angr 9.2.122__py3-none-manylinux2014_aarch64.whl → 9.2.124__py3-none-manylinux2014_aarch64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +1 -1
- angr/analyses/calling_convention.py +6 -1
- angr/analyses/cfg/indirect_jump_resolvers/mips_elf_fast.py +11 -8
- angr/analyses/cfg/indirect_jump_resolvers/mips_elf_got.py +2 -2
- angr/analyses/decompiler/ail_simplifier.py +38 -342
- angr/analyses/decompiler/callsite_maker.py +8 -7
- angr/analyses/decompiler/ccall_rewriters/amd64_ccalls.py +24 -2
- angr/analyses/decompiler/clinic.py +30 -3
- angr/analyses/decompiler/condition_processor.py +10 -3
- angr/analyses/decompiler/decompilation_cache.py +2 -0
- angr/analyses/decompiler/decompiler.py +50 -8
- angr/analyses/decompiler/dephication/graph_vvar_mapping.py +10 -2
- angr/analyses/decompiler/dephication/rewriting_engine.py +65 -2
- angr/analyses/decompiler/expression_narrower.py +206 -6
- angr/analyses/decompiler/optimization_passes/div_simplifier.py +4 -1
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +7 -0
- angr/analyses/decompiler/optimization_passes/ite_region_converter.py +34 -11
- angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +10 -1
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +3 -1
- angr/analyses/decompiler/optimization_passes/return_duplicator_base.py +8 -5
- angr/analyses/decompiler/optimization_passes/return_duplicator_high.py +10 -5
- angr/analyses/decompiler/optimization_passes/return_duplicator_low.py +18 -7
- angr/analyses/decompiler/optimization_passes/switch_default_case_duplicator.py +6 -0
- angr/analyses/decompiler/optimization_passes/win_stack_canary_simplifier.py +2 -0
- angr/analyses/decompiler/peephole_optimizations/const_mull_a_shift.py +75 -42
- angr/analyses/decompiler/peephole_optimizations/remove_cascading_conversions.py +8 -2
- angr/analyses/decompiler/region_identifier.py +36 -0
- angr/analyses/decompiler/region_simplifiers/expr_folding.py +4 -0
- angr/analyses/decompiler/region_simplifiers/loop.py +2 -8
- angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +9 -3
- angr/analyses/decompiler/sequence_walker.py +20 -4
- angr/analyses/decompiler/ssailification/rewriting.py +5 -2
- angr/analyses/decompiler/ssailification/rewriting_engine.py +151 -25
- angr/analyses/decompiler/ssailification/rewriting_state.py +1 -0
- angr/analyses/decompiler/ssailification/ssailification.py +17 -9
- angr/analyses/decompiler/ssailification/traversal.py +3 -1
- angr/analyses/decompiler/ssailification/traversal_engine.py +35 -8
- angr/analyses/decompiler/ssailification/traversal_state.py +1 -0
- angr/analyses/decompiler/structured_codegen/c.py +42 -4
- angr/analyses/decompiler/structuring/phoenix.py +3 -0
- angr/analyses/propagator/engine_ail.py +10 -3
- angr/analyses/reaching_definitions/engine_ail.py +10 -15
- angr/analyses/s_propagator.py +26 -15
- angr/analyses/s_reaching_definitions/s_rda_view.py +127 -63
- angr/analyses/variable_recovery/engine_ail.py +14 -0
- angr/analyses/variable_recovery/engine_base.py +11 -0
- angr/calling_conventions.py +2 -2
- angr/engines/light/engine.py +24 -2
- angr/engines/soot/expressions/instanceOf.py +4 -1
- angr/engines/successors.py +1 -1
- angr/engines/vex/heavy/concretizers.py +47 -47
- angr/engines/vex/heavy/dirty.py +4 -4
- angr/knowledge_plugins/__init__.py +2 -0
- angr/knowledge_plugins/decompilation.py +45 -0
- angr/knowledge_plugins/key_definitions/atoms.py +8 -0
- angr/procedures/definitions/parse_win32json.py +2 -1
- angr/procedures/java_lang/getsimplename.py +4 -1
- angr/procedures/linux_kernel/iovec.py +5 -2
- angr/sim_type.py +3 -1
- angr/storage/memory_mixins/actions_mixin.py +7 -7
- angr/storage/memory_mixins/address_concretization_mixin.py +5 -5
- angr/storage/memory_mixins/bvv_conversion_mixin.py +1 -1
- angr/storage/memory_mixins/clouseau_mixin.py +3 -3
- angr/storage/memory_mixins/conditional_store_mixin.py +3 -3
- angr/storage/memory_mixins/default_filler_mixin.py +3 -3
- angr/storage/memory_mixins/memory_mixin.py +45 -34
- angr/storage/memory_mixins/paged_memory/page_backer_mixins.py +15 -14
- angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +27 -16
- angr/storage/memory_mixins/paged_memory/pages/cooperation.py +18 -9
- angr/storage/memory_mixins/paged_memory/pages/ispo_mixin.py +5 -5
- angr/storage/memory_mixins/paged_memory/pages/multi_values.py +89 -55
- angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +16 -25
- angr/storage/memory_mixins/paged_memory/pages/permissions_mixin.py +11 -9
- angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +23 -7
- angr/storage/memory_mixins/paged_memory/privileged_mixin.py +1 -1
- angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +9 -7
- angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +9 -9
- angr/storage/memory_mixins/regioned_memory/static_find_mixin.py +1 -0
- angr/storage/memory_mixins/simple_interface_mixin.py +2 -2
- angr/storage/memory_mixins/simplification_mixin.py +2 -2
- angr/storage/memory_mixins/size_resolution_mixin.py +1 -1
- angr/storage/memory_mixins/slotted_memory.py +3 -3
- angr/storage/memory_mixins/smart_find_mixin.py +1 -0
- angr/storage/memory_mixins/underconstrained_mixin.py +5 -5
- angr/storage/memory_mixins/unwrapper_mixin.py +4 -4
- angr/storage/memory_object.py +4 -3
- angr/utils/constants.py +1 -1
- angr/utils/graph.py +15 -0
- angr/vaults.py +2 -2
- {angr-9.2.122.dist-info → angr-9.2.124.dist-info}/METADATA +7 -6
- {angr-9.2.122.dist-info → angr-9.2.124.dist-info}/RECORD +95 -94
- {angr-9.2.122.dist-info → angr-9.2.124.dist-info}/WHEEL +1 -1
- {angr-9.2.122.dist-info → angr-9.2.124.dist-info}/LICENSE +0 -0
- {angr-9.2.122.dist-info → angr-9.2.124.dist-info}/entry_points.txt +0 -0
- {angr-9.2.122.dist-info → angr-9.2.124.dist-info}/top_level.txt +0 -0
|
@@ -23,7 +23,7 @@ def concretize_2xm1(state, args):
|
|
|
23
23
|
# 2xm1(x) = 2 ** x - 1. Concretize 2**x part alone since only that cannot be modelled in Z3.
|
|
24
24
|
arg_x = state.solver.eval(args[1])
|
|
25
25
|
if -1 <= arg_x <= 1:
|
|
26
|
-
return
|
|
26
|
+
return claripy.FPV(math.pow(2, arg_x) - 1, claripy.FSORT_DOUBLE)
|
|
27
27
|
|
|
28
28
|
# If x is outside range [-1.0, 1.0], result is undefined. We return argument itself as observed on an Intel CPU.
|
|
29
29
|
return args[1]
|
|
@@ -31,26 +31,26 @@ def concretize_2xm1(state, args):
|
|
|
31
31
|
|
|
32
32
|
def concretize_abs_float64(state, args):
|
|
33
33
|
arg_val = state.solver.eval(args[0])
|
|
34
|
-
return
|
|
34
|
+
return claripy.FPV(abs(arg_val), args[0].sort)
|
|
35
35
|
|
|
36
36
|
|
|
37
37
|
def concretize_add_float64(state, args):
|
|
38
38
|
arg0 = state.solver.eval(args[1])
|
|
39
39
|
arg1 = state.solver.eval(args[2])
|
|
40
|
-
return
|
|
40
|
+
return claripy.FPV(arg0 + arg1, claripy.FSORT_DOUBLE)
|
|
41
41
|
|
|
42
42
|
|
|
43
43
|
def concretize_add32f04(state, args):
|
|
44
44
|
fp_arg0 = state.solver.eval(args[0][31:0].raw_to_fp())
|
|
45
45
|
fp_arg1 = state.solver.eval(args[1][31:0].raw_to_fp())
|
|
46
|
-
result =
|
|
46
|
+
result = claripy.FPV(fp_arg0 + fp_arg1, claripy.FSORT_FLOAT).raw_to_bv()
|
|
47
47
|
return claripy.Concat(args[0][(args[0].length - 1) : result.size()], result)
|
|
48
48
|
|
|
49
49
|
|
|
50
50
|
def concretize_add64f02(state, args):
|
|
51
51
|
fp_arg0 = state.solver.eval(args[0][63:0].raw_to_fp())
|
|
52
52
|
fp_arg1 = state.solver.eval(args[1][63:0].raw_to_fp())
|
|
53
|
-
result =
|
|
53
|
+
result = claripy.FPV(fp_arg0 + fp_arg1, claripy.FSORT_DOUBLE).raw_to_bv()
|
|
54
54
|
return claripy.Concat(args[0][(args[0].length - 1) : result.size()], result)
|
|
55
55
|
|
|
56
56
|
|
|
@@ -71,18 +71,18 @@ def concretize_divf64(state, args):
|
|
|
71
71
|
arg1 = state.solver.eval(args[1])
|
|
72
72
|
arg2 = state.solver.eval(args[2])
|
|
73
73
|
if arg2 == 0:
|
|
74
|
-
return
|
|
74
|
+
return claripy.FPV(math.inf, args[1].sort)
|
|
75
75
|
|
|
76
|
-
return
|
|
76
|
+
return claripy.FPV(arg1 / arg2, args[1].sort)
|
|
77
77
|
|
|
78
78
|
|
|
79
79
|
def concretize_div32f04(state, args):
|
|
80
80
|
fp_arg0 = state.solver.eval(args[0][31:0].raw_to_fp())
|
|
81
81
|
fp_arg1 = state.solver.eval(args[1][31:0].raw_to_fp())
|
|
82
82
|
if fp_arg1 == 0:
|
|
83
|
-
result =
|
|
83
|
+
result = claripy.FPV(math.inf, claripy.FSORT_FLOAT).raw_to_bv()
|
|
84
84
|
else:
|
|
85
|
-
result =
|
|
85
|
+
result = claripy.FPV(fp_arg0 / fp_arg1, claripy.FSORT_FLOAT).raw_to_bv()
|
|
86
86
|
|
|
87
87
|
return claripy.Concat(args[0][(args[0].length - 1) : result.size()], result)
|
|
88
88
|
|
|
@@ -91,21 +91,21 @@ def concretize_div64f02(state, args):
|
|
|
91
91
|
fp_arg0 = state.solver.eval(args[0][63:0].raw_to_fp())
|
|
92
92
|
fp_arg1 = state.solver.eval(args[1][63:0].raw_to_fp())
|
|
93
93
|
if fp_arg1 == 0:
|
|
94
|
-
result =
|
|
94
|
+
result = claripy.FPV(math.inf, claripy.FSORT_DOUBLE).raw_to_bv()
|
|
95
95
|
else:
|
|
96
|
-
result =
|
|
96
|
+
result = claripy.FPV(fp_arg0 / fp_arg1, claripy.FSORT_DOUBLE).raw_to_bv()
|
|
97
97
|
|
|
98
98
|
return claripy.Concat(args[0][(args[0].length - 1) : result.size()], result)
|
|
99
99
|
|
|
100
100
|
|
|
101
101
|
def concretize_float32_to_float64(state, args):
|
|
102
102
|
arg0 = state.solver.eval(args[0])
|
|
103
|
-
return
|
|
103
|
+
return claripy.FPV(arg0, claripy.FSORT_DOUBLE)
|
|
104
104
|
|
|
105
105
|
|
|
106
106
|
def concretize_float64_to_float32(state, args):
|
|
107
107
|
arg = state.solver.eval(args[1])
|
|
108
|
-
return
|
|
108
|
+
return claripy.FPV(arg, claripy.FSORT_FLOAT)
|
|
109
109
|
|
|
110
110
|
|
|
111
111
|
def concretize_float64_to_int64s(state, args):
|
|
@@ -127,20 +127,20 @@ def concretize_int64s_to_float64(state, args):
|
|
|
127
127
|
def concretize_mulf64(state, args):
|
|
128
128
|
arg1 = state.solver.eval(args[1])
|
|
129
129
|
arg2 = state.solver.eval(args[2])
|
|
130
|
-
return
|
|
130
|
+
return claripy.FPV(arg1 / arg2, args[1].sort)
|
|
131
131
|
|
|
132
132
|
|
|
133
133
|
def concretize_mul32f04(state, args):
|
|
134
134
|
fp_arg0 = state.solver.eval(args[0][31:0].raw_to_fp())
|
|
135
135
|
fp_arg1 = state.solver.eval(args[1][31:0].raw_to_fp())
|
|
136
|
-
result =
|
|
136
|
+
result = claripy.FPV(fp_arg0 * fp_arg1, claripy.FSORT_FLOAT).raw_to_bv()
|
|
137
137
|
return claripy.Concat(args[0][(args[0].length - 1) : result.size()], result)
|
|
138
138
|
|
|
139
139
|
|
|
140
140
|
def concretize_mul64f02(state, args):
|
|
141
141
|
fp_arg0 = state.solver.eval(args[0][63:0].raw_to_fp())
|
|
142
142
|
fp_arg1 = state.solver.eval(args[1][63:0].raw_to_fp())
|
|
143
|
-
result =
|
|
143
|
+
result = claripy.FPV(fp_arg0 * fp_arg1, claripy.FSORT_DOUBLE).raw_to_bv()
|
|
144
144
|
return claripy.Concat(args[0][(args[0].length - 1) : result.size()], result)
|
|
145
145
|
|
|
146
146
|
|
|
@@ -149,24 +149,24 @@ def concretize_fscale(state, args):
|
|
|
149
149
|
arg_x = state.solver.eval(args[1])
|
|
150
150
|
arg_y = math.floor(state.solver.eval(args[2]))
|
|
151
151
|
if math.isnan(arg_x) or math.isnan(arg_y):
|
|
152
|
-
return
|
|
152
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
153
153
|
|
|
154
154
|
if abs(arg_x) == math.inf and arg_y == -1 * math.inf:
|
|
155
|
-
return
|
|
155
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
156
156
|
|
|
157
157
|
if arg_x == 0.0 and arg_y == math.inf:
|
|
158
|
-
return
|
|
158
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
159
159
|
|
|
160
|
-
return
|
|
160
|
+
return claripy.FPV(arg_x * math.pow(2, arg_y), claripy.FSORT_DOUBLE)
|
|
161
161
|
|
|
162
162
|
|
|
163
163
|
def concretize_fsqrt(state, args):
|
|
164
164
|
# Concretize floating point square root. Z3 does support square root but unsure if that includes floating point
|
|
165
165
|
arg_1 = state.solver.eval(args[1])
|
|
166
166
|
if arg_1 < 0 or math.isnan(arg_1):
|
|
167
|
-
return
|
|
167
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
168
168
|
|
|
169
|
-
return
|
|
169
|
+
return claripy.FPV(math.sqrt(arg_1), claripy.FSORT_DOUBLE)
|
|
170
170
|
|
|
171
171
|
|
|
172
172
|
def concretize_prem(state, args):
|
|
@@ -175,7 +175,7 @@ def concretize_prem(state, args):
|
|
|
175
175
|
dividend = state.solver.eval(args[1])
|
|
176
176
|
divisor = state.solver.eval(args[2])
|
|
177
177
|
if math.isnan(dividend) or math.isnan(divisor) or abs(dividend) == math.inf or divisor == 0.0:
|
|
178
|
-
return
|
|
178
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
179
179
|
|
|
180
180
|
if abs(divisor) == math.inf or dividend == 0.0:
|
|
181
181
|
return args[1]
|
|
@@ -194,9 +194,9 @@ def concretize_prem(state, args):
|
|
|
194
194
|
|
|
195
195
|
if result == 0.0 and math.copysign(1.0, dividend) < 0:
|
|
196
196
|
# According to Intel manual, if result is 0, its sign should be same as that of dividend.
|
|
197
|
-
return
|
|
197
|
+
return claripy.FPV(-0.0, claripy.FSORT_DOUBLE)
|
|
198
198
|
|
|
199
|
-
return
|
|
199
|
+
return claripy.FPV(result, claripy.FSORT_DOUBLE)
|
|
200
200
|
|
|
201
201
|
|
|
202
202
|
def concretize_prem_flags(state, args):
|
|
@@ -241,20 +241,20 @@ def concretize_prem_flags(state, args):
|
|
|
241
241
|
|
|
242
242
|
|
|
243
243
|
def concretize_reinterp_float64_as_int64(state, args):
|
|
244
|
-
return
|
|
244
|
+
return claripy.FPV(state.solver.eval(args[0]), args[0].sort).raw_to_bv()
|
|
245
245
|
|
|
246
246
|
|
|
247
247
|
def concretize_sub32f04(state, args):
|
|
248
248
|
fp_arg0 = state.solver.eval(args[0][31:0].raw_to_fp())
|
|
249
249
|
fp_arg1 = state.solver.eval(args[1][31:0].raw_to_fp())
|
|
250
|
-
result =
|
|
250
|
+
result = claripy.FPV(fp_arg0 - fp_arg1, claripy.FSORT_FLOAT).raw_to_bv()
|
|
251
251
|
return claripy.Concat(args[0][(args[0].length - 1) : result.size()], result)
|
|
252
252
|
|
|
253
253
|
|
|
254
254
|
def concretize_sub64f02(state, args):
|
|
255
255
|
fp_arg0 = state.solver.eval(args[0][63:0].raw_to_fp())
|
|
256
256
|
fp_arg1 = state.solver.eval(args[1][63:0].raw_to_fp())
|
|
257
|
-
result =
|
|
257
|
+
result = claripy.FPV(fp_arg0 - fp_arg1, claripy.FSORT_DOUBLE).raw_to_bv()
|
|
258
258
|
return claripy.Concat(args[0][(args[0].length - 1) : result.size()], result)
|
|
259
259
|
|
|
260
260
|
|
|
@@ -265,18 +265,18 @@ def concretize_trig_cos(state, args):
|
|
|
265
265
|
abs_arg_x = abs(arg_x)
|
|
266
266
|
|
|
267
267
|
if math.isnan(abs_arg_x):
|
|
268
|
-
return
|
|
268
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
269
269
|
|
|
270
270
|
if abs_arg_x == math.inf:
|
|
271
271
|
# Floating-point invalid-operation exception
|
|
272
|
-
return
|
|
272
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
273
273
|
|
|
274
274
|
if abs_arg_x > pow(2, 63):
|
|
275
275
|
# Intel manual says argument must be in range [-2^63, 2^63]. Otherwise, floating-point invalid-operation
|
|
276
276
|
# exception: leave value changed
|
|
277
277
|
return args[1]
|
|
278
278
|
|
|
279
|
-
return
|
|
279
|
+
return claripy.FPV(math.cos(arg_x), claripy.FSORT_DOUBLE)
|
|
280
280
|
|
|
281
281
|
|
|
282
282
|
def concretize_trig_sin(state, args):
|
|
@@ -286,18 +286,18 @@ def concretize_trig_sin(state, args):
|
|
|
286
286
|
abs_arg_x = abs(arg_x)
|
|
287
287
|
|
|
288
288
|
if math.isnan(abs_arg_x):
|
|
289
|
-
return
|
|
289
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
290
290
|
|
|
291
291
|
if abs_arg_x == math.inf:
|
|
292
292
|
# Floating-point invalid-operation exception
|
|
293
|
-
return
|
|
293
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
294
294
|
|
|
295
295
|
if abs_arg_x > pow(2, 63):
|
|
296
296
|
# Intel manual says argument must be in range [-2^63, 2^63]. Otherwise, floating-point invalid-operation
|
|
297
297
|
# exception: leave value changed
|
|
298
298
|
return args[1]
|
|
299
299
|
|
|
300
|
-
return
|
|
300
|
+
return claripy.FPV(math.sin(arg_x), claripy.FSORT_DOUBLE)
|
|
301
301
|
|
|
302
302
|
|
|
303
303
|
def concretize_trig_tan(state, args):
|
|
@@ -307,18 +307,18 @@ def concretize_trig_tan(state, args):
|
|
|
307
307
|
abs_arg_x = abs(arg_x)
|
|
308
308
|
|
|
309
309
|
if math.isnan(abs_arg_x):
|
|
310
|
-
return
|
|
310
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
311
311
|
|
|
312
312
|
if abs_arg_x == math.inf:
|
|
313
313
|
# Floating-point invalid-operation exception
|
|
314
|
-
return
|
|
314
|
+
return claripy.FPV(math.nan, claripy.FSORT_DOUBLE)
|
|
315
315
|
|
|
316
316
|
if abs_arg_x > pow(2, 63):
|
|
317
317
|
# Intel manual says argument must be in range [-2^63, 2^63]. Otherwise, floating-point invalid-operation
|
|
318
318
|
# exception: leave value changed
|
|
319
319
|
return args[1]
|
|
320
320
|
|
|
321
|
-
return
|
|
321
|
+
return claripy.FPV(math.tan(arg_x), claripy.FSORT_DOUBLE)
|
|
322
322
|
|
|
323
323
|
|
|
324
324
|
def concretize_yl2x(state, args):
|
|
@@ -330,35 +330,35 @@ def concretize_yl2x(state, args):
|
|
|
330
330
|
arg_y = state.solver.eval(args[1])
|
|
331
331
|
if arg_x < 0:
|
|
332
332
|
# TODO: Indicate floating-point invalid-operation exception
|
|
333
|
-
return
|
|
333
|
+
return claripy.FPV(arg_x, claripy.FSORT_DOUBLE)
|
|
334
334
|
|
|
335
335
|
if arg_x == 0:
|
|
336
336
|
if abs(arg_y) == math.inf:
|
|
337
|
-
return
|
|
337
|
+
return claripy.FPV(-1 * arg_y, claripy.FSORT_DOUBLE)
|
|
338
338
|
if arg_y == 0:
|
|
339
339
|
# TODO: Indicate floating-point invalid-operation exception
|
|
340
|
-
return
|
|
340
|
+
return claripy.FPV(arg_x, claripy.FSORT_DOUBLE)
|
|
341
341
|
# TODO: Indicate floating-point zero-division exception
|
|
342
|
-
return
|
|
342
|
+
return claripy.FPV(arg_x, claripy.FSORT_DOUBLE)
|
|
343
343
|
|
|
344
344
|
if arg_x == 1:
|
|
345
345
|
if abs(arg_y) == math.inf:
|
|
346
346
|
# TODO: Indicate floating-point invalid-operation exception
|
|
347
|
-
return
|
|
347
|
+
return claripy.FPV(arg_x, claripy.FSORT_DOUBLE)
|
|
348
348
|
|
|
349
349
|
# TODO: How to distinguish between +0 and -0?
|
|
350
|
-
return
|
|
350
|
+
return claripy.FPV(0, claripy.FSORT_DOUBLE)
|
|
351
351
|
|
|
352
352
|
if arg_x == math.inf:
|
|
353
353
|
if arg_y == 0:
|
|
354
354
|
# TODO: Indicate floating-point invalid-operation exception
|
|
355
|
-
return
|
|
355
|
+
return claripy.FPV(arg_x, claripy.FSORT_DOUBLE)
|
|
356
356
|
if arg_y < 0:
|
|
357
|
-
return
|
|
357
|
+
return claripy.FPV(-1 * math.inf, claripy.FSORT_DOUBLE)
|
|
358
358
|
|
|
359
|
-
return
|
|
359
|
+
return claripy.FPV(math.inf, claripy.FSORT_DOUBLE)
|
|
360
360
|
|
|
361
|
-
return
|
|
361
|
+
return claripy.FPV(arg_y * math.log2(arg_x), claripy.FSORT_DOUBLE)
|
|
362
362
|
|
|
363
363
|
|
|
364
364
|
concretizers = {
|
angr/engines/vex/heavy/dirty.py
CHANGED
|
@@ -19,12 +19,12 @@ l = logging.getLogger(name=__name__)
|
|
|
19
19
|
# http://www-inteng.fnal.gov/Integrated_Eng/GoodwinDocs/pdf/Sys%20docs/PowerPC/PowerPC%20Elapsed%20Time.pdf
|
|
20
20
|
# and
|
|
21
21
|
# http://www.cap-lore.com/code/TB/
|
|
22
|
-
def ppcg_dirtyhelper_MFTB(state):
|
|
22
|
+
def ppcg_dirtyhelper_MFTB(state): # pylint:disable=unused-argument
|
|
23
23
|
# TODO: This is an incorrect implementation. Fix it later!
|
|
24
24
|
return claripy.BVV(0x200, 64), []
|
|
25
25
|
|
|
26
26
|
|
|
27
|
-
def ppc32g_dirtyhelper_MFSPR_287(state):
|
|
27
|
+
def ppc32g_dirtyhelper_MFSPR_287(state): # pylint:disable=unused-argument
|
|
28
28
|
return claripy.BVV(0x200, 32), []
|
|
29
29
|
|
|
30
30
|
|
|
@@ -119,8 +119,8 @@ EmWarn_S390X_fpext_rounding = 10
|
|
|
119
119
|
EmWarn_S390X_invalid_rounding = 11
|
|
120
120
|
|
|
121
121
|
|
|
122
|
-
def amd64g_check_ldmxcsr(state, mxcsr):
|
|
123
|
-
rmode =
|
|
122
|
+
def amd64g_check_ldmxcsr(state, mxcsr): # pylint:disable=unused-argument
|
|
123
|
+
rmode = claripy.LShR(mxcsr, 13) & 3
|
|
124
124
|
|
|
125
125
|
ew = claripy.If(
|
|
126
126
|
(mxcsr & 0x1F80) != 0x1F80,
|
|
@@ -17,6 +17,7 @@ from .structured_code import StructuredCodeManager
|
|
|
17
17
|
from .types import TypesStore
|
|
18
18
|
from .callsite_prototypes import CallsitePrototypes
|
|
19
19
|
from .custom_strings import CustomStrings
|
|
20
|
+
from .decompilation import DecompilationManager
|
|
20
21
|
|
|
21
22
|
|
|
22
23
|
__all__ = (
|
|
@@ -38,4 +39,5 @@ __all__ = (
|
|
|
38
39
|
"TypesStore",
|
|
39
40
|
"CallsitePrototypes",
|
|
40
41
|
"CustomStrings",
|
|
42
|
+
"DecompilationManager",
|
|
41
43
|
)
|
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
# pylint:disable=import-outside-toplevel
|
|
2
|
+
from __future__ import annotations
|
|
3
|
+
|
|
4
|
+
from typing import Any, TYPE_CHECKING
|
|
5
|
+
|
|
6
|
+
from .plugin import KnowledgeBasePlugin
|
|
7
|
+
|
|
8
|
+
if TYPE_CHECKING:
|
|
9
|
+
from angr.analyses.decompiler.decompilation_cache import DecompilationCache
|
|
10
|
+
|
|
11
|
+
|
|
12
|
+
class DecompilationManager(KnowledgeBasePlugin):
|
|
13
|
+
"""A knowledge base plugin to store decompilation results."""
|
|
14
|
+
|
|
15
|
+
def __init__(self, kb):
|
|
16
|
+
super().__init__(kb=kb)
|
|
17
|
+
self.cached: dict[Any, DecompilationCache] = {}
|
|
18
|
+
|
|
19
|
+
def _normalize_key(self, item: int | str):
|
|
20
|
+
if type(item) is str:
|
|
21
|
+
item = (self._kb.labels.lookup(item[0]), *item[1:])
|
|
22
|
+
return item
|
|
23
|
+
|
|
24
|
+
def __getitem__(self, item) -> DecompilationCache:
|
|
25
|
+
return self.cached[self._normalize_key(item)]
|
|
26
|
+
|
|
27
|
+
def __setitem__(self, key, value: DecompilationCache):
|
|
28
|
+
self.cached[self._normalize_key(key)] = value
|
|
29
|
+
|
|
30
|
+
def __contains__(self, key):
|
|
31
|
+
return self._normalize_key(key) in self.cached
|
|
32
|
+
|
|
33
|
+
def __delitem__(self, key):
|
|
34
|
+
del self.cached[self._normalize_key(key)]
|
|
35
|
+
|
|
36
|
+
def discard(self, key):
|
|
37
|
+
normalized_key = self._normalize_key(key)
|
|
38
|
+
if normalized_key in self.cached:
|
|
39
|
+
del self.cached[normalized_key]
|
|
40
|
+
|
|
41
|
+
def copy(self):
|
|
42
|
+
raise NotImplementedError
|
|
43
|
+
|
|
44
|
+
|
|
45
|
+
KnowledgeBasePlugin.register_default("decompilations", DecompilationManager)
|
|
@@ -277,6 +277,10 @@ class VirtualVariable(Atom):
|
|
|
277
277
|
def was_parameter(self) -> bool:
|
|
278
278
|
return self.category == ailment.Expr.VirtualVariableCategory.PARAMETER
|
|
279
279
|
|
|
280
|
+
@property
|
|
281
|
+
def was_tmp(self) -> bool:
|
|
282
|
+
return self.category == ailment.Expr.VirtualVariableCategory.TMP
|
|
283
|
+
|
|
280
284
|
@property
|
|
281
285
|
def reg_offset(self) -> int | None:
|
|
282
286
|
if self.was_reg:
|
|
@@ -289,6 +293,10 @@ class VirtualVariable(Atom):
|
|
|
289
293
|
return self.oident
|
|
290
294
|
return None
|
|
291
295
|
|
|
296
|
+
@property
|
|
297
|
+
def tmp_idx(self) -> int | None:
|
|
298
|
+
return self.oident if self.was_tmp else None
|
|
299
|
+
|
|
292
300
|
|
|
293
301
|
class MemoryLocation(Atom):
|
|
294
302
|
"""
|
|
@@ -162,7 +162,8 @@ def do_it(in_dir, out_file):
|
|
|
162
162
|
|
|
163
163
|
for file in files:
|
|
164
164
|
logging.info("Found file %s", file)
|
|
165
|
-
|
|
165
|
+
with codecs.open(file, "r", "utf-8-sig") as f:
|
|
166
|
+
api_namespaces[file.stem] = json.load(f)
|
|
166
167
|
|
|
167
168
|
logging.info("Making a bunch of types...")
|
|
168
169
|
missing_types_last_round = set()
|
|
@@ -1,6 +1,9 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
+
|
|
2
3
|
import logging
|
|
3
4
|
|
|
5
|
+
import claripy
|
|
6
|
+
|
|
4
7
|
from angr.procedures.java import JavaSimProcedure
|
|
5
8
|
from angr.engines.soot.values.strref import SimSootValue_StringRef
|
|
6
9
|
|
|
@@ -12,4 +15,4 @@ class GetSimpleName(JavaSimProcedure):
|
|
|
12
15
|
|
|
13
16
|
def run(self, this): # pylint: disable=arguments-differ
|
|
14
17
|
class_simple_name = this.type.split(".")[-1]
|
|
15
|
-
return SimSootValue_StringRef.new_string(self.state,
|
|
18
|
+
return SimSootValue_StringRef.new_string(self.state, claripy.StringV(class_simple_name))
|
|
@@ -1,4 +1,7 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
+
|
|
3
|
+
import claripy
|
|
4
|
+
|
|
2
5
|
import angr
|
|
3
6
|
from angr.procedures.posix.read import read
|
|
4
7
|
from angr.procedures.posix.write import write
|
|
@@ -24,7 +27,7 @@ class readv(angr.SimProcedure):
|
|
|
24
27
|
res = 0
|
|
25
28
|
for element in self.state.mem[iovec].struct.iovec.array(iovcnt).resolved:
|
|
26
29
|
tmpres = self.inline_call(read, fd, element.iov_base, element.iov_len).ret_expr
|
|
27
|
-
if self.state.solver.is_true(
|
|
30
|
+
if self.state.solver.is_true(claripy.SLT(tmpres, 0)):
|
|
28
31
|
return tmpres
|
|
29
32
|
|
|
30
33
|
return res
|
|
@@ -38,7 +41,7 @@ class writev(angr.SimProcedure):
|
|
|
38
41
|
res = 0
|
|
39
42
|
for element in self.state.mem[iovec].struct.iovec.array(iovcnt).resolved:
|
|
40
43
|
tmpres = self.inline_call(write, fd, element.iov_base, element.iov_len).ret_expr
|
|
41
|
-
if self.state.solver.is_true(
|
|
44
|
+
if self.state.solver.is_true(claripy.SLT(tmpres, 0)):
|
|
42
45
|
return tmpres
|
|
43
46
|
|
|
44
47
|
return res
|
angr/sim_type.py
CHANGED
|
@@ -1629,7 +1629,9 @@ class SimUnion(NamedTypeMixin, SimType):
|
|
|
1629
1629
|
|
|
1630
1630
|
@property
|
|
1631
1631
|
def size(self):
|
|
1632
|
-
|
|
1632
|
+
member_sizes = [ty.size for ty in self.members.values() if not isinstance(ty, SimTypeBottom)]
|
|
1633
|
+
# fall back to word size in case all members are SimTypeBottom
|
|
1634
|
+
return max(member_sizes) if member_sizes else self._arch.bytes
|
|
1633
1635
|
|
|
1634
1636
|
@property
|
|
1635
1637
|
def alignment(self):
|
|
@@ -7,7 +7,7 @@ from angr.storage.memory_mixins.memory_mixin import MemoryMixin
|
|
|
7
7
|
|
|
8
8
|
|
|
9
9
|
class ActionsMixinHigh(MemoryMixin):
|
|
10
|
-
def load(self, addr, size=None, condition=None, fallback=None, disable_actions=False, action=None, **kwargs):
|
|
10
|
+
def load(self, addr, size=None, *, condition=None, fallback=None, disable_actions=False, action=None, **kwargs):
|
|
11
11
|
if not disable_actions and o.AUTO_REFS in self.state.options and action is None:
|
|
12
12
|
action = self.__make_action("read", addr, size, None, condition, fallback)
|
|
13
13
|
|
|
@@ -28,7 +28,7 @@ class ActionsMixinHigh(MemoryMixin):
|
|
|
28
28
|
|
|
29
29
|
return r
|
|
30
30
|
|
|
31
|
-
def store(self, addr, data, size=None, disable_actions=False, action=None, condition=None, **kwargs):
|
|
31
|
+
def store(self, addr, data, size=None, *, disable_actions=False, action=None, condition=None, **kwargs):
|
|
32
32
|
if not disable_actions and o.AUTO_REFS in self.state.options and action is None:
|
|
33
33
|
action = self.__make_action("write", addr, size, data, condition, None)
|
|
34
34
|
|
|
@@ -49,24 +49,24 @@ class ActionsMixinHigh(MemoryMixin):
|
|
|
49
49
|
action.added_constraints = claripy.true()
|
|
50
50
|
return action
|
|
51
51
|
|
|
52
|
-
def _add_constraints(self, c, action=None, **kwargs):
|
|
52
|
+
def _add_constraints(self, c, *, action=None, **kwargs):
|
|
53
53
|
if action is not None:
|
|
54
54
|
action.added_constraints = claripy.And(action.added_constraints, c)
|
|
55
55
|
return super()._add_constraints(c, action=action, **kwargs)
|
|
56
56
|
|
|
57
57
|
|
|
58
58
|
class ActionsMixinLow(MemoryMixin):
|
|
59
|
-
def load(self, addr, action=None, **kwargs):
|
|
59
|
+
def load(self, addr, size=None, *, action=None, **kwargs):
|
|
60
60
|
if action is not None:
|
|
61
61
|
if action.actual_addrs is None:
|
|
62
62
|
action.actual_addrs = []
|
|
63
63
|
action.actual_addrs.append(addr)
|
|
64
|
-
return super().load(addr, action=action, **kwargs)
|
|
64
|
+
return super().load(addr, size, action=action, **kwargs)
|
|
65
65
|
|
|
66
|
-
def store(self, addr, data, action: SimActionData | None = None, **kwargs):
|
|
66
|
+
def store(self, addr, data, size=None, *, action: SimActionData | None = None, **kwargs):
|
|
67
67
|
if action is not None:
|
|
68
68
|
if action.actual_addrs is None:
|
|
69
69
|
action.actual_addrs = []
|
|
70
70
|
action.actual_addrs.append(addr)
|
|
71
71
|
action.actual_value = action._make_object(data)
|
|
72
|
-
return super().store(addr, data, action=action, **kwargs)
|
|
72
|
+
return super().store(addr, data, size, action=action, **kwargs)
|
|
@@ -230,7 +230,7 @@ class AddressConcretizationMixin(MemoryMixin):
|
|
|
230
230
|
"""
|
|
231
231
|
Take a list of integers and return a new list of integers where front and back integers interleave.
|
|
232
232
|
"""
|
|
233
|
-
lst = [
|
|
233
|
+
lst = [0xFACE] * len(addrs)
|
|
234
234
|
front, back = 0, len(addrs) - 1
|
|
235
235
|
i = 0
|
|
236
236
|
while front <= back:
|
|
@@ -257,7 +257,7 @@ class AddressConcretizationMixin(MemoryMixin):
|
|
|
257
257
|
return sub_value
|
|
258
258
|
return claripy.If(addr == concrete_addr, sub_value, read_value)
|
|
259
259
|
|
|
260
|
-
def load(self, addr, size=None, condition=None, **kwargs):
|
|
260
|
+
def load(self, addr, size=None, *, condition=None, **kwargs):
|
|
261
261
|
if type(size) is not int:
|
|
262
262
|
raise TypeError("Size must have been specified as an int before reaching address concretization")
|
|
263
263
|
|
|
@@ -309,7 +309,7 @@ class AddressConcretizationMixin(MemoryMixin):
|
|
|
309
309
|
sub_condition = condition & sub_condition
|
|
310
310
|
super().store(concrete_addr, data, size=size, condition=sub_condition, **kwargs)
|
|
311
311
|
|
|
312
|
-
def store(self, addr, data, size=None, condition=None, **kwargs):
|
|
312
|
+
def store(self, addr, data, size=None, *, condition=None, **kwargs):
|
|
313
313
|
# Fast path
|
|
314
314
|
if type(addr) is int:
|
|
315
315
|
self._store_one_addr(addr, data, True, addr, condition, size, **kwargs)
|
|
@@ -374,11 +374,11 @@ class AddressConcretizationMixin(MemoryMixin):
|
|
|
374
374
|
raise SimMemoryAddressError("Cannot unmap a region for a symbolic address")
|
|
375
375
|
return super().unmap_region(addr, length, **kwargs)
|
|
376
376
|
|
|
377
|
-
def concrete_load(self, addr, size,
|
|
377
|
+
def concrete_load(self, addr, size, writing=False, **kwargs):
|
|
378
378
|
if type(addr) is int:
|
|
379
379
|
pass
|
|
380
380
|
elif getattr(addr, "op", None) == "BVV":
|
|
381
381
|
addr = addr.args[0]
|
|
382
382
|
else:
|
|
383
383
|
raise SimMemoryAddressError("Cannot unmap a region for a symbolic address")
|
|
384
|
-
return super().concrete_load(addr, size,
|
|
384
|
+
return super().concrete_load(addr, size, writing=writing, **kwargs)
|
|
@@ -26,7 +26,7 @@ class DataNormalizationMixin(MemoryMixin):
|
|
|
26
26
|
|
|
27
27
|
super().store(addr, data_bv, size=size, **kwargs)
|
|
28
28
|
|
|
29
|
-
def load(self, addr, size=None, fallback=None, **kwargs):
|
|
29
|
+
def load(self, addr, size=None, *, fallback=None, **kwargs):
|
|
30
30
|
fallback_bv = self._convert_to_ast(fallback, size, self.state.arch.byte_width) if fallback is not None else None
|
|
31
31
|
return super().load(addr, size=size, fallback=fallback_bv, **kwargs)
|
|
32
32
|
|
|
@@ -4,7 +4,7 @@ from angr.storage.memory_mixins.memory_mixin import MemoryMixin
|
|
|
4
4
|
|
|
5
5
|
|
|
6
6
|
class InspectMixinHigh(MemoryMixin):
|
|
7
|
-
def store(self, addr, data, size=None, condition=None, endness=None, inspect=True, **kwargs):
|
|
7
|
+
def store(self, addr, data, size=None, *, condition=None, endness=None, inspect=True, **kwargs):
|
|
8
8
|
if not inspect or not self.state.supports_inspect:
|
|
9
9
|
super().store(addr, data, size=size, condition=condition, endness=endness, inspect=inspect, **kwargs)
|
|
10
10
|
return
|
|
@@ -63,7 +63,7 @@ class InspectMixinHigh(MemoryMixin):
|
|
|
63
63
|
mem_write_endness=endness,
|
|
64
64
|
)
|
|
65
65
|
|
|
66
|
-
def load(self, addr, size=None, condition=None, endness=None, inspect=True, **kwargs):
|
|
66
|
+
def load(self, addr, size=None, *, condition=None, endness=None, inspect=True, **kwargs):
|
|
67
67
|
if not inspect or not self.state.supports_inspect:
|
|
68
68
|
return super().load(addr, size=size, condition=condition, endness=endness, inspect=inspect, **kwargs)
|
|
69
69
|
|
|
@@ -122,7 +122,7 @@ class InspectMixinHigh(MemoryMixin):
|
|
|
122
122
|
|
|
123
123
|
return r
|
|
124
124
|
|
|
125
|
-
def _add_constraints(self, c, add_constraints=True, inspect=True, **kwargs):
|
|
125
|
+
def _add_constraints(self, c, *, add_constraints=True, inspect=True, **kwargs):
|
|
126
126
|
if inspect and self.state.supports_inspect:
|
|
127
127
|
# tracer uses address_concretization_add_constraints
|
|
128
128
|
add_constraints = self.state._inspect_getattr("address_concretization_add_constraints", add_constraints)
|
|
@@ -5,13 +5,13 @@ from angr.storage.memory_mixins.memory_mixin import MemoryMixin
|
|
|
5
5
|
|
|
6
6
|
|
|
7
7
|
class ConditionalMixin(MemoryMixin):
|
|
8
|
-
def load(self, addr, condition=None, fallback=None, **kwargs):
|
|
9
|
-
res = super().load(addr, condition=condition, **kwargs)
|
|
8
|
+
def load(self, addr, size=None, *, condition=None, fallback=None, **kwargs):
|
|
9
|
+
res = super().load(addr, size, condition=condition, **kwargs)
|
|
10
10
|
if condition is not None and fallback is not None:
|
|
11
11
|
res = claripy.If(condition, res, fallback)
|
|
12
12
|
return res
|
|
13
13
|
|
|
14
|
-
def store(self, addr, data, size=None, condition=None, **kwargs):
|
|
14
|
+
def store(self, addr, data, size=None, *, condition=None, **kwargs):
|
|
15
15
|
condition = self.state._adjust_condition(condition)
|
|
16
16
|
|
|
17
17
|
if condition is None or self.state.solver.is_true(condition):
|
|
@@ -13,7 +13,7 @@ l = logging.getLogger(__name__)
|
|
|
13
13
|
|
|
14
14
|
class DefaultFillerMixin(MemoryMixin):
|
|
15
15
|
def _default_value(
|
|
16
|
-
self, addr, size, name=None, inspect=True, events=True, key=None, fill_missing: bool = True, **kwargs
|
|
16
|
+
self, addr, size, *, name=None, inspect=True, events=True, key=None, fill_missing: bool = True, **kwargs
|
|
17
17
|
):
|
|
18
18
|
if self.state.project and self.state.project.concrete_target:
|
|
19
19
|
mem = self.state.project.concrete_target.read_memory(addr, size)
|
|
@@ -115,7 +115,7 @@ class SpecialFillerMixin(MemoryMixin):
|
|
|
115
115
|
super().__init__(**kwargs)
|
|
116
116
|
self._special_memory_filler = special_memory_filler
|
|
117
117
|
|
|
118
|
-
def _default_value(self, addr, size, name=None, **kwargs):
|
|
118
|
+
def _default_value(self, addr, size, *, name=None, **kwargs):
|
|
119
119
|
if (
|
|
120
120
|
options.SPECIAL_MEMORY_FILL in self.state.options
|
|
121
121
|
and self.state._special_memory_filler is not None
|
|
@@ -135,7 +135,7 @@ class ExplicitFillerMixin(MemoryMixin):
|
|
|
135
135
|
super().__init__(**kwargs)
|
|
136
136
|
self._uninitialized_read_handler = uninitialized_read_handler
|
|
137
137
|
|
|
138
|
-
def _default_value(self, addr, size, inspect=True, events=True, **kwargs):
|
|
138
|
+
def _default_value(self, addr, size, *, inspect=True, events=True, **kwargs):
|
|
139
139
|
if self._uninitialized_read_handler is not None:
|
|
140
140
|
return self._uninitialized_read_handler(addr, size, inspect=inspect, events=events)
|
|
141
141
|
return super()._default_value(addr, size, inspect=inspect, events=events, **kwargs)
|