angr 9.2.103__py3-none-manylinux2014_aarch64.whl

angr/knowledge_plugins/xrefs/__init__.py

@@ -0,0 +1,3 @@
+from .xref_types import XRefType
+from .xref import XRef
+from .xref_manager import XRefManager

angr/knowledge_plugins/xrefs/xref.py

@@ -0,0 +1,157 @@
+from ...serializable import Serializable
+from ...protos import primitives_pb2
+from .xref_types import XRefType
+
+
+class XRef(Serializable):
+    """
+    XRef describes a reference to a MemoryData instance (if a MemoryData instance is available) or just an address.
+    """
+
+    __slots__ = (
+        "ins_addr",
+        "block_addr",
+        "stmt_idx",
+        "insn_op_idx",
+        "insn_op_type",
+        "memory_data",
+        "dst",
+        "type",
+    )
+
+    def __init__(
+        self,
+        ins_addr: int | None = None,
+        block_addr: int | None = None,
+        stmt_idx: int | None = None,
+        insn_op_idx: int | None = None,
+        memory_data=None,
+        dst: int | None = None,
+        xref_type=None,
+    ):
+        if dst is not None and not isinstance(dst, int):
+            raise TypeError("XRefs must be pointing to a constant target. Target %r is not supported." % dst)
+
+        # src
+        self.ins_addr: int | None = ins_addr
+        self.insn_op_idx: int | None = insn_op_idx
+        self.block_addr: int | None = block_addr
+        self.stmt_idx: int | None = stmt_idx
+
+        # dst
+        self.memory_data = memory_data  # optional
+        self.dst = dst
+        self.type = xref_type
+
+        if memory_data is not None and dst is None:
+            self.dst = memory_data.addr
+
+    @property
+    def type_string(self):
+        return XRefType.to_string(self.type)
+
+    def __repr__(self):
+        if self.dst is not None:
+            if isinstance(self.dst, int):
+                dst_str = hex(self.dst)
+            else:
+                dst_str = str(self.dst)
+        elif self.memory_data is not None:
+            dst_str = hex(self.memory_data.addr)
+        else:
+            dst_str = "unknown"
+        return "<XRef {}: {}->{}>".format(
+            self.type_string,
+            "%#x" % self.ins_addr if self.ins_addr is not None else "%#x[%d]" % (self.block_addr, self.stmt_idx),
+            dst_str,
+        )
+
+    def __eq__(self, other):
+        return (
+            type(other) is XRef
+            and other.type == self.type
+            and other.ins_addr == self.ins_addr
+            and other.dst == self.dst
+        )
+
+    def __hash__(self):
+        return hash((XRef, self.type, self.ins_addr, self.dst))
+
+    @classmethod
+    def _get_cmsg(cls):
+        return primitives_pb2.CodeReference()
+
+    def serialize_to_cmessage(self):
+        # pylint:disable=no-member
+
+        # delayed import
+        from ...engines.light import SpOffset  # pylint:disable=import-outside-toplevel
+
+        cmsg = self._get_cmsg()
+        if self.memory_data is not None:
+            # determine target_type from memory_data.sort
+            if self.memory_data.sort == MemoryDataSort.CodeReference:
+                cmsg.target_type = primitives_pb2.CodeReference.CodeTarget
+            else:
+                cmsg.target_type = primitives_pb2.CodeReference.DataTarget
+
+            cmsg.location = primitives_pb2.CodeReference.Internal
+            cmsg.data_ea = self.memory_data.addr
+        elif self.dst is not None:
+            if isinstance(self.dst, SpOffset):
+                cmsg.target_type = primitives_pb2.CodeReference.StackTarget
+                cmsg.data_ea = self.dst.offset
+            else:
+                cmsg.data_ea = self.dst
+        else:
+            # Unknown... why?
+            cmsg.data_ea = -1
+        if self.insn_op_idx is None:
+            cmsg.operand_idx = -1
+        else:
+            cmsg.operand_idx = self.insn_op_idx
+        cmsg.ea = self.ins_addr
+        cmsg.block_ea = self.block_addr
+        cmsg.stmt_idx = self.stmt_idx
+        cmsg.ref_type = self.type
+        return cmsg
+
+    @classmethod
+    def parse_from_cmessage(cls, cmsg, bits=None, **kwargs):  # pylint:disable=arguments-differ
+        # Note that we cannot recover _memory_data from cmsg
+
+        # delayed import
+        from ...engines.light import SpOffset  # pylint:disable=import-outside-toplevel
+
+        if not isinstance(bits, int):
+            raise TypeError("bits must be provided.")
+
+        if cmsg.target_type == primitives_pb2.CodeReference.StackTarget:  # pylint:disable=no-member
+            dst = SpOffset(bits, cmsg.data_ea, is_base=False)
+        else:
+            dst = cmsg.data_ea
+
+        cr = XRef(
+            ins_addr=cmsg.ea,
+            block_addr=cmsg.block_ea,
+            stmt_idx=cmsg.stmt_idx,
+            insn_op_idx=None if cmsg.operand_idx == -1 else cmsg.opearnd_idx,
+            dst=dst,
+            xref_type=cmsg.ref_type,
+        )
+        return cr
+
+    def copy(self):
+        cr = XRef(
+            ins_addr=self.ins_addr,
+            block_addr=self.block_addr,
+            stmt_idx=self.stmt_idx,
+            insn_op_idx=self.insn_op_idx,
+            memory_data=self.memory_data,
+            dst=self.dst,
+            xref_type=self.type,
+        )
+        return cr
+
+
+from ..cfg.memory_data import MemoryDataSort

angr/knowledge_plugins/xrefs/xref_manager.py

@@ -0,0 +1,122 @@
+import logging
+from collections import defaultdict
+
+from ...serializable import Serializable
+from ...protos import xrefs_pb2
+from ..plugin import KnowledgeBasePlugin
+from .xref import XRef, XRefType
+
+
+l = logging.getLogger(name=__name__)
+
+
+class XRefManager(KnowledgeBasePlugin, Serializable):
+    def __init__(self, kb):
+        super().__init__(kb=kb)
+
+        self.xrefs_by_ins_addr: dict[int, set[XRef]] = defaultdict(set)
+        self.xrefs_by_dst: dict[int, set[XRef]] = defaultdict(set)
+
+    def copy(self):
+        xm = XRefManager(self._kb)
+        xm.xrefs_by_ins_addr = self.xrefs_by_ins_addr.copy()
+        xm.xrefs_by_dst = self.xrefs_by_dst.copy()
+        return xm
+
+    def add_xref(self, xref):
+        to_remove = set()
+        # Overwrite existing "offset" refs
+        if xref.type != XRefType.Offset:
+            existing = self.get_xrefs_by_ins_addr(xref.ins_addr)
+            if existing:
+                for ex in existing:
+                    if ex.dst == xref.dst and ex.type == XRefType.Offset:
+                        # We want to remove this one and replace it with the new one
+                        to_remove.add(ex)
+
+        d0 = self.xrefs_by_ins_addr[xref.ins_addr]
+        d0.add(xref)
+        d1 = self.xrefs_by_dst[xref.dst]
+        d1.add(xref)
+
+        for ex in to_remove:
+            d0.discard(ex)
+            d1.discard(ex)
+
+    def add_xrefs(self, xrefs):
+        for xref in xrefs:
+            self.add_xref(xref)
+
+    def get_xrefs_by_ins_addr(self, ins_addr):
+        return self.xrefs_by_ins_addr.get(ins_addr, set())
+
+    def get_xrefs_by_dst(self, dst):
+        return self.xrefs_by_dst.get(dst, set())
+
+    def get_xrefs_by_dst_region(self, start, end):
+        """
+        Get a set of XRef objects that point to a given address region
+        bounded by start and end.
+        Will only return absolute xrefs, not relative ones (like SP offsets)
+        """
+
+        def f(x):
+            return isinstance(x, int) and start <= x <= end
+
+        addrs = filter(f, self.xrefs_by_dst.keys())
+        refs = set()
+        for addr in addrs:
+            refs = refs.union(self.xrefs_by_dst[addr])
+        return refs
+
+    def get_xrefs_by_ins_addr_region(self, start, end) -> set[XRef]:
+        """
+        Get a set of XRef objects that originate at a given address region
+        bounded by start and end.  Useful for finding references from a basic block or function.
+        """
+
+        def f(x):
+            return isinstance(x, int) and start <= x <= end
+
+        addrs = filter(f, self.xrefs_by_ins_addr.keys())
+        refs = set()
+        for addr in addrs:
+            refs = refs.union(self.xrefs_by_ins_addr[addr])
+        return refs
+
+    # TODO: Maybe add some helpers that accept Function or Block objects for the sake of clean analyses.
+
+    @classmethod
+    def _get_cmsg(cls):
+        return xrefs_pb2.XRefs()
+
+    def serialize_to_cmessage(self):
+        # pylint:disable=no-member
+        cmsg = self._get_cmsg()
+        # references
+        refs = []
+        for ref_set in self.xrefs_by_ins_addr.values():
+            for ref in ref_set:
+                refs.append(ref.serialize_to_cmessage())
+        cmsg.xrefs.extend(refs)
+        return cmsg
+
+    @classmethod
+    def parse_from_cmessage(cls, cmsg, cfg_model=None, kb=None, **kwargs):  # pylint:disable=arguments-differ
+        model = XRefManager(kb)
+        bits = kb._project.arch.bits
+
+        # references
+        for xref_pb2 in cmsg.xrefs:
+            if xref_pb2.data_ea == -1:
+                l.warning("Unknown address of the referenced data item. Ignore the reference at %#x.", xref_pb2.ea)
+                continue
+            xref = XRef.parse_from_cmessage(xref_pb2, bits=bits)
+            if cfg_model is not None and isinstance(xref.dst, int):
+                xref.memory_data = cfg_model.memory_data.get(xref.dst, None)
+            model.add_xref(xref)
+
+        return model
+
+
+KnowledgeBasePlugin.register_default("xrefs", XRefManager)

angr/knowledge_plugins/xrefs/xref_types.py

@@ -0,0 +1,13 @@
+class XRefType:
+    Offset = 0
+    Read = 1
+    Write = 2
+
+    @staticmethod
+    def to_string(ty):
+        s = {
+            XRefType.Offset: "offset",
+            XRefType.Read: "read",
+            XRefType.Write: "write",
+        }
+        return s.get(ty, "unknown")

angr/misc/__init__.py

@@ -0,0 +1,8 @@
+from . import ux
+from . import autoimport
+from . import weakpatch
+from .loggers import Loggers
+from .range import IRange
+from .plugins import PluginHub, PluginPreset
+from .hookset import HookSet
+from .picklable_lock import PicklableLock

angr/misc/ansi.py

@@ -0,0 +1,46 @@
+from enum import Enum, unique
+
+
+_ansi_prefix = "\x1b["
+
+
+#
+# Ansi colors
+#
+
+
+clear: str = f"{_ansi_prefix}0m"
+
+
+@unique
+class Color(Enum):
+    """
+    The basic ansi colors
+    """
+
+    black = 30
+    red = 31
+    green = 32
+    yellow = 33
+    blue = 34
+    magenta = 35
+    cyan = 36
+    white = 37
+
+
+BackgroundColor = unique(Enum("BackgroundColor", {i.name: (i.value + 10) for i in Color}))
+
+
+#
+# Functions
+#
+
+
+def color(c: Color | BackgroundColor, bright: bool):
+    """
+    Return the ansi prefix using the given code
+    Bright may not be used with a BackgroundColor
+    """
+    if bright and isinstance(c, BackgroundColor):
+        raise ValueError("Backgrounds should not be bright")
+    return f"{_ansi_prefix}{c.value};1m" if bright else f"{_ansi_prefix}{c.value}m"

angr/misc/autoimport.py

@@ -0,0 +1,89 @@
+import os
+import importlib
+import importlib.machinery
+import importlib.util
+import logging
+from collections.abc import Callable
+
+
+l = logging.getLogger(name=__name__)
+
+
+def auto_import_packages(base_module, base_path, ignore_dirs=(), ignore_files=(), scan_modules=True):
+    for lib_module_name in os.listdir(base_path):
+        if lib_module_name in ignore_dirs or lib_module_name == "__pycache__":
+            continue
+
+        lib_path = os.path.join(base_path, lib_module_name)
+        init_path = os.path.join(lib_path, "__init__.py")
+        if not os.path.isfile(init_path):
+            l.debug("Not a module: %s", lib_module_name)
+            continue
+
+        l.debug("Loading %s.%s", base_module, lib_module_name)
+
+        try:
+            package = importlib.import_module(".%s" % lib_module_name, base_module)
+        except ImportError:
+            l.warning("Unable to autoimport package %s.%s", base_module, lib_module_name, exc_info=True)
+        else:
+            if scan_modules:
+                for name, mod in auto_import_modules(
+                    f"{base_module}.{lib_module_name}", lib_path, ignore_files=ignore_files
+                ):
+                    if name not in dir(package):
+                        setattr(package, name, mod)
+            yield lib_module_name, package
+
+
+def auto_import_modules(base_module, base_path, ignore_files=(), filter_func: Callable | None = None):
+    for proc_file_name in os.listdir(base_path):
+        if not proc_file_name.endswith(".py"):
+            continue
+        if proc_file_name in ignore_files or proc_file_name == "__init__.py":
+            continue
+        proc_module_name = proc_file_name[:-3]
+        if filter_func is not None and not filter_func(proc_module_name):
+            continue
+
+        try:
+            proc_module = importlib.import_module(".%s" % proc_module_name, base_module)
+        except ImportError:
+            l.warning("Unable to autoimport module %s.%s", base_module, proc_module_name, exc_info=True)
+            continue
+        else:
+            yield proc_module_name, proc_module
+
+
+def filter_module(mod, type_req=None, subclass_req=None):
+    for name in dir(mod):
+        val = getattr(mod, name)
+        if type_req is not None and not isinstance(val, type_req):
+            continue
+        if subclass_req is not None and not issubclass(val, subclass_req):
+            continue
+        yield name, val
+
+
+def auto_import_source_files(base_path, ignore_files=(), filter_func: Callable | None = None):
+    for proc_file_name in os.listdir(base_path):
+        if not proc_file_name.endswith(".py"):
+            continue
+        if proc_file_name in ignore_files or proc_file_name == "__init__.py":
+            continue
+
+        proc_module_name = proc_file_name[:-3]
+        if filter_func is not None and not filter_func(proc_file_name):
+            continue
+
+        proc_path = os.path.join(base_path, proc_file_name)
+        try:
+            loader = importlib.machinery.SourceFileLoader(proc_module_name, proc_path)
+            spec = importlib.util.spec_from_loader(proc_module_name, loader)
+            proc_module = importlib.util.module_from_spec(spec)
+            loader.exec_module(proc_module)
+        except ImportError:
+            l.warning("Unable to autoimport module from file %s", proc_path, exc_info=True)
+            continue
+        else:
+            yield proc_module_name, proc_module

angr/misc/bug_report.py

@@ -0,0 +1,125 @@
+import importlib
+import os
+import sys
+import datetime
+import gc
+import ctypes
+
+from .import_hooks import remove_fake_pkg_resources
+
+
+have_gitpython = False
+try:
+    from git import Repo, InvalidGitRepositoryError
+
+    have_gitpython = True
+except ImportError:
+    print("If you install gitpython (`pip install gitpython`), I can give you git info too!")
+
+
+angr_modules = ["angr", "ailment", "cle", "pyvex", "claripy", "archinfo", "z3", "unicorn"]
+native_modules = {
+    "angr": lambda: angr.state_plugins.unicorn_engine._UC_NATIVE,  # pylint: disable=undefined-variable
+    "unicorn": lambda: unicorn.unicorn._uc,  # pylint: disable=undefined-variable
+    "pyvex": lambda: pyvex.pvc,  # pylint: disable=undefined-variable
+    "z3": lambda: [x for x in gc.get_objects() if type(x) is ctypes.CDLL and "z3" in str(x)][0],  # YIKES FOREVER
+}
+python_packages = {"z3": "z3-solver"}
+
+
+def get_venv():
+    if "VIRTUAL_ENV" in os.environ:
+        return os.environ["VIRTUAL_ENV"]
+    return None
+
+
+def print_versions():
+    remove_fake_pkg_resources()
+    # import the real pkg_resources
+    import pkg_resources  # pylint:disable=import-outside-toplevel
+
+    for m in angr_modules:
+        print("######## %s #########" % m)
+        try:
+            python_filename = importlib.util.find_spec(m).origin
+        except ImportError:
+            print("Python could not find " + m)
+            continue
+        except Exception as e:  # pylint: disable=broad-except
+            print(f"An error occurred importing {m}: {e}")
+        print("Python found it in %s" % (python_filename))
+        try:
+            pip_package = python_packages.get(m, m)
+            pip_version = pkg_resources.get_distribution(pip_package)
+            print("Pip version %s" % pip_version)
+        except Exception:  # pylint: disable-broad-except
+            print("Pip version not found!")
+        print_git_info(python_filename)
+
+
+def print_git_info(dirname):
+    if not have_gitpython:
+        return
+    try:
+        repo = Repo(dirname, search_parent_directories=True)
+    except InvalidGitRepositoryError:
+        print("Couldn't find git info")
+        return
+    cur_commit = repo.commit()
+    cur_branch = repo.active_branch
+    print("Git info:")
+    print(f"\tCurrent commit {cur_commit.hexsha} from branch {cur_branch.name}")
+    try:
+        # EDG: Git is insane, but this should work 99% of the time
+        cur_tb = cur_branch.tracking_branch()
+        if cur_tb.is_remote():
+            remote_name = cur_tb.remote_name
+            remote_url = repo.remotes[remote_name].url
+            print(f"\tChecked out from remote {remote_name}: {remote_url}")
+        else:
+            print("Tracking local branch %s" % cur_tb.name)
+    except Exception:  # pylint: disable=broad-except
+        print("Could not resolve tracking branch or remote info!")
+
+
+def print_system_info():
+    remove_fake_pkg_resources()
+    # import the real pkg_resources
+    import pkg_resources  # pylint:disable=import-outside-toplevel
+
+    print("Platform: " + pkg_resources.get_build_platform())
+    print("Python version: " + str(sys.version))
+
+
+def print_native_info():
+    print("######### Native Module Info ##########")
+    for module, funcs in native_modules.items():
+        try:
+            globals()[module] = __import__(module)
+            try:
+                print(f"{module}: {funcs()}")
+            except Exception as e:  # pylint: disable=broad-except
+                print(f"{module}: imported but path finding raised a {type(e)}: {e}")
+        except ModuleNotFoundError:
+            print(f"{module}: NOT FOUND")
+        except ImportError:
+            print(f"{module}: FOUND BUT FAILED TO IMPORT")
+        except Exception as e:  # pylint: disable=broad-except
+            print(f"{module}: __import__ raised a {type(e)}: {e}")
+
+
+def bug_report():
+    print("angr environment report")
+    print("=============================")
+    print("Date: " + str(datetime.datetime.today()))
+    if get_venv():
+        print("Running in virtual environment at " + get_venv())
+    else:
+        print("!!! running in global environment.  Are you sure? !!!")
+    print_system_info()
+    print_versions()
+    print_native_info()
+
+
+if __name__ == "__main__":
+    bug_report()

angr/misc/hookset.py

@@ -0,0 +1,106 @@
+"""
+These classes perform some python magic that we use to implement the nesting of exploration technique methods.
+This process is formalized as a "hooking" of a python method - each exploration technique's methods "hooks" a method of
+the same name on the simulation manager class.
+"""
+
+
+class HookSet:
+    """
+    A HookSet is a static class that provides the capability to apply many hooks to an object.
+    """
+
+    @staticmethod
+    def install_hooks(target, **hooks):
+        """
+        Given the target `target`, apply the hooks given as keyword arguments to it.
+        If any targeted method has already been hooked, the hooks will not be overridden but will instead be pushed
+        into a list of pending hooks. The final behavior should be that all hooks call each other in a nested stack.
+
+        :param target:  Any object. Its methods named as keys in `hooks` will be replaced by `HookedMethod` objects.
+        :param hooks:   Any keywords will be interpreted as hooks to apply. Each method named will hooked with the
+                        corresponding function value.
+        """
+        for name, hook in hooks.items():
+            func = getattr(target, name)
+            if not isinstance(func, HookedMethod):
+                func = HookedMethod(func)
+                setattr(target, name, func)
+            func.pending.append(hook)
+
+    @staticmethod
+    def remove_hooks(target, **hooks):
+        """
+        Remove the given hooks from the given target.
+
+        :param target:  The object from which to remove hooks. If all hooks are removed from a given method, the
+                        HookedMethod object will be removed and replaced with the original function.
+        :param hooks:   Any keywords will be interpreted as hooks to remove. You must provide the exact hook that was
+                        applied so that it can it can be identified for removal among any other hooks.
+        """
+        for name, hook in hooks.items():
+            hooked = getattr(target, name)
+            if hook in hooked.pending:
+                try:
+                    hooked.pending.remove(hook)
+                except ValueError as e:
+                    raise ValueError(f"{target} is not hooked by {hook}") from e
+            if not hooked.pending:
+                setattr(target, name, hooked.func)
+
+    @staticmethod
+    def copy_hooks(source, target, domain):
+        """
+        Copy the hooks from source onto target.
+
+        If the current callstack includes hooked methods from source, the already-called methods will not be included in
+        the copy.
+
+        ``domain`` is a list of names that might be hooked.
+        """
+        for name in domain:
+            hooked = getattr(source, name)
+            if isinstance(hooked, HookedMethod):
+                setattr(target, name, hooked.copy_to(getattr(target, name)))
+
+
+class HookedMethod:
+    """
+    HookedMethod is a callable object which provides a stack of nested hooks.
+
+    :param func:    The bottom-most function which provides the original functionality that is being hooked
+
+    :ivar func:     Same as the eponymous parameter
+    :ivar pending:  The stack of hooks that have yet to be called. When this object is called, it will pop the last
+                    function in this list and call it. The function should call this object again in order to request
+                    the functionality of the original method, at which point the pop-dispatch mechanism will run
+                    recursively until the stack is exhausted, at which point the original function will be called.
+                    When the call returns, the hook will be restored to the stack.
+    """
+
+    def __init__(self, func):
+        self.func = func
+        self.pending = []
+
+    def __repr__(self):
+        return "<HookedMethod(%s.%s, %d pending)>" % (
+            self.func.__self__.__class__.__name__,
+            self.func.__name__,
+            len(self.pending),
+        )
+
+    def __call__(self, *args, **kwargs):
+        if self.pending:
+            current_hook = self.pending.pop()
+            try:
+                result = current_hook(self.func.__self__, *args, **kwargs)
+            finally:
+                self.pending.append(current_hook)
+            return result
+        else:
+            return self.func(*args, **kwargs)
+
+    def copy_to(self, new_func):
+        new_hooked = HookedMethod(new_func)
+        new_hooked.pending = list(self.pending)
+        return new_hooked