angr 9.2.119__py3-none-manylinux2014_aarch64.whl → 9.2.121__py3-none-manylinux2014_aarch64.whl

angr/analyses/cfg/cfg_emulated.py

@@ -14,15 +14,15 @@ from archinfo import ArchARM
 from angr.analyses import ForwardAnalysis
 from angr.utils.graph import GraphUtils
 from angr.analyses import AnalysesHub
-from ... import BP, BP_BEFORE, BP_AFTER, SIM_PROCEDURES, procedures
-from ... import options as o
-from ...codenode import BlockNode
-from ...engines.procedure import ProcedureEngine
-from ...exploration_techniques.loop_seer import LoopSeer
-from ...exploration_techniques.slicecutor import Slicecutor
-from ...exploration_techniques.explorer import Explorer
-from ...exploration_techniques.lengthlimiter import LengthLimiter
-from ...errors import (
+from angr import BP, BP_BEFORE, BP_AFTER, SIM_PROCEDURES, procedures
+from angr import options as o
+from angr.codenode import BlockNode
+from angr.engines.procedure import ProcedureEngine
+from angr.exploration_techniques.loop_seer import LoopSeer
+from angr.exploration_techniques.slicecutor import Slicecutor
+from angr.exploration_techniques.explorer import Explorer
+from angr.exploration_techniques.lengthlimiter import LengthLimiter
+from angr.errors import (
     AngrCFGError,
     AngrError,
     AngrSkipJobNotice,
@@ -34,15 +34,15 @@ from ...errors import (
     AngrExitError,
     SimEmptyCallStackError,
 )
-from ...sim_state import SimState
-from ...state_plugins.callstack import CallStack
-from ...state_plugins.sim_action import SimActionData
-from ...knowledge_plugins.cfg import CFGENode, IndirectJump
-from ...utils.constants import DEFAULT_STATEMENT
-from ..cdg import CDG
-from ..ddg import DDG
-from ..backward_slice import BackwardSlice
-from ..loopfinder import LoopFinder, Loop
+from angr.sim_state import SimState
+from angr.state_plugins.callstack import CallStack
+from angr.state_plugins.sim_action import SimActionData
+from angr.knowledge_plugins.cfg import CFGENode, IndirectJump
+from angr.utils.constants import DEFAULT_STATEMENT
+from angr.analyses.cdg import CDG
+from angr.analyses.ddg import DDG
+from angr.analyses.backward_slice import BackwardSlice
+from angr.analyses.loopfinder import LoopFinder, Loop
 from .cfg_base import CFGBase
 from .cfg_job_base import BlockID, CFGJobBase
 import contextlib

angr/analyses/cfg/cfg_fast.py

@@ -3450,7 +3450,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
 
                 # next case - if b is directly from function prologue detection, or a basic block that is a successor of
                 # a wrongly identified basic block, we might be totally misdecoding b
-                if b.instruction_addrs[0] not in a.instruction_addrs and b in self.graph:
+                if (not b.instruction_addrs or b.instruction_addrs[0] not in a.instruction_addrs) and b in self.graph:
                     # use a, truncate b
 
                     new_b_addr = a.addr + a.size  # b starts right after a terminates
@@ -4131,7 +4131,8 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         if self.project.arch.name in {"MIPS64", "MIPS32"} or is_arm_arch(self.project.arch):
             self._ro_region_cdata_cache = []
             for segment in self.project.loader.main_object.segments:
-                if segment.is_readable and not segment.is_writable:
+                if segment.is_readable and segment.memsize >= 8:
+                    # the gp area is sometimes writable, so we can't test for (not segment.is_writable)
                     content = self.project.loader.memory.load(segment.vaddr, segment.memsize)
                     content_buf = pyvex.ffi.from_buffer(content)
                     self._ro_region_cdata_cache.append(content_buf)

angr/analyses/cfg/cfg_fast_soot.py

@@ -8,11 +8,11 @@ from copy import copy
 
 from archinfo.arch_soot import SootMethodDescriptor, SootAddressDescriptor
 
-from ...utils.constants import DEFAULT_STATEMENT
-from ...errors import AngrCFGError, SimMemoryError, SimEngineError
-from ...codenode import HookNode, SootBlockNode
-from ...knowledge_plugins.cfg import CFGNode
-from .. import register_analysis
+from angr.utils.constants import DEFAULT_STATEMENT
+from angr.errors import AngrCFGError, SimMemoryError, SimEngineError
+from angr.codenode import HookNode, SootBlockNode
+from angr.knowledge_plugins.cfg import CFGNode
+from angr.analyses import register_analysis
 from .cfg_fast import CFGFast, CFGJob, PendingJobs, FunctionTransitionEdge
 
 l = logging.getLogger(name=__name__)

angr/analyses/cfg/cfg_job_base.py

@@ -4,11 +4,11 @@ from typing import TYPE_CHECKING
 
 from archinfo.arch_soot import SootAddressDescriptor
 
-from ...errors import SimValueError, SimSolverModeError
-from ...state_plugins.callstack import CallStack
+from angr.errors import SimValueError, SimSolverModeError
+from angr.state_plugins.callstack import CallStack
 
 if TYPE_CHECKING:
-    from ...sim_state import SimState
+    from angr.sim_state import SimState
 l = logging.getLogger(name=__name__)
 
 # TODO: Make callsite an object and use it in BlockID and FunctionKey

angr/analyses/cfg/indirect_jump_resolvers/__init__.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
+
 from .mips_elf_fast import MipsElfFastResolver
+from .mips_elf_got import MipsElfGotResolver
 from .x86_elf_pic_plt import X86ElfPicPltResolver
 from .jumptable import JumpTableResolver
 from .x86_pe_iat import X86PeIatResolver
@@ -7,3 +9,16 @@ from .amd64_elf_got import AMD64ElfGotResolver
 from .arm_elf_fast import ArmElfFastResolver
 from .const_resolver import ConstantResolver
 from .amd64_pe_iat import AMD64PeIatResolver
+
+
+__all__ = (
+    "MipsElfFastResolver",
+    "MipsElfGotResolver",
+    "X86ElfPicPltResolver",
+    "JumpTableResolver",
+    "X86PeIatResolver",
+    "AMD64ElfGotResolver",
+    "ArmElfFastResolver",
+    "ConstantResolver",
+    "AMD64PeIatResolver",
+)

angr/analyses/cfg/indirect_jump_resolvers/amd64_pe_iat.py

@@ -3,7 +3,7 @@ import logging
 
 from capstone.x86_const import X86_OP_MEM, X86_REG_RIP
 
-from ....simos import SimWindows
+from angr.simos import SimWindows
 from .resolver import IndirectJumpResolver
 
 l = logging.getLogger(name=__name__)

angr/analyses/cfg/indirect_jump_resolvers/arm_elf_fast.py

@@ -4,8 +4,8 @@ import logging
 import archinfo
 import pyvex
 
-from ....blade import Blade
-from ....utils.constants import DEFAULT_STATEMENT
+from angr.blade import Blade
+from angr.utils.constants import DEFAULT_STATEMENT
 from .resolver import IndirectJumpResolver
 
 _l = logging.getLogger(name=__name__)

angr/analyses/cfg/indirect_jump_resolvers/const_resolver.py

@@ -5,10 +5,10 @@ import logging
 import claripy
 import pyvex
 
-from ....utils.constants import DEFAULT_STATEMENT
-from ....code_location import CodeLocation
-from ....blade import Blade
-from ...propagator import vex_vars
+from angr.utils.constants import DEFAULT_STATEMENT
+from angr.code_location import CodeLocation
+from angr.blade import Blade
+from angr.analyses.propagator import vex_vars
 from .resolver import IndirectJumpResolver
 from .propagator_utils import PropagatorLoadCallback
 

angr/analyses/cfg/indirect_jump_resolvers/default_resolvers.py

@@ -9,6 +9,7 @@ from . import AMD64ElfGotResolver
 from . import ConstantResolver
 from . import ArmElfFastResolver
 from . import AMD64PeIatResolver
+from . import MipsElfGotResolver
 
 DEFAULT_RESOLVERS = {
     "X86": {
@@ -29,6 +30,7 @@ DEFAULT_RESOLVERS = {
     },
     "MIPS32": {
         cle.MetaELF: [
+            MipsElfGotResolver,
             MipsElfFastResolver,
         ],
     },

angr/analyses/cfg/indirect_jump_resolvers/jumptable.py

@@ -11,27 +11,27 @@ import pyvex
 import claripy
 from archinfo.arch_arm import is_arm_arch
 
-from .... import sim_options as o
-from .... import BP, BP_BEFORE, BP_AFTER
-from ....misc.ux import once
-from ....code_location import CodeLocation
-from ....concretization_strategies import SimConcretizationStrategyAny
-from ....knowledge_plugins.cfg import IndirectJump, IndirectJumpType
-from ....engines.vex.claripy import ccall
-from ....engines.light import SimEngineLightVEXMixin, SimEngineLight, SpOffset, RegisterOffset
-from ....errors import AngrError, SimError
-from ....blade import Blade
-from ....annocfg import AnnotatedCFG
-from ....exploration_techniques.slicecutor import Slicecutor
-from ....exploration_techniques.local_loop_seer import LocalLoopSeer
-from ....exploration_techniques.explorer import Explorer
-from ....utils.constants import DEFAULT_STATEMENT
-from ...propagator.vex_vars import VEXReg
+from angr import sim_options as o
+from angr import BP, BP_BEFORE, BP_AFTER
+from angr.misc.ux import once
+from angr.code_location import CodeLocation
+from angr.concretization_strategies import SimConcretizationStrategyAny
+from angr.knowledge_plugins.cfg import IndirectJump, IndirectJumpType
+from angr.engines.vex.claripy import ccall
+from angr.engines.light import SimEngineLightVEXMixin, SimEngineLight, SpOffset, RegisterOffset
+from angr.errors import AngrError, SimError
+from angr.blade import Blade
+from angr.annocfg import AnnotatedCFG
+from angr.exploration_techniques.slicecutor import Slicecutor
+from angr.exploration_techniques.local_loop_seer import LocalLoopSeer
+from angr.exploration_techniques.explorer import Explorer
+from angr.utils.constants import DEFAULT_STATEMENT
+from angr.analyses.propagator.vex_vars import VEXReg
 from .resolver import IndirectJumpResolver
 from .propagator_utils import PropagatorLoadCallback
 
 try:
-    from ....engines import pcode
+    from angr.engines import pcode
 except ImportError:
     pcode = None
 
@@ -1723,18 +1723,25 @@ class JumpTableResolver(IndirectJumpResolver):
         all_targets = []
         jump_table = []
 
-        jumptable_si = claripy.SI(bits=project.arch.bits, to_conv=jumptable_addr)
+        if jumptable_addr.op == "BVV":
+            stride = 0
+        else:
+            try:
+                jumptable_si = claripy.backends.vsa.simplify(jumptable_addr)
+                si_annotation = jumptable_si.get_annotation(claripy.annotation.StridedIntervalAnnotation)
+                stride = si_annotation.stride if si_annotation is not None else 0
+            except claripy.errors.BackendError:
+                return None
 
         # we may resolve a vtable (in C, e.g., the IO_JUMPS_FUNC in libc), but the stride of this load is usually 1
         # while the read statement reads a word size at a time.
         # we use this to differentiate between traditional jump tables (where each entry is some blocks that belong to
         # the current function) and vtables (where each entry is a function).
-        if jumptable_si.args[3] < load_size:  # stride < load_size
+        if stride < load_size:
             stride = load_size
             total_cases = jumptable_addr.cardinality // load_size
             sort = "vtable"  # it's probably a vtable!
         else:
-            stride = jumptable_si.args[3]
             total_cases = jumptable_addr.cardinality
             sort = "jumptable"