angr 9.2.103__py3-none-macosx_11_0_arm64.whl

angr/analyses/disassembly_utils.py

@@ -0,0 +1,104 @@
+import capstone as cs
+import logging
+
+from archinfo.arch_arm import is_arm_arch
+
+from ..misc.ux import once
+
+l = logging.getLogger(name=__name__)
+
+
+INS_GROUP_INFO = {
+    "X86": {
+        cs.x86.X86_GRP_CALL: "call",
+        cs.x86.X86_GRP_JUMP: "branch",
+        cs.x86.X86_GRP_RET: "return",
+    },
+    "AMD64": {
+        cs.x86.X86_GRP_CALL: "call",
+        cs.x86.X86_GRP_JUMP: "branch",
+        cs.x86.X86_GRP_RET: "return",
+    },
+    "ARM": {
+        cs.arm.ARM_GRP_CALL: "call",
+        cs.arm.ARM_GRP_BRANCH_RELATIVE: "branch",
+        cs.arm.ARM_GRP_JUMP: "branch",
+    },
+}
+
+INS_GROUP_INFO["ARMEL"] = INS_GROUP_INFO["ARM"]
+INS_GROUP_INFO["ARMHF"] = INS_GROUP_INFO["ARM"]
+INS_GROUP_INFO["ARMCortexM"] = INS_GROUP_INFO["ARM"]
+
+
+try:
+    INS_GROUP_INFO["MIPS32"] = {
+        cs.mips.MIPS_GRP_CALL: "call",
+        cs.mips.MIPS_GRP_JUMP: "branch",
+        cs.mips.MIPS_GRP_RET: "return",
+    }
+except AttributeError:
+    # The installed capstone is too old - it does not support cs.mips.MIPS_GRP_*
+    pass
+
+
+INS_INFO = {
+    "MIPS32": {
+        cs.mips.MIPS_INS_JAL: "call",
+        cs.mips.MIPS_INS_BAL: "branch",
+    }
+}
+
+
+def decode_instruction(arch, instr):
+    # this is clearly architecture specific
+
+    arch_name = arch.name
+    if arch_name == "MIPS32" and once("mips-instruction-groups"):
+        l.warning("Your version of capstone does not support MIPS instruction groups.")
+
+    insn_info = None
+
+    info = INS_GROUP_INFO.get(arch_name, None)
+    if info is not None:
+        for group in instr.insn.insn.groups:
+            insn_info = info.get(group, None)
+            if insn_info is not None:
+                break
+
+    if insn_info is None:
+        info = INS_INFO.get(arch_name, None)
+        if info is not None:
+            insn_info = info.get(instr.insn.insn.id, None)
+
+    if insn_info is None:
+        return
+
+    instr.type = insn_info
+
+    if instr.type in ("call", "branch"):
+        # determine if this is a direct or indirect call/branch
+        if arch_name in ("X86", "AMD64"):
+            last_operand = instr.insn.operands[-1]
+            if last_operand.type == cs.x86.X86_OP_IMM:
+                instr.branch_type = "direct"
+            else:
+                instr.branch_type = "indirect"
+            instr.branch_target_operand = len(instr.insn.operands) - 1
+
+        elif is_arm_arch(arch):
+            last_operand = instr.insn.operands[-1]
+            if last_operand.type == cs.arm.ARM_OP_IMM:
+                instr.branch_type = "direct"
+            else:
+                instr.branch_type = "indirect"
+            instr.branch_target_operand = len(instr.insn.operands) - 1
+
+        elif arch_name == "MIPS32":
+            # check the last operand
+            last_operand = instr.insn.operands[-1]
+            if last_operand.type == cs.mips.MIPS_OP_REG:
+                instr.branch_type = "indirect"
+            else:
+                instr.branch_type = "direct"
+            instr.branch_target_operand = len(instr.insn.operands) - 1

angr/analyses/dominance_frontier.py

@@ -0,0 +1,39 @@
+from ..utils.graph import compute_dominance_frontier, Dominators
+from .analysis import Analysis
+from . import register_analysis
+
+
+class DominanceFrontier(Analysis):
+    """
+    Computes the dominance frontier of all nodes in a function graph, and provides an easy-to-use interface for
+    querying the frontier information.
+    """
+
+    def __init__(self, func, exception_edges=False):
+        self.function = func
+        self._exception_edges = exception_edges
+
+        self.frontiers = None
+
+        self._compute()
+
+    def _get_graph(self):
+        g = self.function.graph_ex(exception_edges=self._exception_edges)
+        return g
+
+    def _compute(self):
+        g = self._get_graph()
+
+        # Compute the dominator tree
+        if self.function.startpoint is None:
+            # The function might be empty or is corrupted (maybe the object is created manually)
+            raise TypeError("Startpoint of function %s is None. Is this function empty?" % repr(self.function))
+        doms = Dominators(g, self.function.startpoint)
+
+        # Compute the dominance frontier
+        dom_frontiers = compute_dominance_frontier(g, doms.dom)
+
+        self.frontiers = dom_frontiers
+
+
+register_analysis(DominanceFrontier, "DominanceFrontier")

angr/analyses/find_objects_static.py

@@ -0,0 +1,203 @@
+from typing import TYPE_CHECKING
+from collections import defaultdict
+
+import claripy
+
+from ..analyses import AnalysesHub
+from ..analyses.reaching_definitions.function_handler import FunctionHandler
+from ..knowledge_plugins.key_definitions.atoms import Register, MemoryLocation
+from ..storage.memory_mixins.paged_memory.pages.multi_values import MultiValues
+from ..knowledge_plugins.key_definitions.constants import OP_BEFORE, OP_AFTER
+from . import Analysis, VtableFinder, CFGFast, ReachingDefinitionsAnalysis
+
+if TYPE_CHECKING:
+    from angr.analyses.reaching_definitions.function_handler import FunctionCallData
+    from angr.analyses.reaching_definitions.rd_state import ReachingDefinitionsState
+
+
+class PossibleObject:
+    """
+    This holds the address and class name of possible class instances.
+    The address that it holds in mapped outside the binary so it is only valid in this analysis.
+    TO DO: map the address to its uses in the registers/memory locations in the instructions
+    """
+
+    def __init__(self, size, addr, class_name=None):
+        self.size = size
+        # This address is only valid during RDA as we map new objects outside the already mapped region
+        self.addr = addr
+        self.class_name = class_name
+
+    def __hash__(self):
+        return hash((self.addr, self.size, self.class_name))
+
+    def __eq__(self, other):
+        return self.size == other.size and self.addr == other.size and self.class_name == other.class_name
+
+
+class NewFunctionHandler(FunctionHandler):
+    """
+    This handles calls to the function new(), by recording the size parameter passed to it and also assigns a new
+     address outside the mapped binary to the newly created space(possible object).
+
+     It also tracks if the function called right after new() is passed the same 'this' pointer and is a constructor,
+     if so we mark it as an instance of the class the constructor belongs to.(only for non stripped binaries)
+    """
+
+    def __init__(self, max_addr=None, new_func_addr=None, project=None):
+        super().__init__()
+        self.max_addr = max_addr
+
+        # this is a map between an object addr outside the mapped binary and PossibleObject instance
+        self.possible_objects_dict = {}
+
+        # address of the new() function
+        self.new_func_addr = new_func_addr
+        self.project = project
+
+    def hook(self, analysis):
+        return self
+
+    def handle_local_function(
+        self,
+        state: "ReachingDefinitionsState",
+        data: "FunctionCallData",
+    ):
+        function_address = data.address
+        if function_address == self.new_func_addr:
+            word_size = self.project.arch.bits // self.project.arch.byte_width
+            # check if this is a call to new()
+            # reading from rdi for the size argument passed to new()
+            cc = self.project.kb.functions[function_address].calling_convention
+            if cc is not None:
+                size_arg_reg_offset = self.project.arch.registers[cc.args[0].reg_name][0]
+                size_arg_reg_size = cc.args[0].size
+            else:
+                size_arg_reg_offset = self.project.arch.registers["rdi"][0]
+                size_arg_reg_size = word_size
+            v0 = state.registers.load(size_arg_reg_offset, size_arg_reg_size).one_value()
+            size = v0.concrete_value if v0 is not None and v0.concrete else None
+
+            if size is not None:
+                # None since we do not know it's class yet, it is a possible this pointer
+                self.possible_objects_dict[self.max_addr] = PossibleObject(size, self.max_addr)
+
+            # assigning eax a concrete address to track the possible this pointer
+            if cc is not None:
+                ret_val_reg_offset = self.project.arch.registers[cc.return_val.reg_name][0]
+                ret_val_reg_size = cc.return_val.size
+            else:
+                ret_val_reg_offset = self.project.arch.registers["rax"][0]
+                ret_val_reg_size = word_size
+            atom = Register(ret_val_reg_offset, ret_val_reg_size)
+            data.depends(
+                atom,
+                value=MultiValues(
+                    offset_to_values={0: {claripy.BVV(self.max_addr, word_size * state.arch.byte_width)}}
+                ),
+            )
+            # setting the values pointed by rax to zero
+            memory_location = MemoryLocation(self.max_addr, size)
+            offset_to_values = {}
+
+            for offset in range(0, size, word_size):
+                offset_to_values[offset] = {claripy.BVV(0, word_size * state.arch.byte_width)}
+            data.depends(memory_location, value=MultiValues(offset_to_values=offset_to_values))
+            self.max_addr += size
+
+        else:
+            if self.project.kb.functions.contains_addr(function_address):
+                func = self.project.kb.functions.get_by_addr(function_address)
+                if func is not None and "ctor" in func.demangled_name:
+                    # check if rdi has a possible this pointer/ object address, if so then we can assign this object
+                    # this class
+                    # also if the func is a constructor(not stripped binaries)
+                    for addr, possible_object in self.possible_objects_dict.items():
+                        v1 = state.registers.load(72, state.arch.bits // state.arch.byte_width).one_value()
+                        obj_addr = v1.concrete_value if v1 is not None and v1.concrete else None
+                        if obj_addr is not None and addr == obj_addr:
+                            col_ind = self.project.kb.functions[function_address].demangled_name.rfind("::")
+                            class_name = self.project.kb.functions[function_address].demangled_name[:col_ind]
+                            possible_object.class_name = class_name
+
+
+class StaticObjectFinder(Analysis):
+    """
+    This analysis tries to find objects on the heap based on calls to new(), and subsequent calls to constructors with
+     the 'this' pointer
+    """
+
+    def __init__(self):
+        vtable_analysis = self.project.analyses[VtableFinder].prep()()
+        self.vtables_list = vtable_analysis.vtables_list
+        self.possible_objects = {}
+
+        # for stripped binaries
+        # This is a mapping between the constructors and the objects that use them
+        self.possible_constructors = defaultdict(list)
+
+        self._analyze()
+
+    def _analyze(self):
+        if "CFGFast" not in self.project.kb.cfgs:
+            self.project.analyses[CFGFast].prep()(cross_references=True)
+        all_functions = self.project.kb.functions
+        # this is the addr where all the this pointers returned by new() will be pointing to
+        max_addr = self.project.loader.main_object.max_addr + 8
+        new_func_addr = self.project.kb.functions["_Znwm"].addr
+        for func in all_functions.values():
+            if func.is_simprocedure:
+                continue
+
+            cc = func.calling_convention
+            word_size = self.project.arch.bits // self.project.arch.byte_width
+            # the map fo this ptrs
+            newhandler = NewFunctionHandler(max_addr=max_addr, new_func_addr=new_func_addr, project=self.project)
+            max_addr = newhandler.max_addr
+            # this performs RDA as well as mark possible object instances for non stripped binaries
+            rd = self.project.analyses[ReachingDefinitionsAnalysis].prep()(
+                func, observe_all=True, function_handler=newhandler
+            )
+            for addr, pos_obj in newhandler.possible_objects_dict.items():
+                self.possible_objects[addr] = pos_obj
+
+            # for stripped binary we check if the first function called after new(),
+            # is passed the this pointer(returned by new)...
+            # if so then we say that it is possibly a constructor
+            for node in func.graph.nodes():
+                if func.get_call_target(node.addr) == new_func_addr:
+                    ret_node_addr = func.get_call_return(node.addr)
+                    ret_node = self.project.factory.block(ret_node_addr)
+                    call_after_new_addr = func.get_call_target(ret_node_addr)
+                    rd_before_node = rd.get_reaching_definitions_by_node(ret_node_addr, OP_BEFORE)
+
+                    if cc is not None:
+                        ret_val_reg_offset = self.project.arch.registers[cc.return_val.reg_name][0]
+                        ret_val_reg_size = cc.return_val.size
+                    else:
+                        ret_val_reg_offset = self.project.arch.registers["rax"][0]
+                        ret_val_reg_size = word_size
+                    v0 = rd_before_node.registers.load(ret_val_reg_offset, ret_val_reg_size).one_value()
+                    addr_of_new_obj = v0.concrete_value if v0 is not None and v0.concrete else None
+
+                    # we need the state right before the call
+                    if ret_node.vex.jumpkind == "Ijk_Call" and ret_node.vex.instruction_addresses:
+                        last_ins_addr = ret_node.instruction_addrs[-1]
+                        rd_after_node = rd.get_reaching_definitions_by_insn(last_ins_addr, OP_BEFORE)
+                    else:
+                        rd_after_node = rd.get_reaching_definitions_by_insn(ret_node_addr, OP_AFTER)
+
+                    if cc is not None:
+                        this_ptr_reg_offset = self.project.arch.registers[cc.args[0].reg_name][0]
+                        this_ptr_reg_size = cc.args[0].size
+                    else:
+                        this_ptr_reg_offset = self.project.arch.registers["rdi"][0]
+                        this_ptr_reg_size = word_size
+                    v1 = rd_after_node.registers.load(this_ptr_reg_offset, this_ptr_reg_size).one_value()
+                    addr_in_rdi = v1.concrete_value if v1 is not None and v1.concrete else None
+
+                    if addr_of_new_obj is not None and addr_of_new_obj == addr_in_rdi:
+                        self.possible_constructors[call_after_new_addr].append(self.possible_objects[addr_of_new_obj])
+
+
+AnalysesHub.register_default("StaticObjectFinder", StaticObjectFinder)

angr/analyses/flirt.py

@@ -0,0 +1,185 @@
+from typing import TYPE_CHECKING
+from functools import partial
+from collections import defaultdict
+import logging
+
+import nampa
+from archinfo.arch_arm import is_arm_arch
+
+from ..analyses import AnalysesHub
+from ..flirt import FlirtSignature, STRING_TO_LIBRARIES, LIBRARY_TO_SIGNATURES, FLIRT_SIGNATURES_BY_ARCH
+from .analysis import Analysis
+
+if TYPE_CHECKING:
+    from angr.knowledge_plugins.functions import Function
+
+
+_l = logging.getLogger(name=__name__)
+
+
+MAX_UNIQUE_STRING_LEN = 70
+
+
+class FlirtAnalysis(Analysis):
+    """
+    FlirtAnalysis accomplishes two purposes:
+
+    - If a FLIRT signature file is specified, it will match the given signature file against the current binary and
+      rename recognized functions accordingly.
+    - If no FLIRT signature file is specified, it will use strings to determine possible libraries embedded in the
+      current binary, and then match all possible signatures for the architecture.
+    """
+
+    def __init__(self, sig: FlirtSignature | str | None = None):
+        self._is_arm = is_arm_arch(self.project.arch)
+        self._all_suggestions: dict[str, dict[str, dict[int, str]]] = {}
+        self._suggestions: dict[int, str] = {}
+        self.matched_suggestions: dict[str, tuple[FlirtSignature, dict[int, str]]] = {}
+        self._temporary_sig = False
+
+        if sig:
+            if isinstance(sig, str):
+                # this is a file path
+                sig = FlirtSignature(
+                    self.project.arch.name.lower(), self.project.simos.name.lower(), "Temporary", sig, None
+                )
+
+                self.signatures = [sig]
+                self._temporary_sig = True
+
+        else:
+            if not FLIRT_SIGNATURES_BY_ARCH:
+                raise RuntimeError(
+                    "No FLIRT signatures exist. Please load FLIRT signatures by calling "
+                    "load_signatures() before running FlirtAnalysis."
+                )
+
+            # determine all signatures to match against strings in mapped memory regions
+            mem_regions = [
+                self.project.loader.memory.load(seg.vaddr, seg.memsize)
+                for seg in self.project.loader.main_object.segments
+                if seg.filesize > 0 and seg.memsize > 0
+            ]
+
+            self.signatures = list(self._find_hits_by_strings(mem_regions))
+            _l.debug("Identified %d signatures to apply.", len(self.signatures))
+
+        path_to_sig: dict[str, FlirtSignature] = {}
+        for sig_ in self.signatures:
+            self._match_all_against_one_signature(sig_)
+            if sig_.sig_name not in self._all_suggestions:
+                self._all_suggestions[sig_.sig_name] = {}
+            path_to_sig[sig_.sig_path] = sig_
+            self._all_suggestions[sig_.sig_name][sig_.sig_path] = self._suggestions
+            self._suggestions = {}
+
+        for lib, sig_to_suggestions in self._all_suggestions.items():
+            max_suggestions = None
+            max_suggestion_sig_path = None
+            for sig_, suggestion in sig_to_suggestions.items():
+                _l.debug("Signature %s has %d function name suggestions.", sig_, len(suggestion))
+                if max_suggestions is None or len(suggestion) > max_suggestions:
+                    max_suggestion_sig_path = sig_
+                    max_suggestions = len(suggestion)
+
+            if max_suggestion_sig_path is not None:
+                sig_ = path_to_sig.get(max_suggestion_sig_path, None)
+                _l.info("Applying FLIRT signature %s for library %s.", sig_, lib)
+                self._apply_changes(
+                    sig_.sig_name if not self._temporary_sig else None, sig_to_suggestions[max_suggestion_sig_path]
+                )
+                self.matched_suggestions[lib] = (sig_, sig_to_suggestions[max_suggestion_sig_path])
+
+    def _find_hits_by_strings(self, regions: list[bytes]) -> list[FlirtSignature]:
+        library_hits: dict[str, int] = defaultdict(int)
+        for s, libs in STRING_TO_LIBRARIES.items():
+            for region in regions:
+                if s.encode("ascii") in region:
+                    for lib in libs:
+                        library_hits[lib] += 1
+
+        # sort libraries based on the number of hits
+        sorted_libraries = sorted(library_hits.keys(), key=lambda lib: library_hits[lib], reverse=True)
+        arch_lowercase = self.project.arch.name.lower()
+
+        for lib in sorted_libraries:
+            for sig in LIBRARY_TO_SIGNATURES[lib]:
+                if sig.arch == arch_lowercase:
+                    yield sig
+                elif sig.arch == "armel" and self._is_arm:
+                    # ARMHF may use ARMEL libraries
+                    yield sig
+
+    def _match_all_against_one_signature(self, sig: FlirtSignature):
+        # match each function
+        self._suggestions = {}
+        with open(sig.sig_path, "rb") as sigfile:
+            flirt = nampa.parse_flirt_file(sigfile)
+            for func in self.project.kb.functions.values():
+                func: "Function"
+                if func.is_simprocedure or func.is_plt:
+                    continue
+                if not func.is_default_name:
+                    # it already has a name. skip
+                    continue
+
+                start = func.addr
+                if self._is_arm:
+                    start = start & 0xFFFF_FFFE
+
+                max_block_addr = max(func.block_addrs_set)
+                end_block = func.get_block(max_block_addr)
+                end = max_block_addr + end_block.size
+
+                if self._is_arm:
+                    end = end & 0xFFFF_FFFE
+
+                # load all bytes
+                func_bytes = self.project.loader.memory.load(start, end - start + 0x100)
+                _callback = partial(self._on_func_matched, func)
+                nampa.match_function(flirt, func_bytes, start, _callback)
+
+    def _on_func_matched(self, func: "Function", base_addr: int, flirt_func: "nampa.FlirtFunction"):
+        func_addr = base_addr + flirt_func.offset
+        _l.debug(
+            "_on_func_matched() is called with func_addr %#x with a suggested name %s.", func_addr, flirt_func.name
+        )
+        if func_addr != base_addr:
+            # get the correct function
+            func = None
+            try:
+                func = self.kb.functions.get_by_addr(func_addr)
+            except KeyError:
+                # the function is not found. Try the THUMB version
+                if self._is_arm:
+                    try:
+                        func = self.kb.functions.get_by_addr(func_addr + 1)
+                    except KeyError:
+                        pass
+
+            if func is None:
+                _l.debug(
+                    "FlirtAnalysis identified a function at %#x but it does not exist in function manager.", func_addr
+                )
+                return
+
+        if func.is_default_name:
+            # set the function name
+            # TODO: Make sure function names do not conflict with existing ones
+            _l.debug("Identified %s @ %#x (%#x-%#x)", flirt_func.name, func_addr, base_addr, flirt_func.offset)
+            if flirt_func.name != "?":
+                func_name = flirt_func.name
+            else:
+                func_name = f"unknown_function_{func.addr:x}"
+            self._suggestions[func.addr] = func_name
+
+    def _apply_changes(self, library_name: str | None, suggestion: dict[int, str]) -> None:
+        for func_addr, suggested_name in suggestion.items():
+            func = self.kb.functions.get_by_addr(func_addr)
+            func.name = suggested_name
+            func.is_default_name = False
+            func.from_signature = "flirt"
+            func.find_declaration(ignore_binary_name=True, binary_name_hint=library_name)
+
+
+AnalysesHub.register_default("Flirt", FlirtAnalysis)

angr/analyses/forward_analysis/__init__.py

@@ -0,0 +1,2 @@
+from .forward_analysis import ForwardAnalysis
+from .visitors import CallGraphVisitor, FunctionGraphVisitor, LoopVisitor, SingleNodeGraphVisitor