angr 9.2.130__py3-none-win_amd64.whl → 9.2.132__py3-none-win_amd64.whl

angr/analyses/decompiler/peephole_optimizations/bswap.py

@@ -1,8 +1,10 @@
+# pylint:disable=missing-class-docstring,no-self-use
 from __future__ import annotations
 from ailment.expression import BinaryOp, Const, Expression, Convert
 from ailment.statement import Call
 
 from .base import PeepholeOptimizationExprBase
+from .utils import get_expr_shift_left_amount
 
 
 class Bswap(PeepholeOptimizationExprBase):
@@ -69,19 +71,21 @@ class Bswap(PeepholeOptimizationExprBase):
                 cores = set()
                 for piece in or_pieces:
                     if isinstance(piece, BinaryOp):
-                        if piece.op == "Shl" and isinstance(piece.operands[1], Const):
+                        if piece.op in {"Shl", "Mul"} and isinstance(piece.operands[1], Const):
                             cores.add(piece.operands[0])
-                            shifts.add(("<<", piece.operands[1].value, 0xFFFFFFFF))
+                            shift_amount = get_expr_shift_left_amount(piece)
+                            shifts.add(("<<", shift_amount, 0xFFFFFFFF))
                         elif piece.op == "And" and isinstance(piece.operands[1], Const):
                             and_amount = piece.operands[1].value
                             and_core = piece.operands[0]
                             if (
                                 isinstance(and_core, BinaryOp)
-                                and and_core.op == "Shl"
+                                and and_core.op in {"Shl", "Mul"}
                                 and isinstance(and_core.operands[1], Const)
                             ):
                                 cores.add(and_core.operands[0])
-                                shifts.add(("<<", and_core.operands[1].value, and_amount))
+                                shift_amount = get_expr_shift_left_amount(and_core)
+                                shifts.add(("<<", shift_amount, and_amount))
                             elif (
                                 isinstance(and_core, BinaryOp)
                                 and and_core.op == "Shr"
@@ -112,9 +116,9 @@ class Bswap(PeepholeOptimizationExprBase):
             if (
                 (
                     isinstance(inner_first, BinaryOp)
-                    and inner_first.op == "Shl"
+                    and inner_first.op in {"Shl", "Mul"}
                     and isinstance(inner_first.operands[1], Const)
-                    and inner_first.operands[1].value == 8
+                    and get_expr_shift_left_amount(inner_first) == 8
                 )
                 and (
                     isinstance(inner_second, BinaryOp)

angr/analyses/decompiler/peephole_optimizations/eager_eval.py

@@ -3,6 +3,7 @@ from math import gcd
 
 from ailment.expression import BinaryOp, UnaryOp, Const, Convert, StackBaseOffset
 
+from angr.utils.bits import sign_extend
 from .base import PeepholeOptimizationExprBase
 
 
@@ -59,22 +60,50 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
                         expr.signed,
                         **expr.tags,
                     )
-            if (
-                isinstance(expr.operands[0], BinaryOp)
-                and expr.operands[0].op == "Mul"
-                and isinstance(expr.operands[0].operands[1], Const)
-                and expr.operands[0].operands[0].likes(expr.operands[1])
-            ):
-                # A * x + x => (A + 1) * x
-                coeff_expr = expr.operands[0].operands[1]
-                new_coeff = coeff_expr.value + 1
-                return BinaryOp(
-                    expr.idx,
-                    "Mul",
-                    [Const(coeff_expr.idx, None, new_coeff, coeff_expr.bits), expr.operands[1]],
-                    expr.signed,
-                    **expr.tags,
-                )
+            op0, op1 = expr.operands
+            if op0.likes(op1):
+                # x + x => 2 * x
+                count = Const(expr.idx, None, 2, op0.bits, **expr.tags)
+                return BinaryOp(expr.idx, "Mul", [op0, count], expr.signed, **expr.tags)
+
+            op0_is_mulconst = (
+                isinstance(op0, BinaryOp)
+                and op0.op == "Mul"
+                and (isinstance(op0.operands[0], Const) or isinstance(op0.operands[1], Const))
+            )
+            op1_is_mulconst = (
+                isinstance(op1, BinaryOp)
+                and op1.op == "Mul"
+                and (isinstance(op1.operands[0], Const) or isinstance(op1.operands[1], Const))
+            )
+            const0, x0 = None, None
+            const1, x1 = None, None
+            if op0_is_mulconst:
+                if isinstance(op0.operands[0], Const):
+                    const0, x0 = op0.operands
+                elif isinstance(op0.operands[1], Const):
+                    x0, const0 = op0.operands
+            if op1_is_mulconst:
+                if isinstance(op1.operands[0], Const):
+                    const1, x1 = op1.operands
+                elif isinstance(op1.operands[1], Const):
+                    x1, const1 = op1.operands
+
+            if op0_is_mulconst ^ op1_is_mulconst:
+                if x0 is not None and const0 is not None and x0.likes(op1):
+                    # x * A + x => (A + 1) * x
+                    new_const = Const(const0.idx, None, const0.value + 1, const0.bits, **const0.tags)
+                    return BinaryOp(expr.idx, "Mul", [x0, new_const], expr.signed, **expr.tags)
+                if x1 is not None and const1 is not None and x1.likes(op0):
+                    # x + x * A => (A + 1) * x
+                    new_const = Const(const1.idx, None, const1.value + 1, const1.bits, **const1.tags)
+                    return BinaryOp(expr.idx, "Mul", [x1, new_const], expr.signed, **expr.tags)
+            elif op0_is_mulconst and op1_is_mulconst:
+                if x0.likes(x1):
+                    # x * A + x * B => (A + B) * x
+                    new_const = Const(const0.idx, None, const0.value + const1.value, const0.bits, **const0.tags)
+                    return BinaryOp(expr.idx, "Mul", [x0, new_const], expr.signed, **expr.tags)
+
         elif expr.op == "Sub":
             if isinstance(expr.operands[0], Const) and isinstance(expr.operands[1], Const):
                 mask = (1 << expr.bits) - 1
@@ -119,12 +148,25 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
 
         elif expr.op == "Mul":
             if isinstance(expr.operands[1], Const) and expr.operands[1].value == 1:
+                # x * 1 => x
                 return expr.operands[0]
             if isinstance(expr.operands[0], Const) and isinstance(expr.operands[1], Const):
+                # constant multiplication
                 mask = (1 << expr.bits) - 1
                 return Const(
                     expr.idx, None, (expr.operands[0].value * expr.operands[1].value) & mask, expr.bits, **expr.tags
                 )
+            if {type(expr.operands[0]), type(expr.operands[1])} == {BinaryOp, Const}:
+                op0, op1 = expr.operands
+                const_, x0 = (op0, op1) if isinstance(op0, Const) else (op1, op0)
+                if x0.op == "Mul" and (isinstance(x0.operands[0], Const) or isinstance(x0.operands[1], Const)):
+                    # (A * x) * C => (A * C) * x
+                    if isinstance(x0.operands[0], Const):
+                        const_x0, x = x0.operands[0], x0.operands[1]
+                    else:
+                        const_x0, x = x0.operands[1], x0.operands[0]
+                    new_const = Const(const_.idx, None, const_.value * const_x0.value, const_.bits, **const_x0.tags)
+                    return BinaryOp(expr.idx, "Mul", [x, new_const], expr.signed, bits=expr.bits, **expr.tags)
 
         elif (
             expr.op == "Div"
@@ -197,6 +239,42 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
             if expr.operands[0].likes(expr.operands[1]):
                 return expr.operands[0]
 
+        elif expr.op in {"CmpEQ", "CmpLE", "CmpGE"}:
+            if expr.operands[0].likes(expr.operands[1]):
+                # x == x => 1
+                return Const(expr.idx, None, 1, 1, **expr.tags)
+            if isinstance(expr.operands[0], Const) and isinstance(expr.operands[1], Const):
+                if expr.op == "CmpEQ":
+                    return Const(
+                        expr.idx, None, 1 if expr.operands[0].value == expr.operands[1].value else 0, 1, **expr.tags
+                    )
+                if expr.op == "CmpLE":
+                    return Const(
+                        expr.idx, None, 1 if expr.operands[0].value <= expr.operands[1].value else 0, 1, **expr.tags
+                    )
+                if expr.op == "CmpGE":
+                    return Const(
+                        expr.idx, None, 1 if expr.operands[0].value >= expr.operands[1].value else 0, 1, **expr.tags
+                    )
+
+        elif expr.op in {"CmpNE", "CmpLT", "CmpGT"}:
+            if expr.operands[0].likes(expr.operands[1]):
+                # x != x => 0
+                return Const(expr.idx, None, 0, 1, **expr.tags)
+            if isinstance(expr.operands[0], Const) and isinstance(expr.operands[1], Const):
+                if expr.op == "CmpNE":
+                    return Const(
+                        expr.idx, None, 1 if expr.operands[0].value != expr.operands[1].value else 0, 1, **expr.tags
+                    )
+                if expr.op == "CmpLT":
+                    return Const(
+                        expr.idx, None, 1 if expr.operands[0].value < expr.operands[1].value else 0, 1, **expr.tags
+                    )
+                if expr.op == "CmpGT":
+                    return Const(
+                        expr.idx, None, 1 if expr.operands[0].value > expr.operands[1].value else 0, 1, **expr.tags
+                    )
+
         return None
 
     @staticmethod
@@ -225,8 +303,11 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
             and expr.from_type == Convert.TYPE_INT
             and expr.to_type == Convert.TYPE_INT
             and expr.from_bits <= expr.to_bits
-            and expr.is_signed is False
         ):
-            # unsigned extension
-            return Const(expr.idx, expr.operand.variable, expr.operand.value, expr.to_bits, **expr.operand.tags)
+            if expr.is_signed is False:
+                # unsigned extension
+                return Const(expr.idx, expr.operand.variable, expr.operand.value, expr.to_bits, **expr.operand.tags)
+            # signed extension
+            v = sign_extend(expr.operand.value, expr.to_bits)
+            return Const(expr.idx, expr.operand.variable, v, expr.to_bits, **expr.operand.tags)
         return None

angr/analyses/decompiler/peephole_optimizations/remove_noop_conversions.py

@@ -22,9 +22,26 @@ class RemoveNoopConversions(PeepholeOptimizationExprBase):
                 and expr.to_bits < expr.from_bits
                 and expr.from_bits == inner.to_bits
                 and expr.is_signed == inner.is_signed
+                and expr.from_type == expr.to_type == inner.from_type == inner.to_type == Convert.TYPE_INT
             ):
                 # extension then truncation (e.g., 1->64->1) can be removed, but truncation then extension cannot be
                 # removed (e.g., the high 32 bits must be removed during 64->32->64)
                 return inner.operand
+            if (
+                expr.to_bits < expr.from_bits
+                and expr.from_bits == inner.to_bits
+                and inner.to_bits <= inner.from_bits
+                and expr.is_signed == inner.is_signed
+                and expr.from_type == expr.to_type == inner.from_type == inner.to_type == Convert.TYPE_INT
+            ):
+                # merging two truncations into one
+                return Convert(
+                    expr.idx,
+                    inner.from_bits,
+                    expr.to_bits,
+                    expr.is_signed,
+                    inner.operand,
+                    **expr.tags,
+                )
 
         return None

angr/analyses/decompiler/peephole_optimizations/remove_redundant_conversions.py

@@ -1,4 +1,4 @@
-# pylint: disable=missing-class-docstring
+# pylint: disable=missing-class-docstring,too-many-boolean-expressions
 from __future__ import annotations
 from ailment.expression import BinaryOp, Convert, Const
 
@@ -9,9 +9,18 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
     __slots__ = ()
 
     NAME = "Remove redundant conversions around binary operators"
-    expr_classes = (BinaryOp,)
+    expr_classes = (BinaryOp, Convert)
 
-    def optimize(self, expr: BinaryOp, **kwargs):
+    def optimize(self, expr: BinaryOp | Convert, **kwargs):
+
+        if isinstance(expr, BinaryOp):
+            return self._optimize_BinaryOp(expr)
+        if isinstance(expr, Convert):
+            return self._optimize_Convert(expr)
+        return None
+
+    @staticmethod
+    def _optimize_BinaryOp(expr: BinaryOp):
         # TODO make this lhs/rhs agnostic
         if isinstance(expr.operands[0], Convert):
             # check: is the lhs convert an up-cast and is rhs a const?
@@ -156,3 +165,33 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
                             )
 
         return None
+
+    @staticmethod
+    def _optimize_Convert(expr: Convert):
+        operand_expr = expr.operand
+        if isinstance(operand_expr, BinaryOp) and operand_expr.op in {
+            "Mul",
+            "Shl",
+            "Div",
+            "DivMod",
+            "Mod",
+            "Add",
+            "Sub",
+        }:
+            op0, op1 = operand_expr.operands
+            if (
+                isinstance(op0, Convert)
+                and isinstance(op1, Convert)
+                and op0.from_bits == op1.from_bits
+                and op0.to_bits == op1.to_bits
+                and expr.from_bits == op0.to_bits
+                and expr.to_bits == op1.from_bits
+            ):
+                return BinaryOp(
+                    operand_expr.idx,
+                    operand_expr.op,
+                    [op0.operand, op1.operand],
+                    expr.is_signed,
+                    **operand_expr.tags,
+                )
+        return None

angr/analyses/decompiler/peephole_optimizations/remove_redundant_shifts.py

@@ -1,7 +1,9 @@
+# pylint:disable=no-self-use,missing-class-docstring
 from __future__ import annotations
 from ailment.expression import BinaryOp, Const, Convert
 
 from .base import PeepholeOptimizationExprBase
+from .utils import get_expr_shift_left_amount
 
 
 class RemoveRedundantShifts(PeepholeOptimizationExprBase):
@@ -15,8 +17,8 @@ class RemoveRedundantShifts(PeepholeOptimizationExprBase):
         if expr.op in ("Shr", "Sar") and isinstance(expr.operands[1], Const):
             expr_a = expr.operands[0]
             n0 = expr.operands[1].value
-            if isinstance(expr_a, BinaryOp) and expr_a.op == "Shl" and isinstance(expr_a.operands[1], Const):
-                n1 = expr_a.operands[1].value
+            if isinstance(expr_a, BinaryOp) and expr_a.op in {"Shl", "Mul"} and isinstance(expr_a.operands[1], Const):
+                n1 = get_expr_shift_left_amount(expr_a)
                 if n0 == n1:
                     inner_expr = expr_a.operands[0]
                     conv_inner_expr = Convert(

angr/analyses/decompiler/peephole_optimizations/rol_ror.py

@@ -3,6 +3,7 @@ from ailment.statement import Assignment
 from ailment.expression import BinaryOp, Const, Tmp
 
 from .base import PeepholeOptimizationStmtBase
+from .utils import get_expr_shift_left_amount
 
 
 class RolRorRewriter(PeepholeOptimizationStmtBase):
@@ -61,38 +62,64 @@ class RolRorRewriter(PeepholeOptimizationStmtBase):
             if not (isinstance(stmt1_op1, Const) and isinstance(stmt2_op1, Const)):
                 return None
 
-            if stmt_1.src.op == "Shl" and stmt_2.src.op == "Shr" and stmt1_op1.value + stmt2_op1.value == stmt.dst.bits:
+            if (
+                stmt_1.src.op in {"Shl", "Mul"}
+                and stmt_2.src.op == "Shr"
+                and (shiftleft_amount := get_expr_shift_left_amount(stmt_1.src)) is not None
+                and shiftleft_amount + stmt2_op1.value == stmt.dst.bits
+            ):
+                rol_amount = Const(None, None, shiftleft_amount, 8, **stmt1_op1.tags)
                 return Assignment(
                     stmt.idx,
                     stmt.dst,
-                    BinaryOp(None, "Rol", [stmt1_op0, stmt1_op1], False, bits=stmt.dst.bits, **stmt_1.src.tags),
+                    BinaryOp(None, "Rol", [stmt1_op0, rol_amount], False, bits=stmt.dst.bits, **stmt_1.src.tags),
                     **stmt.tags,
                 )
-            if stmt_1.src.op == "Shr" and stmt_2.src.op == "Shl" and stmt1_op1.value + stmt2_op1.value == stmt.dst.bits:
+            if (
+                stmt_1.src.op == "Shr"
+                and stmt_2.src.op in {"Shl", "Mul"}
+                and (shiftleft_amount := get_expr_shift_left_amount(stmt_2.src)) is not None
+                and stmt1_op1.value + shiftleft_amount == stmt.dst.bits
+            ):
                 return Assignment(
                     stmt.idx,
                     stmt.dst,
                     BinaryOp(None, "Ror", [stmt1_op0, stmt1_op1], False, bits=stmt.dst.bits, **stmt_1.src.tags),
                     **stmt.tags,
                 )
-        elif isinstance(op0, BinaryOp) and isinstance(op1, BinaryOp) and {op0.op, op1.op} == {"Shl", "Shr"}:
+        elif (
+            isinstance(op0, BinaryOp)
+            and isinstance(op1, BinaryOp)
+            and {op0.op, op1.op} in [{"Shl", "Shr"}, {"Mul", "Shr"}]
+        ):
             if not op0.operands[0].likes(op1.operands[0]):
                 return None
 
             if not isinstance(op0.operands[1], Const) or not isinstance(op1.operands[1], Const):
                 return None
-            shiftamount = op0.operands[1]
-            op0_shiftamount = op0.operands[1].value
-            op1_shiftamount = op1.operands[1].value
-
-            if op0.op == "Shl" and op1.op == "Shr" and op0_shiftamount + op1_shiftamount == stmt.dst.bits:
+            op0_v = op0.operands[1].value
+            op1_v = op1.operands[1].value
+
+            if (
+                op0.op in {"Shl", "Mul"}
+                and op1.op == "Shr"
+                and (op0_shiftamount := get_expr_shift_left_amount(op0)) is not None
+                and op0_shiftamount + op1_v == stmt.dst.bits
+            ):
+                shiftamount = Const(None, None, op0_shiftamount, 8, **op0.operands[1].tags)
                 return Assignment(
                     stmt.idx,
                     stmt.dst,
                     BinaryOp(None, "Rol", [op0.operands[0], shiftamount], False, bits=stmt.dst.bits, **op0.tags),
                     **stmt.tags,
                 )
-            if op0.op == "Shr" and op1.op == "Shl" and op0_shiftamount + op1_shiftamount == stmt.dst.bits:
+            if (
+                op0.op == "Shr"
+                and op1.op in {"Shl", "Mul"}
+                and (op1_shiftamount := get_expr_shift_left_amount(op1)) is not None
+                and op0_v + op1_shiftamount == stmt.dst.bits
+            ):
+                shiftamount = op0.operands[1]
                 return Assignment(
                     stmt.idx,
                     stmt.dst,

angr/analyses/decompiler/peephole_optimizations/shl_to_mul.py

@@ -0,0 +1,25 @@
+# pylint:disable=missing-class-docstring,no-self-use
+from __future__ import annotations
+from ailment.expression import BinaryOp, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ShlToMul(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "a << A => a * (2 ** A)"
+    expr_classes = (BinaryOp,)  # all expressions are allowed
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if expr.op == "Shl" and isinstance(expr.operands[1], Const):
+            mul_amount = Const(None, None, 2 ** expr.operands[1].value, expr.operands[0].bits)
+            return BinaryOp(
+                expr.idx,
+                "Mul",
+                [expr.operands[0], mul_amount],
+                expr.signed,
+                **expr.tags,
+            )
+
+        return None

angr/analyses/decompiler/peephole_optimizations/utils.py

@@ -0,0 +1,18 @@
+from __future__ import annotations
+from ailment.expression import BinaryOp, Const
+
+
+def get_expr_shift_left_amount(expr: BinaryOp) -> int | None:
+    """
+    Get the shift amount of a shift-left or multiplication operation if the shift amount is a constant.
+
+    :param expr:    The shift-left or multiplication expression (must be a BinaryOp).
+    :return:        The shift amount if it is a constant, or None if it is not.
+    """
+    if expr.op == "Shl" and isinstance(expr.operands[1], Const):
+        return expr.operands[1].value
+    if expr.op == "Mul" and isinstance(expr.operands[1], Const):
+        v = expr.operands[1].value
+        if v & (v - 1) == 0:
+            return v.bit_length() - 1
+    return None

angr/analyses/decompiler/presets/fast.py

@@ -19,7 +19,6 @@ from angr.analyses.decompiler.optimization_passes import (
     FlipBooleanCmp,
     InlinedStringTransformationSimplifier,
     CallStatementRewriter,
-    MultiSimplifier,
     DeadblockRemover,
     SwitchReusedEntryRewriter,
 )
@@ -32,7 +31,6 @@ preset_fast = DecompilationPreset(
         StackCanarySimplifier,
         WinStackCanarySimplifier,
         BasePointerSaveSimplifier,
-        MultiSimplifier,  # TODO: MultiSimplifier should be replaced by a peephole optimization
         ConstantDereferencesSimplifier,
         RetAddrSaveSimplifier,
         X86GccGetPcSimplifier,

angr/analyses/decompiler/presets/full.py

@@ -6,7 +6,6 @@ from angr.analyses.decompiler.optimization_passes import (
     WinStackCanarySimplifier,
     BasePointerSaveSimplifier,
     DivSimplifier,
-    MultiSimplifier,
     ModSimplifier,
     ConstantDereferencesSimplifier,
     RetAddrSaveSimplifier,
@@ -38,7 +37,6 @@ preset_full = DecompilationPreset(
         WinStackCanarySimplifier,
         BasePointerSaveSimplifier,
         DivSimplifier,
-        MultiSimplifier,
         ModSimplifier,
         ConstantDereferencesSimplifier,
         RetAddrSaveSimplifier,

angr/analyses/decompiler/ssailification/rewriting.py

@@ -56,8 +56,7 @@ class RewritingAnalysis(ForwardAnalysis[RewritingState, NodeType, object, object
         self._rewrite_tmps = rewrite_tmps
         self._ail_manager = ail_manager
         self._engine_ail = SimEngineSSARewriting(
-            self.project.arch,
-            project=self.project,
+            self.project,
             sp_tracker=sp_tracker,
             bp_as_gpr=bp_as_gpr,
             udef_to_phiid=self._udef_to_phiid,