angr 9.2.116__py3-none-win_amd64.whl → 9.2.118__py3-none-win_amd64.whl

angr/sim_variable.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import collections.abc
 from typing import TYPE_CHECKING
 
@@ -35,13 +36,13 @@ class SimVariable(Serializable):
         self.size = size
 
     def copy(self):
-        raise NotImplementedError()
+        raise NotImplementedError
 
-    def loc_repr(self, arch: "archinfo.Arch"):
+    def loc_repr(self, arch: archinfo.Arch):
         """
         The representation that shows up in a GUI
         """
-        raise NotImplementedError()
+        raise NotImplementedError
 
     def _set_base(self, obj):
         obj.base.ident = self.ident
@@ -92,9 +93,7 @@ class SimConstantVariable(SimVariable):
         self._hash = None
 
     def __repr__(self):
-        s = f"<{self.region}|const {self.value}>"
-
-        return s
+        return f"<{self.region}|const {self.value}>"
 
     def loc_repr(self, arch):
         return f"const {self.value}"
@@ -114,7 +113,7 @@ class SimConstantVariable(SimVariable):
             self._hash = hash(("const", self.value, self.ident, self.region, self.ident))
         return self._hash
 
-    def copy(self) -> "SimConstantVariable":
+    def copy(self) -> SimConstantVariable:
         r = SimConstantVariable(ident=self.ident, value=self.value, region=self.region, size=self.size)
         r._hash = self._hash
         return r
@@ -130,8 +129,7 @@ class SimTemporaryVariable(SimVariable):
         self._hash = None
 
     def __repr__(self):
-        s = "<tmp %d>" % (self.tmp_id,)
-        return s
+        return "<tmp %d>" % (self.tmp_id,)
 
     def loc_repr(self, arch):
         return f"tmp #{self.tmp_id}"
@@ -147,7 +145,7 @@ class SimTemporaryVariable(SimVariable):
 
         return False
 
-    def copy(self) -> "SimTemporaryVariable":
+    def copy(self) -> SimTemporaryVariable:
         r = SimTemporaryVariable(self.tmp_id, size=self.size)
         r._hash = self._hash
         return r
@@ -183,12 +181,10 @@ class SimRegisterVariable(SimVariable):
         return self.size * 8
 
     def __repr__(self):
-        ident_str = "[%s]" % self.ident if self.ident else ""
+        ident_str = f"[{self.ident}]" if self.ident else ""
         region_str = hex(self.region) if isinstance(self.region, int) else self.region
 
-        s = f"<{region_str}{ident_str}|Reg {self.reg}, {self.size}B>"
-
-        return s
+        return f"<{region_str}{ident_str}|Reg {self.reg}, {self.size}B>"
 
     def loc_repr(self, arch):
         return arch.translate_register_name(self.reg, self.size)
@@ -209,7 +205,7 @@ class SimRegisterVariable(SimVariable):
 
         return False
 
-    def copy(self) -> "SimRegisterVariable":
+    def copy(self) -> SimRegisterVariable:
         s = SimRegisterVariable(
             self.reg, self.size, ident=self.ident, name=self.name, region=self.region, category=self.category
         )
@@ -253,10 +249,7 @@ class SimMemoryVariable(SimVariable):
         self._hash = None
 
     def __repr__(self):
-        if type(self.size) is int:
-            size = "%d" % self.size
-        else:
-            size = "%s" % self.size
+        size = "%d" % self.size if type(self.size) is int else f"{self.size}"
 
         if type(self.addr) is int:
             s = f"<{self.name}: {self.region}-Mem {self.addr:#x} {size}>"
@@ -285,7 +278,7 @@ class SimMemoryVariable(SimVariable):
     def bits(self):
         return self.size * 8
 
-    def copy(self) -> "SimMemoryVariable":
+    def copy(self) -> SimMemoryVariable:
         r = SimMemoryVariable(
             self.addr, self.size, ident=self.ident, name=self.name, region=self.region, category=self.category
         )
@@ -327,11 +320,7 @@ class SimStackVariable(SimMemoryVariable):
             mask = (1 << offset.bit_length()) - 1
             offset = -((0 - offset) & mask)
 
-        if base_addr is not None:
-            addr = offset + base_addr
-        else:
-            # TODO: this is not optimal
-            addr = offset
+        addr = offset + base_addr if base_addr is not None else offset  # TODO: this is not optimal
 
         super().__init__(addr, size, ident=ident, name=name, region=region, category=category)
 
@@ -340,20 +329,17 @@ class SimStackVariable(SimMemoryVariable):
         self.base_addr = base_addr
 
     def __repr__(self):
-        if type(self.size) is int:
-            size = "%d" % self.size
-        else:
-            size = "%s" % self.size
+        size = "%d" % self.size if type(self.size) is int else f"{self.size}"
 
-        prefix = "%s(stack)" % self.name if self.name is not None else "Stack"
-        ident = "[%s]" % self.ident if self.ident else ""
+        prefix = f"{self.name}(stack)" if self.name is not None else "Stack"
+        ident = f"[{self.ident}]" if self.ident else ""
         region_str = hex(self.region) if isinstance(self.region, int) else self.region
 
         if type(self.offset) is int:
             if self.offset < 0:
-                offset = "%#x" % self.offset
+                offset = f"{self.offset:#x}"
             elif self.offset > 0:
-                offset = "+%#x" % self.offset
+                offset = f"+{self.offset:#x}"
             else:
                 offset = ""
 
@@ -380,7 +366,7 @@ class SimStackVariable(SimMemoryVariable):
     def __hash__(self):
         return hash((self.ident, self.base, self.offset, self.size))
 
-    def copy(self) -> "SimStackVariable":
+    def copy(self) -> SimStackVariable:
         s = SimStackVariable(
             self.offset,
             self.size,
@@ -538,10 +524,9 @@ class SimVariableSet(collections.abc.MutableSet):
         if type(item) is SimRegisterVariable:
             return self.contains_register_variable(item)
 
-        elif type(item) is SimMemoryVariable:
+        if type(item) is SimMemoryVariable:
             # TODO: Make it better!
             return self.contains_memory_variable(item)
 
-        else:
-            __import__("ipdb").set_trace()
-            raise Exception("WTF is this variable?")
+        __import__("ipdb").set_trace()
+        raise Exception("WTF is this variable?")

angr/simos/__init__.py

@@ -2,6 +2,8 @@
 Manage OS-level configuration.
 """
 
+from __future__ import annotations
+
 from collections import defaultdict
 from elftools.elf.descriptions import _DESCR_EI_OSABI
 
@@ -21,7 +23,7 @@ def register_simos(name, cls):
 
 
 # Pulling in all EI_OSABI options supported by elftools
-for k, v in _DESCR_EI_OSABI.items():
+for _k, v in _DESCR_EI_OSABI.items():
     register_simos(v, SimLinux)
 
 register_simos("linux", SimLinux)

angr/simos/cgc.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 
 import claripy
@@ -51,11 +52,11 @@ class SimCGC(SimUserland):
         if flag_page is None:
             flag_page = [s.solver.BVS("cgc-flag-byte-%d" % i, 8, key=("flag", i), eternal=True) for i in range(0x1000)]
         elif type(flag_page) is bytes:
-            flag_page = [s.solver.BVV(c, 8) for c in flag_page]
+            flag_page = [claripy.BVV(c, 8) for c in flag_page]
         elif type(flag_page) is list:
             pass
         else:
-            raise ValueError("Bad flag page: expected None, bytestring, or list, but got %s" % type(flag_page))
+            raise ValueError(f"Bad flag page: expected None, bytestring, or list, but got {type(flag_page)}")
 
         s.cgc.flag_bytes = flag_page
         if s.mode != "static":
@@ -93,7 +94,7 @@ class SimCGC(SimUserland):
             for size in writes_backer:
                 if size == 0:
                     continue
-                str_to_write = state.solver.BVS("file_write", size * 8)
+                str_to_write = claripy.BVS("file_write", size * 8)
                 a = SimActionData(
                     state, "file_1_0", "write", addr=claripy.BVV(pos, state.arch.bits), data=str_to_write, size=size
                 )

angr/simos/javavm.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 
 from angr import SIM_PROCEDURES, options
@@ -107,7 +108,6 @@ class SimJavaVM(SimOS):
             kwargs["os_name"] = self.name
         # enable support for string analysis
         add_options = kwargs.get("add_options", set())
-        add_options.add(options.STRINGS_ANALYSIS)
         add_options.add(options.COMPOSITE_SOLVER)
         kwargs["add_options"] = add_options
 
@@ -227,62 +227,61 @@ class SimJavaVM(SimOS):
             cc.setup_callsite(state, ret_addr, args, kwargs.pop("prototype", None))
             return state
 
-        else:
-            # NATIVE CALLSITE
-
-            # setup native return type
-            # TODO roll this into protytype
-            ret_type = kwargs.pop("ret_type")
-            native_ret_type = self.get_native_type(ret_type)
-
-            # setup function prototype, so the SimCC know how to init the callsite
-            prototype = kwargs.pop("prototype", None)
-            if prototype is None:
-                arg_types = [self.get_native_type(arg.type) for arg in args]
-                prototype = SimTypeFunction(args=arg_types, returnty=native_ret_type)
-            native_cc = kwargs.pop("cc", None)
-            if native_cc is None:
-                native_cc = self.get_native_cc()
-
-            # setup native argument values
-            native_arg_values = []
-            for arg, arg_ty in zip(args, prototype.args):
-                if arg.type in ArchSoot.primitive_types or arg.type == "JNIEnv":
-                    # the value of primitive types and the JNIEnv pointer
-                    # are just getting copied into the native memory
-                    native_arg_value = arg.value
-                    if self.arch.bits == 32 and arg.type == "long":
-                        # On 32 bit architecture, long values (w/ 64 bit) are copied
-                        # as two 32 bit integer
-                        # TODO I _think_ all this logic can go away as long as the cc knows how to store large values
-                        # TODO this has been mostly implemented 11 Dec 2021
-                        # unfortunately no test cases hit this branch so I don't wanna touch it :(
-                        upper = native_arg_value.get_bytes(0, 4)
-                        lower = native_arg_value.get_bytes(4, 4)
-                        idx = args.index(arg)
-                        args = args[:idx] + (SootArgument(upper, "int"), SootArgument(lower, "int")) + args[idx + 1 :]
-                        native_arg_values += [upper, lower]
-                        continue
-                    if type(arg.value) is BV and len(arg.value) > arg_ty.size:
-                        # hack??? all small primitives are passed around as 32bit but cc won't like that
-                        native_arg_value = native_arg_value[arg_ty.size - 1 : 0]
-                else:
-                    # argument has a relative type
-                    # => map Java reference to an opaque reference, which the native code
-                    #    can use to access the Java object through the JNI interface
-                    native_arg_value = state.jni_references.create_new_reference(obj=arg.value)
-                native_arg_values += [native_arg_value]
-
-            # setup native invoke state
-            return self.native_simos.state_call(
-                addr,
-                *native_arg_values,
-                base_state=state,
-                ret_addr=self.native_return_hook_addr,
-                cc=native_cc,
-                prototype=prototype,
-                **kwargs,
-            )
+        # NATIVE CALLSITE
+
+        # setup native return type
+        # TODO roll this into protytype
+        ret_type = kwargs.pop("ret_type")
+        native_ret_type = self.get_native_type(ret_type)
+
+        # setup function prototype, so the SimCC know how to init the callsite
+        prototype = kwargs.pop("prototype", None)
+        if prototype is None:
+            arg_types = [self.get_native_type(arg.type) for arg in args]
+            prototype = SimTypeFunction(args=arg_types, returnty=native_ret_type)
+        native_cc = kwargs.pop("cc", None)
+        if native_cc is None:
+            native_cc = self.get_native_cc()
+
+        # setup native argument values
+        native_arg_values = []
+        for arg, arg_ty in zip(args, prototype.args):
+            if arg.type in ArchSoot.primitive_types or arg.type == "JNIEnv":
+                # the value of primitive types and the JNIEnv pointer
+                # are just getting copied into the native memory
+                native_arg_value = arg.value
+                if self.arch.bits == 32 and arg.type == "long":
+                    # On 32 bit architecture, long values (w/ 64 bit) are copied
+                    # as two 32 bit integer
+                    # TODO I _think_ all this logic can go away as long as the cc knows how to store large values
+                    # TODO this has been mostly implemented 11 Dec 2021
+                    # unfortunately no test cases hit this branch so I don't wanna touch it :(
+                    upper = native_arg_value.get_bytes(0, 4)
+                    lower = native_arg_value.get_bytes(4, 4)
+                    idx = args.index(arg)
+                    args = args[:idx] + (SootArgument(upper, "int"), SootArgument(lower, "int")) + args[idx + 1 :]
+                    native_arg_values += [upper, lower]
+                    continue
+                if type(arg.value) is BV and len(arg.value) > arg_ty.size:
+                    # hack??? all small primitives are passed around as 32bit but cc won't like that
+                    native_arg_value = native_arg_value[arg_ty.size - 1 : 0]
+            else:
+                # argument has a relative type
+                # => map Java reference to an opaque reference, which the native code
+                #    can use to access the Java object through the JNI interface
+                native_arg_value = state.jni_references.create_new_reference(obj=arg.value)
+            native_arg_values += [native_arg_value]
+
+        # setup native invoke state
+        return self.native_simos.state_call(
+            addr,
+            *native_arg_values,
+            base_state=state,
+            ret_addr=self.native_return_hook_addr,
+            cc=native_cc,
+            prototype=prototype,
+            **kwargs,
+        )
 
     #
     # MISC
@@ -317,19 +316,18 @@ class SimJavaVM(SimOS):
         if type_.endswith("[][]"):
             raise NotImplementedError
         if type_.endswith("[]"):
-            array = SimSootExpr_NewArray.new_array(state, type_[:-2], BVV(2, 32))
-            return array
+            return SimSootExpr_NewArray.new_array(state, type_[:-2], BVV(2, 32))
         return SimSootValue_ThisRef.new_object(state, type_, symbolic=True, init_object=False)
 
     @staticmethod
     def _get_default_concrete_value_by_type(type_, state=None):  # pylint: disable=unused-argument
         if type_ in ["byte", "char", "short", "int", "boolean"]:
             return BVV(0, 32)
-        elif type_ == "long":
+        if type_ == "long":
             return BVV(0, 64)
-        elif type_ == "float":
+        if type_ == "float":
             return FPV(0, FSORT_FLOAT)
-        elif type_ == "double":
+        if type_ == "double":
             return FPV(0, FSORT_DOUBLE)
         # not a primitive type
         # => treat it as a reference
@@ -338,7 +336,7 @@ class SimJavaVM(SimOS):
     @staticmethod
     def cast_primitive(state, value, to_type):
         """
-        Cast the value of primtive types.
+        Cast the value of primitive types.
 
         :param value:       Bitvector storing the primitive value.
         :param to_type:     Name of the targeted type.
@@ -352,29 +350,28 @@ class SimJavaVM(SimOS):
             sort = FSORT_FLOAT if to_type == "float" else FSORT_DOUBLE
             return FPV(value, sort)
 
-        elif to_type == "int" and isinstance(value, FP):
+        if to_type == "int" and isinstance(value, FP):
             # TODO fix fpToIEEEBV in claripty
             l.warning("Converting FP to BV might provide incorrect results.")
             return fpToIEEEBV(value)[63:32]
 
-        elif to_type == "long" and isinstance(value, FP):
+        if to_type == "long" and isinstance(value, FP):
             # TODO fix fpToIEEEBV in claripty
             l.warning("Converting FP to BV might provide incorrect results.")
             return fpToIEEEBV(value)
 
-        else:
-            # lookup the type size and extract value
-            value_size = ArchSoot.sizeof[to_type]
-            value_extracted = value.reversed.get_bytes(index=0, size=value_size // 8).reversed
-
-            # determine size of Soot bitvector and resize bitvector
-            # Note: smaller types than int's are stored in a 32-bit BV
-            value_soot_size = value_size if value_size >= 32 else 32
-            if to_type in ["char", "boolean"]:
-                # unsigned extend
-                return value_extracted.zero_extend(value_soot_size - value_extracted.size())
-            # signed extend
-            return value_extracted.sign_extend(value_soot_size - value_extracted.size())
+        # lookup the type size and extract value
+        value_size = ArchSoot.sizeof[to_type]
+        value_extracted = value.reversed.get_bytes(index=0, size=value_size // 8).reversed
+
+        # determine size of Soot bitvector and resize bitvector
+        # Note: smaller types than int's are stored in a 32-bit BV
+        value_soot_size = max(value_size, 32)
+        if to_type in ["char", "boolean"]:
+            # unsigned extend
+            return value_extracted.zero_extend(value_soot_size - value_extracted.size())
+        # signed extend
+        return value_extracted.sign_extend(value_soot_size - value_extracted.size())
 
     @staticmethod
     def init_static_field(state, field_class_name, field_name, field_type):
@@ -434,11 +431,8 @@ class SimJavaVM(SimOS):
 
         :return: A SymTypeReg with the JNI size of the given type.
         """
-        if java_type in ArchSoot.sizeof.keys():
-            jni_type_size = ArchSoot.sizeof[java_type]
-        else:
-            # if it's not a primitive type, we treat it as a reference
-            jni_type_size = self.native_simos.arch.bits
+        # if it's not a primitive type, we treat it as a reference
+        jni_type_size = ArchSoot.sizeof.get(java_type, self.native_simos.arch.bits)
         return SimTypeNum(size=jni_type_size)
 
     def get_method_native_type(self, method):

angr/simos/linux.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import os
 import logging
 import struct
@@ -94,11 +95,10 @@ class SimLinux(SimUserland):
 
             # TODO: what the hell is this
             _rtld_global_ro = self.project.loader.find_symbol("_rtld_global_ro")
-            if _rtld_global_ro is not None:
-                if isinstance(self.project.arch, ArchAMD64):
-                    self.project.loader.memory.pack_word(
-                        _rtld_global_ro.rebased_addr + 0x0D0, 2
-                    )  # cpu features: kind = amd
+            if _rtld_global_ro is not None and isinstance(self.project.arch, ArchAMD64):
+                self.project.loader.memory.pack_word(
+                    _rtld_global_ro.rebased_addr + 0x0D0, 2
+                )  # cpu features: kind = amd
 
             try:
                 tls_obj = self.project.loader.tls.new_thread()
@@ -150,37 +150,39 @@ class SimLinux(SimUserland):
 
         super().configure_project(syscall_abis)
 
-        if not self._is_core:
-            # Only set up ifunc resolution if we are using the ELF backend on AMD64
-            if isinstance(self.project.loader.main_object, MetaELF):
-                if isinstance(self.project.arch, (ArchAMD64, ArchX86)):
-                    for binary in self.project.loader.all_objects:
-                        if not isinstance(binary, MetaELF):
+        # Only set up ifunc resolution if we are using the ELF backend on AMD64
+        if (
+            not self._is_core
+            and isinstance(self.project.loader.main_object, MetaELF)
+            and isinstance(self.project.arch, (ArchAMD64, ArchX86))
+        ):
+            for binary in self.project.loader.all_objects:
+                if not isinstance(binary, MetaELF):
+                    continue
+                for reloc in binary.relocs:
+                    if reloc.symbol is None or reloc.resolvedby is None:
+                        continue
+                    try:
+                        if reloc.resolvedby.subtype != ELFSymbolType.STT_GNU_IFUNC:
                             continue
-                        for reloc in binary.relocs:
-                            if reloc.symbol is None or reloc.resolvedby is None:
-                                continue
-                            try:
-                                if reloc.resolvedby.subtype != ELFSymbolType.STT_GNU_IFUNC:
-                                    continue
-                            except ValueError:  # base class Symbol throws this, meaning we don't have an ELFSymbol, etc
-                                continue
-                            gotaddr = reloc.rebased_addr
-                            gotvalue = self.project.loader.memory.unpack_word(gotaddr)
-                            if self.project.is_hooked(gotvalue):
-                                continue
-                            if self.project._eager_ifunc_resolution:
-                                # Resolve it!
-                                resolver = self.project.factory.callable(gotvalue, "void *x()", concrete_only=True)
-                                result = resolver().concrete_value
-                                self.project.loader.memory.pack_word(gotaddr, result)
-                            else:
-                                # Replace it with an ifunc-resolve simprocedure!
-                                proc = P["linux_loader"]["IFuncResolver"](
-                                    display_name="IFuncResolver." + reloc.symbol.name,
-                                    funcaddr=gotvalue,
-                                )
-                                self.project.hook(gotvalue, proc, replace=True)
+                    except ValueError:  # base class Symbol throws this, meaning we don't have an ELFSymbol, etc
+                        continue
+                    gotaddr = reloc.rebased_addr
+                    gotvalue = self.project.loader.memory.unpack_word(gotaddr)
+                    if self.project.is_hooked(gotvalue):
+                        continue
+                    if self.project._eager_ifunc_resolution:
+                        # Resolve it!
+                        resolver = self.project.factory.callable(gotvalue, "void *x()", concrete_only=True)
+                        result = resolver().concrete_value
+                        self.project.loader.memory.pack_word(gotaddr, result)
+                    else:
+                        # Replace it with an ifunc-resolve simprocedure!
+                        proc = P["linux_loader"]["IFuncResolver"](
+                            display_name="IFuncResolver." + reloc.symbol.name,
+                            funcaddr=gotvalue,
+                        )
+                        self.project.hook(gotvalue, proc, replace=True)
 
     def syscall_abi(self, state):
         if state.arch.name != "AMD64":
@@ -191,10 +193,9 @@ class SimLinux(SimUserland):
             jk = state.history.parent.jumpkind
         if jk == "Ijk_Sys_int128":
             return "i386"
-        elif jk == "Ijk_Sys_syscall":
+        if jk == "Ijk_Sys_syscall":
             return "amd64"
-        else:
-            raise AngrSyscallError("Unknown syscall jumpkind %s" % jk)
+        raise AngrSyscallError(f"Unknown syscall jumpkind {jk}")
 
     # pylint: disable=arguments-differ
     def state_blank(
@@ -240,26 +241,20 @@ class SimLinux(SimUserland):
             if isinstance(fs[name], claripy.Bits):
                 fs[name] = SimFile(name, content=fs[name])
             if not isinstance(fs[name], SimFileBase):
-                raise TypeError("Provided fs initializer with unusable type %r" % type(fs[name]))
+                raise TypeError(f"Provided fs initializer with unusable type {type(fs[name])!r}")
 
         mounts = {}
         if concrete_fs:
             if fs:
                 raise TypeError("Providing both fs and concrete_fs doesn't make sense")
-            if chroot is not None:
-                chroot = os.path.abspath(chroot)
-            else:
-                chroot = os.path.sep
+            chroot = os.path.abspath(chroot) if chroot is not None else os.path.sep
             mounts[pathsep] = SimHostFilesystem(chroot)
             if cwd is None:
                 cwd = os.getcwd()
 
                 if chroot != os.path.sep:
                     # try to translate the cwd into the chroot
-                    if cwd.startswith(chroot):
-                        cwd = cwd[len(chroot) :]
-                    else:
-                        cwd = os.path.sep
+                    cwd = cwd[len(chroot) :] if cwd.startswith(chroot) else os.path.sep
                 cwd = cwd.encode()
         else:
             if cwd is None:
@@ -305,7 +300,7 @@ class SimLinux(SimUserland):
         # Prepare the auxiliary vector and add it to the end of the string table
         # TODO: Actually construct a real auxiliary vector
         # current vector is an AT_RANDOM entry where the "random" value is 0xaec0aec0aec0...
-        aux = [(25, b"\xAE\xC0" * 8)]
+        aux = [(25, b"\xae\xc0" * 8)]
         for a, b in aux:
             table.add_pointer(a)
             if isinstance(b, bytes):
@@ -324,10 +319,7 @@ class SimLinux(SimUserland):
 
         # Put argc on stack and fix the stack pointer
         newsp = argv - state.arch.bytes
-        if len(argc) < state.arch.bits:
-            argc_bvv = claripy.ZeroExt(state.arch.bits - len(argc), argc)
-        else:
-            argc_bvv = argc
+        argc_bvv = claripy.ZeroExt(state.arch.bits - len(argc), argc) if len(argc) < state.arch.bits else argc
         state.memory.store(newsp, argc_bvv, endness=state.arch.memory_endness)
         state.regs.sp = newsp
 
@@ -355,11 +347,10 @@ class SimLinux(SimUserland):
                 byte = state.mem[progname_cur].byte.resolved
                 if byte.symbolic:
                     break
-                else:
-                    if state.solver.eval(byte) == ord("/"):
-                        progname = progname_cur + 1
-                    elif state.solver.eval(byte) == 0:
-                        break
+                if state.solver.eval(byte) == ord("/"):
+                    progname = progname_cur + 1
+                elif state.solver.eval(byte) == 0:
+                    break
 
                 progname_cur += 1
 
@@ -441,10 +432,9 @@ class SimLinux(SimUserland):
                 AT.from_mva(pseudo_toc, self.project.loader.extern_object).to_rva(), pseudo_hookaddr
             )
             return pseudo_hookaddr, pseudo_toc
-        else:
-            if basic_addr is None:
-                basic_addr = self.project.loader.extern_object.get_pseudo_addr(symbol_name)
-            return basic_addr, basic_addr
+        if basic_addr is None:
+            basic_addr = self.project.loader.extern_object.get_pseudo_addr(symbol_name)
+        return basic_addr, basic_addr
 
     def initialize_segment_register_x64(self, state, concrete_target):
         """
@@ -489,7 +479,7 @@ class SimLinux(SimUserland):
         # register used to read the value of the segment register
         exfiltration_reg = "rax"
         # instruction to inject for reading the value at segment value = offset
-        read_fs0_x64 = b"\x64\x48\x8B\x04\x25\x00\x00\x00\x00\x90\x90\x90\x90"  # mov rax, fs:[0]
+        read_fs0_x64 = b"\x64\x48\x8b\x04\x25\x00\x00\x00\x00\x90\x90\x90\x90"  # mov rax, fs:[0]
 
         return concrete_target.execute_shellcode(read_fs0_x64, exfiltration_reg)
 
@@ -504,7 +494,7 @@ class SimLinux(SimUserland):
         # register used to read the value of the segment register
         exfiltration_reg = "eax"
         # instruction to inject for reading the value at segment value = offset
-        read_gs0_x64 = b"\x65\xA1\x00\x00\x00\x00\x90\x90\x90\x90"  # mov eax, gs:[0]
+        read_gs0_x64 = b"\x65\xa1\x00\x00\x00\x00\x90\x90\x90\x90"  # mov eax, gs:[0]
         return concrete_target.execute_shellcode(read_gs0_x64, exfiltration_reg)
 
     def get_segment_register_name(self):