angr 9.2.131__py3-none-manylinux2014_aarch64.whl → 9.2.133__py3-none-manylinux2014_aarch64.whl

angr/analyses/variable_recovery/engine_ail.py

@@ -1,23 +1,22 @@
 # pylint:disable=arguments-differ,invalid-unary-operand-type
 from __future__ import annotations
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, cast
 import logging
 
 import ailment
 import claripy
 from unique_log_filter import UniqueLogFilter
 
+from angr.engines.light.engine import SimEngineNostmtAIL
 from angr.procedures import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from angr.utils.constants import MAX_POINTSTO_BITS
-from angr.calling_conventions import SimRegArg
 from angr.sim_type import SimTypeFunction, dereference_simtype
-from angr.engines.light import SimEngineLightAILMixin
 from angr.analyses.typehoon import typeconsts, typevars
 from angr.analyses.typehoon.lifter import TypeLifter
 from .engine_base import SimEngineVRBase, RichR
 
 if TYPE_CHECKING:
-    from .variable_recovery_fast import VariableRecoveryFastState
+    pass
 
 
 l = logging.getLogger(name=__name__)
@@ -25,16 +24,13 @@ l.addFilter(UniqueLogFilter())
 
 
 class SimEngineVRAIL(
-    SimEngineLightAILMixin,
-    SimEngineVRBase,
+    SimEngineNostmtAIL["VariableRecoveryFastState", RichR[claripy.ast.BV | claripy.ast.FP], None, None],
+    SimEngineVRBase["VariableRecoveryFastState", ailment.Block],
 ):
     """
     The engine for variable recovery on AIL.
     """
 
-    state: VariableRecoveryFastState
-    block: ailment.Block
-
     def __init__(self, *args, call_info=None, vvar_to_vvar: dict[int, int] | None, **kwargs):
         super().__init__(*args, **kwargs)
 
@@ -47,9 +43,12 @@ class SimEngineVRAIL(
             return self.vvar_to_vvar[vvar_id]
         return None
 
+    def _process_block_end(self, block, stmt_data, whitelist):
+        pass
+
     # Statement handlers
 
-    def _ail_handle_Assignment(self, stmt):
+    def _handle_stmt_Assignment(self, stmt):
         dst_type = type(stmt.dst)
 
         if dst_type is ailment.Expr.Register:
@@ -91,19 +90,89 @@ class SimEngineVRAIL(
         else:
             l.warning("Unsupported dst type %s.", dst_type)
 
-    def _ail_handle_Store(self, stmt: ailment.Stmt.Store):
-        addr_r = self._expr(stmt.addr)
+    def _handle_stmt_Store(self, stmt: ailment.Stmt.Store):
+        addr_r = self._expr_bv(stmt.addr)
         data = self._expr(stmt.data)
         size = stmt.size
         self._store(addr_r, data, size, stmt=stmt)
 
-    def _ail_handle_Jump(self, stmt):
+    def _handle_stmt_Jump(self, stmt):
         pass
 
-    def _ail_handle_ConditionalJump(self, stmt):
+    def _handle_stmt_ConditionalJump(self, stmt):
         self._expr(stmt.condition)
 
-    def _ail_handle_Call(self, stmt: ailment.Stmt.Call, is_expr=False) -> RichR | None:
+    def _handle_expr_Tmp(self, expr):
+        try:
+            return self.tmps[expr.tmp_idx]
+        except KeyError:
+            return self._top(expr.bits)
+
+    def _handle_expr_MultiStatementExpression(self, expr):
+        for stmt in expr.statements:
+            self._stmt(stmt)
+        return self._expr(expr.expr)
+
+    def _handle_expr_Call(self, expr):
+        target = expr.target
+        args = []
+        if expr.args:
+            for arg in expr.args:
+                self._reference_spoffset = True
+                richr = self._expr(arg)
+                self._reference_spoffset = False
+                args.append(richr)
+
+        ret_expr_bits = expr.bits
+
+        if isinstance(target, ailment.Expr.Expression) and not isinstance(
+            target, (ailment.Expr.Const, ailment.Expr.DirtyExpression)
+        ):
+            # this is a dynamically calculated call target
+            target_expr = self._expr(target)
+            funcaddr_typevar = target_expr.typevar
+            assert funcaddr_typevar is not None
+            load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
+            self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
+
+        # discover the prototype
+        prototype: SimTypeFunction | None = None
+        prototype_libname: str | None = None
+        if expr.prototype is not None:
+            prototype = expr.prototype
+        if isinstance(expr.target, ailment.Expr.Const):
+            func_addr = expr.target.value
+            if isinstance(func_addr, self.kb.functions.address_types) and func_addr in self.kb.functions:
+                func = self.kb.functions[func_addr]
+                if prototype is None:
+                    prototype = func.prototype
+                prototype_libname = func.prototype_libname
+
+        # dump the type of the return value
+        ret_ty = typevars.TypeVariable() if prototype is not None else typevars.TypeVariable()
+        if isinstance(ret_ty, typeconsts.BottomType):
+            ret_ty = typevars.TypeVariable()
+
+        if prototype is not None and args:
+            # add type constraints
+
+            type_collections = []
+            if prototype_libname is not None:
+                prototype_lib = SIM_LIBRARIES[prototype_libname]
+                if prototype_lib.type_collection_names:
+                    for typelib_name in prototype_lib.type_collection_names:
+                        type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
+
+            for arg, arg_type in zip(args, prototype.args):
+                if arg.typevar is not None:
+                    arg_type = dereference_simtype(arg_type, type_collections).with_arch(arg_type._arch)
+                    arg_ty = TypeLifter(self.arch.bits).lift(arg_type)
+                    type_constraint = typevars.Subtype(arg.typevar, arg_ty)
+                    self.state.add_type_constraint(type_constraint)
+
+        return RichR(self.state.top(ret_expr_bits), typevar=ret_ty)
+
+    def _handle_stmt_Call(self, stmt):
         target = stmt.target
         args = []
         if stmt.args:
@@ -113,38 +182,26 @@ class SimEngineVRAIL(
                 self._reference_spoffset = False
                 args.append(richr)
 
-        ret_expr = None
         ret_expr_bits = self.state.arch.bits
-        ret_val = None  # stores the value that this method should return to its caller when this is a call expression.
         create_variable = True
-        if not is_expr:
-            # this is a call statement. we need to update the return value register later
-            ret_expr: ailment.Expr.VirtualVariable | None = stmt.ret_expr
-            if ret_expr is not None:
-                if ret_expr.category == ailment.Expr.VirtualVariableCategory.REGISTER:
-                    ret_expr_bits = ret_expr.bits
-            else:
-                # the return expression is not used, so we treat this call as not returning anything
-                if stmt.calling_convention is not None:
-                    # we only set the ret_expr if prototype must be guessed. otherwise ret_expr should just be None
-                    if stmt.prototype is None:
-                        ret_expr: SimRegArg = stmt.calling_convention.RETURN_VAL
-                else:
-                    l.debug(
-                        "Unknown calling convention for function %s. Fall back to default calling convention.", target
-                    )
-                    ret_expr: SimRegArg = self.project.factory.cc().RETURN_VAL
 
-                create_variable = False
+        # this is a call statement. we need to update the return value register later
+        ret_expr = stmt.ret_expr
+        if ret_expr is not None:
+            if ret_expr.category == ailment.Expr.VirtualVariableCategory.REGISTER:
+                ret_expr_bits = ret_expr.bits
         else:
-            # this is a call expression. we just return the value at the end of this method
-            ret_expr_bits = stmt.bits
+            # the return expression is not used, so we treat this call as not returning anything
+            create_variable = False
 
-        if isinstance(target, ailment.Expr.Expression) and not isinstance(target, ailment.Expr.Const):
+        if isinstance(target, ailment.Expr.Expression) and not isinstance(
+            target, (ailment.Expr.Const, ailment.Expr.DirtyExpression)
+        ):
             # this is a dynamically calculated call target
             target_expr = self._expr(target)
             funcaddr_typevar = target_expr.typevar
-            load_typevar = self._create_access_typevar(target_expr.typevar, False, self.arch.bytes, 0)
+            assert funcaddr_typevar is not None
+            load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
             self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
 
         # discover the prototype
@@ -168,30 +225,26 @@ class SimEngineVRAIL(
         # TODO: Expose it as an option
         return_value_use_full_width_reg = True
 
-        if is_expr:
-            # call expression mode
-            ret_val = RichR(self.state.top(ret_expr_bits), typevar=ret_ty)
-        else:
-            # update the return value register
-            if isinstance(ret_expr, ailment.Expr.VirtualVariable):
-                expr_bits = ret_expr_bits
-                self._assign_to_vvar(
-                    ret_expr,
-                    RichR(self.state.top(expr_bits), typevar=ret_ty),
-                    dst=ret_expr,
-                    create_variable=create_variable,
-                    vvar_id=self._mapped_vvarid(ret_expr.varid),
-                )
-            elif isinstance(ret_expr, ailment.Expr.Register):
-                l.warning("Left-over register found in call.ret_expr.")
-                expr_bits = self.state.arch.bits if return_value_use_full_width_reg else ret_expr_bits
-                self._assign_to_register(
-                    ret_expr.reg_offset,
-                    RichR(self.state.top(expr_bits), typevar=ret_ty),
-                    expr_bits // self.arch.byte_width,
-                    dst=ret_expr,
-                    create_variable=create_variable,
-                )
+        # update the return value register
+        if isinstance(ret_expr, ailment.Expr.VirtualVariable):
+            expr_bits = ret_expr_bits
+            self._assign_to_vvar(
+                ret_expr,
+                RichR(self.state.top(expr_bits), typevar=ret_ty),
+                dst=ret_expr,
+                create_variable=create_variable,
+                vvar_id=self._mapped_vvarid(ret_expr.varid),
+            )
+        elif isinstance(ret_expr, ailment.Expr.Register):
+            l.warning("Left-over register found in call.ret_expr.")
+            expr_bits = self.state.arch.bits if return_value_use_full_width_reg else ret_expr_bits
+            self._assign_to_register(
+                ret_expr.reg_offset,
+                RichR(self.state.top(expr_bits), typevar=ret_ty),
+                expr_bits // self.arch.byte_width,
+                dst=ret_expr,
+                create_variable=create_variable,
+            )
 
         if prototype is not None and args:
             # add type constraints
@@ -210,20 +263,12 @@ class SimEngineVRAIL(
                     type_constraint = typevars.Subtype(arg.typevar, arg_ty)
                     self.state.add_type_constraint(type_constraint)
 
-        if is_expr:
-            # call expression mode: return the actual return value
-            return ret_val
-        return None
-
-    def _ail_handle_CallExpr(self, expr: ailment.Stmt.Call) -> RichR:
-        return self._ail_handle_Call(expr, is_expr=True)
-
-    def _ail_handle_Return(self, stmt: ailment.Stmt.Return):
+    def _handle_stmt_Return(self, stmt):
         if stmt.ret_exprs:
             for ret_expr in stmt.ret_exprs:
                 self._expr(ret_expr)
 
-    def _ail_handle_DirtyExpression(self, expr: ailment.Expr.DirtyExpression) -> RichR:
+    def _handle_expr_DirtyExpression(self, expr: ailment.Expr.DirtyExpression) -> RichR:
         for op in expr.operands:
             self._expr(op)
         if expr.guard:
@@ -232,45 +277,47 @@ class SimEngineVRAIL(
             self._expr(expr.maddr)
         return RichR(self.state.top(expr.bits))
 
-    def _ail_handle_VEXCCallExpression(self, expr: ailment.Expr.VEXCCallExpression) -> RichR:
+    def _handle_expr_VEXCCallExpression(self, expr: ailment.Expr.VEXCCallExpression) -> RichR:
         for op in expr.operands:
             self._expr(op)
         return RichR(self.state.top(expr.bits))
 
     # Expression handlers
 
-    def _expr(self, expr: ailment.Expr.Expression):
-        """
-
-        :param expr:
-        :return:
-        :rtype: RichR
-        """
-
-        r = super()._expr(expr)
-        if r is None:
-            return RichR(self.state.top(expr.bits))
-        return r
-
-    def _ail_handle_BV(self, expr: claripy.ast.Base):
-        return RichR(expr)
-
-    def _ail_handle_Register(self, expr):
+    def _expr_bv(self, expr: ailment.expression.Expression) -> RichR[claripy.ast.BV]:
+        result = self._expr(expr)
+        assert isinstance(result.data, claripy.ast.BV)
+        return cast(RichR[claripy.ast.BV], result)
+
+    def _expr_fp(self, expr: ailment.expression.Expression) -> RichR[claripy.ast.FP]:
+        result = self._expr(expr)
+        assert isinstance(result.data, claripy.ast.FP)
+        return cast(RichR[claripy.ast.FP], result)
+
+    def _expr_pair(
+        self, expr1: ailment.expression.Expression, expr2: ailment.expression.Expression
+    ) -> tuple[RichR[claripy.ast.BV], RichR[claripy.ast.BV]] | tuple[RichR[claripy.ast.FP], RichR[claripy.ast.FP]]:
+        result1 = self._expr(expr1)
+        result2 = self._expr(expr2)
+        assert type(result1.data) is type(result2.data)
+        return result1, result2  # type: ignore
+
+    def _handle_expr_Register(self, expr):
         offset = expr.reg_offset
         size = expr.bits // 8
 
         return self._read_from_register(offset, size, expr=expr)
 
-    def _ail_handle_Load(self, expr):
-        addr_r = self._expr(expr.addr)
+    def _handle_expr_Load(self, expr):
+        addr_r = self._expr_bv(expr.addr)
         size = expr.size
 
         return self._load(addr_r, size, expr=expr)
 
-    def _ail_handle_VirtualVariable(self, expr: ailment.Expr.VirtualVariable):
+    def _handle_expr_VirtualVariable(self, expr: ailment.Expr.VirtualVariable):
         return self._read_from_vvar(expr, expr=expr, vvar_id=self._mapped_vvarid(expr.varid))
 
-    def _ail_handle_Phi(self, expr: ailment.Expr.Phi):
+    def _handle_expr_Phi(self, expr: ailment.Expr.Phi):
         tvs = set()
         for _, vvar in expr.src_and_vvars:
             if vvar is not None:
@@ -283,9 +330,9 @@ class SimEngineVRAIL(
             self.state.add_type_constraint(typevars.Subtype(tv, tv_))
         return RichR(self.state.top(expr.bits), typevar=tv)
 
-    def _ail_handle_Const(self, expr: ailment.Expr.Const):
+    def _handle_expr_Const(self, expr: ailment.Expr.Const):
         if isinstance(expr.value, float):
-            v = claripy.FPV(expr.value, claripy.FSORT_DOUBLE if expr.bits == 64 else claripy.FSORT_FLOAT)
+            v = claripy.FPV(expr.value, claripy.FSORT_DOUBLE if expr.bits == 64 else claripy.FSORT_FLOAT).to_bv()
             ty = typeconsts.float_type(expr.bits)
         else:
             if self.project.loader.find_segment_containing(expr.value) is not None:
@@ -299,7 +346,7 @@ class SimEngineVRAIL(
                     else typeconsts.Pointer32(typeconsts.TopType())
                 )
             else:
-                ty = typeconsts.int_type(expr.size * self.state.arch.byte_width)
+                ty = typeconsts.int_type(expr.bits)
             v = claripy.BVV(expr.value, expr.bits)
         r = RichR(v, typevar=ty)
         codeloc = self._codeloc()
@@ -307,17 +354,7 @@ class SimEngineVRAIL(
         self._reference(r, codeloc)
         return r
 
-    def _ail_handle_BinaryOp(self, expr):
-        r = super()._ail_handle_BinaryOp(expr)
-        if r is None:
-            # Treat it as a normal binaryop expression
-            self._expr(expr.operands[0])
-            self._expr(expr.operands[1])
-            # still return a RichR instance
-            r = RichR(self.state.top(expr.bits))
-        return r
-
-    def _ail_handle_Convert(self, expr: ailment.Expr.Convert):
+    def _handle_expr_Convert(self, expr: ailment.Expr.Convert):
         r = self._expr(expr.operand)
         typevar = None
         if r.typevar is not None:
@@ -333,7 +370,7 @@ class SimEngineVRAIL(
 
         return RichR(self.state.top(expr.to_bits), typevar=typevar)
 
-    def _ail_handle_Reinterpret(self, expr: ailment.Expr.Reinterpret):
+    def _handle_expr_Reinterpret(self, expr: ailment.Expr.Reinterpret):
         r = self._expr(expr.operand)
         typevar = None
         if r.typevar is not None:
@@ -349,7 +386,7 @@ class SimEngineVRAIL(
 
         return RichR(self.state.top(expr.to_bits), typevar=typevar)
 
-    def _ail_handle_StackBaseOffset(self, expr: ailment.Expr.StackBaseOffset):
+    def _handle_expr_StackBaseOffset(self, expr: ailment.Expr.StackBaseOffset):
         ref_typevar = self.state.stack_offset_typevars.get(expr.offset, None)
 
         if ref_typevar is None:
@@ -374,37 +411,21 @@ class SimEngineVRAIL(
 
         return richr
 
-    def _ail_handle_ITE(self, expr: ailment.Expr.ITE):
+    def _handle_expr_BasePointerOffset(self, expr):
+        # TODO
+        return self._top(expr.bits)
+
+    def _handle_expr_ITE(self, expr: ailment.Expr.ITE):
         self._expr(expr.cond)  # cond
         self._expr(expr.iftrue)  # r0
         self._expr(expr.iffalse)  # r1
 
         return RichR(self.state.top(expr.bits))
 
-    def _ail_handle_Cmp(self, expr):  # pylint:disable=useless-return
-        self._expr(expr.operands[0])
-        self._expr(expr.operands[1])
-        return RichR(self.state.top(expr.bits))
-
-    _ail_handle_CmpF = _ail_handle_Cmp
-    _ail_handle_CmpEQ = _ail_handle_Cmp
-    _ail_handle_CmpNE = _ail_handle_Cmp
-    _ail_handle_CmpLT = _ail_handle_Cmp
-    _ail_handle_CmpLE = _ail_handle_Cmp
-    _ail_handle_CmpGT = _ail_handle_Cmp
-    _ail_handle_CmpGE = _ail_handle_Cmp
-    _ail_handle_CasCmpEQ = _ail_handle_Cmp
-    _ail_handle_CasCmpNE = _ail_handle_Cmp
-    _ail_handle_CasCmpLT = _ail_handle_Cmp
-    _ail_handle_CasCmpLE = _ail_handle_Cmp
-    _ail_handle_CasCmpGT = _ail_handle_Cmp
-    _ail_handle_CasCmpGE = _ail_handle_Cmp
-
-    def _ail_handle_Add(self, expr):
+    def _handle_binop_Add(self, expr):
         arg0, arg1 = expr.operands
-
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0, r1 = self._expr_pair(arg0, arg1)
+        compute = r0.data + r1.data  # type: ignore
 
         type_constraints = set()
         # create a new type variable and add constraints accordingly
@@ -419,21 +440,12 @@ class SimEngineVRAIL(
         else:
             typevar = None
 
-        sum_ = None
-        if r0.data is not None and r1.data is not None:
-            sum_ = r0.data + r1.data
-
-        return RichR(
-            sum_,
-            typevar=typevar,
-            type_constraints=type_constraints,
-        )
+        return RichR(compute, typevar=typevar, type_constraints=type_constraints)
 
-    def _ail_handle_Sub(self, expr):
+    def _handle_binop_Sub(self, expr):
         arg0, arg1 = expr.operands
-
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0, r1 = self._expr_pair(arg0, arg1)
+        compute = r0.data - r1.data  # type: ignore
 
         type_constraints = set()
         if r0.typevar is not None and r1.data.concrete:
@@ -443,39 +455,34 @@ class SimEngineVRAIL(
             if r0.typevar is not None and r1.typevar is not None:
                 type_constraints.add(typevars.Sub(r0.typevar, r1.typevar, typevar))
 
-        sub = None
-        if r0.data is not None and r1.data is not None:
-            sub = r0.data - r1.data
-
         return RichR(
-            sub,
+            compute,
             typevar=typevar,
             type_constraints=type_constraints,
         )
 
-    def _ail_handle_Mul(self, expr):
+    def _handle_binop_Mul(self, expr):
         arg0, arg1 = expr.operands
-
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0, r1 = self._expr_pair(arg0, arg1)
 
         result_size = arg0.bits
-        if r0.data.concrete and r1.data.concrete:
-            v = r0.data * r1.data
-            tv = r0.typevar
-        elif r1.data.concrete:
-            v = r0.data * r1.data
-            tv = typeconsts.int_type(result_size)
-        else:
-            v = self.state.top(expr.bits)
-            tv = typeconsts.int_type(result_size)
-        return RichR(v, typevar=tv, type_constraints=None)
+        if r0.data.concrete or r1.data.concrete:
+            # constants
+            result_size = arg0.bits
+            compute = r0.data * r1.data  # type: ignore
+            return RichR(compute, typevar=typeconsts.int_type(result_size), type_constraints=None)
 
-    def _ail_handle_Mull(self, expr):
+        r = self.state.top(expr.bits)
+        return RichR(
+            r,
+            typevar=r0.typevar,
+        )
+
+    def _handle_binop_Mull(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
 
         if r0.data.concrete and r1.data.concrete:
             # constants
@@ -498,11 +505,11 @@ class SimEngineVRAIL(
             typevar=r0.typevar,  # FIXME: the size is probably changed
         )
 
-    def _ail_handle_Div(self, expr):
+    def _handle_binop_Div(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
         from_size = expr.bits
         to_size = r1.bits
 
@@ -521,66 +528,37 @@ class SimEngineVRAIL(
             # | typevar=r0.typevar,  # FIXME: Handle typevars for Div
         )
 
-    def _ail_handle_DivMod(self, expr: ailment.Expr.BinaryOp):
-        arg0, arg1 = expr.operands
-
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
-        from_size = expr.from_bits
-        to_size = expr.to_bits
-
-        if (r1.data == 0).is_true():
-            r = self.state.top(to_size * 2)
-        elif expr.signed:
-            quotient = r0.data.SDiv(claripy.SignExt(from_size - to_size, r1.data))
-            remainder = r0.data.SMod(claripy.SignExt(from_size - to_size, r1.data))
-            quotient_size = to_size
-            remainder_size = to_size
-            r = claripy.Concat(
-                claripy.Extract(remainder_size - 1, 0, remainder), claripy.Extract(quotient_size - 1, 0, quotient)
-            )
-        else:
-            quotient = r0.data // claripy.ZeroExt(from_size - to_size, r1.data)
-            remainder = r0.data % claripy.ZeroExt(from_size - to_size, r1.data)
-            quotient_size = to_size
-            remainder_size = to_size
-            r = claripy.Concat(
-                claripy.Extract(remainder_size - 1, 0, remainder), claripy.Extract(quotient_size - 1, 0, quotient)
-            )
-
-        return RichR(
-            r,
-            # | typevar=r0.typevar,  # FIXME: Handle typevars for DivMod
-        )
-
-    def _ail_handle_Mod(self, expr):
+    def _handle_binop_Mod(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
-        from_size = expr.bits
-        to_size = r1.bits
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
+        result_size = expr.bits
 
         if expr.floating_point:
-            remainder = self.state.top(to_size)
+            remainder = self.state.top(result_size)
         else:
             if (r1.data == 0).is_true():
-                remainder = self.state.top(to_size)
+                remainder = self.state.top(result_size)
             elif expr.signed:
-                remainder = r0.data.SMod(claripy.SignExt(from_size - to_size, r1.data))
+                remainder = r0.data.SMod(r1.data)
             else:
-                remainder = r0.data % claripy.ZeroExt(from_size - to_size, r1.data)
+                remainder = r0.data % r1.data
+
+        # truncation if necessary
+        if remainder.size() > result_size:
+            remainder = claripy.Extract(result_size - 1, 0, remainder)
 
         return RichR(
             remainder,
             # | typevar=r0.typevar,  # FIXME: Handle typevars for Mod
         )
 
-    def _ail_handle_Xor(self, expr):
+    def _handle_binop_Xor(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
 
         if r0.data.concrete and r1.data.concrete:
             # constants
@@ -593,11 +571,11 @@ class SimEngineVRAIL(
             typevar=r0.typevar,
         )
 
-    def _ail_handle_Shl(self, expr):
+    def _handle_binop_Shl(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
         result_size = arg0.bits
 
         if not r1.data.concrete:
@@ -611,11 +589,11 @@ class SimEngineVRAIL(
         shiftamount = r1.data.concrete_value
         return RichR(r0.data << shiftamount, typevar=typeconsts.int_type(result_size), type_constraints=None)
 
-    def _ail_handle_Shr(self, expr):
+    def _handle_binop_Shr(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
         result_size = arg0.bits
 
         if not r1.data.concrete:
@@ -632,11 +610,11 @@ class SimEngineVRAIL(
             claripy.LShR(r0.data, shiftamount), typevar=typeconsts.int_type(result_size), type_constraints=None
         )
 
-    def _ail_handle_Sal(self, expr):
+    def _handle_binop_Sal(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
         result_size = arg0.bits
 
         if not r1.data.concrete:
@@ -651,11 +629,11 @@ class SimEngineVRAIL(
 
         return RichR(r0.data << shiftamount, typevar=typeconsts.int_type(result_size), type_constraints=None)
 
-    def _ail_handle_Sar(self, expr):
+    def _handle_binop_Sar(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
         result_size = arg0.bits
 
         if not r1.data.concrete:
@@ -670,11 +648,11 @@ class SimEngineVRAIL(
 
         return RichR(r0.data >> shiftamount, typevar=typeconsts.int_type(result_size), type_constraints=None)
 
-    def _ail_handle_And(self, expr):
+    def _handle_binop_And(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
 
         result_size = arg0.bits
         if r0.data.concrete and r1.data.concrete:
@@ -687,11 +665,11 @@ class SimEngineVRAIL(
         r = self.state.top(expr.bits)
         return RichR(r, typevar=typeconsts.int_type(result_size))
 
-    def _ail_handle_Or(self, expr):
+    def _handle_binop_Or(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        r1 = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        r1 = self._expr_bv(arg1)
 
         result_size = arg0.bits
         if r0.data.concrete and r1.data.concrete:
@@ -704,62 +682,111 @@ class SimEngineVRAIL(
         r = self.state.top(expr.bits)
         return RichR(r, typevar=typeconsts.int_type(result_size))
 
-    def _ail_handle_LogicalAnd(self, expr):
+    def _handle_binop_LogicalAnd(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        _ = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        _ = self._expr_bv(arg1)
         r = self.state.top(expr.bits)
         return RichR(r, typevar=r0.typevar)
 
-    def _ail_handle_LogicalOr(self, expr):
+    def _handle_binop_LogicalOr(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        _ = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        _ = self._expr_bv(arg1)
         r = self.state.top(expr.bits)
         return RichR(r, typevar=r0.typevar)
 
-    def _ail_handle_LogicalXor(self, expr):
+    def _handle_binop_LogicalXor(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        _ = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        _ = self._expr_bv(arg1)
         r = self.state.top(expr.bits)
         return RichR(r, typevar=r0.typevar)
 
-    def _ail_handle_Rol(self, expr):
+    def _handle_binop_Rol(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        _ = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        _ = self._expr_bv(arg1)
         result_size = arg0.bits
 
         r = self.state.top(result_size)
         return RichR(r, typevar=r0.typevar)
 
-    def _ail_handle_Ror(self, expr):
+    def _handle_binop_Ror(self, expr):
         arg0, arg1 = expr.operands
 
-        r0 = self._expr(arg0)
-        _ = self._expr(arg1)
+        r0 = self._expr_bv(arg0)
+        _ = self._expr_bv(arg1)
         result_size = arg0.bits
 
         r = self.state.top(result_size)
         return RichR(r, typevar=r0.typevar)
 
-    def _ail_handle_Concat(self, expr):
+    def _handle_binop_Concat(self, expr):
         arg0, arg1 = expr.operands
 
-        _ = self._expr(arg0)
-        _ = self._expr(arg1)
+        _ = self._expr_bv(arg0)
+        _ = self._expr_bv(arg1)
 
         # TODO: Model the operation. Don't lose type constraints
         return RichR(self.state.top(expr.bits))
 
-    def _ail_handle_Not(self, expr):
+    def _handle_binop_Default(self, expr):
+        arg0, arg1 = expr.operands
+
+        self._expr(arg0)
+        self._expr(arg1)
+
+        return RichR(self.state.top(expr.bits))
+
+    _handle_binop_AddF = _handle_binop_Default
+    _handle_binop_SubF = _handle_binop_Default
+    _handle_binop_SubV = _handle_binop_Default
+    _handle_binop_MulF = _handle_binop_Default
+    _handle_binop_DivF = _handle_binop_Default
+    _handle_binop_DivV = _handle_binop_Default
+    _handle_binop_AddV = _handle_binop_Default
+    _handle_binop_MulV = _handle_binop_Default
+    _handle_binop_MulHiV = _handle_binop_Default
+    _handle_binop_Carry = _handle_binop_Default
+    _handle_binop_Borrow = _handle_binop_Default
+    _handle_binop_SCarry = _handle_binop_Default
+    _handle_binop_SBorrow = _handle_binop_Default
+    _handle_binop_InterleaveLOV = _handle_binop_Default
+    _handle_binop_InterleaveHIV = _handle_binop_Default
+    _handle_binop_CasCmpEQ = _handle_binop_Default
+    _handle_binop_CasCmpNE = _handle_binop_Default
+    _handle_binop_ExpCmpNE = _handle_binop_Default
+    _handle_binop_SarNV = _handle_binop_Default
+    _handle_binop_ShrNV = _handle_binop_Default
+    _handle_binop_ShlNV = _handle_binop_Default
+    _handle_binop_PermV = _handle_binop_Default
+    _handle_binop_Set = _handle_binop_Default
+    _handle_binop_MaxV = _handle_binop_Default
+    _handle_binop_MinV = _handle_binop_Default
+    _handle_binop_QAddV = _handle_binop_Default
+    _handle_binop_QNarrowBinV = _handle_binop_Default
+    _handle_binop_CmpEQ = _handle_binop_Default
+    _handle_binop_CmpNE = _handle_binop_Default
+    _handle_binop_CmpLT = _handle_binop_Default
+    _handle_binop_CmpLE = _handle_binop_Default
+    _handle_binop_CmpGT = _handle_binop_Default
+    _handle_binop_CmpGE = _handle_binop_Default
+    _handle_binop_CmpEQV = _handle_binop_Default
+    _handle_binop_CmpNEV = _handle_binop_Default
+    _handle_binop_CmpGEV = _handle_binop_Default
+    _handle_binop_CmpGTV = _handle_binop_Default
+    _handle_binop_CmpLEV = _handle_binop_Default
+    _handle_binop_CmpLTV = _handle_binop_Default
+    _handle_binop_CmpF = _handle_binop_Default
+
+    def _handle_unop_Not(self, expr):
         arg = expr.operands[0]
-        expr = self._expr(arg)
+        expr = self._expr_bv(arg)
 
         result_size = arg.bits
 
@@ -773,9 +800,9 @@ class SimEngineVRAIL(
         r = self.state.top(result_size)
         return RichR(r, typevar=expr.typevar)
 
-    def _ail_handle_Neg(self, expr):
+    def _handle_unop_Neg(self, expr):
         arg = expr.operands[0]
-        expr = self._expr(arg)
+        expr = self._expr_bv(arg)
 
         result_size = arg.bits
 
@@ -789,9 +816,9 @@ class SimEngineVRAIL(
         r = self.state.top(result_size)
         return RichR(r, typevar=expr.typevar)
 
-    def _ail_handle_BitwiseNeg(self, expr):
+    def _handle_unop_BitwiseNeg(self, expr):
         arg = expr.operands[0]
-        expr = self._expr(arg)
+        expr = self._expr_bv(arg)
 
         result_size = arg.bits
 
@@ -804,3 +831,16 @@ class SimEngineVRAIL(
 
         r = self.state.top(result_size)
         return RichR(r, typevar=expr.typevar)
+
+    def _handle_unop_Default(self, expr):
+        self._expr(expr.operands[0])
+        return RichR(self.state.top(expr.bits))
+
+    _handle_unop_Reference = _handle_unop_Default
+    _handle_unop_Dereference = _handle_unop_Default
+    _handle_unop_Clz = _handle_unop_Default
+    _handle_unop_Ctz = _handle_unop_Default
+    _handle_unop_GetMSBs = _handle_unop_Default
+    _handle_unop_unpack = _handle_unop_Default
+    _handle_unop_Sqrt = _handle_unop_Default
+    _handle_unop_RSqrtEst = _handle_unop_Default