angr 9.2.117__py3-none-manylinux2014_aarch64.whl → 9.2.119__py3-none-manylinux2014_aarch64.whl

angr/analyses/typehoon/simple_solver.py

@@ -1,5 +1,5 @@
 # pylint:disable=missing-class-docstring
-from typing import DefaultDict
+from __future__ import annotations
 import enum
 from collections import defaultdict
 import logging
@@ -169,7 +169,7 @@ class Sketch:
         "solver",
     )
 
-    def __init__(self, solver: "SimpleSolver", root: TypeVariable):
+    def __init__(self, solver: SimpleSolver, root: TypeVariable):
         self.root: SketchNode = SketchNode(root)
         self.graph = networkx.DiGraph()
         self.node_mapping: dict[TypeVariable | DerivedTypeVariable, SketchNodeBase] = {}
@@ -298,46 +298,34 @@ class ConstraintGraphNode:
     def __hash__(self):
         return hash((ConstraintGraphNode, self.typevar, self.variance, self.tag, self.forgotten))
 
-    def forget_last_label(self) -> tuple["ConstraintGraphNode", BaseLabel] | None:
+    def forget_last_label(self) -> tuple[ConstraintGraphNode, BaseLabel] | None:
         if isinstance(self.typevar, DerivedTypeVariable) and self.typevar.labels:
             last_label = self.typevar.labels[-1]
             if len(self.typevar.labels) == 1:
                 prefix = self.typevar.type_var
             else:
                 prefix = DerivedTypeVariable(self.typevar.type_var, None, labels=self.typevar.labels[:-1])
-            if self.variance == last_label.variance:
-                variance = Variance.COVARIANT
-            else:
-                variance = Variance.CONTRAVARIANT
+            variance = Variance.COVARIANT if self.variance == last_label.variance else Variance.CONTRAVARIANT
             return (
                 ConstraintGraphNode(prefix, variance, self.tag, FORGOTTEN.PRE_FORGOTTEN),
                 self.typevar.labels[-1],
             )
         return None
 
-    def recall(self, label: BaseLabel) -> "ConstraintGraphNode":
+    def recall(self, label: BaseLabel) -> ConstraintGraphNode:
         if isinstance(self.typevar, DerivedTypeVariable):
-            labels = self.typevar.labels + (label,)
+            labels = (*self.typevar.labels, label)
             typevar = self.typevar.type_var
-        elif isinstance(self.typevar, TypeVariable):
-            labels = (label,)
-            typevar = self.typevar
-        elif isinstance(self.typevar, TypeConstant):
+        elif isinstance(self.typevar, (TypeVariable, TypeConstant)):
             labels = (label,)
             typevar = self.typevar
         else:
             raise TypeError(f"Unsupported type {type(self.typevar)}")
-        if self.variance == label.variance:
-            variance = Variance.COVARIANT
-        else:
-            variance = Variance.CONTRAVARIANT
-        if not labels:
-            var = typevar
-        else:
-            var = DerivedTypeVariable(typevar, None, labels=labels)
+        variance = Variance.COVARIANT if self.variance == label.variance else Variance.CONTRAVARIANT
+        var = typevar if not labels else DerivedTypeVariable(typevar, None, labels=labels)
         return ConstraintGraphNode(var, variance, self.tag, FORGOTTEN.PRE_FORGOTTEN)
 
-    def inverse(self) -> "ConstraintGraphNode":
+    def inverse(self) -> ConstraintGraphNode:
         if self.tag == ConstraintGraphTag.LEFT:
             tag = ConstraintGraphTag.RIGHT
         elif self.tag == ConstraintGraphTag.RIGHT:
@@ -345,21 +333,15 @@ class ConstraintGraphNode:
         else:
             tag = ConstraintGraphTag.UNKNOWN
 
-        if self.variance == Variance.COVARIANT:
-            variance = Variance.CONTRAVARIANT
-        else:
-            variance = Variance.COVARIANT
+        variance = Variance.CONTRAVARIANT if self.variance == Variance.COVARIANT else Variance.COVARIANT
 
         return ConstraintGraphNode(self.typevar, variance, tag, self.forgotten)
 
-    def inverse_wo_tag(self) -> "ConstraintGraphNode":
+    def inverse_wo_tag(self) -> ConstraintGraphNode:
         """
         Invert the variance only.
         """
-        if self.variance == Variance.COVARIANT:
-            variance = Variance.CONTRAVARIANT
-        else:
-            variance = Variance.COVARIANT
+        variance = Variance.CONTRAVARIANT if self.variance == Variance.COVARIANT else Variance.COVARIANT
 
         return ConstraintGraphNode(self.typevar, variance, self.tag, self.forgotten)
 
@@ -397,8 +379,13 @@ class SimpleSolver:
             if self._constraints[typevar]:
                 self._constraints[typevar] |= self._eq_constraints_from_add(typevar)
                 self._constraints[typevar] = self._handle_equivalence(typevar)
-        equ_classes, sketches, _ = self.solve()
+
         self.solution = {}
+        for tv, sol in self._equivalence.items():
+            if isinstance(tv, TypeVariable) and isinstance(sol, TypeConstant):
+                self.solution[tv] = sol
+
+        equ_classes, sketches, _ = self.solve()
         self._solution_cache = {}
         self.determine(equ_classes, sketches, self.solution)
         for typevar in list(self._constraints):
@@ -415,7 +402,16 @@ class SimpleSolver:
         - Apply constraints to derive the lower and upper bounds
         """
 
-        typevars = set(self._constraints) | self._typevars
+        prem_typevars = set(self._constraints) | self._typevars
+        typevars = set()
+        for tv in prem_typevars:
+            if tv not in self._equivalence:
+                typevars.add(tv)
+            else:
+                repl = self._equivalence[tv]
+                if isinstance(repl, TypeVariable):
+                    typevars.add(repl)
+
         constraints = set()
         for tv in typevars:
             if tv in self._constraints:
@@ -429,9 +425,8 @@ class SimpleSolver:
                     if isinstance(t, DerivedTypeVariable):
                         if t.type_var in typevars:
                             constrained_typevars.add(t.type_var)
-                    elif isinstance(t, TypeVariable):
-                        if t in typevars:
-                            constrained_typevars.add(t)
+                    elif isinstance(t, TypeVariable) and t in typevars:
+                        constrained_typevars.add(t)
 
         equivalence_classes, sketches = self.infer_shapes(typevars, constraints)
         # TODO: Handle global variables
@@ -681,7 +676,7 @@ class SimpleSolver:
                     graph.add_edge(ta, tb)
 
         for components in networkx.connected_components(graph):
-            components_lst = list(sorted(components, key=lambda x: str(x)))  # pylint:disable=unnecessary-lambda
+            components_lst = sorted(components, key=lambda x: str(x))  # pylint:disable=unnecessary-lambda
             representative = components_lst[0]
             for tv in components_lst[1:]:
                 replacements[tv] = representative
@@ -720,15 +715,21 @@ class SimpleSolver:
             if not isinstance(constraint, Existence):
                 continue
             inner = constraint.type_
-            if isinstance(inner, DerivedTypeVariable) and isinstance(inner.one_label(), IsArray):
-                if inner.type_var in self.solution:
-                    curr_type = self.solution[inner.type_var]
-                    if isinstance(curr_type, Pointer) and isinstance(curr_type.basetype, Struct):
-                        # replace all fields with the first field
-                        if 0 in curr_type.basetype.fields:
-                            first_field = curr_type.basetype.fields[0]
-                            for offset in curr_type.basetype.fields.keys():
-                                curr_type.basetype.fields[offset] = first_field
+            if (
+                isinstance(inner, DerivedTypeVariable)
+                and isinstance(inner.one_label(), IsArray)
+                and inner.type_var in self.solution
+            ):
+                curr_type = self.solution[inner.type_var]
+                if (
+                    isinstance(curr_type, Pointer)
+                    and isinstance(curr_type.basetype, Struct)
+                    and 0 in curr_type.basetype.fields
+                ):
+                    # replace all fields with the first field
+                    first_field = curr_type.basetype.fields[0]
+                    for offset in curr_type.basetype.fields:
+                        curr_type.basetype.fields[offset] = first_field
 
     #
     # Constraint graph
@@ -844,7 +845,7 @@ class SimpleSolver:
         """
         The saturation algorithm D.2 as described in Appendix of the retypd paper.
         """
-        R: DefaultDict[ConstraintGraphNode, set[tuple[BaseLabel, ConstraintGraphNode]]] = defaultdict(set)
+        R: defaultdict[ConstraintGraphNode, set[tuple[BaseLabel, ConstraintGraphNode]]] = defaultdict(set)
 
         # initialize the reaching-push sets R(x)
         for x, y, data in graph.edges(data=True):
@@ -916,9 +917,7 @@ class SimpleSolver:
     def _to_typevar_or_typeconst(obj: TypeVariable | DerivedTypeVariable | TypeConstant) -> TypeVariable | TypeConstant:
         if isinstance(obj, DerivedTypeVariable):
             return SimpleSolver._to_typevar_or_typeconst(obj.type_var)
-        elif isinstance(obj, TypeVariable):
-            return obj
-        elif isinstance(obj, TypeConstant):
+        if isinstance(obj, (TypeVariable, TypeConstant)):
             return obj
         raise TypeError(f"Unsupported type {type(obj)}")
 
@@ -982,12 +981,21 @@ class SimpleSolver:
         abstract_t2 = self.abstract(t2)
         if abstract_t1 in self._base_lattice and abstract_t2 in self._base_lattice:
             ancestor = networkx.lowest_common_ancestor(self._base_lattice, abstract_t1, abstract_t2)
+
+            if (
+                isinstance(ancestor, Pointer)
+                and isinstance(abstract_t1, Pointer)
+                and isinstance(abstract_t2, Pointer)
+                and isinstance(t1, Pointer)
+                and isinstance(t2, Pointer)
+            ):
+                return ancestor.__class__(self.join(t1.basetype, t2.basetype))
+
             if ancestor == abstract_t1:
                 return t1
-            elif ancestor == abstract_t2:
+            if ancestor == abstract_t2:
                 return t2
-            else:
-                return ancestor
+            return ancestor
         if t1 == Bottom_:
             return t2
         if t2 == Bottom_:
@@ -999,12 +1007,21 @@ class SimpleSolver:
         abstract_t2 = self.abstract(t2)
         if abstract_t1 in self._base_lattice_inverted and abstract_t2 in self._base_lattice_inverted:
             ancestor = networkx.lowest_common_ancestor(self._base_lattice_inverted, abstract_t1, abstract_t2)
+
+            if (
+                isinstance(ancestor, Pointer)
+                and isinstance(abstract_t1, Pointer)
+                and isinstance(abstract_t2, Pointer)
+                and isinstance(t1, Pointer)
+                and isinstance(t2, Pointer)
+            ):
+                return ancestor.__class__(self.meet(t1.basetype, t2.basetype))
+
             if ancestor == abstract_t1:
                 return t1
-            elif ancestor == abstract_t2:
+            if ancestor == abstract_t2:
                 return t2
-            else:
-                return ancestor
+            return ancestor
         if t1 == Top_:
             return t2
         if t2 == Top_:
@@ -1015,7 +1032,7 @@ class SimpleSolver:
     def abstract(t: TypeConstant | TypeVariable) -> TypeConstant | TypeVariable:
         if isinstance(t, Pointer32):
             return Pointer32()
-        elif isinstance(t, Pointer64):
+        if isinstance(t, Pointer64):
             return Pointer64()
         return t
 
@@ -1061,7 +1078,7 @@ class SimpleSolver:
                 cached_results.add(self._solution_cache[node.typevar])
         if len(cached_results) == 1:
             return next(iter(cached_results))
-        elif len(cached_results) > 1:
+        if len(cached_results) > 1:
             # we get nodes for multiple type variables?
             raise RuntimeError("Getting nodes for multiple type variables. Unexpected.")
 
@@ -1101,7 +1118,7 @@ class SimpleSolver:
             input_args = []
             output_values = []
             for vals, out in [(func_inputs, input_args), (func_outputs, output_values)]:
-                for idx in range(0, max(vals) + 1):
+                for idx in range(max(vals) + 1):
                     if idx in vals:
                         sol = self._determine(equivalent_classes, the_typevar, sketch, solution, nodes=vals[idx])
                         out.append(sol)
@@ -1158,9 +1175,8 @@ class SimpleSolver:
                 if isinstance(last_label, HasField):
                     for start_offset, sizes in candidate_bases.items():
                         for size in sizes:
-                            if last_label.offset > start_offset:
-                                if last_label.offset < start_offset + size:  # ???
-                                    node_to_base[succ] = start_offset
+                            if last_label.offset > start_offset and last_label.offset < start_offset + size:  # ???
+                                node_to_base[succ] = start_offset
 
             node_by_offset = defaultdict(set)
 
@@ -1241,7 +1257,7 @@ class SimpleSolver:
                     continue
                 if isinstance(label, IsArray):
                     continue
-                new_labels = curr_labels + [label]
+                new_labels = [*curr_labels, label]
                 succ: SketchNode
                 if isinstance(succ.typevar, DerivedTypeVariable) and isinstance(succ.typevar.labels[-1], (Load, Store)):
                     queue.append((new_labels, succ))
@@ -1253,6 +1269,6 @@ class SimpleSolver:
     def _pointer_class(self) -> type[Pointer32] | type[Pointer64]:
         if self.bits == 32:
             return Pointer32
-        elif self.bits == 64:
+        if self.bits == 64:
             return Pointer64
         raise NotImplementedError("Unsupported bits %d" % self.bits)

angr/analyses/typehoon/translator.py

@@ -1,3 +1,5 @@
+# pylint:disable=unused-argument,no-self-use
+from __future__ import annotations
 from itertools import count
 
 from ... import sim_type
@@ -7,11 +9,15 @@ from .typeconsts import TypeConstant
 
 
 class SimTypeTempRef(sim_type.SimType):
+    """
+    Represents a temporary reference to another type. TypeVariableReference is translated to SimTypeTempRef.
+    """
+
     def __init__(self, typevar):
         super().__init__()
         self.typevar = typevar
 
-    def c_repr(self):
+    def c_repr(self, **kwargs):
         return "<SimTypeTempRef>"
 
 
@@ -55,8 +61,7 @@ class TypeTranslator:
         except KeyError:
             return sim_type.SimTypeBottom().with_arch(self.arch)
 
-        translated = handler(self, tc)
-        return translated
+        return handler(self, tc)
 
     def simtype2tc(self, simtype: sim_type.SimType) -> typeconsts.TypeConstant:
         return self._simtype2tc(simtype)
@@ -98,10 +103,7 @@ class TypeTranslator:
         if tc in self.structs:
             return self.structs[tc]
 
-        if tc.name:
-            name = tc.name
-        else:
-            name = self.struct_name()
+        name = tc.name if tc.name else self.struct_name()
 
         s = sim_type.SimStruct({}, name=name).with_arch(self.arch)
         self.structs[tc] = s
@@ -111,7 +113,7 @@ class TypeTranslator:
             if offset > next_offset:
                 # we need padding!
                 padding_size = offset - next_offset
-                s.fields["padding_%x" % next_offset] = sim_type.SimTypeFixedSizeArray(
+                s.fields[f"padding_{next_offset:x}"] = sim_type.SimTypeFixedSizeArray(
                     sim_type.SimTypeChar(signed=False).with_arch(self.arch), padding_size
                 ).with_arch(self.arch)
 
@@ -121,10 +123,7 @@ class TypeTranslator:
                 # for now, we replace it with an unsigned char
                 translated_type = sim_type.SimTypeChar(signed=False).with_arch(self.arch)
 
-            if tc.field_names and offset in tc.field_names:
-                field_name = tc.field_names[offset]
-            else:
-                field_name = f"field_{offset:x}"
+            field_name = tc.field_names[offset] if tc.field_names and offset in tc.field_names else f"field_{offset:x}"
             s.fields[field_name] = translated_type
 
             if isinstance(translated_type, SimTypeTempRef):
@@ -147,7 +146,10 @@ class TypeTranslator:
         return sim_type.SimTypeLongLong(signed=False).with_arch(self.arch)
 
     def _translate_Int128(self, tc):  # pylint:disable=unused-argument
-        return sim_type.SimTypeNum(128, signed=False).with_arch(self.arch)
+        return sim_type.SimTypeInt128(signed=False).with_arch(self.arch)
+
+    def _translate_Int256(self, tc):  # pylint:disable=unused-argument
+        return sim_type.SimTypeInt256(signed=False).with_arch(self.arch)
 
     def _translate_TypeVariableReference(self, tc):
         if tc.typevar in self.translated:
@@ -182,6 +184,12 @@ class TypeTranslator:
     # SimType handlers
     #
 
+    def _translate_SimTypeInt128(self, st: sim_type.SimTypeChar) -> typeconsts.Int128:
+        return typeconsts.Int128()
+
+    def _translate_SimTypeInt256(self, st: sim_type.SimTypeChar) -> typeconsts.Int256:
+        return typeconsts.Int256()
+
     def _translate_SimTypeInt(self, st: sim_type.SimTypeInt) -> typeconsts.Int32:
         return typeconsts.Int32()
 
@@ -205,14 +213,13 @@ class TypeTranslator:
 
     def _translate_SimTypeArray(self, st: sim_type.SimTypeArray) -> typeconsts.Array:
         elem_type = self._simtype2tc(st.elem_type)
-        array_tc = typeconsts.Array(elem_type, count=st.length)
-        return array_tc
+        return typeconsts.Array(elem_type, count=st.length)
 
     def _translate_SimTypePointer(self, st: sim_type.SimTypePointer) -> typeconsts.Pointer32 | typeconsts.Pointer64:
         base = self._simtype2tc(st.pts_to)
         if self.arch.bits == 32:
             return typeconsts.Pointer32(base)
-        elif self.arch.bits == 64:
+        if self.arch.bits == 64:
             return typeconsts.Pointer64(base)
         raise TypeError("Unsupported pointer size %d" % self.arch.bits)
 
@@ -227,6 +234,7 @@ TypeConstHandlers = {
     typeconsts.Int32: TypeTranslator._translate_Int32,
     typeconsts.Int64: TypeTranslator._translate_Int64,
     typeconsts.Int128: TypeTranslator._translate_Int128,
+    typeconsts.Int256: TypeTranslator._translate_Int256,
     typeconsts.TypeVariableReference: TypeTranslator._translate_TypeVariableReference,
 }
 
@@ -237,6 +245,8 @@ SimTypeHandlers = {
     sim_type.SimTypeLong: TypeTranslator._translate_SimTypeLong,
     sim_type.SimTypeLongLong: TypeTranslator._translate_SimTypeLongLong,
     sim_type.SimTypeChar: TypeTranslator._translate_SimTypeChar,
+    sim_type.SimTypeInt128: TypeTranslator._translate_SimTypeInt128,
+    sim_type.SimTypeInt256: TypeTranslator._translate_SimTypeInt256,
     sim_type.SimStruct: TypeTranslator._translate_SimStruct,
     sim_type.SimTypeArray: TypeTranslator._translate_SimTypeArray,
 }

angr/analyses/typehoon/typeconsts.py

@@ -2,6 +2,7 @@
 """
 All type constants used in type inference. They can be mapped, translated, or rewritten to C-style types.
 """
+from __future__ import annotations
 
 import functools
 
@@ -9,10 +10,7 @@ import functools
 def memoize(f):
     @functools.wraps(f)
     def wrapped_repr(self, *args, **kwargs):
-        if not kwargs or "memo" not in kwargs:
-            memo = set()
-        else:
-            memo = kwargs.pop("memo")
+        memo = set() if not kwargs or "memo" not in kwargs else kwargs.pop("memo")
         if self in memo:
             return "..."
         memo.add(self)
@@ -41,11 +39,11 @@ class TypeConstant:
     @property
     def size(self) -> int:
         if self.SIZE is None:
-            raise NotImplementedError()
+            raise NotImplementedError
         return self.SIZE
 
     def __repr__(self, memo=None):
-        raise NotImplementedError()
+        raise NotImplementedError
 
 
 class TopType(TypeConstant):
@@ -102,6 +100,13 @@ class Int128(Int):
         return "int128"
 
 
+class Int256(Int):
+    SIZE = 32
+
+    def __repr__(self, memo=None):
+        return "int256"
+
+
 class FloatBase(TypeConstant):
     def __repr__(self, memo=None):
         return "floatbase"
@@ -176,9 +181,8 @@ class Array(TypeConstant):
     @memoize
     def __repr__(self, memo=None):
         if self.count is None:
-            return "%r[?]" % self.element
-        else:
-            return "%r[%d]" % (self.element, self.count)
+            return f"{self.element!r}[?]"
+        return "%r[%d]" % (self.element, self.count)
 
     def __eq__(self, other):
         return type(other) is type(self) and self.element == other.element and self.count == other.count
@@ -215,7 +219,12 @@ class Struct(TypeConstant):
         prefix = "struct"
         if self.name:
             prefix = f"struct {self.name}"
-        return prefix + "{" + ", ".join(f"{k}:{v.__repr__(memo=memo)}" for k, v in self.fields.items()) + "}"
+        return (
+            prefix
+            + "{"
+            + ", ".join(f"{k}:{v.__repr__(memo=memo) if v is not None else 'None'}" for k, v in self.fields.items())
+            + "}"
+        )
 
     def __eq__(self, other):
         return type(other) is type(self) and hash(self) == hash(other)
@@ -258,7 +267,7 @@ class TypeVariableReference(TypeConstant):
         self.typevar = typevar
 
     def __repr__(self, memo=None):
-        return "ref(%s)" % self.typevar
+        return f"ref({self.typevar})"
 
     def __eq__(self, other):
         return type(other) is type(self) and self.typevar == other.typevar
@@ -280,6 +289,7 @@ def int_type(bits: int) -> Int | None:
         32: Int32,
         64: Int64,
         128: Int128,
+        256: Int256,
     }
     if bits in mapping:
         return mapping[bits]()
@@ -289,6 +299,6 @@ def int_type(bits: int) -> Int | None:
 def float_type(bits: int) -> FloatBase | None:
     if bits == 32:
         return Float()
-    elif bits == 64:
+    if bits == 64:
         return Double()
     return None

angr/analyses/typehoon/typehoon.py

@@ -1,4 +1,5 @@
 # pylint:disable=bad-builtin
+from __future__ import annotations
 from typing import TYPE_CHECKING
 
 from ...sim_type import SimStruct, SimTypePointer, SimTypeArray
@@ -34,8 +35,8 @@ class Typehoon(Analysis):
         constraints,
         func_var,
         ground_truth=None,
-        var_mapping: dict["SimVariable", set["TypeVariable"]] | None = None,
-        must_struct: set["TypeVariable"] | None = None,
+        var_mapping: dict[SimVariable, set[TypeVariable]] | None = None,
+        must_struct: set[TypeVariable] | None = None,
     ):
         """
 
@@ -46,9 +47,9 @@ class Typehoon(Analysis):
         :param must_struct:
         """
 
-        self.func_var: "TypeVariable" = func_var
-        self._constraints: dict["TypeVariable", set["TypeConstraint"]] = constraints
-        self._ground_truth: dict["TypeVariable", "SimType"] | None = ground_truth
+        self.func_var: TypeVariable = func_var
+        self._constraints: dict[TypeVariable, set[TypeConstraint]] = constraints
+        self._ground_truth: dict[TypeVariable, SimType] | None = ground_truth
         self._var_mapping = var_mapping
         self._must_struct = must_struct
 
@@ -123,10 +124,7 @@ class Typehoon(Analysis):
         print(f"### {len(self.solution)} solutions")
         for typevar in sorted(self.solution.keys(), key=str):
             sol = self.solution[typevar]
-            if typevar in typevar_to_var:
-                var_and_typevar = f"{typevar_to_var[typevar]} ({typevar})"
-            else:
-                var_and_typevar = typevar
+            var_and_typevar = f"{typevar_to_var[typevar]} ({typevar})" if typevar in typevar_to_var else typevar
             print(f"    {var_and_typevar} -> {sol}")
         print("### end of solutions ###")
 
@@ -190,7 +188,7 @@ class Typehoon(Analysis):
             return tc.new(specialized)
 
         if isinstance(tc, Struct) and tc.fields and min(tc.fields) >= 0:
-            offsets: list[int] = sorted(list(tc.fields.keys()))  # get a sorted list of offsets
+            offsets: list[int] = sorted(tc.fields.keys())  # get a sorted list of offsets
             offset0 = offsets[0]
             field0: TypeConstant = tc.fields[offset0]