angr 9.2.116__py3-none-manylinux2014_x86_64.whl → 9.2.118__py3-none-manylinux2014_x86_64.whl

angr/analyses/decompiler/expression_narrower.py

@@ -1,4 +1,5 @@
-from typing import Optional, Any, TYPE_CHECKING
+from __future__ import annotations
+from typing import Any, TYPE_CHECKING
 from ailment import AILBlockWalkerBase
 
 if TYPE_CHECKING:
@@ -27,13 +28,13 @@ class ExpressionNarrowingWalker(AILBlockWalkerBase):
     The previous expression is always used in the succeeding expression.
     """
 
-    def __init__(self, target_expr: "Expression"):
+    def __init__(self, target_expr: Expression):
         super().__init__()
         self._target_expr = target_expr
         self.operations = []
 
     def _handle_expr(
-        self, expr_idx: int, expr: "Expression", stmt_idx: int, stmt: Optional["Statement"], block: Optional["Block"]
+        self, expr_idx: int, expr: Expression, stmt_idx: int, stmt: Statement | None, block: Block | None
     ) -> Any:
         if expr == self._target_expr:
             # we are done!
@@ -45,46 +46,40 @@ class ExpressionNarrowingWalker(AILBlockWalkerBase):
             return True
         return False
 
-    def _handle_Load(self, expr_idx: int, expr: "Load", stmt_idx: int, stmt: "Statement", block: Optional["Block"]):
+    def _handle_Load(self, expr_idx: int, expr: Load, stmt_idx: int, stmt: Statement, block: Block | None):
         return self._handle_expr(0, expr.addr, stmt_idx, stmt, block)
 
-    def _handle_CallExpr(self, expr_idx: int, expr: "Call", stmt_idx: int, stmt: "Statement", block: Optional["Block"]):
+    def _handle_CallExpr(self, expr_idx: int, expr: Call, stmt_idx: int, stmt: Statement, block: Block | None):
         r = False
         if expr.args:
             for i, arg in enumerate(expr.args):
                 r |= self._handle_expr(i, arg, stmt_idx, stmt, block)
         return r
 
-    def _handle_BinaryOp(
-        self, expr_idx: int, expr: "BinaryOp", stmt_idx: int, stmt: "Statement", block: Optional["Block"]
-    ):
+    def _handle_BinaryOp(self, expr_idx: int, expr: BinaryOp, stmt_idx: int, stmt: Statement, block: Block | None):
         r = self._handle_expr(0, expr.operands[0], stmt_idx, stmt, block)
         r |= self._handle_expr(1, expr.operands[1], stmt_idx, stmt, block)
         return r
 
-    def _handle_UnaryOp(
-        self, expr_idx: int, expr: "UnaryOp", stmt_idx: int, stmt: "Statement", block: Optional["Block"]
-    ):
+    def _handle_UnaryOp(self, expr_idx: int, expr: UnaryOp, stmt_idx: int, stmt: Statement, block: Block | None):
         return self._handle_expr(0, expr.operand, stmt_idx, stmt, block)
 
-    def _handle_Convert(
-        self, expr_idx: int, expr: "Convert", stmt_idx: int, stmt: "Statement", block: Optional["Block"]
-    ):
+    def _handle_Convert(self, expr_idx: int, expr: Convert, stmt_idx: int, stmt: Statement, block: Block | None):
         return self._handle_expr(expr_idx, expr.operand, stmt_idx, stmt, block)
 
-    def _handle_ITE(self, expr_idx: int, expr: "ITE", stmt_idx: int, stmt: "Statement", block: Optional["Block"]):
+    def _handle_ITE(self, expr_idx: int, expr: ITE, stmt_idx: int, stmt: Statement, block: Block | None):
         r = self._handle_expr(0, expr.cond, stmt_idx, stmt, block)
         r |= self._handle_expr(1, expr.iftrue, stmt_idx, stmt, block)
         r |= self._handle_expr(2, expr.iffalse, stmt_idx, stmt, block)
         return r
 
     def _handle_DirtyExpression(
-        self, expr_idx: int, expr: "DirtyExpression", stmt_idx: int, stmt: "Statement", block: Optional["Block"]
+        self, expr_idx: int, expr: DirtyExpression, stmt_idx: int, stmt: Statement, block: Block | None
     ):
         return self._handle_expr(0, expr.dirty_expr, stmt_idx, stmt, block)
 
     def _handle_VEXCCallExpression(
-        self, expr_idx: int, expr: "VEXCCallExpression", stmt_idx: int, stmt: "Statement", block: Optional["Block"]
+        self, expr_idx: int, expr: VEXCCallExpression, stmt_idx: int, stmt: Statement, block: Block | None
     ):
         r = False
         for idx, operand in enumerate(expr.operands):

angr/analyses/decompiler/goto_manager.py

@@ -1,4 +1,9 @@
+from __future__ import annotations
 import ailment
+from ailment.block import Block
+import networkx
+
+from .utils import find_block_by_addr
 
 
 class Goto:
@@ -65,9 +70,43 @@ class GotoManager:
         for goto in src_gotos:
             if goto.dst_addr == dst.addr:
                 return True
-            else:
-                block_addrs = {stmt.ins_addr for stmt in dst.statements if "ins_addr" in stmt.tags}
-                if goto.dst_addr in block_addrs:
-                    return True
+            block_addrs = {stmt.ins_addr for stmt in dst.statements if "ins_addr" in stmt.tags}
+            if goto.dst_addr in block_addrs:
+                return True
 
         return False
+
+    def find_goto_edges(self, graph: networkx.DiGraph) -> list[tuple[Block, Block]]:
+        """
+        This function finds all edges that are _potential_ gotos in the graph.
+        The gotos are not guaranteed to be correct, but they are an approximation based on how the Phoenix
+        structuring algorithm will select edges from the graph to be gotos in structuring.
+        """
+        # first collect all simple destinations known by the goto managers
+        dst_blocks = set()
+        goto_edges = []
+        for goto in self.gotos:
+            try:
+                dst_block = find_block_by_addr(graph, goto.dst_addr)
+            except ValueError:
+                continue
+
+            try:
+                src_block = find_block_by_addr(graph, goto.src_addr)
+            except ValueError:
+                src_block = None
+
+            if src_block is None:
+                # try the instruction addrs in the block to find the goto
+                try:
+                    src_block = find_block_by_addr(graph, goto.src_ins_addr, insn_addr=True)
+                except ValueError:
+                    src_block = None
+
+            if src_block is not None and dst_block is not None:
+                # if you found the source, we dont need to try later things on this dst
+                goto_edges.append((src_block, dst_block))
+            elif dst_block is not None:
+                dst_blocks.add(dst_block)
+
+        return goto_edges

angr/analyses/decompiler/graph_region.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 from typing import Any
 from collections import defaultdict
@@ -65,7 +66,7 @@ class GraphRegion:
         s = ""
         if self.graph is None:
             # only head is available
-            return "<GraphRegion %r>" % self.head
+            return f"<GraphRegion {self.head!r}>"
 
         for node in self.graph.nodes():
             if hasattr(node, "addr"):
@@ -75,7 +76,7 @@ class GraphRegion:
 
         return "<GraphRegion %r of %d nodes%s>" % (self.head, self.graph.number_of_nodes(), s)
 
-    def copy(self) -> "GraphRegion":
+    def copy(self) -> GraphRegion:
         return GraphRegion(
             self.head,
             networkx.DiGraph(self.graph) if self.graph is not None else None,
@@ -106,10 +107,7 @@ class GraphRegion:
             new_graph_with_successors = None
             successors = None
 
-        if self.full_graph is not None:
-            new_full_graph = self._recursive_copy(self.full_graph, nodes_map)
-        else:
-            new_full_graph = None
+        new_full_graph = self._recursive_copy(self.full_graph, nodes_map) if self.full_graph is not None else None
 
         return GraphRegion(
             nodes_map[self.head],
@@ -159,12 +157,7 @@ class GraphRegion:
 
     @staticmethod
     def dbg_get_repr(obj, ident=0):
-        if type(obj) is GraphRegion:
-            s = obj.dbg_print(ident=ident)
-        else:
-            s = " " * ident + str(obj)
-
-        return s
+        return obj.dbg_print(ident=ident) if type(obj) is GraphRegion else " " * ident + str(obj)
 
     def dbg_print(self, ident=0):
         s = self.dbg_get_repr(self.head, ident=ident) + "\n"
@@ -194,14 +187,14 @@ class GraphRegion:
 
     def replace_region(
         self,
-        sub_region: "GraphRegion",
-        updated_sub_region: "GraphRegion",
+        sub_region: GraphRegion,
+        updated_sub_region: GraphRegion,
         replace_with,
         virtualized_edges: set[tuple[Any, Any]],
     ):
         if sub_region not in self.graph:
             l.error("The sub-region to replace must be in the current region. Note that this method is not recursive.")
-            raise Exception()
+            raise Exception
 
         if sub_region is self.head:
             self.head = replace_with
@@ -242,18 +235,17 @@ class GraphRegion:
                     if succ not in updated_sub_region.successors:
                         # find the corresponding node in graph_with_successors
                         real_succ = next(iter(nn for nn in real_succs if nn.addr == succ.addr), None)
-                        if real_succ is not None:
-                            if real_succ not in self.graph:
-                                self.graph_with_successors.remove_edge(sub_region, real_succ)
+                        if real_succ is not None and real_succ not in self.graph:
+                            self.graph_with_successors.remove_edge(sub_region, real_succ)
             self._replace_node_in_graph(self.graph_with_successors, sub_region, replace_with, edges_to_remove)
 
         self._node_to_replaced_regions[replace_with] = sub_region
         self._replaced_regions[sub_region] = replace_with
 
-    def replace_region_with_region(self, sub_region: "GraphRegion", replace_with: "GraphRegion"):
+    def replace_region_with_region(self, sub_region: GraphRegion, replace_with: GraphRegion):
         if sub_region not in self.graph:
             l.error("The sub-region to replace must be in the current region. Note that this method is not recursive.")
-            raise Exception()
+            raise Exception
 
         if sub_region is self.head:
             self.head = replace_with.head
@@ -262,13 +254,12 @@ class GraphRegion:
         # successor in self.successors is a graph region (with the AIL block as its head). we handle this case here by
         # creating a new graph_with_successors for the replace_with region
         successor_map = {}
-        if self.successors:
-            if any(succ not in self.successors for succ in replace_with.successors):
-                for succ in replace_with.successors:
-                    if succ not in self.successors:
-                        for succ_ in self.successors:
-                            if isinstance(succ_, GraphRegion) and succ_.addr == succ.addr:
-                                successor_map[succ] = succ_
+        if self.successors and any(succ not in self.successors for succ in replace_with.successors):
+            for succ in replace_with.successors:
+                if succ not in self.successors:
+                    for succ_ in self.successors:
+                        if isinstance(succ_, GraphRegion) and succ_.addr == succ.addr:
+                            successor_map[succ] = succ_
         if successor_map:
             replace_with_graph_with_successors = networkx.DiGraph()
             for nn in replace_with.graph_with_successors:
@@ -351,10 +342,7 @@ class GraphRegion:
             if known_successors is not None and dst in known_successors:
                 continue
 
-            if dst in self._node_to_replaced_regions:
-                dst_in_subgraph = self._node_to_replaced_regions[dst]
-            else:
-                dst_in_subgraph = dst
+            dst_in_subgraph = self._node_to_replaced_regions.get(dst, dst)
 
             # find the correct source
             if isinstance(dst_in_subgraph, GraphRegion) and dst_in_subgraph not in sub_graph:

angr/analyses/decompiler/jump_target_collector.py

@@ -1,4 +1,5 @@
 # pylint:disable=unused-argument
+from __future__ import annotations
 
 import ailment
 

angr/analyses/decompiler/jumptable_entry_condition_rewriter.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import claripy
 
 from .structuring.structurer_nodes import ConditionNode, CodeNode

angr/analyses/decompiler/optimization_passes/__init__.py

@@ -1,4 +1,5 @@
 # pylint:disable=import-outside-toplevel
+from __future__ import annotations
 from typing import Optional, Union
 
 from archinfo import Arch
@@ -17,7 +18,6 @@ from .return_duplicator_low import ReturnDuplicatorLow
 from .return_duplicator_high import ReturnDuplicatorHigh
 from .const_derefs import ConstantDereferencesSimplifier
 from .register_save_area_simplifier import RegisterSaveAreaSimplifier
-from .spilled_register_finder import SpilledRegisterFinder
 from .ret_addr_save_simplifier import RetAddrSaveSimplifier
 from .x86_gcc_getpc_simplifier import X86GccGetPcSimplifier
 from .flip_boolean_cmp import FlipBooleanCmp
@@ -29,6 +29,8 @@ from .switch_default_case_duplicator import SwitchDefaultCaseDuplicator
 from .deadblock_remover import DeadblockRemover
 from .inlined_string_transformation_simplifier import InlinedStringTransformationSimplifier
 from .const_prop_reverter import ConstPropOptReverter
+from .call_stmt_rewriter import CallStatementRewriter
+from .duplication_reverter import DuplicationReverter
 
 # order matters!
 _all_optimization_passes = [
@@ -49,19 +51,21 @@ _all_optimization_passes = [
     (DeadblockRemover, True),
     (SwitchDefaultCaseDuplicator, True),
     (ConstPropOptReverter, True),
+    (DuplicationReverter, True),
     (LoweredSwitchSimplifier, True),
     (ReturnDuplicatorLow, True),
     (ReturnDeduplicator, True),
-    (CodeMotionOptimization, True),
+    (CodeMotionOptimization, False),
     (CrossJumpReverter, True),
     (FlipBooleanCmp, True),
     (InlinedStringTransformationSimplifier, True),
+    (CallStatementRewriter, True),
 ]
 
 # these passes may duplicate code to remove gotos or improve the structure of the graph
 DUPLICATING_OPTS = [ReturnDuplicatorLow, ReturnDuplicatorHigh, CrossJumpReverter]
 # these passes may destroy blocks by merging them into semantically equivalent blocks
-CONDENSING_OPTS = [CodeMotionOptimization, ReturnDeduplicator]
+CONDENSING_OPTS = [CodeMotionOptimization, ReturnDeduplicator, DuplicationReverter]
 
 
 def get_optimization_passes(arch, platform):

angr/analyses/decompiler/optimization_passes/base_ptr_save_simplifier.py

@@ -1,3 +1,5 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
 import logging
 
 import ailment
@@ -86,21 +88,24 @@ class BasePointerSaveSimplifier(OptimizationPass):
 
         for idx, stmt in enumerate(first_block.statements):
             if (
-                isinstance(stmt, ailment.Stmt.Store)
-                and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
-                and isinstance(stmt.data, ailment.Expr.Register)
-                and stmt.data.reg_offset == self.project.arch.bp_offset
-                and stmt.addr.offset < 0
+                isinstance(stmt, ailment.Stmt.Assignment)
+                and isinstance(stmt.dst, ailment.Expr.VirtualVariable)
+                and stmt.dst.was_stack
+                and stmt.dst.stack_offset < 0
+                and isinstance(stmt.src, ailment.Expr.VirtualVariable)
+                and stmt.src.was_reg
+                and stmt.src.reg_offset == self.project.arch.bp_offset
             ):
-                return first_block, idx, stmt.addr
+                return first_block, idx, stmt.dst
             if (
-                isinstance(stmt, ailment.Stmt.Store)
-                and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
-                and isinstance(stmt.data, ailment.Expr.StackBaseOffset)
-                and stmt.data.offset == 0
-                and stmt.addr.offset < 0
+                isinstance(stmt, ailment.Stmt.Assignment)
+                and isinstance(stmt.dst, ailment.Expr.VirtualVariable)
+                and stmt.dst.was_stack
+                and stmt.dst.stack_offset < 0
+                and isinstance(stmt.src, ailment.Expr.StackBaseOffset)
+                and stmt.src.offset == 0
             ):
-                return first_block, idx, stmt.addr
+                return first_block, idx, stmt.dst
 
         # Not found
         return None
@@ -124,7 +129,8 @@ class BasePointerSaveSimplifier(OptimizationPass):
                 for idx, stmt in enumerate(endpoint_block.statements):
                     if (
                         isinstance(stmt, ailment.Stmt.Assignment)
-                        and isinstance(stmt.dst, ailment.Expr.Register)
+                        and isinstance(stmt.dst, ailment.Expr.VirtualVariable)
+                        and stmt.dst.was_reg
                         and stmt.dst.reg_offset == self.project.arch.bp_offset
                         and isinstance(stmt.src, ailment.Expr.Load)
                         and isinstance(stmt.src.addr, ailment.Expr.StackBaseOffset)
@@ -135,10 +141,9 @@ class BasePointerSaveSimplifier(OptimizationPass):
                     if endpoint.addr not in callouts_and_jumpouts:
                         _l.debug("Could not find baseptr restoring statement in function %#x.", endpoint.addr)
                         return None
-                    else:
-                        _l.debug(
-                            "No baseptr restoring statement is found at callout/jumpout site %#x. Might be expected.",
-                            endpoint.addr,
-                        )
+                    _l.debug(
+                        "No baseptr restoring statement is found at callout/jumpout site %#x. Might be expected.",
+                        endpoint.addr,
+                    )
 
         return baseptr_restore_stmts

angr/analyses/decompiler/optimization_passes/call_stmt_rewriter.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+import logging
+
+from ailment.statement import Call, Assignment
+
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(name=__name__)
+
+
+class CallStatementRewriter(OptimizationPass):
+    """
+    Rewrite call statements to assignments if needed.
+    """
+
+    ARCHES = None
+    PLATFORMS = None
+    STAGE = OptimizationPassStage.AFTER_MAKING_CALLSITES
+    NAME = "Unify call statements on demand."
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+
+        self.analyze()
+
+    def _check(self):
+        return True, None
+
+    def _analyze(self, cache=None):
+
+        changed = False
+
+        for block in self._graph.nodes:
+            for idx in range(len(block.statements)):  # pylint:disable=consider-using-enumerate
+                stmt = block.statements[idx]
+                if isinstance(stmt, Call) and stmt.ret_expr is not None and stmt.fp_ret_expr is None:
+                    src = stmt.copy()
+                    src.ret_expr = None
+                    new_stmt = Assignment(stmt.idx, stmt.ret_expr, src, **stmt.tags)
+                    block.statements[idx] = new_stmt
+                    changed = True
+
+        if changed:
+            self.out_graph = self._graph

angr/analyses/decompiler/optimization_passes/code_motion.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import itertools
 import logging
 
@@ -58,6 +59,7 @@ class CodeMotionOptimization(OptimizationPass):
         return True, None
 
     def _analyze(self, cache=None):
+        _l.warning("CodeMotionOptimization is likely broken right now, use with caution!")
         optimization_runs = 0
         graph_copy = remove_labels(nx.DiGraph(self._graph))
         updates = True
@@ -116,9 +118,9 @@ class CodeMotionOptimization(OptimizationPass):
             original_graph.remove_nodes_from(original_blocks)
             original_graph.add_node(new_super)
             for pred in first_node_preds:
-                original_graph.add_edge(og_to_super[pred] if pred in og_to_super else pred, new_super)
+                original_graph.add_edge(og_to_super.get(pred, pred), new_super)
             for succ in last_node_preds:
-                original_graph.add_edge(new_super, og_to_super[succ] if succ in og_to_super else succ)
+                original_graph.add_edge(new_super, og_to_super.get(succ, succ))
 
         return False
 

angr/analyses/decompiler/optimization_passes/const_derefs.py

@@ -1,4 +1,5 @@
 # pylint:disable=unused-argument
+from __future__ import annotations
 from typing import TYPE_CHECKING
 import logging
 
@@ -17,7 +18,7 @@ _l = logging.getLogger(name=__name__)
 
 
 class BlockWalker(AILBlockWalker):
-    def __init__(self, project: "Project"):
+    def __init__(self, project: Project):
         super().__init__()
         self._project = project
         self._new_block: Block | None = None  # output
@@ -59,13 +60,12 @@ class BlockWalker(AILBlockWalker):
         new_src = self._handle_expr(1, stmt.src, stmt_idx, stmt, block)
 
         if new_dst is not None or new_src is not None:
-            new_stmt = Assignment(
+            return Assignment(
                 stmt.idx,
                 stmt.dst if new_dst is None else new_dst,
                 stmt.src if new_src is None else new_src,
                 **stmt.tags,
             )
-            return new_stmt
         return None
 
     def _handle_CallExpr(self, expr_idx: int, expr: Call, stmt_idx: int, stmt: Statement, block: Block | None):
@@ -88,7 +88,7 @@ class BlockWalker(AILBlockWalker):
 
         if new_target is not None or new_args is not None:
             # create a new call expr
-            new_expr = Call(
+            return Call(
                 expr.idx,
                 expr.target if new_target is None else new_target,
                 calling_convention=expr.calling_convention,
@@ -97,7 +97,6 @@ class BlockWalker(AILBlockWalker):
                 ret_expr=expr.ret_expr,
                 **expr.tags,
             )
-            return new_expr
         return None
 
     def _handle_Call(self, stmt_idx: int, stmt: Call, block: Block):
@@ -120,7 +119,7 @@ class BlockWalker(AILBlockWalker):
 
         if new_target is not None or new_args is not None:
             # create a new statement
-            new_stmt = Call(
+            return Call(
                 stmt.idx,
                 stmt.target if new_target is None else new_target,
                 calling_convention=stmt.calling_convention,
@@ -129,7 +128,6 @@ class BlockWalker(AILBlockWalker):
                 ret_expr=stmt.ret_expr,
                 **stmt.tags,
             )
-            return new_stmt
         return None
 
     def _handle_Load(self, expr_idx: int, expr: Load, stmt_idx: int, stmt: Statement, block: Block):
@@ -147,35 +145,38 @@ class BlockWalker(AILBlockWalker):
                 except KeyError:
                     # we don't have enough bytes to read out
                     w = None
-                if w is not None:
-                    if not (is_got and w == 0):
-                        # nice! replace it with the actual value
-                        return Const(None, None, w, expr.bits, **expr.tags)
-        elif isinstance(expr.addr, Load) and expr.addr.bits == self._project.arch.bits:
-            if isinstance(expr.addr.addr, Const):
+                if w is not None and not (is_got and w == 0):
+                    # nice! replace it with the actual value
+                    return Const(None, None, w, expr.bits, **expr.tags)
+        elif (
+            isinstance(expr.addr, Load)
+            and expr.addr.bits == self._project.arch.bits
+            and isinstance(expr.addr.addr, Const)
+            and (
                 # *(*(const_addr))
                 # does it belong to a read-only section/segment?
-                if self._addr_belongs_to_got(expr.addr.addr.value) or self._addr_belongs_to_ro_region(
-                    expr.addr.addr.value
-                ):
-                    w = self._project.loader.memory.unpack_word(
-                        expr.addr.addr.value,
-                        expr.addr.addr.bits // self._project.arch.byte_width,
-                        endness=self._project.arch.memory_endness,
-                    )
-                    if w is not None and self._addr_belongs_to_object(w):
-                        # nice! replace it with a load from that address
-                        return Load(
-                            expr.idx,
-                            Const(None, None, w, expr.addr.size, **expr.addr.addr.tags),
-                            expr.size,
-                            expr.endness,
-                            variable=expr.variable,
-                            variable_offset=expr.variable_offset,
-                            guard=expr.guard,
-                            alt=expr.alt,
-                            **expr.tags,
-                        )
+                self._addr_belongs_to_got(expr.addr.addr.value)
+                or self._addr_belongs_to_ro_region(expr.addr.addr.value)
+            )
+        ):
+            w = self._project.loader.memory.unpack_word(
+                expr.addr.addr.value,
+                expr.addr.addr.bits // self._project.arch.byte_width,
+                endness=self._project.arch.memory_endness,
+            )
+            if w is not None and self._addr_belongs_to_object(w):
+                # nice! replace it with a load from that address
+                return Load(
+                    expr.idx,
+                    Const(None, None, w, expr.addr.size, **expr.addr.addr.tags),
+                    expr.size,
+                    expr.endness,
+                    variable=expr.variable,
+                    variable_offset=expr.variable_offset,
+                    guard=expr.guard,
+                    alt=expr.alt,
+                    **expr.tags,
+                )
 
         return super()._handle_Load(expr_idx, expr, stmt_idx, stmt, block)
 
@@ -261,5 +262,4 @@ class ConstantDereferencesSimplifier(OptimizationPass):
         walker.walk()
 
     def _walk_block(self, block: Block) -> Block | None:
-        new_block = self._block_walker.walk(block)
-        return new_block
+        return self._block_walker.walk(block)

angr/analyses/decompiler/optimization_passes/const_prop_reverter.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 from collections.abc import Callable
 import itertools
@@ -226,13 +227,13 @@ class ConstPropOptReverter(OptimizationPass):
                 if len(state_vals) != 1:
                     continue
 
-                state_val = list(state_vals[0])[0]
+                state_val = next(iter(state_vals[0]))
                 if hasattr(state_val, "concrete") and state_val.concrete:
                     const_value = claripy.Solver().eval(state_val, 1)[0]
                 else:
                     continue
 
-                if not const_value == const_arg.value:
+                if const_value != const_arg.value:
                     continue
 
                 _l.debug("Constant argument at position %d was resolved to symbolic arg %s", i, sym_arg)
@@ -262,7 +263,7 @@ class ConstPropOptReverter(OptimizationPass):
         if len(conflicts) != 1:
             return
 
-        _, ret_exprs = list(conflicts.items())[0]
+        _, ret_exprs = next(iter(conflicts.items()))
         expr_to_blk = {ret_exprs[0]: blk0, ret_exprs[1]: blk1}
         # find the expression that is symbolic
         symb_expr, const_expr = None, None
@@ -271,9 +272,7 @@ class ConstPropOptReverter(OptimizationPass):
             if isinstance(expr, Convert):
                 unpacked_expr = expr.operands[0]
 
-            if isinstance(unpacked_expr, Const):
-                const_expr = expr
-            elif isinstance(unpacked_expr, Call):
+            if isinstance(unpacked_expr, (Const, Call)):
                 const_expr = expr
             else:
                 symb_expr = expr
@@ -362,6 +361,4 @@ class ConstPropOptReverter(OptimizationPass):
             return None
 
         # zip args of call 0 and 1 conflict if they are not like each other
-        conflicts = {i: args for i, args in enumerate(zip(call0.args, call1.args)) if not args[0].likes(args[1])}
-
-        return conflicts
+        return {i: args for i, args in enumerate(zip(call0.args, call1.args)) if not args[0].likes(args[1])}