angr 9.2.117__py3-none-manylinux2014_x86_64.whl → 9.2.118__py3-none-manylinux2014_x86_64.whl

angr/analyses/decompiler/optimization_passes/optimization_pass.py

@@ -1,4 +1,5 @@
 # pylint:disable=unused-argument
+from __future__ import annotations
 import logging
 from typing import TYPE_CHECKING
 from collections.abc import Generator
@@ -12,11 +13,12 @@ from angr.analyses.decompiler.condition_processor import ConditionProcessor
 from angr.analyses.decompiler.goto_manager import GotoManager
 from angr.analyses.decompiler.structuring import RecursiveStructurer, SAILRStructurer
 from angr.analyses.decompiler.utils import add_labels
-from angr.analyses.decompiler.seq_cf_structure_counter import ControlFlowStructureCounter
+from angr.analyses.decompiler.counters import ControlFlowStructureCounter
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.functions import Function
 
+
 _l = logging.getLogger(__name__)
 
 
@@ -41,13 +43,14 @@ class OptimizationPassStage(Enum):
     """
 
     AFTER_AIL_GRAPH_CREATION = 0
-    AFTER_SINGLE_BLOCK_SIMPLIFICATION = 1
-    AFTER_MAKING_CALLSITES = 2
-    AFTER_GLOBAL_SIMPLIFICATION = 3
-    AFTER_VARIABLE_RECOVERY = 4
-    BEFORE_REGION_IDENTIFICATION = 5
-    DURING_REGION_IDENTIFICATION = 6
-    AFTER_STRUCTURING = 7
+    BEFORE_SSA_LEVEL0_TRANSFORMATION = 1
+    AFTER_SINGLE_BLOCK_SIMPLIFICATION = 2
+    AFTER_MAKING_CALLSITES = 3
+    AFTER_GLOBAL_SIMPLIFICATION = 4
+    AFTER_VARIABLE_RECOVERY = 5
+    BEFORE_REGION_IDENTIFICATION = 6
+    DURING_REGION_IDENTIFICATION = 7
+    AFTER_STRUCTURING = 8
 
 
 class BaseOptimizationPass:
@@ -63,7 +66,7 @@ class BaseOptimizationPass:
     DESCRIPTION = "N/A"
 
     def __init__(self, func):
-        self._func: "Function" = func
+        self._func: Function = func
 
     @property
     def project(self):
@@ -85,7 +88,7 @@ class BaseOptimizationPass:
         :returns: a tuple of (does_apply, cache) where cache is a way to pass
                   information to _analyze so it does not have to be recalculated
         """
-        raise NotImplementedError()
+        raise NotImplementedError
 
     def _analyze(self, cache=None):
         """
@@ -95,16 +98,24 @@ class BaseOptimizationPass:
                       recalculated
         :returns: None
         """
-        raise NotImplementedError()
+        raise NotImplementedError
 
     def _simplify_graph(self, graph):
-        simp = self.project.analyses.AILSimplifier(
-            self._func,
-            func_graph=graph,
-            use_callee_saved_regs_at_return=False,
-            gp=self._func.info.get("gp", None) if self.project.arch.name in {"MIPS32", "MIPS64"} else None,
-        )
-        return simp.func_graph if simp.simplified else graph
+        MAX_SIMP_ITERATION = 8
+        for _ in range(MAX_SIMP_ITERATION):
+            simp = self.project.analyses.AILSimplifier(
+                self._func,
+                func_graph=graph,
+                use_callee_saved_regs_at_return=False,
+                gp=self._func.info.get("gp", None) if self.project.arch.name in {"MIPS32", "MIPS64"} else None,
+            )
+            if simp.simplified:
+                graph = simp.func_graph
+            else:
+                break
+        else:
+            _l.warning("Failed to reach fixed point after %s simplification iterations.", MAX_SIMP_ITERATION)
+        return graph
 
     def _recover_regions(self, graph: networkx.DiGraph, condition_processor=None, update_graph: bool = False):
         return self.project.analyses[RegionIdentifier].prep(kb=self.kb)(
@@ -132,6 +143,7 @@ class OptimizationPass(BaseOptimizationPass):
         variable_kb=None,
         region_identifier=None,
         reaching_definitions=None,
+        vvar_id_start=None,
         **kwargs,
     ):
         super().__init__(func)
@@ -143,6 +155,7 @@ class OptimizationPass(BaseOptimizationPass):
         self._ri = region_identifier
         self._rd = reaching_definitions
         self._new_block_addrs = set()
+        self.vvar_id_start = vvar_id_start
 
         # output
         self.out_graph: networkx.DiGraph | None = None
@@ -165,30 +178,26 @@ class OptimizationPass(BaseOptimizationPass):
 
         :return:    The block address.
         """
-        if self._new_block_addrs:
-            new_addr = max(self._new_block_addrs) + 1
-        else:
-            new_addr = max(self.blocks_by_addr) + 2048
+        new_addr = max(self._new_block_addrs) + 1 if self._new_block_addrs else max(self.blocks_by_addr) + 2048
         self._new_block_addrs.add(new_addr)
         return new_addr
 
     def _get_block(self, addr, idx=None) -> ailment.Block | None:
         if not self._blocks_by_addr:
             return None
+        if idx is None:
+            blocks = self._blocks_by_addr.get(addr, None)
         else:
-            if idx is None:
-                blocks = self._blocks_by_addr.get(addr, None)
-            else:
-                blocks = [self._blocks_by_addr_and_idx.get((addr, idx), None)]
-            if not blocks:
-                return None
-            if len(blocks) == 1:
-                return next(iter(blocks))
-            raise MultipleBlocksException(
-                "There are %d blocks at address %#x.%s but only one is requested." % (len(blocks), addr, idx)
-            )
+            blocks = [self._blocks_by_addr_and_idx.get((addr, idx), None)]
+        if not blocks:
+            return None
+        if len(blocks) == 1:
+            return next(iter(blocks))
+        raise MultipleBlocksException(
+            "There are %d blocks at address %#x.%s but only one is requested." % (len(blocks), addr, idx)
+        )
 
-    def _get_blocks(self, addr, idx=None) -> Generator[ailment.Block, None, None]:
+    def _get_blocks(self, addr, idx=None) -> Generator[ailment.Block]:
         if not self._blocks_by_addr:
             return
         else:
@@ -289,6 +298,7 @@ class StructuringOptimizationPass(OptimizationPass):
         max_opt_iters=1,
         simplify_ail=True,
         require_gotos=True,
+        readd_labels=False,
         **kwargs,
     ):
         super().__init__(func, **kwargs)
@@ -299,7 +309,9 @@ class StructuringOptimizationPass(OptimizationPass):
         self._simplify_ail = simplify_ail
         self._require_gotos = require_gotos
         self._must_improve_rel_quality = must_improve_rel_quality
+        self._readd_labels = readd_labels
 
+        self._initial_gotos = None
         self._goto_manager: GotoManager | None = None
         self._prev_graph: networkx.DiGraph | None = None
 
@@ -308,7 +320,7 @@ class StructuringOptimizationPass(OptimizationPass):
         self._current_structure_counter = None
 
     def _analyze(self, cache=None) -> bool:
-        raise NotImplementedError()
+        raise NotImplementedError
 
     def analyze(self):
         """
@@ -317,8 +329,8 @@ class StructuringOptimizationPass(OptimizationPass):
         if not self._graph_is_structurable(self._graph, initial=True):
             return
 
-        initial_gotos = self._goto_manager.gotos.copy()
-        if self._require_gotos and not initial_gotos:
+        self._initial_gotos = self._goto_manager.gotos.copy()
+        if self._require_gotos and not self._initial_gotos:
             return
 
         # replace the normal check in OptimizationPass.analyze()
@@ -339,7 +351,11 @@ class StructuringOptimizationPass(OptimizationPass):
         if self.out_graph is None:
             return
 
-        if not self._graph_is_structurable(self.out_graph):
+        # since all checks have completed, add labels back out here
+        if self._readd_labels:
+            self.out_graph = add_labels(self.out_graph)
+
+        if not self._graph_is_structurable(self.out_graph, readd_labels=False):
             self.out_graph = None
             return
 
@@ -349,8 +365,8 @@ class StructuringOptimizationPass(OptimizationPass):
             self.out_graph = self._simplify_graph(self.out_graph)
 
         if self._prevent_new_gotos:
-            prev_gotos = len(initial_gotos)
-            new_gotos = len(self._goto_manager.gotos)
+            prev_gotos = len(self._initial_gotos)
+            new_gotos = len(self._get_new_gotos())
             if (self._strictly_less_gotos and (new_gotos >= prev_gotos)) or (
                 not self._strictly_less_gotos and (new_gotos > prev_gotos)
             ):
@@ -361,7 +377,11 @@ class StructuringOptimizationPass(OptimizationPass):
             self.out_graph = None
             return
 
+    def _get_new_gotos(self):
+        return self._goto_manager.gotos
+
     def _fixed_point_analyze(self, cache=None):
+        had_any_changes = False
         for _ in range(self._max_opt_iters):
             if self._require_gotos and not self._goto_manager.gotos:
                 break
@@ -375,10 +395,17 @@ class StructuringOptimizationPass(OptimizationPass):
             if not changes:
                 break
 
+            had_any_changes = True
             # check if the graph is structurable
-            if not self._graph_is_structurable(self.out_graph):
-                self.out_graph = self._prev_graph if self._recover_structure_fails else None
-                break
+            if not self._graph_is_structurable(self.out_graph, readd_labels=self._readd_labels):
+                if self._recover_structure_fails:
+                    self.out_graph = self._prev_graph
+                else:
+                    self.out_graph = None
+                    break
+
+        if not had_any_changes:
+            self.out_graph = None
 
     def _graph_is_structurable(self, graph, readd_labels=False, initial=False) -> bool:
         """
@@ -445,10 +472,9 @@ class StructuringOptimizationPass(OptimizationPass):
 
     def _improves_relative_quality(self) -> bool:
         """
-        Checks if the new structured output improves (or maintains) the relative quality of the control flow structures
-        present in the function.
-
-        For now, this only involves loops
+        Welcome to the unprincipled land of mahaloz. This function is a heuristic that tries to determine if the
+        optimization pass improved the relative quality of the control flow structures in the function. These heuristics
+        are based on mahaloz's observations of what bad code looks like.
         """
         if self._initial_structure_counter is None or self._current_structure_counter is None:
             _l.warning("Relative quality check failed due to missing structure counters")
@@ -471,4 +497,39 @@ class StructuringOptimizationPass(OptimizationPass):
         if curr_floops < prev_floops and total_curr_loops == total_prev_loops:
             return False
 
+        # Gotos play an important part in readability and control flow structure. We already count gotos in other parts
+        # of the analysis, so we don't need to count them here. However, some gotos are worse than others. Much
+        # like loops, trading gotos (keeping the same total, but getting worse types), is bad for decompilation.
+        if len(self._initial_gotos) == len(self._goto_manager.gotos) != 0:
+            prev_labels = self._initial_structure_counter.goto_targets
+            curr_labels = self._current_structure_counter.goto_targets
+
+            # 1. We traded gotos, but we increased the number of labels, which is generally worse
+            if len(curr_labels) > len(prev_labels):
+                return False
+
+            ordered_curr_labels = self._current_structure_counter.ordered_labels
+
+            # 2. We trade for a goto that occurs higher in the program (much like a back edge goto), these are bad
+            for addr, curr_cnt in curr_labels.items():
+                prev_cnt = prev_labels.get(addr, 0)
+                # some label increased in gotos, check everything to the right in ordered labels, if it went down,
+                # then we fail
+                if curr_cnt > prev_cnt:
+                    right_labels = ordered_curr_labels[ordered_curr_labels.index(addr) + 1 :]
+                    for right_label in right_labels:
+                        right_curr_label_cnt = curr_labels[right_label]
+                        right_prev_label_cnt = prev_labels.get(right_label, 0)
+                        if right_curr_label_cnt < right_prev_label_cnt:
+                            return False
+
+                # some label decreased in gotos, check everything to the left, if something went up, then we fail
+                elif curr_cnt < prev_cnt:
+                    left_labels = ordered_curr_labels[: ordered_curr_labels.index(addr)]
+                    for left_label in left_labels:
+                        left_curr_label_cnt = curr_labels[left_label]
+                        left_prev_label_cnt = prev_labels.get(left_label, 0)
+                        if left_curr_label_cnt > left_prev_label_cnt:
+                            return False
+
         return True

angr/analyses/decompiler/optimization_passes/register_save_area_simplifier.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from collections.abc import Iterable
 import logging
 
@@ -21,6 +22,9 @@ def s2u(s, bits):
 class RegisterSaveAreaSimplifier(OptimizationPass):
     """
     Optimizes away register spilling effects, including callee-saved registers.
+
+    This optimization runs between SSA-level0 and SSA-level1, which means registers are converted to vvars but stack
+    accesses stay unchanged.
     """
 
     ARCHES = None
@@ -52,7 +56,7 @@ class RegisterSaveAreaSimplifier(OptimizationPass):
 
     @staticmethod
     def _modify_statement(
-        old_block, stmt_idx_: int, updated_blocks_, stack_offset: int = None
+        old_block, stmt_idx_: int, updated_blocks_, stack_offset: int | None = None
     ):  # pylint:disable=unused-argument
         if old_block not in updated_blocks_:
             block = old_block.copy()
@@ -95,7 +99,9 @@ class RegisterSaveAreaSimplifier(OptimizationPass):
             if (
                 isinstance(stmt, ailment.Stmt.Store)
                 and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
-                and isinstance(stmt.data, ailment.Expr.Register)
+                and isinstance(stmt.addr.offset, int)
+                and isinstance(stmt.data, ailment.Expr.VirtualVariable)
+                and stmt.data.was_reg
             ):
                 # it's storing registers to the stack!
                 stack_offset = stmt.addr.offset
@@ -113,7 +119,8 @@ class RegisterSaveAreaSimplifier(OptimizationPass):
                 for idx, stmt in enumerate(block.statements):
                     if (
                         isinstance(stmt, ailment.Stmt.Assignment)
-                        and isinstance(stmt.dst, ailment.Expr.Register)
+                        and isinstance(stmt.dst, ailment.Expr.VirtualVariable)
+                        and stmt.dst.was_reg
                         and isinstance(stmt.src, ailment.Expr.Load)
                         and isinstance(stmt.src.addr, ailment.Expr.StackBaseOffset)
                     ):

angr/analyses/decompiler/optimization_passes/ret_addr_save_simplifier.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from typing import Any
 import logging
 
@@ -162,11 +163,9 @@ class RetAddrSaveSimplifier(OptimizationPass):
                     if endpoint.addr not in callouts_and_jumpouts:
                         _l.debug("Could not find retaddr restoring statement in function %#x.", endpoint.addr)
                         return None
-                    else:
-                        _l.debug(
-                            "No retaddr restoring statement is found at callout/jumpout site %#x. "
-                            "Might be expected.",
-                            endpoint.addr,
-                        )
+                    _l.debug(
+                        "No retaddr restoring statement is found at callout/jumpout site %#x. Might be expected.",
+                        endpoint.addr,
+                    )
 
         return retaddr_restore_stmts

angr/analyses/decompiler/optimization_passes/ret_deduplicator.py

@@ -1,4 +1,5 @@
 # pylint:disable=unnecessary-pass
+from __future__ import annotations
 import logging
 
 from ailment import Block
@@ -61,7 +62,7 @@ class ReturnDeduplicator(OptimizationPass):
              D
 
 
-        The super blocks of the true and falst child will be used as the replacement for the true and false child
+        The super blocks of the true and false child will be used as the replacement for the true and false child
         to assure correctness.
         """
 
@@ -205,7 +206,7 @@ class ReturnDeduplicator(OptimizationPass):
         for super_blocks in if_ret_candidates:
             corrected_region = []
             for super_block in super_blocks:
-                block = super_block_map.get(super_block, None)
+                block = super_block_map.get(super_block)
                 if block is None:
                     break
 

angr/analyses/decompiler/optimization_passes/return_duplicator_base.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from typing import Any
 from itertools import count
 import copy
@@ -6,10 +7,11 @@ import logging
 import ailment.expression
 import networkx
 
-from ailment import Block
+from ailment import Block, AILBlockWalker
 from ailment.statement import Jump, ConditionalJump, Assignment, Return, Label
-from ailment.expression import Const
+from ailment.expression import Const, Phi, VirtualVariable
 
+from angr.utils.ail import is_phi_assignment
 from ..condition_processor import ConditionProcessor, EmptyBlockNotice
 from ..graph_region import GraphRegion
 from ..utils import remove_labels, to_ail_supergraph, calls_in_graph
@@ -19,6 +21,53 @@ from ..region_identifier import RegionIdentifier
 _l = logging.getLogger(name=__name__)
 
 
+class FreshVirtualVariableRewriter(AILBlockWalker):
+    """
+    Helper class to rewrite virtual variables so that they will use fresh virtual variables.
+    """
+
+    def __init__(self, vvar_id_start: int, vvar_mapping: dict[int, int]):
+        super().__init__()
+        self.vvar_idx = vvar_id_start
+        self.vvar_mapping = vvar_mapping
+        self.new_block = None
+
+    def _handle_Assignment(self, stmt_idx: int, stmt: Assignment, block: Block | None):
+        new_stmt = super()._handle_Assignment(stmt_idx, stmt, block)
+        dst = new_stmt.dst if new_stmt is not None else stmt.dst
+        if isinstance(dst, VirtualVariable):
+            self.vvar_mapping[dst.varid] = self.vvar_idx
+            self.vvar_idx += 1
+
+            dst = VirtualVariable(dst.idx, self.vvar_mapping[dst.varid], dst.bits, dst.category, dst.oident, **dst.tags)
+
+            return Assignment(stmt.idx, dst, stmt.src, **stmt.tags)
+
+        return new_stmt
+
+    def _handle_VirtualVariable(self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt, block: Block | None):
+        if expr.varid in self.vvar_mapping:
+            return VirtualVariable(
+                expr.idx,
+                self.vvar_mapping[expr.varid],
+                expr.bits,
+                expr.category,
+                expr.oident,
+                variable=expr.variable,
+                variable_offset=expr.variable_offset,
+                **expr.tags,
+            )
+        return None
+
+    def _handle_stmt(self, stmt_idx: int, stmt, block: Block):
+        r = super()._handle_stmt(stmt_idx, stmt, block)
+        if r is not None:
+            # replace the original statement
+            if self.new_block is None:
+                self.new_block = block.copy()
+            self.new_block.statements[stmt_idx] = r
+
+
 class ReturnDuplicatorBase:
     """
     The base class for implementing Return Duplication as described in the SAILR paper.
@@ -33,6 +82,7 @@ class ReturnDuplicatorBase:
         max_calls_in_regions: int = 2,
         minimize_copies_for_regions: bool = True,
         ri: RegionIdentifier | None = None,
+        vvar_id_start: int | None = None,
         **kwargs,
     ):
         self.node_idx = count(start=node_idx_start)
@@ -43,13 +93,14 @@ class ReturnDuplicatorBase:
         # this should also be set by the optimization passes initer
         self._func = func
         self._ri: RegionIdentifier | None = ri
+        self.vvar_id_start = vvar_id_start
 
     #
     # must implement these methods
     #
 
     def _should_duplicate_dst(self, src, dst, graph, dst_is_const_ret=False) -> bool:
-        raise NotImplementedError()
+        raise NotImplementedError
 
     #
     # main analysis
@@ -144,14 +195,19 @@ class ReturnDuplicatorBase:
 
     def _copy_region(self, pred_nodes, region_head, region, graph):
         # copy the entire return region
-        copies = {}
+        copies: dict[Block, Block] = {}
         queue = [(pred_node, region_head) for pred_node in pred_nodes]
+        vvar_mapping: dict[int, int] = {}
         while queue:
             pred, node = queue.pop(0)
             if node in copies:
                 node_copy = copies[node]
             else:
-                node_copy = copy.deepcopy(node)
+                if node is region_head:
+                    node_copy = self._copy_node_and_update_phi_variables(node, pred)
+                else:
+                    node_copy = copy.deepcopy(node)
+                node_copy = self._use_fresh_virtual_variables(node_copy, vvar_mapping)
                 node_copy.idx = next(self.node_idx)
                 self._fix_copied_node_labels(node_copy)
                 copies[node] = node_copy
@@ -177,6 +233,52 @@ class ReturnDuplicatorBase:
         for pred_node in pred_nodes:
             # delete the old edge to the return node
             graph.remove_edge(pred_node, region_head)
+            # update phi variables at the beginning of region_head
+            self._update_phi_variables_after_removing_predecessor(region_head, pred_node)
+
+    @staticmethod
+    def _copy_node_and_update_phi_variables(node: Block, pred: Block) -> Block:
+        stmts = []
+        for stmt in node.statements:
+            if isinstance(stmt, Assignment) and isinstance(stmt.src, Phi) and isinstance(stmt.dst, VirtualVariable):
+                # pick the variable from the correct source
+                vvar_src = next(iter(vvar for src, vvar in stmt.src.src_and_vvars if src == (pred.addr, pred.idx)), ...)
+                if vvar_src is ...:
+                    _l.warning(
+                        "Cannot find the virtual variable in Phi expression %r that corresponds with node %#x-%s.",
+                        stmt.src,
+                        pred.addr,
+                        pred.idx,
+                    )
+                elif vvar_src is None:
+                    # not used in this branch. drop this statement
+                    continue
+                else:
+                    phi_var = Phi(stmt.src.idx, stmt.src.bits, [((pred.addr, pred.idx), vvar_src)], **stmt.src.tags)
+                    new_stmt = Assignment(stmt.idx, stmt.dst, phi_var, **stmt.tags)
+                    stmts.append(new_stmt)
+                    continue
+            stmts.append(stmt)
+
+        return Block(node.addr, node.original_size, statements=stmts, idx=node.idx)
+
+    @staticmethod
+    def _update_phi_variables_after_removing_predecessor(node: Block, pred: Block) -> None:
+        for idx in range(len(node.statements)):  # pylint:disable=consider-using-enumerate
+            stmt = node.statements[idx]
+            if isinstance(stmt, Assignment) and isinstance(stmt.src, Phi) and isinstance(stmt.dst, VirtualVariable):
+                # remove the variable from the specified source
+                new_src_and_vvars = [
+                    (src, vvar) for src, vvar in stmt.src.src_and_vvars if src != (pred.addr, pred.idx)
+                ]
+                new_phi = Phi(stmt.src.idx, stmt.src.bits, new_src_and_vvars, **stmt.src.tags)
+                node.statements[idx] = Assignment(stmt.idx, stmt.dst, new_phi, **stmt.tags)
+
+    def _use_fresh_virtual_variables(self, node: Block, vvar_map: dict[int, int]) -> Block:
+        rewriter = FreshVirtualVariableRewriter(self.vvar_id_start, vvar_map)
+        rewriter.walk(node)
+        self.vvar_id_start = rewriter.vvar_idx + 1
+        return rewriter.new_block if rewriter.new_block is not None else node
 
     def _copy_connected_edge_components(
         self, endnode_regions: dict[Any, tuple[list[tuple[Any, Any]], networkx.DiGraph]], graph: networkx.DiGraph
@@ -276,7 +378,7 @@ class ReturnDuplicatorBase:
                 return False
 
         # gather all assignments
-        assignments = [s for s in stmts if isinstance(s, Assignment)]
+        assignments = [s for s in stmts if isinstance(s, Assignment) and not is_phi_assignment(s)]
         has_assign = len(assignments) > 0
         if len(assignments) > max_assigns:
             return False
@@ -293,7 +395,11 @@ class ReturnDuplicatorBase:
         if ret_exprs and len(ret_exprs) > 1:
             return False
 
-        ret_expr = ret_exprs[0] if ret_exprs and len(ret_exprs) == 1 else None
+        ret_expr = ReturnDuplicatorBase.unwrap_conv(ret_exprs[0]) if ret_exprs and len(ret_exprs) == 1 else None
+        # check if ret_expr is a virtual variable or not
+        if not isinstance(ret_expr, (VirtualVariable, Const)):
+            return False
+
         # stop early if there are no assignments at all and just jumps and rets, or a const ret
         if not has_assign:
             return True
@@ -305,9 +411,11 @@ class ReturnDuplicatorBase:
         # assignments to registers from the stack are valid, since cases of these assignments
         # pop up across optimized binaries
         elif (
-            isinstance(assign.dst, ailment.expression.Register)
-            and isinstance(assign.src, ailment.expression.Load)
-            and isinstance(assign.src.addr, ailment.expression.StackBaseOffset)
+            isinstance(assign.dst, ailment.expression.VirtualVariable)
+            and assign.dst.was_reg
+            and isinstance(assign.src, ailment.expression.VirtualVariable)
+            and assign.src.was_stack
+            and isinstance(assign.src.stack_offset, int)
         ):
             valid_assignment = True
         else:
@@ -388,7 +496,7 @@ class ReturnDuplicatorBase:
         return region, region_head
 
     @staticmethod
-    def _is_indirect_jump_ailblock(block: "Block") -> bool:
+    def _is_indirect_jump_ailblock(block: Block) -> bool:
         if block.statements and isinstance(block.statements[-1], Jump):
             last_stmt = block.statements[-1]
             if not isinstance(last_stmt.target, Const):
@@ -416,9 +524,9 @@ class ReturnDuplicatorBase:
         def _unpack_block_type_to_addrs(node):
             if isinstance(node, Block):
                 return {node.addr}
-            elif isinstance(node, MultiNode):
+            if isinstance(node, MultiNode):
                 return {n.addr for n in node.nodes}
-            elif isinstance(node, ConditionNode):
+            if isinstance(node, ConditionNode):
                 return _unpack_block_type_to_addrs(node.true_node) | _unpack_block_type_to_addrs(node.false_node)
             return set()
 
@@ -467,3 +575,7 @@ class ReturnDuplicatorBase:
                 new_name += f"__{block.idx}"
 
                 block.statements[i] = Label(stmt.idx, new_name, stmt.ins_addr, block_idx=block.idx, **stmt.tags)
+
+    @staticmethod
+    def unwrap_conv(expr):
+        return ReturnDuplicatorBase.unwrap_conv(expr.operand) if isinstance(expr, ailment.expression.Convert) else expr

angr/analyses/decompiler/optimization_passes/return_duplicator_high.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 
 import networkx

angr/analyses/decompiler/optimization_passes/return_duplicator_low.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import logging
 import inspect
 
@@ -152,8 +153,8 @@ class ReturnDuplicatorLow(StructuringOptimizationPass, ReturnDuplicatorBase):
 
             super_to_og_nodes = {n: self._supergraph.nodes[n]["original_nodes"] for n in self._supergraph.nodes}
             og_to_super_nodes = {og: super_n for super_n, ogs in super_to_og_nodes.items() for og in ogs}
-            super_src = og_to_super_nodes.get(src, None)
-            super_dst = og_to_super_nodes.get(dst, None)
+            super_src = og_to_super_nodes.get(src)
+            super_dst = og_to_super_nodes.get(dst)
             if super_src is None or super_dst is None:
                 return False