angr 9.2.124__py3-none-win_amd64.whl → 9.2.126__py3-none-win_amd64.whl

angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.124"
+__version__ = "9.2.126"
 
 if bytes is str:
     raise Exception(

angr/analyses/__init__.py

@@ -1,4 +1,4 @@
-# pylint:disable=wrong-import-position
+# " pylint:disable=wrong-import-position
 from __future__ import annotations
 
 from .analysis import Analysis, AnalysesHub
@@ -49,6 +49,12 @@ from .flirt import FlirtAnalysis
 from .s_propagator import SPropagatorAnalysis
 from .s_reaching_definitions import SReachingDefinitionsAnalysis
 from .s_liveness import SLivenessAnalysis
+from .codecave import CodeCaveAnalysis
+from .patchfinder import PatchFinderAnalysis
+from .pathfinder import Pathfinder
+from .smc import SelfModifyingCodeAnalysis
+from .unpacker import PackingDetector
+from . import deobfuscator
 
 
 __all__ = (
@@ -101,4 +107,10 @@ __all__ = (
     "SPropagatorAnalysis",
     "SReachingDefinitionsAnalysis",
     "SLivenessAnalysis",
+    "CodeCaveAnalysis",
+    "PatchFinderAnalysis",
+    "Pathfinder",
+    "SelfModifyingCodeAnalysis",
+    "PackingDetector",
+    "deobfuscator",
 )

angr/analyses/codecave.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+import logging
+from enum import Enum, auto
+from typing import TYPE_CHECKING
+from dataclasses import dataclass
+
+from angr.analyses import Analysis, AnalysesHub
+
+
+if TYPE_CHECKING:
+    from angr.knowledge_plugins import Function
+
+
+log = logging.getLogger(__name__)
+
+
+class CodeCaveClassification(Enum):
+    """
+    Type of code caves.
+    """
+
+    ALIGNMENT = auto()
+    UNREACHABLE = auto()
+
+
+@dataclass
+class CodeCave:
+    """
+    Describes a code cave in a binary.
+    """
+
+    func: Function | None
+    addr: int
+    size: int
+    classification: CodeCaveClassification
+
+
+class CodeCaveAnalysis(Analysis):
+    """
+    Best-effort static location of potential vacant code caves for possible code injection:
+    - Padding functions
+    - Unreachable code
+    """
+
+    codecaves: list[CodeCave]
+
+    def __init__(self):
+        self.codecaves = []
+
+        if len(self.project.kb.functions) == 0 and self.project.kb.cfgs.get_most_accurate() is None:
+            log.warning("Please run CFGFast analysis first, to identify functions")
+            return
+
+        # Alignment functions
+        for func in self.project.kb.functions.values():
+            if func.is_alignment:
+                for block in func.blocks:
+                    self.codecaves.append(CodeCave(func, block.addr, block.size, CodeCaveClassification.ALIGNMENT))
+
+        # Unreachable code
+        for func in self.project.kb.functions.values():
+            if func.is_alignment or func.is_plt or func.is_simprocedure or func.addr in self.project.kb.labels:
+                continue
+
+            in_degree = self.project.kb.callgraph.in_degree(func.addr)
+            if in_degree == 0 or (
+                in_degree == 1
+                and self.project.kb.functions[next(self.project.kb.callgraph.predecessors(func.addr))].is_alignment
+            ):
+                for block in func.blocks:
+                    self.codecaves.append(CodeCave(func, block.addr, block.size, CodeCaveClassification.UNREACHABLE))
+
+            # FIXME: find dead blocks with argument propagation
+            # FIXME: find dead blocks with external coverage info
+
+
+AnalysesHub.register_default("CodeCaves", CodeCaveAnalysis)

angr/analyses/decompiler/ail_simplifier.py

@@ -872,6 +872,7 @@ class AILSimplifier(Analysis):
                         Const(None, None, eq.atom0.addr, self.project.arch.bits),
                         eq.atom0.size,
                         endness=self.project.arch.memory_endness,
+                        **eq.atom1.tags,
                     )
                 elif isinstance(eq.atom0, VirtualVariable) and eq.atom0.was_reg:
                     if isinstance(eq.atom1, VirtualVariable) and eq.atom1.was_reg:

angr/analyses/decompiler/callsite_maker.py

@@ -157,7 +157,15 @@ class CallSiteMaker(Analysis):
                         )
                         args.append(vvar_use)
                     else:
-                        args.append(Expr.Register(self._atom_idx(), None, offset, size * 8, reg_name=arg_loc.reg_name))
+                        reg = Expr.Register(
+                            self._atom_idx(),
+                            None,
+                            offset,
+                            size * 8,
+                            reg_name=arg_loc.reg_name,
+                            ins_addr=last_stmt.ins_addr,
+                        )
+                        args.append(reg)
                 elif isinstance(arg_loc, SimStackArg):
                     stack_arg_locs.append(arg_loc)
                     _, the_arg = self._resolve_stack_argument(call_stmt, arg_loc)

angr/analyses/decompiler/clinic.py

@@ -42,6 +42,7 @@ from .optimization_passes import (
     OptimizationPassStage,
     RegisterSaveAreaSimplifier,
     StackCanarySimplifier,
+    TagSlicer,
     DUPLICATING_OPTS,
     CONDENSING_OPTS,
 )
@@ -111,6 +112,7 @@ class Clinic(Analysis):
         inlining_parents: set[int] | None = None,
         vvar_id_start: int = 0,
         optimization_scratch: dict[str, Any] | None = None,
+        desired_variables: set[str] | None = None,
     ):
         if not func.normalized and mode == ClinicMode.DECOMPILE:
             raise ValueError("Decompilation must work on normalized function graphs.")
@@ -154,6 +156,7 @@ class Clinic(Analysis):
         self._inline_functions = inline_functions
         self._inlined_counts = {} if inlined_counts is None else inlined_counts
         self._inlining_parents = inlining_parents or ()
+        self._desired_variables = desired_variables
 
         self._register_save_areas_removed: bool = False
 
@@ -220,6 +223,9 @@ class Clinic(Analysis):
             ail_graph = self._inline_child_functions(ail_graph)
 
         ail_graph = self._decompilation_simplifications(ail_graph)
+
+        if self._desired_variables:
+            ail_graph = self._slice_variables(ail_graph)
         self.graph = ail_graph
 
     def _decompilation_graph_recovery(self):
@@ -279,6 +285,27 @@ class Clinic(Analysis):
 
         return ail_graph
 
+    def _slice_variables(self, ail_graph):
+        nodes_index = {(n.addr, n.idx): n for n in ail_graph.nodes()}
+
+        vfm = self.variable_kb.variables.function_managers[self.function.addr]
+        for v_name in self._desired_variables:
+            v = next(iter(vv for vv in vfm._unified_variables if vv.name == v_name))
+            for va in vfm.get_variable_accesses(v):
+                nodes_index[(va.location.block_addr, va.location.block_idx)].statements[va.location.stmt_idx].tags[
+                    "keep_in_slice"
+                ] = True
+
+        a = TagSlicer(
+            self.function,
+            graph=ail_graph,
+            variable_kb=self.variable_kb,
+        )
+        if a.out_graph:
+            # use the new graph
+            ail_graph = a.out_graph
+        return ail_graph
+
     def _inline_child_functions(self, ail_graph):
         for blk in ail_graph.nodes():
             for idx, stmt in enumerate(blk.statements):
@@ -909,13 +936,16 @@ class Clinic(Analysis):
         Convert a VEX block to an AIL block.
 
         :param block_node:  A BlockNode instance.
-        :return:            An converted AIL block.
+        :return:            A converted AIL block.
         :rtype:             ailment.Block
         """
 
         if type(block_node) is not BlockNode:
             return block_node
 
+        if block_node.size == 0:
+            return ailment.Block(block_node.addr, 0, statements=[])
+
         block = self.project.factory.block(block_node.addr, block_node.size, cross_insn_opt=False)
         if block.vex.jumpkind not in {"Ijk_Call", "Ijk_Boring", "Ijk_Ret"} and not block.vex.jumpkind.startswith(
             "Ijk_Sys"
@@ -1782,7 +1812,7 @@ class Clinic(Analysis):
                 s = self.kb.custom_strings[expr.value]
                 expr.tags["reference_values"] = {
                     SimTypePointer(SimTypeChar().with_arch(self.project.arch)).with_arch(self.project.arch): s.decode(
-                        "ascii"
+                        "latin-1"
                     ),
                 }
             else:

angr/analyses/decompiler/condition_processor.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 from collections import defaultdict, OrderedDict
 from typing import Any
+from collections.abc import Callable
 from collections.abc import Generator
 import operator
 import logging
@@ -80,17 +81,17 @@ _INVERSE_OPERATIONS = {
 #
 
 
-def _op_with_unified_size(op, conv, operand0, operand1):
+def _op_with_unified_size(op, conv: Callable, operand0, operand1, ins_addr: int):
     # ensure operand1 is of the same size as operand0
     if isinstance(operand1, ailment.Expr.Const):
         # amazing - we do the easy thing here
-        return op(conv(operand0, nobool=True), operand1.value)
+        return op(conv(operand0, nobool=True, ins_addr=ins_addr), operand1.value)
     if operand1.bits == operand0.bits:
-        return op(conv(operand0, nobool=True), conv(operand1))
+        return op(conv(operand0, nobool=True, ins_addr=ins_addr), conv(operand1, ins_addr=ins_addr))
     # extension is required
     assert operand1.bits < operand0.bits
     operand1 = ailment.Expr.Convert(None, operand1.bits, operand0.bits, False, operand1)
-    return op(conv(operand0, nobool=True), conv(operand1, nobool=True))
+    return op(conv(operand0, nobool=True, ins_addr=ins_addr), conv(operand1, nobool=True, ins_addr=ins_addr))
 
 
 def _dummy_bvs(condition, condition_mapping, name_suffix=""):
@@ -106,62 +107,94 @@ def _dummy_bools(condition, condition_mapping, name_suffix=""):
 
 
 _ail2claripy_op_mapping = {
-    "LogicalAnd": lambda expr, conv, _: claripy.And(conv(expr.operands[0]), conv(expr.operands[1])),
-    "LogicalOr": lambda expr, conv, _: claripy.Or(conv(expr.operands[0]), conv(expr.operands[1])),
-    "CmpEQ": lambda expr, conv, _: conv(expr.operands[0]) == conv(expr.operands[1]),
-    "CmpNE": lambda expr, conv, _: conv(expr.operands[0]) != conv(expr.operands[1]),
-    "CmpLE": lambda expr, conv, _: conv(expr.operands[0]) <= conv(expr.operands[1]),
-    "CmpLEs": lambda expr, conv, _: claripy.SLE(conv(expr.operands[0]), conv(expr.operands[1])),
-    "CmpLT": lambda expr, conv, _: conv(expr.operands[0]) < conv(expr.operands[1]),
-    "CmpLTs": lambda expr, conv, _: claripy.SLT(conv(expr.operands[0]), conv(expr.operands[1])),
-    "CmpGE": lambda expr, conv, _: conv(expr.operands[0]) >= conv(expr.operands[1]),
-    "CmpGEs": lambda expr, conv, _: claripy.SGE(conv(expr.operands[0]), conv(expr.operands[1])),
-    "CmpGT": lambda expr, conv, _: conv(expr.operands[0]) > conv(expr.operands[1]),
-    "CmpGTs": lambda expr, conv, _: claripy.SGT(conv(expr.operands[0]), conv(expr.operands[1])),
-    "CasCmpEQ": lambda expr, conv, _: conv(expr.operands[0]) == conv(expr.operands[1]),
-    "CasCmpNE": lambda expr, conv, _: conv(expr.operands[0]) != conv(expr.operands[1]),
-    "CasCmpLE": lambda expr, conv, _: conv(expr.operands[0]) <= conv(expr.operands[1]),
-    "CasCmpLEs": lambda expr, conv, _: claripy.SLE(conv(expr.operands[0]), conv(expr.operands[1])),
-    "CasCmpLT": lambda expr, conv, _: conv(expr.operands[0]) < conv(expr.operands[1]),
-    "CasCmpLTs": lambda expr, conv, _: claripy.SLT(conv(expr.operands[0]), conv(expr.operands[1])),
-    "CasCmpGE": lambda expr, conv, _: conv(expr.operands[0]) >= conv(expr.operands[1]),
-    "CasCmpGEs": lambda expr, conv, _: claripy.SGE(conv(expr.operands[0]), conv(expr.operands[1])),
-    "CasCmpGT": lambda expr, conv, _: conv(expr.operands[0]) > conv(expr.operands[1]),
-    "CasCmpGTs": lambda expr, conv, _: claripy.SGT(conv(expr.operands[0]), conv(expr.operands[1])),
-    "Add": lambda expr, conv, _: conv(expr.operands[0], nobool=True) + conv(expr.operands[1], nobool=True),
-    "Sub": lambda expr, conv, _: conv(expr.operands[0], nobool=True) - conv(expr.operands[1], nobool=True),
-    "Mul": lambda expr, conv, _: conv(expr.operands[0], nobool=True) * conv(expr.operands[1], nobool=True),
-    "Div": lambda expr, conv, _: conv(expr.operands[0], nobool=True) / conv(expr.operands[1], nobool=True),
-    "Mod": lambda expr, conv, _: conv(expr.operands[0], nobool=True) % conv(expr.operands[1], nobool=True),
-    "Not": lambda expr, conv, _: claripy.Not(conv(expr.operand)),
-    "Neg": lambda expr, conv, _: -conv(expr.operand),
-    "BitwiseNeg": lambda expr, conv, _: ~conv(expr.operand),
-    "Xor": lambda expr, conv, _: conv(expr.operands[0], nobool=True) ^ conv(expr.operands[1], nobool=True),
-    "And": lambda expr, conv, _: conv(expr.operands[0], nobool=True) & conv(expr.operands[1], nobool=True),
-    "Or": lambda expr, conv, _: conv(expr.operands[0], nobool=True) | conv(expr.operands[1], nobool=True),
-    "Shr": lambda expr, conv, _: _op_with_unified_size(claripy.LShR, conv, expr.operands[0], expr.operands[1]),
-    "Shl": lambda expr, conv, _: _op_with_unified_size(operator.lshift, conv, expr.operands[0], expr.operands[1]),
-    "Sar": lambda expr, conv, _: _op_with_unified_size(operator.rshift, conv, expr.operands[0], expr.operands[1]),
-    "Concat": lambda expr, conv, _: claripy.Concat(*[conv(operand) for operand in expr.operands]),
+    "LogicalAnd": lambda expr, conv, _, ia: claripy.And(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "LogicalOr": lambda expr, conv, _, ia: claripy.Or(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "CmpEQ": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) == conv(expr.operands[1], ins_addr=ia),
+    "CmpNE": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) != conv(expr.operands[1], ins_addr=ia),
+    "CmpLE": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) <= conv(expr.operands[1], ins_addr=ia),
+    "CmpLEs": lambda expr, conv, _, ia: claripy.SLE(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "CmpLT": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) < conv(expr.operands[1], ins_addr=ia),
+    "CmpLTs": lambda expr, conv, _, ia: claripy.SLT(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "CmpGE": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) >= conv(expr.operands[1], ins_addr=ia),
+    "CmpGEs": lambda expr, conv, _, ia: claripy.SGE(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "CmpGT": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) > conv(expr.operands[1], ins_addr=ia),
+    "CmpGTs": lambda expr, conv, _, ia: claripy.SGT(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "CasCmpEQ": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) == conv(expr.operands[1], ins_addr=ia),
+    "CasCmpNE": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) != conv(expr.operands[1], ins_addr=ia),
+    "CasCmpLE": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) <= conv(expr.operands[1], ins_addr=ia),
+    "CasCmpLEs": lambda expr, conv, _, ia: claripy.SLE(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "CasCmpLT": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) < conv(expr.operands[1], ins_addr=ia),
+    "CasCmpLTs": lambda expr, conv, _, ia: claripy.SLT(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "CasCmpGE": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) >= conv(expr.operands[1], ins_addr=ia),
+    "CasCmpGEs": lambda expr, conv, _, ia: claripy.SGE(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "CasCmpGT": lambda expr, conv, _, ia: conv(expr.operands[0], ins_addr=ia) > conv(expr.operands[1], ins_addr=ia),
+    "CasCmpGTs": lambda expr, conv, _, ia: claripy.SGT(
+        conv(expr.operands[0], ins_addr=ia), conv(expr.operands[1], ins_addr=ia)
+    ),
+    "Add": lambda expr, conv, _, ia: conv(expr.operands[0], nobool=True, ins_addr=ia)
+    + conv(expr.operands[1], nobool=True, ins_addr=ia),
+    "Sub": lambda expr, conv, _, ia: conv(expr.operands[0], nobool=True, ins_addr=ia)
+    - conv(expr.operands[1], nobool=True, ins_addr=ia),
+    "Mul": lambda expr, conv, _, ia: conv(expr.operands[0], nobool=True, ins_addr=ia)
+    * conv(expr.operands[1], nobool=True, ins_addr=ia),
+    "Div": lambda expr, conv, _, ia: conv(expr.operands[0], nobool=True, ins_addr=ia)
+    / conv(expr.operands[1], nobool=True, ins_addr=ia),
+    "Mod": lambda expr, conv, _, ia: conv(expr.operands[0], nobool=True, ins_addr=ia)
+    % conv(expr.operands[1], nobool=True, ins_addr=ia),
+    "Not": lambda expr, conv, _, ia: claripy.Not(conv(expr.operand, ins_addr=ia)),
+    "Neg": lambda expr, conv, _, ia: -conv(expr.operand, ins_addr=ia),
+    "BitwiseNeg": lambda expr, conv, _, ia: ~conv(expr.operand, ins_addr=ia),
+    "Xor": lambda expr, conv, _, ia: conv(expr.operands[0], nobool=True, ins_addr=ia)
+    ^ conv(expr.operands[1], nobool=True, ins_addr=ia),
+    "And": lambda expr, conv, _, ia: conv(expr.operands[0], nobool=True, ins_addr=ia)
+    & conv(expr.operands[1], nobool=True, ins_addr=ia),
+    "Or": lambda expr, conv, _, ia: conv(expr.operands[0], nobool=True, ins_addr=ia)
+    | conv(expr.operands[1], nobool=True, ins_addr=ia),
+    "Shr": lambda expr, conv, _, ia: _op_with_unified_size(claripy.LShR, conv, expr.operands[0], expr.operands[1], ia),
+    "Shl": lambda expr, conv, _, ia: _op_with_unified_size(
+        operator.lshift, conv, expr.operands[0], expr.operands[1], ia
+    ),
+    "Sar": lambda expr, conv, _, ia: _op_with_unified_size(
+        operator.rshift, conv, expr.operands[0], expr.operands[1], ia
+    ),
+    "Concat": lambda expr, conv, _, ia: claripy.Concat(*[conv(operand, ins_addr=ia) for operand in expr.operands]),
     # There are no corresponding claripy operations for the following operations
-    "DivMod": lambda expr, _, m: _dummy_bvs(expr, m),
-    "CmpF": lambda expr, _, m: _dummy_bvs(expr, m),
-    "Mull": lambda expr, _, m: _dummy_bvs(expr, m),
-    "Mulls": lambda expr, _, m: _dummy_bvs(expr, m),
-    "Reinterpret": lambda expr, _, m: _dummy_bvs(expr, m),
-    "Rol": lambda expr, _, m: _dummy_bvs(expr, m),
-    "Ror": lambda expr, _, m: _dummy_bvs(expr, m),
-    "LogicalXor": lambda expr, _, m: _dummy_bvs(expr, m),
-    "Carry": lambda expr, _, m: _dummy_bvs(expr, m),
-    "SCarry": lambda expr, _, m: _dummy_bvs(expr, m),
-    "SBorrow": lambda expr, _, m: _dummy_bvs(expr, m),
-    "ExpCmpNE": lambda expr, _, m: _dummy_bools(expr, m),
-    "CmpORD": lambda expr, _, m: _dummy_bvs(expr, m),  # in case CmpORDRewriter fails
-    "GetMSBs": lambda expr, _, m: _dummy_bvs(expr, m),
-    "InterleaveLOV": lambda expr, _, m: _dummy_bvs(expr, m),
-    "InterleaveHIV": lambda expr, _, m: _dummy_bvs(expr, m),
+    "DivMod": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "CmpF": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "Mull": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "Mulls": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "Reinterpret": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "Rol": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "Ror": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "LogicalXor": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "Carry": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "SCarry": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "SBorrow": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "ExpCmpNE": lambda expr, _, m, *args: _dummy_bools(expr, m),
+    "CmpORD": lambda expr, _, m, *args: _dummy_bvs(expr, m),  # in case CmpORDRewriter fails
+    "GetMSBs": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "InterleaveLOV": lambda expr, _, m, *args: _dummy_bvs(expr, m),
+    "InterleaveHIV": lambda expr, _, m, *args: _dummy_bvs(expr, m),
     # catch-all
-    "_DUMMY_": lambda expr, _, m: _dummy_bvs(expr, m),
+    "_DUMMY_": lambda expr, _, m, *args: _dummy_bvs(expr, m),
 }
 
 #
@@ -610,6 +643,7 @@ class ConditionProcessor:
                     ),
                     False,
                 ),
+                ins_addr=dst_block.addr,
             )
 
         if type(src_block) is ConditionalBreakNode:
@@ -638,10 +672,10 @@ class ConditionProcessor:
             if isinstance(last_stmt.target, ailment.Expr.Const):
                 return claripy.true()
             # indirect jump
-            target_ast = self.claripy_ast_from_ail_condition(last_stmt.target)
+            target_ast = self.claripy_ast_from_ail_condition(last_stmt.target, ins_addr=last_stmt.ins_addr)
             return target_ast == dst_block.addr
         if type(last_stmt) is ailment.Stmt.ConditionalJump:
-            bool_var = self.claripy_ast_from_ail_condition(last_stmt.condition)
+            bool_var = self.claripy_ast_from_ail_condition(last_stmt.condition, ins_addr=last_stmt.ins_addr)
             if isinstance(last_stmt.true_target, ailment.Expr.Const) and last_stmt.true_target.value == dst_block.addr:
                 return bool_var
             return claripy.Not(bool_var)
@@ -766,7 +800,7 @@ class ConditionProcessor:
             f"Condition variable {cond} has an unsupported operator {cond.op}. Consider implementing."
         )
 
-    def claripy_ast_from_ail_condition(self, condition, nobool: bool = False) -> claripy.ast.Bool:
+    def claripy_ast_from_ail_condition(self, condition, nobool: bool = False, *, ins_addr: int = 0) -> claripy.ast.Bool:
         # Unpack a condition all the way to the leaves
         if isinstance(condition, claripy.ast.Base):  # pylint:disable=isinstance-second-argument-not-valid-type
             return condition
@@ -782,20 +816,24 @@ class ConditionProcessor:
             # does it have a variable associated?
             if condition.variable is not None:
                 var = claripy.BVS(
-                    f"ailexpr_{condition!r}-{condition.variable.ident}", condition.bits, explicit_name=True
+                    f"ailexpr_{condition!r}-{condition.variable.ident}-{ins_addr:x}",
+                    condition.bits,
+                    explicit_name=True,
                 )
             else:
-                var = claripy.BVS(f"ailexpr_{condition!r}-{condition.idx}", condition.bits, explicit_name=True)
+                var = claripy.BVS(
+                    f"ailexpr_{condition!r}-{condition.idx}-{ins_addr:x}", condition.bits, explicit_name=True
+                )
             self._condition_mapping[var.args[0]] = condition
             return var
         if isinstance(condition, ailment.Expr.Convert):
             # convert is special. if it generates a 1-bit variable, it should be treated as a BoolS
             if condition.to_bits == 1:
-                var_ = self.claripy_ast_from_ail_condition(condition.operands[0])
+                var_ = self.claripy_ast_from_ail_condition(condition.operands[0], ins_addr=ins_addr)
                 name = "ailcond_Conv(%d->%d, %d)" % (condition.from_bits, condition.to_bits, hash(var_))
                 var = claripy.BoolS(name, explicit_name=True)
             else:
-                var_ = self.claripy_ast_from_ail_condition(condition.operands[0])
+                var_ = self.claripy_ast_from_ail_condition(condition.operands[0], ins_addr=ins_addr)
                 name = "ailexpr_Conv(%d->%d, %d)" % (condition.from_bits, condition.to_bits, hash(var_))
                 var = claripy.BVS(name, condition.to_bits, explicit_name=True)
             self._condition_mapping[var.args[0]] = condition
@@ -838,7 +876,7 @@ class ConditionProcessor:
                 condition.verbose_op,
             )
             lambda_expr = _ail2claripy_op_mapping["_DUMMY_"]
-        r = lambda_expr(condition, self.claripy_ast_from_ail_condition, self._condition_mapping)
+        r = lambda_expr(condition, self.claripy_ast_from_ail_condition, self._condition_mapping, ins_addr)
 
         if isinstance(r, claripy.ast.Bool) and nobool:
             r = claripy.BVS(f"ailexpr_from_bool_{r!r}", 1, explicit_name=True)

angr/analyses/decompiler/decompiler.py

@@ -66,9 +66,11 @@ class Decompiler(Analysis):
         decompile=True,
         regen_clinic=True,
         inline_functions=frozenset(),
+        desired_variables=frozenset(),
         update_memory_data: bool = True,
         generate_code: bool = True,
         use_cache: bool = True,
+        expr_collapse_depth: int = 16,
     ):
         if not isinstance(func, Function):
             func = self.kb.functions[func]
@@ -103,6 +105,7 @@ class Decompiler(Analysis):
         self._update_memory_data = update_memory_data
         self._generate_code = generate_code
         self._inline_functions = inline_functions
+        self._desired_variables = desired_variables
         self._cache_parameters = (
             {
                 "cfg": self._cfg,
@@ -118,6 +121,7 @@ class Decompiler(Analysis):
                 "ite_exprs": self._ite_exprs,
                 "binop_operators": self._binop_operators,
                 "inline_functions": self._inline_functions,
+                "desired_variables": self._desired_variables,
             }
             if use_cache
             else None
@@ -132,6 +136,7 @@ class Decompiler(Analysis):
         self.ail_graph: networkx.DiGraph | None = None
         self.vvar_id_start = None
         self._optimization_scratch: dict[str, Any] = {}
+        self.expr_collapse_depth = expr_collapse_depth
 
         if decompile:
             self._decompile()
@@ -226,6 +231,7 @@ class Decompiler(Analysis):
                 cache=cache,
                 progress_callback=progress_callback,
                 inline_functions=self._inline_functions,
+                desired_variables=self._desired_variables,
                 optimization_scratch=self._optimization_scratch,
                 **self.options_to_params(self.options_by_class["clinic"]),
             )
@@ -329,6 +335,7 @@ class Decompiler(Analysis):
                 stmt_comments=old_codegen.stmt_comments if old_codegen is not None else None,
                 const_formats=old_codegen.const_formats if old_codegen is not None else None,
                 externs=clinic.externs,
+                binop_depth_cutoff=self.expr_collapse_depth,
                 **self.options_to_params(self.options_by_class["codegen"]),
             )
 

angr/analyses/decompiler/optimization_passes/__init__.py

@@ -1,5 +1,6 @@
 # pylint:disable=import-outside-toplevel
 from __future__ import annotations
+from typing import TYPE_CHECKING
 
 from archinfo import Arch
 
@@ -26,11 +27,16 @@ from .cross_jump_reverter import CrossJumpReverter
 from .code_motion import CodeMotionOptimization
 from .switch_default_case_duplicator import SwitchDefaultCaseDuplicator
 from .deadblock_remover import DeadblockRemover
+from .tag_slicer import TagSlicer
 from .inlined_string_transformation_simplifier import InlinedStringTransformationSimplifier
 from .const_prop_reverter import ConstPropOptReverter
 from .call_stmt_rewriter import CallStatementRewriter
 from .duplication_reverter import DuplicationReverter
 
+if TYPE_CHECKING:
+    from angr.analyses.decompiler.presets import DecompilationPreset
+
+
 # order matters!
 ALL_OPTIMIZATION_PASSES = [
     RegisterSaveAreaSimplifier,
@@ -59,6 +65,7 @@ ALL_OPTIMIZATION_PASSES = [
     FlipBooleanCmp,
     InlinedStringTransformationSimplifier,
     CallStatementRewriter,
+    TagSlicer,
 ]
 
 # these passes may duplicate code to remove gotos or improve the structure of the graph
@@ -86,9 +93,18 @@ def get_optimization_passes(arch, platform):
     return passes
 
 
-def register_optimization_pass(opt_pass):
+def register_optimization_pass(opt_pass, *, presets: list[str | DecompilationPreset] | None = None):
     ALL_OPTIMIZATION_PASSES.append(opt_pass)
 
+    if presets:
+        from angr.analyses.decompiler.presets import DECOMPILATION_PRESETS
+
+        for preset in presets:
+            if isinstance(preset, str):
+                preset = DECOMPILATION_PRESETS[preset]  # intentionally raise a KeyError if the preset is not found
+            if opt_pass not in preset.opt_passes:
+                preset.opt_passes.append(opt_pass)
+
 
 __all__ = (
     "OptimizationPassStage",
@@ -118,6 +134,7 @@ __all__ = (
     "ConstPropOptReverter",
     "CallStatementRewriter",
     "DuplicationReverter",
+    "TagSlicer",
     "ALL_OPTIMIZATION_PASSES",
     "DUPLICATING_OPTS",
     "CONDENSING_OPTS",

angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py

@@ -240,6 +240,12 @@ class InlinedStringTransformationAILEngine(SimEngineLightAILMixin):
         return None
 
     def _handle_Neg(self, expr: UnaryOp):
+        v = self._expr(expr.operand)
+        if isinstance(v, claripy.ast.Bits):
+            return -v
+        return None
+
+    def _handle_BitwiseNeg(self, expr: UnaryOp):
         v = self._expr(expr.operand)
         if isinstance(v, claripy.ast.Bits):
             return ~v

angr/analyses/decompiler/optimization_passes/tag_slicer.py

@@ -0,0 +1,41 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
+import logging
+
+from ailment.statement import ConditionalJump, Jump, Label
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(name=__name__)
+
+
+class TagSlicer(OptimizationPass):
+    """
+    Removes unmarked statements from the graph.
+    """
+
+    ARCHES = None
+    PLATFORMS = None
+    STAGE = OptimizationPassStage.AFTER_VARIABLE_RECOVERY
+    NAME = "Remove unmarked statements from the graph."
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+        self.analyze()
+
+    def _check(self):
+        return True, {}
+
+    def _analyze(self, cache=None):
+        for n in self._graph.nodes():
+            for i, s in enumerate(n.statements):
+                if isinstance(s, (ConditionalJump, Jump, Label)):
+                    continue
+                if not s.tags.get("keep_in_slice", False):
+                    n.statements[i] = None
+
+        for n in self._graph.nodes():
+            n.statements = [s for s in n.statements if s is not None]
+
+        self.out_graph = self._graph