angr 9.2.117__py3-none-macosx_11_0_arm64.whl → 9.2.119__py3-none-macosx_11_0_arm64.whl

angr/analyses/decompiler/callsite_maker.py

@@ -1,22 +1,21 @@
-from typing import Optional, Any, TYPE_CHECKING
+from __future__ import annotations
+from typing import Any, TYPE_CHECKING
 import copy
 import logging
 
 import archinfo
-from ailment import Stmt, Expr
+from ailment import Stmt, Expr, Const
 
 from angr.procedures.stubs.format_parser import FormatParser, FormatSpecifier
-from angr.errors import SimMemoryMissingError
 from angr.sim_type import SimTypeBottom, SimTypePointer, SimTypeChar, SimTypeInt, dereference_simtype
 from angr.calling_conventions import SimRegArg, SimStackArg, SimCC, SimStructArg
 from angr.knowledge_plugins.key_definitions.constants import OP_BEFORE
 from angr.analyses import Analysis, register_analysis
+from angr.analyses.s_reaching_definitions.s_rda import SRDAView
 from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.functions import Function
-    from angr.storage.memory_mixins.paged_memory.pages.multi_values import MultiValues
-    from angr.knowledge_plugins.key_definitions.live_definitions import LiveDefinitions
     from angr.knowledge_plugins.key_definitions.definition import Definition
 
 
@@ -37,6 +36,7 @@ class CallSiteMaker(Analysis):
 
         self.result_block = None
         self.stack_arg_offsets: set[tuple[int, int]] | None = None  # ins_addr, stack_offset
+        self.removed_vvar_ids: set[int] = set()
 
         self._analyze()
 
@@ -46,11 +46,15 @@ class CallSiteMaker(Analysis):
 
         last_stmt = self.block.statements[-1]
 
-        if type(last_stmt) is not Stmt.Call:
+        if type(last_stmt) is Stmt.Call:
+            call_stmt = last_stmt
+        elif isinstance(last_stmt, Stmt.Assignment) and type(last_stmt.src) is Stmt.Call:
+            call_stmt = last_stmt.src
+        else:
             self.result_block = self.block
             return
 
-        if isinstance(last_stmt.target, str):
+        if isinstance(call_stmt.target, str):
             # custom function calls
             self.result_block = self.block
             return
@@ -76,7 +80,7 @@ class CallSiteMaker(Analysis):
 
         # function-specific prototype
         if cc is None or prototype is None:
-            target = self._get_call_target(last_stmt)
+            target = self._get_call_target(call_stmt)
             if target is not None and target in self.kb.functions:
                 # function-specific logic when the calling target is known
                 func = self.kb.functions[target]
@@ -105,7 +109,7 @@ class CallSiteMaker(Analysis):
                 prototype = dereference_simtype(prototype, type_collections).with_arch(self.project.arch)
 
         args = []
-        arg_defs = []
+        arg_vvars = []
         arg_locs = None
         if cc is None:
             l.warning("Call site %#x (callee %s) has an unknown calling convention.", self.block.addr, repr(func))
@@ -116,7 +120,7 @@ class CallSiteMaker(Analysis):
                 arg_locs = cc.arg_locs(prototype)
                 if prototype.variadic:
                     # determine the number of variadic arguments
-                    variadic_args = self._determine_variadic_arguments(func, cc, last_stmt)
+                    variadic_args = self._determine_variadic_arguments(func, cc, call_stmt)
                     if variadic_args:
                         callsite_ty = copy.copy(prototype)
                         callsite_ty.args = list(callsite_ty.args)
@@ -129,12 +133,24 @@ class CallSiteMaker(Analysis):
                 if isinstance(arg_loc, SimRegArg):
                     size = arg_loc.size
                     offset = arg_loc.check_offset(cc.arch)
-                    value_and_defs = self._resolve_register_argument(last_stmt, arg_loc)
-                    arg_defs += [d for _, d in value_and_defs]
-                    args.append(Expr.Register(self._atom_idx(), None, offset, size * 8, reg_name=arg_loc.reg_name))
+                    value_and_def = self._resolve_register_argument(call_stmt, arg_loc)
+                    if value_and_def is not None:
+                        vvar_def = value_and_def[1]
+                        arg_vvars.append(vvar_def)
+                        vvar_use = Expr.VirtualVariable(
+                            None,
+                            vvar_def.varid,
+                            vvar_def.bits,
+                            vvar_def.category,
+                            oident=vvar_def.oident,
+                            **vvar_def.tags,
+                        )
+                        args.append(vvar_use)
+                    else:
+                        args.append(Expr.Register(self._atom_idx(), None, offset, size * 8, reg_name=arg_loc.reg_name))
                 elif isinstance(arg_loc, SimStackArg):
                     stack_arg_locs.append(arg_loc)
-                    _, the_arg = self._resolve_stack_argument(last_stmt, arg_loc)
+                    _, the_arg = self._resolve_stack_argument(call_stmt, arg_loc)
 
                     if the_arg is not None:
                         args.append(the_arg)
@@ -154,13 +170,16 @@ class CallSiteMaker(Analysis):
             # check if the last statement is storing the return address onto the top of the stack
             if len(new_stmts) >= 1:
                 the_stmt = new_stmts[-1]
-                if isinstance(the_stmt, Stmt.Store) and isinstance(the_stmt.data, Expr.Const):
-                    if (
-                        isinstance(the_stmt.addr, Expr.StackBaseOffset)
-                        and the_stmt.data.value == self.block.addr + self.block.original_size
-                    ):
-                        # yes it is!
-                        new_stmts = new_stmts[:-1]
+                if (
+                    isinstance(the_stmt, Stmt.Assignment)
+                    and isinstance(the_stmt.dst, Expr.VirtualVariable)
+                    and the_stmt.dst.was_stack
+                    and isinstance(the_stmt.src, Expr.Const)
+                    and the_stmt.src.value == self.block.addr + self.block.original_size
+                ):
+                    # yes it is!
+                    self.removed_vvar_ids.add(the_stmt.dst.varid)
+                    new_stmts = new_stmts[:-1]
         else:
             # if there is an lr register...
             lr_offset = None
@@ -168,35 +187,34 @@ class CallSiteMaker(Analysis):
                 lr_offset = self.project.arch.registers["lr"][0]
             elif self.project.arch.name in {"MIPS32", "MIPS64"}:
                 lr_offset = self.project.arch.registers["ra"][0]
-            if lr_offset is not None:
-                # remove the assignment to the lr register
-                if len(new_stmts) >= 1:
-                    the_stmt = new_stmts[-1]
-                    if (
-                        isinstance(the_stmt, Stmt.Assignment)
-                        and isinstance(the_stmt.dst, Expr.Register)
-                        and the_stmt.dst.reg_offset == lr_offset
-                    ):
-                        # found it
-                        new_stmts = new_stmts[:-1]
+            # remove the assignment to the lr register
+            if lr_offset is not None and len(new_stmts) >= 1:
+                the_stmt = new_stmts[-1]
+                if (
+                    isinstance(the_stmt, Stmt.Assignment)
+                    and isinstance(the_stmt.dst, Expr.Register)
+                    and the_stmt.dst.reg_offset == lr_offset
+                ):
+                    # found it
+                    new_stmts = new_stmts[:-1]
 
         # calculate stack offsets for arguments that are put on the stack. these offsets will be consumed by
         # simplification steps in the future, which may decide to remove statements that store arguments on the stack.
         if stack_arg_locs:
-            sp_offset = self._stack_pointer_tracker.offset_before(last_stmt.ins_addr, self.project.arch.sp_offset)
+            sp_offset = self._stack_pointer_tracker.offset_before(call_stmt.ins_addr, self.project.arch.sp_offset)
             if sp_offset is None:
                 l.warning(
                     "Failed to calculate the stack pointer offset at pc %#x. You may find redundant Store "
                     "statements.",
-                    last_stmt.ins_addr,
+                    call_stmt.ins_addr,
                 )
                 self.stack_arg_offsets = None
             else:
                 self.stack_arg_offsets = {
-                    (last_stmt.ins_addr, sp_offset + arg.stack_offset - stackarg_sp_diff) for arg in stack_arg_locs
+                    (call_stmt.ins_addr, sp_offset + arg.stack_offset - stackarg_sp_diff) for arg in stack_arg_locs
                 }
 
-        ret_expr = last_stmt.ret_expr
+        ret_expr = call_stmt.ret_expr
         # if ret_expr is None, it means in previous steps (such as during AIL simplification) we have deemed the return
         # value of this call statement as useless and is removed.
 
@@ -205,32 +223,38 @@ class CallSiteMaker(Analysis):
             and prototype is not None
             and prototype.returnty is not None
             and not isinstance(prototype.returnty, SimTypeBottom)
+            and not isinstance(ret_expr, Expr.VirtualVariable)
         ):
             # try to narrow the return expression if needed
             ret_type_bits = prototype.returnty.with_arch(self.project.arch).size
             if ret_expr.bits > ret_type_bits:
                 ret_expr = ret_expr.copy()
                 ret_expr.bits = ret_type_bits
-
-        new_stmts.append(
-            Stmt.Call(
-                last_stmt.idx,
-                last_stmt.target,
-                calling_convention=cc,
-                prototype=prototype,
-                args=args,
-                ret_expr=ret_expr,
-                arg_defs=arg_defs,
-                **last_stmt.tags,
-            )
+            # TODO: Support narrowing virtual variables
+
+        new_stmt = Stmt.Call(
+            call_stmt.idx,
+            call_stmt.target,
+            calling_convention=cc,
+            prototype=prototype,
+            args=args,
+            ret_expr=ret_expr,
+            arg_vvars=arg_vvars,
+            **call_stmt.tags,
         )
+        if isinstance(last_stmt, Stmt.Assignment):
+            if new_stmt.bits is None:
+                new_stmt.bits = last_stmt.src.bits
+            new_stmt = Stmt.Assignment(last_stmt.idx, last_stmt.dst, new_stmt, **last_stmt.tags)
+
+        new_stmts.append(new_stmt)
 
         new_block = self.block.copy()
         new_block.statements = new_stmts
 
         self.result_block = new_block
 
-    def _find_variable_from_definition(self, def_: "Definition"):
+    def _find_variable_from_definition(self, def_: Definition):
         """
 
         :param Definition def_: The reaching definition of a variable.
@@ -244,41 +268,25 @@ class CallSiteMaker(Analysis):
         stmt = self.block.statements[def_.codeloc.stmt_idx]
         if type(stmt) is Stmt.Assignment:
             return stmt.dst
-        elif type(stmt) is Stmt.Store:
+        if type(stmt) is Stmt.Store:
             return stmt.addr
-        else:
-            l.warning("TODO: Unsupported statement type %s for definitions.", type(stmt))
-            return None
+        l.warning("TODO: Unsupported statement type %s for definitions.", type(stmt))
+        return None
 
-    def _resolve_register_argument(self, call_stmt, arg_loc) -> set[tuple[int | None, "Definition"]]:
-        size = arg_loc.size
+    def _resolve_register_argument(self, call_stmt, arg_loc) -> tuple[int | None, Expr.VirtualVariable] | None:
         offset = arg_loc.check_offset(self.project.arch)
 
         if self._reaching_definitions is not None:
             # Find its definition
             ins_addr = call_stmt.tags["ins_addr"]
-            try:
-                rd: "LiveDefinitions" = self._reaching_definitions.get_reaching_definitions_by_insn(ins_addr, OP_BEFORE)
-            except KeyError:
-                return set()
+            view = SRDAView(self._reaching_definitions.model)
+            vvar = view.get_reg_vvar_by_insn(offset, ins_addr, OP_BEFORE, block_idx=self.block.idx)
 
-            try:
-                vs: "MultiValues" = rd.registers.load(offset, size=size)
-            except SimMemoryMissingError:
-                return set()
-            values_and_defs_ = set()
-            for values in vs.values():
-                for value in values:
-                    if value.concrete:
-                        concrete_value = value.concrete_value
-                    else:
-                        concrete_value = None
-                    for def_ in rd.extract_defs(value):
-                        values_and_defs_.add((concrete_value, def_))
+            if vvar is not None:
+                vvar_value = view.get_vvar_value(vvar)
+                return vvar_value, vvar
 
-            return values_and_defs_
-
-        return set()
+        return None
 
     def _resolve_stack_argument(self, call_stmt, arg_loc) -> tuple[Any, Any]:  # pylint:disable=unused-argument
         size = arg_loc.size
@@ -287,12 +295,44 @@ class CallSiteMaker(Analysis):
             # adjust the offset
             offset -= self.project.arch.bytes
 
-        # TODO: Support extracting values
+        sp_base = self._stack_pointer_tracker.offset_before(call_stmt.ins_addr, self.project.arch.sp_offset)
+        if sp_base is not None:
+            sp_offset = sp_base + offset
+            if sp_offset >= (1 << (self.project.arch.bits - 1)):
+                # make it a signed integer
+                mask = (1 << self.project.arch.bits) - 1
+                sp_offset = -(((~sp_offset) & mask) + 1)
+
+            if self._reaching_definitions is not None:
+                # find its definition
+                view = SRDAView(self._reaching_definitions.model)
+                vvar = view.get_stack_vvar_by_insn(
+                    sp_offset, size, call_stmt.ins_addr, OP_BEFORE, block_idx=self.block.idx
+                )
+                if vvar is not None:
+                    value = view.get_vvar_value(vvar)
+                    if value is not None:
+                        return None, value
+                    return None, Expr.VirtualVariable(
+                        self._atom_idx(),
+                        vvar.varid,
+                        vvar.bits,
+                        vvar.category,
+                        oident=vvar.oident,
+                        ins_addr=call_stmt.ins_addr,
+                    )
+
+            return None, Expr.Load(
+                self._atom_idx(),
+                Expr.StackBaseOffset(self._atom_idx(), self.project.arch.bits, sp_offset),
+                size,
+                self.project.arch.memory_endness,
+                func_arg=True,
+            )
 
         return None, Expr.Load(
             self._atom_idx(),
-            Expr.Register(self._atom_idx(), None, self.project.arch.sp_offset, self.project.arch.bits)
-            + Expr.Const(self._atom_idx(), None, offset, self.project.arch.bits),
+            Expr.StackBaseOffset(self._atom_idx(), self.project.arch.bits, offset),
             size,
             self.project.arch.memory_endness,
             func_arg=True,
@@ -330,7 +370,7 @@ class CallSiteMaker(Analysis):
 
         return s
 
-    def _determine_variadic_arguments(self, func: Optional["Function"], cc: SimCC, call_stmt) -> int | None:
+    def _determine_variadic_arguments(self, func: Function | None, cc: SimCC, call_stmt) -> int | None:
         if func is not None and "printf" in func.name or "scanf" in func.name:
             return self._determine_variadic_arguments_for_format_strings(func, cc, call_stmt)
         return None
@@ -364,9 +404,9 @@ class CallSiteMaker(Analysis):
 
             value = None
             if isinstance(arg_loc, SimRegArg):
-                value_and_defs = self._resolve_register_argument(call_stmt, arg_loc)
-                if len({v for v, _ in value_and_defs}) == 1:
-                    value = next(iter({v for v, _ in value_and_defs}))
+                value_and_def = self._resolve_register_argument(call_stmt, arg_loc)
+                if value_and_def is not None:
+                    value = value_and_def[0]
 
             elif isinstance(arg_loc, SimStackArg):
                 value, _ = self._resolve_stack_argument(call_stmt, arg_loc)
@@ -375,6 +415,8 @@ class CallSiteMaker(Analysis):
                 l.warning("Unexpected type of argument type %s.", arg_loc.__class__)
                 return None
 
+            if isinstance(value, Const) and isinstance(value.value, int):
+                value = value.value
             if isinstance(value, int):
                 fmt_str = self._load_string(value)
                 if fmt_str:

angr/analyses/decompiler/ccall_rewriters/__init__.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from .amd64_ccalls import AMD64CCallRewriter