angr 9.2.116__py3-none-win_amd64.whl → 9.2.118__py3-none-win_amd64.whl

angr/analyses/decompiler/ailgraph_walker.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import networkx  # pylint:disable=unused-import
 
 

angr/analyses/decompiler/block_io_finder.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from collections import defaultdict
 from typing import Any
 
@@ -5,6 +6,7 @@ from ailment import Block
 from ailment.statement import Call, Statement, ConditionalJump, Assignment, Store, Return, Jump
 from ailment.expression import (
     Load,
+    VirtualVariable,
     Expression,
     BinaryOp,
     UnaryOp,
@@ -191,6 +193,15 @@ class BlockIOFinder(AILBlockWalkerBase):
         self._add_or_update_dict(self.derefed_at, stmt_idx, load_loc)
         return load_loc
 
+    def _handle_VirtualVariable(
+        self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt: Statement, block: Block | None, is_memory=True
+    ):
+        if expr.was_stack:
+            load_loc = MemoryLocation(SpOffset(self._project.arch.bits, expr.stack_offset), expr.bits)
+            self._add_or_update_dict(self.derefed_at, stmt_idx, load_loc)
+            return load_loc
+        return None
+
     def _handle_CallExpr(
         self, expr_idx: int, expr: Call, stmt_idx: int, stmt: Statement, block: Block | None, is_memory=False
     ):
@@ -253,8 +264,7 @@ class BlockIOFinder(AILBlockWalkerBase):
     ):
         if self._as_atom:
             return None
-        else:
-            return expr
+        return expr
 
     # pylint: disable=unused-argument
     def _handle_Register(
@@ -262,8 +272,7 @@ class BlockIOFinder(AILBlockWalkerBase):
     ):
         if self._as_atom:
             return Register(expr.reg_offset, expr.size)
-        else:
-            return expr
+        return expr
 
     def _handle_Const(
         self, expr_idx: int, expr: Const, stmt_idx: int, stmt: Statement, block: Block | None, is_memory=False

angr/analyses/decompiler/block_similarity.py

@@ -1,9 +1,13 @@
+from __future__ import annotations
+import logging
 import networkx as nx
 from ailment.block import Block
 from ailment.statement import Statement, ConditionalJump
 
 from .utils import find_block_by_addr
 
+_l = logging.getLogger(name=__name__)
+
 
 def has_similar_stmt(blk1: Block, blk2: Block):
     """
@@ -17,11 +21,20 @@ def has_similar_stmt(blk1: Block, blk2: Block):
 
 
 def is_similar(
-    ail_obj1: Block | Statement, ail_obj2: Block | Statement, graph: nx.DiGraph = None, partial: bool = True
+    ail_obj1: Block | Statement,
+    ail_obj2: Block | Statement,
+    graph: nx.DiGraph = None,
+    partial: bool = True,
+    max_depth: int = 10,
+    curr_depth: int = 0,
 ):
     """
     Returns True if the two AIL objects are similar, False otherwise.
     """
+    if curr_depth >= max_depth:
+        _l.warning("Reached maximum depth while comparing AIL objects, assuming true!")
+        return True
+
     if type(ail_obj1) is not type(ail_obj2):
         return False
 
@@ -34,24 +47,25 @@ def is_similar(
             return False
 
         for stmt1, stmt2 in zip(ail_obj1.statements, ail_obj2.statements):
-            if not is_similar(stmt1, stmt2, graph=graph):
+            if not is_similar(stmt1, stmt2, graph=graph, max_depth=max_depth, curr_depth=curr_depth + 1):
                 return False
         return True
 
     # AIL Statements
-    elif isinstance(ail_obj1, Statement):
-        # if all(barr in [0x404530, 0x404573] for barr in [ail_obj1.ins_addr, ail_obj2.ins_addr]):
-        #    do a breakpoint
+    if isinstance(ail_obj1, Statement):
+        # must be likeable
+        if not hasattr(ail_obj2, "likes"):
+            return False
 
         # ConditionalJump Handler
         if isinstance(ail_obj1, ConditionalJump):
             # try a simple compare
-            liked = ail_obj1.likes(ail_obj2)
+            liked = ail_obj1.matches(ail_obj2)
             if liked or not graph:
                 return liked
 
             # even in partial matching, the condition must at least match
-            if not ail_obj1.condition.likes(ail_obj2.condition):
+            if not ail_obj1.condition.matches(ail_obj2.condition):
                 return False
 
             # must use graph to know
@@ -59,7 +73,8 @@ def is_similar(
                 t1, t2 = getattr(ail_obj1, attr).value, getattr(ail_obj2, attr).value
                 try:
                     t1_blk, t2_blk = find_block_by_addr(graph, t1), find_block_by_addr(graph, t2)
-                except KeyError:
+                except ValueError:
+                    _l.warning("Could not find block by address in graph. It is likely that the graph is broken.")
                     return False
 
                 # special checks for when a node is empty:
@@ -73,18 +88,16 @@ def is_similar(
                     return False
 
                 # skip full checks when partial checking is on
-                if partial and t1_blk.statements[0].likes(t2_blk.statements[0]):
+                if partial and t1_blk.statements[0].matches(t2_blk.statements[0]):
                     continue
 
-                if not is_similar(t1_blk, t2_blk, graph=graph):
+                if not is_similar(t1_blk, t2_blk, graph=graph, curr_depth=curr_depth + 1, max_depth=max_depth):
                     return False
             return True
 
         # Generic Statement Handler
-        else:
-            return ail_obj1.likes(ail_obj2)
-    else:
-        return False
+        return ail_obj1.matches(ail_obj2)
+    return False
 
 
 #
@@ -148,10 +161,7 @@ def in_other(stmts, other, graph=None):
     @return:
     """
 
-    if index_of_similar_stmts(stmts, other, graph=graph) is not None:
-        return True
-
-    return False
+    return index_of_similar_stmts(stmts, other, graph=graph) is not None
 
 
 def longest_ail_subseq(

angr/analyses/decompiler/block_simplifier.py

@@ -1,20 +1,17 @@
 # pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
 import logging
-from typing import Optional, TYPE_CHECKING
+from typing import TYPE_CHECKING
 from collections.abc import Iterable
 
 from ailment.statement import Statement, Assignment, Call, Store, Jump
 from ailment.expression import Tmp, Load, Const, Register, Convert
 from ailment import AILBlockWalkerBase
 
-from angr.code_location import ExternalCodeLocation
+from angr.code_location import ExternalCodeLocation, CodeLocation
 
-from ...engines.light.data import SpOffset
-from ...knowledge_plugins.key_definitions.constants import OP_AFTER
-from ...knowledge_plugins.key_definitions import atoms
-from ...analyses.propagator import PropagatorAnalysis
-from ...analyses.reaching_definitions import ReachingDefinitionsAnalysis
-from ...errors import SimMemoryMissingError
+from ...analyses.s_propagator import SPropagatorAnalysis
+from ...analyses.s_reaching_definitions import SReachingDefinitionsAnalysis, SRDAModel
 from .. import Analysis, register_analysis
 from .peephole_optimizations import (
     MULTI_STMT_OPTS,
@@ -27,8 +24,7 @@ from .peephole_optimizations import (
 from .utils import peephole_optimize_exprs, peephole_optimize_stmts, peephole_optimize_multistmts
 
 if TYPE_CHECKING:
-    from angr.storage.memory_mixins.paged_memory.pages.multi_values import MultiValues
-    from angr.knowledge_plugins.key_definitions.live_definitions import LiveDefinitions, Definition
+    from angr.knowledge_plugins.key_definitions.live_definitions import Definition
     from ailment.block import Block
 
 
@@ -44,11 +40,11 @@ class HasCallExprWalker(AILBlockWalkerBase):
         super().__init__()
         self.has_call_expr = False
 
-    def _handle_Call(self, stmt_idx: int, stmt: Call, block: Optional["Block"]):  # pylint:disable=unused-argument
+    def _handle_Call(self, stmt_idx: int, stmt: Call, block: Block | None):  # pylint:disable=unused-argument
         self.has_call_expr = True
 
     def _handle_CallExpr(  # pylint:disable=unused-argument
-        self, expr_idx: int, expr: Call, stmt_idx: int, stmt: Statement, block: Optional["Block"]
+        self, expr_idx: int, expr: Call, stmt_idx: int, stmt: Statement, block: Block | None
     ):
         self.has_call_expr = True
 
@@ -60,14 +56,13 @@ class BlockSimplifier(Analysis):
 
     def __init__(
         self,
-        block: Optional["Block"],
+        block: Block | None,
         func_addr: int | None = None,
         remove_dead_memdefs=False,
         stack_pointer_tracker=None,
         peephole_optimizations: None | (
             Iterable[type[PeepholeOptimizationStmtBase] | type[PeepholeOptimizationExprBase]]
         ) = None,
-        stack_arg_offsets: set[tuple[int, int]] | None = None,
         cached_reaching_definitions=None,
         cached_propagator=None,
     ):
@@ -80,7 +75,6 @@ class BlockSimplifier(Analysis):
         self.func_addr = func_addr
 
         self._remove_dead_memdefs = remove_dead_memdefs
-        self._stack_arg_offsets = stack_arg_offsets
         self._stack_pointer_tracker = stack_pointer_tracker
 
         if peephole_optimizations is None:
@@ -147,27 +141,21 @@ class BlockSimplifier(Analysis):
 
     def _compute_propagation(self, block):
         if self._propagator is None:
-            self._propagator = self.project.analyses[PropagatorAnalysis].prep()(
-                block=block,
+            self._propagator = self.project.analyses[SPropagatorAnalysis].prep()(
+                subject=block,
                 func_addr=self.func_addr,
                 stack_pointer_tracker=self._stack_pointer_tracker,
-                reaching_definitions=self._compute_reaching_definitions(block),
             )
         return self._propagator
 
-    def _compute_reaching_definitions(self, block):
-        def observe_callback(ob_type, addr=None, op_type=None, **kwargs) -> bool:  # pylint:disable=unused-argument
-            return ob_type == "node" and addr == block.addr and op_type == OP_AFTER
-
+    def _compute_reaching_definitions(self, block) -> SRDAModel:
         if self._reaching_definitions is None:
             self._reaching_definitions = (
-                self.project.analyses[ReachingDefinitionsAnalysis]
+                self.project.analyses[SReachingDefinitionsAnalysis]
                 .prep()(
                     subject=block,
                     track_tmps=True,
                     stack_pointer_tracker=self._stack_pointer_tracker,
-                    observe_all=False,
-                    observe_callback=observe_callback,
                     func_addr=self.func_addr,
                 )
                 .model
@@ -196,9 +184,8 @@ class BlockSimplifier(Analysis):
         if nonconstant_stmts >= 2 and has_propagatable_assignments:
             propagator = self._compute_propagation(block)
             new_block = block
-            if propagator.model.states:
-                prop_state = list(propagator.model.states.values())[0]
-                replacements = prop_state._replacements
+            if propagator.model is not None:
+                replacements = propagator.model.replacements
                 if replacements:
                     _, new_block = self._replace_and_build(block, replacements, replace_registers=True)
                     new_block = self._eliminate_self_assignments(new_block)
@@ -210,8 +197,7 @@ class BlockSimplifier(Analysis):
         if nonconstant_stmts >= 2 and has_propagatable_assignments:
             new_block = self._eliminate_dead_assignments(new_block)
 
-        new_block = self._peephole_optimize(new_block)
-        return new_block
+        return self._peephole_optimize(new_block)
 
     @staticmethod
     def _replace_and_build(
@@ -221,7 +207,7 @@ class BlockSimplifier(Analysis):
         replace_loads: bool = False,
         gp: int | None = None,
         replace_registers: bool = True,
-    ) -> tuple[bool, "Block"]:
+    ) -> tuple[bool, Block]:
         new_statements = block.statements[::]
         replaced = False
 
@@ -301,18 +287,16 @@ class BlockSimplifier(Analysis):
                     isinstance(stmt.dst, Register)
                     and isinstance(stmt.src, Convert)
                     and isinstance(stmt.src.operand, Register)
+                ) and (
+                    stmt.dst.size == stmt.src.size
+                    and stmt.dst.reg_offset == stmt.src.operand.reg_offset
+                    and not stmt.src.is_signed
                 ):
-                    if (
-                        stmt.dst.size == stmt.src.size
-                        and stmt.dst.reg_offset == stmt.src.operand.reg_offset
-                        and not stmt.src.is_signed
-                    ):
-                        # ignore statements like edi = convert(rdi, 32)
-                        continue
+                    # ignore statements like edi = convert(rdi, 32)
+                    continue
             new_statements.append(stmt)
 
-        new_block = block.copy(statements=new_statements)
-        return new_block
+        return block.copy(statements=new_statements)
 
     def _eliminate_dead_assignments(self, block):
         new_statements = []
@@ -320,76 +304,33 @@ class BlockSimplifier(Analysis):
             return block
 
         rd = self._compute_reaching_definitions(block)
-        live_defs: "LiveDefinitions" = rd.observed_results[("node", block.addr, OP_AFTER)]
+        block_loc = CodeLocation(block.addr, None, block_idx=block.idx)
 
         # Find dead assignments
         dead_defs_stmt_idx = set()
-        all_defs: Iterable["Definition"] = rd.all_definitions
-        mask = (1 << self.project.arch.bits) - 1
-        stackarg_offsets = (
-            {(tpl[1] & mask) for tpl in self._stack_arg_offsets} if self._stack_arg_offsets is not None else None
-        )
+        all_defs: Iterable[Definition] = rd.get_all_tmp_definitions(block_loc)
         for d in all_defs:
-            if isinstance(d.codeloc, ExternalCodeLocation) or d.dummy:
-                continue
-            if isinstance(d.atom, atoms.MemoryLocation):
-                if not self._remove_dead_memdefs:
-                    # we always remove definitions for stack arguments
-                    if stackarg_offsets is not None and isinstance(d.atom.addr, atoms.SpOffset):
-                        if (d.atom.addr.offset & mask) not in stackarg_offsets:
-                            continue
-                    else:
-                        continue
+            assert not isinstance(d.codeloc, ExternalCodeLocation)
+            assert not d.dummy
 
-            if isinstance(d.atom, atoms.Tmp):
-                uses = live_defs.tmp_uses[d.atom.tmp_idx]
-                if not uses:
-                    dead_defs_stmt_idx.add(d.codeloc.stmt_idx)
-            else:
-                uses = rd.all_uses.get_uses(d)
-                if not uses:
-                    # it's entirely possible that at the end of the block, a register definition is not used.
-                    # however, it might be used in future blocks.
-                    # so we only remove a definition if the definition is not alive anymore at the end of the block
-                    defs_ = set()
-                    if isinstance(d.atom, atoms.Register):
-                        try:
-                            vs: "MultiValues" = live_defs.registers.load(d.atom.reg_offset, size=d.atom.size)
-                        except SimMemoryMissingError:
-                            vs = None
-                    elif isinstance(d.atom, atoms.MemoryLocation) and isinstance(d.atom.addr, SpOffset):
-                        stack_addr = live_defs.stack_offset_to_stack_addr(d.atom.addr.offset)
-                        try:
-                            vs: "MultiValues" = live_defs.stack.load(
-                                stack_addr, size=d.atom.size, endness=d.atom.endness
-                            )
-                        except SimMemoryMissingError:
-                            vs = None
-                    else:
-                        continue
-                    if vs is not None:
-                        for values in vs.values():
-                            for value in values:
-                                defs_.update(live_defs.extract_defs(value))
-
-                    if d not in defs_:
-                        dead_defs_stmt_idx.add(d.codeloc.stmt_idx)
+            uses = rd.get_tmp_uses(d.atom, block_loc)
+            if not uses:
+                dead_defs_stmt_idx.add(d.codeloc.stmt_idx)
 
-        used_tmps = set()
+        used_tmps: set[int] = set()
         # micro optimization: if all statements that use a tmp are going to be removed, we remove this tmp as well
-        for tmp, used_locs in live_defs.tmp_uses.items():
-            used_at = {loc.stmt_idx for loc in used_locs}
+        for tmp, used_locs in rd.all_tmp_uses[block_loc].items():
+            used_at = {stmt_idx for _, stmt_idx in used_locs}
             if used_at.issubset(dead_defs_stmt_idx):
                 continue
-            used_tmps.add(tmp)
+            used_tmps.add(tmp.tmp_idx)
 
         # Remove dead assignments
         for idx, stmt in enumerate(block.statements):
             if type(stmt) is Assignment:
                 # tmps can't execute new code
-                if type(stmt.dst) is Tmp:
-                    if stmt.dst.tmp_idx not in used_tmps:
-                        continue
+                if type(stmt.dst) is Tmp and stmt.dst.tmp_idx not in used_tmps:
+                    continue
 
                 # is it a dead virgin?
                 if idx in dead_defs_stmt_idx:
@@ -404,8 +345,7 @@ class BlockSimplifier(Analysis):
 
             new_statements.append(stmt)
 
-        new_block = block.copy(statements=new_statements)
-        return new_block
+        return block.copy(statements=new_statements)
 
     #
     # Peephole optimization
@@ -418,17 +358,13 @@ class BlockSimplifier(Analysis):
         # run statement-level optimizations
         statements, stmts_updated = peephole_optimize_stmts(block, self._stmt_peephole_opts)
 
-        if stmts_updated:
-            new_block = block.copy(statements=statements)
-        else:
-            new_block = block
+        new_block = block.copy(statements=statements) if stmts_updated else block
 
         statements, multi_stmts_updated = peephole_optimize_multistmts(new_block, self._multistmt_peephole_opts)
 
         if not multi_stmts_updated:
             return new_block
-        new_block = new_block.copy(statements=statements)
-        return new_block
+        return new_block.copy(statements=statements)
 
 
 register_analysis(BlockSimplifier, "AILBlockSimplifier")