angr 9.2.116__py3-none-win_amd64.whl → 9.2.117__py3-none-win_amd64.whl

angr/engines/soot/statements/throw.py

@@ -1,12 +1,14 @@
 import logging
 
-from .base import SimSootStmt
+import claripy
 from archinfo.arch_soot import SootAddressTerminator
 
+from .base import SimSootStmt
+
 l = logging.getLogger(name=__name__)
 
 
 class SimSootStmt_Throw(SimSootStmt):
     def _execute(self):
         # TODO: implement simprocedure to throw exception
-        self._add_jmp_target(target=SootAddressTerminator(), condition=self.state.solver.true)
+        self._add_jmp_target(target=SootAddressTerminator(), condition=claripy.true)

angr/engines/soot/values/arrayref.py

@@ -1,6 +1,6 @@
 import logging
 
-from claripy import And
+import claripy
 
 from . import translate_value
 from ....errors import SimEngineError
@@ -38,7 +38,7 @@ class SimSootValue_ArrayBaseRef(SimSootValue):
 
         :param function generator: Function that given the state, returns a
                                    default value for array elements, e.g.
-                                   `generator = lambda state: state.solver.BVV(0, 32)`
+                                   `generator = lambda state: claripy.BVV(0, 32)`
         """
         self._default_value_generator = generator
 
@@ -81,9 +81,9 @@ class SimSootValue_ArrayRef(SimSootValue):
     def check_array_bounds(idx, array, state):
         # a valid idx fullfills the constraint
         # 0 <= idx < length
-        zero = state.solver.BVV(0, 32)
+        zero = claripy.BVV(0, 32)
         length = array.size
-        bound_constraint = state.solver.And(
+        bound_constraint = claripy.And(
             length.SGT(idx),
             zero.SLE(idx),
         )
@@ -121,4 +121,4 @@ class SimSootValue_ArrayRef(SimSootValue):
                 idx,
                 length,
             )
-            state.solver.add(And(length.SGT(idx), zero.SLE(idx)))
+            state.solver.add(claripy.And(length.SGT(idx), zero.SLE(idx)))

angr/engines/unicorn.py

@@ -3,6 +3,7 @@ import functools
 import logging
 
 import archinfo
+import claripy
 
 from ..errors import SimIRSBError, SimIRSBNoDecodeError, SimValueError
 from .engine import SuccessorsMixin
@@ -178,7 +179,7 @@ class SimEngineUnicorn(SuccessorsMixin):
 
         self._instr_mem_write_addrs = set()  # pylint:disable=attribute-defined-outside-init
         for block_details in self.state.unicorn._get_details_of_blocks_with_symbolic_vex_stmts():
-            self.state.scratch.guard = self.state.solver.true
+            self.state.scratch.guard = claripy.true
             try:
                 if self.state.os_name == "CGC" and block_details["block_addr"] in {
                     self.state.unicorn.cgc_random_addr,
@@ -314,7 +315,7 @@ class SimEngineUnicorn(SuccessorsMixin):
             mem_read_val += next_val["value"]
 
         assert state.inspect.mem_read_length == mem_read_size
-        state.inspect.mem_read_address = state.solver.BVV(mem_read_address, state.inspect.mem_read_address.size())
+        state.inspect.mem_read_address = claripy.BVV(mem_read_address, state.inspect.mem_read_address.size())
         if mem_read_taint_map.count(-1) != mem_read_size:
             # Since read is might need bitmap adjustment, insert breakpoint to return the correct concrete value
             self.state.inspect.b(
@@ -330,9 +331,9 @@ class SimEngineUnicorn(SuccessorsMixin):
         if taint_map.count(0) == state.inspect.mem_read_length:
             # The value is completely concrete
             if state.arch.memory_endness == archinfo.Endness.LE:
-                state.inspect.mem_read_expr = state.solver.BVV(value[::-1])
+                state.inspect.mem_read_expr = claripy.BVV(value[::-1])
             else:
-                state.inspect.mem_read_expr = state.solver.BVV(value)
+                state.inspect.mem_read_expr = claripy.BVV(value)
         else:
             # The value may be partially concrete. Set the symbolic bitmap to read correct value and restore it
             mem_read_addr = state.solver.eval(state.inspect.mem_read_address)
@@ -370,12 +371,12 @@ class SimEngineUnicorn(SuccessorsMixin):
 
                 for offset, expected_taint in enumerate(taint_map):
                     if expected_taint == 0:
-                        curr_value_bytes[offset] = state.solver.BVV(value[offset], 8)
+                        curr_value_bytes[offset] = claripy.BVV(value[offset], 8)
 
                 if state.arch.memory_endness == archinfo.Endness.LE:
                     curr_value_bytes = reversed(curr_value_bytes)
 
-                curr_value = state.solver.Concat(*curr_value_bytes)
+                curr_value = claripy.Concat(*curr_value_bytes)
 
             state.inspect.mem_read_expr = curr_value
 
@@ -475,7 +476,7 @@ class SimEngineUnicorn(SuccessorsMixin):
 
         if state.unicorn.jumpkind.startswith("Ijk_Sys"):
             state.ip = state.unicorn._syscall_pc
-        successors.add_successor(state, state.ip, state.solver.true, state.unicorn.jumpkind)
+        successors.add_successor(state, state.ip, claripy.true, state.unicorn.jumpkind)
 
         successors.description = description
         successors.processed = True

angr/engines/vex/heavy/concretizers.py

@@ -57,13 +57,13 @@ def concretize_cmpf64(state, args):
     fp_arg0 = state.solver.eval(args[0])
     fp_arg1 = state.solver.eval(args[1])
     if fp_arg0 < fp_arg1:
-        return state.solver.BVV(1, 32)
+        return claripy.BVV(1, 32)
     if fp_arg0 > fp_arg1:
-        return state.solver.BVV(0, 32)
+        return claripy.BVV(0, 32)
     if fp_arg0 == fp_arg1:
-        return state.solver.BVV(0x40, 32)
+        return claripy.BVV(0x40, 32)
 
-    return state.solver.BVV(0x45, 32)
+    return claripy.BVV(0x45, 32)
 
 
 def concretize_divf64(state, args):
@@ -113,13 +113,13 @@ def concretize_float64_to_int64s(state, args):
 
 
 def concretize_int32s_to_float64(state, args):
-    arg = state.solver.BVV(state.solver.eval(args[0]), args[0].size())
+    arg = claripy.BVV(state.solver.eval(args[0]), args[0].size())
     return arg.val_to_fp(claripy.fp.FSort.from_size(64), signed=True, rm=fp_rm_map[0])
 
 
 def concretize_int64s_to_float64(state, args):
     rm = translate_rm(args[0])
-    arg = state.solver.BVV(state.solver.eval(args[1]), args[1].size())
+    arg = claripy.BVV(state.solver.eval(args[1]), args[1].size())
     return arg.val_to_fp(claripy.fp.FSort.from_size(64), signed=True, rm=rm)
 
 

angr/engines/vex/heavy/dirty.py

@@ -1,8 +1,8 @@
-import claripy
-
 import logging
 import time
 
+import claripy
+
 from angr import sim_options as o, errors
 
 l = logging.getLogger(name=__name__)
@@ -20,16 +20,16 @@ l = logging.getLogger(name=__name__)
 # http://www.cap-lore.com/code/TB/
 def ppcg_dirtyhelper_MFTB(state):
     # TODO: This is an incorrect implementation. Fix it later!
-    return state.solver.BVV(0x200, 64), []
+    return claripy.BVV(0x200, 64), []
 
 
 def ppc32g_dirtyhelper_MFSPR_287(state):
-    return state.solver.BVV(0x200, 32), []
+    return claripy.BVV(0x200, 32), []
 
 
 def amd64g_dirtyhelper_RDTSC(state):
     if o.USE_SYSTEM_TIMES in state.options:
-        val = state.solver.BVV(int(time.process_time() * 1000000) + 12345678, 64)
+        val = claripy.BVV(int(time.process_time() * 1000000) + 12345678, 64)
     else:
         val = state.solver.BVS("RDTSC", 64, key=("hardware", "rdtsc"))
     return val, []
@@ -121,15 +121,13 @@ EmWarn_S390X_invalid_rounding = 11
 def amd64g_check_ldmxcsr(state, mxcsr):
     rmode = state.solver.LShR(mxcsr, 13) & 3
 
-    ew = state.solver.If(
+    ew = claripy.If(
         (mxcsr & 0x1F80) != 0x1F80,
-        state.solver.BVV(EmWarn_X86_sseExns, 64),
-        state.solver.If(
+        claripy.BVV(EmWarn_X86_sseExns, 64),
+        claripy.If(
             mxcsr & (1 << 15) != 0,
-            state.solver.BVV(EmWarn_X86_fz, 64),
-            state.solver.If(
-                mxcsr & (1 << 6) != 0, state.solver.BVV(EmWarn_X86_daz, 64), state.solver.BVV(EmNote_NONE, 64)
-            ),
+            claripy.BVV(EmWarn_X86_fz, 64),
+            claripy.If(mxcsr & (1 << 6) != 0, claripy.BVV(EmWarn_X86_daz, 64), claripy.BVV(EmNote_NONE, 64)),
         ),
     )
 
@@ -138,7 +136,7 @@ def amd64g_check_ldmxcsr(state, mxcsr):
 
 # see canonical implementation of this in guest_amd64_helpers.c
 def amd64g_dirtyhelper_XRSTOR_COMPONENT_1_EXCLUDING_XMMREGS(state, _, addr):
-    w32 = state.solver.BVV(
+    w32 = claripy.BVV(
         (state.mem[state.solver.eval(addr) + 12 * 2].short.concrete & 0xFFFF)
         | ((state.mem[state.solver.eval(addr) + 13 * 2].short.concrete & 0xFFFF) << 16),
         64,
@@ -365,7 +363,7 @@ def x86g_dirtyhelper_LGDT_LIDT(state, addr, op):
     base = state.memory.load(addr + 2, 4, endness="Iend_LE")
 
     if op.concrete_value == 2:
-        state.regs.gdt = state.solver.Concat(base, limit).zero_extend(16)
+        state.regs.gdt = claripy.Concat(base, limit).zero_extend(16)
     elif op.concrete_value == 3:
         # LIDT is a nop
         pass
@@ -398,8 +396,8 @@ def x86g_dirtyhelper_loadF80le(state, addr):
     mantissa = tbyte[62:0]
 
     normalized_exponent = exponent[10:0] - 16383 + 1023
-    zero_exponent = state.solver.BVV(0, 11)
-    inf_exponent = state.solver.BVV(-1, 11)
+    zero_exponent = claripy.BVV(0, 11)
+    inf_exponent = claripy.BVV(-1, 11)
     final_exponent = claripy.If(
         exponent == 0, zero_exponent, claripy.If(exponent == -1, inf_exponent, normalized_exponent)
     )
@@ -424,8 +422,8 @@ def x86g_dirtyhelper_storeF80le(state, addr, qword):
     mantissa = qword[51:0]
 
     normalized_exponent = exponent.zero_extend(4) - 1023 + 16383
-    zero_exponent = state.solver.BVV(0, 15)
-    inf_exponent = state.solver.BVV(-1, 15)
+    zero_exponent = claripy.BVV(0, 15)
+    inf_exponent = claripy.BVV(-1, 15)
     final_exponent = claripy.If(
         exponent == 0, zero_exponent, claripy.If(exponent == -1, inf_exponent, normalized_exponent)
     )
@@ -449,18 +447,18 @@ def x86g_dirtyhelper_RDMSR(state, msr):
     try:
         msr_conc = state.solver.eval_one(msr)
     except errors.SimSolverError:
-        return state.solver.BVS("rdmsr_?", 64, key=("cpu", "rdmsr", "?")), []
+        return claripy.BVS("rdmsr_?", 64, key=("cpu", "rdmsr", "?")), []
     else:
-        return state.solver.BVS("rdmsr_%#x" % msr_conc, 64, key=("cpu", "rdmsr", msr_conc), eternal=True), []
+        return claripy.BVS("rdmsr_%#x" % msr_conc, 64, key=("cpu", "rdmsr", msr_conc), eternal=True), []
 
 
 def x86g_dirtyhelper_XGETBV(state, reg):
     try:
         reg_conc = state.solver.eval_one(reg)
     except errors.SimSolverError:
-        return state.solver.BVS("xgetbv_?", 64, key=("cpu", "xgetbv", "?")), []
+        return claripy.BVS("xgetbv_?", 64, key=("cpu", "xgetbv", "?")), []
     else:
-        return state.solver.BVS("xgetbv_%#x" % reg_conc, 64, key=("cpu", "xgetbv", reg_conc), eternal=True), []
+        return claripy.BVS("xgetbv_%#x" % reg_conc, 64, key=("cpu", "xgetbv", reg_conc), eternal=True), []
 
 
 amd64g_dirtyhelper_RDMSR = x86g_dirtyhelper_RDMSR

angr/engines/vex/heavy/heavy.py

@@ -203,7 +203,7 @@ class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEX
                 exit_state.registers.store(
                     exit_state.arch.ret_offset, exit_state.solver.Unconstrained("fake_ret_value", exit_state.arch.bits)
                 )
-                exit_state.scratch.target = exit_state.solver.BVV(successors.addr + irsb.size, exit_state.arch.bits)
+                exit_state.scratch.target = claripy.BVV(successors.addr + irsb.size, exit_state.arch.bits)
                 exit_state.history.jumpkind = "Ijk_Ret"
                 exit_state.regs.ip = exit_state.scratch.target
                 if exit_state.arch.call_pushes_ret:
@@ -215,12 +215,8 @@ class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEX
                 l.debug("%s adding postcall exit.", self)
 
                 ret_state = exit_state.copy()
-                guard = (
-                    ret_state.solver.true
-                    if o.TRUE_RET_EMULATION_GUARD in self.state.options
-                    else ret_state.solver.false
-                )
-                ret_target = ret_state.solver.BVV(successors.addr + irsb.size, ret_state.arch.bits)
+                guard = claripy.true if o.TRUE_RET_EMULATION_GUARD in self.state.options else claripy.false
+                ret_target = claripy.BVV(successors.addr + irsb.size, ret_state.arch.bits)
                 ret_state.registers.store(
                     ret_state.arch.ret_offset, ret_state.solver.Unconstrained("fake_ret_value", ret_state.arch.bits)
                 )
@@ -340,7 +336,7 @@ class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEX
             result = self.state.solver.simplify(result)
 
         if self.state.solver.symbolic(result) and o.CONCRETIZE in self.state.options:
-            concrete_value = self.state.solver.BVV(self.state.solver.eval(result), len(result))
+            concrete_value = claripy.BVV(self.state.solver.eval(result), len(result))
             self.state.add_constraints(result == concrete_value)
             result = concrete_value
 

angr/exploration_techniques/director.py

@@ -330,7 +330,7 @@ class CallFunctionGoal(BaseGoal):
     def _compare_pointer_content(state, ptr, expected):
         if isinstance(expected, str):
             # convert it to an AST
-            expected = state.solver.BVV(expected)
+            expected = claripy.BVV(expected)
         length = expected.size() // 8
         real_string = state.memory.load(ptr, length, endness="Iend_BE")
 

angr/exploration_techniques/driller_core.py

@@ -1,6 +1,8 @@
 import logging
 from itertools import islice
 
+import claripy
+
 from . import ExplorationTechnique
 
 
@@ -91,7 +93,7 @@ class DrillerCore(ExplorationTechnique):
     @staticmethod
     def _has_false(state):
         # Check if the state is unsat even if we remove preconstraints.
-        claripy_false = state.solver.false
+        claripy_false = claripy.false
         if state.scratch.guard.cache_key == claripy_false.cache_key:
             return True
 

angr/exploration_techniques/tracer.py

@@ -2,6 +2,7 @@ from typing import TYPE_CHECKING
 import logging
 import cle
 
+import claripy
 from capstone import CS_GRP_CALL, CS_GRP_IRET, CS_GRP_JUMP, CS_GRP_RET
 
 from . import ExplorationTechnique
@@ -53,7 +54,7 @@ class RepHook:
 
     @staticmethod
     def _inline_call(state, procedure, *arguments, **kwargs):
-        e_args = [state.solver.BVV(a, state.arch.bits) if isinstance(a, int) else a for a in arguments]
+        e_args = [claripy.BVV(a, state.arch.bits) if isinstance(a, int) else a for a in arguments]
         p = procedure(project=state.project, **kwargs)
         return p.execute(state, None, arguments=e_args)
 

angr/procedures/cgc/allocate.py

@@ -18,13 +18,13 @@ class allocate(angr.SimProcedure):
         length = self.state.solver.max_int(length)
 
         # return code (see allocate() docs)
-        r = self.state.solver.ite_cases(
+        r = claripy.ite_cases(
             (
                 (length == 0, self.state.cgc.EINVAL),
                 (length > self.state.cgc.max_allocation, self.state.cgc.EINVAL),
                 (self.state.cgc.addr_invalid(addr), self.state.cgc.EFAULT),
             ),
-            self.state.solver.BVV(0, self.state.arch.bits),
+            claripy.BVV(0, self.state.arch.bits),
         )
 
         if self.state.solver.max_int(r) != 0:
@@ -34,7 +34,7 @@ class allocate(angr.SimProcedure):
         aligned_length = ((length + 0xFFF) // 0x1000) * 0x1000
 
         if isinstance(self.state.cgc.allocation_base, int):
-            self.state.cgc.allocation_base = self.state.solver.BVV(self.state.cgc.allocation_base, self.state.arch.bits)
+            self.state.cgc.allocation_base = claripy.BVV(self.state.cgc.allocation_base, self.state.arch.bits)
 
         chosen = self.state.cgc.get_max_sinkhole(aligned_length)
         if chosen is None:
@@ -49,26 +49,24 @@ class allocate(angr.SimProcedure):
                 if sinkhole_size != 0:
                     self.state.cgc.add_sinkhole(cgc_flag_page_start_addr + 0x1000, sinkhole_size)
 
-                chosen = self.state.solver.BVV(cgc_flag_page_start_addr - aligned_length, self.state.arch.bits)
+                chosen = claripy.BVV(cgc_flag_page_start_addr - aligned_length, self.state.arch.bits)
             elif chosen_conc <= self.state.project.loader.max_addr < allocation_base_conc:
                 # Chosen memory overlaps with some loaded object
                 sinkhole_size = allocation_base_conc - self.state.project.loader.max_addr
                 if sinkhole_size != 0:
                     self.state.cgc.add_sinkhole(self.state.project.loader.max_addr, sinkhole_size)
 
-                chosen = self.state.solver.BVV(
-                    self.state.project.loader.min_addr - aligned_length, self.state.arch.bits
-                )
+                chosen = claripy.BVV(self.state.project.loader.min_addr - aligned_length, self.state.arch.bits)
 
             self.state.cgc.allocation_base = chosen
 
         self.state.memory.store(
-            addr, chosen, size=self.state.arch.bytes, condition=self.state.solver.And(addr != 0), endness="Iend_LE"
+            addr, chosen, size=self.state.arch.bytes, condition=claripy.And(addr != 0), endness="Iend_LE"
         )
 
         # PROT_READ | PROT_WRITE default
-        permissions = self.state.solver.BVV(1 | 2, 3)
-        permissions |= self.state.solver.If(is_x != 0, claripy.BVV(4, 3), claripy.BVV(0, 3))
+        permissions = claripy.BVV(1 | 2, 3)
+        permissions |= claripy.If(is_x != 0, claripy.BVV(4, 3), claripy.BVV(0, 3))
 
         chosen_conc = self.state.solver.eval(chosen)
         l.debug("Allocating [%#x, %#x]", chosen_conc, chosen_conc + aligned_length - 1)

angr/procedures/cgc/deallocate.py

@@ -1,8 +1,10 @@
 import logging
 
+import claripy
 from unique_log_filter import UniqueLogFilter
 
 import angr
+from angr.state_plugins.sim_action_object import SimActionObject
 
 l = logging.getLogger(name=__name__)
 l.addFilter(UniqueLogFilter())
@@ -11,16 +13,21 @@ l.addFilter(UniqueLogFilter())
 class deallocate(angr.SimProcedure):
     # pylint:disable=arguments-differ
 
-    def run(self, addr, length):  # pylint:disable=unused-argument
+    def run(self, addr, length):
+        if isinstance(addr, SimActionObject):
+            addr = addr.ast
+        if isinstance(length, SimActionObject):
+            length = length.ast
+
         # return code (see deallocate() docs)
-        r = self.state.solver.ite_cases(
+        r = claripy.ite_cases(
             (
                 (addr % 0x1000 != 0, self.state.cgc.EINVAL),
                 (length == 0, self.state.cgc.EINVAL),
                 (self.state.cgc.addr_invalid(addr), self.state.cgc.EINVAL),
                 (self.state.cgc.addr_invalid(addr + length), self.state.cgc.EINVAL),
             ),
-            self.state.solver.BVV(0, self.state.arch.bits),
+            claripy.BVV(0, self.state.arch.bits),
         )
 
         if self.state.solver.symbolic(addr):

angr/procedures/cgc/fdwait.py

@@ -1,7 +1,9 @@
-import angr
-
 import itertools
 
+import claripy
+
+import angr
+
 fdcount = itertools.count()
 
 
@@ -10,42 +12,42 @@ class fdwait(angr.SimProcedure):
 
     def run(self, nfds, readfds, writefds, timeout, readyfds):
         run_count = next(fdcount)
-        total_ready = self.state.solver.BVV(0, self.state.arch.bits)
+        total_ready = claripy.BVV(0, self.state.arch.bits)
 
         read_fds = []
         for fd_set in range(0, 32, 8):
             sym_newbits = []
             for fd in range(fd_set, fd_set + 8):
                 if angr.options.CGC_NON_BLOCKING_FDS in self.state.options:
-                    sym_bit = self.state.solver.BVV(1, 1)
+                    sym_bit = claripy.BVV(1, 1)
                 else:
                     sym_bit = self.state.solver.Unconstrained(
                         "fdwait_read_%d_%d" % (run_count, fd), 1, key=("syscall", "fdwait", fd, "read_ready")
                     )
-                fd = self.state.solver.BVV(fd, self.state.arch.bits)
-                sym_newbit = self.state.solver.If(self.state.solver.ULT(fd, nfds), sym_bit, 0)
+                fd = claripy.BVV(fd, self.state.arch.bits)
+                sym_newbit = claripy.If(claripy.ULT(fd, nfds), sym_bit, 0)
                 total_ready += sym_newbit.zero_extend(self.state.arch.bits - 1)
                 sym_newbits.append(sym_newbit)
             read_fds.extend(reversed(sym_newbits))
-        self.state.memory.store(readfds, self.state.solver.Concat(*read_fds), condition=readfds != 0)
+        self.state.memory.store(readfds, claripy.Concat(*read_fds), condition=readfds != 0)
 
         write_fds = []
         for fd_set in range(0, 32, 8):
             sym_newbits = []
             for fd in range(fd_set, fd_set + 8):
                 if angr.options.CGC_NON_BLOCKING_FDS in self.state.options:
-                    sym_bit = self.state.solver.BVV(1, 1)
+                    sym_bit = claripy.BVV(1, 1)
                 else:
                     sym_bit = self.state.solver.Unconstrained(
                         "fdwait_write_%d_%d" % (run_count, fd), 1, key=("syscall", "fdwait", fd, "write_ready")
                     )
 
-                fd = self.state.solver.BVV(fd, self.state.arch.bits)
-                sym_newbit = self.state.solver.If(self.state.solver.ULT(fd, nfds), sym_bit, 0)
+                fd = claripy.BVV(fd, self.state.arch.bits)
+                sym_newbit = claripy.If(claripy.ULT(fd, nfds), sym_bit, 0)
                 total_ready += sym_newbit.zero_extend(self.state.arch.bits - 1)
                 sym_newbits.append(sym_newbit)
             write_fds.extend(reversed(sym_newbits))
-        self.state.memory.store(writefds, self.state.solver.Concat(*write_fds), condition=writefds != 0)
+        self.state.memory.store(writefds, claripy.Concat(*write_fds), condition=writefds != 0)
 
         self.state.memory.store(readyfds, total_ready, endness="Iend_LE", condition=readyfds != 0)
 
@@ -56,7 +58,7 @@ class fdwait(angr.SimProcedure):
             timeout + 4, 4, endness=self.state.arch.memory_endness, condition=timeout != 0, fallback=0
         )
         total_time = tv_sec * 1000000 + tv_usec
-        self.state.cgc.time += self.state.solver.If(total_ready == 0, total_time, 0)
+        self.state.cgc.time += claripy.If(total_ready == 0, total_time, 0)
 
         # TODO: errors
-        return self.state.solver.BVV(0, self.state.arch.bits)
+        return claripy.BVV(0, self.state.arch.bits)

angr/procedures/cgc/random.py

@@ -1,6 +1,9 @@
 import itertools
 
+import claripy
+
 import angr
+from angr.state_plugins.sim_action_object import SimActionObject
 
 rand_count = itertools.count()
 
@@ -9,6 +12,9 @@ class random(angr.SimProcedure):
     # pylint:disable=arguments-differ,missing-class-docstring
 
     def run(self, buf, count, rnd_bytes, concrete_data=None):
+        if isinstance(rnd_bytes, SimActionObject):
+            rnd_bytes = rnd_bytes.ast
+
         if self.state.mode == "fastpath":
             # Special case for CFG
             if (
@@ -28,15 +34,15 @@ class random(angr.SimProcedure):
                     self.state.memory.store(rnd_bytes, count, endness="Iend_LE")
 
             # We always return something in fastpath mode
-            return self.state.solver.BVV(0, self.state.arch.bits)
+            return claripy.BVV(0, self.state.arch.bits)
 
         # return code
-        r = self.state.solver.ite_cases(
+        r = claripy.ite_cases(
             (
                 (self.state.cgc.addr_invalid(buf), self.state.cgc.EFAULT),
-                (self.state.solver.And(rnd_bytes != 0, self.state.cgc.addr_invalid(rnd_bytes)), self.state.cgc.EFAULT),
+                (claripy.And(rnd_bytes != 0, self.state.cgc.addr_invalid(rnd_bytes)), self.state.cgc.EFAULT),
             ),
-            self.state.solver.BVV(0, self.state.arch.bits),
+            claripy.BVV(0, self.state.arch.bits),
         )
 
         if self.state.satisfiable(extra_constraints=[count != 0]):
@@ -46,7 +52,7 @@ class random(angr.SimProcedure):
             )
 
             if concrete_data:
-                value = self.state.solver.BVS(f"random_{next(rand_count)}", max_size)
+                value = claripy.BVS(f"random_{next(rand_count)}", max_size)
                 self.state.preconstrainer.preconstrain(concrete_data, value)
             else:
                 value = self.state.solver.Unconstrained(

angr/procedures/cgc/receive.py

@@ -1,5 +1,7 @@
 from itertools import count
 
+import claripy
+
 import angr
 
 from ... import sim_options as o
@@ -30,7 +32,7 @@ class receive(angr.SimProcedure):
                 count = self.state.solver.Unconstrained("receive_length", self.state.arch.bits)
             self.state.memory.store(rx_bytes, count, endness="Iend_LE")
 
-            return self.state.solver.BVV(0, self.state.arch.bits)
+            return claripy.BVV(0, self.state.arch.bits)
 
         # check invalid memory accesses
         # rules for invalid: greater than 0xc0 or wraps around
@@ -56,7 +58,7 @@ class receive(angr.SimProcedure):
             )
             read_length = simfd.read(buf, count, short_reads=False, do_concrete_update=do_concrete_update)
             if type(read_length) is int:
-                read_length = self.state.solver.BVV(read_length, 32)
+                read_length = claripy.BVV(read_length, 32)
             self.state.memory.store(rx_bytes, read_length, condition=rx_bytes != 0, endness="Iend_LE")
             self.size = read_length
 
@@ -86,6 +88,6 @@ class receive(angr.SimProcedure):
 
             self.size = read_length
             if type(read_length) is int:
-                read_length = self.state.solver.BVV(read_length, 32)
+                read_length = claripy.BVV(read_length, 32)
             self.state.memory.store(rx_bytes, read_length, condition=rx_bytes != 0, endness="Iend_LE")
             return 0

angr/procedures/cgc/transmit.py

@@ -1,5 +1,6 @@
-import angr
+import claripy
 
+import angr
 from ... import sim_options as o
 
 
@@ -17,7 +18,7 @@ class transmit(angr.SimProcedure):
         if self.state.mode == "fastpath":
             # Special case for CFG generation
             self.state.memory.store(tx_bytes, count, endness="Iend_LE")
-            return self.state.solver.BVV(0, self.state.arch.bits)
+            return claripy.BVV(0, self.state.arch.bits)
 
         if o.ABSTRACT_MEMORY in self.state.options:
             simfd.write(buf, count)
@@ -54,10 +55,10 @@ class transmit(angr.SimProcedure):
             )
 
             if do_concrete_update and count.symbolic:
-                concrete_count = self.state.solver.BVV(self.state.solver.eval(count), 32)
+                concrete_count = claripy.BVV(self.state.solver.eval(count), 32)
                 self.state.memory.store(tx_bytes, concrete_count, endness="Iend_LE", condition=tx_bytes != 0)
 
             self.state.memory.store(tx_bytes, count, endness="Iend_LE", condition=tx_bytes != 0)
 
         # TODO: transmit failure
-        return self.state.solver.BVV(0, self.state.arch.bits)
+        return claripy.BVV(0, self.state.arch.bits)