angr 9.2.120__tar.gz → 9.2.121__tar.gz

{angr-9.2.120/angr.egg-info → angr-9.2.121}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: angr
-Version: 9.2.120
+Version: 9.2.121
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 Home-page: https://github.com/angr/angr
 License: BSD-2-Clause
@@ -15,22 +15,22 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: CppHeaderParser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.120
-Requires-Dist: archinfo==9.2.120
+Requires-Dist: ailment==9.2.121
+Requires-Dist: archinfo==9.2.121
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.120
-Requires-Dist: cle==9.2.120
+Requires-Dist: claripy==9.2.121
+Requires-Dist: cle==9.2.121
 Requires-Dist: itanium-demangler
 Requires-Dist: mulpyplexer
 Requires-Dist: nampa
 Requires-Dist: networkx!=2.8.1,>=2.0
-Requires-Dist: protobuf>=3.19.0
+Requires-Dist: protobuf>=5.28.2
 Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.120
+Requires-Dist: pyvex==9.2.121
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.120 → angr-9.2.121}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.120"
+__version__ = "9.2.121"
 
 if bytes is str:
     raise Exception(

{angr-9.2.120 → angr-9.2.121}/angr/analyses/cfg/cfg_fast.py

@@ -4131,7 +4131,8 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         if self.project.arch.name in {"MIPS64", "MIPS32"} or is_arm_arch(self.project.arch):
             self._ro_region_cdata_cache = []
             for segment in self.project.loader.main_object.segments:
-                if segment.is_readable and not segment.is_writable:
+                if segment.is_readable and segment.memsize >= 8:
+                    # the gp area is sometimes writable, so we can't test for (not segment.is_writable)
                     content = self.project.loader.memory.load(segment.vaddr, segment.memsize)
                     content_buf = pyvex.ffi.from_buffer(content)
                     self._ro_region_cdata_cache.append(content_buf)

{angr-9.2.120 → angr-9.2.121}/angr/analyses/cfg/indirect_jump_resolvers/__init__.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from .mips_elf_fast import MipsElfFastResolver
+from .mips_elf_got import MipsElfGotResolver
 from .x86_elf_pic_plt import X86ElfPicPltResolver
 from .jumptable import JumpTableResolver
 from .x86_pe_iat import X86PeIatResolver
@@ -12,6 +13,7 @@ from .amd64_pe_iat import AMD64PeIatResolver
 
 __all__ = (
     "MipsElfFastResolver",
+    "MipsElfGotResolver",
     "X86ElfPicPltResolver",
     "JumpTableResolver",
     "X86PeIatResolver",

{angr-9.2.120 → angr-9.2.121}/angr/analyses/cfg/indirect_jump_resolvers/default_resolvers.py

@@ -9,6 +9,7 @@ from . import AMD64ElfGotResolver
 from . import ConstantResolver
 from . import ArmElfFastResolver
 from . import AMD64PeIatResolver
+from . import MipsElfGotResolver
 
 DEFAULT_RESOLVERS = {
     "X86": {
@@ -29,6 +30,7 @@ DEFAULT_RESOLVERS = {
     },
     "MIPS32": {
         cle.MetaELF: [
+            MipsElfGotResolver,
             MipsElfFastResolver,
         ],
     },

{angr-9.2.120 → angr-9.2.121}/angr/analyses/cfg/indirect_jump_resolvers/jumptable.py

@@ -1723,21 +1723,25 @@ class JumpTableResolver(IndirectJumpResolver):
         all_targets = []
         jump_table = []
 
-        try:
-            jumptable_si = claripy.SI(bits=project.arch.bits, to_conv=jumptable_addr)
-        except claripy.errors.BackendError:
-            return None
+        if jumptable_addr.op == "BVV":
+            stride = 0
+        else:
+            try:
+                jumptable_si = claripy.backends.vsa.simplify(jumptable_addr)
+                si_annotation = jumptable_si.get_annotation(claripy.annotation.StridedIntervalAnnotation)
+                stride = si_annotation.stride if si_annotation is not None else 0
+            except claripy.errors.BackendError:
+                return None
 
         # we may resolve a vtable (in C, e.g., the IO_JUMPS_FUNC in libc), but the stride of this load is usually 1
         # while the read statement reads a word size at a time.
         # we use this to differentiate between traditional jump tables (where each entry is some blocks that belong to
         # the current function) and vtables (where each entry is a function).
-        if jumptable_si.args[3] < load_size:  # stride < load_size
+        if stride < load_size:
             stride = load_size
             total_cases = jumptable_addr.cardinality // load_size
             sort = "vtable"  # it's probably a vtable!
         else:
-            stride = jumptable_si.args[3]
             total_cases = jumptable_addr.cardinality
             sort = "jumptable"
 

angr-9.2.121/angr/analyses/cfg/indirect_jump_resolvers/mips_elf_fast.py

@@ -0,0 +1,283 @@
+# pylint:disable=too-many-boolean-expressions,global-statement,too-many-positional-arguments
+from __future__ import annotations
+from typing import TYPE_CHECKING
+import logging
+from enum import Enum
+
+import archinfo
+import pyvex
+
+
+from angr.blade import Blade
+from angr.utils.constants import DEFAULT_STATEMENT
+from .resolver import IndirectJumpResolver
+
+if TYPE_CHECKING:
+    from angr.block import Block
+
+
+l = logging.getLogger(name=__name__)
+
+PROFILING = False
+HITS_CASE_1, HITS_CASE_2, MISSES = 0, 0, 0
+
+
+def enable_profiling():
+    global PROFILING, HITS_CASE_1, HITS_CASE_2, MISSES
+
+    PROFILING = True
+    HITS_CASE_1 = 0
+    HITS_CASE_2 = 0
+    MISSES = 0
+
+
+def disable_profiling():
+    global PROFILING
+    PROFILING = False
+
+
+class Case2Result(Enum):
+    """
+    Describes the result of resolving case 2 function calls.
+    """
+
+    SUCCESS = 0
+    FAILURE = 1
+    RESUME = 2
+
+
+class MipsElfFastResolver(IndirectJumpResolver):
+    """
+    A timeless indirect jump resolver for R9-based indirect function calls in MIPS ELFs.
+    """
+
+    def __init__(self, project):
+        super().__init__(project, timeless=True)
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        return isinstance(self.project.arch, (archinfo.ArchMIPS32, archinfo.ArchMIPS64))
+
+    def resolve(  # pylint:disable=unused-argument
+        self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs
+    ):
+        """
+        Wrapper for _resolve that slowly increments the max_depth used by Blade for finding sources
+        until we can resolve the addr or we reach the default max_depth
+
+        :param cfg: A CFG instance.
+        :param int addr: IRSB address.
+        :param int func_addr: The function address.
+        :param pyvex.IRSB block: The IRSB.
+        :param str jumpkind: The jumpkind.
+        :return: If it was resolved and targets alongside it
+        :rtype: tuple
+        """
+        global MISSES
+
+        resolved, resolved_targets = self._resolve(cfg, addr, func_addr, block, jumpkind, max_level=2)
+        if resolved:
+            return resolved, resolved_targets
+
+        if PROFILING:
+            MISSES += 1
+        return False, []
+
+    def _resolve(self, cfg, addr, func_addr, block, jumpkind, max_level):  # pylint:disable=unused-argument
+        """
+        Resolves the indirect jump in MIPS ELF binaries where all external function calls are indexed using gp.
+
+        :param cfg: A CFG instance.
+        :param int addr: IRSB address.
+        :param int func_addr: The function address.
+        :param pyvex.IRSB block: The IRSB.
+        :param str jumpkind: The jumpkind.
+        :param int max_level: maximum level for Blade to resolve when looking for sources
+        :return: If it was resolved and targets alongside it
+        :rtype: tuple
+        """
+
+        global HITS_CASE_1, HITS_CASE_2
+
+        func = cfg.kb.functions.function(addr=func_addr)
+        b = Blade(
+            cfg.graph,
+            addr,
+            -1,
+            cfg=cfg,
+            project=self.project,
+            ignore_sp=True,
+            ignore_bp=True,
+            ignored_regs=("gp",),
+            cross_insn_opt=False,
+            stop_at_calls=True,
+            max_level=max_level,
+            include_imarks=False,
+        )
+
+        gp_value = func.info.get("gp", None)
+
+        # see if gp is used on this slice at all
+        gp_used = self._is_gp_used_on_slice(self.project, b)
+        if gp_used and gp_value is None:
+            # this might a special case: gp is only used once in this function, and it can be initialized right
+            # before its use site.
+            # however, it should have been determined in CFGFast
+            # cannot determine the value of gp. quit
+            l.warning("Failed to determine value of register gp for function %#x.", func.addr)
+            return False, []
+
+        # we support two cases:
+        # Case 1. t9 is set in the current block, and jalr $t9 at the end of the same block.
+        # Case 2. t9 is set in both predecessor blocks, and jalr $t9 at the end of the current block.
+
+        block_addrs = {block_addr for block_addr, _ in b.slice}
+        if len(block_addrs) == 2 and addr in block_addrs:
+            first_block_addr = next(iter(block_addrs - {addr}))
+            r, target = self._resolve_case_2(first_block_addr, block, func_addr, gp_value, cfg)
+            if r == Case2Result.SUCCESS:
+                if PROFILING:
+                    HITS_CASE_2 += 1
+                return True, [target]
+            if r == Case2Result.FAILURE:
+                return False, []
+            # otherwise, we need to resume the analysis
+
+        target = self._resolve_case_1(addr, block, func_addr, gp_value, cfg)
+        if target is not None:
+            if PROFILING:
+                HITS_CASE_1 += 1
+            return True, [target]
+
+        # no luck
+        return False, []
+
+    def _resolve_case_1(self, addr: int, block: pyvex.IRSB, func_addr: int, gp_value: int, cfg) -> int | None:
+        # lift the block again with the correct setting
+        first_irsb = self.project.factory.block(
+            addr,
+            size=block.size,
+            collect_data_refs=False,
+            const_prop=True,
+            cross_insn_opt=False,
+            load_from_ro_regions=True,
+            initial_regs=[
+                (self.project.arch.registers["t9"][0], self.project.arch.registers["t9"][1], func_addr),
+                (self.project.arch.registers["gp"][0], self.project.arch.registers["gp"][1], gp_value),
+            ],
+        ).vex_nostmt
+
+        if not isinstance(first_irsb.next, pyvex.IRExpr.RdTmp):
+            return None
+        target_tmp = first_irsb.next.tmp
+        if first_irsb.const_vals is None:
+            return None
+
+        # find the value of the next tmp
+        for cv in first_irsb.const_vals:
+            if cv.tmp == target_tmp:
+                target = cv.value
+                if self._is_target_valid(cfg, target):
+                    return target
+                break
+
+        return None
+
+    def _resolve_case_2(
+        self, first_block_addr: int, second_block: pyvex.IRSB, func_addr: int, gp_value: int, cfg
+    ) -> tuple[Case2Result, int | None]:
+        jump_target_reg = self._get_jump_target_reg(second_block)
+        if jump_target_reg is None:
+            return Case2Result.FAILURE, None
+        last_reg_setting_tmp = self._get_last_reg_setting_tmp(second_block, jump_target_reg)
+        if last_reg_setting_tmp is not None:
+            # the register (t9) is set in this block - we can resolve the jump target using only the current block
+            return Case2Result.RESUME, None
+
+        # lift the first block again with the correct setting
+        first_irsb = self.project.factory.block(
+            first_block_addr,
+            cross_insn_opt=False,
+            collect_data_refs=False,
+            const_prop=True,
+            load_from_ro_regions=True,
+            initial_regs=[
+                (self.project.arch.registers["t9"][0], self.project.arch.registers["t9"][1], func_addr),
+                (self.project.arch.registers["gp"][0], self.project.arch.registers["gp"][1], gp_value),
+            ],
+        ).vex_nostmt
+
+        last_reg_setting_tmp = self._get_last_reg_setting_tmp(first_irsb, jump_target_reg)
+        if last_reg_setting_tmp is None:
+            return Case2Result.FAILURE, None
+
+        # find the value of the next tmp
+        if first_irsb.const_vals is None:
+            return Case2Result.FAILURE, None
+        for cv in first_irsb.const_vals:
+            if cv.tmp == last_reg_setting_tmp:
+                target = cv.value
+                if self._is_target_valid(cfg, target):
+                    return Case2Result.SUCCESS, target
+                break
+
+        return Case2Result.FAILURE, None
+
+    @staticmethod
+    def _get_jump_target_reg(block: pyvex.IRSB) -> int | None:
+        if block.jumpkind != "Ijk_Call":
+            return None
+        if not isinstance(block.next, pyvex.IRExpr.RdTmp):
+            return None
+        next_tmp = block.next.tmp
+
+        for stmt in reversed(block.statements):
+            if (
+                isinstance(stmt, pyvex.IRStmt.Put)
+                and isinstance(stmt.data, pyvex.IRExpr.RdTmp)
+                and stmt.data.tmp == next_tmp
+            ):
+                return stmt.offset
+            if (
+                isinstance(stmt, pyvex.IRStmt.WrTmp)
+                and stmt.tmp == next_tmp
+                and isinstance(stmt.data, pyvex.IRExpr.Get)
+            ):
+                return stmt.data.offset
+
+        return None
+
+    @staticmethod
+    def _get_last_reg_setting_tmp(block: pyvex.IRSB, target_reg: int) -> int | None:
+        for stmt in reversed(block.statements):
+            if isinstance(stmt, pyvex.IRStmt.Put) and stmt.offset == target_reg:
+                if isinstance(stmt.data, pyvex.IRExpr.RdTmp):
+                    return stmt.data.tmp
+                return None
+
+        return None
+
+    @staticmethod
+    def _is_gp_used_on_slice(project, b: Blade) -> bool:
+        gp_offset = project.arch.registers["gp"][0]
+        blocks_on_slice: dict[int, Block] = {}
+        for block_addr, block_stmt_idx in b.slice.nodes():
+            if block_addr not in blocks_on_slice:
+                blocks_on_slice[block_addr] = project.factory.block(block_addr, cross_insn_opt=False)
+            block = blocks_on_slice[block_addr]
+            if block_stmt_idx == DEFAULT_STATEMENT:
+                if isinstance(block.vex.next, pyvex.IRExpr.Get) and block.vex.next.offset == gp_offset:
+                    gp_used = True
+                    break
+            else:
+                stmt = block.vex.statements[block_stmt_idx]
+                if (
+                    isinstance(stmt, pyvex.IRStmt.WrTmp)
+                    and isinstance(stmt.data, pyvex.IRExpr.Get)
+                    and stmt.data.offset == gp_offset
+                ):
+                    gp_used = True
+                    break
+        else:
+            gp_used = False
+
+        return gp_used

angr-9.2.121/angr/analyses/cfg/indirect_jump_resolvers/mips_elf_got.py

@@ -0,0 +1,148 @@
+# pylint:disable=too-many-positional-arguments
+from __future__ import annotations
+import logging
+
+from capstone.mips_const import (
+    MIPS_REG_T7,
+    MIPS_REG_T8,
+    MIPS_REG_T9,
+    MIPS_REG_RA,
+    MIPS_REG_ZERO,
+    MIPS_OP_REG,
+    MIPS_OP_IMM,
+)
+
+import cle
+
+from .resolver import IndirectJumpResolver
+
+l = logging.getLogger(name=__name__)
+
+
+class MipsElfGotResolver(IndirectJumpResolver):
+    """
+    A timeless indirect jump resolver that resolves GOT stub entries in MIPS ELF binaries.
+
+    Reference: MIPS Assembly Language Programmer's Guide, Calling Position Independent Functions
+    """
+
+    def __init__(self, project):
+        super().__init__(project, timeless=True)
+
+        self._section_cache: dict[tuple[int, str], int] = {}
+        self._simproc_cache: dict[str, int] | None = None
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        return jumpkind == "Ijk_Call" and addr == func_addr
+
+    def resolve(  # pylint:disable=unused-argument
+        self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs
+    ):
+        # The stub must look like the following:
+        #   585b80  lw      $t9, -0x7ff0($gp)
+        #   585b84  move    $t7, $ra
+        #   585b88  jalr    $t9
+        #   585b8c  addiu   $t8, $zero, 0x84b
+
+        obj = self.project.loader.find_object_containing(addr)
+        if obj is None:
+            return False, []
+        if not isinstance(obj, cle.ELF):
+            return False, []
+        dynsym_addr = self._find_and_cache_section_addr(obj, ".dynsym")
+        if dynsym_addr is None:
+            return None
+
+        dynstr_addr = self._find_and_cache_section_addr(obj, ".dynstr")
+        if dynstr_addr is None:
+            return None
+
+        if block.size != 16:
+            return False, []
+        the_block = self.project.factory.block(block.addr, size=block.size)
+        if len(the_block.capstone.insns) != 4:
+            return False, []
+
+        insn0 = the_block.capstone.insns[0]
+        if not (
+            insn0.insn.mnemonic == "lw"
+            and insn0.insn.operands[0].type == MIPS_OP_REG
+            and insn0.insn.operands[0].reg == MIPS_REG_T9
+        ):
+            return False, []
+
+        insn1 = the_block.capstone.insns[1]
+        if not (
+            insn1.insn.mnemonic == "move"
+            and insn1.insn.operands[0].type == MIPS_OP_REG
+            and insn1.insn.operands[0].reg == MIPS_REG_T7
+            and insn1.insn.operands[1].type == MIPS_OP_REG
+            and insn1.insn.operands[1].reg == MIPS_REG_RA
+        ):
+            return False, []
+
+        insn2 = the_block.capstone.insns[2]
+        if not (
+            insn2.insn.mnemonic == "jalr"
+            and insn2.insn.operands[0].type == MIPS_OP_REG
+            and insn2.insn.operands[0].reg == MIPS_REG_T9
+        ):
+            return False, []
+
+        insn3 = the_block.capstone.insns[3]
+        if not (
+            insn3.insn.mnemonic == "addiu"
+            and insn3.insn.operands[0].type == MIPS_OP_REG
+            and insn3.insn.operands[0].reg == MIPS_REG_T8
+            and insn3.insn.operands[1].type == MIPS_OP_REG
+            and insn3.insn.operands[1].reg == MIPS_REG_ZERO
+            and insn3.insn.operands[2].type == MIPS_OP_IMM
+        ):
+            return False, []
+
+        dynsym_index = insn3.insn.operands[2].imm
+        symbol_addr = dynsym_addr + dynsym_index * 16
+
+        symbol_name_index = self.project.loader.memory.unpack_word(symbol_addr, size=4)
+        symbol_name_addr = dynstr_addr + symbol_name_index
+        symbol_name_bytes = self.project.loader.memory.load_null_terminated_bytes(symbol_name_addr, 512)
+
+        try:
+            symbol_name = symbol_name_bytes.strip(b"\x00").decode("ascii")
+        except UnicodeDecodeError:
+            return False, []
+
+        symbol = obj.symbols_by_name.get(symbol_name, None)
+        if symbol is None:
+            return False, []
+
+        if symbol.rebased_addr != func_addr:
+            l.debug("Resolved target to %s @ %#x", symbol_name, symbol.rebased_addr)
+            return True, [symbol.rebased_addr]
+
+        # find out if there is a SimProcedure for this import symbol
+        simproc_addr = self._cache_and_find_simproc_by_name(symbol_name)
+        if simproc_addr is not None:
+            l.debug("Resolved target to %s @ %#x", symbol_name, simproc_addr)
+            return True, [simproc_addr]
+        return False, []
+
+    def _find_and_cache_section_addr(self, obj, section_name: str) -> int | None:
+        cache_key = (obj.min_addr, section_name)
+        if cache_key in self._section_cache:
+            return self._section_cache[cache_key]
+
+        for sec in obj.sections:
+            if sec.name == section_name:
+                # cache it
+                self._section_cache[cache_key] = sec.vaddr
+                return sec.vaddr
+        return None
+
+    def _cache_and_find_simproc_by_name(self, symbol_name: str) -> int | None:
+        if self._simproc_cache is None:
+            self._simproc_cache = {}
+            for addr, simproc in self.project._sim_procedures.items():
+                self._simproc_cache[simproc.display_name] = addr
+
+        return self._simproc_cache.get(symbol_name)

{angr-9.2.120 → angr-9.2.121}/angr/analyses/decompiler/ccall_rewriters/amd64_ccalls.py

@@ -240,6 +240,26 @@ class AMD64CCallRewriter(CCallRewriterBase):
 
                         r = Expr.BinaryOp(ccall.idx, expr_op, (masked_dep, zero), False, **ccall.tags)
                         return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
+                    if op_v in {
+                        AMD64_OpTypes["G_CC_OP_DECB"],
+                        AMD64_OpTypes["G_CC_OP_DECW"],
+                        AMD64_OpTypes["G_CC_OP_DECL"],
+                        AMD64_OpTypes["G_CC_OP_DECQ"],
+                    }:
+                        # dep_1 == 0 or dep_1 != 0
+                        dep_1 = self._fix_size(
+                            dep_1,
+                            op_v,
+                            AMD64_OpTypes["G_CC_OP_SHRB"],
+                            AMD64_OpTypes["G_CC_OP_SHRW"],
+                            AMD64_OpTypes["G_CC_OP_SHRL"],
+                            ccall.tags,
+                        )
+                        expr_op = "CmpEQ" if cond_v == AMD64_CondTypes["CondZ"] else "CmpNE"
+
+                        zero = Expr.Const(None, None, 0, dep_1.bits)
+                        r = Expr.BinaryOp(ccall.idx, expr_op, (dep_1, zero), False, **ccall.tags)
+                        return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
                 elif cond_v == AMD64_CondTypes["CondL"]:
                     if op_v in {
                         AMD64_OpTypes["G_CC_OP_SUBB"],