angr 9.2.116__py3-none-win_amd64.whl → 9.2.118__py3-none-win_amd64.whl

angr/procedures/libc/getdelim.py

@@ -1,7 +1,11 @@
-import angr
+from __future__ import annotations
+import logging
+
+import claripy
 from cle.backends.externs.simdata.io_file import io_file_data_for_arch
 
-import logging
+import angr
+
 
 l = logging.getLogger(name=__name__)
 
@@ -63,34 +67,33 @@ class __getdelim(angr.SimProcedure):
         # case 2: the data is symbolic, the delimiter could be anywhere. Read some maximum number of bytes
         # and add a constraint to assert the delimiter nonsense.
         # caveat: there could also be no delimiter and the file could EOF.
-        else:
-            # Just a guess as to a good value for a max size
-            size = 1024
-
-            data, real_size = simfd.read_data(size - 1)
-            delim_byte = chr(self.state.solver.eval(delim))
-
-            for i, byte in enumerate(data.chop(8)):
-                self.state.add_constraints(
-                    self.state.solver.If(
-                        i + 1 != real_size,
-                        byte != delim_byte,  # if not last byte returned, not newline
-                        self.state.solver.Or(  # otherwise one of the following must be true:
-                            i + 2 == size,  # - we ran out of space, or
-                            simfd.eof(),  # - the file is at EOF, or
-                            byte == delim_byte,  # - it is a newline
-                        ),
-                    )
+        # Just a guess as to a good value for a max size
+        size = 1024
+
+        data, real_size = simfd.read_data(size - 1)
+        delim_byte = chr(self.state.solver.eval(delim))
+
+        for i, byte in enumerate(data.chop(8)):
+            self.state.add_constraints(
+                claripy.If(
+                    i + 1 != real_size,
+                    byte != delim_byte,  # if not last byte returned, not newline
+                    claripy.Or(  # otherwise one of the following must be true:
+                        i + 2 == size,  # - we ran out of space, or
+                        simfd.eof(),  # - the file is at EOF, or
+                        byte == delim_byte,  # - it is a newline
+                    ),
                 )
+            )
 
-            malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
 
-            dst = self.inline_call(malloc, real_size).ret_expr
+        dst = self.inline_call(malloc, real_size).ret_expr
 
-            self.state.memory.store(dst, data, size=real_size)
-            self.state.memory.store(dst + real_size, b"\0")
+        self.state.memory.store(dst, data, size=real_size)
+        self.state.memory.store(dst + real_size, b"\0")
 
-            self.state.memory.store(len_ptr, real_size)
-            self.state.memory.store(line_ptrptr, dst)
+        self.state.memory.store(len_ptr, real_size)
+        self.state.memory.store(line_ptrptr, dst)
 
-            return real_size
+        return real_size

angr/procedures/libc/getegid.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/geteuid.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/getgid.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/gets.py

@@ -1,5 +1,8 @@
+from __future__ import annotations
 import logging
 
+import claripy
+
 import angr
 from angr.storage.memory_mixins.address_concretization_mixin import MultiwriteAnnotation
 from angr.misc.ux import once
@@ -43,24 +46,23 @@ class gets(angr.SimProcedure):
         # (SHORT_READS should take care of the variable length) and add a constraint to assert the
         # newline nonsense.
         # caveat: there could also be no newline and the file could EOF.
-        else:
-            data, real_size = simfd.read_data(max_size - 1)
+        data, real_size = simfd.read_data(max_size - 1)
 
-            for i, byte in enumerate(data.chop(8)):
-                self.state.add_constraints(
-                    self.state.solver.If(
-                        i + 1 != real_size,
-                        byte != b"\n",  # if not last byte returned, not newline
-                        self.state.solver.Or(  # otherwise one of the following must be true:
-                            i + 2 == max_size,  # - we ran out of space, or
-                            simfd.eof(),  # - the file is at EOF, or
-                            byte == b"\n",  # - it is a newline
-                        ),
-                    )
+        for i, byte in enumerate(data.chop(8)):
+            self.state.add_constraints(
+                claripy.If(
+                    i + 1 != real_size,
+                    byte != b"\n",  # if not last byte returned, not newline
+                    claripy.Or(  # otherwise one of the following must be true:
+                        i + 2 == max_size,  # - we ran out of space, or
+                        simfd.eof(),  # - the file is at EOF, or
+                        byte == b"\n",  # - it is a newline
+                    ),
                 )
-            self.state.memory.store(dst, data, size=real_size)
-            end_address = dst + real_size
-            end_address = end_address.annotate(MultiwriteAnnotation())
-            self.state.memory.store(end_address, b"\0")
+            )
+        self.state.memory.store(dst, data, size=real_size)
+        end_address = dst + real_size
+        end_address = end_address.annotate(MultiwriteAnnotation())
+        self.state.memory.store(end_address, b"\0")
 
-            return dst
+        return dst

angr/procedures/libc/getuid.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/malloc.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 import itertools
 

angr/procedures/libc/memcmp.py

@@ -1,6 +1,10 @@
-import angr
+from __future__ import annotations
 import logging
 
+import claripy
+
+import angr
+
 l = logging.getLogger(name=__name__)
 
 
@@ -13,10 +17,7 @@ class memcmp(angr.SimProcedure):
         definite_size = self.state.solver.min_int(n)
         conditional_s1_start = s1_addr + definite_size
         conditional_s2_start = s2_addr + definite_size
-        if self.state.solver.symbolic(n):
-            conditional_size = int(max(max_memcmp_size - definite_size, 0))
-        else:
-            conditional_size = 0
+        conditional_size = int(max(max_memcmp_size - definite_size, 0)) if self.state.solver.symbolic(n) else 0
 
         l.debug("Definite size %s and conditional size: %s", definite_size, conditional_size)
 
@@ -25,19 +26,19 @@ class memcmp(angr.SimProcedure):
             s1_part = self.state.memory.load(s1_addr, definite_size, endness="Iend_BE")
             s2_part = self.state.memory.load(s2_addr, definite_size, endness="Iend_BE")
             cases = [
-                [s1_part == s2_part, self.state.solver.BVV(0, int_bits)],
-                [self.state.solver.ULT(s1_part, s2_part), self.state.solver.BVV(-1, int_bits)],
-                [self.state.solver.UGT(s1_part, s2_part), self.state.solver.BVV(1, int_bits)],
+                [s1_part == s2_part, claripy.BVV(0, int_bits)],
+                [claripy.ULT(s1_part, s2_part), claripy.BVV(-1, int_bits)],
+                [claripy.UGT(s1_part, s2_part), claripy.BVV(1, int_bits)],
             ]
-            definite_answer = self.state.solver.ite_cases(cases, 2)
-            constraint = self.state.solver.Or(*[c for c, _ in cases])
+            definite_answer = claripy.ite_cases(cases, 2)
+            constraint = claripy.Or(*[c for c, _ in cases])
             self.state.add_constraints(constraint)
 
             l.debug("Created definite answer: %s", definite_answer)
             l.debug("Created constraint: %s", constraint)
             l.debug("... crom cases: %s", cases)
         else:
-            definite_answer = self.state.solver.BVV(0, int_bits)
+            definite_answer = claripy.BVV(0, int_bits)
 
         if not self.state.solver.symbolic(definite_answer) and self.state.solver.eval(definite_answer) != 0:
             return definite_answer
@@ -51,19 +52,18 @@ class memcmp(angr.SimProcedure):
                 s1_part = s1_all[conditional_size * 8 - 1 : bit - 8]
                 s2_part = s2_all[conditional_size * 8 - 1 : bit - 8]
                 cases = [
-                    [s1_part == s2_part, self.state.solver.BVV(0, int_bits)],
-                    [self.state.solver.ULT(s1_part, s2_part), self.state.solver.BVV(-1, int_bits)],
-                    [self.state.solver.UGT(s1_part, s2_part), self.state.solver.BVV(1, int_bits)],
+                    [s1_part == s2_part, claripy.BVV(0, int_bits)],
+                    [claripy.ULT(s1_part, s2_part), claripy.BVV(-1, int_bits)],
+                    [claripy.UGT(s1_part, s2_part), claripy.BVV(1, int_bits)],
                 ]
-                conditional_rets[byte + 1] = self.state.solver.ite_cases(cases, 0)
-                self.state.add_constraints(self.state.solver.Or(*[c for c, _ in cases]))
+                conditional_rets[byte + 1] = claripy.ite_cases(cases, 0)
+                self.state.add_constraints(claripy.Or(*[c for c, _ in cases]))
 
-            ret_expr = self.state.solver.If(
+            ret_expr = claripy.If(
                 definite_answer == 0,
-                self.state.solver.ite_dict(n - definite_size, conditional_rets, 2),
+                claripy.ite_dict(n - definite_size, conditional_rets, 2),
                 definite_answer,
             )
-            self.state.add_constraints(self.state.solver.Or(*[n - definite_size == c for c in conditional_rets]))
+            self.state.add_constraints(claripy.Or(*[n - definite_size == c for c in conditional_rets]))
             return ret_expr
-        else:
-            return definite_answer
+        return definite_answer

angr/procedures/libc/memcpy.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 import logging
 

angr/procedures/libc/memset.py

@@ -1,7 +1,10 @@
-import angr
-
+from __future__ import annotations
 import logging
 
+import claripy
+
+import angr
+
 l = logging.getLogger(name=__name__)
 
 
@@ -37,12 +40,12 @@ class memset(angr.SimProcedure):
 
     def run(self, dst_addr, char, num):
         if char.size() != self.state.arch.byte_width:  # sizeof(char)
-            char = self.state.solver.Extract(self.state.arch.byte_width - 1, 0, char)
+            char = claripy.Extract(self.state.arch.byte_width - 1, 0, char)
 
         if self.state.solver.symbolic(num):
             l.debug("symbolic length")
             max_size = self.state.solver.min_int(num) + self.state.libc.max_buffer_size
-            write_bytes = self.state.solver.Concat(*([char] * max_size))
+            write_bytes = claripy.Concat(*([char] * max_size))
             self.state.memory.store(dst_addr, write_bytes, size=num)
         else:
             max_size = self.state.solver.eval(num)
@@ -54,14 +57,14 @@ class memset(angr.SimProcedure):
 
                 if self.state.solver.symbolic(char):
                     l.debug("symbolic char")
-                    write_bytes = self.state.solver.Concat(*([char] * chunksize))
+                    write_bytes = claripy.Concat(*([char] * chunksize))
                 else:
                     # Concatenating many bytes is slow, so some sort of optimization is required
                     if char.concrete_value == 0:
-                        write_bytes = self.state.solver.BVV(0, chunksize * 8)
+                        write_bytes = claripy.BVV(0, chunksize * 8)
                     else:
                         rb = memset._repeat_bytes(char.concrete_value, chunksize)
-                        write_bytes = self.state.solver.BVV(rb, chunksize * 8)
+                        write_bytes = claripy.BVV(rb, chunksize * 8)
 
                 self.state.memory.store(dst_addr + offset, write_bytes)
                 offset += chunksize

angr/procedures/libc/openlog.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/perror.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/printf.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 
 from angr.procedures.stubs.format_parser import FormatParser

angr/procedures/libc/putchar.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/puts.py

@@ -1,3 +1,6 @@
+from __future__ import annotations
+import claripy
+
 import angr
 
 
@@ -12,5 +15,5 @@ class puts(angr.SimProcedure):
         strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
         length = self.inline_call(strlen, string).ret_expr
         out = stdout.write(string, length)
-        stdout.write_data(self.state.solver.BVV(b"\n"))
+        stdout.write_data(claripy.BVV(b"\n"))
         return (out + 1)[31:0]

angr/procedures/libc/rand.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/realloc.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/rewind.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 
@@ -8,4 +9,4 @@ class rewind(angr.SimProcedure):
         fseek = angr.SIM_PROCEDURES["libc"]["fseek"]
         self.inline_call(fseek, file_ptr, 0, 0)
 
-        return None
+        return

angr/procedures/libc/scanf.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 
 from angr.procedures.stubs.format_parser import ScanfFormatParser
@@ -16,5 +17,4 @@ class scanf(ScanfFormatParser):
         if simfd is None:
             return -1
 
-        items = fmt_str.interpret(self.va_arg, simfd=simfd)
-        return items
+        return fmt_str.interpret(self.va_arg, simfd=simfd)

angr/procedures/libc/setbuf.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/setvbuf.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/snprintf.py

@@ -1,5 +1,8 @@
+from __future__ import annotations
 import logging
 
+import claripy
+
 from angr.procedures.stubs.format_parser import FormatParser
 
 l = logging.getLogger(name=__name__)
@@ -15,7 +18,7 @@ class snprintf(FormatParser):
         self.state.memory.store(dst_ptr, out_str)
 
         # place the terminating null byte
-        self.state.memory.store(dst_ptr + (out_str.size() // self.arch.byte_width), self.state.solver.BVV(0, 8))
+        self.state.memory.store(dst_ptr + (out_str.size() // self.arch.byte_width), claripy.BVV(0, 8))
 
         return out_str.size() // self.arch.byte_width
 
@@ -28,6 +31,6 @@ class __snprintf_chk(FormatParser):
         self.state.memory.store(dst_ptr, out_str)
 
         # place the terminating null byte
-        self.state.memory.store(dst_ptr + (out_str.size() // self.arch.byte_width), self.state.solver.BVV(0, 8))
+        self.state.memory.store(dst_ptr + (out_str.size() // self.arch.byte_width), claripy.BVV(0, 8))
 
         return out_str.size() // self.arch.byte_width

angr/procedures/libc/sprintf.py

@@ -1,5 +1,8 @@
+from __future__ import annotations
 import logging
 
+import claripy
+
 from angr.procedures.stubs.format_parser import FormatParser
 
 l = logging.getLogger(name=__name__)
@@ -16,7 +19,7 @@ class sprintf(FormatParser):
 
         # place the terminating null byte
         self.state.memory.store(
-            dst_ptr + (out_str.size() // self.arch.byte_width), self.state.solver.BVV(0, self.arch.byte_width)
+            dst_ptr + (out_str.size() // self.arch.byte_width), claripy.BVV(0, self.arch.byte_width)
         )
 
         return out_str.size() // self.arch.byte_width

angr/procedures/libc/srand.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/sscanf.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 
 from angr.procedures.stubs.format_parser import ScanfFormatParser
@@ -9,5 +10,4 @@ class sscanf(ScanfFormatParser):
     # pylint:disable=arguments-differ,unused-argument
     def run(self, data, fmt):
         fmt_str = self._parse(fmt)
-        items = fmt_str.interpret(self.va_arg, addr=data)
-        return items
+        return fmt_str.interpret(self.va_arg, addr=data)

angr/procedures/libc/stpcpy.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 
@@ -11,8 +12,7 @@ class stpcpy(angr.SimProcedure):
         strncpy = angr.SIM_PROCEDURES["libc"]["strncpy"]
         src_len = self.inline_call(strlen, src)
 
-        ret_expr = (
+        return (
             self.inline_call(strncpy, dst, src, src_len.ret_expr + 1, src_len=src_len.ret_expr).ret_expr
             + src_len.ret_expr
         )
-        return ret_expr

angr/procedures/libc/strcat.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 

angr/procedures/libc/strchr.py

@@ -1,8 +1,12 @@
+from __future__ import annotations
+import logging
+
+import claripy
+
 import angr
 from angr.storage.memory_mixins.address_concretization_mixin import MultiwriteAnnotation
 from angr.sim_options import MEMORY_CHUNK_INDIVIDUAL_READS
 
-import logging
 
 l = logging.getLogger(name=__name__)
 
@@ -36,9 +40,9 @@ class strchr(angr.SimProcedure):
         # ensure that the string length is long enough to include
         # the character!
         chrpos = a - s_addr
-        self.state.add_constraints(self.state.solver.If(a != 0, chrpos <= s_strlen.ret_expr, True))
+        self.state.add_constraints(claripy.If(a != 0, chrpos <= s_strlen.ret_expr, True))
 
         return a
-        # self.state.add_constraints(self.state.solver.ULT(a - s_addr, s_strlen.ret_expr))
+        # self.state.add_constraints(claripy.ULT(a - s_addr, s_strlen.ret_expr))
         # self.max_chr_index = max(i)
         # return a

angr/procedures/libc/strcmp.py

@@ -1,7 +1,10 @@
-import angr
-
+from __future__ import annotations
 import logging
 
+import claripy
+
+import angr
+
 l = logging.getLogger(name=__name__)
 
 
@@ -13,7 +16,7 @@ class strcmp(angr.SimProcedure):
 
         a_strlen = self.inline_call(strlen, a_addr, wchar=wchar)
         b_strlen = self.inline_call(strlen, b_addr, wchar=wchar)
-        maxlen = self.state.solver.BVV(max(a_strlen.max_null_index, b_strlen.max_null_index), self.state.arch.bits)
+        maxlen = claripy.BVV(max(a_strlen.max_null_index, b_strlen.max_null_index), self.state.arch.bits)
 
         strncmp = self.inline_call(
             angr.SIM_PROCEDURES["libc"]["strncmp"],

angr/procedures/libc/strcpy.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 
 
@@ -9,5 +10,4 @@ class strcpy(angr.SimProcedure):
         strncpy = angr.SIM_PROCEDURES["libc"]["strncpy"]
         src_len = self.inline_call(strlen, src)
 
-        ret_expr = self.inline_call(strncpy, dst, src, src_len.ret_expr + 1, src_len=src_len.ret_expr).ret_expr
-        return ret_expr
+        return self.inline_call(strncpy, dst, src, src_len.ret_expr + 1, src_len=src_len.ret_expr).ret_expr

angr/procedures/libc/strlen.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 
 import claripy
@@ -16,10 +17,10 @@ class strlen(angr.SimProcedure):
 
     def run(self, s, wchar=False, maxlen=None):
         if wchar:
-            null_seq = self.state.solver.BVV(0, 16)
+            null_seq = claripy.BVV(0, 16)
             char_size = 2
         else:
-            null_seq = self.state.solver.BVV(0, 8)
+            null_seq = claripy.BVV(0, 8)
             char_size = 1
 
         max_symbolic_bytes = self.state.libc.buf_symbolic_bytes
@@ -38,7 +39,7 @@ class strlen(angr.SimProcedure):
             addr_desc: AbstractAddressDescriptor = self.state.memory._normalize_address(s)
 
             # size_t
-            length = self.state.solver.ESI(self.arch.bits)
+            length = claripy.ESI(self.arch.bits)
             for s_aw in self.state.memory._concretize_address_descriptor(addr_desc, None):
                 s_ptr = s_aw.to_valueset(self.state)
                 r, c, i = self.state.memory.find(
@@ -50,12 +51,16 @@ class strlen(angr.SimProcedure):
                     char_size=char_size,
                 )
 
-                self.max_null_index = max([self.max_null_index] + i)
+                self.max_null_index = max([self.max_null_index, *i])
 
                 # Convert r to the same region as s
                 r_desc = self.state.memory._normalize_address(r)
                 r_aw_iter = self.state.memory._concretize_address_descriptor(
-                    r_desc, None, target_region=next(iter(claripy.backends.vsa.convert(s_ptr).regions.keys()))
+                    r_desc,
+                    None,
+                    target_region=next(
+                        iter(s_ptr.get_annotations_by_type(claripy.annotation.RegionAnnotation))
+                    ).region_id,
                 )
 
                 for r_aw in r_aw_iter:
@@ -64,39 +69,38 @@ class strlen(angr.SimProcedure):
 
             return length
 
-        else:
-            search_len = max_str_len
+        search_len = max_str_len
+        r, c, i = self.state.memory.find(
+            s,
+            null_seq,
+            search_len,
+            max_symbolic_bytes=max_symbolic_bytes,
+            chunk_size=chunk_size,
+            char_size=char_size,
+        )
+
+        # try doubling the search len and searching again
+        s_new = s
+        while c and all(con.is_false() for con in c):
+            s_new += search_len
+            search_len *= 2
             r, c, i = self.state.memory.find(
-                s,
+                s_new,
                 null_seq,
                 search_len,
                 max_symbolic_bytes=max_symbolic_bytes,
                 chunk_size=chunk_size,
                 char_size=char_size,
             )
-
-            # try doubling the search len and searching again
-            s_new = s
-            while c and all(con.is_false() for con in c):
-                s_new += search_len
-                search_len *= 2
-                r, c, i = self.state.memory.find(
-                    s_new,
-                    null_seq,
-                    search_len,
-                    max_symbolic_bytes=max_symbolic_bytes,
-                    chunk_size=chunk_size,
-                    char_size=char_size,
-                )
-                # stop searching after some reasonable limit
-                if search_len > 0x10000:
-                    raise angr.SimMemoryLimitError("strlen hit limit of 0x10000")
-
-            self.max_null_index = max(i)
-            self.state.add_constraints(*c)
-            result = r - s
-            if result.depth > 3:
-                rresult = self.state.solver.BVS("strlen", len(result), key=("api", "strlen"))
-                self.state.add_constraints(result == rresult)
-                result = rresult
-            return result
+            # stop searching after some reasonable limit
+            if search_len > 0x10000:
+                raise angr.SimMemoryLimitError("strlen hit limit of 0x10000")
+
+        self.max_null_index = max(i)
+        self.state.add_constraints(*c)
+        result = r - s
+        if result.depth > 3:
+            rresult = self.state.solver.BVS("strlen", len(result), key=("api", "strlen"))
+            self.state.add_constraints(result == rresult)
+            result = rresult
+        return result

angr/procedures/libc/strncat.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import angr
 import logging