memory/abstract_address_descriptor.py +3 -3
- angr/storage/memory_mixins/regioned_memory/abstract_merger_mixin.py +3 -2
- angr/storage/memory_mixins/regioned_memory/region_data.py +1 -2
- angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +2 -2
- angr/storage/memory_mixins/regioned_memory/regioned_address_concretization_mixin.py +3 -3
- angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +18 -21
- angr/storage/memory_mixins/size_resolution_mixin.py +1 -2
- angr/storage/memory_mixins/symbolic_merger_mixin.py +3 -2
- angr/storage/memory_mixins/top_merger_mixin.py +3 -2
- angr/storage/memory_object.py +2 -4
- angr/utils/algo.py +3 -2
- angr/utils/dynamic_dictlist.py +5 -5
- angr/utils/formatting.py +4 -4
- angr/utils/funcid.py +1 -2
- angr/utils/graph.py +5 -6
- angr/utils/library.py +5 -5
- angr/utils/mp.py +5 -4
- angr/utils/segment_list.py +3 -4
- angr/utils/typing.py +3 -2
- {angr-9.2.101.dist-info → angr-9.2.103.dist-info}/METADATA +9 -11
- {angr-9.2.101.dist-info → angr-9.2.103.dist-info}/RECORD +239 -236
- {angr-9.2.101.dist-info → angr-9.2.103.dist-info}/LICENSE +0 -0
- {angr-9.2.101.dist-info → angr-9.2.103.dist-info}/WHEEL +0 -0
- {angr-9.2.101.dist-info → angr-9.2.103.dist-info}/entry_points.txt +0 -0
- {angr-9.2.101.dist-info → angr-9.2.103.dist-info}/top_level.txt +0 -0
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
# pylint:disable=wrong-import-position,wrong-import-order
|
|
2
|
-
from typing import
|
|
2
|
+
from typing import DefaultDict, TYPE_CHECKING
|
|
3
3
|
import logging
|
|
4
4
|
from collections import defaultdict
|
|
5
5
|
|
|
@@ -103,8 +103,8 @@ class VariableRecoveryFastState(VariableRecoveryStateBase):
|
|
|
103
103
|
return state
|
|
104
104
|
|
|
105
105
|
def merge(
|
|
106
|
-
self, others:
|
|
107
|
-
) ->
|
|
106
|
+
self, others: tuple["VariableRecoveryFastState"], successor=None
|
|
107
|
+
) -> tuple["VariableRecoveryFastState", bool]:
|
|
108
108
|
"""
|
|
109
109
|
Merge two abstract states.
|
|
110
110
|
|
|
@@ -233,12 +233,12 @@ class VariableRecoveryFast(ForwardAnalysis, VariableRecoveryBase): # pylint:dis
|
|
|
233
233
|
|
|
234
234
|
def __init__(
|
|
235
235
|
self,
|
|
236
|
-
func:
|
|
237
|
-
func_graph:
|
|
236
|
+
func: Function | str | int,
|
|
237
|
+
func_graph: networkx.DiGraph | None = None,
|
|
238
238
|
max_iterations: int = 2,
|
|
239
239
|
low_priority=False,
|
|
240
240
|
track_sp=True,
|
|
241
|
-
func_args:
|
|
241
|
+
func_args: list[SimVariable] | None = None,
|
|
242
242
|
store_live_variables=False,
|
|
243
243
|
unify_variables=True,
|
|
244
244
|
):
|
|
@@ -276,9 +276,9 @@ class VariableRecoveryFast(ForwardAnalysis, VariableRecoveryBase): # pylint:dis
|
|
|
276
276
|
self._node_iterations = defaultdict(int)
|
|
277
277
|
|
|
278
278
|
self._node_to_cc = {}
|
|
279
|
-
self.var_to_typevars: DefaultDict[SimVariable,
|
|
279
|
+
self.var_to_typevars: DefaultDict[SimVariable, set[TypeVariable]] = defaultdict(set)
|
|
280
280
|
self.typevars = None
|
|
281
|
-
self.type_constraints:
|
|
281
|
+
self.type_constraints: dict["TypeVariable", set["TypeConstraint"]] | None = None
|
|
282
282
|
self.func_typevar = TypeVariable(name=func.name)
|
|
283
283
|
self.delayed_type_constraints = None
|
|
284
284
|
self.ret_val_size = None
|
angr/analyses/veritesting.py
CHANGED
|
@@ -1,7 +1,6 @@
|
|
|
1
1
|
import logging
|
|
2
2
|
from collections import defaultdict
|
|
3
3
|
from functools import cmp_to_key
|
|
4
|
-
from typing import Tuple
|
|
5
4
|
|
|
6
5
|
import networkx
|
|
7
6
|
|
|
@@ -235,7 +234,7 @@ class Veritesting(Analysis):
|
|
|
235
234
|
|
|
236
235
|
self.result, self.final_manager = self._veritesting()
|
|
237
236
|
|
|
238
|
-
def _veritesting(self) ->
|
|
237
|
+
def _veritesting(self) -> tuple[bool, SimulationManager]:
|
|
239
238
|
"""
|
|
240
239
|
Perform static symbolic execution starting from the given point.
|
|
241
240
|
:returns: tuple of the success/failure of veritesting and the subsequent SimulationManager after execution
|
angr/analyses/vfg.py
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
from typing import TYPE_CHECKING, Any,
|
|
1
|
+
from typing import TYPE_CHECKING, Any, DefaultDict, Optional
|
|
2
|
+
from collections.abc import Callable, Generator
|
|
2
3
|
import logging
|
|
3
4
|
from collections import defaultdict
|
|
4
5
|
|
|
@@ -45,24 +46,24 @@ class VFGJob(CFGJobBase):
|
|
|
45
46
|
def __init__(self, *args, **kwargs) -> None:
|
|
46
47
|
super().__init__(*args, **kwargs)
|
|
47
48
|
|
|
48
|
-
self.call_stack_suffix:
|
|
49
|
-
self.vfg_node:
|
|
49
|
+
self.call_stack_suffix: list = []
|
|
50
|
+
self.vfg_node: VFGNode | None = None
|
|
50
51
|
self.is_call_jump = None
|
|
51
52
|
self.call_target = None
|
|
52
53
|
self.dbg_exit_status = {}
|
|
53
54
|
self.is_return_jump = None
|
|
54
55
|
|
|
55
|
-
self.sim_successors:
|
|
56
|
+
self.sim_successors: SimSuccessors | None = None
|
|
56
57
|
|
|
57
58
|
# if this job has a call successor, do we plan to skip the call successor or not
|
|
58
59
|
self.call_skipped = False
|
|
59
60
|
# if the call is skipped, calling stack of the skipped function is saved in `call_context_key`
|
|
60
|
-
self.call_function_key:
|
|
61
|
+
self.call_function_key: FunctionKey | None = None
|
|
61
62
|
|
|
62
|
-
self.call_task:
|
|
63
|
+
self.call_task: CallAnalysis | None = None
|
|
63
64
|
|
|
64
65
|
@property
|
|
65
|
-
def block_id(self) ->
|
|
66
|
+
def block_id(self) -> BlockID | None:
|
|
66
67
|
return self._block_id
|
|
67
68
|
|
|
68
69
|
def callstack_repr(self, kb: "KnowledgeBase"):
|
|
@@ -134,13 +135,13 @@ class FunctionAnalysis(AnalysisTask):
|
|
|
134
135
|
Analyze a function, generate fix-point states from all endpoints of that function, and then merge them to one state.
|
|
135
136
|
"""
|
|
136
137
|
|
|
137
|
-
def __init__(self, function_address: int, return_address:
|
|
138
|
+
def __init__(self, function_address: int, return_address: int | None) -> None:
|
|
138
139
|
super().__init__()
|
|
139
140
|
|
|
140
141
|
self.function_address = function_address
|
|
141
142
|
self.return_address = return_address
|
|
142
143
|
|
|
143
|
-
self.call_analysis:
|
|
144
|
+
self.call_analysis: AnalysisTask | None = None
|
|
144
145
|
|
|
145
146
|
# tracks all jobs that are live currently
|
|
146
147
|
self.jobs = []
|
|
@@ -168,8 +169,8 @@ class CallAnalysis(AnalysisTask):
|
|
|
168
169
|
self,
|
|
169
170
|
address: int,
|
|
170
171
|
return_address: None,
|
|
171
|
-
function_analysis_tasks:
|
|
172
|
-
mergeable_plugins:
|
|
172
|
+
function_analysis_tasks: list[Any] | None = None,
|
|
173
|
+
mergeable_plugins: tuple[str, str] | None = None,
|
|
173
174
|
) -> None:
|
|
174
175
|
super().__init__()
|
|
175
176
|
|
|
@@ -235,14 +236,14 @@ class VFGNode:
|
|
|
235
236
|
"""
|
|
236
237
|
self.key = key
|
|
237
238
|
self.addr = addr
|
|
238
|
-
self.state:
|
|
239
|
-
self.widened_state:
|
|
239
|
+
self.state: SimState | None = None
|
|
240
|
+
self.widened_state: SimState | None = None
|
|
240
241
|
self.narrowing_times: int = 0
|
|
241
|
-
self.all_states:
|
|
242
|
-
self.events:
|
|
243
|
-
self.input_variables:
|
|
244
|
-
self.actions:
|
|
245
|
-
self.final_states:
|
|
242
|
+
self.all_states: list[SimState] = []
|
|
243
|
+
self.events: list = []
|
|
244
|
+
self.input_variables: list = []
|
|
245
|
+
self.actions: list = []
|
|
246
|
+
self.final_states: list[SimState] = []
|
|
246
247
|
|
|
247
248
|
if state:
|
|
248
249
|
self.all_states.append(state)
|
|
@@ -307,20 +308,20 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
307
308
|
|
|
308
309
|
def __init__(
|
|
309
310
|
self,
|
|
310
|
-
cfg:
|
|
311
|
+
cfg: CFGEmulated | None = None,
|
|
311
312
|
context_sensitivity_level: int = 2,
|
|
312
|
-
start:
|
|
313
|
-
function_start:
|
|
313
|
+
start: int | None = None,
|
|
314
|
+
function_start: int | None = None,
|
|
314
315
|
interfunction_level: int = 0,
|
|
315
316
|
initial_state: Optional["SimState"] = None,
|
|
316
|
-
avoid_runs:
|
|
317
|
-
remove_options:
|
|
318
|
-
timeout:
|
|
317
|
+
avoid_runs: list[int] | None = None,
|
|
318
|
+
remove_options: set[str] | None = None,
|
|
319
|
+
timeout: int | None = None,
|
|
319
320
|
max_iterations_before_widening: int = 8,
|
|
320
321
|
max_iterations: int = 40,
|
|
321
322
|
widening_interval: int = 3,
|
|
322
|
-
final_state_callback:
|
|
323
|
-
status_callback:
|
|
323
|
+
final_state_callback: Callable[["SimState", CallStack], Any] | None = None,
|
|
324
|
+
status_callback: Callable[["VFG"], Any] | None = None,
|
|
324
325
|
record_function_final_states: bool = False,
|
|
325
326
|
) -> None:
|
|
326
327
|
"""
|
|
@@ -352,7 +353,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
352
353
|
self._function_start: int = function_start if function_start is not None else self._start
|
|
353
354
|
|
|
354
355
|
# Other parameters
|
|
355
|
-
self._avoid_runs:
|
|
356
|
+
self._avoid_runs: list[int] = [] if avoid_runs is None else avoid_runs
|
|
356
357
|
self._context_sensitivity_level = context_sensitivity_level
|
|
357
358
|
self._interfunction_level = interfunction_level
|
|
358
359
|
self._state_options_to_remove = set() if remove_options is None else remove_options
|
|
@@ -369,46 +370,46 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
369
370
|
|
|
370
371
|
self._record_function_final_states = record_function_final_states
|
|
371
372
|
|
|
372
|
-
self._nodes:
|
|
373
|
-
self._normal_states:
|
|
373
|
+
self._nodes: dict[BlockID, VFGNode] = {} # all the vfg nodes, keyed on block IDs
|
|
374
|
+
self._normal_states: dict[BlockID, SimState] = (
|
|
374
375
|
{}
|
|
375
376
|
) # Last available state for each program point without widening
|
|
376
|
-
self._widened_states:
|
|
377
|
+
self._widened_states: dict[BlockID, SimState] = {} # States on which widening has occurred
|
|
377
378
|
|
|
378
379
|
# Initial states of each function, which is context sensitive
|
|
379
380
|
# It maps function key to its states
|
|
380
|
-
self._function_initial_states: DefaultDict[int,
|
|
381
|
+
self._function_initial_states: DefaultDict[int, dict[int, SimState]] = defaultdict(dict)
|
|
381
382
|
# Final states of each function, right after `ret` is called. Also context sensitive.
|
|
382
383
|
# even if a function may have multiple return sites, as long as they all return to the same place, there is
|
|
383
384
|
# only one final state of that function.
|
|
384
|
-
self._function_final_states: DefaultDict[int,
|
|
385
|
+
self._function_final_states: DefaultDict[int, dict[int, SimState]] = defaultdict(dict)
|
|
385
386
|
|
|
386
387
|
# All final states are put in this list
|
|
387
|
-
self.final_states:
|
|
388
|
+
self.final_states: list[SimState] = []
|
|
388
389
|
|
|
389
|
-
self._state_initialization_map: DefaultDict[int,
|
|
390
|
+
self._state_initialization_map: DefaultDict[int, list[tuple[int, int]]] = defaultdict(list)
|
|
390
391
|
|
|
391
|
-
self._exit_targets: DefaultDict[
|
|
392
|
+
self._exit_targets: DefaultDict[tuple[int | None, ...], list[tuple[BlockID, str]]] = defaultdict(
|
|
392
393
|
list
|
|
393
394
|
) # A dict to log edges and the jumpkind between each basic block
|
|
394
395
|
# A dict to record all blocks that returns to a specific address
|
|
395
|
-
self._return_target_sources: DefaultDict[int,
|
|
396
|
+
self._return_target_sources: DefaultDict[int, list[int]] = defaultdict(list)
|
|
396
397
|
|
|
397
|
-
self._pending_returns:
|
|
398
|
+
self._pending_returns: dict[BlockID, PendingJob] = {}
|
|
398
399
|
|
|
399
|
-
self._thumb_addrs:
|
|
400
|
+
self._thumb_addrs: set[int] = set() # set of all addresses that are code in thumb mode
|
|
400
401
|
|
|
401
|
-
self._final_address:
|
|
402
|
+
self._final_address: int | None = (
|
|
402
403
|
None # Address of the very last instruction. The analysis is terminated there.
|
|
403
404
|
)
|
|
404
405
|
|
|
405
|
-
self._function_merge_points:
|
|
406
|
-
self._function_widening_points:
|
|
407
|
-
self._function_node_addrs:
|
|
406
|
+
self._function_merge_points: dict[int, list[int]] = {}
|
|
407
|
+
self._function_widening_points: dict[int, list[int]] = {}
|
|
408
|
+
self._function_node_addrs: dict[int, list[int]] = {} # sorted in reverse post-order
|
|
408
409
|
|
|
409
410
|
self._mergeable_plugins = ("memory", "registers")
|
|
410
411
|
|
|
411
|
-
self._task_stack:
|
|
412
|
+
self._task_stack: list[FunctionAnalysis] = []
|
|
412
413
|
|
|
413
414
|
self._tracing_times: DefaultDict[BlockID, int] = defaultdict(int)
|
|
414
415
|
|
|
@@ -427,7 +428,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
427
428
|
return self._task_stack[-1].function_address
|
|
428
429
|
|
|
429
430
|
@property
|
|
430
|
-
def _top_task(self) ->
|
|
431
|
+
def _top_task(self) -> FunctionAnalysis | None:
|
|
431
432
|
"""
|
|
432
433
|
Get the first task in the stack.
|
|
433
434
|
|
|
@@ -462,7 +463,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
462
463
|
# Public methods
|
|
463
464
|
#
|
|
464
465
|
|
|
465
|
-
def get_any_node(self, addr: int) ->
|
|
466
|
+
def get_any_node(self, addr: int) -> VFGNode | None:
|
|
466
467
|
"""
|
|
467
468
|
Get any VFG node corresponding to the basic block at @addr.
|
|
468
469
|
Note that depending on the context sensitivity level, there might be
|
|
@@ -610,7 +611,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
610
611
|
|
|
611
612
|
# return self._cfg.get_topological_order(self._cfg.get_node(job.block_id))
|
|
612
613
|
|
|
613
|
-
def _job_key(self, job: VFGJob) ->
|
|
614
|
+
def _job_key(self, job: VFGJob) -> BlockID | None:
|
|
614
615
|
"""
|
|
615
616
|
Return the block ID of the job. Two or more jobs owning the same block ID will be merged together.
|
|
616
617
|
|
|
@@ -735,7 +736,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
735
736
|
|
|
736
737
|
self._graph_add_edge(src_block_id, block_id, jumpkind=job.jumpkind, src_exit_stmt_idx=src_exit_stmt_idx)
|
|
737
738
|
|
|
738
|
-
def _get_successors(self, job: VFGJob) ->
|
|
739
|
+
def _get_successors(self, job: VFGJob) -> list[SimState]:
|
|
739
740
|
# Extract initial values
|
|
740
741
|
state = job.state
|
|
741
742
|
addr = job.addr
|
|
@@ -743,7 +744,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
743
744
|
# Obtain successors
|
|
744
745
|
if addr not in self._avoid_runs:
|
|
745
746
|
assert job.sim_successors is not None
|
|
746
|
-
all_successors:
|
|
747
|
+
all_successors: list["SimState"] = (
|
|
747
748
|
job.sim_successors.flat_successors + job.sim_successors.unconstrained_successors
|
|
748
749
|
)
|
|
749
750
|
else:
|
|
@@ -809,8 +810,8 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
809
810
|
return all_successors
|
|
810
811
|
|
|
811
812
|
def _handle_successor(
|
|
812
|
-
self, job: VFGJob, successor: SimState, all_successors:
|
|
813
|
-
) ->
|
|
813
|
+
self, job: VFGJob, successor: SimState, all_successors: list[SimState]
|
|
814
|
+
) -> list[VFGJob | Any]: # pylint:disable=arguments-renamed
|
|
814
815
|
"""
|
|
815
816
|
Process each successor generated by the job, and return a new list of succeeding jobs.
|
|
816
817
|
|
|
@@ -999,7 +1000,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
999
1000
|
return new_jobs
|
|
1000
1001
|
|
|
1001
1002
|
def _post_job_handling(
|
|
1002
|
-
self, job: VFGJob, new_jobs:
|
|
1003
|
+
self, job: VFGJob, new_jobs: list[VFGJob | Any], successors: list[SimState]
|
|
1003
1004
|
) -> None: # pylint:disable=unused-argument
|
|
1004
1005
|
# Debugging output
|
|
1005
1006
|
if l.level == logging.DEBUG:
|
|
@@ -1261,7 +1262,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
1261
1262
|
# Helper methods
|
|
1262
1263
|
#
|
|
1263
1264
|
|
|
1264
|
-
def _prepare_initial_state(self, function_start: int, state:
|
|
1265
|
+
def _prepare_initial_state(self, function_start: int, state: SimState | None) -> SimState:
|
|
1265
1266
|
"""
|
|
1266
1267
|
Get the state to start the analysis for function.
|
|
1267
1268
|
|
|
@@ -1404,7 +1405,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
1404
1405
|
|
|
1405
1406
|
return self._nodes[block_id]
|
|
1406
1407
|
|
|
1407
|
-
def _graph_add_edge(self, src_block_id:
|
|
1408
|
+
def _graph_add_edge(self, src_block_id: BlockID | None, dst_block_id: BlockID, **kwargs) -> None:
|
|
1408
1409
|
"""
|
|
1409
1410
|
Add an edge onto the graph.
|
|
1410
1411
|
|
|
@@ -1429,7 +1430,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
1429
1430
|
# Other methods
|
|
1430
1431
|
#
|
|
1431
1432
|
|
|
1432
|
-
def _get_simsuccessors(self, state: SimState, addr: int) ->
|
|
1433
|
+
def _get_simsuccessors(self, state: SimState, addr: int) -> tuple[SimSuccessors, bool, bool]:
|
|
1433
1434
|
error_occured = False
|
|
1434
1435
|
restart_analysis = False
|
|
1435
1436
|
|
|
@@ -1474,7 +1475,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
1474
1475
|
|
|
1475
1476
|
def _create_new_jobs(
|
|
1476
1477
|
self, job: VFGJob, successor: "SimState", new_block_id: BlockID, new_call_stack: CallStack
|
|
1477
|
-
) ->
|
|
1478
|
+
) -> list[VFGJob | Any]:
|
|
1478
1479
|
"""
|
|
1479
1480
|
Create a list of new VFG jobs for the successor state.
|
|
1480
1481
|
|
|
@@ -1740,7 +1741,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis): # pyl
|
|
|
1740
1741
|
return reg_sp_si
|
|
1741
1742
|
|
|
1742
1743
|
def _create_callstack(
|
|
1743
|
-
self, job: VFGJob, successor_ip: int, jumpkind: str, fakeret_successor:
|
|
1744
|
+
self, job: VFGJob, successor_ip: int, jumpkind: str, fakeret_successor: SimState | None
|
|
1744
1745
|
) -> CallStack:
|
|
1745
1746
|
addr = job.addr
|
|
1746
1747
|
|
angr/analyses/xrefs.py
CHANGED
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
from typing import Optional
|
|
2
1
|
from collections import defaultdict
|
|
3
2
|
|
|
4
3
|
import claripy
|
|
@@ -40,7 +39,7 @@ class SimEngineXRefsVEX(
|
|
|
40
39
|
)
|
|
41
40
|
|
|
42
41
|
@staticmethod
|
|
43
|
-
def extract_value_if_concrete(expr) ->
|
|
42
|
+
def extract_value_if_concrete(expr) -> int | None:
|
|
44
43
|
"""
|
|
45
44
|
Extract the concrete value from expr if it is a concrete claripy AST.
|
|
46
45
|
|
angr/angrdb/db.py
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
from typing import
|
|
1
|
+
from typing import Any, TYPE_CHECKING
|
|
2
2
|
import time
|
|
3
3
|
from contextlib import contextmanager
|
|
4
4
|
|
|
@@ -90,7 +90,7 @@ class AngrDB:
|
|
|
90
90
|
return None
|
|
91
91
|
return db_info.value
|
|
92
92
|
|
|
93
|
-
def update_dbinfo(self, session, extra_info:
|
|
93
|
+
def update_dbinfo(self, session, extra_info: dict[str, str] | None = None):
|
|
94
94
|
"""
|
|
95
95
|
Update the information in database.
|
|
96
96
|
|
|
@@ -105,7 +105,7 @@ class AngrDB:
|
|
|
105
105
|
for key, value in extra_info.items():
|
|
106
106
|
self.save_info(session, str(key), str(value))
|
|
107
107
|
|
|
108
|
-
def get_dbinfo(self, session, extra_info:
|
|
108
|
+
def get_dbinfo(self, session, extra_info: dict[str, str] | None = None):
|
|
109
109
|
"""
|
|
110
110
|
Get database information.
|
|
111
111
|
|
|
@@ -145,7 +145,7 @@ class AngrDB:
|
|
|
145
145
|
|
|
146
146
|
return version == self.VERSION
|
|
147
147
|
|
|
148
|
-
def dump(self, db_path, kbs:
|
|
148
|
+
def dump(self, db_path, kbs: list["KnowledgeBase"] | None = None, extra_info: dict[str, Any] | None = None):
|
|
149
149
|
db_str = "sqlite:///%s" % db_path
|
|
150
150
|
|
|
151
151
|
with self.open_db(db_str) as Session:
|
|
@@ -166,9 +166,9 @@ class AngrDB:
|
|
|
166
166
|
def load(
|
|
167
167
|
self,
|
|
168
168
|
db_path: str,
|
|
169
|
-
kb_names:
|
|
170
|
-
other_kbs:
|
|
171
|
-
extra_info:
|
|
169
|
+
kb_names: list[str] | None = None,
|
|
170
|
+
other_kbs: dict[str, "KnowledgeBase"] | None = None,
|
|
171
|
+
extra_info: dict[str, Any] | None = None,
|
|
172
172
|
):
|
|
173
173
|
db_str = "sqlite:///%s" % db_path
|
|
174
174
|
|
angr/angrdb/serializers/kb.py
CHANGED
|
@@ -90,18 +90,21 @@ class KnowledgeBaseSerializer:
|
|
|
90
90
|
if structured_code is not None:
|
|
91
91
|
kb.structured_code = structured_code
|
|
92
92
|
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
93
|
+
if cfg_model is not None:
|
|
94
|
+
# CFG may not exist for all knowledge bases
|
|
95
|
+
|
|
96
|
+
# fill in CFGNode.function_address
|
|
97
|
+
for func in funcs.values():
|
|
98
|
+
for block_addr in func.block_addrs_set:
|
|
99
|
+
node = cfg_model.get_any_node(block_addr)
|
|
100
|
+
if node is not None:
|
|
101
|
+
node.function_address = func.addr
|
|
102
|
+
|
|
103
|
+
# re-initialize CFGModel.insn_addr_to_memory_data
|
|
104
|
+
# fill in insn_addr_to_memory_data
|
|
105
|
+
for xrefs in xrefs.xrefs_by_ins_addr.values():
|
|
106
|
+
for xref in xrefs:
|
|
107
|
+
if xref.ins_addr is not None and xref.memory_data is not None:
|
|
108
|
+
cfg_model.insn_addr_to_memory_data[xref.ins_addr] = xref.memory_data
|
|
106
109
|
|
|
107
110
|
return kb
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
from io import BytesIO
|
|
2
|
-
from typing import List
|
|
3
2
|
|
|
4
3
|
import cle
|
|
5
4
|
|
|
@@ -58,7 +57,7 @@ class LoaderSerializer:
|
|
|
58
57
|
all_objects = {} # path to object
|
|
59
58
|
main_object = None
|
|
60
59
|
|
|
61
|
-
db_objects:
|
|
60
|
+
db_objects: list[DbObject] = session.query(DbObject)
|
|
62
61
|
|
|
63
62
|
for db_o in db_objects:
|
|
64
63
|
all_objects[db_o.path] = db_o
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
from typing import
|
|
1
|
+
from typing import Any, TYPE_CHECKING
|
|
2
2
|
import json
|
|
3
3
|
import pickle
|
|
4
4
|
|
|
@@ -64,7 +64,7 @@ class StructuredCodeManagerSerializer:
|
|
|
64
64
|
session.add(db_code)
|
|
65
65
|
|
|
66
66
|
@staticmethod
|
|
67
|
-
def dict_strkey_to_intkey(d:
|
|
67
|
+
def dict_strkey_to_intkey(d: dict[str, Any]) -> dict[int, Any]:
|
|
68
68
|
new_d = {}
|
|
69
69
|
|
|
70
70
|
for key, value in d.items():
|
angr/annocfg.py
CHANGED
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
from collections import defaultdict
|
|
2
|
-
from typing import Dict, List, Union
|
|
3
2
|
import logging
|
|
4
3
|
|
|
5
4
|
import networkx
|
|
@@ -30,7 +29,7 @@ class AnnotatedCFG:
|
|
|
30
29
|
self._cfg = None
|
|
31
30
|
self._target = None
|
|
32
31
|
|
|
33
|
-
self._run_statement_whitelist:
|
|
32
|
+
self._run_statement_whitelist: dict[int, list[int] | bool] = defaultdict(list)
|
|
34
33
|
self._exit_taken = defaultdict(list)
|
|
35
34
|
self._addr_to_run = {}
|
|
36
35
|
self._addr_to_last_stmt_id = {}
|
angr/block.py
CHANGED
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
# pylint:disable=wrong-import-position,arguments-differ
|
|
2
2
|
import logging
|
|
3
|
-
from typing import List, Optional, Tuple
|
|
4
3
|
|
|
5
4
|
import pyvex
|
|
6
5
|
from pyvex import IRSB
|
|
@@ -151,6 +150,7 @@ class Block(Serializable):
|
|
|
151
150
|
project=None,
|
|
152
151
|
arch=None,
|
|
153
152
|
size=None,
|
|
153
|
+
max_size=None,
|
|
154
154
|
byte_string=None,
|
|
155
155
|
vex=None,
|
|
156
156
|
thumb=False,
|
|
@@ -164,6 +164,7 @@ class Block(Serializable):
|
|
|
164
164
|
cross_insn_opt=True,
|
|
165
165
|
load_from_ro_regions=False,
|
|
166
166
|
initial_regs=None,
|
|
167
|
+
skip_stmts=False,
|
|
167
168
|
):
|
|
168
169
|
# set up arch
|
|
169
170
|
if project is not None:
|
|
@@ -189,7 +190,7 @@ class Block(Serializable):
|
|
|
189
190
|
self.thumb = thumb
|
|
190
191
|
self.addr = addr
|
|
191
192
|
self._opt_level = opt_level
|
|
192
|
-
self._initial_regs:
|
|
193
|
+
self._initial_regs: list[tuple[int, int, int]] | None = initial_regs if collect_data_refs else None
|
|
193
194
|
|
|
194
195
|
if self._project is None and byte_string is None:
|
|
195
196
|
raise ValueError('"byte_string" has to be specified if "project" is not provided.')
|
|
@@ -207,6 +208,7 @@ class Block(Serializable):
|
|
|
207
208
|
state=backup_state,
|
|
208
209
|
insn_bytes=byte_string,
|
|
209
210
|
addr=addr,
|
|
211
|
+
size=max_size,
|
|
210
212
|
thumb=thumb,
|
|
211
213
|
extra_stop_points=extra_stop_points,
|
|
212
214
|
opt_level=opt_level,
|
|
@@ -216,13 +218,18 @@ class Block(Serializable):
|
|
|
216
218
|
collect_data_refs=collect_data_refs,
|
|
217
219
|
load_from_ro_regions=load_from_ro_regions,
|
|
218
220
|
cross_insn_opt=cross_insn_opt,
|
|
221
|
+
skip_stmts=skip_stmts,
|
|
219
222
|
)
|
|
220
223
|
if self._initial_regs:
|
|
221
224
|
self.reset_initial_regs()
|
|
222
225
|
size = vex.size
|
|
223
226
|
|
|
224
|
-
|
|
225
|
-
|
|
227
|
+
if skip_stmts:
|
|
228
|
+
self._vex = None
|
|
229
|
+
self._vex_nostmt = vex
|
|
230
|
+
else:
|
|
231
|
+
self._vex = vex
|
|
232
|
+
self._vex_nostmt = None
|
|
226
233
|
self._disassembly = None
|
|
227
234
|
self._capstone = None
|
|
228
235
|
self.size = size
|
|
@@ -232,9 +239,12 @@ class Block(Serializable):
|
|
|
232
239
|
self._load_from_ro_regions = load_from_ro_regions
|
|
233
240
|
|
|
234
241
|
self._instructions = num_inst
|
|
235
|
-
self._instruction_addrs:
|
|
242
|
+
self._instruction_addrs: list[int] = []
|
|
236
243
|
|
|
237
|
-
|
|
244
|
+
if skip_stmts:
|
|
245
|
+
self._parse_vex_info(self._vex_nostmt)
|
|
246
|
+
else:
|
|
247
|
+
self._parse_vex_info(self._vex)
|
|
238
248
|
|
|
239
249
|
if byte_string is None:
|
|
240
250
|
if backup_state is not None:
|