angr 9.2.116__py3-none-manylinux2014_aarch64.whl → 9.2.118__py3-none-manylinux2014_aarch64.whl

angr/analyses/typehoon/typevars.py

@@ -1,5 +1,6 @@
 # pylint:disable=missing-class-docstring
-from typing import Any, Optional, Union, TYPE_CHECKING
+from __future__ import annotations
+from typing import Any, Union, TYPE_CHECKING
 from collections.abc import Iterable
 from itertools import count
 
@@ -19,8 +20,8 @@ TypeType = Union["TypeConstant", "TypeVariable", "DerivedTypeVariable"]
 class TypeConstraint:
     __slots__ = ()
 
-    def pp_str(self, mapping: dict["TypeVariable", Any]) -> str:
-        raise NotImplementedError()
+    def pp_str(self, mapping: dict[TypeVariable, Any]) -> str:
+        raise NotImplementedError
 
 
 class Equivalence(TypeConstraint):
@@ -33,7 +34,7 @@ class Equivalence(TypeConstraint):
         self.type_a = type_a
         self.type_b = type_b
 
-    def pp_str(self, mapping: dict["TypeVariable", Any]) -> str:
+    def pp_str(self, mapping: dict[TypeVariable, Any]) -> str:
         return f"{self.type_a.pp_str(mapping)} == {self.type_b.pp_str(mapping)}"
 
     def __repr__(self):
@@ -57,11 +58,11 @@ class Existence(TypeConstraint):
     def __init__(self, type_):
         self.type_ = type_
 
-    def pp_str(self, mapping: dict["TypeVariable", Any]) -> str:
+    def pp_str(self, mapping: dict[TypeVariable, Any]) -> str:
         return f"V {self.type_.pp_str(mapping)}"
 
     def __repr__(self):
-        return "V %s" % self.type_
+        return f"V {self.type_}"
 
     def __eq__(self, other):
         return type(other) is Existence and self.type_ == other.type_
@@ -73,11 +74,10 @@ class Existence(TypeConstraint):
         if self.type_ in replacements:
             return True, Existence(replacements[self.type_])
 
-        else:
-            replaced, new_type = self.type_.replace(replacements)
-            if replaced:
-                return True, Existence(new_type)
-            return False, self
+        replaced, new_type = self.type_.replace(replacements)
+        if replaced:
+            return True, Existence(new_type)
+        return False, self
 
 
 class Subtype(TypeConstraint):
@@ -90,7 +90,7 @@ class Subtype(TypeConstraint):
         self.super_type = super_type
         self.sub_type = sub_type
 
-    def pp_str(self, mapping: dict["TypeVariable", Any]) -> str:
+    def pp_str(self, mapping: dict[TypeVariable, Any]) -> str:
         return f"{self.sub_type.pp_str(mapping)} <: {self.super_type.pp_str(mapping)}"
 
     def __repr__(self):
@@ -127,8 +127,7 @@ class Subtype(TypeConstraint):
                 subtype if subtype is not None else self.sub_type,
                 supertype if supertype is not None else self.super_type,
             )
-        else:
-            return False, self
+        return False, self
 
 
 class Add(TypeConstraint):
@@ -147,12 +146,8 @@ class Add(TypeConstraint):
         self.type_1 = type_1
         self.type_r = type_r
 
-    def pp_str(self, mapping: dict["TypeVariable", Any]) -> str:
-        return "{} == {} + {}".format(
-            self.type_r.pp_str(mapping),
-            self.type_0.pp_str(mapping),
-            self.type_1.pp_str(mapping),
-        )
+    def pp_str(self, mapping: dict[TypeVariable, Any]) -> str:
+        return f"{self.type_r.pp_str(mapping)} == {self.type_0.pp_str(mapping)} + {self.type_1.pp_str(mapping)}"
 
     def __repr__(self):
         return f"{self.type_r!r} == {self.type_0!r} + {self.type_1!r}"
@@ -199,8 +194,7 @@ class Add(TypeConstraint):
                 t1 if t1 is not None else self.type_1,
                 tr if tr is not None else self.type_r,
             )
-        else:
-            return False, self
+        return False, self
 
 
 class Sub(TypeConstraint):
@@ -219,12 +213,8 @@ class Sub(TypeConstraint):
         self.type_1 = type_1
         self.type_r = type_r
 
-    def pp_str(self, mapping: dict["TypeVariable", Any]) -> str:
-        return "{} == {} - {}".format(
-            self.type_r.pp_str(mapping),
-            self.type_0.pp_str(mapping),
-            self.type_1.pp_str(mapping),
-        )
+    def pp_str(self, mapping: dict[TypeVariable, Any]) -> str:
+        return f"{self.type_r.pp_str(mapping)} == {self.type_0.pp_str(mapping)} - {self.type_1.pp_str(mapping)}"
 
     def __repr__(self):
         return f"{self.type_r!r} == {self.type_0!r} - {self.type_1!r}"
@@ -271,8 +261,7 @@ class Sub(TypeConstraint):
                 t1 if t1 is not None else self.type_1,
                 tr if tr is not None else self.type_r,
             )
-        else:
-            return False, self
+        return False, self
 
 
 _typevariable_counter = count()
@@ -288,11 +277,11 @@ class TypeVariable:
             self.idx: int = idx
         self.name = name
 
-    def pp_str(self, mapping: dict["TypeVariable", Any]) -> str:
+    def pp_str(self, mapping: dict[TypeVariable, Any]) -> str:
         varname = mapping.get(self, self.name)
         if varname is None:
             return repr(self)
-        return f"{varname} ({repr(self)})"
+        return f"{varname} ({self!r})"
 
     def __eq__(self, other):
         if type(other) is not TypeVariable:
@@ -318,13 +307,13 @@ class TypeVariable:
 class DerivedTypeVariable(TypeVariable):
     __slots__ = ("type_var", "labels")
 
-    type_var: Union[TypeVariable, "TypeConstant"]
+    type_var: TypeVariable | TypeConstant
 
     def __init__(
         self,
-        type_var: Union[TypeVariable, "DerivedTypeVariable"] | None,
+        type_var: TypeVariable | DerivedTypeVariable | None,
         label,
-        labels: Iterable["BaseLabel"] | None = None,
+        labels: Iterable[BaseLabel] | None = None,
         idx=None,
     ):
         super().__init__(idx=idx)
@@ -340,27 +329,27 @@ class DerivedTypeVariable(TypeVariable):
             raise TypeError("You cannot specify both label and labels at the same time")
 
         if label is not None:
-            self.labels = existing_labels + (label,)
+            self.labels = (*existing_labels, label)
         else:
-            self.labels: tuple["BaseLabel"] = existing_labels + tuple(labels)
+            self.labels: tuple[BaseLabel] = existing_labels + tuple(labels)
 
         if not self.labels:
             raise ValueError("A DerivedTypeVariable must have at least one label")
 
-    def one_label(self) -> Optional["BaseLabel"]:
+    def one_label(self) -> BaseLabel | None:
         return self.labels[0] if len(self.labels) == 1 else None
 
-    def path(self) -> tuple["BaseLabel"]:
+    def path(self) -> tuple[BaseLabel]:
         return self.labels
 
-    def longest_prefix(self) -> Union[TypeVariable, "DerivedTypeVariable"] | None:
+    def longest_prefix(self) -> TypeVariable | DerivedTypeVariable | None:
         if not self.labels:
             return None
         if len(self.labels) == 1:
             return self.type_var
         return DerivedTypeVariable(self.type_var, None, labels=self.labels[:-1])
 
-    def pp_str(self, mapping: dict["TypeVariable", Any]) -> str:
+    def pp_str(self, mapping: dict[TypeVariable, Any]) -> str:
         return ".".join([self.type_var.pp_str(mapping)] + [repr(lbl) for lbl in self.labels])
 
     def __eq__(self, other):
@@ -391,8 +380,7 @@ class DerivedTypeVariable(TypeVariable):
         if typevar is not None:
             # replacement has happened
             return True, DerivedTypeVariable(typevar, None, labels=self.labels, idx=self.idx)
-        else:
-            return False, self
+        return False, self
 
 
 class TypeVariables:
@@ -402,7 +390,7 @@ class TypeVariables:
     )
 
     def __init__(self):
-        self._typevars: dict["SimVariable", set[TypeVariable]] = {}
+        self._typevars: dict[SimVariable, set[TypeVariable]] = {}
         self._last_typevars: dict[SimVariable, TypeVariable] = {}
 
     def copy(self):
@@ -419,7 +407,7 @@ class TypeVariables:
         # )
         return "{TypeVars: %d items}" % len(self._typevars)
 
-    def add_type_variable(self, var: "SimVariable", codeloc, typevar: TypeVariable):  # pylint:disable=unused-argument
+    def add_type_variable(self, var: SimVariable, codeloc, typevar: TypeVariable):  # pylint:disable=unused-argument
         if var not in self._typevars:
             self._typevars[var] = set()
         elif typevar in self._typevars[var]:
@@ -430,7 +418,7 @@ class TypeVariables:
     def get_type_variable(self, var, codeloc):  # pylint:disable=unused-argument
         return self._last_typevars[var]
 
-    def has_type_variable_for(self, var: "SimVariable", codeloc):  # pylint:disable=unused-argument
+    def has_type_variable_for(self, var: SimVariable, codeloc):  # pylint:disable=unused-argument
         return var in self._typevars
         # if codeloc not in self._typevars[var]:
         #     return False
@@ -455,7 +443,7 @@ class BaseLabel:
         return type(self) is type(other) and hash(self) == hash(other)
 
     def __hash__(self):
-        return hash((type(self),) + tuple(getattr(self, k) for k in self.__slots__))
+        return hash((type(self), *tuple(getattr(self, k) for k in self.__slots__)))
 
     @property
     def variance(self) -> Variance:
@@ -469,7 +457,7 @@ class FuncIn(BaseLabel):
         self.loc = loc
 
     def __repr__(self):
-        return "in<%s>" % self.loc
+        return f"in<{self.loc}>"
 
 
 class FuncOut(BaseLabel):
@@ -479,7 +467,7 @@ class FuncOut(BaseLabel):
         self.loc = loc
 
     def __repr__(self):
-        return "out<%s>" % self.loc
+        return f"out<{self.loc}>"
 
 
 class Load(BaseLabel):

angr/analyses/typehoon/variance.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import enum
 
 

angr/analyses/variable_recovery/__init__.py

@@ -1,2 +1,3 @@
+from __future__ import annotations
 from .variable_recovery import VariableRecovery
 from .variable_recovery_fast import VariableRecoveryFast

angr/analyses/variable_recovery/annotations.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from claripy import Annotation
 
 

angr/analyses/variable_recovery/engine_ail.py

@@ -1,4 +1,5 @@
 # pylint:disable=arguments-differ,invalid-unary-operand-type
+from __future__ import annotations
 from typing import TYPE_CHECKING
 import logging
 
@@ -31,14 +32,20 @@ class SimEngineVRAIL(
     The engine for variable recovery on AIL.
     """
 
-    state: "VariableRecoveryFastState"
+    state: VariableRecoveryFastState
     block: ailment.Block
 
-    def __init__(self, *args, call_info=None, **kwargs):
+    def __init__(self, *args, call_info=None, vvar_to_vvar: dict[int, int] | None, **kwargs):
         super().__init__(*args, **kwargs)
 
         self._reference_spoffset: bool = False
         self.call_info = call_info or {}
+        self.vvar_to_vvar = vvar_to_vvar
+
+    def _mapped_vvarid(self, vvar_id: int) -> int | None:
+        if self.vvar_to_vvar is not None and vvar_id in self.vvar_to_vvar:
+            return self.vvar_to_vvar[vvar_id]
+        return None
 
     # Statement handlers
 
@@ -66,6 +73,21 @@ class SimEngineVRAIL(
 
             self.tmps[stmt.dst.tmp_idx] = data
 
+        elif dst_type is ailment.Expr.VirtualVariable:
+            data = self._expr(stmt.src)
+            self._assign_to_vvar(
+                stmt.dst, data, src=stmt.src, dst=stmt.dst, vvar_id=self._mapped_vvarid(stmt.dst.varid)
+            )
+
+            if stmt.dst.was_stack and isinstance(stmt.dst.stack_offset, int):
+                # store it to the stack region in case it's directly referenced later
+                self._store(
+                    RichR(self.state.stack_address(stmt.dst.stack_offset)),
+                    data,
+                    stmt.dst.bits // self.arch.byte_width,
+                    stmt=stmt,
+                )
+
         else:
             l.warning("Unsupported dst type %s.", dst_type)
 
@@ -92,16 +114,15 @@ class SimEngineVRAIL(
                 args.append(richr)
 
         ret_expr = None
-        ret_reg_offset = None
         ret_expr_bits = self.state.arch.bits
         ret_val = None  # stores the value that this method should return to its caller when this is a call expression.
         create_variable = True
         if not is_expr:
             # this is a call statement. we need to update the return value register later
-            ret_expr: ailment.Expr.Register | None = stmt.ret_expr
+            ret_expr: ailment.Expr.VirtualVariable | None = stmt.ret_expr
             if ret_expr is not None:
-                ret_reg_offset = ret_expr.reg_offset
-                ret_expr_bits = ret_expr.bits
+                if ret_expr.category == ailment.Expr.VirtualVariableCategory.REGISTER:
+                    ret_expr_bits = ret_expr.bits
             else:
                 # the return expression is not used, so we treat this call as not returning anything
                 if stmt.calling_convention is not None:
@@ -114,13 +135,10 @@ class SimEngineVRAIL(
                     )
                     ret_expr: SimRegArg = self.project.factory.cc().RETURN_VAL
 
-                if ret_expr is not None:
-                    ret_reg_offset = self.project.arch.registers[ret_expr.reg_name][0]
                 create_variable = False
         else:
             # this is a call expression. we just return the value at the end of this method
-            if stmt.ret_expr is not None:
-                ret_expr_bits = stmt.ret_expr.bits
+            ret_expr_bits = stmt.bits
 
         if isinstance(target, ailment.Expr.Expression) and not isinstance(target, ailment.Expr.Const):
             # this is a dynamically calculated call target
@@ -143,10 +161,7 @@ class SimEngineVRAIL(
                 prototype_libname = func.prototype_libname
 
         # dump the type of the return value
-        if prototype is not None:
-            ret_ty = typevars.TypeVariable()  # TypeLifter(self.arch.bits).lift(prototype.returnty)
-        else:
-            ret_ty = typevars.TypeVariable()
+        ret_ty = typevars.TypeVariable() if prototype is not None else typevars.TypeVariable()
         if isinstance(ret_ty, typeconsts.BottomType):
             ret_ty = typevars.TypeVariable()
 
@@ -157,14 +172,21 @@ class SimEngineVRAIL(
             # call expression mode
             ret_val = RichR(self.state.top(ret_expr_bits), typevar=ret_ty)
         else:
-            if ret_expr is not None:
-                # update the return value register
-                if return_value_use_full_width_reg:
-                    expr_bits = self.state.arch.bits
-                else:
-                    expr_bits = ret_expr_bits
+            # update the return value register
+            if isinstance(ret_expr, ailment.Expr.VirtualVariable):
+                expr_bits = ret_expr_bits
+                self._assign_to_vvar(
+                    ret_expr,
+                    RichR(self.state.top(expr_bits), typevar=ret_ty),
+                    dst=ret_expr,
+                    create_variable=create_variable,
+                    vvar_id=self._mapped_vvarid(ret_expr.varid),
+                )
+            elif isinstance(ret_expr, ailment.Expr.Register):
+                l.warning("Left-over register found in call.ret_expr.")
+                expr_bits = self.state.arch.bits if return_value_use_full_width_reg else ret_expr_bits
                 self._assign_to_register(
-                    ret_reg_offset,
+                    ret_expr.reg_offset,
                     RichR(self.state.top(expr_bits), typevar=ret_ty),
                     expr_bits // self.arch.byte_width,
                     dst=ret_expr,
@@ -229,8 +251,23 @@ class SimEngineVRAIL(
         addr_r = self._expr(expr.addr)
         size = expr.size
 
-        r = self._load(addr_r, size, expr=expr)
-        return r
+        return self._load(addr_r, size, expr=expr)
+
+    def _ail_handle_VirtualVariable(self, expr: ailment.Expr.VirtualVariable):
+        return self._read_from_vvar(expr, expr=expr, vvar_id=self._mapped_vvarid(expr.varid))
+
+    def _ail_handle_Phi(self, expr: ailment.Expr.Phi):
+        tvs = set()
+        for _, vvar in expr.src_and_vvars:
+            if vvar is not None:
+                r = self._read_from_vvar(vvar, expr=expr, vvar_id=self._mapped_vvarid(vvar.varid))
+                if r.typevar is not None:
+                    tvs.add(r.typevar)
+
+        tv = typevars.TypeVariable()
+        for tv_ in tvs:
+            self.state.add_type_constraint(typevars.Subtype(tv, tv_))
+        return RichR(self.state.top(expr.bits), typevar=tv)
 
     def _ail_handle_Const(self, expr: ailment.Expr.Const):
         if isinstance(expr.value, float):
@@ -342,6 +379,12 @@ class SimEngineVRAIL(
     _ail_handle_CmpLE = _ail_handle_Cmp
     _ail_handle_CmpGT = _ail_handle_Cmp
     _ail_handle_CmpGE = _ail_handle_Cmp
+    _ail_handle_CasCmpEQ = _ail_handle_Cmp
+    _ail_handle_CasCmpNE = _ail_handle_Cmp
+    _ail_handle_CasCmpLT = _ail_handle_Cmp
+    _ail_handle_CasCmpLE = _ail_handle_Cmp
+    _ail_handle_CasCmpGT = _ail_handle_Cmp
+    _ail_handle_CasCmpGE = _ail_handle_Cmp
 
     def _ail_handle_Add(self, expr):
         arg0, arg1 = expr.operands
@@ -350,11 +393,8 @@ class SimEngineVRAIL(
         r1 = self._expr(arg1)
 
         type_constraints = set()
-        if r0.typevar is not None:
-            r0_typevar = r0.typevar
-        else:
-            # create a new type variable and add constraints accordingly
-            r0_typevar = typevars.TypeVariable()
+        # create a new type variable and add constraints accordingly
+        r0_typevar = r0.typevar if r0.typevar is not None else typevars.TypeVariable()
 
         if r1.data.concrete:
             # addition with constants. create a derived type variable
@@ -454,10 +494,12 @@ class SimEngineVRAIL(
         if expr.floating_point:
             quotient = self.state.top(to_size)
         else:
-            if expr.signed:
+            if (r1.data == 0).is_true():
+                quotient = self.state.top(to_size)
+            elif expr.signed:
                 quotient = claripy.SDiv(r0.data, claripy.SignExt(from_size - to_size, r1.data))
             else:
-                quotient = r0.data / claripy.ZeroExt(from_size - to_size, r1.data)
+                quotient = r0.data // claripy.ZeroExt(from_size - to_size, r1.data)
 
         return RichR(
             quotient,
@@ -472,7 +514,9 @@ class SimEngineVRAIL(
         from_size = expr.from_bits
         to_size = expr.to_bits
 
-        if expr.signed:
+        if (r1.data == 0).is_true():
+            r = self.state.top(to_size * 2)
+        elif expr.signed:
             quotient = r0.data.SDiv(claripy.SignExt(from_size - to_size, r1.data))
             remainder = r0.data.SMod(claripy.SignExt(from_size - to_size, r1.data))
             quotient_size = to_size
@@ -505,7 +549,9 @@ class SimEngineVRAIL(
         if expr.floating_point:
             remainder = self.state.top(to_size)
         else:
-            if expr.signed:
+            if (r1.data == 0).is_true():
+                remainder = self.state.top(to_size)
+            elif expr.signed:
                 remainder = r0.data.SMod(claripy.SignExt(from_size - to_size, r1.data))
             else:
                 remainder = r0.data % claripy.ZeroExt(from_size - to_size, r1.data)