angr 9.2.116__py3-none-manylinux2014_x86_64.whl → 9.2.118__py3-none-manylinux2014_x86_64.whl

angr/__init__.py

@@ -1,7 +1,8 @@
 # pylint: disable=wildcard-import
 # pylint: disable=wrong-import-position
+from __future__ import annotations
 
-__version__ = "9.2.116"
+__version__ = "9.2.118"
 
 if bytes is str:
     raise Exception(

angr/__main__.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import argparse
 
 from angr.analyses.decompiler.structuring import STRUCTURER_CLASSES, DEFAULT_STRUCTURER
@@ -37,6 +38,14 @@ def main():
         action="store_true",
         default=False,
     )
+    parser.add_argument(
+        "--base-addr",
+        help="""
+        The base address of the binary. This is useful when the binary is loaded at a different address than the one
+        specified in the ELF header.""",
+        type=lambda x: int(x, 0),
+        default=None,
+    )
     # decompilation-specific arguments
     parser.add_argument(
         "--structurer",
@@ -44,11 +53,22 @@ def main():
         choices=STRUCTURER_CLASSES.keys(),
         default=DEFAULT_STRUCTURER.NAME,
     )
+    parser.add_argument(
+        "--no-casts",
+        help="Do not show type casts in the decompiled output.",
+        action="store_true",
+        default=False,
+    )
 
     args = parser.parse_args()
     if args.command == COMMANDS.DECOMPILE:
         decompilation = decompile_functions(
-            args.binary, functions=args.functions, structurer=args.structurer, catch_errors=args.catch_exceptions
+            args.binary,
+            functions=args.functions,
+            structurer=args.structurer,
+            catch_errors=args.catch_exceptions,
+            show_casts=not args.no_casts,
+            base_address=args.base_addr,
         )
         print(decompilation)
     else:

angr/analyses/__init__.py

@@ -1,4 +1,5 @@
 # pylint:disable=wrong-import-position
+from __future__ import annotations
 from .analysis import Analysis, AnalysesHub
 
 
@@ -44,3 +45,6 @@ from .vtable import VtableFinder
 from .find_objects_static import StaticObjectFinder
 from .class_identifier import ClassIdentifier
 from .flirt import FlirtAnalysis
+from .s_propagator import SPropagatorAnalysis
+from .s_reaching_definitions import SReachingDefinitionsAnalysis
+from .s_liveness import SLivenessAnalysis

angr/analyses/analysis.py

@@ -1,4 +1,5 @@
 # ruff: noqa: F401
+from __future__ import annotations
 import functools
 import sys
 import contextlib
@@ -88,14 +89,13 @@ class AnalysisLogEntry:
                 msg_str = msg_str[:66] + "..."
                 if msg_str[0] in ('"', "'"):
                     msg_str += msg_str[0]
-            return "<AnalysisLogEntry %s>" % msg_str
-        else:
-            msg_str = repr(self.message)
-            if len(msg_str) > 40:
-                msg_str = msg_str[:36] + "..."
-                if msg_str[0] in ('"', "'"):
-                    msg_str += msg_str[0]
-            return f"<AnalysisLogEntry {msg_str} with {self.exc_type.__name__}: {self.exc_value}>"
+            return f"<AnalysisLogEntry {msg_str}>"
+        msg_str = repr(self.message)
+        if len(msg_str) > 40:
+            msg_str = msg_str[:36] + "..."
+            if msg_str[0] in ('"', "'"):
+                msg_str += msg_str[0]
+        return f"<AnalysisLogEntry {msg_str} with {self.exc_type.__name__}: {self.exc_value}>"
 
 
 A = TypeVar("A", bound="Analysis")
@@ -114,7 +114,7 @@ class AnalysesHub(PluginVendor[A]):
     def reload_analyses(self):  # pylint: disable=no-self-use
         return
 
-    def _init_plugin(self, plugin_cls: type[A]) -> "AnalysisFactory[A]":
+    def _init_plugin(self, plugin_cls: type[A]) -> AnalysisFactory[A]:
         return AnalysisFactory(self.project, plugin_cls)
 
     def __getstate__(self):
@@ -125,42 +125,42 @@ class AnalysesHub(PluginVendor[A]):
         s, self.project = sd
         super().__setstate__(s)
 
-    def __getitem__(self, plugin_cls: type[A]) -> "AnalysisFactory[A]":
+    def __getitem__(self, plugin_cls: type[A]) -> AnalysisFactory[A]:
         return AnalysisFactory(self.project, plugin_cls)
 
 
 class KnownAnalysesPlugin(typing.Protocol):
-    Identifier: "Type[Identifier]"
-    CalleeCleanupFinder: "Type[CalleeCleanupFinder]"
-    VSA_DDG: "Type[VSA_DDG]"
-    CDG: "Type[CDG]"
-    BinDiff: "Type[BinDiff]"
-    CFGEmulated: "Type[CFGEmulated]"
-    CFB: "Type[CFBlanket]"
-    CFBlanket: "Type[CFBlanket]"
-    CFG: "Type[CFG]"
-    CFGFast: "Type[CFGFast]"
-    StaticHooker: "Type[StaticHooker]"
-    DDG: "Type[DDG]"
-    CongruencyCheck: "Type[CongruencyCheck]"
-    Reassembler: "Type[Reassembler]"
-    BackwardSlice: "Type[BackwardSlice]"
-    BinaryOptimizer: "Type[BinaryOptimizer]"
-    VFG: "Type[VFG]"
-    LoopFinder: "Type[LoopFinder]"
-    Disassembly: "Type[Disassembly]"
-    Veritesting: "Type[Veritesting]"
-    CodeTagging: "Type[CodeTagging]"
-    BoyScout: "Type[BoyScout]"
-    VariableRecoveryFast: "Type[VariableRecoveryFast]"
-    VariableRecovery: "Type[VariableRecovery]"
-    ReachingDefinitions: "Type[ReachingDefinitionsAnalysis]"
-    CompleteCallingConventions: "Type[CompleteCallingConventionsAnalysis]"
-    Clinic: "Type[Clinic]"
-    Propagator: "Type[PropagatorAnalysis]"
-    CallingConvention: "Type[CallingConventionAnalysis]"
-    Decompiler: "Type[Decompiler]"
-    XRefs: "Type[XRefsAnalysis]"
+    Identifier: type[Identifier]
+    CalleeCleanupFinder: type[CalleeCleanupFinder]
+    VSA_DDG: type[VSA_DDG]
+    CDG: type[CDG]
+    BinDiff: type[BinDiff]
+    CFGEmulated: type[CFGEmulated]
+    CFB: type[CFBlanket]
+    CFBlanket: type[CFBlanket]
+    CFG: type[CFG]
+    CFGFast: type[CFGFast]
+    StaticHooker: type[StaticHooker]
+    DDG: type[DDG]
+    CongruencyCheck: type[CongruencyCheck]
+    Reassembler: type[Reassembler]
+    BackwardSlice: type[BackwardSlice]
+    BinaryOptimizer: type[BinaryOptimizer]
+    VFG: type[VFG]
+    LoopFinder: type[LoopFinder]
+    Disassembly: type[Disassembly]
+    Veritesting: type[Veritesting]
+    CodeTagging: type[CodeTagging]
+    BoyScout: type[BoyScout]
+    VariableRecoveryFast: type[VariableRecoveryFast]
+    VariableRecovery: type[VariableRecovery]
+    ReachingDefinitions: type[ReachingDefinitionsAnalysis]
+    CompleteCallingConventions: type[CompleteCallingConventionsAnalysis]
+    Clinic: type[Clinic]
+    Propagator: type[PropagatorAnalysis]
+    CallingConvention: type[CallingConventionAnalysis]
+    Decompiler: type[Decompiler]
+    XRefs: type[XRefsAnalysis]
 
 
 class AnalysesHubWithDefault(AnalysesHub, KnownAnalysesPlugin):
@@ -170,7 +170,7 @@ class AnalysesHubWithDefault(AnalysesHub, KnownAnalysesPlugin):
 
 
 class AnalysisFactory(Generic[A]):
-    def __init__(self, project: "Project", analysis_cls: type[A]):
+    def __init__(self, project: Project, analysis_cls: type[A]):
         self._project = project
         self._analysis_cls = analysis_cls
         self.__doc__ = ""
@@ -181,7 +181,7 @@ class AnalysisFactory(Generic[A]):
     def prep(
         self,
         fail_fast=False,
-        kb: Optional["KnowledgeBase"] = None,
+        kb: KnowledgeBase | None = None,
         progress_callback: Callable | None = None,
         show_progressbar: bool = False,
     ) -> type[A]:
@@ -235,8 +235,8 @@ class Analysis:
     :ivar progress.Progress _progressbar: The progress bar object.
     """
 
-    project: "Project"
-    kb: "KnowledgeBase"
+    project: Project
+    kb: KnowledgeBase
     _fail_fast: bool
     _name: str
     errors = []

angr/analyses/backward_slice.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 from collections import defaultdict
 
@@ -77,7 +78,7 @@ class BackwardSlice(Analysis):
                 elif type(t) is tuple:
                     self._targets.append(t)
                 else:
-                    raise AngrBackwardSlicingError("Unsupported type of target %s" % t)
+                    raise AngrBackwardSlicingError(f"Unsupported type of target {t}")
 
         # Save a list of taints to begin with at the beginning of each SimRun
         self.initial_taints_per_run = None
@@ -96,8 +97,7 @@ class BackwardSlice(Analysis):
     #
 
     def __repr__(self):
-        s = "BackwardSlice (to %s)" % self._targets
-        return s
+        return f"BackwardSlice (to {self._targets})"
 
     def dbg_repr(self, max_display=10):
         """
@@ -137,10 +137,10 @@ class BackwardSlice(Analysis):
         """
 
         if self.project.is_hooked(run_addr):
-            ss = "%#x Hooked\n" % run_addr
+            ss = f"{run_addr:#x} Hooked\n"
 
         else:
-            ss = "%#x\n" % run_addr
+            ss = f"{run_addr:#x}\n"
 
             # statements
             chosen_statements = self.chosen_statements[run_addr]
@@ -148,11 +148,8 @@ class BackwardSlice(Analysis):
             vex_block = self.project.factory.block(run_addr).vex
 
             statements = vex_block.statements
-            for i in range(0, len(statements)):
-                if i in chosen_statements:
-                    line = "+"
-                else:
-                    line = "-"
+            for i in range(len(statements)):
+                line = "+" if i in chosen_statements else "-"
                 line += "[% 3d] " % i
                 line += str(statements[i])
                 ss += line + "\n"
@@ -160,11 +157,11 @@ class BackwardSlice(Analysis):
             # exits
             targets = self.chosen_exits[run_addr]
             addr_strs = []
-            for exit_stmt_id, target_addr in targets:
+            for _exit_stmt_id, target_addr in targets:
                 if target_addr is None:
                     addr_strs.append("default")
                 else:
-                    addr_strs.append("%#x" % target_addr)
+                    addr_strs.append(f"{target_addr:#x}")
 
             ss += "Chosen exits: " + ", ".join(addr_strs)
 
@@ -371,7 +368,7 @@ class BackwardSlice(Analysis):
 
         for cfg_node, stmt_idx in targets:
             if cfg_node not in self._cfg.graph:
-                raise AngrBackwardSlicingError("Target CFGNode %s is not in the CFG." % cfg_node)
+                raise AngrBackwardSlicingError(f"Target CFGNode {cfg_node} is not in the CFG.")
 
             if stmt_idx == -1:
                 new_taints = self._handle_control_dependence(cfg_node)
@@ -574,8 +571,8 @@ class BackwardSlice(Analysis):
         new_exit_statements_per_run = defaultdict(list)
 
         while len(exit_statements_per_run):
-            for block_address, exits in exit_statements_per_run.items():
-                for stmt_idx, exit_target in exits:
+            for exits in exit_statements_per_run.values():
+                for _stmt_idx, exit_target in exits:
                     if exit_target not in self.chosen_exits:
                         # Oh we found one!
                         # The default exit should be taken no matter where it leads to
@@ -606,9 +603,9 @@ class BackwardSlice(Analysis):
 
         # Sanity check
         if not isinstance(block_address, int):
-            raise AngrBackwardSlicingError("Invalid block address %s." % block_address)
+            raise AngrBackwardSlicingError(f"Invalid block address {block_address}.")
         if not isinstance(stmt_idx, int):
-            raise AngrBackwardSlicingError("Invalid statement ID %s." % stmt_idx)
+            raise AngrBackwardSlicingError(f"Invalid statement ID {stmt_idx}.")
 
         self.chosen_statements[block_address].add(stmt_idx)
 
@@ -664,7 +661,7 @@ class BackwardSlice(Analysis):
             vex_block = self.project.factory.block(block_addr).vex
             return len(vex_block.statements)
 
-        raise AngrBackwardSlicingError('Unsupported statement ID "%s"' % stmt_idx)
+        raise AngrBackwardSlicingError(f'Unsupported statement ID "{stmt_idx}"')
 
     @staticmethod
     def _last_branching_statement(statements):

angr/analyses/binary_optimizer.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 import re
 from typing import TYPE_CHECKING
@@ -23,11 +24,7 @@ class ConstantPropagation:
         self.constant_consuming_loc = constant_consuming_loc
 
     def __repr__(self):
-        s = "<Constant {:#x} propagates from {:#x} to {:#x}>".format(
-            self.constant, self.constant_assignment_loc.ins_addr, self.constant_consuming_loc.ins_addr
-        )
-
-        return s
+        return f"<Constant {self.constant:#x} propagates from {self.constant_assignment_loc.ins_addr:#x} to {self.constant_consuming_loc.ins_addr:#x}>"
 
 
 class RedundantStackVariable:
@@ -38,15 +35,13 @@ class RedundantStackVariable:
         self.argument_register_as_retval = False
 
     def __repr__(self):
-        s = "<StackVar %s for %s at %d locations%s>" % (
+        return "<StackVar %s for %s at %d locations%s>" % (
             self.stack_variable,
             self.argument,
             len(self.stack_variable_consuming_locs),
             " - retval" if self.argument_register_as_retval else "",
         )
 
-        return s
-
 
 class RegisterReallocation:
     def __init__(
@@ -84,13 +79,12 @@ class RegisterReallocation:
         self.epilogue_size = epilogue_size
 
     def __repr__(self):
-        s = "<RegisterReallocation %s for %s with %d sources and %d consumers>" % (
+        return "<RegisterReallocation %s for %s with %d sources and %d consumers>" % (
             self.register_variable,
             self.stack_variable,
             len(self.stack_variable_sources),
             len(self.stack_variable_consumers),
         )
-        return s
 
 
 class DeadAssignment:
@@ -104,14 +98,13 @@ class DeadAssignment:
         self.pv = pv
 
     def __repr__(self):
-        s = "<DeadAssignmentElimination %s>" % self.pv
-        return s
+        return f"<DeadAssignmentElimination {self.pv}>"
 
 
 class BinaryOptimizer(Analysis):
     """
     This is a collection of binary optimization techniques we used in Mechanical Phish during the finals of Cyber Grand
-    Challange. It focuses on dealing with some serious speed-impacting code constructs, and *sort of* worked on *some*
+    Challenge. It focuses on dealing with some serious speed-impacting code constructs, and *sort of* worked on *some*
     CGC binaries compiled with O0. Use this analysis as a reference of how to use data dependency graph and such.
 
     There is no guarantee that BinaryOptimizer will ever work on non-CGC binaries. Feel free to give us PR or MR, but
@@ -153,7 +146,7 @@ class BinaryOptimizer(Analysis):
                 SIM_PROCEDURES["stubs"]["UnresolvableJumpTarget"],
                 SIM_PROCEDURES["stubs"]["UnresolvableCallTarget"],
             )
-            if any([n.sim_procedure in unresolvable_targets for n in f.graph.nodes() if isinstance(n, HookNode)]):
+            if any(n.sim_procedure in unresolvable_targets for n in f.graph.nodes() if isinstance(n, HookNode)):
                 continue
 
             if len(f.block_addrs_set) > self.BLOCKS_THRESHOLD:
@@ -320,12 +313,12 @@ class BinaryOptimizer(Analysis):
                 successors1 = [s for _, s, data in out_edges if "type" not in data or data["type"] != "kill"]
                 if len(successors1) == 1:
                     successor1 = successors1[0]
-                    if isinstance(successor1.variable, SimStackVariable):
-                        if (successor1.variable.base == "sp" and successor1.variable.offset > 0) or (
-                            successor1.variable.base == "bp" and successor1.variable.offset < 0
-                        ):
-                            # yes it's copied onto the stack!
-                            argument_to_local[argument_variable] = successor1
+                    if isinstance(successor1.variable, SimStackVariable) and (
+                        (successor1.variable.base == "sp" and successor1.variable.offset > 0)
+                        or (successor1.variable.base == "bp" and successor1.variable.offset < 0)
+                    ):
+                        # yes it's copied onto the stack!
+                        argument_to_local[argument_variable] = successor1
 
                 # if the register is eax, and it's not killed later, it might be the return value of this function
                 # in that case, we cannot eliminate the instruction that moves stack argument to that register
@@ -336,7 +329,7 @@ class BinaryOptimizer(Analysis):
                         argument_register_as_retval.add(argument_variable)
 
             else:
-                raise NotImplementedError()  # TODO:
+                raise NotImplementedError  # TODO:
 
         # import pprint
         # pprint.pprint(argument_to_local, width=160)
@@ -431,7 +424,7 @@ class BinaryOptimizer(Analysis):
             return
         if not (insn4.mnemonic == "pop" and insn4.op_str == "ebp"):
             return
-        if not insn5.mnemonic == "ret":
+        if insn5.mnemonic != "ret":
             return
 
         # make sure esp is not used anywhere else - all stack variables must be indexed using ebp
@@ -479,16 +472,17 @@ class BinaryOptimizer(Analysis):
                 isinstance(dst.variable, SimRegisterVariable)
                 and dst.variable.reg != ebp_offset
                 and dst.variable.reg < 40
-            ):
                 # to a register other than ebp
-                if isinstance(src.variable, SimRegisterVariable) and src.variable.reg == ebp_offset:
-                    # from ebp
-                    l.debug(
-                        "Found a lea operation from ebp at %#x. Function %s cannot be optimized.",
-                        dst.location.ins_addr,
-                        repr(function),
-                    )
-                    return
+                and isinstance(src.variable, SimRegisterVariable)
+                and src.variable.reg == ebp_offset
+            ):
+                # from ebp
+                l.debug(
+                    "Found a lea operation from ebp at %#x. Function %s cannot be optimized.",
+                    dst.location.ins_addr,
+                    repr(function),
+                )
+                return
 
         # we definitely don't want to mess with fp or sse operations
         for node in data_graph.nodes():
@@ -509,9 +503,10 @@ class BinaryOptimizer(Analysis):
 
         used_general_registers = set()
         for n in data_graph.nodes():
-            if isinstance(n.variable, SimRegisterVariable):
-                if n.variable.reg < 40:  # this is a hardcoded limit - we only care about general registers
-                    used_general_registers.add(n.variable.reg)
+            if (
+                isinstance(n.variable, SimRegisterVariable) and n.variable.reg < 40
+            ):  # this is a hardcoded limit - we only care about general registers
+                used_general_registers.add(n.variable.reg)
         registers = self.project.arch.registers
         all_general_registers = {  # registers['eax'][0], registers['ecx'][0], registers['edx'][0],
             registers["ebx"][0],