angr 9.2.122__py3-none-win_amd64.whl → 9.2.123__py3-none-win_amd64.whl

angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.122"
+__version__ = "9.2.123"
 
 if bytes is str:
     raise Exception(

angr/analyses/calling_convention.py

@@ -356,9 +356,12 @@ class CallingConventionAnalysis(Analysis):
         caller_block_addr: int,
         call_insn_addr: int,
         include_preds: bool = False,
-    ) -> CallSiteFact:
+    ) -> CallSiteFact | None:
         func = self.kb.functions[caller_addr]
         subgraph = self._generate_callsite_subgraph(func, caller_block_addr, include_preds=include_preds)
+        if subgraph is None:
+            # failed to generate a subgraph when the caller block cannot be found in the function graph
+            return None
 
         observation_points: list = [("insn", call_insn_addr, OP_BEFORE), ("node", caller_block_addr, OP_AFTER)]
 
@@ -440,6 +443,8 @@ class CallingConventionAnalysis(Analysis):
                     call_insn_addr,
                     include_preds=include_callsite_preds,
                 )
+                if fact is None:
+                    continue
                 facts.append(fact)
 
                 ctr += 1

angr/analyses/decompiler/ail_simplifier.py

@@ -22,7 +22,6 @@ from ailment.expression import (
     Const,
     BinaryOp,
     VirtualVariable,
-    Phi,
 )
 
 from angr.analyses.s_reaching_definitions import SRDAModel
@@ -36,7 +35,7 @@ from angr.knowledge_plugins.key_definitions.constants import OP_BEFORE
 from angr.errors import AngrRuntimeError
 from angr.analyses import Analysis, AnalysesHub
 from .ailgraph_walker import AILGraphWalker
-from .expression_narrower import ExpressionNarrowingWalker
+from .expression_narrower import ExprNarrowingInfo, NarrowingInfoExtractor, ExpressionNarrower
 from .block_simplifier import BlockSimplifier
 from .ccall_rewriters import CCALL_REWRITERS
 from .counters.expression_counters import SingleExpressionCounter
@@ -76,26 +75,6 @@ class AILBlockTempCollector(AILBlockWalker):
             self.temps.add(expr)
 
 
-class ExprNarrowingInfo:
-    """
-    Stores the analysis result of _narrowing_needed().
-    """
-
-    __slots__ = ("narrowable", "to_size", "use_exprs", "phi_vars")
-
-    def __init__(
-        self,
-        narrowable: bool,
-        to_size: int | None = None,
-        use_exprs: list[tuple[atoms.VirtualVariable, CodeLocation, tuple[str, tuple[Expression, ...]]]] | None = None,
-        phi_vars: set[atoms.VirtualVariable] | None = None,
-    ):
-        self.narrowable = narrowable
-        self.to_size = to_size
-        self.use_exprs = use_exprs
-        self.phi_vars = phi_vars
-
-
 class AILSimplifier(Analysis):
     """
     Perform function-level simplifications.
@@ -343,309 +322,26 @@ class AILSimplifier(Analysis):
             if not repeat:
                 break
 
-        replaced_vvar_ids = set()
-
         # let's narrow them (finally)
-        for def_, narrow_info in narrowables:
-
-            # does any uses involve a previously replaced expressions? if so, we have to skip this one because the use
-            # expression may no longer exist.
-            should_skip = False
-            for _, _, (use_type, use_expr_tpl) in narrow_info.use_exprs:
-                if use_type == "binop-convert" and self._exprs_contain_vvar(use_expr_tpl, replaced_vvar_ids):
-                    should_skip = True
-                    break
-            if should_skip:
-                continue
-
-            # replace the definition
-            if not isinstance(def_.codeloc, ExternalCodeLocation):
-                old_block = addr_and_idx_to_block.get((def_.codeloc.block_addr, def_.codeloc.block_idx))
-                if old_block is None:
-                    # this definition might be inside a callee function, which is why the block does not exist
-                    # ignore it
-                    continue
-
-                the_block = self.blocks.get(old_block, old_block)
-                stmt = the_block.statements[def_.codeloc.stmt_idx]
-                r, new_block = False, None
-                replaced_vvar: VirtualVariable | None = None
-                if is_phi_assignment(stmt):
-                    new_assignment_dst = VirtualVariable(
-                        stmt.dst.idx,
-                        stmt.dst.varid,
-                        narrow_info.to_size * self.project.arch.byte_width,
-                        category=def_.atom.category,
-                        oident=def_.atom.oident,
-                        **stmt.dst.tags,
-                    )
-                    new_src_and_vvars = []
-                    for src, vvar in stmt.src.src_and_vvars:
-                        if vvar is not None and vvar.varid == stmt.dst.varid:
-                            new_vvar = VirtualVariable(
-                                vvar.idx,
-                                vvar.varid,
-                                narrow_info.to_size * self.project.arch.byte_width,
-                                category=vvar.category,
-                                oident=vvar.oident,
-                                **vvar.tags,
-                            )
-                        else:
-                            new_vvar = vvar
-                        new_src_and_vvars.append((src, new_vvar))
-                    new_assignment_src = Phi(
-                        stmt.src.idx,
-                        narrow_info.to_size * self.project.arch.byte_width,
-                        new_src_and_vvars,
-                        **stmt.src.tags,
-                    )
-                    replaced_vvar = stmt.dst
-                    r, new_block = BlockSimplifier._replace_and_build(
-                        the_block,
-                        {
-                            def_.codeloc: {
-                                stmt.dst: new_assignment_dst,
-                                stmt.src: new_assignment_src,
-                            }
-                        },
-                        replace_assignment_dsts=True,
-                        replace_loads=True,
-                    )
-                elif isinstance(stmt, Assignment) and isinstance(stmt.dst, VirtualVariable) and stmt.dst.was_reg:
-                    new_assignment_dst = VirtualVariable(
-                        stmt.dst.idx,
-                        stmt.dst.varid,
-                        narrow_info.to_size * self.project.arch.byte_width,
-                        category=def_.atom.category,
-                        oident=def_.atom.oident,
-                        **stmt.dst.tags,
-                    )
-                    new_assignment_src = Convert(
-                        stmt.src.idx,  # FIXME: This is a hack
-                        stmt.src.bits,
-                        narrow_info.to_size * self.project.arch.byte_width,
-                        False,
-                        stmt.src,
-                        **stmt.src.tags,
-                    )
-                    replaced_vvar = stmt.dst
-                    r, new_block = BlockSimplifier._replace_and_build(
-                        the_block,
-                        {
-                            def_.codeloc: {
-                                stmt.dst: new_assignment_dst,
-                                stmt.src: new_assignment_src,
-                            }
-                        },
-                        replace_assignment_dsts=True,
-                        replace_loads=True,
-                    )
-                elif isinstance(stmt, Call):
-                    if stmt.ret_expr is not None:
-                        tags = dict(stmt.ret_expr.tags)
-                        tags["reg_name"] = self.project.arch.translate_register_name(
-                            def_.atom.reg_offset, size=narrow_info.to_size
-                        )
-                        replaced_vvar = stmt.ret_expr
-                        new_retexpr = VirtualVariable(
-                            stmt.ret_expr.idx,
-                            stmt.ret_expr.varid,
-                            narrow_info.to_size * self.project.arch.byte_width,
-                            category=def_.atom.category,
-                            oident=def_.atom.oident,
-                            **stmt.ret_expr.tags,
-                        )
-                        r, new_block = BlockSimplifier._replace_and_build(
-                            the_block, {def_.codeloc: {stmt.ret_expr: new_retexpr}}
-                        )
-                if not r:
-                    # couldn't replace the definition...
-                    continue
+        narrower = ExpressionNarrower(self.project, rd, narrowables, addr_and_idx_to_block, self.blocks)
+        for old_block in addr_and_idx_to_block.values():
+            new_block = self.blocks.get(old_block, old_block)
+            new_block = narrower.walk(new_block)
+            if narrower.narrowed_any:
+                narrowed = True
                 self.blocks[old_block] = new_block
-                if replaced_vvar is not None:
-                    replaced_vvar_ids.add(replaced_vvar.varid)
-
-            use_exprs = list(narrow_info.use_exprs)
-            if narrow_info.phi_vars:
-                for phi_var in narrow_info.phi_vars:
-                    loc = rd.all_vvar_definitions[phi_var]
-                    old_block = addr_and_idx_to_block.get((loc.block_addr, loc.block_idx))
-                    the_block = self.blocks.get(old_block, old_block)
-                    stmt = the_block.statements[loc.stmt_idx]
-                    assert is_phi_assignment(stmt)
-
-                    for _, vvar in stmt.src.src_and_vvars:
-                        if vvar is not None and vvar.varid == def_.atom.varid:
-                            use_exprs.append((vvar, loc, ("phi-src-expr", (vvar,))))
-
-            # replace all uses if necessary
-            for use_atom, use_loc, (use_type, use_expr_tpl) in use_exprs:
-                if (
-                    isinstance(use_expr_tpl[0], VirtualVariable)
-                    and use_expr_tpl[0].was_reg
-                    and narrow_info.to_size == use_expr_tpl[0].size
-                ):
-                    # don't replace registers to the same registers
-                    continue
-                if use_atom.varid != def_.atom.varid:
-                    # don't replace this use - it will be replaced later
-                    continue
-
-                old_block = addr_and_idx_to_block.get((use_loc.block_addr, use_loc.block_idx))
-                the_block = self.blocks.get(old_block, old_block)
 
-                if use_type in {"expr", "mask", "convert"}:
-                    # the first used expr
-                    use_expr_0 = use_expr_tpl[0]
-                    new_use_expr_0 = VirtualVariable(
-                        use_expr_0.idx,
-                        def_.atom.varid,
-                        narrow_info.to_size * self.project.arch.byte_width,
-                        category=def_.atom.category,
-                        oident=def_.atom.oident,
-                        **use_expr_0.tags,
-                    )
-                    new_use_expr = new_use_expr_0
-
-                    # the second used expr (if it exists)
-                    if len(use_expr_tpl) == 2:
-                        use_expr_1 = use_expr_tpl[1]
-                        assert isinstance(use_expr_1, BinaryOp)
-                        con = use_expr_1.operands[1]
-                        assert isinstance(con, Const)
-                        new_use_expr_1 = BinaryOp(
-                            use_expr_1.idx,
-                            use_expr_1.op,
-                            [
-                                new_use_expr_0,
-                                Const(con.idx, con.variable, con.value, new_use_expr_0.bits, **con.tags),
-                            ],
-                            use_expr_1.signed,
-                            floating_point=use_expr_1.floating_point,
-                            rounding_mode=use_expr_1.rounding_mode,
-                            **use_expr_1.tags,
-                        )
-
-                        if use_expr_1.size > new_use_expr_1.size:
-                            new_use_expr_1 = Convert(
-                                None,
-                                new_use_expr_1.bits,
-                                use_expr_1.bits,
-                                False,
-                                new_use_expr_1,
-                                **new_use_expr_1.tags,
-                            )
-
-                        r, new_block = BlockSimplifier._replace_and_build(
-                            the_block, {use_loc: {use_expr_1: new_use_expr_1}}
-                        )
-                    elif len(use_expr_tpl) == 1:
-                        if use_expr_0.size > new_use_expr_0.size:
-                            new_use_expr_0 = Convert(
-                                None,
-                                new_use_expr_0.bits,
-                                use_expr_0.bits,
-                                False,
-                                new_use_expr_0,
-                                **new_use_expr_0.tags,
-                            )
-
-                        r, new_block = BlockSimplifier._replace_and_build(
-                            the_block, {use_loc: {use_expr_0: new_use_expr_0}}
-                        )
-                    else:
-                        _l.warning("Nothing to replace at %s.", use_loc)
-                        r = False
-                        new_block = None
-
-                elif use_type == "phi-src-expr":
-                    # the size of the replaced variable will be different from its original size, and it's expected
-                    use_expr = use_expr_tpl[0]
-                    new_use_expr = VirtualVariable(
-                        use_expr.idx,
-                        def_.atom.varid,
-                        narrow_info.to_size * self.project.arch.byte_width,
-                        category=def_.atom.category,
-                        oident=def_.atom.oident,
-                        **use_expr.tags,
-                    )
-                    r, new_block = BlockSimplifier._replace_and_build(the_block, {use_loc: {use_expr: new_use_expr}})
-
-                elif use_type == "binop-convert":
-                    use_expr_0 = use_expr_tpl[0]
-                    new_use_expr_0 = VirtualVariable(
-                        use_expr_0.idx,
-                        def_.atom.varid,
-                        narrow_info.to_size * self.project.arch.byte_width,
-                        category=def_.atom.category,
-                        oident=def_.atom.oident,
-                        **use_expr_0.tags,
-                    )
-                    new_use_expr = new_use_expr_0
-
-                    use_expr_1: BinaryOp = use_expr_tpl[1]
-                    # build the new use_expr_1
-                    new_use_expr_1_operands = {}
-                    if use_expr_1.operands[0] is use_expr_0:
-                        new_use_expr_1_operands[0] = new_use_expr_0
-                        other_operand = use_expr_1.operands[1]
-                    else:
-                        new_use_expr_1_operands[1] = new_use_expr_0
-                        other_operand = use_expr_1.operands[0]
-                    use_expr_2: Convert = use_expr_tpl[2]
-                    if other_operand.bits == use_expr_2.from_bits:
-                        new_other_operand = Convert(
-                            None, use_expr_2.from_bits, use_expr_2.to_bits, False, other_operand
-                        )
-                    else:
-                        # Some operations, like Sar and Shl, have operands with different sizes
-                        new_other_operand = other_operand
-
-                    if 0 in new_use_expr_1_operands:
-                        new_use_expr_1_operands[1] = new_other_operand
-                    else:
-                        new_use_expr_1_operands[0] = new_other_operand
-
-                    # build new use_expr_1
-                    new_use_expr_1 = BinaryOp(
-                        use_expr_1.idx,
-                        use_expr_1.op,
-                        [new_use_expr_1_operands[0], new_use_expr_1_operands[1]],
-                        use_expr_1.signed,
-                        bits=narrow_info.to_size * 8,
-                        floating_point=use_expr_1.floating_point,
-                        rounding_mode=use_expr_1.rounding_mode,
-                        **use_expr_1.tags,
-                    )
-
-                    # first remove the old conversion
-                    r, new_block = BlockSimplifier._replace_and_build(
-                        the_block, {use_loc: {use_expr_2: use_expr_2.operand}}
-                    )
-                    # then replace use_expr_1
-                    if r:
-                        r, new_block = BlockSimplifier._replace_and_build(
-                            new_block, {use_loc: {use_expr_1: new_use_expr_1}}
-                        )
-                else:
-                    raise TypeError(f'Unsupported use_type value "{use_type}"')
-
-                if not r:
-                    _l.warning("Failed to replace use-expr at %s.", use_loc)
-                else:
-                    # update self._arg_vvars if necessary
-                    if new_use_expr is not None and new_use_expr.was_parameter and self._arg_vvars:
-                        for func_arg_idx in list(self._arg_vvars):
-                            vvar, simvar = self._arg_vvars[func_arg_idx]
-                            if vvar.varid == new_use_expr.varid:
-                                simvar_new = simvar.copy()
-                                simvar_new._hash = None
-                                simvar_new.size = new_use_expr.size
-                                self._arg_vvars[func_arg_idx] = new_use_expr, simvar_new
-
-                    self.blocks[old_block] = new_block
-
-            narrowed = True
+        # update self._arg_vvars if necessary
+        for new_vvars in narrower.replacement_core_vvars.values():
+            for new_vvar in new_vvars:
+                if new_vvar.was_parameter and self._arg_vvars:
+                    for func_arg_idx in list(self._arg_vvars):
+                        vvar, simvar = self._arg_vvars[func_arg_idx]
+                        if vvar.varid == new_vvar.varid:
+                            simvar_new = simvar.copy()
+                            simvar_new._hash = None
+                            simvar_new.size = new_vvar.size
+                            self._arg_vvars[func_arg_idx] = new_vvar, simvar_new
 
         return narrowed
 
@@ -669,6 +365,9 @@ class AILSimplifier(Analysis):
                 if len(narrowing_sizes) == 1 and None not in narrowing_sizes:
                     # we can narrow this phi vvar!
                     narrowable_phivarids.add(def_vvarid)
+                else:
+                    # blacklist it for now
+                    blacklist_varids.add(def_vvarid)
 
         # now determine what to narrow!
         narrowables = []
@@ -834,7 +533,7 @@ class AILSimplifier(Analysis):
         Determine the effective size of an expression when it's used.
         """
 
-        walker = ExpressionNarrowingWalker(expr)
+        walker = NarrowingInfoExtractor(expr)
         walker.walk_statement(statement)
         if not walker.operations:
             if expr is None:

angr/analyses/decompiler/clinic.py

@@ -749,8 +749,9 @@ class Clinic(Analysis):
                 continue
 
             call_sites = []
-            for pred in self.function.transition_graph.predecessors(node):
-                call_sites.append(pred)
+            for pred, _, data in self.function.transition_graph.in_edges(node, data=True):
+                if data.get("type", None) != "return":
+                    call_sites.append(pred)
             # case 1: calling conventions and prototypes are available at every single call site
             if call_sites and all(self.kb.callsite_prototypes.has_prototype(callsite.addr) for callsite in call_sites):
                 continue

angr/analyses/decompiler/dephication/rewriting_engine.py

@@ -126,7 +126,7 @@ class SimEngineDephiRewriting(
         return None
 
     def _handle_Call(self, stmt: Call) -> Call | None:
-        new_target = self._expr(stmt.target) if stmt.target is not None else None
+        new_target = self._expr(stmt.target) if stmt.target is not None and not isinstance(stmt.target, str) else None
         new_ret_expr = self._expr(stmt.ret_expr) if stmt.ret_expr is not None else None
         new_fp_ret_expr = self._expr(stmt.fp_ret_expr) if stmt.fp_ret_expr is not None else None
 

angr/analyses/decompiler/expression_narrower.py

@@ -1,23 +1,52 @@
 from __future__ import annotations
 from typing import Any, TYPE_CHECKING
-from ailment import AILBlockWalkerBase
+from collections import defaultdict
+import logging
+
+from ailment import AILBlockWalkerBase, AILBlockWalker
+from ailment.statement import Assignment, Call
+from ailment.expression import VirtualVariable, Convert, BinaryOp, Phi
+
+from angr.knowledge_plugins.key_definitions import atoms
+from angr.code_location import CodeLocation
 
 if TYPE_CHECKING:
     from ailment.expression import (
         Expression,
-        BinaryOp,
         Load,
         UnaryOp,
-        Convert,
         ITE,
         DirtyExpression,
         VEXCCallExpression,
     )
-    from ailment.statement import Call, Statement
+    from ailment.statement import Statement
     from ailment.block import Block
 
 
-class ExpressionNarrowingWalker(AILBlockWalkerBase):
+_l = logging.getLogger(__name__)
+
+
+class ExprNarrowingInfo:
+    """
+    Stores the analysis result of _narrowing_needed().
+    """
+
+    __slots__ = ("narrowable", "to_size", "use_exprs", "phi_vars")
+
+    def __init__(
+        self,
+        narrowable: bool,
+        to_size: int | None = None,
+        use_exprs: list[tuple[atoms.VirtualVariable, CodeLocation, tuple[str, tuple[Expression, ...]]]] | None = None,
+        phi_vars: set[atoms.VirtualVariable] | None = None,
+    ):
+        self.narrowable = narrowable
+        self.to_size = to_size
+        self.use_exprs = use_exprs
+        self.phi_vars = phi_vars
+
+
+class NarrowingInfoExtractor(AILBlockWalkerBase):
     """
     Walks a statement or an expression and extracts the operations that are applied on the given expression.
 
@@ -85,3 +114,170 @@ class ExpressionNarrowingWalker(AILBlockWalkerBase):
         for idx, operand in enumerate(expr.operands):
             r |= self._handle_expr(idx, operand, stmt_idx, stmt, block)
         return r
+
+
+class ExpressionNarrower(AILBlockWalker):
+    """
+    Narrows an expression regardless of whether the expression is a definition or a use.
+    """
+
+    def __init__(
+        self, project, rd, narrowables, addr2blocks: dict[tuple[int, int | None], Block], new_blocks: dict[Block, Block]
+    ):
+        super().__init__(update_block=False)
+
+        self.project = project
+        self._rd = rd
+        self._addr2blocks = addr2blocks
+        self._new_blocks = new_blocks
+
+        self.new_vvar_sizes: dict[int, int] = {}
+        self.replacement_core_vvars: dict[int, list[VirtualVariable]] = defaultdict(list)
+        self.narrowed_any = False
+
+        for def_, narrow_info in narrowables:
+            self.new_vvar_sizes[def_.atom.varid] = narrow_info.to_size
+
+    def walk(self, block: Block):
+        self.narrowed_any = False
+        return super().walk(block)
+
+    def _handle_Assignment(self, stmt_idx: int, stmt: Assignment, block: Block | None) -> Assignment | None:
+
+        if isinstance(stmt.src, Phi):
+            changed = False
+
+            src_and_vvars = []
+            for src, vvar in stmt.src.src_and_vvars:
+                if vvar is None:
+                    src_and_vvars.append((src, None))
+                    continue
+                if vvar.varid in self.new_vvar_sizes and self.new_vvar_sizes[vvar.varid] != vvar.size:
+                    self.narrowed_any = True
+                    changed = True
+                    new_var = VirtualVariable(
+                        vvar.idx,
+                        vvar.varid,
+                        self.new_vvar_sizes[vvar.varid] * self.project.arch.byte_width,
+                        category=vvar.category,
+                        oident=vvar.oident,
+                        **vvar.tags,
+                    )
+
+                    self.replacement_core_vvars[new_var.varid].append(new_var)
+                else:
+                    new_var = None
+
+                src_and_vvars.append((src, new_var))
+
+            new_src = Phi(stmt.src.idx, stmt.src.bits, src_and_vvars, **stmt.src.tags)
+
+        else:
+            new_src = self._handle_expr(1, stmt.src, stmt_idx, stmt, block)
+            if new_src is None:
+                changed = False
+                new_src = stmt.src
+            else:
+                changed = True
+
+        if isinstance(stmt.dst, VirtualVariable) and stmt.dst.varid in self.new_vvar_sizes:
+            changed = True
+            new_dst = VirtualVariable(
+                stmt.dst.idx,
+                stmt.dst.varid,
+                self.new_vvar_sizes[stmt.dst.varid] * self.project.arch.byte_width,
+                category=stmt.dst.category,
+                oident=stmt.dst.oident,
+                **stmt.dst.tags,
+            )
+
+            self.replacement_core_vvars[new_dst.varid].append(new_dst)
+
+            if isinstance(new_src, Phi):
+                new_src.bits = self.new_vvar_sizes[stmt.dst.varid] * self.project.arch.byte_width
+            else:
+                new_src = Convert(
+                    None,
+                    stmt.src.bits,
+                    self.new_vvar_sizes[stmt.dst.varid] * self.project.arch.byte_width,
+                    False,
+                    new_src,
+                    **new_src.tags,
+                )
+        else:
+            new_dst = self._handle_expr(0, stmt.dst, stmt_idx, stmt, block)
+            if new_dst is not None:
+                changed = True
+            else:
+                new_dst = stmt.dst
+
+        if changed:
+            self.narrowed_any = True
+            return Assignment(stmt.idx, new_dst, new_src, **stmt.tags)
+
+        return None
+
+    def _handle_VirtualVariable(
+        self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt: Statement, block: Block | None
+    ) -> Convert | None:
+        if expr.varid in self.new_vvar_sizes and self.new_vvar_sizes[expr.varid] != expr.size:
+            self.narrowed_any = True
+            new_expr = VirtualVariable(
+                expr.idx,
+                expr.varid,
+                self.new_vvar_sizes[expr.varid] * self.project.arch.byte_width,
+                category=expr.category,
+                oident=expr.oident,
+                **expr.tags,
+            )
+
+            self.replacement_core_vvars[expr.varid].append(new_expr)
+
+            return Convert(
+                None,
+                new_expr.bits,
+                expr.bits,
+                False,
+                new_expr,
+                **new_expr.tags,
+            )
+        return None
+
+    def _handle_Call(self, stmt_idx: int, stmt: Call, block: Block | None) -> Call | None:
+        new_stmt = super()._handle_Call(stmt_idx, stmt, block)
+        if new_stmt is None:
+            changed = False
+            new_stmt = stmt
+        else:
+            changed = True
+
+        if (
+            stmt.ret_expr is not None
+            and isinstance(stmt.ret_expr, VirtualVariable)
+            and stmt.ret_expr.was_reg
+            and stmt.ret_expr.varid in self.new_vvar_sizes
+            and stmt.ret_expr.size != self.new_vvar_sizes[stmt.ret_expr.varid]
+        ):
+            changed = True
+
+            # update reg name
+            tags = dict(stmt.ret_expr.tags)
+            tags["reg_name"] = self.project.arch.translate_register_name(
+                stmt.ret_expr.reg_offset, size=self.new_vvar_sizes[stmt.ret_expr.varid]
+            )
+            new_ret_expr = VirtualVariable(
+                stmt.ret_expr.idx,
+                stmt.ret_expr.varid,
+                self.new_vvar_sizes[stmt.ret_expr.varid] * self.project.arch.byte_width,
+                category=stmt.ret_expr.category,
+                oident=stmt.ret_expr.oident,
+                **tags,
+            )
+            self.replacement_core_vvars[new_ret_expr.varid].append(new_ret_expr)
+            new_stmt.ret_expr = new_ret_expr
+
+        if changed:
+            self.narrowed_any = True
+            return new_stmt
+
+        return None