angr 9.2.130__py3-none-manylinux2014_x86_64.whl → 9.2.132__py3-none-manylinux2014_x86_64.whl

angr/analyses/deobfuscator/irsb_reg_collector.py

@@ -1,85 +1,54 @@
-# pylint:disable=no-self-use,unused-argument,attribute-defined-outside-init
+# pylint:disable=no-self-use,unused-argument
 from __future__ import annotations
 
-import pyvex
+from angr.engines.light import SimEngineNostmtVEX
 
-from angr.engines.light import SimEngineLightVEXMixin
 
-
-class IRSBRegisterCollector(SimEngineLightVEXMixin):
+class IRSBRegisterCollector(SimEngineNostmtVEX[None, None, None]):
     """
     Scan the VEX IRSB to collect all registers that are read.
     """
 
-    def __init__(self, block, *args, **kwargs):
+    def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
 
-        self.block = block
         self.reg_reads: set[tuple[int, int]] = set()
 
-    def process(self):
-        self.tmps = {}
-        self.tyenv = self.block.vex.tyenv
-
-        self._process_Stmt()
-
-        self.stmt_idx = None
-        self.ins_addr = None
-
-    def _handle_Put(self, stmt):
-        pass
-
-    def _handle_Load(self, expr):
-        pass
+    def _top(self, bits):
+        return None
 
-    def _handle_Store(self, stmt):
-        pass
+    def _is_top(self, expr):
+        return True
 
-    def _handle_LoadG(self, stmt):
-        pass
-
-    def _handle_LLSC(self, stmt: pyvex.IRStmt.LLSC):
-        pass
-
-    def _handle_StoreG(self, stmt):
-        pass
-
-    def _handle_Get(self, expr: pyvex.IRExpr.Get):
+    def _handle_expr_Get(self, expr):
         self.reg_reads.add((expr.offset, expr.result_size(self.tyenv)))
 
-    def _handle_RdTmp(self, expr):
-        pass
-
-    def _handle_Conversion(self, expr: pyvex.IRExpr.Unop):
-        pass
+    def _handle_stmt_WrTmp(self, stmt):
+        self._expr(stmt.data)
 
-    def _handle_16HLto32(self, expr):
-        pass
+    def _handle_conversion(self, from_size, to_size, signed, operand):
+        return None
 
-    def _handle_Cmp_v(self, expr, _vector_size, _vector_count):
-        pass
+    def _process_block_end(self, stmt_result, whitelist):
+        return None
 
-    _handle_CmpEQ_v = _handle_Cmp_v
-    _handle_CmpNE_v = _handle_Cmp_v
-    _handle_CmpLE_v = _handle_Cmp_v
-    _handle_CmpLT_v = _handle_Cmp_v
-    _handle_CmpGE_v = _handle_Cmp_v
-    _handle_CmpGT_v = _handle_Cmp_v
+    def _handle_expr_VECRET(self, expr):
+        return None
 
-    def _handle_ExpCmpNE64(self, expr):
-        pass
+    def _handle_expr_GSPTR(self, expr):
+        return None
 
-    def _handle_CCall(self, expr):
-        pass
+    def _handle_expr_RdTmp(self, expr):
+        return None
 
-    def _handle_function(self, func_addr):
-        pass
+    def _handle_expr_GetI(self, expr):
+        return None
 
-    def _handle_Unop(self, expr):
-        pass
+    def _handle_expr_Load(self, expr):
+        return None
 
-    def _handle_Binop(self, expr: pyvex.IRExpr.Binop):
-        pass
+    def _handle_expr_ITE(self, expr):
+        return None
 
-    def _handle_Triop(self, expr: pyvex.IRExpr.Triop):
-        pass
+    def _handle_expr_Const(self, expr):
+        return None

angr/analyses/deobfuscator/string_obf_finder.py

@@ -669,8 +669,8 @@ class StringObfuscationFinder(Analysis):
         # take a look at the call-site block to see what registers are used
         reg_reads = set()
         for block_addr in blocks_at_callsite:
-            reg_collector = IRSBRegisterCollector(self.project.factory.block(block_addr))
-            reg_collector.process()
+            reg_collector = IRSBRegisterCollector(self.project)
+            reg_collector.process(state=None, block=self.project.factory.block(block_addr))
             reg_reads |= set(reg_collector.reg_reads)
 
         # run constant propagation to track constant registers

angr/analyses/init_finder.py

@@ -1,33 +1,36 @@
 from __future__ import annotations
 from collections import defaultdict
+from typing import cast
 
 from cle.loader import MetaELF
-from cle.backends import Section, Segment
 import pyvex
 import claripy
 
 from angr.analyses import visitors, ForwardAnalysis
-from angr.engines.light import SimEngineLight, SimEngineLightVEXMixin
+from angr.code_location import CodeLocation
+from angr.engines.light import SimEngineNostmtVEX
 from . import register_analysis, PropagatorAnalysis
 from .analysis import Analysis
 from .propagator.vex_vars import VEXTmp
 
 
-class SimEngineInitFinderVEX(
-    SimEngineLightVEXMixin,
-    SimEngineLight,
-):
+class SimEngineInitFinderVEX(SimEngineNostmtVEX[None, claripy.ast.Base | int | None, None]):
     """
     The VEX engine class for InitFinder.
     """
 
     def __init__(self, project, replacements, overlay, pointers_only=False):
-        super().__init__()
-        self.project = project
-        self.replacements = replacements
+        super().__init__(project)
+        self.replacements: dict[CodeLocation, dict[int, claripy.ast.Base | int]] = replacements
         self.overlay = overlay
         self.pointers_only = pointers_only
 
+    def _top(self, bits):
+        return None
+
+    def _is_top(self, expr):
+        return expr is None
+
     #
     # Utils
     #
@@ -38,18 +41,19 @@ class SimEngineInitFinderVEX(
             return True
         return bool(isinstance(expr, int))
 
-    def _is_addr_uninitialized(self, addr):
+    def _is_addr_uninitialized(self, addr: int | claripy.ast.Base):
         # is it writing to a global, uninitialized region?
 
         if isinstance(addr, claripy.ast.Base):
-            addr = addr.args[0]
+            assert addr.op == "BVV"
+            addr = cast(int, addr.args[0])
 
         obj = self.project.loader.find_object_containing(addr)
         if obj is not None:
             if not obj.has_memory:
                 # Objects without memory are definitely uninitialized
                 return True
-            section: Section = obj.find_section_containing(addr)
+            section = obj.find_section_containing(addr)
             if section is not None:
                 return section.name in {
                     ".bss",
@@ -58,7 +62,7 @@ class SimEngineInitFinderVEX(
             if isinstance(obj, MetaELF):
                 # for ELFs, if p_memsz >= p_filesz, the extra bytes are considered NOBITS
                 # https://docs.oracle.com/cd/E19120-01/open.solaris/819-0690/gjpww/index.html
-                segment: Segment = obj.find_segment_containing(addr)
+                segment = obj.find_segment_containing(addr)
                 if segment is not None and segment.memsize > segment.filesize:
                     return segment.vaddr + segment.filesize <= addr < segment.vaddr + segment.memsize
         return False
@@ -71,6 +75,9 @@ class SimEngineInitFinderVEX(
             return self.project.loader.find_object_containing(addr) is not None
         return False
 
+    def _process_block_end(self, stmt_result, whitelist):
+        return None
+
     #
     # Statement handlers
     #
@@ -78,15 +85,15 @@ class SimEngineInitFinderVEX(
     def _handle_function(self, *args, **kwargs):
         pass
 
-    def _handle_WrTmp(self, stmt):
+    def _handle_stmt_WrTmp(self, stmt):
         # Don't do anything since constant propagation has already processed it
         return
 
-    def _handle_Put(self, stmt):
+    def _handle_stmt_Put(self, stmt):
         # Don't do anything since constant propagation has already processed it
         return
 
-    def _handle_Store(self, stmt):
+    def _handle_stmt_Store(self, stmt):
         blockloc = self._codeloc(block_only=True)
 
         if type(stmt.addr) is pyvex.IRExpr.RdTmp:
@@ -107,7 +114,7 @@ class SimEngineInitFinderVEX(
                         if not self.pointers_only or self._is_pointer(data_v):
                             self.overlay.store(addr_v, data_v, endness=self.project.arch.memory_endness)
 
-    def _handle_StoreG(self, stmt):
+    def _handle_stmt_StoreG(self, stmt):
         blockloc = self._codeloc(block_only=True)
         repl = self.replacements[blockloc]
 
@@ -144,16 +151,16 @@ class SimEngineInitFinderVEX(
     # Expression handlers
     #
 
-    def _handle_Get(self, expr):
+    def _handle_expr_Get(self, expr):
         return None
 
-    def _handle_Load(self, expr):
+    def _handle_expr_Load(self, expr):
         return None
 
-    def _handle_LoadG(self, stmt):
+    def _handle_stmt_LoadG(self, stmt):
         return None
 
-    def _handle_RdTmp(self, expr):
+    def _handle_expr_RdTmp(self, expr):
         blockloc = self._codeloc(block_only=True)
 
         tmp = VEXTmp(expr.tmp)
@@ -161,6 +168,24 @@ class SimEngineInitFinderVEX(
             return self.replacements[blockloc][tmp]
         return None
 
+    def _handle_expr_VECRET(self, expr):
+        return None
+
+    def _handle_expr_GSPTR(self, expr):
+        return None
+
+    def _handle_expr_GetI(self, expr):
+        return None
+
+    def _handle_expr_ITE(self, expr):
+        return None
+
+    def _handle_conversion(self, from_size, to_size, signed, operand):
+        return None
+
+    def _handle_expr_Const(self, expr):
+        return None
+
 
 class InitializationFinder(ForwardAnalysis, Analysis):  # pylint:disable=abstract-method
     """
@@ -238,7 +263,7 @@ class InitializationFinder(ForwardAnalysis, Analysis):  # pylint:disable=abstrac
         return None
 
     def _merge_states(self, node, *states):
-        return None
+        return None, False
 
     def _run_on_node(self, node, state):
         block = self.project.factory.block(node.addr, node.size, opt_level=1, cross_insn_opt=False)

angr/analyses/propagator/engine_base.py

@@ -1,9 +1,14 @@
 from __future__ import annotations
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Generic
 import logging
 
+
+from angr.engines.light.engine import BlockType, DataType_co, StateType
+
 from angr.engines.light import SimEngineLight
 from angr.errors import SimEngineError
+from angr.project import Project
+from angr.misc.testing import is_testing
 
 if TYPE_CHECKING:
     from angr.analyses.reaching_definitions.reaching_definitions import ReachingDefinitionsModel
@@ -11,22 +16,22 @@ if TYPE_CHECKING:
 l = logging.getLogger(name=__name__)
 
 
-class SimEnginePropagatorBase(SimEngineLight):  # pylint:disable=abstract-method
+class SimEnginePropagatorBaseMixin(
+    Generic[StateType, DataType_co, BlockType], SimEngineLight[StateType, DataType_co, BlockType, StateType]
+):  # pylint:disable=abstract-method
     def __init__(
         self,
+        project: Project,
         stack_pointer_tracker=None,
-        project=None,
         propagate_tmps=True,
-        arch=None,
         reaching_definitions: ReachingDefinitionsModel | None = None,
         immediate_stmt_removal: bool = False,
         bp_as_gpr: bool = False,
     ):
-        super().__init__()
+        super().__init__(project)
 
         # Used in the VEX engine
-        self._project = project
-        self.arch = arch
+        self.arch = project.arch
         self.base_state = None
         self._load_callback = None
         self._propagate_tmps: bool = propagate_tmps
@@ -40,15 +45,17 @@ class SimEnginePropagatorBase(SimEngineLight):  # pylint:disable=abstract-method
 
         self._multi_occurrence_registers = None
 
-    def process(self, state, *args, **kwargs):
-        self.project = kwargs.pop("project", None)
-        self.base_state = kwargs.pop("base_state", None)
-        self._load_callback = kwargs.pop("load_callback", None)
+    def process(
+        self, state: StateType, *, block: BlockType | None = None, base_state=None, load_callback=None, **kwargs
+    ) -> StateType:
+        self.base_state = base_state
+        self._load_callback = load_callback
         try:
-            self._process(state, None, block=kwargs.pop("block", None))
+            result_state = super().process(state, block=block, **kwargs)
         except SimEngineError as ex:
-            if kwargs.pop("fail_fast", False) is True:
+            if kwargs.pop("fail_fast", is_testing) is True:
                 raise ex
             l.error(ex, exc_info=True)
+            result_state = state
 
-        return self.state
+        return result_state