angr 9.2.117__py3-none-manylinux2014_aarch64.whl → 9.2.118__py3-none-manylinux2014_aarch64.whl

angr/analyses/variable_recovery/engine_base.py

@@ -1,4 +1,6 @@
-from typing import Optional, TYPE_CHECKING
+from __future__ import annotations
+from typing import Any, TYPE_CHECKING
+import contextlib
 import logging
 
 import ailment
@@ -58,7 +60,7 @@ class RichR:
         return None
 
     def __repr__(self):
-        return "R{%r}" % self.data
+        return f"R{{{self.data!r}}}"
 
 
 class SimEngineVRBase(SimEngineLight):
@@ -67,14 +69,15 @@ class SimEngineVRBase(SimEngineLight):
     and storing data.
     """
 
-    state: "VariableRecoveryStateBase"
+    state: VariableRecoveryStateBase
 
     def __init__(self, project, kb):
         super().__init__()
 
         self.project = project
         self.kb = kb
-        self.variable_manager: Optional["VariableManager"] = None
+        self.variable_manager: VariableManager | None = None
+        self.vvar_region: dict[int, Any] = {}
 
     @property
     def func_addr(self):
@@ -93,7 +96,7 @@ class SimEngineVRBase(SimEngineLight):
 
     def _process(
         self, state, successors, block=None, func_addr=None
-    ):  # pylint:disable=unused-argument,arguments-differ
+    ):  # pylint:disable=unused-argument,arguments-differ,arguments-renamed
         super()._process(state, successors, block=block)
 
     #
@@ -102,39 +105,37 @@ class SimEngineVRBase(SimEngineLight):
 
     @staticmethod
     def _addr_has_concrete_base(addr: claripy.ast.BV) -> bool:
-        if addr.op == "__add__":
-            if len(addr.args) == 2:
-                if addr.args[0].concrete:
-                    return True
-                if addr.args[1].concrete:
-                    return True
+        if addr.op == "__add__" and len(addr.args) == 2:
+            if addr.args[0].concrete:
+                return True
+            if addr.args[1].concrete:
+                return True
         return False
 
     @staticmethod
-    def _parse_offseted_addr(addr: claripy.ast.BV) -> tuple[claripy.ast.BV, claripy.ast.BV, claripy.ast.BV] | None:
-        if addr.op == "__add__":
-            if len(addr.args) == 2:
-                concrete_base, byte_offset = None, None
-                if addr.args[0].concrete:
-                    concrete_base, byte_offset = addr.args
-                elif addr.args[1].concrete:
-                    concrete_base, byte_offset = addr.args[1], addr.args[0]
-                if concrete_base is None or byte_offset is None:
-                    return None
-                base_addr = concrete_base
-                offset = None
-                elem_size = None
-                if byte_offset.concrete:
-                    offset = byte_offset
-                    elem_size = 1
-                else:
-                    abs_offset = byte_offset
-                    if abs_offset.op == "__lshift__" and abs_offset.args[1].concrete:
-                        offset = abs_offset.args[0]
-                        elem_size = 2 ** abs_offset.args[1].concrete_value
+    def _parse_offsetted_addr(addr: claripy.ast.BV) -> tuple[claripy.ast.BV, claripy.ast.BV, claripy.ast.BV] | None:
+        if addr.op == "__add__" and len(addr.args) == 2:
+            concrete_base, byte_offset = None, None
+            if addr.args[0].concrete:
+                concrete_base, byte_offset = addr.args
+            elif addr.args[1].concrete:
+                concrete_base, byte_offset = addr.args[1], addr.args[0]
+            if concrete_base is None or byte_offset is None:
+                return None
+            base_addr = concrete_base
+            offset = None
+            elem_size = None
+            if byte_offset.concrete:
+                offset = byte_offset
+                elem_size = 1
+            else:
+                abs_offset = byte_offset
+                if abs_offset.op == "__lshift__" and abs_offset.args[1].concrete:
+                    offset = abs_offset.args[0]
+                    elem_size = 2 ** abs_offset.args[1].concrete_value
 
-                if base_addr is not None and offset is not None and elem_size is not None:
-                    return base_addr, offset, elem_size
+            if base_addr is not None and offset is not None and elem_size is not None:
+                return base_addr, offset, elem_size
         return None
 
     #
@@ -217,7 +218,7 @@ class SimEngineVRBase(SimEngineLight):
             variable_manager = self.variable_manager["global"]
 
             # special case for global variables: find existing variable by base address
-            existing_vars = list((var, 0) for var in variable_manager.get_global_variables(global_var_addr))
+            existing_vars = [(var, 0) for var in variable_manager.get_global_variables(global_var_addr)]
 
             if not existing_vars:
                 variable = SimMemoryVariable(
@@ -269,7 +270,7 @@ class SimEngineVRBase(SimEngineLight):
             global_var_addr = data.concrete_value
             variable_manager = self.variable_manager["global"]
             # special case for global variables: find existing variable by base address
-            existing_vars = list((var, 0) for var in variable_manager.get_global_variables(global_var_addr))
+            existing_vars = [(var, 0) for var in variable_manager.get_global_variables(global_var_addr)]
         else:
             return
 
@@ -277,8 +278,7 @@ class SimEngineVRBase(SimEngineLight):
             # no associated variables. it's usually because _ensure_variable_existence() is not called, or the address
             # is a TOP. we ignore this case.
             return
-        else:
-            variable, _ = existing_vars[0]
+        variable, _ = existing_vars[0]
 
         if not self.state.typevars.has_type_variable_for(variable, codeloc):
             variable_typevar = typevars.TypeVariable()
@@ -292,7 +292,9 @@ class SimEngineVRBase(SimEngineLight):
                 offset = None
             variable_manager.reference_at(var, offset, codeloc, atom=src)
 
-    def _assign_to_register(self, offset, richr, size, src=None, dst=None, create_variable: bool = True):
+    def _assign_to_register(
+        self, offset, richr, size, src=None, dst=None, create_variable: bool = True
+    ):  # pylint:disable=unused-argument
         """
 
         :param int offset:
@@ -311,8 +313,8 @@ class SimEngineVRBase(SimEngineLight):
         data: claripy.ast.Base = richr.data
 
         # lea
-        self._ensure_variable_existence(richr, codeloc, src_expr=src)
-        self._reference(richr, codeloc, src=src)
+        self._ensure_variable_existence(richr, codeloc)
+        self._reference(richr, codeloc)
 
         # handle register writes
 
@@ -351,7 +353,97 @@ class SimEngineVRBase(SimEngineLight):
         v = MultiValues(annotated_data)
         self.state.register_region.store(offset, v)
         # register with the variable manager
-        self.variable_manager[self.func_addr].write_to(variable, None, codeloc, atom=dst)
+        self.variable_manager[self.func_addr].write_to(variable, None, codeloc, atom=dst, overwrite=False)
+
+        if richr.typevar is not None:
+            if not self.state.typevars.has_type_variable_for(variable, codeloc):
+                # assign a new type variable to it
+                typevar = typevars.TypeVariable()
+                self.state.typevars.add_type_variable(variable, codeloc, typevar)
+                # create constraints
+            else:
+                typevar = self.state.typevars.get_type_variable(variable, codeloc)
+            self.state.add_type_constraint(typevars.Subtype(richr.typevar, typevar))
+            self.state.add_type_constraint(typevars.Subtype(typevar, typeconsts.int_type(variable.size * 8)))
+
+    def _assign_to_vvar(
+        self,
+        vvar: ailment.Expr.VirtualVariable,
+        richr,
+        src=None,
+        dst=None,
+        create_variable: bool = True,
+        vvar_id: int | None = None,
+    ):  # pylint:disable=unused-argument
+
+        if vvar_id is None:
+            vvar_id = vvar.varid
+
+        if (
+            vvar.category == ailment.Expr.VirtualVariableCategory.REGISTER
+            and vvar.oident in (self.arch.ip_offset, self.arch.sp_offset, self.arch.lr_offset)
+            or not create_variable
+        ):
+            # only store the value. don't worry about variables.
+            self.vvar_region[vvar_id] = richr.data
+            return
+
+        codeloc: CodeLocation = self._codeloc()
+        data: claripy.ast.Base = richr.data
+
+        # lea
+        self._ensure_variable_existence(richr, codeloc)
+        self._reference(richr, codeloc)
+
+        # first check if there is an existing variable for the atom at this location already
+        existing_vars: set[tuple[SimVariable, int]] = self.variable_manager[self.func_addr].find_variables_by_atom(
+            self.block.addr, self.stmt_idx, dst
+        )
+        if not existing_vars:
+            # next check if there is already a variable for the vvar ID
+            addr_and_variables = set()
+            try:
+                value = self.vvar_region[vvar_id]
+                addr_and_variables.update(self.state.extract_variables(value))
+            except KeyError:
+                pass
+            existing_vars = {(av[1], av[0]) for av in addr_and_variables}
+
+        if not existing_vars:
+            if vvar.was_reg:
+                variable = SimRegisterVariable(
+                    vvar.reg_offset,
+                    vvar.size,
+                    ident=self.variable_manager[self.func_addr].next_variable_ident("register"),
+                    region=self.func_addr,
+                )
+                self.variable_manager[self.func_addr].add_variable("register", vvar.reg_offset, variable)
+            elif vvar.was_stack:
+                variable = SimStackVariable(
+                    vvar.stack_offset,
+                    vvar.size,
+                    ident=self.variable_manager[self.func_addr].next_variable_ident("stack"),
+                    region=self.func_addr,
+                )
+                self.variable_manager[self.func_addr].add_variable("stack", vvar.stack_offset, variable)
+            elif vvar.was_parameter:
+                # FIXME: we assume all parameter vvars were registers
+                variable = SimRegisterVariable(
+                    vvar.reg_offset,
+                    vvar.size,
+                    ident=self.variable_manager[self.func_addr].next_variable_ident("register"),
+                    region=self.func_addr,
+                )
+                self.variable_manager[self.func_addr].add_variable("register", vvar.oident, variable)
+            else:
+                raise NotImplementedError
+        else:
+            variable, _ = next(iter(existing_vars))
+
+        # FIXME: The offset does not have to be 0
+        annotated_data = self.state.annotate_with_variables(data, [(0, variable)])
+        self.vvar_region[vvar_id] = annotated_data
+        self.variable_manager[self.func_addr].write_to(variable, None, codeloc, atom=dst, overwrite=False)
 
         if richr.typevar is not None:
             if not self.state.typevars.has_type_variable_for(variable, codeloc):
@@ -380,9 +472,9 @@ class SimEngineVRBase(SimEngineLight):
             # fully concrete. this is a global address
             self._store_to_global(addr.concrete_value, data, size, stmt=stmt)
             stored = True
-        elif self._addr_has_concrete_base(addr) and self._parse_offseted_addr(addr) is not None:
+        elif self._addr_has_concrete_base(addr) and self._parse_offsetted_addr(addr) is not None:
             # we are storing to a concrete global address with an offset
-            base_addr, offset, elem_size = self._parse_offseted_addr(addr)
+            base_addr, offset, elem_size = self._parse_offsetted_addr(addr)
             self._store_to_global(base_addr.concrete_value, data, size, stmt=stmt, offset=offset, elem_size=elem_size)
             stored = True
         else:
@@ -523,12 +615,10 @@ class SimEngineVRBase(SimEngineLight):
         )
         values = None
         if abs_addr is not None:
-            try:
+            with contextlib.suppress(SimMemoryMissingError):
                 values: MultiValues = self.state.global_region.load(
                     abs_addr, size=size, endness=self.state.arch.memory_endness if stmt is None else stmt.endness
                 )
-            except SimMemoryMissingError:
-                pass
 
         if values is not None:
             for vs in values.values():
@@ -579,10 +669,7 @@ class SimEngineVRBase(SimEngineLight):
             for tc in richr_addr.type_constraints:
                 self.state.add_type_constraint(tc)
 
-        if richr_addr.typevar is None:
-            typevar = typevars.TypeVariable()
-        else:
-            typevar = richr_addr.typevar
+        typevar = typevars.TypeVariable() if richr_addr.typevar is None else richr_addr.typevar
 
         if typevar is not None:
             if isinstance(typevar, typevars.DerivedTypeVariable) and isinstance(typevar.one_label, typevars.AddN):
@@ -749,9 +836,9 @@ class SimEngineVRBase(SimEngineLight):
             v = self._load_from_global(addr.concrete_value, size, expr=expr)
             typevar = v.typevar
 
-        elif self._addr_has_concrete_base(addr) and self._parse_offseted_addr(addr) is not None:
+        elif self._addr_has_concrete_base(addr) and self._parse_offsetted_addr(addr) is not None:
             # Loading data from a memory address with an offset
-            base_addr, offset, elem_size = self._parse_offseted_addr(addr)
+            base_addr, offset, elem_size = self._parse_offsetted_addr(addr)
             v = self._load_from_global(base_addr.concrete_value, size, expr=expr, offset=offset, elem_size=elem_size)
             typevar = v.typevar
 
@@ -848,7 +935,7 @@ class SimEngineVRBase(SimEngineLight):
                 self.state.add_type_constraint(typevars.Subtype(load_typevar, typeconsts.TopType()))
             else:
                 # FIXME: This is a hack
-                for i in range(0, 4):
+                for i in range(4):
                     concrete_offset = size * i
                     load_typevar = self._create_access_typevar(typevar, True, size, concrete_offset)
                     self.state.add_type_constraint(typevars.Subtype(load_typevar, typeconsts.TopType()))
@@ -900,7 +987,7 @@ class SimEngineVRBase(SimEngineLight):
         for value_set in value_list:
             for value in value_set:
                 for _, var in self.state.extract_variables(value):
-                    self.variable_manager[self.func_addr].read_from(var, None, codeloc, atom=expr)
+                    self.variable_manager[self.func_addr].read_from(var, None, codeloc, atom=expr, overwrite=False)
                     variable_set.add(var)
 
         if offset == self.arch.sp_offset:
@@ -929,15 +1016,102 @@ class SimEngineVRBase(SimEngineLight):
                     # | typevar = next(reversed(list(self.state.typevars[var].values())))
                     typevar = self.state.typevars[var]
 
-        if len(value_list) == 1:
-            r_value = next(iter(value_list[0]))
-        else:
-            r_value = self.state.top(size * self.arch.byte_width)  # fall back to top
+        r_value = (
+            next(iter(value_list[0])) if len(value_list) == 1 else self.state.top(size * self.arch.byte_width)
+        )  # fall back to top
         if var is not None and var.size != size:
             # ignore the variable and the associated type if we are only reading part of the variable
             return RichR(r_value, variable=var)
         return RichR(r_value, variable=var, typevar=typevar)
 
+    def _read_from_vvar(
+        self, vvar: ailment.Expr.VirtualVariable, expr=None, create_variable: bool = True, vvar_id: int | None = None
+    ):
+        codeloc = self._codeloc()
+
+        if vvar_id is None:
+            vvar_id = vvar.varid
+
+        value: claripy.ast.Base | None = self.vvar_region.get(vvar_id, None)
+
+        # fallback for register arguments
+        if value is None and vvar.was_reg:
+            return self._read_from_register(vvar.reg_offset, vvar.size, expr=vvar, create_variable=True)
+
+        if vvar.category == ailment.Expr.VirtualVariableCategory.REGISTER and vvar.oident in (
+            self.arch.sp_offset,
+            self.arch.ip_offset,
+        ):
+            # load values. don't worry about variables
+            r_value = self.state.top(vvar.size) if value is None else value
+            return RichR(r_value, variable=None, typevar=None)
+
+        if value is None:
+            # the value does not exist.
+            value = self.state.top(vvar.bits)
+            if create_variable:
+                # create a new variable if necessary
+                if vvar.category == ailment.Expr.VirtualVariableCategory.REGISTER:
+                    variable = SimRegisterVariable(
+                        vvar.reg_offset,
+                        vvar.size,
+                        ident=self.variable_manager[self.func_addr].next_variable_ident("register"),
+                        region=self.func_addr,
+                    )
+                    value = self.state.annotate_with_variables(value, [(0, variable)])
+                    self.variable_manager[self.func_addr].add_variable("register", vvar.reg_offset, variable)
+                elif vvar.category == ailment.Expr.VirtualVariableCategory.STACK:
+                    variable = SimStackVariable(
+                        vvar.stack_offset,
+                        vvar.size,
+                        ident=self.variable_manager[self.func_addr].next_variable_ident("stack"),
+                        region=self.func_addr,
+                    )
+                    value = self.state.annotate_with_variables(value, [(0, variable)])
+                    self.variable_manager[self.func_addr].add_variable("stack", vvar.stack_offset, variable)
+                elif vvar.category == ailment.Expr.VirtualVariableCategory.PARAMETER:
+                    raise KeyError(f"Missing virtual variable for parameter {vvar}")
+                else:
+                    raise NotImplementedError
+
+            self.vvar_region[vvar_id] = value
+
+        variable_set = set()
+        for _, var in self.state.extract_variables(value):
+            self.variable_manager[self.func_addr].read_from(var, None, codeloc, atom=expr, overwrite=False)
+            variable_set.add(var)
+
+        if vvar.category == ailment.Expr.VirtualVariableCategory.REGISTER and vvar.oident == self.arch.sp_offset:
+            # ignore sp
+            typevar = None
+            var = None
+        else:
+            # we accept the precision loss here by only returning the first variable
+            # FIXME: Multiple variables
+            typevar = None
+            var = None
+            if variable_set:
+                var = next(iter(variable_set))
+
+                # add delayed type constraints
+                if var in self.state.delayed_type_constraints:
+                    for constraint in self.state.delayed_type_constraints[var]:
+                        self.state.add_type_constraint(constraint)
+                    self.state.delayed_type_constraints.pop(var)
+
+                if var not in self.state.typevars:
+                    typevar = typevars.TypeVariable()
+                    self.state.typevars.add_type_variable(var, codeloc, typevar)
+                else:
+                    # FIXME: This is an extremely stupid hack. Fix it later.
+                    # | typevar = next(reversed(list(self.state.typevars[var].values())))
+                    typevar = self.state.typevars[var]
+
+        if var is not None and var.size != vvar.size:
+            # ignore the variable and the associated type if we are only reading part of the variable
+            return RichR(value, variable=var)
+        return RichR(value, variable=var, typevar=typevar)
+
     def _create_access_typevar(
         self, typevar: TypeVariable | DerivedTypeVariable, is_store: bool, size: int, offset: int
     ) -> DerivedTypeVariable:

angr/analyses/variable_recovery/engine_vex.py

@@ -1,4 +1,5 @@
 # pylint:disable=unused-argument
+from __future__ import annotations
 from typing import TYPE_CHECKING
 
 import claripy
@@ -27,7 +28,7 @@ class SimEngineVRVEX(
     Implements the VEX engine for variable recovery analysis.
     """
 
-    state: "VariableRecoveryStateBase"
+    state: VariableRecoveryStateBase
 
     def __init__(self, *args, call_info=None, **kwargs):
         super().__init__(*args, **kwargs)
@@ -41,8 +42,8 @@ class SimEngineVRVEX(
     def _is_top(self, expr: RichR) -> bool:
         return self.state.is_top(expr)
 
-    def _top(self, size: int):
-        return self.state.top(size)
+    def _top(self, size: int) -> RichR:
+        return RichR(self.state.top(size))
 
     def _process_Stmt(self, whitelist=None):
         scanner = VEXIRSBScanner(logger=self.l)
@@ -143,16 +144,14 @@ class SimEngineVRVEX(
         #    49 | t300 = ITE(t299,0x00000000,t143)
         #    50 | PUT(r3) = t300
         #    51 | PUT(pc) = 0x000feca5
-        if is_arm_arch(self.arch) and (self.ins_addr & 1) == 1:
-            if self.stmt_idx < len(self.block.vex.statements) - 1:
-                next_stmt = self.block.vex.statements[self.stmt_idx + 1]
-                if isinstance(next_stmt, pyvex.IRStmt.WrTmp) and isinstance(next_stmt.data, pyvex.IRExpr.ITE):
-                    return RichR(self.state.top(reg_size * 8))
+        if is_arm_arch(self.arch) and (self.ins_addr & 1) == 1 and self.stmt_idx < len(self.block.vex.statements) - 1:
+            next_stmt = self.block.vex.statements[self.stmt_idx + 1]
+            if isinstance(next_stmt, pyvex.IRStmt.WrTmp) and isinstance(next_stmt.data, pyvex.IRExpr.ITE):
+                return RichR(self.state.top(reg_size * 8))
 
         force_variable_size = None
-        if self.stmts_to_lower and self.stmt_idx in self.stmts_to_lower:
-            if reg_size == 8:
-                force_variable_size = 4
+        if self.stmts_to_lower and self.stmt_idx in self.stmts_to_lower and reg_size == 8:
+            force_variable_size = 4
 
         return self._read_from_register(
             reg_offset,

angr/analyses/variable_recovery/irsb_scanner.py

@@ -1,4 +1,5 @@
 # pylint:disable=no-self-use,unused-argument
+from __future__ import annotations
 
 import pyvex
 

angr/analyses/variable_recovery/variable_recovery.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 from collections import defaultdict
 
@@ -55,7 +56,7 @@ class VariableRecoveryState(VariableRecoveryStateBase):
         return None
 
     def copy(self):
-        state = VariableRecoveryState(
+        return VariableRecoveryState(
             self.block_addr,
             self._analysis,
             self.arch,
@@ -65,8 +66,6 @@ class VariableRecoveryState(VariableRecoveryStateBase):
             register_region=self.register_region.copy(),
         )
 
-        return state
-
     def register_callbacks(self, concrete_states):
         """
 
@@ -89,7 +88,7 @@ class VariableRecoveryState(VariableRecoveryStateBase):
             )
             concrete_state.inspect.add_breakpoint("mem_write", BP(enabled=True, action=self._hook_memory_write))
 
-    def merge(self, others: tuple["VariableRecoveryState"], successor=None) -> tuple["VariableRecoveryState", bool]:
+    def merge(self, others: tuple[VariableRecoveryState], successor=None) -> tuple[VariableRecoveryState, bool]:
         """
         Merge two abstract states.
 
@@ -377,29 +376,28 @@ class VariableRecoveryState(VariableRecoveryStateBase):
                 annotated = [True for annotated, _ in parsed if annotated is True]
                 if len(annotated) != 1:
                     # either nothing is annotated, or more than one element is annotated
-                    raise ValueError()
+                    raise ValueError
 
                 return True, sum(off for _, off in parsed)
-            elif addr.op == "__sub__":
+            if addr.op == "__sub__":
                 # __sub__ might have multiple arguments
 
                 parsed = [_parse(arg) for arg in addr.args]
                 first_annotated, first_offset = parsed[0]
                 if first_annotated is False:
                     # the first argument is not annotated. we don't support it.
-                    raise ValueError()
+                    raise ValueError
                 if any(annotated for annotated, _ in parsed[1:]):
                     # more than one argument is annotated. we don't support it.
-                    raise ValueError()
+                    raise ValueError
 
                 return True, first_offset - sum(off for _, off in parsed[1:])
-            else:
-                anno = next(iter(anno for anno in addr.annotations if isinstance(anno, StackLocationAnnotation)), None)
-                if anno is None:
-                    if addr.op == "BVV":
-                        return False, addr.concrete_value
-                    raise ValueError()
-                return True, anno.offset
+            anno = next(iter(anno for anno in addr.annotations if isinstance(anno, StackLocationAnnotation)), None)
+            if anno is None:
+                if addr.op == "BVV":
+                    return False, addr.concrete_value
+                raise ValueError
+            return True, anno.offset
 
         # find the annotated AST
         try:
@@ -437,7 +435,7 @@ class VariableRecovery(ForwardAnalysis, VariableRecoveryBase):  # pylint:disable
     This analysis follows SSA, which means every write creates a new variable in registers or memory (statck, heap,
     etc.). Things may get tricky when overlapping variable (in memory, as you cannot really have overlapping accesses
     to registers) accesses exist, and in such cases, a new variable will be created, and this new variable will overlap
-    with one or more existing varaibles. A decision procedure (which is pretty much TODO) is required at the end of this
+    with one or more existing variables. A decision procedure (which is pretty much TODO) is required at the end of this
     analysis to resolve the conflicts between overlapping variables.
     """
 

angr/analyses/variable_recovery/variable_recovery_base.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import weakref
 from typing import Any, TYPE_CHECKING
 from collections.abc import Generator, Iterable
@@ -44,10 +45,10 @@ def parse_stack_pointer(sp):
         off1 = parse_stack_pointer(op1)
         if sp.op == "Sub":
             return off0 - off1
-        elif sp.op == "Add":
+        if sp.op == "Add":
             return off0 + off1
 
-    raise NotImplementedError("Unsupported stack pointer representation type %s." % type(sp))
+    raise NotImplementedError(f"Unsupported stack pointer representation type {type(sp)}.")
 
 
 class VariableAnnotation(Annotation):
@@ -81,7 +82,7 @@ class VariableRecoveryBase(Analysis):
     The base class for VariableRecovery and VariableRecoveryFast.
     """
 
-    def __init__(self, func, max_iterations, store_live_variables: bool):
+    def __init__(self, func, max_iterations, store_live_variables: bool, vvar_to_vvar: dict[int, int] | None = None):
         self.function = func
         self.variable_manager = self.kb.variables
 
@@ -91,6 +92,7 @@ class VariableRecoveryBase(Analysis):
         self._outstates = {}
         self._instates: dict[Any, VariableRecoveryStateBase] = {}
         self._dominance_frontiers = None
+        self.vvar_to_vvar = vvar_to_vvar
 
     #
     # Public methods
@@ -128,7 +130,7 @@ class VariableRecoveryBase(Analysis):
         stack_vars_by_offset = defaultdict(list)
         for sv in stack_vars:
             stack_vars_by_offset[sv.offset].append(sv)
-        for offset, var_list in stack_vars_by_offset.items():
+        for _offset, var_list in stack_vars_by_offset.items():
             if len(var_list) < 2:
                 continue
             single_byte_vars = [v for v in var_list if v.size == 1]
@@ -241,12 +243,10 @@ class VariableRecoveryStateBase:
 
     @staticmethod
     def is_top(thing) -> bool:
-        if isinstance(thing, claripy.ast.BV) and thing.op == "BVS" and thing.args[0] == "top":
-            return True
-        return False
+        return bool(isinstance(thing, claripy.ast.BV) and thing.op == "BVS" and thing.args[0] == "top")
 
     @staticmethod
-    def extract_variables(expr: claripy.ast.Base) -> Generator[tuple[int, SimVariable | SpOffset], None, None]:
+    def extract_variables(expr: claripy.ast.Base) -> Generator[tuple[int, SimVariable | SpOffset]]:
         for anno in expr.annotations:
             if isinstance(anno, VariableAnnotation):
                 yield from anno.addr_and_variables
@@ -255,8 +255,7 @@ class VariableRecoveryStateBase:
     def annotate_with_variables(
         expr: claripy.ast.Base, addr_and_variables: Iterable[tuple[int, SimVariable | SpOffset]]
     ) -> claripy.ast.Base:
-        expr = expr.replace_annotations((VariableAnnotation(list(addr_and_variables)),))
-        return expr
+        return expr.replace_annotations((VariableAnnotation(list(addr_and_variables)),))
 
     def stack_address(self, offset: int) -> claripy.ast.Base:
         base = claripy.BVS("stack_base", self.arch.bits, explicit_name=True)
@@ -284,7 +283,7 @@ class VariableRecoveryStateBase:
             if addr.args[0] == "stack_base":
                 return claripy.BVV(0, addr.size())
             return None
-        elif addr.op == "BVV":
+        if addr.op == "BVV":
             r = addr
         elif addr.op == "__add__":
             arg_offsets = []
@@ -408,7 +407,7 @@ class VariableRecoveryStateBase:
 
     @staticmethod
     def _mo_cmp(
-        mos_self: set["SimMemoryObject"], mos_other: set["SimMemoryObject"], addr: int, size: int
+        mos_self: set[SimMemoryObject], mos_other: set[SimMemoryObject], addr: int, size: int
     ):  # pylint:disable=unused-argument
         # comparing bytes from two sets of memory objects
         # we don't need to resort to byte-level comparison. object-level is good enough.
@@ -436,8 +435,7 @@ class VariableRecoveryStateBase:
                 self.phi_variables[var] = phi_var
 
         r = self.top(bits)
-        r = self.annotate_with_variables(r, [(0, phi_var)])
-        return r
+        return self.annotate_with_variables(r, [(0, phi_var)])
 
     def _phi_node_contains(self, phi_variable, variable):
         """