angr 9.2.115__py3-none-manylinux2014_aarch64.whl → 9.2.117__py3-none-manylinux2014_aarch64.whl

angr/engines/soot/statements/goto.py

@@ -1,5 +1,7 @@
 import logging
 
+import claripy
+
 from .base import SimSootStmt
 
 l = logging.getLogger("angr.engines.soot.statements.goto")
@@ -8,4 +10,4 @@ l = logging.getLogger("angr.engines.soot.statements.goto")
 class SimSootStmt_Goto(SimSootStmt):
     def _execute(self):
         jmp_target = self._get_bb_addr_from_instr(instr=self.stmt.target)
-        self._add_jmp_target(target=jmp_target, condition=self.state.solver.true)
+        self._add_jmp_target(target=jmp_target, condition=claripy.true)

angr/engines/soot/statements/if_.py

@@ -1,5 +1,7 @@
 import logging
 
+import claripy
+
 from .base import SimSootStmt
 
 l = logging.getLogger("angr.engines.soot.statements.if")
@@ -12,5 +14,5 @@ class SimSootStmt_If(SimSootStmt):
         self._add_jmp_target(target=jmp_target, condition=jmp_condition)
         self._add_jmp_target(
             target=None,  # if target is None, engine goes on linearly
-            condition=(jmp_condition == self.state.solver.false),
+            condition=(jmp_condition == claripy.false),
         )

angr/engines/soot/statements/switch.py

@@ -1,5 +1,7 @@
 import logging
 
+import claripy
+
 from .base import SimSootStmt
 
 l = logging.getLogger("angr.engines.soot.statements.switch")
@@ -26,7 +28,7 @@ class SwitchBase(SimSootStmt):
 
         # add default target
         default_jmp_target = self._get_bb_addr_from_instr(self.stmt.default_target)
-        default_jmp_cond = self.state.solver.And(*default_jmp_conditions)
+        default_jmp_cond = claripy.And(*default_jmp_conditions)
         self._add_jmp_target(default_jmp_target, default_jmp_cond)
 
 

angr/engines/soot/statements/throw.py

@@ -1,12 +1,14 @@
 import logging
 
-from .base import SimSootStmt
+import claripy
 from archinfo.arch_soot import SootAddressTerminator
 
+from .base import SimSootStmt
+
 l = logging.getLogger(name=__name__)
 
 
 class SimSootStmt_Throw(SimSootStmt):
     def _execute(self):
         # TODO: implement simprocedure to throw exception
-        self._add_jmp_target(target=SootAddressTerminator(), condition=self.state.solver.true)
+        self._add_jmp_target(target=SootAddressTerminator(), condition=claripy.true)

angr/engines/soot/values/arrayref.py

@@ -1,6 +1,6 @@
 import logging
 
-from claripy import And
+import claripy
 
 from . import translate_value
 from ....errors import SimEngineError
@@ -38,7 +38,7 @@ class SimSootValue_ArrayBaseRef(SimSootValue):
 
         :param function generator: Function that given the state, returns a
                                    default value for array elements, e.g.
-                                   `generator = lambda state: state.solver.BVV(0, 32)`
+                                   `generator = lambda state: claripy.BVV(0, 32)`
         """
         self._default_value_generator = generator
 
@@ -81,9 +81,9 @@ class SimSootValue_ArrayRef(SimSootValue):
     def check_array_bounds(idx, array, state):
         # a valid idx fullfills the constraint
         # 0 <= idx < length
-        zero = state.solver.BVV(0, 32)
+        zero = claripy.BVV(0, 32)
         length = array.size
-        bound_constraint = state.solver.And(
+        bound_constraint = claripy.And(
             length.SGT(idx),
             zero.SLE(idx),
         )
@@ -121,4 +121,4 @@ class SimSootValue_ArrayRef(SimSootValue):
                 idx,
                 length,
             )
-            state.solver.add(And(length.SGT(idx), zero.SLE(idx)))
+            state.solver.add(claripy.And(length.SGT(idx), zero.SLE(idx)))

angr/engines/unicorn.py

@@ -3,6 +3,7 @@ import functools
 import logging
 
 import archinfo
+import claripy
 
 from ..errors import SimIRSBError, SimIRSBNoDecodeError, SimValueError
 from .engine import SuccessorsMixin
@@ -178,7 +179,7 @@ class SimEngineUnicorn(SuccessorsMixin):
 
         self._instr_mem_write_addrs = set()  # pylint:disable=attribute-defined-outside-init
         for block_details in self.state.unicorn._get_details_of_blocks_with_symbolic_vex_stmts():
-            self.state.scratch.guard = self.state.solver.true
+            self.state.scratch.guard = claripy.true
             try:
                 if self.state.os_name == "CGC" and block_details["block_addr"] in {
                     self.state.unicorn.cgc_random_addr,
@@ -314,7 +315,7 @@ class SimEngineUnicorn(SuccessorsMixin):
             mem_read_val += next_val["value"]
 
         assert state.inspect.mem_read_length == mem_read_size
-        state.inspect.mem_read_address = state.solver.BVV(mem_read_address, state.inspect.mem_read_address.size())
+        state.inspect.mem_read_address = claripy.BVV(mem_read_address, state.inspect.mem_read_address.size())
         if mem_read_taint_map.count(-1) != mem_read_size:
             # Since read is might need bitmap adjustment, insert breakpoint to return the correct concrete value
             self.state.inspect.b(
@@ -330,9 +331,9 @@ class SimEngineUnicorn(SuccessorsMixin):
         if taint_map.count(0) == state.inspect.mem_read_length:
             # The value is completely concrete
             if state.arch.memory_endness == archinfo.Endness.LE:
-                state.inspect.mem_read_expr = state.solver.BVV(value[::-1])
+                state.inspect.mem_read_expr = claripy.BVV(value[::-1])
             else:
-                state.inspect.mem_read_expr = state.solver.BVV(value)
+                state.inspect.mem_read_expr = claripy.BVV(value)
         else:
             # The value may be partially concrete. Set the symbolic bitmap to read correct value and restore it
             mem_read_addr = state.solver.eval(state.inspect.mem_read_address)
@@ -370,12 +371,12 @@ class SimEngineUnicorn(SuccessorsMixin):
 
                 for offset, expected_taint in enumerate(taint_map):
                     if expected_taint == 0:
-                        curr_value_bytes[offset] = state.solver.BVV(value[offset], 8)
+                        curr_value_bytes[offset] = claripy.BVV(value[offset], 8)
 
                 if state.arch.memory_endness == archinfo.Endness.LE:
                     curr_value_bytes = reversed(curr_value_bytes)
 
-                curr_value = state.solver.Concat(*curr_value_bytes)
+                curr_value = claripy.Concat(*curr_value_bytes)
 
             state.inspect.mem_read_expr = curr_value
 
@@ -475,7 +476,7 @@ class SimEngineUnicorn(SuccessorsMixin):
 
         if state.unicorn.jumpkind.startswith("Ijk_Sys"):
             state.ip = state.unicorn._syscall_pc
-        successors.add_successor(state, state.ip, state.solver.true, state.unicorn.jumpkind)
+        successors.add_successor(state, state.ip, claripy.true, state.unicorn.jumpkind)
 
         successors.description = description
         successors.processed = True

angr/engines/vex/heavy/concretizers.py

@@ -57,13 +57,13 @@ def concretize_cmpf64(state, args):
     fp_arg0 = state.solver.eval(args[0])
     fp_arg1 = state.solver.eval(args[1])
     if fp_arg0 < fp_arg1:
-        return state.solver.BVV(1, 32)
+        return claripy.BVV(1, 32)
     if fp_arg0 > fp_arg1:
-        return state.solver.BVV(0, 32)
+        return claripy.BVV(0, 32)
     if fp_arg0 == fp_arg1:
-        return state.solver.BVV(0x40, 32)
+        return claripy.BVV(0x40, 32)
 
-    return state.solver.BVV(0x45, 32)
+    return claripy.BVV(0x45, 32)
 
 
 def concretize_divf64(state, args):
@@ -113,13 +113,13 @@ def concretize_float64_to_int64s(state, args):
 
 
 def concretize_int32s_to_float64(state, args):
-    arg = state.solver.BVV(state.solver.eval(args[0]), args[0].size())
+    arg = claripy.BVV(state.solver.eval(args[0]), args[0].size())
     return arg.val_to_fp(claripy.fp.FSort.from_size(64), signed=True, rm=fp_rm_map[0])
 
 
 def concretize_int64s_to_float64(state, args):
     rm = translate_rm(args[0])
-    arg = state.solver.BVV(state.solver.eval(args[1]), args[1].size())
+    arg = claripy.BVV(state.solver.eval(args[1]), args[1].size())
     return arg.val_to_fp(claripy.fp.FSort.from_size(64), signed=True, rm=rm)
 
 

angr/engines/vex/heavy/dirty.py

@@ -1,8 +1,8 @@
-import claripy
-
 import logging
 import time
 
+import claripy
+
 from angr import sim_options as o, errors
 
 l = logging.getLogger(name=__name__)
@@ -20,16 +20,16 @@ l = logging.getLogger(name=__name__)
 # http://www.cap-lore.com/code/TB/
 def ppcg_dirtyhelper_MFTB(state):
     # TODO: This is an incorrect implementation. Fix it later!
-    return state.solver.BVV(0x200, 64), []
+    return claripy.BVV(0x200, 64), []
 
 
 def ppc32g_dirtyhelper_MFSPR_287(state):
-    return state.solver.BVV(0x200, 32), []
+    return claripy.BVV(0x200, 32), []
 
 
 def amd64g_dirtyhelper_RDTSC(state):
     if o.USE_SYSTEM_TIMES in state.options:
-        val = state.solver.BVV(int(time.process_time() * 1000000) + 12345678, 64)
+        val = claripy.BVV(int(time.process_time() * 1000000) + 12345678, 64)
     else:
         val = state.solver.BVS("RDTSC", 64, key=("hardware", "rdtsc"))
     return val, []
@@ -121,15 +121,13 @@ EmWarn_S390X_invalid_rounding = 11
 def amd64g_check_ldmxcsr(state, mxcsr):
     rmode = state.solver.LShR(mxcsr, 13) & 3
 
-    ew = state.solver.If(
+    ew = claripy.If(
         (mxcsr & 0x1F80) != 0x1F80,
-        state.solver.BVV(EmWarn_X86_sseExns, 64),
-        state.solver.If(
+        claripy.BVV(EmWarn_X86_sseExns, 64),
+        claripy.If(
             mxcsr & (1 << 15) != 0,
-            state.solver.BVV(EmWarn_X86_fz, 64),
-            state.solver.If(
-                mxcsr & (1 << 6) != 0, state.solver.BVV(EmWarn_X86_daz, 64), state.solver.BVV(EmNote_NONE, 64)
-            ),
+            claripy.BVV(EmWarn_X86_fz, 64),
+            claripy.If(mxcsr & (1 << 6) != 0, claripy.BVV(EmWarn_X86_daz, 64), claripy.BVV(EmNote_NONE, 64)),
         ),
     )
 
@@ -138,7 +136,7 @@ def amd64g_check_ldmxcsr(state, mxcsr):
 
 # see canonical implementation of this in guest_amd64_helpers.c
 def amd64g_dirtyhelper_XRSTOR_COMPONENT_1_EXCLUDING_XMMREGS(state, _, addr):
-    w32 = state.solver.BVV(
+    w32 = claripy.BVV(
         (state.mem[state.solver.eval(addr) + 12 * 2].short.concrete & 0xFFFF)
         | ((state.mem[state.solver.eval(addr) + 13 * 2].short.concrete & 0xFFFF) << 16),
         64,
@@ -365,7 +363,7 @@ def x86g_dirtyhelper_LGDT_LIDT(state, addr, op):
     base = state.memory.load(addr + 2, 4, endness="Iend_LE")
 
     if op.concrete_value == 2:
-        state.regs.gdt = state.solver.Concat(base, limit).zero_extend(16)
+        state.regs.gdt = claripy.Concat(base, limit).zero_extend(16)
     elif op.concrete_value == 3:
         # LIDT is a nop
         pass
@@ -398,8 +396,8 @@ def x86g_dirtyhelper_loadF80le(state, addr):
     mantissa = tbyte[62:0]
 
     normalized_exponent = exponent[10:0] - 16383 + 1023
-    zero_exponent = state.solver.BVV(0, 11)
-    inf_exponent = state.solver.BVV(-1, 11)
+    zero_exponent = claripy.BVV(0, 11)
+    inf_exponent = claripy.BVV(-1, 11)
     final_exponent = claripy.If(
         exponent == 0, zero_exponent, claripy.If(exponent == -1, inf_exponent, normalized_exponent)
     )
@@ -424,8 +422,8 @@ def x86g_dirtyhelper_storeF80le(state, addr, qword):
     mantissa = qword[51:0]
 
     normalized_exponent = exponent.zero_extend(4) - 1023 + 16383
-    zero_exponent = state.solver.BVV(0, 15)
-    inf_exponent = state.solver.BVV(-1, 15)
+    zero_exponent = claripy.BVV(0, 15)
+    inf_exponent = claripy.BVV(-1, 15)
     final_exponent = claripy.If(
         exponent == 0, zero_exponent, claripy.If(exponent == -1, inf_exponent, normalized_exponent)
     )
@@ -449,18 +447,18 @@ def x86g_dirtyhelper_RDMSR(state, msr):
     try:
         msr_conc = state.solver.eval_one(msr)
     except errors.SimSolverError:
-        return state.solver.BVS("rdmsr_?", 64, key=("cpu", "rdmsr", "?")), []
+        return claripy.BVS("rdmsr_?", 64, key=("cpu", "rdmsr", "?")), []
     else:
-        return state.solver.BVS("rdmsr_%#x" % msr_conc, 64, key=("cpu", "rdmsr", msr_conc), eternal=True), []
+        return claripy.BVS("rdmsr_%#x" % msr_conc, 64, key=("cpu", "rdmsr", msr_conc), eternal=True), []
 
 
 def x86g_dirtyhelper_XGETBV(state, reg):
     try:
         reg_conc = state.solver.eval_one(reg)
     except errors.SimSolverError:
-        return state.solver.BVS("xgetbv_?", 64, key=("cpu", "xgetbv", "?")), []
+        return claripy.BVS("xgetbv_?", 64, key=("cpu", "xgetbv", "?")), []
     else:
-        return state.solver.BVS("xgetbv_%#x" % reg_conc, 64, key=("cpu", "xgetbv", reg_conc), eternal=True), []
+        return claripy.BVS("xgetbv_%#x" % reg_conc, 64, key=("cpu", "xgetbv", reg_conc), eternal=True), []
 
 
 amd64g_dirtyhelper_RDMSR = x86g_dirtyhelper_RDMSR

angr/engines/vex/heavy/heavy.py

@@ -203,7 +203,7 @@ class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEX
                 exit_state.registers.store(
                     exit_state.arch.ret_offset, exit_state.solver.Unconstrained("fake_ret_value", exit_state.arch.bits)
                 )
-                exit_state.scratch.target = exit_state.solver.BVV(successors.addr + irsb.size, exit_state.arch.bits)
+                exit_state.scratch.target = claripy.BVV(successors.addr + irsb.size, exit_state.arch.bits)
                 exit_state.history.jumpkind = "Ijk_Ret"
                 exit_state.regs.ip = exit_state.scratch.target
                 if exit_state.arch.call_pushes_ret:
@@ -215,12 +215,8 @@ class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEX
                 l.debug("%s adding postcall exit.", self)
 
                 ret_state = exit_state.copy()
-                guard = (
-                    ret_state.solver.true
-                    if o.TRUE_RET_EMULATION_GUARD in self.state.options
-                    else ret_state.solver.false
-                )
-                ret_target = ret_state.solver.BVV(successors.addr + irsb.size, ret_state.arch.bits)
+                guard = claripy.true if o.TRUE_RET_EMULATION_GUARD in self.state.options else claripy.false
+                ret_target = claripy.BVV(successors.addr + irsb.size, ret_state.arch.bits)
                 ret_state.registers.store(
                     ret_state.arch.ret_offset, ret_state.solver.Unconstrained("fake_ret_value", ret_state.arch.bits)
                 )
@@ -340,7 +336,7 @@ class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEX
             result = self.state.solver.simplify(result)
 
         if self.state.solver.symbolic(result) and o.CONCRETIZE in self.state.options:
-            concrete_value = self.state.solver.BVV(self.state.solver.eval(result), len(result))
+            concrete_value = claripy.BVV(self.state.solver.eval(result), len(result))
             self.state.add_constraints(result == concrete_value)
             result = concrete_value
 

angr/exploration_techniques/director.py

@@ -330,7 +330,7 @@ class CallFunctionGoal(BaseGoal):
     def _compare_pointer_content(state, ptr, expected):
         if isinstance(expected, str):
             # convert it to an AST
-            expected = state.solver.BVV(expected)
+            expected = claripy.BVV(expected)
         length = expected.size() // 8
         real_string = state.memory.load(ptr, length, endness="Iend_BE")
 

angr/exploration_techniques/driller_core.py

@@ -1,6 +1,8 @@
 import logging
 from itertools import islice
 
+import claripy
+
 from . import ExplorationTechnique
 
 
@@ -91,7 +93,7 @@ class DrillerCore(ExplorationTechnique):
     @staticmethod
     def _has_false(state):
         # Check if the state is unsat even if we remove preconstraints.
-        claripy_false = state.solver.false
+        claripy_false = claripy.false
         if state.scratch.guard.cache_key == claripy_false.cache_key:
             return True
 

angr/exploration_techniques/tracer.py

@@ -2,6 +2,7 @@ from typing import TYPE_CHECKING
 import logging
 import cle
 
+import claripy
 from capstone import CS_GRP_CALL, CS_GRP_IRET, CS_GRP_JUMP, CS_GRP_RET
 
 from . import ExplorationTechnique
@@ -53,7 +54,7 @@ class RepHook:
 
     @staticmethod
     def _inline_call(state, procedure, *arguments, **kwargs):
-        e_args = [state.solver.BVV(a, state.arch.bits) if isinstance(a, int) else a for a in arguments]
+        e_args = [claripy.BVV(a, state.arch.bits) if isinstance(a, int) else a for a in arguments]
         p = procedure(project=state.project, **kwargs)
         return p.execute(state, None, arguments=e_args)
 

angr/knowledge_plugins/key_definitions/live_definitions.py

@@ -14,6 +14,7 @@ from angr.misc.ux import deprecated
 from angr.errors import SimMemoryMissingError, SimMemoryError
 from angr.storage.memory_mixins import MultiValuedMemory
 from angr.storage.memory_mixins.paged_memory.pages.multi_values import MultiValues
+from angr.knowledge_plugins.key_definitions.definition import A
 from angr.engines.light import SpOffset
 from angr.code_location import CodeLocation, ExternalCodeLocation
 from .atoms import Atom, Register, MemoryLocation, Tmp, ConstantSrc
@@ -660,7 +661,7 @@ class LiveDefinitions:
             self.other_uses.add_use(definition, code_loc, expr)
 
     def get_definitions(
-        self, thing: Atom | Definition[Atom] | Iterable[Atom] | Iterable[Definition[Atom]] | MultiValues
+        self, thing: A | Definition[A] | Iterable[A] | Iterable[Definition[A]] | MultiValues
     ) -> set[Definition[Atom]]:
         if isinstance(thing, MultiValues):
             defs = set()
@@ -693,9 +694,9 @@ class LiveDefinitions:
             return self.get_tmp_definitions(thing.tmp_idx)
         else:
             defs = set()
-            for mvs in self.others.get(thing, {}).values():
-                for mv in mvs:
-                    defs |= self.get_definitions(mv)
+            mv = self.others.get(thing, None)
+            if mv is not None:
+                defs |= self.get_definitions(mv)
             return defs
 
     def get_tmp_definitions(self, tmp_idx: int) -> set[Definition]:
@@ -749,7 +750,7 @@ class LiveDefinitions:
         return LiveDefinitions.extract_defs_from_annotations(annotations)
 
     @deprecated("get_definitions")
-    def get_definitions_from_atoms(self, atoms: Iterable[Atom]) -> Iterable[Definition]:
+    def get_definitions_from_atoms(self, atoms: Iterable[A]) -> Iterable[Definition]:
         result = set()
         for atom in atoms:
             result |= self.get_definitions(atom)
@@ -813,9 +814,7 @@ class LiveDefinitions:
             return None
         return r.concrete_value
 
-    def get_values(
-        self, spec: Atom | Definition[Atom] | Iterable[Atom] | Iterable[Definition[Atom]]
-    ) -> MultiValues | None:
+    def get_values(self, spec: A | Definition[A] | Iterable[A] | Iterable[Definition[A]]) -> MultiValues | None:
         if isinstance(spec, Definition):
             atom = spec.atom
         elif isinstance(spec, Atom):
@@ -874,7 +873,7 @@ class LiveDefinitions:
 
     def get_one_value(
         self,
-        spec: Atom | Definition | Iterable[Atom] | Iterable[Definition[Atom]],
+        spec: A | Definition[A] | Iterable[A] | Iterable[Definition[A]],
         strip_annotations: bool = False,
     ) -> claripy.ast.bv.BV | None:
         r = self.get_values(spec)
@@ -884,19 +883,19 @@ class LiveDefinitions:
 
     @overload
     def get_concrete_value(
-        self, spec: Atom | Definition[Atom] | Iterable[Atom] | Iterable[Definition[Atom]], cast_to: type[int] = ...
+        self, spec: A | Definition[A] | Iterable[A] | Iterable[Definition[A]], cast_to: type[int] = ...
     ) -> int | None: ...
 
     @overload
     def get_concrete_value(
         self,
-        spec: Atom | Definition[Atom] | Iterable[Atom] | Iterable[Definition[Atom]],
+        spec: A | Definition[A] | Iterable[A] | Iterable[Definition[A]],
         cast_to: type[bytes] = ...,
     ) -> bytes | None: ...
 
     def get_concrete_value(
         self,
-        spec: Atom | Definition[Atom] | Iterable[Atom] | Iterable[Definition[Atom]],
+        spec: A | Definition[A] | Iterable[A] | Iterable[Definition[A]],
         cast_to: type[int] | type[bytes] = int,
     ) -> int | bytes | None:
         r = self.get_one_value(spec, strip_annotations=True)
@@ -983,7 +982,7 @@ class LiveDefinitions:
     @overload
     def deref(
         self,
-        pointer: MultiValues | Atom | Definition | Iterable[Atom] | Iterable[Definition],
+        pointer: MultiValues | A | Definition[A] | Iterable[A] | Iterable[Definition[A]],
         size: int | DerefSize,
         endness: archinfo.Endness = ...,
     ) -> set[MemoryLocation]: ...

angr/procedures/cgc/allocate.py

@@ -18,13 +18,13 @@ class allocate(angr.SimProcedure):
         length = self.state.solver.max_int(length)
 
         # return code (see allocate() docs)
-        r = self.state.solver.ite_cases(
+        r = claripy.ite_cases(
             (
                 (length == 0, self.state.cgc.EINVAL),
                 (length > self.state.cgc.max_allocation, self.state.cgc.EINVAL),
                 (self.state.cgc.addr_invalid(addr), self.state.cgc.EFAULT),
             ),
-            self.state.solver.BVV(0, self.state.arch.bits),
+            claripy.BVV(0, self.state.arch.bits),
         )
 
         if self.state.solver.max_int(r) != 0:
@@ -34,7 +34,7 @@ class allocate(angr.SimProcedure):
         aligned_length = ((length + 0xFFF) // 0x1000) * 0x1000
 
         if isinstance(self.state.cgc.allocation_base, int):
-            self.state.cgc.allocation_base = self.state.solver.BVV(self.state.cgc.allocation_base, self.state.arch.bits)
+            self.state.cgc.allocation_base = claripy.BVV(self.state.cgc.allocation_base, self.state.arch.bits)
 
         chosen = self.state.cgc.get_max_sinkhole(aligned_length)
         if chosen is None:
@@ -49,26 +49,24 @@ class allocate(angr.SimProcedure):
                 if sinkhole_size != 0:
                     self.state.cgc.add_sinkhole(cgc_flag_page_start_addr + 0x1000, sinkhole_size)
 
-                chosen = self.state.solver.BVV(cgc_flag_page_start_addr - aligned_length, self.state.arch.bits)
+                chosen = claripy.BVV(cgc_flag_page_start_addr - aligned_length, self.state.arch.bits)
             elif chosen_conc <= self.state.project.loader.max_addr < allocation_base_conc:
                 # Chosen memory overlaps with some loaded object
                 sinkhole_size = allocation_base_conc - self.state.project.loader.max_addr
                 if sinkhole_size != 0:
                     self.state.cgc.add_sinkhole(self.state.project.loader.max_addr, sinkhole_size)
 
-                chosen = self.state.solver.BVV(
-                    self.state.project.loader.min_addr - aligned_length, self.state.arch.bits
-                )
+                chosen = claripy.BVV(self.state.project.loader.min_addr - aligned_length, self.state.arch.bits)
 
             self.state.cgc.allocation_base = chosen
 
         self.state.memory.store(
-            addr, chosen, size=self.state.arch.bytes, condition=self.state.solver.And(addr != 0), endness="Iend_LE"
+            addr, chosen, size=self.state.arch.bytes, condition=claripy.And(addr != 0), endness="Iend_LE"
         )
 
         # PROT_READ | PROT_WRITE default
-        permissions = self.state.solver.BVV(1 | 2, 3)
-        permissions |= self.state.solver.If(is_x != 0, claripy.BVV(4, 3), claripy.BVV(0, 3))
+        permissions = claripy.BVV(1 | 2, 3)
+        permissions |= claripy.If(is_x != 0, claripy.BVV(4, 3), claripy.BVV(0, 3))
 
         chosen_conc = self.state.solver.eval(chosen)
         l.debug("Allocating [%#x, %#x]", chosen_conc, chosen_conc + aligned_length - 1)

angr/procedures/cgc/deallocate.py

@@ -1,8 +1,10 @@
 import logging
 
+import claripy
 from unique_log_filter import UniqueLogFilter
 
 import angr
+from angr.state_plugins.sim_action_object import SimActionObject
 
 l = logging.getLogger(name=__name__)
 l.addFilter(UniqueLogFilter())
@@ -11,16 +13,21 @@ l.addFilter(UniqueLogFilter())
 class deallocate(angr.SimProcedure):
     # pylint:disable=arguments-differ
 
-    def run(self, addr, length):  # pylint:disable=unused-argument
+    def run(self, addr, length):
+        if isinstance(addr, SimActionObject):
+            addr = addr.ast
+        if isinstance(length, SimActionObject):
+            length = length.ast
+
         # return code (see deallocate() docs)
-        r = self.state.solver.ite_cases(
+        r = claripy.ite_cases(
             (
                 (addr % 0x1000 != 0, self.state.cgc.EINVAL),
                 (length == 0, self.state.cgc.EINVAL),
                 (self.state.cgc.addr_invalid(addr), self.state.cgc.EINVAL),
                 (self.state.cgc.addr_invalid(addr + length), self.state.cgc.EINVAL),
             ),
-            self.state.solver.BVV(0, self.state.arch.bits),
+            claripy.BVV(0, self.state.arch.bits),
         )
 
         if self.state.solver.symbolic(addr):

angr/procedures/cgc/fdwait.py

@@ -1,7 +1,9 @@
-import angr
-
 import itertools
 
+import claripy
+
+import angr
+
 fdcount = itertools.count()
 
 
@@ -10,42 +12,42 @@ class fdwait(angr.SimProcedure):
 
     def run(self, nfds, readfds, writefds, timeout, readyfds):
         run_count = next(fdcount)
-        total_ready = self.state.solver.BVV(0, self.state.arch.bits)
+        total_ready = claripy.BVV(0, self.state.arch.bits)
 
         read_fds = []
         for fd_set in range(0, 32, 8):
             sym_newbits = []
             for fd in range(fd_set, fd_set + 8):
                 if angr.options.CGC_NON_BLOCKING_FDS in self.state.options:
-                    sym_bit = self.state.solver.BVV(1, 1)
+                    sym_bit = claripy.BVV(1, 1)
                 else:
                     sym_bit = self.state.solver.Unconstrained(
                         "fdwait_read_%d_%d" % (run_count, fd), 1, key=("syscall", "fdwait", fd, "read_ready")
                     )
-                fd = self.state.solver.BVV(fd, self.state.arch.bits)
-                sym_newbit = self.state.solver.If(self.state.solver.ULT(fd, nfds), sym_bit, 0)
+                fd = claripy.BVV(fd, self.state.arch.bits)
+                sym_newbit = claripy.If(claripy.ULT(fd, nfds), sym_bit, 0)
                 total_ready += sym_newbit.zero_extend(self.state.arch.bits - 1)
                 sym_newbits.append(sym_newbit)
             read_fds.extend(reversed(sym_newbits))
-        self.state.memory.store(readfds, self.state.solver.Concat(*read_fds), condition=readfds != 0)
+        self.state.memory.store(readfds, claripy.Concat(*read_fds), condition=readfds != 0)
 
         write_fds = []
         for fd_set in range(0, 32, 8):
             sym_newbits = []
             for fd in range(fd_set, fd_set + 8):
                 if angr.options.CGC_NON_BLOCKING_FDS in self.state.options:
-                    sym_bit = self.state.solver.BVV(1, 1)
+                    sym_bit = claripy.BVV(1, 1)
                 else:
                     sym_bit = self.state.solver.Unconstrained(
                         "fdwait_write_%d_%d" % (run_count, fd), 1, key=("syscall", "fdwait", fd, "write_ready")
                     )
 
-                fd = self.state.solver.BVV(fd, self.state.arch.bits)
-                sym_newbit = self.state.solver.If(self.state.solver.ULT(fd, nfds), sym_bit, 0)
+                fd = claripy.BVV(fd, self.state.arch.bits)
+                sym_newbit = claripy.If(claripy.ULT(fd, nfds), sym_bit, 0)
                 total_ready += sym_newbit.zero_extend(self.state.arch.bits - 1)
                 sym_newbits.append(sym_newbit)
             write_fds.extend(reversed(sym_newbits))
-        self.state.memory.store(writefds, self.state.solver.Concat(*write_fds), condition=writefds != 0)
+        self.state.memory.store(writefds, claripy.Concat(*write_fds), condition=writefds != 0)
 
         self.state.memory.store(readyfds, total_ready, endness="Iend_LE", condition=readyfds != 0)
 
@@ -56,7 +58,7 @@ class fdwait(angr.SimProcedure):
             timeout + 4, 4, endness=self.state.arch.memory_endness, condition=timeout != 0, fallback=0
         )
         total_time = tv_sec * 1000000 + tv_usec
-        self.state.cgc.time += self.state.solver.If(total_ready == 0, total_time, 0)
+        self.state.cgc.time += claripy.If(total_ready == 0, total_time, 0)
 
         # TODO: errors
-        return self.state.solver.BVV(0, self.state.arch.bits)
+        return claripy.BVV(0, self.state.arch.bits)