angr 9.2.117__py3-none-manylinux2014_x86_64.whl → 9.2.118__py3-none-manylinux2014_x86_64.whl

angr/analyses/decompiler/peephole_optimizations/inlined_strcpy.py

@@ -1,10 +1,11 @@
 # pylint:disable=arguments-differ
+from __future__ import annotations
 import string
 
 from archinfo import Endness
 
-from ailment.expression import Const, StackBaseOffset
-from ailment.statement import Call, Store
+from ailment.expression import Const, StackBaseOffset, VirtualVariable
+from ailment.statement import Call, Assignment
 
 from angr.utils.endness import ail_const_to_be
 from .base import PeepholeOptimizationStmtBase
@@ -22,11 +23,16 @@ class InlinedStrcpy(PeepholeOptimizationStmtBase):
     __slots__ = ()
 
     NAME = "Simplifying inlined strcpy"
-    stmt_classes = (Store,)
-
-    def optimize(self, stmt: Store, stmt_idx: int = None, block=None, **kwargs):
-        if isinstance(stmt.data, Const) and isinstance(stmt.data.value, int):
-            r, s = self.is_integer_likely_a_string(stmt.data.value, stmt.data.size, stmt.endness)
+    stmt_classes = (Assignment,)
+
+    def optimize(self, stmt: Assignment, stmt_idx: int | None = None, block=None, **kwargs):
+        if (
+            isinstance(stmt.dst, VirtualVariable)
+            and stmt.dst.was_stack
+            and isinstance(stmt.src, Const)
+            and isinstance(stmt.src.value, int)
+        ):
+            r, s = self.is_integer_likely_a_string(stmt.src.value, stmt.src.size, self.project.arch.memory_endness)
             if r:
                 # replace it with a call to strncpy
                 str_id = self.kb.custom_strings.allocate(s.encode("ascii"))
@@ -34,8 +40,8 @@ class InlinedStrcpy(PeepholeOptimizationStmtBase):
                     stmt.idx,
                     "strncpy",
                     args=[
-                        stmt.addr,
-                        Const(None, None, str_id, stmt.addr.bits, custom_string=True),
+                        StackBaseOffset(None, self.project.arch.bits, stmt.dst.stack_offset),
+                        Const(None, None, str_id, self.project.arch.bits, custom_string=True),
                         Const(None, None, len(s), self.project.arch.bits),
                     ],
                     **stmt.tags,
@@ -75,8 +81,8 @@ class InlinedStrcpy(PeepholeOptimizationStmtBase):
                             stmt.idx,
                             "strncpy",
                             args=[
-                                stmt.addr,
-                                Const(None, None, str_id, stmt.addr.bits, custom_string=True),
+                                StackBaseOffset(None, self.project.arch.bits, stmt.dst.stack_offset),
+                                Const(None, None, str_id, self.project.arch.bits, custom_string=True),
                                 Const(None, None, len(s), self.project.arch.bits),
                             ],
                             **stmt.tags,
@@ -95,17 +101,21 @@ class InlinedStrcpy(PeepholeOptimizationStmtBase):
             n |= v.value
         return n, size
 
-    @staticmethod
-    def collect_constant_stores(block, starting_stmt_idx: int) -> dict[int, tuple[int, Const | None]]:
+    def collect_constant_stores(self, block, starting_stmt_idx: int) -> dict[int, tuple[int, Const | None]]:
         r = {}
         for idx, stmt in enumerate(block.statements):
             if idx < starting_stmt_idx:
                 continue
-            if isinstance(stmt, Store) and isinstance(stmt.addr, StackBaseOffset) and isinstance(stmt.addr.offset, int):
-                if isinstance(stmt.data, Const):
-                    r[stmt.addr.offset] = idx, ail_const_to_be(stmt.data, stmt.endness)
+            if (
+                isinstance(stmt, Assignment)
+                and isinstance(stmt.dst, VirtualVariable)
+                and stmt.dst.was_stack
+                and isinstance(stmt.dst.stack_offset, int)
+            ):
+                if isinstance(stmt.src, Const):
+                    r[stmt.dst.stack_offset] = idx, ail_const_to_be(stmt.src, self.project.arch.memory_endness)
                 else:
-                    r[stmt.addr.offset] = idx, None
+                    r[stmt.dst.stack_offset] = idx, None
 
         return r
 
@@ -135,7 +145,7 @@ class InlinedStrcpy(PeepholeOptimizationStmtBase):
                 if chr(byt) not in ASCII_PRINTABLES:
                     return False, None
                 chars.append(chr(byt))
-            chars = chars[::-1]
+            chars.reverse()
         else:
             # unsupported endness
             return False, None

angr/analyses/decompiler/peephole_optimizations/inlined_strcpy_consolidation.py

@@ -1,4 +1,5 @@
 # pylint:disable=arguments-differ
+from __future__ import annotations
 
 from ailment.expression import Expression, BinaryOp, Const, Register, StackBaseOffset
 from ailment.statement import Call, Store
@@ -72,10 +73,13 @@ class InlinedStrcpyConsolidation(PeepholeOptimizationMultiStmtBase):
 
     @staticmethod
     def _is_inlined_strcpy(stmt: Call):
-        if isinstance(stmt.target, str) and stmt.target == "strncpy":
-            if len(stmt.args) == 3 and isinstance(stmt.args[1], Const) and hasattr(stmt.args[1], "custom_string"):
-                return True
-        return False
+        return (
+            isinstance(stmt.target, str)
+            and stmt.target == "strncpy"
+            and len(stmt.args) == 3
+            and isinstance(stmt.args[1], Const)
+            and hasattr(stmt.args[1], "custom_string")
+        )
 
     @staticmethod
     def _parse_addr(addr: Expression) -> tuple[Expression, int]:

angr/analyses/decompiler/peephole_optimizations/inlined_wstrcpy.py

@@ -1,10 +1,11 @@
 # pylint:disable=arguments-differ
+from __future__ import annotations
 import string
 
 from archinfo import Endness
 
-from ailment.expression import Const, StackBaseOffset
-from ailment.statement import Call, Store
+from ailment.expression import Const, StackBaseOffset, VirtualVariable
+from ailment.statement import Call, Assignment
 
 from angr.utils.endness import ail_const_to_be
 from .base import PeepholeOptimizationStmtBase
@@ -22,11 +23,16 @@ class InlinedWstrcpy(PeepholeOptimizationStmtBase):
     __slots__ = ()
 
     NAME = "Simplifying inlined wstrcpy"
-    stmt_classes = (Store,)
-
-    def optimize(self, stmt: Store, stmt_idx: int = None, block=None, **kwargs):
-        if isinstance(stmt.data, Const) and isinstance(stmt.data.value, int):
-            r, s = self.is_integer_likely_a_wide_string(stmt.data.value, stmt.data.size, stmt.endness)
+    stmt_classes = (Assignment,)
+
+    def optimize(self, stmt: Assignment, stmt_idx: int | None = None, block=None, **kwargs):
+        if (
+            isinstance(stmt.dst, VirtualVariable)
+            and stmt.dst.was_stack
+            and isinstance(stmt.src, Const)
+            and isinstance(stmt.src.value, int)
+        ):
+            r, s = self.is_integer_likely_a_wide_string(stmt.src.value, stmt.src.size, self.project.arch.memory_endness)
             if r:
                 # replace it with a call to strncpy
                 str_id = self.kb.custom_strings.allocate(s.encode("ascii"))
@@ -34,8 +40,8 @@ class InlinedWstrcpy(PeepholeOptimizationStmtBase):
                     stmt.idx,
                     "wstrncpy",
                     args=[
-                        stmt.addr,
-                        Const(None, None, str_id, stmt.addr.bits, custom_string=True),
+                        StackBaseOffset(None, self.project.arch.bits, stmt.dst.stack_offset),
+                        Const(None, None, str_id, self.project.arch.bits, custom_string=True),
                         Const(None, None, len(s), self.project.arch.bits),
                     ],
                     **stmt.tags,
@@ -75,8 +81,8 @@ class InlinedWstrcpy(PeepholeOptimizationStmtBase):
                             stmt.idx,
                             "wstrncpy",
                             args=[
-                                stmt.addr,
-                                Const(None, None, str_id, stmt.addr.bits, custom_string=True),
+                                StackBaseOffset(None, self.project.arch.bits, stmt.dst.stack_offset),
+                                Const(None, None, str_id, self.project.arch.bits, custom_string=True),
                                 Const(None, None, len(s), self.project.arch.bits),
                             ],
                             **stmt.tags,
@@ -95,17 +101,21 @@ class InlinedWstrcpy(PeepholeOptimizationStmtBase):
             n |= v.value
         return n, size
 
-    @staticmethod
-    def collect_constant_stores(block, starting_stmt_idx: int) -> dict[int, tuple[int, Const | None]]:
+    def collect_constant_stores(self, block, starting_stmt_idx: int) -> dict[int, tuple[int, Const | None]]:
         r = {}
         for idx, stmt in enumerate(block.statements):
             if idx < starting_stmt_idx:
                 continue
-            if isinstance(stmt, Store) and isinstance(stmt.addr, StackBaseOffset) and isinstance(stmt.addr.offset, int):
-                if isinstance(stmt.data, Const):
-                    r[stmt.addr.offset] = idx, ail_const_to_be(stmt.data, stmt.endness)
+            if (
+                isinstance(stmt, Assignment)
+                and isinstance(stmt.dst, VirtualVariable)
+                and stmt.dst.was_stack
+                and isinstance(stmt.dst.stack_offset, int)
+            ):
+                if isinstance(stmt.src, Const):
+                    r[stmt.dst.stack_offset] = idx, ail_const_to_be(stmt.src, self.project.arch.memory_endness)
                 else:
-                    r[stmt.addr.offset] = idx, None
+                    r[stmt.dst.stack_offset] = idx, None
 
         return r
 
@@ -139,7 +149,7 @@ class InlinedWstrcpy(PeepholeOptimizationStmtBase):
                 if byt != 0 and chr(byt) not in ASCII_PRINTABLES:
                     return False, None
                 chars.append(chr(byt))
-            chars = chars[::-1]
+            chars.reverse()
         else:
             # unsupported endness
             return False, None

angr/analyses/decompiler/peephole_optimizations/invert_negated_logical_conjuction_disjunction.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.expression import UnaryOp, BinaryOp
 
 from .base import PeepholeOptimizationExprBase
@@ -14,37 +15,36 @@ class InvertNegatedLogicalConjunctionsAndDisjunctions(PeepholeOptimizationExprBa
     expr_classes = (UnaryOp,)  # all expressions are allowed
 
     def optimize(self, expr: UnaryOp, **kwargs):
-        if expr.op == "Not":
-            if isinstance(expr.operand, BinaryOp):
-                if expr.operand.op == "LogicalAnd":
-                    inner_operands = [
-                        UnaryOp(None, "Not", expr.operand.operands[0], **expr.operand.operands[0].tags),
-                        UnaryOp(None, "Not", expr.operand.operands[1], **expr.operand.operands[1].tags),
-                    ]
-                    return BinaryOp(
-                        expr.operand.idx,
-                        "LogicalOr",
-                        inner_operands,
-                        expr.operand.signed,
-                        variable=expr.operand.variable,
-                        variable_offset=expr.operand.variable_offset,
-                        bits=expr.operand.bits,
-                        **expr.tags,
-                    )
-                elif expr.operand.op == "LogicalOr":
-                    inner_operands = [
-                        UnaryOp(None, "Not", expr.operand.operands[0], **expr.operand.operands[0].tags),
-                        UnaryOp(None, "Not", expr.operand.operands[1], **expr.operand.operands[1].tags),
-                    ]
-                    return BinaryOp(
-                        expr.idx,
-                        "LogicalAnd",
-                        inner_operands,
-                        expr.operand.signed,
-                        variable=expr.operand.variable,
-                        variable_offset=expr.operand.variable_offset,
-                        bits=expr.operand.bits,
-                        **expr.tags,
-                    )
+        if expr.op == "Not" and isinstance(expr.operand, BinaryOp):
+            if expr.operand.op == "LogicalAnd":
+                inner_operands = [
+                    UnaryOp(None, "Not", expr.operand.operands[0], **expr.operand.operands[0].tags),
+                    UnaryOp(None, "Not", expr.operand.operands[1], **expr.operand.operands[1].tags),
+                ]
+                return BinaryOp(
+                    expr.operand.idx,
+                    "LogicalOr",
+                    inner_operands,
+                    expr.operand.signed,
+                    variable=expr.operand.variable,
+                    variable_offset=expr.operand.variable_offset,
+                    bits=expr.operand.bits,
+                    **expr.tags,
+                )
+            if expr.operand.op == "LogicalOr":
+                inner_operands = [
+                    UnaryOp(None, "Not", expr.operand.operands[0], **expr.operand.operands[0].tags),
+                    UnaryOp(None, "Not", expr.operand.operands[1], **expr.operand.operands[1].tags),
+                ]
+                return BinaryOp(
+                    expr.idx,
+                    "LogicalAnd",
+                    inner_operands,
+                    expr.operand.signed,
+                    variable=expr.operand.variable,
+                    variable_offset=expr.operand.variable_offset,
+                    bits=expr.operand.bits,
+                    **expr.tags,
+                )
 
         return None

angr/analyses/decompiler/peephole_optimizations/one_sub_bool.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.expression import Convert, BinaryOp, Const, UnaryOp
 
 from .base import PeepholeOptimizationExprBase
@@ -20,7 +21,7 @@ class OneSubBool(PeepholeOptimizationExprBase):
         ):
             conv_expr = expr.operands[1]
             if self.is_bool_expr(conv_expr.operand):
-                new_expr = Convert(
+                return Convert(
                     None,
                     1,
                     conv_expr.to_bits,
@@ -28,6 +29,5 @@ class OneSubBool(PeepholeOptimizationExprBase):
                     UnaryOp(None, "Not", conv_expr.operand, **conv_expr.operand.tags),
                     **conv_expr.tags,
                 )
-                return new_expr
 
         return None

angr/analyses/decompiler/peephole_optimizations/remove_cascading_conversions.py

@@ -1,4 +1,5 @@
-from ailment.expression import Convert
+from __future__ import annotations
+from ailment.expression import Convert, BinaryOp, Const
 
 from .base import PeepholeOptimizationExprBase
 
@@ -6,14 +7,33 @@ from .base import PeepholeOptimizationExprBase
 class RemoveCascadingConversions(PeepholeOptimizationExprBase):
     __slots__ = ()
 
-    NAME = "Remove adjacent conversions"
+    NAME = "Simplify adjacent size conversions"
     expr_classes = (Convert,)
 
     def optimize(self, expr: Convert, **kwargs):
         if isinstance(expr.operand, Convert):
             inner = expr.operand
             if inner.from_bits == expr.to_bits:
-                return inner.operand
+                if inner.from_bits < inner.to_bits:
+                    # extension -> truncation
+                    return inner.operand
+                # truncation -> extension
+                # we must clear the top truncated bits
+                mask = (1 << inner.to_bits) - 1
+                return BinaryOp(
+                    expr.idx,
+                    "And",
+                    [inner.operand, Const(None, None, mask, inner.operand.bits)],
+                    False,
+                    **expr.tags,
+                )
             return Convert(expr.idx, inner.from_bits, expr.to_bits, expr.is_signed, inner.operand, **expr.tags)
 
+        if isinstance(expr.operand, BinaryOp) and expr.operand.op == "And":
+            and0, and1 = expr.operand.operands
+            if not isinstance(and0, Const) and isinstance(and1, Const):
+                mask = (1 << expr.to_bits) - 1
+                if and1.value == mask:
+                    return Convert(expr.idx, expr.from_bits, expr.to_bits, expr.is_signed, and0, **expr.tags)
+
         return None

angr/analyses/decompiler/peephole_optimizations/remove_empty_if_body.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.statement import ConditionalJump
 from ailment.expression import ITE, UnaryOp
 
@@ -10,7 +11,7 @@ class RemoveEmptyIfBody(PeepholeOptimizationStmtBase):
     NAME = "Remove empty If bodies"
     stmt_classes = (ConditionalJump,)
 
-    def optimize(self, stmt: ConditionalJump, stmt_idx: int = None, block=None, **kwargs):
+    def optimize(self, stmt: ConditionalJump, stmt_idx: int | None = None, block=None, **kwargs):
         cond = stmt.condition
 
         # if (!cond) {} else { ITE(cond, true_branch, false_branch } ==> if (cond) { ITE(...) } else {}

angr/analyses/decompiler/peephole_optimizations/remove_noop_conversions.py

@@ -1,4 +1,5 @@
 # pylint: disable=missing-class-docstring,no-self-use
+from __future__ import annotations
 from ailment.expression import Convert
 
 from .base import PeepholeOptimizationExprBase
@@ -18,9 +19,12 @@ class RemoveNoopConversions(PeepholeOptimizationExprBase):
             inner = expr.operand
             if (
                 expr.to_bits == inner.from_bits
+                and expr.to_bits < expr.from_bits
                 and expr.from_bits == inner.to_bits
                 and expr.is_signed == inner.is_signed
             ):
+                # extension then truncation (e.g., 1->64->1) can be removed, but truncation then extension cannot be
+                # removed (e.g., the high 32 bits must be removed during 64->32->64)
                 return inner.operand
 
         return None

angr/analyses/decompiler/peephole_optimizations/remove_redundant_bitmasks.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.expression import BinaryOp, Convert, Const, ITE
 
 from .base import PeepholeOptimizationExprBase

angr/analyses/decompiler/peephole_optimizations/remove_redundant_conversions.py

@@ -1,4 +1,5 @@
 # pylint: disable=missing-class-docstring
+from __future__ import annotations
 from ailment.expression import BinaryOp, Convert, Const
 
 from .base import PeepholeOptimizationExprBase
@@ -50,10 +51,9 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
                         expr.operands[0].is_signed and expr.operands[1].value >= (1 << to_bits) - (1 << (from_bits - 1))
                     ):
                         con = Const(None, None, expr.operands[1].value, from_bits, **expr.operands[1].tags)
-                        new_expr = BinaryOp(
+                        return BinaryOp(
                             expr.idx, expr.op, (expr.operands[0].operand, con), expr.signed, bits=1, **expr.tags
                         )
-                        return new_expr
 
                 elif expr.op in {"Add", "Sub"}:
                     # Add(Conv(32->64, expr), A) ==> Conv(32->64, Add(expr, A))
@@ -89,7 +89,7 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
                         bits=op0.from_bits,
                         **expr.tags,
                     )
-                    r = Convert(
+                    return Convert(
                         op0.idx,
                         op0.from_bits,
                         op0.to_bits,
@@ -97,7 +97,6 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
                         new_expr,
                         **op0.tags,
                     )
-                    return r
 
         # a more complex case
         # (Conv(expr) >> A) & B == C  ==>  (expr >> A) & B == C
@@ -147,7 +146,7 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
                                 bits=from_bits,
                                 **op0.tags,
                             )
-                            r = BinaryOp(
+                            return BinaryOp(
                                 expr.idx,
                                 expr.op,
                                 [r1, Const(c.idx, c.variable, c.value, from_bits)],
@@ -155,6 +154,5 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
                                 bits=from_bits,
                                 **expr.tags,
                             )
-                            return r
 
         return None

angr/analyses/decompiler/peephole_optimizations/remove_redundant_ite_branch.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.expression import ITE, BinaryOp
 
 from .base import PeepholeOptimizationExprBase
@@ -11,19 +12,19 @@ class RemoveRedundantITEBranches(PeepholeOptimizationExprBase):
 
     def optimize(self, expr: ITE, **kwargs):
         # ITE(cond, a, ITE(!cond, b, c)) ==> ITE(cond, a, b)
-        if isinstance(expr.iffalse, ITE):
+        if (
+            isinstance(expr.iffalse, ITE)
             # cascading ITEs
-            if isinstance(expr.cond, BinaryOp) and isinstance(expr.iffalse.cond, BinaryOp):
-                # are they negating each other?
-                if (
-                    expr.cond.op in BinaryOp.COMPARISON_NEGATION
-                    and expr.iffalse.cond.op == BinaryOp.COMPARISON_NEGATION[expr.cond.op]
-                ):
-                    cond0_operands = expr.cond.operands
-                    cond1_operands = expr.iffalse.cond.operands
-                    if cond0_operands[0].likes(cond1_operands[0]) and cond0_operands[1].likes(cond1_operands[1]):
-                        # YES...
-                        expr = ITE(expr.idx, expr.cond, expr.iffalse.iftrue, expr.iftrue, **expr.tags)
-                        return expr
+            and isinstance(expr.cond, BinaryOp)
+            # are they negating each other?
+            and isinstance(expr.iffalse.cond, BinaryOp)
+            and expr.cond.op in BinaryOp.COMPARISON_NEGATION
+            and expr.iffalse.cond.op == BinaryOp.COMPARISON_NEGATION[expr.cond.op]
+        ):
+            cond0_operands = expr.cond.operands
+            cond1_operands = expr.iffalse.cond.operands
+            if cond0_operands[0].likes(cond1_operands[0]) and cond0_operands[1].likes(cond1_operands[1]):
+                # YES...
+                return ITE(expr.idx, expr.cond, expr.iffalse.iftrue, expr.iftrue, **expr.tags)
 
         return None

angr/analyses/decompiler/peephole_optimizations/remove_redundant_ite_comparisons.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.expression import ITE, BinaryOp, UnaryOp, Const
 
 from .base import PeepholeOptimizationExprBase
@@ -48,7 +49,6 @@ class RemoveRedundantITEComparisons(PeepholeOptimizationExprBase):
 
                 if not negate:
                     return inner_expr.cond
-                else:
-                    return UnaryOp(None, "Not", inner_expr.cond, **expr.tags)
+                return UnaryOp(None, "Not", inner_expr.cond, **expr.tags)
 
         return None

angr/analyses/decompiler/peephole_optimizations/remove_redundant_nots.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.expression import UnaryOp
 
 from .base import PeepholeOptimizationExprBase

angr/analyses/decompiler/peephole_optimizations/remove_redundant_reinterprets.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import struct
 
 from ailment.expression import Reinterpret, Const
@@ -28,14 +29,14 @@ class RemoveRedundantReinterprets(PeepholeOptimizationExprBase):
             elif expr.operand.bits == 64:
                 int_fmt = "<Q"
             else:
-                raise NotImplementedError()
+                raise NotImplementedError
 
             if expr.bits == 32:
                 float_fmt = "<f"
             elif expr.bits == 64:
                 float_fmt = "<d"
             else:
-                raise NotImplementedError()
+                raise NotImplementedError
 
             value = struct.unpack(float_fmt, struct.pack(int_fmt, expr.operand.value))[0]
             return Const(expr.idx, None, value, expr.bits, **expr.tags)

angr/analyses/decompiler/peephole_optimizations/remove_redundant_shifts.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.expression import BinaryOp, Const, Convert
 
 from .base import PeepholeOptimizationExprBase
@@ -26,7 +27,7 @@ class RemoveRedundantShifts(PeepholeOptimizationExprBase):
                         inner_expr,
                         **expr.tags,
                     )
-                    conv_expr = Convert(
+                    return Convert(
                         None,
                         expr_a.bits - n0,
                         expr.bits,
@@ -34,7 +35,6 @@ class RemoveRedundantShifts(PeepholeOptimizationExprBase):
                         conv_inner_expr,
                         **expr.tags,
                     )
-                    return conv_expr
 
         # expr << 0  ==>  expr
         # expr >> 0  ==>  expr

angr/analyses/decompiler/peephole_optimizations/remove_redundant_shifts_around_comparators.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 from ailment.expression import BinaryOp, Const
 
 from .base import PeepholeOptimizationExprBase
@@ -20,21 +21,24 @@ class RemoveRedundantShiftsAroundComparators(PeepholeOptimizationExprBase):
         # FIXME: This optimization is unsafe but seems to work for all existing case
         if expr.op in {"CmpLE", "CmpLT", "CmpEQ", "CmpNE", "CmpGE", "CmpGT"}:
             op0, op1 = expr.operands
-            if isinstance(op0, BinaryOp) and op0.op == "Shl" and isinstance(op1, BinaryOp) and op1.op == "Shl":
-                if (
-                    isinstance(op0.operands[1], Const)
-                    and isinstance(op1.operands[1], Const)
-                    and op0.operands[1].value == op1.operands[1].value
-                ):
-                    return BinaryOp(
-                        expr.idx,
-                        expr.op,
-                        [op0.operands[0], op1.operands[0]],
-                        expr.signed,
-                        bits=expr.bits,
-                        floating_point=expr.floating_point,
-                        rounding_mode=expr.rounding_mode,
-                        **expr.tags,
-                    )
+            if (
+                isinstance(op0, BinaryOp)
+                and op0.op == "Shl"
+                and isinstance(op1, BinaryOp)
+                and op1.op == "Shl"
+                and isinstance(op0.operands[1], Const)
+                and isinstance(op1.operands[1], Const)
+                and op0.operands[1].value == op1.operands[1].value
+            ):
+                return BinaryOp(
+                    expr.idx,
+                    expr.op,
+                    [op0.operands[0], op1.operands[0]],
+                    expr.signed,
+                    bits=expr.bits,
+                    floating_point=expr.floating_point,
+                    rounding_mode=expr.rounding_mode,
+                    **expr.tags,
+                )
 
         return None

angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py

@@ -1,4 +1,5 @@
 # pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
 from ailment.expression import Expression, BinaryOp, Const, Convert, ITE
 
 from .base import PeepholeOptimizationExprBase
@@ -69,9 +70,8 @@ class RewriteBitExtractions(PeepholeOptimizationExprBase):
         """
 
         if isinstance(expr, BinaryOp):
-            if expr.op == "And":
-                if isinstance(expr.operands[1], Const) and expr.operands[1].value == 1:
-                    return 0, expr
+            if expr.op == "And" and isinstance(expr.operands[1], Const) and expr.operands[1].value == 1:
+                return 0, expr
             if expr.op == "Shl" and isinstance(expr.operands[1], Const):
                 offset = expr.operands[1].value
                 r = RewriteBitExtractions._get_setbit(expr.operands[0])

angr/analyses/decompiler/peephole_optimizations/rewrite_mips_gp_loads.py

@@ -1,5 +1,6 @@
 # pylint:disable=too-many-boolean-expressions
-from ailment.expression import Load, BinaryOp, Register, Const
+from __future__ import annotations
+from ailment.expression import Load, BinaryOp, VirtualVariable, Const
 
 from .base import PeepholeOptimizationExprBase
 
@@ -27,7 +28,8 @@ class RewriteMipsGpLoads(PeepholeOptimizationExprBase):
             and isinstance(expr.addr, BinaryOp)
             and expr.addr.op in {"Add", "Sub"}
             and len(expr.addr.operands) == 2
-            and isinstance(expr.addr.operands[0], Register)
+            and isinstance(expr.addr.operands[0], VirtualVariable)
+            and expr.addr.operands[0].was_reg
             and expr.addr.operands[0].reg_offset == gp_offset
             and isinstance(expr.addr.operands[1], Const)
         ):