angr 9.2.116__py3-none-manylinux2014_aarch64.whl → 9.2.118__py3-none-manylinux2014_aarch64.whl

angr/analyses/cfg/indirect_jump_resolvers/jumptable.py

@@ -1,4 +1,5 @@
 # pylint:disable=wrong-import-position,wrong-import-order
+from __future__ import annotations
 import enum
 from typing import TYPE_CHECKING
 from collections.abc import Sequence
@@ -143,14 +144,14 @@ class ConstantValueManager:
         "mapping",
     )
 
-    def __init__(self, project, kb, func: "Function"):
+    def __init__(self, project, kb, func: Function):
         self.project = project
         self.kb = kb
         self.func = func
 
         self.mapping = None
 
-    def reg_read_callback(self, state: "SimState"):
+    def reg_read_callback(self, state: SimState):
         if not self.mapping:
             self._build_mapping()
 
@@ -317,8 +318,7 @@ class JumpTableProcessor(
         return "SpOffset" in expr.variables
 
     def _get_spoffset_expr(self, sp_offset: SpOffset) -> claripy.ast.BV:
-        v = self._SPOFFSET_BASE.annotate(RegOffsetAnnotation(sp_offset))
-        return v
+        return self._SPOFFSET_BASE.annotate(RegOffsetAnnotation(sp_offset))
 
     @staticmethod
     def _extract_spoffset_from_expr(expr: claripy.ast.Base) -> SpOffset | None:
@@ -329,16 +329,15 @@ class JumpTableProcessor(
         elif expr.op == "__add__":
             if len(expr.args) == 1:
                 return JumpTableProcessor._extract_spoffset_from_expr(expr.args[0])
-            elif len(expr.args) == 2 and expr.args[1].op == "BVV":
+            if len(expr.args) == 2 and expr.args[1].op == "BVV":
                 sp_offset = JumpTableProcessor._extract_spoffset_from_expr(expr.args[0])
                 if sp_offset is not None:
                     delta = expr.args[1].concrete_value
                     sp_offset += delta
                     return sp_offset
-        elif expr.op == "__and__":
-            if len(expr.args) == 2 and expr.args[1].op == "BVV":
-                # ignore all masking on SpOffsets
-                return JumpTableProcessor._extract_spoffset_from_expr(expr.args[0])
+        elif expr.op == "__and__" and len(expr.args) == 2 and expr.args[1].op == "BVV":
+            # ignore all masking on SpOffsets
+            return JumpTableProcessor._extract_spoffset_from_expr(expr.args[0])
         return None
 
     @staticmethod
@@ -348,8 +347,7 @@ class JumpTableProcessor(
     def _get_regoffset_expr(self, reg_offset: RegisterOffset, bits: int) -> claripy.ast.BV:
         if bits not in self._REGOFFSET_BASE:
             self._REGOFFSET_BASE[bits] = claripy.BVS("RegisterOffset", bits, explicit_name=True)
-        v = self._REGOFFSET_BASE[bits].annotate(RegOffsetAnnotation(reg_offset))
-        return v
+        return self._REGOFFSET_BASE[bits].annotate(RegOffsetAnnotation(reg_offset))
 
     @staticmethod
     def _extract_regoffset_from_expr(expr: claripy.ast.Base) -> RegisterOffset | None:
@@ -360,16 +358,15 @@ class JumpTableProcessor(
         elif expr.op == "__add__":
             if len(expr.args) == 1:
                 return JumpTableProcessor._extract_regoffset_from_expr(expr.args[0])
-            elif len(expr.args) == 2 and expr.args[1].op == "BVV":
+            if len(expr.args) == 2 and expr.args[1].op == "BVV":
                 reg_offset = JumpTableProcessor._extract_regoffset_from_expr(expr.args[0])
                 if reg_offset is not None:
                     delta = expr.args[1].concrete_value
                     reg_offset += delta
                     return reg_offset
-        elif expr.op == "__and__":
-            if len(expr.args) == 2 and expr.args[1].op == "BVV":
-                # ignore all masking on SpOffsets
-                return JumpTableProcessor._extract_spoffset_from_expr(expr.args[0])
+        elif expr.op == "__and__" and len(expr.args) == 2 and expr.args[1].op == "BVV":
+            # ignore all masking on SpOffsets
+            return JumpTableProcessor._extract_spoffset_from_expr(expr.args[0])
         return None
 
     def _handle_WrTmp(self, stmt):
@@ -383,10 +380,7 @@ class JumpTableProcessor(
         self._tsrc = set()
         offset = stmt.offset
         data = self._expr(stmt.data)
-        if self._tsrc is not None:
-            r = (self._tsrc, data)
-        else:
-            r = ((self.block.addr, self.stmt_idx), data)
+        r = (self._tsrc, data) if self._tsrc is not None else ((self.block.addr, self.stmt_idx), data)
         self.state._registers[offset] = r
 
     def _handle_Store(self, stmt):
@@ -448,10 +442,9 @@ class JumpTableProcessor(
         guard = self._expr(stmt.guard)
         if guard is True:
             return self._do_load(stmt.addr, stmt.addr.result_size(self.tyenv) // 8)
-        elif guard is False:
+        if guard is False:
             return self._do_load(stmt.alt, stmt.alt.result_size(self.tyenv) // 8)
-        else:
-            return None
+        return None
 
     def _handle_Const(self, expr):
         v = super()._handle_Const(expr)
@@ -496,19 +489,13 @@ class JumpTableProcessor(
         if isinstance(arg0, pyvex.IRExpr.RdTmp):
             if arg0.tmp in self.state._tmpvar_source:
                 arg0_src = self.state._tmpvar_source[arg0.tmp]
-                if not arg0_src or len(arg0_src) > 1:
-                    arg0_src = None
-                else:
-                    arg0_src = next(iter(arg0_src))
+                arg0_src = None if not arg0_src or len(arg0_src) > 1 else next(iter(arg0_src))
         elif isinstance(arg0, pyvex.IRExpr.Const):
             arg0_src = "const"
         if isinstance(arg1, pyvex.IRExpr.RdTmp):
             if arg1.tmp in self.state._tmpvar_source:
                 arg1_src = self.state._tmpvar_source[arg1.tmp]
-                if not arg1_src or len(arg1_src) > 1:
-                    arg1_src = None
-                else:
-                    arg1_src = next(iter(arg1_src))
+                arg1_src = None if not arg1_src or len(arg1_src) > 1 else next(iter(arg1_src))
         elif isinstance(arg1, pyvex.IRExpr.Const):
             arg1_src = "const"
 
@@ -545,7 +532,7 @@ class JumpTableProcessor(
                 #
                 # Instead of writing 1 to [rbp+var_54], we want to write a symbolic variable there instead. Otherwise
                 # we will only recover the second jump target instead of all 7 targets.
-                self.state.stmts_to_instrument.append(("mem_write",) + arg1_src)
+                self.state.stmts_to_instrument.append(("mem_write", *arg1_src))
             elif isinstance(arg1_src_stmt, pyvex.IRStmt.WrTmp) and isinstance(arg1_src_stmt.data, pyvex.IRExpr.Load):
                 # Loading a constant/variable from memory (and later the value is stored in a register)
                 # Same as above, we will need to overwrite it when executing the slice to guarantee the full recovery
@@ -560,7 +547,7 @@ class JumpTableProcessor(
                 #     mov rax, qword [rax*8+0x220741]
                 #     jmp rax
                 #
-                self.state.stmts_to_instrument.append(("mem_read",) + arg1_src)
+                self.state.stmts_to_instrument.append(("mem_read", *arg1_src))
             elif isinstance(arg1_src_stmt, pyvex.IRStmt.Put):
                 # Storing a constant/variable in register
                 # Same as above...
@@ -574,7 +561,7 @@ class JumpTableProcessor(
                 #     mov   eax, eax
                 #     mov   rax, qword [rax*8+0x2231ae]
                 #
-                self.state.stmts_to_instrument.append(("reg_write",) + arg1_src)
+                self.state.stmts_to_instrument.append(("reg_write", *arg1_src))
 
     def _do_load(self, addr, size):
         src = (self.block.addr, self.stmt_idx)
@@ -590,8 +577,7 @@ class JumpTableProcessor(
         elif isinstance(addr, int):
             # Load data from memory if it is mapped
             try:
-                v = self.project.loader.memory.unpack_word(addr, size=size)
-                return v
+                return self.project.loader.memory.unpack_word(addr, size=size)
             except KeyError:
                 return None
         elif self._is_registeroffset(addr):
@@ -604,7 +590,7 @@ class JumpTableProcessor(
                 try:
                     source = next(iter(src for src in self.state._registers[reg_offset.reg][0] if src != "const"))
                     assert isinstance(source, tuple)
-                    self.state.regs_to_initialize.append(source + (reg_offset.reg, reg_offset.bits))
+                    self.state.regs_to_initialize.append((*source, reg_offset.reg, reg_offset.bits))
                 except StopIteration:
                     # we don't need to initialize this register
                     # it might be caused by an incorrect analysis result
@@ -634,7 +620,7 @@ class StoreHook:
             write_length = len(state.inspect.mem_write_expr)
         else:
             write_length = write_length * state.arch.byte_width
-        state.inspect.mem_write_expr = state.solver.BVS("instrumented_store", write_length)
+        state.inspect.mem_write_expr = claripy.BVS("instrumented_store", write_length)
 
 
 class LoadHook:
@@ -648,7 +634,7 @@ class LoadHook:
     def hook_before(self, state):
         addr = state.inspect.mem_read_address
         size = state.solver.eval(state.inspect.mem_read_length)
-        self._var = state.solver.BVS("instrumented_load", size * 8)
+        self._var = claripy.BVS("instrumented_load", size * 8)
         state.memory.store(addr, self._var, endness=state.arch.memory_endness)
 
     def hook_after(self, state):
@@ -662,7 +648,7 @@ class PutHook:
 
     @staticmethod
     def hook(state):
-        state.inspect.reg_write_expr = state.solver.BVS(
+        state.inspect.reg_write_expr = claripy.BVS(
             "instrumented_put", state.solver.eval(state.inspect.reg_write_length) * 8
         )
 
@@ -678,7 +664,7 @@ class RegisterInitializerHook:
         self.value = value
 
     def hook(self, state):
-        state.registers.store(self.reg_offset, state.solver.BVV(self.value, self.reg_bits))
+        state.registers.store(self.reg_offset, claripy.BVV(self.value, self.reg_bits))
 
 
 class BSSHook:
@@ -816,9 +802,7 @@ class JumpTableResolver(IndirectJumpResolver):
 
         if jumpkind == "Ijk_Boring":
             return True
-        if self.resolve_calls and jumpkind == "Ijk_Call":
-            return True
-        return False
+        return bool(self.resolve_calls and jumpkind == "Ijk_Call")
 
     def resolve(self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs):
         """
@@ -837,7 +821,7 @@ class JumpTableResolver(IndirectJumpResolver):
             # the function must exist in the KB
             return False, None
 
-        func: "Function" = cfg.kb.functions[func_addr]
+        func: Function = cfg.kb.functions[func_addr]
         self._max_targets = cfg._indirect_jump_target_limit
 
         # this is an indirect call if (1) the instruction is a call, or (2) the instruction is a tail jump (we detect
@@ -901,7 +885,7 @@ class JumpTableResolver(IndirectJumpResolver):
         self,
         cfg,
         addr: int,
-        func: "Function",
+        func: Function,
         b: Blade,
         cv_manager: ConstantValueManager | None,
         potential_call_table: bool = False,
@@ -976,7 +960,7 @@ class JumpTableResolver(IndirectJumpResolver):
                 if len(pred_succs) == 2:
                     non_node_succ = next(iter(pred_succ for pred_succ in pred_succs if pred_succ is not curr_node))
                     while func.graph.out_degree[non_node_succ] == 1:
-                        non_node_succ = list(func.graph.successors(non_node_succ))[0]
+                        non_node_succ = next(iter(func.graph.successors(non_node_succ)))
                         if non_node_succ == curr_node:
                             is_diamond = True
                             break
@@ -998,9 +982,8 @@ class JumpTableResolver(IndirectJumpResolver):
                     ij.jumptable = False
                     ij.resolved_targets = {jump_target}
                 return True, [jump_target]
-            else:
-                l.debug("Found single constant load, but it does not appear to be a valid target")
-                return False, None
+            l.debug("Found single constant load, but it does not appear to be a valid target")
+            return False, None
 
         # Well, we have a real jump table to resolve!
 
@@ -1214,7 +1197,7 @@ class JumpTableResolver(IndirectJumpResolver):
                             AddressTransformationTypes.Assignment, [stmt.tmp, AddressSingleton]
                         )
                     continue
-                elif isinstance(stmt.data, pyvex.IRExpr.ITE):
+                if isinstance(stmt.data, pyvex.IRExpr.ITE):
                     # data transferring
                     #   t16 = if (t43) ILGop_Ident32(LDle(t29)) else 0x0000c844
                     # > t44 = ITE(t43,t16,0x0000c844)
@@ -1224,7 +1207,7 @@ class JumpTableResolver(IndirectJumpResolver):
                             AddressTransformationTypes.Assignment, [stmt.tmp, AddressSingleton]
                         )
                     continue
-                elif isinstance(stmt.data, pyvex.IRExpr.Unop):
+                if isinstance(stmt.data, pyvex.IRExpr.Unop):
                     if stmt.data.op == "Iop_32Sto64":
                         # data transferring with conversion
                         # t11 = 32Sto64(t12)
@@ -1234,7 +1217,7 @@ class JumpTableResolver(IndirectJumpResolver):
                                 AddressTransformationTypes.SignedExtension, [32, 64, AddressSingleton]
                             )
                         continue
-                    elif stmt.data.op == "Iop_64to32":
+                    if stmt.data.op == "Iop_64to32":
                         # data transferring with conversion
                         # t24 = 64to32(t21)
                         stmts_to_remove.append(stmt_loc)
@@ -1243,7 +1226,7 @@ class JumpTableResolver(IndirectJumpResolver):
                                 AddressTransformationTypes.Truncation, [64, 32, AddressSingleton]
                             )
                         continue
-                    elif stmt.data.op == "Iop_32Uto64":
+                    if stmt.data.op == "Iop_32Uto64":
                         # data transferring with conversion
                         # t21 = 32Uto64(t22)
                         stmts_to_remove.append(stmt_loc)
@@ -1252,7 +1235,7 @@ class JumpTableResolver(IndirectJumpResolver):
                                 AddressTransformationTypes.UnsignedExtension, [32, 64, AddressSingleton]
                             )
                         continue
-                    elif stmt.data.op == "Iop_16Uto32":
+                    if stmt.data.op == "Iop_16Uto32":
                         # data transferring with conversion
                         stmts_to_remove.append(stmt_loc)
                         if isinstance(stmt, pyvex.IRStmt.WrTmp):
@@ -1260,7 +1243,7 @@ class JumpTableResolver(IndirectJumpResolver):
                                 AddressTransformationTypes.UnsignedExtension, [16, 32, AddressSingleton]
                             )
                         continue
-                    elif stmt.data.op == "Iop_8Uto32":
+                    if stmt.data.op == "Iop_8Uto32":
                         # data transferring with conversion
                         stmts_to_remove.append(stmt_loc)
                         if isinstance(stmt, pyvex.IRStmt.WrTmp):
@@ -1268,7 +1251,7 @@ class JumpTableResolver(IndirectJumpResolver):
                                 AddressTransformationTypes.UnsignedExtension, [8, 32, AddressSingleton]
                             )
                         continue
-                    elif stmt.data.op == "Iop_8Uto64":
+                    if stmt.data.op == "Iop_8Uto64":
                         stmts_to_remove.append(stmt_loc)
                         if isinstance(stmt, pyvex.IRStmt.WrTmp):
                             transformations[(stmt_loc[0], stmt.tmp)] = AddressTransformation(
@@ -1359,7 +1342,7 @@ class JumpTableResolver(IndirectJumpResolver):
                             # not supported
                             pass
                         continue
-                    elif stmt.data.op.startswith("Iop_Or"):
+                    if stmt.data.op.startswith("Iop_Or"):
                         # this is sometimes used in VEX statements in THUMB mode code to adjust the address to an odd
                         # number
                         # e.g.
@@ -1410,7 +1393,6 @@ class JumpTableResolver(IndirectJumpResolver):
                                 AddressTransformationTypes.ShiftLeft, [AddressSingleton, stmt.data.args[1].con.value]
                             )
                             continue
-                    elif stmt.data.op.startswith("Iop_Sar"):
                         # AArch64
                         #
                         # LDRB            W0, [X20,W26,UXTW]
@@ -1437,15 +1419,17 @@ class JumpTableResolver(IndirectJumpResolver):
                         #    15 | PUT(x0) = t4
                         #  + 16 | ------ IMark(0x51f858, 4, 0) ------
                         #  + Next: t4
-                        if isinstance(stmt.data.args[0], pyvex.IRExpr.RdTmp) and isinstance(
-                            stmt.data.args[1], pyvex.IRExpr.Const
-                        ):
-                            # found it
-                            stmts_to_remove.append(stmt_loc)
-                            transformations[(stmt_loc[0], stmt.tmp)] = AddressTransformation(
-                                AddressTransformationTypes.ShiftRight, [AddressSingleton, stmt.data.args[1].con.value]
-                            )
-                            continue
+                    elif (
+                        stmt.data.op.startswith("Iop_Sar")
+                        and isinstance(stmt.data.args[0], pyvex.IRExpr.RdTmp)
+                        and isinstance(stmt.data.args[1], pyvex.IRExpr.Const)
+                    ):
+                        # found it
+                        stmts_to_remove.append(stmt_loc)
+                        transformations[(stmt_loc[0], stmt.tmp)] = AddressTransformation(
+                            AddressTransformationTypes.ShiftRight, [AddressSingleton, stmt.data.args[1].con.value]
+                        )
+                        continue
                 elif isinstance(stmt.data, pyvex.IRExpr.Load):
                     # Got it!
                     load_stmt, load_stmt_loc, load_size = (
@@ -1583,7 +1567,7 @@ class JumpTableResolver(IndirectJumpResolver):
                 if state.is_jumptable:
                     return state.stmts_to_instrument, state.regs_to_initialize
                 if state.is_jumptable is False:
-                    raise NotAJumpTableNotification()
+                    raise NotAJumpTableNotification
 
                 # find the next block
                 src = None
@@ -1597,7 +1581,7 @@ class JumpTableResolver(IndirectJumpResolver):
                             traced.add(block_addr_)
                             break
 
-        raise NotAJumpTableNotification()
+        raise NotAJumpTableNotification
 
     @staticmethod
     def _try_resolve_single_constant_loads(load_stmt, cfg, addr):
@@ -1626,27 +1610,26 @@ class JumpTableResolver(IndirectJumpResolver):
                     l.info(
                         "Constant indirect jump %#x points outside of loaded memory to %#08x", addr, jump_target_addr
                     )
-                    raise NotAJumpTableNotification()
+                    raise NotAJumpTableNotification
 
                 l.info("Resolved constant indirect jump from %#08x to %#08x", addr, jump_target_addr)
                 return jump_target
 
-        elif isinstance(load_stmt, pyvex.IRStmt.LoadG):
-            if type(load_stmt.addr) is pyvex.IRExpr.Const:
-                # It's directly loading from a constant address
-                # e.g.,
-                #  4352c     SUB     R1, R11, #0x1000
-                #  43530     LDRHI   R3, =loc_45450
-                #  ...
-                #  43540     MOV     PC, R3
-                #
-                # It's not a jump table, but we resolve it anyway
-                # Note that this block has two branches: One goes to 45450, the other one goes to whatever the original
-                # value of R3 is. Some intensive data-flow analysis is required in this case.
-                jump_target_addr = load_stmt.addr.con.value
-                jump_target = cfg._fast_memory_load_pointer(jump_target_addr)
-                l.info("Resolved constant indirect jump from %#08x to %#08x", addr, jump_target_addr)
-                return jump_target
+        elif isinstance(load_stmt, pyvex.IRStmt.LoadG) and type(load_stmt.addr) is pyvex.IRExpr.Const:
+            # It's directly loading from a constant address
+            # e.g.,
+            #  4352c     SUB     R1, R11, #0x1000
+            #  43530     LDRHI   R3, =loc_45450
+            #  ...
+            #  43540     MOV     PC, R3
+            #
+            # It's not a jump table, but we resolve it anyway
+            # Note that this block has two branches: One goes to 45450, the other one goes to whatever the original
+            # value of R3 is. Some intensive data-flow analysis is required in this case.
+            jump_target_addr = load_stmt.addr.con.value
+            jump_target = cfg._fast_memory_load_pointer(jump_target_addr)
+            l.info("Resolved constant indirect jump from %#08x to %#08x", addr, jump_target_addr)
+            return jump_target
 
         return None
 
@@ -1734,25 +1717,25 @@ class JumpTableResolver(IndirectJumpResolver):
                 # full-function data propagation before performing jump table recovery.
                 l.debug("Multiple statements adding bases, not supported yet")  # FIXME: Just check the addresses?
 
-        jumptable_addr_vsa = claripy.backends.vsa.convert(jumptable_addr)
-
-        if not isinstance(jumptable_addr_vsa, claripy.vsa.StridedInterval):
+        if jumptable_addr.has_annotation_type(claripy.annotation.RegionAnnotation):
             return None
 
         all_targets = []
         jump_table = []
 
+        jumptable_si = claripy.SI(bits=project.arch.bits, to_conv=jumptable_addr)
+
         # we may resolve a vtable (in C, e.g., the IO_JUMPS_FUNC in libc), but the stride of this load is usually 1
         # while the read statement reads a word size at a time.
         # we use this to differentiate between traditional jump tables (where each entry is some blocks that belong to
         # the current function) and vtables (where each entry is a function).
-        if jumptable_addr_vsa.stride < load_size:
+        if jumptable_si.args[3] < load_size:  # stride < load_size
             stride = load_size
-            total_cases = jumptable_addr_vsa.cardinality // load_size
+            total_cases = jumptable_addr.cardinality // load_size
             sort = "vtable"  # it's probably a vtable!
         else:
-            stride = jumptable_addr_vsa.stride
-            total_cases = jumptable_addr_vsa.cardinality
+            stride = jumptable_si.args[3]
+            total_cases = jumptable_addr.cardinality
             sort = "jumptable"
 
         if total_cases > self._max_targets:
@@ -1780,7 +1763,7 @@ class JumpTableResolver(IndirectJumpResolver):
                             break
                         l.debug("- %#x[%d] -> %#x", table_base_addr, i, target)
                         jump_table.append(target)
-                        addr += jumptable_addr_vsa.stride
+                        addr += stride
                     num_targets = len(jump_table)
                     if num_targets == 0:
                         l.debug("Didn't find any plausible targets in suspected jump table %#x", table_base_addr)
@@ -1816,18 +1799,22 @@ class JumpTableResolver(IndirectJumpResolver):
 
         # Both the min jump target and the max jump target should be within a mapped memory region
         # i.e., we shouldn't be jumping to the stack or somewhere unmapped
-        if not project.loader.find_segment_containing(min_jumptable_addr) or not project.loader.find_segment_containing(
-            max_jumptable_addr
+        if not (
+            (
+                project.loader.find_segment_containing(min_jumptable_addr)
+                and project.loader.find_segment_containing(max_jumptable_addr)
+            )
+            or (
+                project.loader.find_section_containing(min_jumptable_addr)
+                and project.loader.find_section_containing(max_jumptable_addr)
+            )
         ):
-            if not project.loader.find_section_containing(
-                min_jumptable_addr
-            ) or not project.loader.find_section_containing(max_jumptable_addr):
-                l.debug(
-                    "Jump table %#x might have jump targets outside mapped memory regions. "
-                    "Continue to resolve it from the next data source.",
-                    addr,
-                )
-                return None
+            l.debug(
+                "Jump table %#x might have jump targets outside mapped memory regions. "
+                "Continue to resolve it from the next data source.",
+                addr,
+            )
+            return None
 
         # Load the jump table from memory
         should_skip = False
@@ -1847,7 +1834,7 @@ class JumpTableResolver(IndirectJumpResolver):
 
         # Adjust entries inside the jump table
         mask = (2**self.project.arch.bits) - 1
-        transformation_list = list(reversed(list(v for v in transformations.values() if not v.first_load)))
+        transformation_list = list(reversed([v for v in transformations.values() if not v.first_load]))
         if transformation_list:
 
             def handle_signed_ext(a):
@@ -2056,7 +2043,7 @@ class JumpTableResolver(IndirectJumpResolver):
                 )
                 state.inspect.add_breakpoint("reg_write", bp)
             else:
-                raise NotImplementedError("Unsupported sort %s in stmts_to_instrument." % sort)
+                raise NotImplementedError(f"Unsupported sort {sort} in stmts_to_instrument.")
 
         reg_val = 0x13370000
 
@@ -2103,10 +2090,10 @@ class JumpTableResolver(IndirectJumpResolver):
 
             read_length = state.inspect.mem_read_length
             if not isinstance(read_length, int):
-                read_length = claripy.backends.vsa.convert(read_length).upper_bound
+                read_length = read_length.args[3]  # max
             if read_length > 16:
                 return
-            new_read_addr = state.solver.BVV(UninitReadMeta.uninit_read_base, state.arch.bits)
+            new_read_addr = claripy.BVV(UninitReadMeta.uninit_read_base, state.arch.bits)
             UninitReadMeta.uninit_read_base += read_length
 
             # replace the expression in registers
@@ -2123,7 +2110,7 @@ class JumpTableResolver(IndirectJumpResolver):
     def _dbg_repr_slice(self, blade, in_slice_stmts_only=False):
         stmts = defaultdict(set)
 
-        for addr, stmt_idx in sorted(list(blade.slice.nodes())):
+        for addr, stmt_idx in sorted(blade.slice.nodes()):
             stmts[addr].add(stmt_idx)
 
         for addr in sorted(stmts.keys()):
@@ -2131,7 +2118,7 @@ class JumpTableResolver(IndirectJumpResolver):
             irsb = self.project.factory.block(addr, cross_insn_opt=True, backup_state=self.base_state).vex
 
             print("  ####")
-            print("  #### Block %#x" % addr)
+            print(f"  #### Block {addr:#x}")
             print("  ####")
 
             for i, stmt in enumerate(irsb.statements):
@@ -2139,7 +2126,7 @@ class JumpTableResolver(IndirectJumpResolver):
                 display = stmt_taken if in_slice_stmts_only else True
                 if display:
                     s = "%s %x:%02d | " % ("+" if stmt_taken else " ", addr, i)
-                    s += "%s " % stmt.pp_str(arch=self.project.arch, tyenv=irsb.tyenv)
+                    s += f"{stmt.pp_str(arch=self.project.arch, tyenv=irsb.tyenv)} "
                     if stmt_taken:
                         s += "IN: %d" % blade.slice.in_degree((addr, i))
                     print(s)
@@ -2238,7 +2225,7 @@ class JumpTableResolver(IndirectJumpResolver):
                 #  blx r0
                 # It's not a jump table, but we resolve it anyway
                 jump_target_addr = load_stmt.data.addr.con.value
-                return state.solver.BVV(jump_target_addr, state.arch.bits)
+                return claripy.BVV(jump_target_addr, state.arch.bits)
         elif isinstance(load_stmt, pyvex.IRStmt.LoadG):
             if type(load_stmt.addr) is pyvex.IRExpr.RdTmp:
                 load_addr_tmp = load_stmt.addr.tmp
@@ -2254,9 +2241,9 @@ class JumpTableResolver(IndirectJumpResolver):
                 # Note that this block has two branches: One goes to 45450, the other one goes to whatever the original
                 # value of R3 is. Some intensive data-flow analysis is required in this case.
                 jump_target_addr = load_stmt.addr.con.value
-                return state.solver.BVV(jump_target_addr, state.arch.bits)
+                return claripy.BVV(jump_target_addr, state.arch.bits)
         else:
-            raise TypeError("Unsupported address loading statement type %s." % type(load_stmt))
+            raise TypeError(f"Unsupported address loading statement type {type(load_stmt)}.")
 
         if state.scratch.temps[load_addr_tmp] is None:
             # the tmp variable is not there... umm...
@@ -2293,9 +2280,7 @@ class JumpTableResolver(IndirectJumpResolver):
             return False
         if vex_block.jumpkind == "Ijk_NoDecode":
             return False
-        if vex_block.size == 0:
-            return False
-        return True
+        return vex_block.size != 0
 
     def _is_address_mapped(self, addr: int) -> bool:
         return (