angr 9.2.131__py3-none-manylinux2014_aarch64.whl → 9.2.133__py3-none-manylinux2014_aarch64.whl

angr/analyses/loopfinder.py

@@ -28,7 +28,7 @@ class Loop:
                     break
 
     def __repr__(self):
-        return "<Loop @ %s, %d blocks>" % (self.entry.addr, len(self.body_nodes))
+        return f"<Loop @ {self.entry.addr}, {len(self.body_nodes)} blocks>"
 
 
 class LoopFinder(Analysis):

angr/analyses/propagator/engine_base.py

@@ -1,9 +1,14 @@
 from __future__ import annotations
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Generic
 import logging
 
+
+from angr.engines.light.engine import BlockType, DataType_co, StateType
+
 from angr.engines.light import SimEngineLight
 from angr.errors import SimEngineError
+from angr.project import Project
+from angr.misc.testing import is_testing
 
 if TYPE_CHECKING:
     from angr.analyses.reaching_definitions.reaching_definitions import ReachingDefinitionsModel
@@ -11,22 +16,22 @@ if TYPE_CHECKING:
 l = logging.getLogger(name=__name__)
 
 
-class SimEnginePropagatorBase(SimEngineLight):  # pylint:disable=abstract-method
+class SimEnginePropagatorBaseMixin(
+    Generic[StateType, DataType_co, BlockType], SimEngineLight[StateType, DataType_co, BlockType, StateType]
+):  # pylint:disable=abstract-method
     def __init__(
         self,
+        project: Project,
         stack_pointer_tracker=None,
-        project=None,
         propagate_tmps=True,
-        arch=None,
         reaching_definitions: ReachingDefinitionsModel | None = None,
         immediate_stmt_removal: bool = False,
         bp_as_gpr: bool = False,
     ):
-        super().__init__()
+        super().__init__(project)
 
         # Used in the VEX engine
-        self._project = project
-        self.arch = arch
+        self.arch = project.arch
         self.base_state = None
         self._load_callback = None
         self._propagate_tmps: bool = propagate_tmps
@@ -40,15 +45,17 @@ class SimEnginePropagatorBase(SimEngineLight):  # pylint:disable=abstract-method
 
         self._multi_occurrence_registers = None
 
-    def process(self, state, *args, **kwargs):
-        self.project = kwargs.pop("project", None)
-        self.base_state = kwargs.pop("base_state", None)
-        self._load_callback = kwargs.pop("load_callback", None)
+    def process(
+        self, state: StateType, *, block: BlockType | None = None, base_state=None, load_callback=None, **kwargs
+    ) -> StateType:
+        self.base_state = base_state
+        self._load_callback = load_callback
         try:
-            self._process(state, None, block=kwargs.pop("block", None))
+            result_state = super().process(state, block=block, **kwargs)
         except SimEngineError as ex:
-            if kwargs.pop("fail_fast", False) is True:
+            if kwargs.pop("fail_fast", is_testing) is True:
                 raise ex
             l.error(ex, exc_info=True)
+            result_state = state
 
-        return self.state
+        return result_state

angr/analyses/propagator/engine_vex.py

@@ -1,39 +1,52 @@
+# pylint: disable=missing-class-docstring
 from __future__ import annotations
-from typing import TYPE_CHECKING
+from typing import cast
 import logging
 
 import claripy
 import pyvex
-import archinfo
 
+from angr.engines.vex.claripy.datalayer import value
 from angr.knowledge_plugins.propagations.states import RegisterAnnotation, RegisterComparisonAnnotation
-from angr.engines.light import SimEngineLightVEXMixin
+from angr.engines.light import SimEngineNostmtVEX
 from angr.calling_conventions import DEFAULT_CC, SYSCALL_CC, default_cc, SimRegArg
-from .values import Top, Bottom
-from .engine_base import SimEnginePropagatorBase
-from .top_checker_mixin import TopCheckerMixin
+from angr.analyses.propagator.propagator import PropagatorVEXState
+from angr.block import Block
+from .engine_base import SimEnginePropagatorBaseMixin
+from .top_checker_mixin import ClaripyDataVEXEngineMixin
 from .vex_vars import VEXReg, VEXTmp, VEXMemVar
 
-if TYPE_CHECKING:
-    from angr.analyses.propagator.propagator import PropagatorVEXState
-
 
 _l = logging.getLogger(name=__name__)
 
+dirty_handler = SimEngineNostmtVEX[PropagatorVEXState, claripy.ast.BV, PropagatorVEXState].dirty_handler
+binop_handler = SimEngineNostmtVEX[PropagatorVEXState, claripy.ast.BV, PropagatorVEXState].binop_handler
+
 
 class SimEnginePropagatorVEX(
-    TopCheckerMixin,
-    SimEngineLightVEXMixin,
-    SimEnginePropagatorBase,
+    ClaripyDataVEXEngineMixin[PropagatorVEXState, claripy.ast.BV, PropagatorVEXState, None],
+    SimEnginePropagatorBaseMixin[PropagatorVEXState, claripy.ast.BV, Block],
+    SimEngineNostmtVEX[PropagatorVEXState, claripy.ast.BV, PropagatorVEXState],
 ):
-    state: PropagatorVEXState
+    @dirty_handler
+    def _handle_dirty_noop(self, expr):
+        if expr.tmp not in (-1, 0xFFFFFFFF):
+            self.tmps[expr.tmp] = self._top(pyvex.get_type_size(self.tyenv.lookup(expr.tmp)))
+
+    _handle_dirty_riscv_dirtyhelper_CSR_rw = _handle_dirty_noop
+    _handle_dirty_riscv_dirtyhelper_CSR_s = _handle_dirty_noop
+    _handle_dirty_riscv_dirtyhelper_CSR_c = _handle_dirty_noop
+    _handle_dirty_riscv_dirtyhelper_mret = _handle_dirty_noop
 
     #
     # Private methods
     #
 
-    def _process_block_end(self):
-        super()._process_block_end()
+    def _process_block_end(self, stmt_result, whitelist):
+        return self.state
+
+    def _process_block(self, whitelist=None):
+        result = super()._process_block(whitelist)
         if self.block.vex.jumpkind == "Ijk_Call" and self.arch.call_pushes_ret:
             # pop ret from the stack
             sp_offset = self.arch.sp_offset
@@ -43,56 +56,35 @@ class SimEnginePropagatorVEX(
 
         if self.block.vex.jumpkind == "Ijk_Call" or self.block.vex.jumpkind.startswith("Ijk_Sys"):
             self._handle_return_from_call()
+        return result
 
-    def _allow_loading(self, addr, size):
-        if type(addr) in (Top, Bottom):
+    def _allow_loading(self, addr: claripy.ast.BV, size):
+        if self._is_top(addr):
             return False
         if self._load_callback is None:
             return True
         return self._load_callback(addr, size)
 
-    def _expr(self, expr):
-        v = super()._expr(expr)
-
-        if (
-            v is not None
-            and type(v) not in {Bottom, Top}
-            and v is not expr
-            and type(expr) is pyvex.IRExpr.Get
-            and expr.offset
-            not in (
-                self.arch.sp_offset,
-                self.arch.ip_offset,
-            )
-        ):
-            # Record the replacement
-            self.state.add_replacement(
-                self._codeloc(block_only=False), VEXReg(expr.offset, expr.result_size(self.tyenv) // 8), v
-            )
-        return v
-
-    def _load_data(self, addr, size, endness):
-        if isinstance(addr, claripy.ast.Base):
-            sp_offset = self.extract_offset_to_sp(addr)
-            if sp_offset is not None:
-                # Local variable
-                return self.state.load_local_variable(sp_offset, size, endness)
-            if addr.op == "BVV":
-                addr = addr.args[0]
-                # Try loading from the state
-                if self._allow_loading(addr, size):
-                    if self.base_state is not None:
-                        _l.debug("Loading %d bytes from %x.", size, addr)
-                        data = self.base_state.memory.load(addr, size, endness=endness)
-                        if not data.symbolic:
-                            return data
-                    else:
-                        try:
-                            val = self.project.loader.memory.unpack_word(addr, size=size, endness=endness)
-                            return claripy.BVV(val, size * self.arch.byte_width)
-                        except KeyError:
-                            return None
-        return None
+    def _load_data(self, addr: claripy.ast.BV, size, endness) -> claripy.ast.BV:
+        sp_offset = self.extract_offset_to_sp(addr)
+        if sp_offset is not None:
+            # Local variable
+            return self.state.load_local_variable(sp_offset, size, endness)
+        if addr.op == "BVV" and self._allow_loading(addr, size):
+            # Try loading from the state
+            addr_int = cast(int, addr.args[0])
+            if self.base_state is not None:
+                _l.debug("Loading %d bytes from %x.", size, addr_int)
+                data = self.base_state.memory.load(addr, size, endness=endness)
+                if not data.symbolic:
+                    return data
+            else:
+                try:
+                    val = self.project.loader.memory.unpack_word(addr_int, size=size, endness=endness)
+                    return claripy.BVV(val, size * self.arch.byte_width)
+                except KeyError:
+                    pass
+        return self._top(size * self.arch.byte_width)
 
     #
     # Function handlers
@@ -101,7 +93,7 @@ class SimEnginePropagatorVEX(
     def _handle_function(self, addr):
         if self.arch.name == "X86" and isinstance(addr, claripy.ast.Base) and addr.op == "BVV":
             try:
-                b = self._project.loader.memory.load(addr.args[0], 4)
+                b = self.project.loader.memory.load(addr.args[0], 4)
             except KeyError:
                 return
             except TypeError:
@@ -124,6 +116,7 @@ class SimEnginePropagatorVEX(
                 platform=self.project.simos.name if self.project.simos is not None else None,
                 syscall=syscall,
             )  # don't instantiate the class for speed
+            assert cc is not None
             if isinstance(cc.RETURN_VAL, SimRegArg):
                 offset, size = self.arch.registers[cc.RETURN_VAL.reg_name]
                 self.state.store_register(offset, size, self.state.top(size * self.arch.byte_width))
@@ -135,70 +128,48 @@ class SimEnginePropagatorVEX(
     #
     # VEX statement handlers
     #
-    def _handle_Dirty(self, stmt):
-        # For RISCV CSR and mret operations, the Dirty statement is skipped.
-        if archinfo.arch_riscv64.is_riscv_arch(self.project.arch):
-            helper = str(stmt.cee)
-            if helper in (
-                "riscv_dirtyhelper_CSR_rw",
-                "riscv_dirtyhelper_CSR_s",
-                "riscv_dirtyhelper_CSR_c",
-                "riscv_dirtyhelper_mret",
-            ):
-                pass
-            else:
-                self.l.warning("Unimplemented Dirty node for current architecture.")
-
-    def _handle_WrTmp(self, stmt):
-        super()._handle_WrTmp(stmt)
 
+    def _handle_stmt_WrTmp(self, stmt):
+        self.tmps[stmt.tmp] = self._expr(stmt.data)
         if stmt.tmp in self.tmps:
             self.state.add_replacement(self._codeloc(block_only=True), VEXTmp(stmt.tmp), self.tmps[stmt.tmp])
 
-    def _handle_Put(self, stmt):
+    def _handle_stmt_Put(self, stmt):
         size = stmt.data.result_size(self.tyenv) // self.arch.byte_width
         data = self._expr(stmt.data)
 
-        if not (data is None or self.state.is_top(data)) or self.state._store_tops:
-            if data is None:
-                # make sure it's a top
-                data = self.state.top(size * self.arch.byte_width)
+        if not self._is_top(data) or self.state._store_tops:
             self.state.store_register(stmt.offset, size, data)
             self.state.add_replacement(self._codeloc(block_only=False), VEXReg(stmt.offset, size), data)
 
-    def _handle_PutI(self, stmt):
+    def _handle_stmt_PutI(self, stmt):
         self._expr(stmt.data)
 
-    def _store_data(self, addr, data, size, endness):
-        # pylint: disable=unused-argument,no-self-use
-        if isinstance(addr, claripy.ast.Base):
-            sp_offset = self.extract_offset_to_sp(addr)
-            if sp_offset is not None:
-                # Local variables
-                self.state.store_local_variable(sp_offset, size, data, endness)
-            elif addr.op == "BVV":
-                # a memory address
-                addr = addr.args[0]
-                variable = VEXMemVar(addr, size)
-                self.state.add_replacement(self._codeloc(block_only=False), variable, data)
-
-    def _handle_Store(self, stmt):
-        addr = self._expr(stmt.addr)
+    def _store_data(self, addr: claripy.ast.BV, data: claripy.ast.Bits, size: int, endness: str):
+        sp_offset = self.extract_offset_to_sp(addr)
+        if sp_offset is not None:
+            # Local variables
+            self.state.store_local_variable(sp_offset, size, data, endness)
+        elif addr.op == "BVV":
+            # a memory address
+            addr_int = cast(int, addr.args[0])
+            variable = VEXMemVar(addr_int, size)
+            self.state.add_replacement(self._codeloc(block_only=False), variable, data)
+
+    def _handle_stmt_Store(self, stmt):
+        addr = self._expr_bv(stmt.addr)
         if self.state.is_top(addr):
             return
         size = stmt.data.result_size(self.tyenv) // self.arch.byte_width
         data = self._expr(stmt.data)
 
-        if not (data is None or self.state.is_top(data)) or self.state._store_tops:
-            if data is None:
-                # make sure it's a top
-                data = self.state.top(size * self.arch.byte_width)
+        if not self.state.is_top(data) or self.state._store_tops:
             self._store_data(addr, data, size, self.arch.memory_endness)
 
-    def _handle_LoadG(self, stmt):
+    def _handle_stmt_LoadG(self, stmt):
         guard = self._expr(stmt.guard)
         if guard is True:
-            addr = self._expr(stmt.addr)
+            addr = self._expr_bv(stmt.addr)
             if addr is not None:
                 self.tmps[stmt.dst] = self._load_data(
                     addr, stmt.alt.result_size(self.tyenv) // 8, self.arch.memory_endness
@@ -207,121 +178,120 @@ class SimEnginePropagatorVEX(
             data = self._expr(stmt.alt)
             self.tmps[stmt.dst] = data
         else:
-            self.tmps[stmt.dst] = None
+            self.tmps[stmt.dst] = self._top(stmt.alt.result_size(self.tyenv))
 
         # add replacement
-        if self.tmps.get(stmt.dst):
+        if not self._is_top(self.tmps[stmt.dst]):
             self.state.add_replacement(self._codeloc(block_only=True), VEXTmp(stmt.dst), self.tmps[stmt.dst])
 
-    def _handle_StoreG(self, stmt):
-        guard = self._expr(stmt.guard)
+    def _handle_stmt_StoreG(self, stmt):
+        guard = self._expr_bv(stmt.guard)
         data = self._expr(stmt.data)
-        if guard is True:
-            addr = self._expr(stmt.addr)
-            if addr is not None:
-                self._store_data(addr, data, stmt.data.result_size(self.tyenv) // 8, self.arch.memory_endness)
-
-        # elif guard is False:
-        #    data = self._expr(stmt.alt)
-        #    self.tmps[stmt.dst] = data
-        # else:
-        #    self.tmps[stmt.dst] = None
+        if (guard != 0).is_true():
+            addr = self._expr_bv(stmt.addr)
+            self._store_data(addr, data, stmt.data.result_size(self.tyenv) // 8, self.arch.memory_endness)
 
-    def _handle_LLSC(self, stmt: pyvex.IRStmt.LLSC):
+    def _handle_stmt_LLSC(self, stmt):
         if stmt.storedata is None:
             # load-link
-            addr = self._expr(stmt.addr)
+            addr = self._expr_bv(stmt.addr)
             size = self.tyenv.sizeof(stmt.result) // self.arch.byte_width
             data = self._load_data(addr, size, stmt.endness)
-            if data is not None:
-                self.tmps[stmt.result] = data
+            self.tmps[stmt.result] = data
             if stmt.result in self.tmps:
                 self.state.add_replacement(self._codeloc(block_only=True), VEXTmp(stmt.result), self.tmps[stmt.result])
         else:
             # store-conditional
             storedata = self._expr(stmt.storedata)
-            if storedata is not None:
-                addr = self._expr(stmt.addr)
-                size = storedata.size() // self.arch.byte_width
-                self._store_data(addr, storedata, size, stmt.endness)
+            addr = self._expr_bv(stmt.addr)
+            size = storedata.size() // self.arch.byte_width
+            self._store_data(addr, storedata, size, stmt.endness)
 
-            self.tmps[stmt.result] = 1
+            self.tmps[stmt.result] = claripy.BVV(1, 1)
             self.state.add_replacement(self._codeloc(block_only=True), VEXTmp(stmt.result), self.tmps[stmt.result])
 
-    def _handle_CmpEQ(self, expr):
-        arg0, arg1 = self._expr(expr.args[0]), self._expr(expr.args[1])
-        if arg1 is not None and arg1.concrete and arg0 is not None and len(arg0.annotations) == 1:
-            anno = arg0.annotations[0]
+    @binop_handler
+    def _handle_binop_CmpEQ(self, expr):
+        lhs, rhs = self._expr(expr.args[0]), self._expr(expr.args[1])
+        if rhs.concrete and len(lhs.annotations) == 1:
+            anno = lhs.annotations[0]
+            if isinstance(anno, RegisterAnnotation):
+                cmp_anno = RegisterComparisonAnnotation(anno.offset, anno.size, "eq", rhs.concrete_value)
+                bits = pyvex.get_type_size(pyvex.get_op_retty(expr.op))
+                return self.state.top(bits).annotate(cmp_anno)
+        if lhs.concrete and len(rhs.annotations) == 1:
+            anno = rhs.annotations[0]
             if isinstance(anno, RegisterAnnotation):
-                cmp_anno = RegisterComparisonAnnotation(anno.offset, anno.size, "eq", arg1.concrete_value)
-                bits = expr.result_size(self.tyenv)
+                cmp_anno = RegisterComparisonAnnotation(anno.offset, anno.size, "eq", lhs.concrete_value)
+                bits = pyvex.get_type_size(pyvex.get_op_retty(expr.op))
                 return self.state.top(bits).annotate(cmp_anno)
-        return super()._handle_CmpEQ(expr)
+        return super()._handle_binop_CmpEQ(expr)
 
     #
     # Expression handlers
     #
 
-    def _handle_Get(self, expr):
+    def _handle_expr_Get(self, expr):
         size = expr.result_size(self.tyenv) // self.arch.byte_width
-        return self.state.load_register(expr.offset, size)
+        result = self.state.load_register(expr.offset, size)
+        if not self._is_top(result) and expr.offset not in (
+            self.arch.sp_offset,
+            self.arch.ip_offset,
+        ):
+            # Record the replacement
+            self.state.add_replacement(
+                self._codeloc(block_only=False), VEXReg(expr.offset, expr.result_size(self.tyenv) // 8), result
+            )
+        return result
 
-    def _handle_GetI(self, expr):
+    def _handle_expr_GetI(self, expr):
         return self.state.top(expr.result_size(self.tyenv))
 
-    def _handle_Load(self, expr):
-        addr = self._expr(expr.addr)
-        if addr is None or type(addr) in (Top, Bottom):
-            return None
+    def _handle_expr_ITE(self, expr):
+        return self.state.top(expr.result_size(self.tyenv))
+
+    def _handle_expr_GSPTR(self, expr):
+        return self.state.top(expr.result_size(self.tyenv))
+
+    def _handle_expr_VECRET(self, expr):
+        return self.state.top(expr.result_size(self.tyenv))
+
+    def _handle_expr_RdTmp(self, expr):
+        try:
+            return self.tmps[expr.tmp]
+        except KeyError:
+            return self._top(pyvex.get_type_size(self.tyenv.lookup(expr.tmp)))
+
+    def _handle_expr_Const(self, expr):
+        result = value(expr.con.type, expr.con.value)
+        if isinstance(result, claripy.ast.FP):
+            return self._top(expr.con.size)
+        return result
+
+    def _handle_expr_Load(self, expr):
+        addr = self._expr_bv(expr.addr)
         size = expr.result_size(self.tyenv) // self.arch.byte_width
         return self._load_data(addr, size, expr.endness)
 
-    def _handle_CCall(self, expr):
-        return None
-
-    def _handle_Binop(self, expr: pyvex.IRExpr.Binop):
+    def _handle_expr_Binop(self, expr):
         if not self.state.do_binops:
-            return self.state.top(expr.result_size(self.tyenv))
+            return self._top(expr.result_size(self.tyenv))
 
-        return super()._handle_Binop(expr)
-        # print(expr.op, r)
+        return super()._handle_expr_Binop(expr)
 
-    def _handle_Triop(self, expr: pyvex.IRExpr.Triop):
+    def _handle_expr_Triop(self, expr):
         if not self.state.do_binops:
-            return self.state.top(expr.result_size(self.tyenv))
-
-        return super()._handle_Triop(expr)
-
-    def _handle_Conversion(self, expr):
-        expr_ = self._expr(expr.args[0])
-        to_size = expr.result_size(self.tyenv)
-        if expr_ is None:
-            return self._top(to_size)
-        if self._is_top(expr_):
-            return self._top(to_size).annotate(*expr_.annotations)
-
-        if isinstance(expr_, claripy.ast.Base) and expr_.op == "BVV":
-            if expr_.size() > to_size:
-                # truncation
-                return expr_[to_size - 1 : 0]
-            if expr_.size() < to_size:
-                # extension
-                return claripy.ZeroExt(to_size - expr_.size(), expr_)
-            return expr_
-
-        return self._top(to_size)
-
-    def _handle_Exit(self, stmt):
+            return self._top(expr.result_size(self.tyenv))
+
+        return super()._handle_expr_Triop(expr)
+
+    def _handle_stmt_Exit(self, stmt: pyvex.stmt.Exit):
         guard = self._expr(stmt.guard)
-        if guard is not None and len(guard.annotations) == 1:
-            dst = self._expr(stmt.dst)
-            if dst is not None and dst.concrete:
+        if len(guard.annotations) == 1:
+            dst = value(stmt.dst.type, stmt.dst.value)
+            if dst.concrete:
                 anno = guard.annotations[0]
                 if isinstance(anno, RegisterComparisonAnnotation) and anno.cmp_op == "eq":
                     v = (anno.offset, anno.size, anno.value)
                     if v not in self.state.block_initial_reg_values[self.block.addr, dst.concrete_value]:
                         self.state.block_initial_reg_values[self.block.addr, dst.concrete_value].append(v)
-
-        super()._handle_Exit(stmt)
-
-    _handle_CmpF = _handle_CmpEQ

angr/analyses/propagator/outdated_definition_walker.py

@@ -119,13 +119,19 @@ class OutdatedDefinitionWalker(AILBlockWalker):
             super()._handle_Load(expr_idx, expr, stmt_idx, stmt, block)
             # then if the address expression is up-to-date, we check the global store
             if not self.out_dated and (
-                self.state.global_stores
-                and not all(
-                    self._check_store_precedes_load(CodeLocation(store_block_addr, store_stmt_idx), self.expr_defat)
-                    for store_block_addr, store_stmt_idx, addr, store in self.state.global_stores
+                (
+                    self.state.global_stores
+                    and not all(
+                        self._check_store_precedes_load(CodeLocation(store_block_addr, store_stmt_idx), self.expr_defat)
+                        for store_block_addr, store_stmt_idx, addr, store in self.state.global_stores
+                    )
+                )
+                or (
+                    self.state.last_stack_store is not None
+                    and not self._check_store_precedes_load(
+                        CodeLocation(*self.state.last_stack_store[:2]), self.expr_defat
+                    )
                 )
-                or self.state.last_stack_store is not None
-                and not self._check_store_precedes_load(CodeLocation(*self.state.last_stack_store[:2]), self.expr_defat)
             ):
                 self.out_dated = True
 

angr/analyses/propagator/propagator.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from typing import Any, TYPE_CHECKING
 import logging
 import time
+import contextlib
 
 import claripy
 import ailment
@@ -17,8 +18,6 @@ from angr import sim_options
 from angr.analyses import register_analysis
 from angr.analyses.analysis import Analysis
 from .engine_vex import SimEnginePropagatorVEX
-from .engine_ail import SimEnginePropagatorAIL
-import contextlib
 
 if TYPE_CHECKING:
     from angr.analyses.reaching_definitions.reaching_definitions import ReachingDefinitionsModel
@@ -165,21 +164,12 @@ class PropagatorAnalysis(ForwardAnalysis, Analysis):  # pylint:disable=abstract-
         if the_func is not None:
             bp_as_gpr = the_func.info.get("bp_as_gpr", False)
 
-        self._engine_vex = SimEnginePropagatorVEX(
+        # pyright says pylint is wrong about this
+        self._engine_vex = SimEnginePropagatorVEX(  # pylint: disable=abstract-class-instantiated
             project=self.project,
-            arch=self.project.arch,
             reaching_definitions=self._reaching_definitions,
             bp_as_gpr=bp_as_gpr,
         )
-        self._engine_ail = SimEnginePropagatorAIL(
-            arch=self.project.arch,
-            stack_pointer_tracker=self._stack_pointer_tracker,
-            # We only propagate tmps within the same block. This is because the lifetime of tmps is one block only.
-            propagate_tmps=block is not None,
-            reaching_definitions=self._reaching_definitions,
-            immediate_stmt_removal=self._immediate_stmt_removal,
-            bp_as_gpr=bp_as_gpr,
-        )
 
         # optimization: skip state copying for the initial state
         self._initial_state = None
@@ -240,8 +230,7 @@ class PropagatorAnalysis(ForwardAnalysis, Analysis):  # pylint:disable=abstract-
         pass
 
     def _initial_abstract_state(self, node):
-        cls = PropagatorAILState if isinstance(node, ailment.Block) else PropagatorVEXState
-        self._initial_state = cls.initial_state(
+        self._initial_state = PropagatorVEXState.initial_state(
             self.project,
             rda=self._reaching_definitions,
             only_consts=self._only_consts,
@@ -262,19 +251,12 @@ class PropagatorAnalysis(ForwardAnalysis, Analysis):  # pylint:disable=abstract-
     def _run_on_node(self, node, state):
         self._analyzed_states += 1
 
-        if isinstance(node, ailment.Block):
-            block = node
-            block_key = (node.addr, node.idx)
-            engine = self._engine_ail
-        else:
-            block = self.project.factory.block(
-                node.addr, node.size, opt_level=1, cross_insn_opt=self._vex_cross_insn_opt
-            )
-            block_key = node.addr
-            engine = self._engine_vex
-            if block.size == 0:
-                # maybe the block is not decodeable
-                return False, state
+        block = self.project.factory.block(node.addr, node.size, opt_level=1, cross_insn_opt=self._vex_cross_insn_opt)
+        block_key = node.addr
+        engine = self._engine_vex
+        if block.size == 0:
+            # maybe the block is not decodeable
+            return False, state
 
         if state is not self._initial_state:
             # make a copy of the state if it's not the initial state