angr 9.2.118__py3-none-macosx_11_0_arm64.whl → 9.2.120__py3-none-macosx_11_0_arm64.whl

angr/analyses/cfg/cfg_base.py

@@ -748,7 +748,8 @@ class CFGBase(Analysis):
                     # Get all executable sections
                     for section in b.sections:
                         if section.is_executable:
-                            tpl = (section.min_addr, section.max_addr + 1)
+                            max_mapped_addr = section.min_addr + min(section.memsize, section.filesize)
+                            tpl = (section.min_addr, max_mapped_addr)
                             sections.append(tpl)
                     memory_regions += sections
 
@@ -756,7 +757,8 @@ class CFGBase(Analysis):
                 # Get all executable segments
                 for segment in b.segments:
                     if segment.is_executable:
-                        tpl = (segment.min_addr, segment.max_addr + 1)
+                        max_mapped_addr = segment.min_addr + min(segment.memsize, segment.filesize)
+                        tpl = (segment.min_addr, max_mapped_addr)
                         segments.append(tpl)
                 if sections and segments:
                     # are there executable segments with no sections inside?
@@ -770,7 +772,8 @@ class CFGBase(Analysis):
             elif isinstance(b, (Coff, PE)):
                 for section in b.sections:
                     if section.is_executable:
-                        tpl = (section.min_addr, section.max_addr + 1)
+                        max_mapped_addr = section.min_addr + min(section.memsize, section.filesize)
+                        tpl = (section.min_addr, max_mapped_addr)
                         memory_regions.append(tpl)
 
             elif isinstance(b, XBE):
@@ -781,7 +784,7 @@ class CFGBase(Analysis):
                         and not section.is_writable
                         and section.name not in {".data", ".rdata", ".rodata"}
                     ):
-                        tpl = (section.min_addr, section.max_addr + 1)
+                        tpl = (section.min_addr, section.max_addr)
                         memory_regions.append(tpl)
 
             elif isinstance(b, MachO):
@@ -791,7 +794,8 @@ class CFGBase(Analysis):
                         if seg.is_executable:
                             # Take all sections from this segment (MachO style)
                             for section in seg.sections:
-                                tpl = (section.min_addr, section.max_addr + 1)
+                                max_mapped_addr = section.min_addr + min(section.memsize, section.filesize)
+                                tpl = (section.min_addr, max_mapped_addr)
                                 memory_regions.append(tpl)
 
             elif isinstance(b, (Hex, SRec)):
@@ -1313,6 +1317,23 @@ class CFGBase(Analysis):
 
             if new_node is None:
                 # Create a new one
+
+                instruction_addrs = []
+                for ins_addr in n.instruction_addrs:
+                    if n.addr <= ins_addr < n.addr + new_size:
+                        instruction_addrs.append(ins_addr)
+                    elif ins_addr == n.addr + new_size:
+                        break
+                    elif ins_addr > n.addr + new_size:
+                        # the immediate next instruction does not start right after the new node. this means we break
+                        # an existing instruction in the middle! we need to drop the last instruction address from
+                        # instruction_addrs.
+                        instruction_addrs.pop()
+                        break
+                    else:
+                        # should not happen if the instruction_addrs list is normal...
+                        break
+
                 if self.tag == "CFGFast":
                     new_node = CFGNode(
                         n.addr,
@@ -1320,7 +1341,7 @@ class CFGBase(Analysis):
                         self.model,
                         function_address=n.function_address,
                         block_id=n.block_id,
-                        instruction_addrs=[i for i in n.instruction_addrs if n.addr <= i <= n.addr + new_size],
+                        instruction_addrs=instruction_addrs,
                         thumb=n.thumb,
                     )
                 elif self.tag == "CFGEmulated":
@@ -1331,16 +1352,12 @@ class CFGBase(Analysis):
                         callstack_key=callstack_key,
                         function_address=n.function_address,
                         block_id=n.block_id,
-                        instruction_addrs=[i for i in n.instruction_addrs if n.addr <= i <= n.addr + new_size],
+                        instruction_addrs=instruction_addrs,
                         thumb=n.thumb,
                     )
                 else:
                     raise ValueError(f"Unknown tag {self.tag}.")
 
-                # Copy instruction addresses
-                new_node.instruction_addrs = [
-                    ins_addr for ins_addr in n.instruction_addrs if ins_addr < n.addr + new_size
-                ]
                 # Put the new node into end_addresses list
                 if key in smallest_nodes:
                     end_addresses_to_nodes[key].add(smallest_nodes[key])

angr/analyses/cfg/cfg_emulated.py

@@ -14,15 +14,15 @@ from archinfo import ArchARM
 from angr.analyses import ForwardAnalysis
 from angr.utils.graph import GraphUtils
 from angr.analyses import AnalysesHub
-from ... import BP, BP_BEFORE, BP_AFTER, SIM_PROCEDURES, procedures
-from ... import options as o
-from ...codenode import BlockNode
-from ...engines.procedure import ProcedureEngine
-from ...exploration_techniques.loop_seer import LoopSeer
-from ...exploration_techniques.slicecutor import Slicecutor
-from ...exploration_techniques.explorer import Explorer
-from ...exploration_techniques.lengthlimiter import LengthLimiter
-from ...errors import (
+from angr import BP, BP_BEFORE, BP_AFTER, SIM_PROCEDURES, procedures
+from angr import options as o
+from angr.codenode import BlockNode
+from angr.engines.procedure import ProcedureEngine
+from angr.exploration_techniques.loop_seer import LoopSeer
+from angr.exploration_techniques.slicecutor import Slicecutor
+from angr.exploration_techniques.explorer import Explorer
+from angr.exploration_techniques.lengthlimiter import LengthLimiter
+from angr.errors import (
     AngrCFGError,
     AngrError,
     AngrSkipJobNotice,
@@ -34,15 +34,15 @@ from ...errors import (
     AngrExitError,
     SimEmptyCallStackError,
 )
-from ...sim_state import SimState
-from ...state_plugins.callstack import CallStack
-from ...state_plugins.sim_action import SimActionData
-from ...knowledge_plugins.cfg import CFGENode, IndirectJump
-from ...utils.constants import DEFAULT_STATEMENT
-from ..cdg import CDG
-from ..ddg import DDG
-from ..backward_slice import BackwardSlice
-from ..loopfinder import LoopFinder, Loop
+from angr.sim_state import SimState
+from angr.state_plugins.callstack import CallStack
+from angr.state_plugins.sim_action import SimActionData
+from angr.knowledge_plugins.cfg import CFGENode, IndirectJump
+from angr.utils.constants import DEFAULT_STATEMENT
+from angr.analyses.cdg import CDG
+from angr.analyses.ddg import DDG
+from angr.analyses.backward_slice import BackwardSlice
+from angr.analyses.loopfinder import LoopFinder, Loop
 from .cfg_base import CFGBase
 from .cfg_job_base import BlockID, CFGJobBase
 import contextlib

angr/analyses/cfg/cfg_fast.py

@@ -1049,15 +1049,14 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         # no wide string is found
         return 0
 
-    def _scan_for_repeating_bytes(self, start_addr, repeating_byte, threshold=2):
+    def _scan_for_repeating_bytes(self, start_addr: int, repeating_byte: int, threshold: int = 2) -> int:
         """
         Scan from a given address and determine the occurrences of a given byte.
 
-        :param int start_addr:      The address in memory to start scanning.
-        :param int repeating_byte:  The repeating byte to scan for.
-        :param int threshold:  The minimum occurrences.
-        :return:                    The occurrences of a given byte.
-        :rtype:                     int
+        :param start_addr:      The address in memory to start scanning.
+        :param repeating_byte:  The repeating byte to scan for.
+        :param threshold:       The minimum occurrences.
+        :return:                The occurrences of a given byte.
         """
 
         addr = start_addr
@@ -1078,6 +1077,70 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
             return repeating_length
         return 0
 
+    def _scan_for_consecutive_pointers(self, start_addr: int, threshold: int = 2) -> int:
+        """
+        Scan from a given address and determine if there are at least `threshold` of pointers.
+
+        This function will yield high numbers of false positives if the mapped memory regions are too low (for example,
+        <= 0x100000). It is recommended to set `threshold` to a higher value in such cases.
+
+        :param start_addr:  The address to start scanning from.
+        :param threshold:   The minimum number of pointers to be found.
+        :return:            The number of pointers found.
+        """
+
+        current_object = self.project.loader.find_object_containing(start_addr)
+        addr = start_addr
+        pointer_count = 0
+        pointer_size = self.project.arch.bytes
+
+        while self._inside_regions(addr):
+            val = self._fast_memory_load_pointer(addr)
+            if val is None:
+                break
+            obj = self.project.loader.find_object_containing(val)
+            if obj is not None and obj is current_object:
+                pointer_count += 1
+            else:
+                break
+            addr += pointer_size
+
+        if pointer_count >= threshold:
+            return pointer_count
+        return 0
+
+    def _scan_for_mixed_pointers(self, start_addr: int, threshold: int = 3, window: int = 6) -> int:
+        """
+        Scan from a given address and determine if there are at least `threshold` of pointers within a given window of pointers.
+
+        This function will yield high numbers of false positives if the mapped memory regions are too low (for example,
+        <= 0x100000). It is recommended to set `threshold` to a higher value in such cases.
+
+        :param start_addr:  The address to start scanning from.
+        :param threshold:   The minimum number of pointers to be found.
+        :return:            The number of pointers found.
+        """
+
+        current_object = self.project.loader.find_object_containing(start_addr)
+        addr = start_addr
+        ctr = 0
+        pointer_count = 0
+        pointer_size = self.project.arch.bytes
+
+        while self._inside_regions(addr) and ctr < window:
+            ctr += 1
+            val = self._fast_memory_load_pointer(addr)
+            if val is None:
+                break
+            obj = self.project.loader.find_object_containing(val)
+            if obj is not None and obj is current_object:
+                pointer_count += 1
+            addr += pointer_size
+
+        if pointer_count >= threshold:
+            return ctr
+        return 0
+
     def _next_code_addr_core(self):
         """
         Call _next_unscanned_addr() first to get the next address that is not scanned. Then check if data locates at
@@ -1091,35 +1154,83 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         start_addr = next_addr
 
         while True:
-            string_length = self._scan_for_printable_strings(start_addr)
-            if string_length == 0:
-                string_length = self._scan_for_printable_widestrings(start_addr)
-
-            if string_length:
-                self._seg_list.occupy(start_addr, string_length, "string")
-                start_addr += string_length
+            pointer_length, string_length, cc_length = 0, 0, 0
+            matched_something = False
+
+            if start_addr % self.project.arch.bytes == 0:
+                # find potential pointer array
+                threshold = 6 if start_addr <= 0x100000 else 1
+                pointer_count = self._scan_for_consecutive_pointers(start_addr, threshold=threshold)
+                pointer_length = pointer_count * self.project.arch.bytes
+
+                if pointer_length:
+                    matched_something = True
+                    self._seg_list.occupy(start_addr, pointer_length, "pointer-array")
+                    self.model.memory_data[start_addr] = MemoryData(
+                        start_addr, pointer_length, MemoryDataSort.PointerArray
+                    )
+                    start_addr += pointer_length
+
+                elif start_addr <= 0x100000:
+                    # for high addresses, all pointers have been found in _scan_for_consecutive_pointers() because we
+                    # set threshold there to 1
+                    threshold = 4
+                    pointer_count = self._scan_for_mixed_pointers(start_addr, threshold=threshold, window=6)
+                    pointer_length = pointer_count * self.project.arch.bytes
+
+                    if pointer_length:
+                        matched_something = True
+                        self._seg_list.occupy(start_addr, pointer_length, "pointer-array")
+                        self.model.memory_data[start_addr] = MemoryData(
+                            start_addr, pointer_length, MemoryDataSort.PointerArray
+                        )
+                        start_addr += pointer_length
+
+            if not matched_something:
+                # find strings
+                is_widestring = False
+                string_length = self._scan_for_printable_strings(start_addr)
+                if string_length == 0:
+                    is_widestring = True
+                    string_length = self._scan_for_printable_widestrings(start_addr)
+
+                if string_length:
+                    matched_something = True
+                    self._seg_list.occupy(start_addr, string_length, "string")
+                    md = MemoryData(
+                        start_addr,
+                        string_length,
+                        MemoryDataSort.String if not is_widestring else MemoryDataSort.UnicodeString,
+                    )
+                    md.fill_content(self.project.loader)
+                    self.model.memory_data[start_addr] = md
+                    start_addr += string_length
 
-            if self.project.arch.name in ("X86", "AMD64"):
+            if not matched_something and self.project.arch.name in {"X86", "AMD64"}:
                 cc_length = self._scan_for_repeating_bytes(start_addr, 0xCC, threshold=1)
                 if cc_length:
+                    matched_something = True
                     self._seg_list.occupy(start_addr, cc_length, "alignment")
+                    self.model.memory_data[start_addr] = MemoryData(start_addr, cc_length, MemoryDataSort.Alignment)
                     start_addr += cc_length
-            else:
-                cc_length = 0
 
             zeros_length = self._scan_for_repeating_bytes(start_addr, 0x00)
             if zeros_length:
+                matched_something = True
                 self._seg_list.occupy(start_addr, zeros_length, "alignment")
+                self.model.memory_data[start_addr] = MemoryData(start_addr, zeros_length, MemoryDataSort.Alignment)
                 start_addr += zeros_length
 
-            if string_length == 0 and cc_length == 0 and zeros_length == 0:
+            if not matched_something:
                 # umm now it's probably code
                 break
 
         instr_alignment = self._initial_state.arch.instruction_alignment
         if start_addr % instr_alignment > 0:
             # occupy those few bytes
-            self._seg_list.occupy(start_addr, instr_alignment - (start_addr % instr_alignment), "alignment")
+            size = instr_alignment - (start_addr % instr_alignment)
+            self._seg_list.occupy(start_addr, size, "alignment")
+            self.model.memory_data[start_addr] = MemoryData(start_addr, size, MemoryDataSort.Unknown)
             start_addr = start_addr - start_addr % instr_alignment + instr_alignment
             # trickiness: aligning the start_addr may create a new address that is outside any mapped region.
             if not self._inside_regions(start_addr):
@@ -3339,7 +3450,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
 
                 # next case - if b is directly from function prologue detection, or a basic block that is a successor of
                 # a wrongly identified basic block, we might be totally misdecoding b
-                if b.instruction_addrs[0] not in a.instruction_addrs and b in self.graph:
+                if (not b.instruction_addrs or b.instruction_addrs[0] not in a.instruction_addrs) and b in self.graph:
                     # use a, truncate b
 
                     new_b_addr = a.addr + a.size  # b starts right after a terminates
@@ -4272,7 +4383,6 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
             # Let's try to create the pyvex IRSB directly, since it's much faster
             nodecode = False
             irsb = None
-            irsb_string = None
             lifted_block = None
             try:
                 lifted_block = self._lift(
@@ -4283,11 +4393,12 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     load_from_ro_regions=True,
                     initial_regs=initial_regs,
                 )
-                irsb = lifted_block.vex_nostmt
-                irsb_string = lifted_block.bytes[: irsb.size]
+                irsb = lifted_block.vex_nostmt  # may raise SimTranslationError
             except SimTranslationError:
                 nodecode = True
 
+            irsb_string: bytes = lifted_block.bytes[: irsb.size] if irsb is not None else lifted_block.bytes
+
             # special logic during the complete scanning phase
             if cfg_job.job_type == CFGJobType.COMPLETE_SCANNING and is_arm_arch(self.project.arch):
                 # it's way too easy to incorrectly disassemble THUMB code contains 0x4f as ARM code svc?? #????
@@ -4324,10 +4435,11 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                             initial_regs=initial_regs,
                         )
                         irsb = lifted_block.vex_nostmt
-                        irsb_string = lifted_block.bytes[: irsb.size]
                     except SimTranslationError:
                         nodecode = True
 
+                    irsb_string: bytes = lifted_block.bytes[: irsb.size] if irsb is not None else lifted_block.bytes
+
                     if not (nodecode or irsb.size == 0 or irsb.jumpkind == "Ijk_NoDecode"):
                         # it is decodeable
                         if current_function_addr == addr:
@@ -4397,7 +4509,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                 nodecode_size = 1
 
                 # special handling for ud, ud1, and ud2 on x86 and x86-64
-                if irsb_string[-2:] == b"\x0f\x0b" and self.project.arch.name == "AMD64":
+                if self.project.arch.name == "AMD64" and irsb_string[-2:] == b"\x0f\x0b":
                     # VEX supports ud2 and make it part of the block size, only in AMD64.
                     valid_ins = True
                     nodecode_size = 0

angr/analyses/cfg/cfg_fast_soot.py

@@ -8,11 +8,11 @@ from copy import copy
 
 from archinfo.arch_soot import SootMethodDescriptor, SootAddressDescriptor
 
-from ...utils.constants import DEFAULT_STATEMENT
-from ...errors import AngrCFGError, SimMemoryError, SimEngineError
-from ...codenode import HookNode, SootBlockNode
-from ...knowledge_plugins.cfg import CFGNode
-from .. import register_analysis
+from angr.utils.constants import DEFAULT_STATEMENT
+from angr.errors import AngrCFGError, SimMemoryError, SimEngineError
+from angr.codenode import HookNode, SootBlockNode
+from angr.knowledge_plugins.cfg import CFGNode
+from angr.analyses import register_analysis
 from .cfg_fast import CFGFast, CFGJob, PendingJobs, FunctionTransitionEdge
 
 l = logging.getLogger(name=__name__)

angr/analyses/cfg/cfg_job_base.py

@@ -4,11 +4,11 @@ from typing import TYPE_CHECKING
 
 from archinfo.arch_soot import SootAddressDescriptor
 
-from ...errors import SimValueError, SimSolverModeError
-from ...state_plugins.callstack import CallStack
+from angr.errors import SimValueError, SimSolverModeError
+from angr.state_plugins.callstack import CallStack
 
 if TYPE_CHECKING:
-    from ...sim_state import SimState
+    from angr.sim_state import SimState
 l = logging.getLogger(name=__name__)
 
 # TODO: Make callsite an object and use it in BlockID and FunctionKey

angr/analyses/cfg/indirect_jump_resolvers/__init__.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+
 from .mips_elf_fast import MipsElfFastResolver
 from .x86_elf_pic_plt import X86ElfPicPltResolver
 from .jumptable import JumpTableResolver
@@ -7,3 +8,15 @@ from .amd64_elf_got import AMD64ElfGotResolver
 from .arm_elf_fast import ArmElfFastResolver
 from .const_resolver import ConstantResolver
 from .amd64_pe_iat import AMD64PeIatResolver
+
+
+__all__ = (
+    "MipsElfFastResolver",
+    "X86ElfPicPltResolver",
+    "JumpTableResolver",
+    "X86PeIatResolver",
+    "AMD64ElfGotResolver",
+    "ArmElfFastResolver",
+    "ConstantResolver",
+    "AMD64PeIatResolver",
+)

angr/analyses/cfg/indirect_jump_resolvers/amd64_pe_iat.py

@@ -3,7 +3,7 @@ import logging
 
 from capstone.x86_const import X86_OP_MEM, X86_REG_RIP
 
-from ....simos import SimWindows
+from angr.simos import SimWindows
 from .resolver import IndirectJumpResolver
 
 l = logging.getLogger(name=__name__)

angr/analyses/cfg/indirect_jump_resolvers/arm_elf_fast.py

@@ -4,8 +4,8 @@ import logging
 import archinfo
 import pyvex
 
-from ....blade import Blade
-from ....utils.constants import DEFAULT_STATEMENT
+from angr.blade import Blade
+from angr.utils.constants import DEFAULT_STATEMENT
 from .resolver import IndirectJumpResolver
 
 _l = logging.getLogger(name=__name__)

angr/analyses/cfg/indirect_jump_resolvers/const_resolver.py

@@ -5,10 +5,10 @@ import logging
 import claripy
 import pyvex
 
-from ....utils.constants import DEFAULT_STATEMENT
-from ....code_location import CodeLocation
-from ....blade import Blade
-from ...propagator import vex_vars
+from angr.utils.constants import DEFAULT_STATEMENT
+from angr.code_location import CodeLocation
+from angr.blade import Blade
+from angr.analyses.propagator import vex_vars
 from .resolver import IndirectJumpResolver
 from .propagator_utils import PropagatorLoadCallback
 

angr/analyses/cfg/indirect_jump_resolvers/jumptable.py

@@ -11,27 +11,27 @@ import pyvex
 import claripy
 from archinfo.arch_arm import is_arm_arch
 
-from .... import sim_options as o
-from .... import BP, BP_BEFORE, BP_AFTER
-from ....misc.ux import once
-from ....code_location import CodeLocation
-from ....concretization_strategies import SimConcretizationStrategyAny
-from ....knowledge_plugins.cfg import IndirectJump, IndirectJumpType
-from ....engines.vex.claripy import ccall
-from ....engines.light import SimEngineLightVEXMixin, SimEngineLight, SpOffset, RegisterOffset
-from ....errors import AngrError, SimError
-from ....blade import Blade
-from ....annocfg import AnnotatedCFG
-from ....exploration_techniques.slicecutor import Slicecutor
-from ....exploration_techniques.local_loop_seer import LocalLoopSeer
-from ....exploration_techniques.explorer import Explorer
-from ....utils.constants import DEFAULT_STATEMENT
-from ...propagator.vex_vars import VEXReg
+from angr import sim_options as o
+from angr import BP, BP_BEFORE, BP_AFTER
+from angr.misc.ux import once
+from angr.code_location import CodeLocation
+from angr.concretization_strategies import SimConcretizationStrategyAny
+from angr.knowledge_plugins.cfg import IndirectJump, IndirectJumpType
+from angr.engines.vex.claripy import ccall
+from angr.engines.light import SimEngineLightVEXMixin, SimEngineLight, SpOffset, RegisterOffset
+from angr.errors import AngrError, SimError
+from angr.blade import Blade
+from angr.annocfg import AnnotatedCFG
+from angr.exploration_techniques.slicecutor import Slicecutor
+from angr.exploration_techniques.local_loop_seer import LocalLoopSeer
+from angr.exploration_techniques.explorer import Explorer
+from angr.utils.constants import DEFAULT_STATEMENT
+from angr.analyses.propagator.vex_vars import VEXReg
 from .resolver import IndirectJumpResolver
 from .propagator_utils import PropagatorLoadCallback
 
 try:
-    from ....engines import pcode
+    from angr.engines import pcode
 except ImportError:
     pcode = None
 
@@ -1723,7 +1723,10 @@ class JumpTableResolver(IndirectJumpResolver):
         all_targets = []
         jump_table = []
 
-        jumptable_si = claripy.SI(bits=project.arch.bits, to_conv=jumptable_addr)
+        try:
+            jumptable_si = claripy.SI(bits=project.arch.bits, to_conv=jumptable_addr)
+        except claripy.errors.BackendError:
+            return None
 
         # we may resolve a vtable (in C, e.g., the IO_JUMPS_FUNC in libc), but the stride of this load is usually 1
         # while the read statement reads a word size at a time.

angr/analyses/cfg/indirect_jump_resolvers/mips_elf_fast.py

@@ -8,11 +8,11 @@ import claripy
 import pyvex
 
 
-from .... import options, BP_BEFORE
-from ....blade import Blade
-from ....annocfg import AnnotatedCFG
-from ....exploration_techniques import Slicecutor
-from ....utils.constants import DEFAULT_STATEMENT
+from angr import options, BP_BEFORE
+from angr.blade import Blade
+from angr.annocfg import AnnotatedCFG
+from angr.exploration_techniques import Slicecutor
+from angr.utils.constants import DEFAULT_STATEMENT
 from .resolver import IndirectJumpResolver
 
 if TYPE_CHECKING:

angr/analyses/cfg/indirect_jump_resolvers/resolver.py

@@ -1,10 +1,10 @@
 from __future__ import annotations
 import typing
 
-from ....errors import SimMemoryError
+from angr.errors import SimMemoryError
 
 if typing.TYPE_CHECKING:
-    from .... import Project
+    from angr import Project
 
 
 class IndirectJumpResolver:

angr/analyses/cfg/indirect_jump_resolvers/x86_pe_iat.py

@@ -3,7 +3,7 @@ import logging
 
 from capstone.x86_const import X86_OP_MEM
 
-from ....simos import SimWindows
+from angr.simos import SimWindows
 from .resolver import IndirectJumpResolver
 
 l = logging.getLogger(name=__name__)

angr/analyses/cfg_slice_to_sink/__init__.py

@@ -1,3 +1,11 @@
 from __future__ import annotations
+
 from .graph import slice_callgraph, slice_cfg_graph, slice_function_graph
 from .cfg_slice_to_sink import CFGSliceToSink
+
+__all__ = (
+    "CFGSliceToSink",
+    "slice_callgraph",
+    "slice_cfg_graph",
+    "slice_function_graph",
+)

angr/analyses/class_identifier.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
-from ..sim_type import SimCppClass, SimTypeCppFunction
-from ..analyses import AnalysesHub
+from angr.sim_type import SimCppClass, SimTypeCppFunction
+from angr.analyses import AnalysesHub
 from . import Analysis, CFGFast, VtableFinder
 
 

angr/analyses/code_tagging.py

@@ -1,8 +1,8 @@
 from __future__ import annotations
 import pyvex
 
-from ..utils import looks_like_sql
-from ..knowledge_plugins.xrefs import XRef
+from angr.utils import looks_like_sql
+from angr.knowledge_plugins.xrefs import XRef
 from . import Analysis, AnalysesHub
 
 

angr/analyses/complete_calling_conventions.py

@@ -14,8 +14,8 @@ import claripy
 
 from angr.utils.graph import GraphUtils
 from angr.simos import SimWindows
-from ..utils.mp import mp_context, Initializer
-from ..knowledge_plugins.cfg import CFGModel
+from angr.utils.mp import mp_context, Initializer
+from angr.knowledge_plugins.cfg import CFGModel
 from . import Analysis, register_analysis, VariableRecoveryFast, CallingConventionAnalysis
 
 if TYPE_CHECKING:
@@ -185,7 +185,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
                 if self._cc_callback is not None:
                     self._cc_callback(func_addr)
 
-                percentage = idx + 1 / total_funcs * 100.0
+                percentage = (idx + 1) / total_funcs * 100.0
                 self._update_progress(percentage, text=f"{idx + 1}/{total_funcs} - {func.demangled_name}")
                 if self._low_priority:
                     self._release_gil(idx + 1, 10, 0.000001)

angr/analyses/congruency_check.py

@@ -6,7 +6,6 @@ import claripy
 from . import Analysis
 
 l = logging.getLogger(name=__name__)
-# l.setLevel(logging.DEBUG)
 
 
 class CongruencyCheck(Analysis):
@@ -373,7 +372,7 @@ class CongruencyCheck(Analysis):
         return True
 
 
-from ..errors import AngrIncongruencyError
+from angr.errors import AngrIncongruencyError
 from angr.analyses import AnalysesHub
 
 AnalysesHub.register_default("CongruencyCheck", CongruencyCheck)