angr 9.2.103__py3-none-manylinux2014_aarch64.whl

angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py

@@ -0,0 +1,293 @@
+from collections import defaultdict
+import logging
+
+import ailment
+
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(name=__name__)
+
+
+def s2u(s, bits):
+    if s > 0:
+        return s
+    return (1 << bits) + s
+
+
+class StackCanarySimplifier(OptimizationPass):
+    """
+    Removes stack canary checks from decompilation results.
+    """
+
+    ARCHES = [
+        "X86",
+        "AMD64",
+    ]  # TODO: fs is x86 only. Figure out how stack canary is loaded in other architectures
+    PLATFORMS = ["cgc", "linux"]
+    STAGE = OptimizationPassStage.AFTER_GLOBAL_SIMPLIFICATION
+    NAME = "Simplify stack canaries"
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+
+        self.analyze()
+
+    def _check(self):
+        # Check the first block and see if there is any statement reading data from fs:0x28h
+        init_stmt = self._find_canary_init_stmt()
+
+        return init_stmt is not None, {"init_stmt": init_stmt}
+
+    def _analyze(self, cache=None):
+        init_stmt = None
+        if cache is not None:
+            init_stmt = cache.get("init_stmt", None)
+
+        if init_stmt is None:
+            init_stmt = self._find_canary_init_stmt()
+
+        if init_stmt is None:
+            return
+
+        # Look for the statement that loads back canary value from the stack
+        first_block, stmt_idx = init_stmt
+        canary_init_stmt = first_block.statements[stmt_idx]
+        # where is the stack canary stored?
+        if not isinstance(canary_init_stmt.addr, ailment.Expr.StackBaseOffset):
+            _l.debug(
+                "Unsupported canary storing location %s. Expects an ailment.Expr.StackBaseOffset.",
+                canary_init_stmt.addr,
+            )
+            return
+
+        store_offset = canary_init_stmt.addr.offset
+        if not isinstance(store_offset, int):
+            _l.debug("Unsupported canary storing offset %s. Expects an int.", store_offset)
+
+        # The function should have at least one end point with an if-else statement
+        # Find all nodes with 0 out-degrees
+        all_endpoint_addrs = [node.addr for node in self._func.graph.nodes() if self._func.graph.out_degree(node) == 0]
+
+        # Before node duplication, each pair of canary-check-success and canary-check-failure nodes have a common
+        # predecessor.
+        # map endpoint addrs to their common predecessors
+        pred_addr_to_endpoint_addrs: dict[int, set[int]] = defaultdict(set)
+        for node_addr in all_endpoint_addrs:
+            preds = self._func.graph.predecessors(self._func.get_node(node_addr))
+            for pred in preds:
+                pred_addr_to_endpoint_addrs[pred.addr].add(node_addr)
+
+        found_endpoints = False
+        for pred_addr in pred_addr_to_endpoint_addrs:
+            endpoint_addrs = pred_addr_to_endpoint_addrs[pred_addr]
+
+            if len(endpoint_addrs) != 2:
+                # we expect there to be only two nodes: one for canary-check-success, and the other for
+                # canary-check-failure. if not, we check the next predecessor
+                continue
+
+            # because other optimization passes may duplicate nodes, we may have more than one node for each function
+            # endpoint.
+            endpoint_addrs_list = list(endpoint_addrs)
+            endnodes_0 = list(self._get_blocks(endpoint_addrs_list[0]))
+            endnodes_1 = list(self._get_blocks(endpoint_addrs_list[1]))
+
+            if not endnodes_0 or not endnodes_1:
+                _l.warning("Unexpected situation: endnodes_0 or endnodes_1 is empty.")
+                continue
+
+            # One of the end nodes calls __stack_chk_fail
+            stack_chk_fail_callers = None
+            other_nodes = None
+            for endnodes, o in [(endnodes_0, endnodes_1), (endnodes_1, endnodes_0)]:
+                if self._calls_stack_chk_fail(endnodes[0]):
+                    stack_chk_fail_callers = endnodes
+                    other_nodes = o
+                    break
+            else:
+                _l.debug("Cannot find the node that calls __stack_chk_fail().")
+                continue
+
+            # Match stack_chk_fail_caller, ret_node, and predecessor
+            nodes_to_process = []
+            for stack_chk_fail_caller in stack_chk_fail_callers:
+                all_preds = set(self._graph.predecessors(stack_chk_fail_caller))
+                preds_for_other_nodes = set()
+                for o in other_nodes:
+                    preds_for_other_nodes |= set(self._graph.predecessors(o))
+                preds = list(all_preds.intersection(preds_for_other_nodes))
+                if len(preds) != 1:
+                    _l.debug("Expect 1 predecessor. Found %d.", len(preds))
+                    continue
+                pred = preds[0]
+
+                # More sanity checks
+                if len(pred.statements) < 1:
+                    _l.debug("The predecessor node is empty.")
+                    continue
+
+                # Check the last statement
+                if not isinstance(pred.statements[-1], ailment.Stmt.ConditionalJump):
+                    _l.debug("The predecessor does not end with a conditional jump.")
+                    continue
+
+                # Find the statement that computes real canary value xor stored canary value
+                canary_check_stmt_idx = self._find_canary_comparison_stmt(pred, store_offset)
+                if canary_check_stmt_idx is None:
+                    _l.debug("Cannot find the canary check statement in the predecessor.")
+                    continue
+
+                succs = list(self._graph.successors(pred))
+                if len(succs) != 2:
+                    _l.debug("Expect 2 successors. Found %d.", len(succs))
+                    continue
+                if stack_chk_fail_caller is succs[0]:
+                    ret_node = succs[1]
+                else:
+                    ret_node = succs[0]
+                nodes_to_process.append((pred, canary_check_stmt_idx, stack_chk_fail_caller, ret_node))
+
+            # Awesome. Now patch this function.
+            for pred, canary_check_stmt_idx, stack_chk_fail_caller, ret_node in nodes_to_process:
+                # Patch the pred so that it jumps to the one that is not stack_chk_fail_caller
+                pred_copy = pred.copy()
+                pred_copy.statements[-1] = ailment.Stmt.Jump(
+                    len(pred_copy.statements) - 1,
+                    ailment.Expr.Const(None, None, ret_node.addr, self.project.arch.bits),
+                    ins_addr=pred_copy.statements[-1].ins_addr,
+                )
+
+                self._graph.remove_edge(pred, stack_chk_fail_caller)
+                self._update_block(pred, pred_copy)
+
+                if self._graph.in_degree[stack_chk_fail_caller] == 0:
+                    # Remove the block that calls stack_chk_fail_caller
+                    self._remove_block(stack_chk_fail_caller)
+
+                found_endpoints = True
+
+        if found_endpoints:
+            # Remove the statement that loads the stack canary from fs
+            first_block_copy = first_block.copy()
+            first_block_copy.statements.pop(stmt_idx)
+            self._update_block(first_block, first_block_copy)
+
+        # Done!
+
+    def _find_canary_init_stmt(self):
+        block_addr = self._func.addr
+        traversed = set()
+
+        while True:
+            traversed.add(block_addr)
+            first_block = next(self._get_blocks(block_addr))
+            if first_block is None:
+                break
+
+            for idx, stmt in enumerate(first_block.statements):
+                if (
+                    isinstance(stmt, ailment.Stmt.Store)
+                    and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
+                    and isinstance(stmt.data, ailment.Expr.Load)
+                    and self._is_add(stmt.data.addr)
+                ):
+                    # Check addr: must be fs+0x28
+                    op0, op1 = stmt.data.addr.operands
+                    if isinstance(op1, ailment.Expr.Register):
+                        op0, op1 = op1, op0
+                    if isinstance(op0, ailment.Expr.Register) and isinstance(op1, ailment.Expr.Const):
+                        if op0.reg_offset == self.project.arch.get_register_offset("fs") and op1.value == 0x28:
+                            return first_block, idx
+
+            succs = list(self._graph.successors(first_block))
+            if len(succs) == 1:
+                block_addr = succs[0].addr
+                if block_addr not in traversed:
+                    continue
+            break
+
+        return None
+
+    def _find_canary_comparison_stmt(self, block, canary_value_stack_offset):
+        for idx, stmt in enumerate(block.statements):
+            if isinstance(stmt, ailment.Stmt.ConditionalJump):
+                if isinstance(stmt.condition, ailment.Expr.UnaryOp) and stmt.condition.op == "Not":
+                    # !(s_10 ^ fs:0x28 == 0)
+                    negated = True
+                    condition = stmt.condition.operand
+                else:
+                    negated = False
+                    condition = stmt.condition
+                if isinstance(condition, ailment.Expr.BinaryOp) and (
+                    not negated and condition.op == "CmpEQ" or negated and condition.op == "CmpNE"
+                ):
+                    pass
+                else:
+                    continue
+
+                expr0, expr1 = condition.operands
+                if isinstance(expr0, ailment.Expr.BinaryOp) and expr0.op == "Xor":
+                    # a ^ b
+                    op0, op1 = expr0.operands
+                    if not (
+                        self._is_stack_canary_load_expr(op0, self.project.arch.bits, canary_value_stack_offset)
+                        and self._is_random_number_load_expr(op1, self.project.arch.get_register_offset("fs"))
+                        or (
+                            self._is_stack_canary_load_expr(op1, self.project.arch.bits, canary_value_stack_offset)
+                            and self._is_random_number_load_expr(op0, self.project.arch.get_register_offset("fs"))
+                        )
+                    ):
+                        continue
+                elif (
+                    isinstance(expr0, ailment.Expr.Load)
+                    and isinstance(expr1, ailment.Expr.Load)
+                    and condition.op == "CmpEQ"
+                ):
+                    # a == b
+                    if not (
+                        self._is_stack_canary_load_expr(expr0, self.project.arch.bits, canary_value_stack_offset)
+                        and self._is_random_number_load_expr(expr1, self.project.arch.get_register_offset("fs"))
+                        or (
+                            self._is_stack_canary_load_expr(expr1, self.project.arch.bits, canary_value_stack_offset)
+                            and self._is_random_number_load_expr(expr0, self.project.arch.get_register_offset("fs"))
+                        )
+                    ):
+                        continue
+
+                # Found it
+                return idx
+
+        return None
+
+    def _calls_stack_chk_fail(self, node):
+        for stmt in node.statements:
+            if isinstance(stmt, ailment.Stmt.Call) and isinstance(stmt.target, ailment.Expr.Const):
+                const_target = stmt.target.value
+                if const_target in self.kb.functions:
+                    func = self.kb.functions.function(addr=const_target)
+                    if func.name == "__stack_chk_fail":
+                        return True
+
+        return False
+
+    @staticmethod
+    def _is_stack_canary_load_expr(expr, bits: int, canary_value_stack_offset: int) -> bool:
+        if not (isinstance(expr, ailment.Expr.Load) and isinstance(expr.addr, ailment.Expr.StackBaseOffset)):
+            return False
+        if s2u(expr.addr.offset, bits) != s2u(canary_value_stack_offset, bits):
+            return False
+        return True
+
+    @staticmethod
+    def _is_random_number_load_expr(expr, fs_reg_offset: int) -> bool:
+        return (
+            isinstance(expr, ailment.Expr.Load)
+            and isinstance(expr.addr, ailment.Expr.BinaryOp)
+            and expr.addr.op == "Add"
+            and isinstance(expr.addr.operands[0], ailment.Expr.Const)
+            and expr.addr.operands[0].value == 0x28
+            and isinstance(expr.addr.operands[1], ailment.Expr.Register)
+            and expr.addr.operands[1].reg_offset == fs_reg_offset
+        )

angr/analyses/decompiler/optimization_passes/switch_default_case_duplicator.py

@@ -0,0 +1,110 @@
+# pylint:disable=too-many-boolean-expressions
+from itertools import count
+import logging
+
+import networkx
+
+from angr.knowledge_plugins.cfg import IndirectJumpType
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(name=__name__)
+
+
+def s2u(s, bits):
+    if s > 0:
+        return s
+    return (1 << bits) + s
+
+
+class SwitchDefaultCaseDuplicator(OptimizationPass):
+    """
+    For each switch-case construct (identified by jump tables), duplicate the default-case node when we detect
+    situations where the default-case node is seemingly reused by edges outside the switch-case construct. This code
+    reuse is usually caused by compiler code deduplication.
+
+    Ideally this pass should be implemented as an ISC optimization reversion.
+    """
+
+    ARCHES = None
+    PLATFORMS = None
+    STAGE = OptimizationPassStage.BEFORE_REGION_IDENTIFICATION
+    NAME = "Duplicate default-case nodes to undo default-case node reuse caused by compiler code deduplication"
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+
+        self.node_idx = count(start=0)
+
+        self.analyze()
+
+    def _check(self):
+        jumptables = self.kb.cfgs.get_most_accurate().jump_tables
+        switch_jump_block_addrs = {
+            jumptable.addr
+            for jumptable in jumptables.values()
+            if jumptable.type
+            in {IndirectJumpType.Jumptable_AddressComputed, IndirectJumpType.Jumptable_AddressLoadedFromMemory}
+        }
+        jump_node_addrs = self._func.block_addrs_set.intersection(switch_jump_block_addrs)
+        if not jump_node_addrs:
+            return False, None
+
+        default_case_node_addrs = set()
+        for node_addr in jump_node_addrs:
+            node = self._func.get_node(node_addr)
+            if self._func.graph.in_degree[node] == 1:
+                pred = list(self._func.graph.predecessors(node))[0]
+                if self._func.graph.out_degree[pred] == 2:
+                    default_case_node = next(
+                        iter(nn for nn in self._func.graph.successors(pred) if nn.addr != node_addr)
+                    )
+                    if self._func.graph.out_degree[default_case_node] == 1:
+                        default_case_node_addrs.add((pred.addr, node_addr, default_case_node.addr))
+
+        if not default_case_node_addrs:
+            return False, None
+
+        cache = {"default_case_node_addrs": default_case_node_addrs}
+        return True, cache
+
+    def _analyze(self, cache=None):
+
+        default_case_node_addrs = cache["default_case_node_addrs"]
+
+        out_graph = None
+
+        for switch_head_addr, jump_node_addr, default_addr in default_case_node_addrs:
+            default_case_node = self._func.get_node(default_addr)
+            unexpected_pred_addrs = {
+                pred.addr
+                for pred in self._func.graph.predecessors(default_case_node)
+                if pred.addr not in {switch_head_addr, jump_node_addr}
+            }
+            if unexpected_pred_addrs:
+                default_case_block = self._get_block(default_addr)
+                default_case_succ_block = list(self._graph.successors(default_case_block))[0]
+
+                jump_nodes = self._get_blocks(jump_node_addr)
+                jump_node_descedents = set()
+                for jump_node in jump_nodes:
+                    jump_node_descedents |= networkx.descendants(self._graph, jump_node)
+
+                # duplicate default_case_node for each unexpected predecessor
+                for unexpected_pred_addr in unexpected_pred_addrs:
+                    for unexpected_pred in self._get_blocks(unexpected_pred_addr):
+                        # is this predecessor reachable from the jump node? if so, we believe this is a legitimate edge
+                        # and do not duplicate it.
+                        if unexpected_pred in jump_node_descedents:
+                            continue
+
+                        default_case_block_copy = default_case_block.copy()
+                        default_case_block_copy.idx = next(self.node_idx)
+                        if out_graph is None:
+                            out_graph = self._graph
+                        out_graph.remove_edge(unexpected_pred, default_case_block)
+                        out_graph.add_edge(unexpected_pred, default_case_block_copy)
+                        out_graph.add_edge(default_case_block_copy, default_case_succ_block)
+
+        self.out_graph = out_graph

angr/analyses/decompiler/optimization_passes/win_stack_canary_simplifier.py

@@ -0,0 +1,281 @@
+# pylint:disable=too-many-boolean-expressions
+from collections import defaultdict
+import logging
+
+import ailment
+import cle
+
+from angr.utils.funcid import is_function_security_check_cookie
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(name=__name__)
+
+
+def s2u(s, bits):
+    if s > 0:
+        return s
+    return (1 << bits) + s
+
+
+class WinStackCanarySimplifier(OptimizationPass):
+    """
+    Removes stack canary checks from decompilation results for Windows PE files.
+
+    we need to run this pass before performing any full-function simplification. Otherwise the effects of
+    _security_cookie will be propagated.
+    """
+
+    ARCHES = [
+        "X86",
+        "AMD64",
+    ]
+    PLATFORMS = ["windows"]
+    STAGE = OptimizationPassStage.AFTER_SINGLE_BLOCK_SIMPLIFICATION
+    NAME = "Simplify stack canaries in Windows PE files"
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+        self._security_cookie_addr = None
+        if isinstance(self.project.loader.main_object, cle.PE):
+            self._security_cookie_addr = self.project.loader.main_object.load_config.get("SecurityCookie", None)
+
+        self.analyze()
+
+    def _check(self):
+        if self._security_cookie_addr is None:
+            return False, None
+
+        # Check the first block and see if there is any statement reading data from _security_cookie
+        init_stmts = self._find_canary_init_stmt()
+
+        return init_stmts is not None, {"init_stmts": init_stmts}
+
+    def _analyze(self, cache=None):
+        init_stmts = None
+        if cache is not None:
+            init_stmts = cache.get("init_stmts", None)
+
+        if init_stmts is None:
+            init_stmts = self._find_canary_init_stmt()
+
+        if init_stmts is None:
+            return
+
+        # Look for the statement that loads back canary value from the stack
+        first_block, canary_init_stmt_ids = init_stmts
+        canary_init_stmt = first_block.statements[canary_init_stmt_ids[-1]]
+        # where is the stack canary stored?
+        if not isinstance(canary_init_stmt.addr, ailment.Expr.StackBaseOffset):
+            _l.debug(
+                "Unsupported canary storing location %s. Expects an ailment.Expr.StackBaseOffset.",
+                canary_init_stmt.addr,
+            )
+            return
+
+        store_offset = canary_init_stmt.addr.offset
+        if not isinstance(store_offset, int):
+            _l.debug("Unsupported canary storing offset %s. Expects an int.", store_offset)
+
+        # The function should have at least one end point calling _security_check_cookie
+        # note that (at least for now) we rely on FLIRT to identify the _security_check_cookie function inside the
+        # binary.
+        # TODO: Add function matching logic to this simplifier
+
+        # Find all nodes with 0 out-degrees
+        all_endpoint_addrs = [node.addr for node in self._func.graph.nodes() if self._func.graph.out_degree(node) == 0]
+
+        # Before node duplication, each pair of canary-check-success and canary-check-failure nodes have a common
+        # predecessor.
+        # map endpoint addrs to their common predecessors
+        pred_addr_to_endpoint_addrs: dict[int, set[int]] = defaultdict(set)
+        for node_addr in all_endpoint_addrs:
+            preds = self._func.graph.predecessors(self._func.get_node(node_addr))
+            for pred in preds:
+                pred_addr_to_endpoint_addrs[pred.addr].add(node_addr)
+
+        found_endpoints = False
+        for pred_addr in pred_addr_to_endpoint_addrs:
+            # the predecessor should call _security_check_cookie
+            endpoint_preds = list(self._get_blocks(pred_addr))
+            if self._find_stmt_calling_security_check_cookie(endpoint_preds[0]) is None:
+                _l.debug("The predecessor does not call _security_check_cookie().")
+                continue
+
+            nodes_to_process = []
+            for pred in endpoint_preds:
+                check_call_stmt_idx = self._find_stmt_calling_security_check_cookie(pred)
+                if check_call_stmt_idx is None:
+                    _l.debug("Cannot find the statement calling _security_check_cookie() in the predecessor.")
+                    continue
+
+                # TODO: Support x86
+                canary_storing_stmt_idx = self._find_amd64_canary_storing_stmt(pred, store_offset)
+                if canary_storing_stmt_idx is None:
+                    _l.debug("Cannot find the canary check statement in the predecessor.")
+                    continue
+
+                return_addr_storing_stmt_idx = self._find_return_addr_storing_stmt(pred)
+                if return_addr_storing_stmt_idx is None:
+                    _l.debug("Cannot find the return address storing statement in the predecessor.")
+                    continue
+
+                nodes_to_process.append(
+                    (pred, check_call_stmt_idx, canary_storing_stmt_idx, return_addr_storing_stmt_idx)
+                )
+
+            # Now patch this function.
+            for pred, check_call_stmt_idx, canary_storing_stmt_idx, return_addr_storing_stmt_idx in nodes_to_process:
+                # Patch the pred so that it jumps to the one that is not stack_chk_fail_caller
+                stmts = []
+                for stmt_idx, stmt in enumerate(pred.statements):
+                    if stmt_idx in {check_call_stmt_idx, canary_storing_stmt_idx, return_addr_storing_stmt_idx}:
+                        continue
+                    stmts.append(stmt)
+                pred_copy = pred.copy(statements=stmts)
+
+                self._update_block(pred, pred_copy)
+
+                found_endpoints = True
+
+        if found_endpoints:
+            # Remove the statement that loads the stack canary from fs
+            first_block_copy = first_block.copy()
+            for stmt_idx in sorted(canary_init_stmt_ids, reverse=True):
+                first_block_copy.statements.pop(stmt_idx)
+            self._update_block(first_block, first_block_copy)
+
+    def _find_canary_init_stmt(self):
+        first_block = self._get_block(self._func.addr)
+        if first_block is None:
+            return None
+
+        load_stmt_idx = None
+        load_reg = None
+        xor_stmt_idx = None
+        xored_reg = None
+
+        for idx, stmt in enumerate(first_block.statements):
+            # if we are lucky and things get folded into one statement:
+            if (
+                isinstance(stmt, ailment.Stmt.Store)
+                and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
+                and isinstance(stmt.data, ailment.Expr.BinaryOp)
+                and stmt.data.op == "Xor"
+                and isinstance(stmt.data.operands[1], ailment.Expr.StackBaseOffset)
+                and isinstance(stmt.data.operands[0], ailment.Expr.Load)
+                and isinstance(stmt.data.operands[0].addr, ailment.Expr.Const)
+            ):
+                # Check addr: must be __security_cookie
+                load_addr = stmt.data.operands[0].addr.value
+                if load_addr == self._security_cookie_addr:
+                    return first_block, [idx]
+            # or if we are unlucky and the load and the xor are two different statements
+            if (
+                isinstance(stmt, ailment.Stmt.Assignment)
+                and isinstance(stmt.dst, ailment.Expr.Register)
+                and isinstance(stmt.src, ailment.Expr.Load)
+                and isinstance(stmt.src.addr, ailment.Expr.Const)
+            ):
+                load_addr = stmt.src.addr.value
+                if load_addr == self._security_cookie_addr:
+                    load_stmt_idx = idx
+                    load_reg = stmt.dst.reg_offset
+            if load_stmt_idx is not None and idx == load_stmt_idx + 1:
+                if (
+                    isinstance(stmt, ailment.Stmt.Assignment)
+                    and isinstance(stmt.dst, ailment.Expr.Register)
+                    and isinstance(stmt.src, ailment.Expr.BinaryOp)
+                    and stmt.src.op == "Xor"
+                    and isinstance(stmt.src.operands[0], ailment.Expr.Register)
+                    and stmt.src.operands[0].reg_offset == load_reg
+                    and isinstance(stmt.src.operands[1], ailment.Expr.StackBaseOffset)
+                ):
+                    xor_stmt_idx = idx
+                    xored_reg = stmt.dst.reg_offset
+                else:
+                    break
+            if xor_stmt_idx is not None and idx == xor_stmt_idx + 1:
+                if (
+                    isinstance(stmt, ailment.Stmt.Store)
+                    and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
+                    and isinstance(stmt.data, ailment.Expr.Register)
+                    and stmt.data.reg_offset == xored_reg
+                ):
+                    return first_block, [load_stmt_idx, xor_stmt_idx, idx]
+                else:
+                    break
+
+        return None
+
+    @staticmethod
+    def _find_amd64_canary_storing_stmt(block, canary_value_stack_offset):
+        load_stmt_idx = None
+
+        for idx, stmt in enumerate(block.statements):
+            # when we are lucky, we have one instruction
+            if (
+                isinstance(stmt, ailment.Stmt.Assignment)
+                and isinstance(stmt.dst, ailment.Expr.Register)
+                and stmt.dst.reg_name == "rcx"
+            ):
+                if isinstance(stmt.src, ailment.Expr.BinaryOp) and stmt.src.op == "Xor":
+                    op0, op1 = stmt.src.operands
+                    if (
+                        isinstance(op0, ailment.Expr.Load)
+                        and isinstance(op0.addr, ailment.Expr.StackBaseOffset)
+                        and op0.addr.offset == canary_value_stack_offset
+                    ):
+                        if isinstance(op1, ailment.Expr.StackBaseOffset):
+                            # found it
+                            return idx
+            # or when we are unlucky, we have two instructions...
+            if (
+                isinstance(stmt, ailment.Stmt.Assignment)
+                and isinstance(stmt.dst, ailment.Expr.Register)
+                and stmt.dst.reg_name == "rcx"
+                and isinstance(stmt.src, ailment.Expr.Load)
+                and isinstance(stmt.src.addr, ailment.Expr.StackBaseOffset)
+                and stmt.src.addr.offset == canary_value_stack_offset
+            ):
+                load_stmt_idx = idx
+            if load_stmt_idx is not None and idx == load_stmt_idx + 1:
+                if (
+                    isinstance(stmt, ailment.Stmt.Assignment)
+                    and isinstance(stmt.dst, ailment.Expr.Register)
+                    and isinstance(stmt.src, ailment.Expr.BinaryOp)
+                    and stmt.src.op == "Xor"
+                ):
+                    if (
+                        isinstance(stmt.src.operands[0], ailment.Expr.Register)
+                        and stmt.src.operands[0].reg_name == "rcx"
+                        and isinstance(stmt.src.operands[1], ailment.Expr.StackBaseOffset)
+                    ):
+                        return idx
+        return None
+
+    @staticmethod
+    def _find_return_addr_storing_stmt(block):
+        for idx, stmt in enumerate(block.statements):
+            if (
+                isinstance(stmt, ailment.Stmt.Store)
+                and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
+                and isinstance(stmt.data, ailment.Expr.Const)
+                and stmt.data.value == block.addr + block.original_size
+            ):
+                return idx
+        return None
+
+    def _find_stmt_calling_security_check_cookie(self, node):
+        for idx, stmt in enumerate(node.statements):
+            if isinstance(stmt, ailment.Stmt.Call) and isinstance(stmt.target, ailment.Expr.Const):
+                const_target = stmt.target.value
+                if const_target in self.kb.functions:
+                    func = self.kb.functions.function(addr=const_target)
+                    if func.name == "_security_check_cookie":
+                        return idx
+                    elif is_function_security_check_cookie(func, self.project, self._security_cookie_addr):
+                        return idx
+
+        return None