angr 9.2.131__py3-none-manylinux2014_aarch64.whl → 9.2.133__py3-none-manylinux2014_aarch64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +128 -128
- angr/analyses/__init__.py +38 -38
- angr/analyses/analysis.py +6 -2
- angr/analyses/backward_slice.py +3 -4
- angr/analyses/binary_optimizer.py +5 -12
- angr/analyses/bindiff.py +3 -6
- angr/analyses/calling_convention.py +3 -4
- angr/analyses/cfg/__init__.py +3 -3
- angr/analyses/cfg/cfg_base.py +1 -1
- angr/analyses/cfg/cfg_emulated.py +5 -5
- angr/analyses/cfg/cfg_fast.py +19 -17
- angr/analyses/cfg/indirect_jump_resolvers/__init__.py +5 -5
- angr/analyses/cfg/indirect_jump_resolvers/amd64_elf_got.py +1 -1
- angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +148 -101
- angr/analyses/cfg/indirect_jump_resolvers/x86_elf_pic_plt.py +1 -1
- angr/analyses/data_dep/__init__.py +4 -4
- angr/analyses/datagraph_meta.py +1 -1
- angr/analyses/ddg.py +16 -17
- angr/analyses/decompiler/__init__.py +12 -12
- angr/analyses/decompiler/ail_simplifier.py +24 -12
- angr/analyses/decompiler/block_similarity.py +2 -4
- angr/analyses/decompiler/block_simplifier.py +10 -21
- angr/analyses/decompiler/callsite_maker.py +1 -1
- angr/analyses/decompiler/ccall_rewriters/rewriter_base.py +1 -1
- angr/analyses/decompiler/clinic.py +122 -41
- angr/analyses/decompiler/condition_processor.py +57 -39
- angr/analyses/decompiler/counters/__init__.py +3 -3
- angr/analyses/decompiler/decompilation_cache.py +7 -7
- angr/analyses/decompiler/dephication/__init__.py +1 -1
- angr/analyses/decompiler/dephication/graph_rewriting.py +1 -1
- angr/analyses/decompiler/dephication/graph_vvar_mapping.py +11 -3
- angr/analyses/decompiler/dephication/rewriting_engine.py +169 -45
- angr/analyses/decompiler/dephication/seqnode_dephication.py +5 -4
- angr/analyses/decompiler/expression_narrower.py +1 -1
- angr/analyses/decompiler/graph_region.py +8 -8
- angr/analyses/decompiler/optimization_passes/__init__.py +20 -20
- angr/analyses/decompiler/optimization_passes/const_derefs.py +1 -0
- angr/analyses/decompiler/optimization_passes/deadblock_remover.py +1 -2
- angr/analyses/decompiler/optimization_passes/div_simplifier.py +41 -16
- angr/analyses/decompiler/optimization_passes/duplication_reverter/duplication_reverter.py +8 -7
- angr/analyses/decompiler/optimization_passes/duplication_reverter/utils.py +1 -3
- angr/analyses/decompiler/optimization_passes/engine_base.py +262 -84
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +175 -39
- angr/analyses/decompiler/optimization_passes/ite_region_converter.py +2 -5
- angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +5 -5
- angr/analyses/decompiler/optimization_passes/mod_simplifier.py +12 -3
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +42 -19
- angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py +9 -5
- angr/analyses/decompiler/peephole_optimizations/__init__.py +1 -1
- angr/analyses/decompiler/peephole_optimizations/base.py +6 -6
- angr/analyses/decompiler/peephole_optimizations/remove_noop_conversions.py +2 -0
- angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py +1 -1
- angr/analyses/decompiler/presets/__init__.py +1 -1
- angr/analyses/decompiler/region_simplifiers/expr_folding.py +3 -3
- angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +8 -12
- angr/analyses/decompiler/ssailification/rewriting.py +1 -2
- angr/analyses/decompiler/ssailification/rewriting_engine.py +139 -56
- angr/analyses/decompiler/ssailification/ssailification.py +2 -1
- angr/analyses/decompiler/ssailification/traversal.py +4 -6
- angr/analyses/decompiler/ssailification/traversal_engine.py +125 -42
- angr/analyses/decompiler/structured_codegen/__init__.py +5 -5
- angr/analyses/decompiler/structured_codegen/base.py +3 -3
- angr/analyses/decompiler/structured_codegen/c.py +39 -40
- angr/analyses/decompiler/structuring/__init__.py +3 -3
- angr/analyses/decompiler/structuring/phoenix.py +45 -29
- angr/analyses/decompiler/structuring/structurer_base.py +2 -2
- angr/analyses/decompiler/structuring/structurer_nodes.py +23 -14
- angr/analyses/deobfuscator/__init__.py +3 -3
- angr/analyses/deobfuscator/irsb_reg_collector.py +29 -60
- angr/analyses/deobfuscator/string_obf_finder.py +2 -2
- angr/analyses/deobfuscator/string_obf_opt_passes.py +1 -1
- angr/analyses/disassembly.py +4 -4
- angr/analyses/forward_analysis/__init__.py +1 -1
- angr/analyses/forward_analysis/visitors/graph.py +6 -6
- angr/analyses/init_finder.py +47 -22
- angr/analyses/loop_analysis.py +1 -1
- angr/analyses/loopfinder.py +1 -1
- angr/analyses/propagator/engine_base.py +21 -14
- angr/analyses/propagator/engine_vex.py +149 -179
- angr/analyses/propagator/outdated_definition_walker.py +12 -6
- angr/analyses/propagator/propagator.py +10 -28
- angr/analyses/propagator/top_checker_mixin.py +211 -5
- angr/analyses/propagator/vex_vars.py +4 -4
- angr/analyses/reaching_definitions/__init__.py +9 -9
- angr/analyses/reaching_definitions/call_trace.py +2 -2
- angr/analyses/reaching_definitions/dep_graph.py +1 -1
- angr/analyses/reaching_definitions/engine_ail.py +304 -329
- angr/analyses/reaching_definitions/engine_vex.py +243 -229
- angr/analyses/reaching_definitions/function_handler.py +3 -3
- angr/analyses/reaching_definitions/function_handler_library/__init__.py +1 -1
- angr/analyses/reaching_definitions/rd_state.py +47 -42
- angr/analyses/reassembler.py +26 -31
- angr/analyses/s_liveness.py +8 -0
- angr/analyses/s_propagator.py +18 -3
- angr/analyses/s_reaching_definitions/s_rda_view.py +2 -5
- angr/analyses/s_reaching_definitions/s_reaching_definitions.py +9 -5
- angr/analyses/stack_pointer_tracker.py +4 -4
- angr/analyses/typehoon/simple_solver.py +14 -14
- angr/analyses/typehoon/translator.py +10 -2
- angr/analyses/typehoon/typeconsts.py +11 -3
- angr/analyses/typehoon/typevars.py +26 -26
- angr/analyses/unpacker/__init__.py +1 -1
- angr/analyses/variable_recovery/engine_ail.py +299 -259
- angr/analyses/variable_recovery/engine_base.py +138 -121
- angr/analyses/variable_recovery/engine_vex.py +175 -185
- angr/analyses/variable_recovery/irsb_scanner.py +49 -38
- angr/analyses/variable_recovery/variable_recovery.py +28 -5
- angr/analyses/variable_recovery/variable_recovery_base.py +33 -34
- angr/analyses/variable_recovery/variable_recovery_fast.py +4 -8
- angr/analyses/veritesting.py +2 -2
- angr/analyses/vfg.py +5 -5
- angr/analyses/xrefs.py +46 -19
- angr/angrdb/serializers/__init__.py +1 -1
- angr/annocfg.py +20 -15
- angr/blade.py +2 -2
- angr/block.py +20 -25
- angr/calling_conventions.py +12 -14
- angr/code_location.py +6 -10
- angr/codenode.py +3 -3
- angr/engines/__init__.py +12 -14
- angr/engines/engine.py +24 -61
- angr/engines/light/__init__.py +13 -5
- angr/engines/light/data.py +1 -1
- angr/engines/light/engine.py +1003 -1185
- angr/engines/pcode/__init__.py +1 -1
- angr/engines/pcode/behavior.py +1 -1
- angr/engines/pcode/cc.py +2 -0
- angr/engines/pcode/lifter.py +13 -15
- angr/engines/soot/expressions/__init__.py +12 -12
- angr/engines/soot/statements/__init__.py +6 -6
- angr/engines/soot/values/__init__.py +6 -6
- angr/engines/soot/values/arrayref.py +2 -2
- angr/engines/soot/values/constants.py +1 -1
- angr/engines/soot/values/instancefieldref.py +1 -1
- angr/engines/soot/values/paramref.py +1 -1
- angr/engines/soot/values/staticfieldref.py +1 -1
- angr/engines/successors.py +15 -14
- angr/engines/vex/__init__.py +5 -5
- angr/engines/vex/claripy/ccall.py +2 -2
- angr/engines/vex/claripy/datalayer.py +1 -1
- angr/engines/vex/claripy/irop.py +19 -19
- angr/engines/vex/heavy/__init__.py +2 -2
- angr/engines/vex/heavy/actions.py +1 -3
- angr/engines/vex/heavy/heavy.py +4 -6
- angr/engines/vex/lifter.py +2 -4
- angr/engines/vex/light/light.py +0 -2
- angr/engines/vex/light/slicing.py +5 -5
- angr/exploration_techniques/__init__.py +19 -142
- angr/exploration_techniques/base.py +126 -0
- angr/exploration_techniques/bucketizer.py +1 -1
- angr/exploration_techniques/dfs.py +3 -1
- angr/exploration_techniques/director.py +2 -3
- angr/exploration_techniques/driller_core.py +1 -1
- angr/exploration_techniques/explorer.py +4 -2
- angr/exploration_techniques/lengthlimiter.py +2 -1
- angr/exploration_techniques/local_loop_seer.py +2 -1
- angr/exploration_techniques/loop_seer.py +5 -5
- angr/exploration_techniques/manual_mergepoint.py +2 -1
- angr/exploration_techniques/memory_watcher.py +3 -1
- angr/exploration_techniques/oppologist.py +4 -5
- angr/exploration_techniques/slicecutor.py +4 -2
- angr/exploration_techniques/spiller.py +1 -1
- angr/exploration_techniques/stochastic.py +2 -1
- angr/exploration_techniques/stub_stasher.py +2 -1
- angr/exploration_techniques/suggestions.py +3 -1
- angr/exploration_techniques/symbion.py +3 -1
- angr/exploration_techniques/tech_builder.py +2 -1
- angr/exploration_techniques/threading.py +2 -11
- angr/exploration_techniques/timeout.py +4 -2
- angr/exploration_techniques/tracer.py +4 -3
- angr/exploration_techniques/unique.py +3 -2
- angr/exploration_techniques/veritesting.py +1 -1
- angr/factory.py +36 -6
- angr/keyed_region.py +4 -4
- angr/knowledge_base.py +1 -1
- angr/knowledge_plugins/__init__.py +11 -11
- angr/knowledge_plugins/cfg/__init__.py +5 -5
- angr/knowledge_plugins/cfg/cfg_manager.py +2 -2
- angr/knowledge_plugins/cfg/cfg_model.py +8 -8
- angr/knowledge_plugins/cfg/cfg_node.py +19 -19
- angr/knowledge_plugins/cfg/indirect_jump.py +6 -6
- angr/knowledge_plugins/cfg/memory_data.py +5 -7
- angr/knowledge_plugins/functions/function.py +48 -52
- angr/knowledge_plugins/functions/function_parser.py +4 -4
- angr/knowledge_plugins/key_definitions/__init__.py +3 -3
- angr/knowledge_plugins/key_definitions/atoms.py +8 -8
- angr/knowledge_plugins/key_definitions/definition.py +1 -1
- angr/knowledge_plugins/key_definitions/live_definitions.py +30 -27
- angr/knowledge_plugins/labels.py +1 -1
- angr/knowledge_plugins/propagations/__init__.py +1 -1
- angr/knowledge_plugins/propagations/prop_value.py +2 -2
- angr/knowledge_plugins/propagations/propagation_model.py +7 -8
- angr/knowledge_plugins/propagations/states.py +44 -39
- angr/knowledge_plugins/variables/variable_access.py +2 -2
- angr/knowledge_plugins/variables/variable_manager.py +24 -10
- angr/knowledge_plugins/xrefs/xref.py +5 -8
- angr/misc/__init__.py +4 -4
- angr/misc/hookset.py +4 -5
- angr/misc/loggers.py +2 -2
- angr/misc/telemetry.py +1 -1
- angr/procedures/__init__.py +1 -1
- angr/procedures/cgc/fdwait.py +2 -2
- angr/procedures/definitions/__init__.py +2 -2
- angr/procedures/definitions/linux_kernel.py +0 -1
- angr/procedures/definitions/parse_syscalls_from_local_system.py +1 -1
- angr/procedures/definitions/parse_win32json.py +0 -1
- angr/procedures/ntdll/exceptions.py +1 -1
- angr/procedures/stubs/format_parser.py +3 -3
- angr/procedures/win32/dynamic_loading.py +1 -1
- angr/protos/__init__.py +3 -3
- angr/sim_manager.py +3 -5
- angr/sim_state.py +40 -42
- angr/sim_state_options.py +3 -3
- angr/sim_type.py +15 -14
- angr/sim_variable.py +42 -45
- angr/simos/__init__.py +4 -4
- angr/simos/cgc.py +1 -1
- angr/simos/simos.py +1 -1
- angr/simos/userland.py +1 -1
- angr/slicer.py +4 -7
- angr/state_plugins/__init__.py +34 -34
- angr/state_plugins/callstack.py +5 -12
- angr/state_plugins/heap/__init__.py +2 -2
- angr/state_plugins/heap/heap_brk.py +2 -4
- angr/state_plugins/heap/heap_ptmalloc.py +1 -1
- angr/state_plugins/jni_references.py +3 -2
- angr/state_plugins/scratch.py +1 -1
- angr/state_plugins/sim_action.py +1 -4
- angr/state_plugins/sim_event.py +1 -1
- angr/state_plugins/solver.py +7 -9
- angr/state_plugins/uc_manager.py +1 -1
- angr/state_plugins/view.py +2 -2
- angr/storage/__init__.py +1 -1
- angr/storage/file.py +10 -10
- angr/storage/memory_mixins/__init__.py +46 -46
- angr/storage/memory_mixins/default_filler_mixin.py +1 -3
- angr/storage/memory_mixins/javavm_memory_mixin.py +2 -2
- angr/storage/memory_mixins/name_resolution_mixin.py +2 -2
- angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +1 -3
- angr/storage/memory_mixins/paged_memory/pages/__init__.py +6 -6
- angr/storage/memory_mixins/paged_memory/pages/list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/multi_values.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +2 -4
- angr/storage/memory_mixins/regioned_memory/__init__.py +3 -3
- angr/storage/memory_mixins/regioned_memory/region_data.py +5 -5
- angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +7 -9
- angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +4 -4
- angr/storage/memory_object.py +4 -4
- angr/utils/__init__.py +3 -3
- angr/utils/bits.py +12 -0
- angr/utils/dynamic_dictlist.py +1 -1
- angr/utils/graph.py +1 -1
- angr/utils/orderedset.py +4 -1
- angr/utils/segment_list.py +2 -2
- angr/utils/ssa/__init__.py +33 -8
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/METADATA +6 -6
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/RECORD +262 -263
- angr/analyses/propagator/engine_ail.py +0 -1562
- angr/storage/memory_mixins/__init__.pyi +0 -48
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/LICENSE +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/WHEEL +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/entry_points.txt +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/top_level.txt +0 -0
angr/engines/pcode/__init__.py
CHANGED
angr/engines/pcode/behavior.py
CHANGED
angr/engines/pcode/cc.py
CHANGED
|
@@ -5,6 +5,7 @@ from archinfo import ArchPcode
|
|
|
5
5
|
|
|
6
6
|
from angr.calling_conventions import (
|
|
7
7
|
SimCC,
|
|
8
|
+
SimCCARM,
|
|
8
9
|
SimRegArg,
|
|
9
10
|
SimStackArg,
|
|
10
11
|
DEFAULT_CC,
|
|
@@ -98,6 +99,7 @@ def register_pcode_arch_default_cc(arch: ArchPcode):
|
|
|
98
99
|
# we have a bunch of manually specified mappings
|
|
99
100
|
manual_cc_mapping = {
|
|
100
101
|
"68000:BE:32:default": SimCCM68k,
|
|
102
|
+
"ARM:LE:32:Cortex": SimCCARM,
|
|
101
103
|
"RISCV:LE:32:RV32G": SimCCRISCV,
|
|
102
104
|
"RISCV:LE:32:RV32GC": SimCCRISCV,
|
|
103
105
|
"RISCV:LE:64:RV64G": SimCCRISCV,
|
angr/engines/pcode/lifter.py
CHANGED
|
@@ -112,17 +112,17 @@ class IRSB:
|
|
|
112
112
|
|
|
113
113
|
__slots__ = (
|
|
114
114
|
"_direct_next",
|
|
115
|
+
"_disassembly",
|
|
115
116
|
"_exit_statements",
|
|
116
117
|
"_instruction_addresses",
|
|
117
118
|
"_ops",
|
|
118
119
|
"_size",
|
|
119
120
|
"_statements",
|
|
120
|
-
"_disassembly",
|
|
121
121
|
"addr",
|
|
122
122
|
"arch",
|
|
123
123
|
"behaviors",
|
|
124
|
-
"data_refs",
|
|
125
124
|
"const_vals",
|
|
125
|
+
"data_refs",
|
|
126
126
|
"default_exit_target",
|
|
127
127
|
"jumpkind",
|
|
128
128
|
"next",
|
|
@@ -521,19 +521,19 @@ class Lifter:
|
|
|
521
521
|
REQUIRE_DATA_PY = False
|
|
522
522
|
|
|
523
523
|
__slots__ = (
|
|
524
|
-
"
|
|
525
|
-
"bytes_offset",
|
|
526
|
-
"opt_level",
|
|
527
|
-
"traceflags",
|
|
524
|
+
"addr",
|
|
528
525
|
"allow_arch_optimizations",
|
|
529
|
-
"
|
|
526
|
+
"arch",
|
|
527
|
+
"bytes_offset",
|
|
530
528
|
"collect_data_refs",
|
|
531
|
-
"
|
|
529
|
+
"data",
|
|
530
|
+
"irsb",
|
|
532
531
|
"max_bytes",
|
|
532
|
+
"max_inst",
|
|
533
|
+
"opt_level",
|
|
533
534
|
"skip_stmts",
|
|
534
|
-
"
|
|
535
|
-
"
|
|
536
|
-
"addr",
|
|
535
|
+
"strict_block_end",
|
|
536
|
+
"traceflags",
|
|
537
537
|
)
|
|
538
538
|
|
|
539
539
|
data: str | bytes | None
|
|
@@ -1377,10 +1377,8 @@ class PcodeLifterEngineMixin(SimEngineBase):
|
|
|
1377
1377
|
|
|
1378
1378
|
def __is_stop_point(self, addr: int, extra_stop_points: Sequence[int] | None = None) -> bool:
|
|
1379
1379
|
return bool(
|
|
1380
|
-
self.project is not None
|
|
1381
|
-
and addr in
|
|
1382
|
-
or extra_stop_points is not None
|
|
1383
|
-
and addr in extra_stop_points
|
|
1380
|
+
(self.project is not None and addr in self.project._sim_procedures)
|
|
1381
|
+
or (extra_stop_points is not None and addr in extra_stop_points)
|
|
1384
1382
|
)
|
|
1385
1383
|
|
|
1386
1384
|
def __getstate__(self):
|
|
@@ -59,32 +59,32 @@ from .instanceOf import SimSootExpr_InstanceOf
|
|
|
59
59
|
|
|
60
60
|
|
|
61
61
|
__all__ = (
|
|
62
|
-
"translate_expr",
|
|
63
62
|
"SimSootExpr_ArrayRef",
|
|
64
63
|
"SimSootExpr_Binop",
|
|
65
64
|
"SimSootExpr_Cast",
|
|
65
|
+
"SimSootExpr_ClassConstant",
|
|
66
66
|
"SimSootExpr_Condition",
|
|
67
|
-
"SimSootExpr_IntConstant",
|
|
68
|
-
"SimSootExpr_LongConstant",
|
|
69
|
-
"SimSootExpr_FloatConstant",
|
|
70
67
|
"SimSootExpr_DoubleConstant",
|
|
71
|
-
"
|
|
72
|
-
"SimSootExpr_ClassConstant",
|
|
73
|
-
"SimSootExpr_NullConstant",
|
|
68
|
+
"SimSootExpr_FloatConstant",
|
|
74
69
|
"SimSootExpr_InstanceFieldRef",
|
|
75
|
-
"
|
|
76
|
-
"
|
|
77
|
-
"SimSootExpr_VirtualInvoke",
|
|
70
|
+
"SimSootExpr_InstanceOf",
|
|
71
|
+
"SimSootExpr_IntConstant",
|
|
78
72
|
"SimSootExpr_InterfaceInvoke",
|
|
79
73
|
"SimSootExpr_Length",
|
|
80
74
|
"SimSootExpr_Local",
|
|
75
|
+
"SimSootExpr_LongConstant",
|
|
81
76
|
"SimSootExpr_New",
|
|
82
77
|
"SimSootExpr_NewArray",
|
|
83
78
|
"SimSootExpr_NewMultiArray",
|
|
79
|
+
"SimSootExpr_NullConstant",
|
|
80
|
+
"SimSootExpr_ParamRef",
|
|
84
81
|
"SimSootExpr_Phi",
|
|
82
|
+
"SimSootExpr_SpecialInvoke",
|
|
85
83
|
"SimSootExpr_StaticFieldRef",
|
|
84
|
+
"SimSootExpr_StaticInvoke",
|
|
85
|
+
"SimSootExpr_StringConstant",
|
|
86
86
|
"SimSootExpr_ThisRef",
|
|
87
|
-
"SimSootExpr_ParamRef",
|
|
88
87
|
"SimSootExpr_Unsupported",
|
|
89
|
-
"
|
|
88
|
+
"SimSootExpr_VirtualInvoke",
|
|
89
|
+
"translate_expr",
|
|
90
90
|
)
|
|
@@ -32,15 +32,15 @@ from .throw import SimSootStmt_Throw
|
|
|
32
32
|
|
|
33
33
|
|
|
34
34
|
__all__ = (
|
|
35
|
-
"translate_stmt",
|
|
36
35
|
"SimSootStmt_Assign",
|
|
37
|
-
"SimSootStmt_Return",
|
|
38
|
-
"SimSootStmt_ReturnVoid",
|
|
39
|
-
"SimSootStmt_Identity",
|
|
40
36
|
"SimSootStmt_Goto",
|
|
41
|
-
"
|
|
37
|
+
"SimSootStmt_Identity",
|
|
42
38
|
"SimSootStmt_If",
|
|
43
|
-
"
|
|
39
|
+
"SimSootStmt_Invoke",
|
|
44
40
|
"SimSootStmt_LookupSwitch",
|
|
41
|
+
"SimSootStmt_Return",
|
|
42
|
+
"SimSootStmt_ReturnVoid",
|
|
43
|
+
"SimSootStmt_TableSwitch",
|
|
45
44
|
"SimSootStmt_Throw",
|
|
45
|
+
"translate_stmt",
|
|
46
46
|
)
|
|
@@ -27,14 +27,14 @@ from .strref import SimSootValue_StringRef
|
|
|
27
27
|
|
|
28
28
|
|
|
29
29
|
__all__ = (
|
|
30
|
-
"translate_value",
|
|
31
|
-
"SimSootValue_Local",
|
|
32
|
-
"SimSootValue_ParamRef",
|
|
33
|
-
"SimSootValue_ArrayRef",
|
|
34
30
|
"SimSootValue_ArrayBaseRef",
|
|
35
|
-
"
|
|
36
|
-
"SimSootValue_StaticFieldRef",
|
|
31
|
+
"SimSootValue_ArrayRef",
|
|
37
32
|
"SimSootValue_InstanceFieldRef",
|
|
38
33
|
"SimSootValue_IntConstant",
|
|
34
|
+
"SimSootValue_Local",
|
|
35
|
+
"SimSootValue_ParamRef",
|
|
36
|
+
"SimSootValue_StaticFieldRef",
|
|
39
37
|
"SimSootValue_StringRef",
|
|
38
|
+
"SimSootValue_ThisRef",
|
|
39
|
+
"translate_value",
|
|
40
40
|
)
|
|
@@ -12,7 +12,7 @@ l = logging.getLogger("angr.engines.soot.values.arrayref")
|
|
|
12
12
|
|
|
13
13
|
|
|
14
14
|
class SimSootValue_ArrayBaseRef(SimSootValue):
|
|
15
|
-
__slots__ = ["
|
|
15
|
+
__slots__ = ["_default_value_generator", "element_type", "id", "size", "type"]
|
|
16
16
|
|
|
17
17
|
def __init__(self, heap_alloc_id, element_type, size, default_value_generator=None):
|
|
18
18
|
self.id = f"{heap_alloc_id}.array_{element_type}"
|
|
@@ -48,7 +48,7 @@ class SimSootValue_ArrayBaseRef(SimSootValue):
|
|
|
48
48
|
|
|
49
49
|
|
|
50
50
|
class SimSootValue_ArrayRef(SimSootValue):
|
|
51
|
-
__slots__ = ["
|
|
51
|
+
__slots__ = ["base", "id", "index"]
|
|
52
52
|
|
|
53
53
|
def __init__(self, base, index):
|
|
54
54
|
self.id = f"{base.id}[{index}]"
|
|
@@ -5,7 +5,7 @@ from angr.engines.soot.field_dispatcher import resolve_field
|
|
|
5
5
|
|
|
6
6
|
|
|
7
7
|
class SimSootValue_InstanceFieldRef(SimSootValue):
|
|
8
|
-
__slots__ = ["
|
|
8
|
+
__slots__ = ["class_name", "field_name", "id", "type"]
|
|
9
9
|
|
|
10
10
|
def __init__(self, heap_alloc_id, class_name, field_name, type_):
|
|
11
11
|
self.id = f"{heap_alloc_id}.{class_name}.{field_name}"
|
|
@@ -4,7 +4,7 @@ from angr.engines.soot.field_dispatcher import resolve_field
|
|
|
4
4
|
|
|
5
5
|
|
|
6
6
|
class SimSootValue_StaticFieldRef(SimSootValue):
|
|
7
|
-
__slots__ = ["
|
|
7
|
+
__slots__ = ["class_name", "field_name", "id", "type"]
|
|
8
8
|
|
|
9
9
|
def __init__(self, class_name, field_name, type_):
|
|
10
10
|
self.id = f"{class_name}.{field_name}"
|
angr/engines/successors.py
CHANGED
|
@@ -4,10 +4,12 @@ import logging
|
|
|
4
4
|
|
|
5
5
|
import claripy
|
|
6
6
|
|
|
7
|
-
from archinfo.arch_soot import ArchSoot
|
|
7
|
+
from archinfo.arch_soot import ArchSoot, SootAddressDescriptor
|
|
8
|
+
|
|
8
9
|
|
|
9
10
|
if TYPE_CHECKING:
|
|
10
11
|
from angr import SimState
|
|
12
|
+
from angr.engines.engine import HeavyState
|
|
11
13
|
|
|
12
14
|
|
|
13
15
|
l = logging.getLogger(name=__name__)
|
|
@@ -40,15 +42,15 @@ class SimSuccessors:
|
|
|
40
42
|
https://docs.angr.io/core-concepts/simulation#simsuccessors
|
|
41
43
|
"""
|
|
42
44
|
|
|
43
|
-
def __init__(self, addr: int | None, initial_state):
|
|
45
|
+
def __init__(self, addr: int | SootAddressDescriptor | None, initial_state: HeavyState | None):
|
|
44
46
|
self.addr = addr
|
|
45
|
-
self.initial_state
|
|
47
|
+
self.initial_state = initial_state
|
|
46
48
|
|
|
47
|
-
self.successors: list[
|
|
48
|
-
self.all_successors: list[
|
|
49
|
-
self.flat_successors: list[
|
|
50
|
-
self.unsat_successors: list[
|
|
51
|
-
self.unconstrained_successors: list[
|
|
49
|
+
self.successors: list[HeavyState] = []
|
|
50
|
+
self.all_successors: list[HeavyState] = []
|
|
51
|
+
self.flat_successors: list[HeavyState] = []
|
|
52
|
+
self.unsat_successors: list[HeavyState] = []
|
|
53
|
+
self.unconstrained_successors: list[HeavyState] = []
|
|
52
54
|
|
|
53
55
|
# the engine that should process or did process this request
|
|
54
56
|
self.engine = None
|
|
@@ -150,6 +152,8 @@ class SimSuccessors:
|
|
|
150
152
|
:param state: the successor state
|
|
151
153
|
"""
|
|
152
154
|
|
|
155
|
+
assert self.initial_state is not None
|
|
156
|
+
|
|
153
157
|
# Next, simplify what needs to be simplified
|
|
154
158
|
if o.SIMPLIFY_EXIT_STATE in state.options:
|
|
155
159
|
state.solver.simplify()
|
|
@@ -182,7 +186,7 @@ class SimSuccessors:
|
|
|
182
186
|
state.options.discard(o.AUTO_REFS)
|
|
183
187
|
|
|
184
188
|
@staticmethod
|
|
185
|
-
def _manage_callstack(state):
|
|
189
|
+
def _manage_callstack(state: SimState[claripy.ast.BV | SootAddressDescriptor, int | SootAddressDescriptor]):
|
|
186
190
|
# condition for call = Ijk_Call
|
|
187
191
|
# condition for ret = stack pointer drops below call point
|
|
188
192
|
if state.history.jumpkind == "Ijk_Call":
|
|
@@ -264,11 +268,8 @@ class SimSuccessors:
|
|
|
264
268
|
if o.VALIDATE_APPROXIMATIONS in state.options and state.solver.satisfiable():
|
|
265
269
|
raise Exception("WTF")
|
|
266
270
|
self.unsat_successors.append(state)
|
|
267
|
-
elif (
|
|
268
|
-
not state.
|
|
269
|
-
and state.solver.is_false(state.scratch.guard)
|
|
270
|
-
or o.LAZY_SOLVES not in state.options
|
|
271
|
-
and not state.satisfiable()
|
|
271
|
+
elif (not state.scratch.guard.symbolic and state.solver.is_false(state.scratch.guard)) or (
|
|
272
|
+
o.LAZY_SOLVES not in state.options and not state.satisfiable()
|
|
272
273
|
):
|
|
273
274
|
self.unsat_successors.append(state)
|
|
274
275
|
elif o.NO_SYMBOLIC_JUMP_RESOLUTION in state.options and state.solver.symbolic(target):
|
angr/engines/vex/__init__.py
CHANGED
|
@@ -8,13 +8,13 @@ from .lifter import VEXLifter
|
|
|
8
8
|
|
|
9
9
|
__all__ = (
|
|
10
10
|
"ClaripyDataMixin",
|
|
11
|
-
"
|
|
12
|
-
"VEXResilienceMixin",
|
|
13
|
-
"VEXSlicingMixin",
|
|
14
|
-
"TrackActionsMixin",
|
|
11
|
+
"HeavyResilienceMixin",
|
|
15
12
|
"HeavyVEXMixin",
|
|
16
13
|
"SimInspectMixin",
|
|
17
|
-
"HeavyResilienceMixin",
|
|
18
14
|
"SuperFastpathMixin",
|
|
15
|
+
"TrackActionsMixin",
|
|
19
16
|
"VEXLifter",
|
|
17
|
+
"VEXMixin",
|
|
18
|
+
"VEXResilienceMixin",
|
|
19
|
+
"VEXSlicingMixin",
|
|
20
20
|
)
|
|
@@ -1701,7 +1701,7 @@ def armg_calculate_condition(state, cond_n_op, cc_dep1, cc_dep2, cc_dep3):
|
|
|
1701
1701
|
return flag
|
|
1702
1702
|
|
|
1703
1703
|
l.error("Unrecognized condition %d in armg_calculate_condition", concrete_cond)
|
|
1704
|
-
raise SimCCallError("Unrecognized condition
|
|
1704
|
+
raise SimCCallError(f"Unrecognized condition {concrete_cond} in armg_calculate_condition")
|
|
1705
1705
|
|
|
1706
1706
|
|
|
1707
1707
|
ARM64G_CC_SHIFT_N = 31
|
|
@@ -1991,7 +1991,7 @@ def arm64g_calculate_condition(state, cond_n_op, cc_dep1, cc_dep2, cc_dep3):
|
|
|
1991
1991
|
return flag
|
|
1992
1992
|
|
|
1993
1993
|
l.error("Unrecognized condition %d in arm64g_calculate_condition", concrete_cond)
|
|
1994
|
-
raise SimCCallError("Unrecognized condition
|
|
1994
|
+
raise SimCCallError(f"Unrecognized condition {concrete_cond} in arm64g_calculate_condition")
|
|
1995
1995
|
|
|
1996
1996
|
|
|
1997
1997
|
#
|
|
@@ -15,7 +15,7 @@ l = logging.getLogger(__name__)
|
|
|
15
15
|
zero = claripy.BVV(0, 32)
|
|
16
16
|
|
|
17
17
|
|
|
18
|
-
def value(ty, val, size: int | None = None):
|
|
18
|
+
def value(ty: str, val: int | float, size: int | None = None):
|
|
19
19
|
if ty == "Ity_F32":
|
|
20
20
|
return claripy.FPV(float(val), claripy.FSORT_FLOAT)
|
|
21
21
|
if ty == "Ity_F64":
|
angr/engines/vex/claripy/irop.py
CHANGED
|
@@ -84,7 +84,7 @@ def op_attrs(p):
|
|
|
84
84
|
|
|
85
85
|
|
|
86
86
|
all_operations = list(pyvex.irop_enums_to_ints.keys())
|
|
87
|
-
operations = {}
|
|
87
|
+
operations: dict[str, SimIROp] = {}
|
|
88
88
|
classified = set()
|
|
89
89
|
unclassified = set()
|
|
90
90
|
unsupported = set()
|
|
@@ -134,7 +134,7 @@ for _vec_lanewidth in (8, 16, 32, 64):
|
|
|
134
134
|
continue
|
|
135
135
|
|
|
136
136
|
# the regex thinks the I is an integral descriptor
|
|
137
|
-
explicit_attrs["Iop_InterleaveHI
|
|
137
|
+
explicit_attrs[f"Iop_InterleaveHI{_vec_lanewidth}x{_vec_count}"] = {
|
|
138
138
|
"generic_name": "InterleaveHI",
|
|
139
139
|
"to_size": _vec_width,
|
|
140
140
|
"vector_size": _vec_lanewidth,
|
|
@@ -220,29 +220,29 @@ class SimIROp:
|
|
|
220
220
|
"""
|
|
221
221
|
|
|
222
222
|
__slots__ = (
|
|
223
|
-
"
|
|
224
|
-
"
|
|
225
|
-
"
|
|
226
|
-
"_from_size",
|
|
223
|
+
"_calculate",
|
|
224
|
+
"_conversion",
|
|
225
|
+
"_float",
|
|
227
226
|
"_from_side",
|
|
228
|
-
"_from_type",
|
|
229
227
|
"_from_signed",
|
|
230
|
-
"
|
|
231
|
-
"
|
|
232
|
-
"
|
|
228
|
+
"_from_size",
|
|
229
|
+
"_from_type",
|
|
230
|
+
"_generic_name",
|
|
231
|
+
"_output_size_bits",
|
|
232
|
+
"_output_type",
|
|
233
|
+
"_rounding_mode",
|
|
233
234
|
"_set_side",
|
|
234
235
|
"_set_size",
|
|
235
|
-
"
|
|
236
|
-
"
|
|
236
|
+
"_to_signed",
|
|
237
|
+
"_to_size",
|
|
238
|
+
"_to_type",
|
|
239
|
+
"_vector_count",
|
|
237
240
|
"_vector_signed",
|
|
241
|
+
"_vector_size",
|
|
238
242
|
"_vector_type",
|
|
239
243
|
"_vector_zero",
|
|
240
|
-
"
|
|
241
|
-
"
|
|
242
|
-
"_output_type",
|
|
243
|
-
"_output_size_bits",
|
|
244
|
-
"_float",
|
|
245
|
-
"_calculate",
|
|
244
|
+
"name",
|
|
245
|
+
"op_attrs",
|
|
246
246
|
)
|
|
247
247
|
|
|
248
248
|
def __init__(self, name, **attrs):
|
|
@@ -567,7 +567,7 @@ class SimIROp:
|
|
|
567
567
|
"""
|
|
568
568
|
arg_num = len(args)
|
|
569
569
|
if arg_num != 1:
|
|
570
|
-
raise SimOperationError("expect exactly one vector to be duplicated, got
|
|
570
|
+
raise SimOperationError(f"expect exactly one vector to be duplicated, got {arg_num}")
|
|
571
571
|
# Duplicate the vector for this many times
|
|
572
572
|
vector_count = self._vector_count
|
|
573
573
|
# Keep a copy of the vector to be duplicated
|
|
@@ -14,8 +14,6 @@ class TrackActionsMixin(HeavyVEXMixin):
|
|
|
14
14
|
|
|
15
15
|
self.__tmp_deps = {}
|
|
16
16
|
|
|
17
|
-
__tls = ("__tmp_deps",)
|
|
18
|
-
|
|
19
17
|
def _optimize_guarded_addr(self, addr, guard):
|
|
20
18
|
addr, addr_deps = addr
|
|
21
19
|
guard, _ = guard
|
|
@@ -150,7 +148,7 @@ class TrackActionsMixin(HeavyVEXMixin):
|
|
|
150
148
|
|
|
151
149
|
# statements
|
|
152
150
|
|
|
153
|
-
def _perform_vex_stmt_WrTmp(self, tmp, data_bundle, **kwargs):
|
|
151
|
+
def _perform_vex_stmt_WrTmp(self, tmp, data_bundle, **kwargs): # pylint:disable=unused-argument
|
|
154
152
|
data, data_deps = data_bundle
|
|
155
153
|
|
|
156
154
|
if o.TRACK_TMP_ACTIONS not in self.state.options:
|
angr/engines/vex/heavy/heavy.py
CHANGED
|
@@ -285,17 +285,15 @@ class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEX
|
|
|
285
285
|
if o.COPY_STATES not in self.state.options:
|
|
286
286
|
# very special logic to try to minimize copies
|
|
287
287
|
# first, check if this branch is impossible
|
|
288
|
-
if (
|
|
289
|
-
|
|
290
|
-
or o.LAZY_SOLVES not in self.state.options
|
|
288
|
+
if guard.is_false() or (
|
|
289
|
+
o.LAZY_SOLVES not in self.state.options
|
|
291
290
|
and not self.state.solver.satisfiable(extra_constraints=(guard,))
|
|
292
291
|
):
|
|
293
292
|
cont_state = self.state
|
|
294
293
|
|
|
295
294
|
# then, check if it's impossible to continue from this branch
|
|
296
|
-
elif (
|
|
297
|
-
|
|
298
|
-
or o.LAZY_SOLVES not in self.state.options
|
|
295
|
+
elif guard.is_true() or (
|
|
296
|
+
o.LAZY_SOLVES not in self.state.options
|
|
299
297
|
and not self.state.solver.satisfiable(extra_constraints=(claripy.Not(guard),))
|
|
300
298
|
):
|
|
301
299
|
exit_state = self.state
|
angr/engines/vex/lifter.py
CHANGED
|
@@ -384,10 +384,8 @@ class VEXLifter(SimEngineBase):
|
|
|
384
384
|
|
|
385
385
|
def __is_stop_point(self, addr, extra_stop_points=None):
|
|
386
386
|
return bool(
|
|
387
|
-
self.project is not None
|
|
388
|
-
and addr in
|
|
389
|
-
or extra_stop_points is not None
|
|
390
|
-
and addr in extra_stop_points
|
|
387
|
+
(self.project is not None and addr in self.project._sim_procedures)
|
|
388
|
+
or (extra_stop_points is not None and addr in extra_stop_points)
|
|
391
389
|
)
|
|
392
390
|
|
|
393
391
|
def __getstate__(self):
|
angr/engines/vex/light/light.py
CHANGED
|
@@ -22,8 +22,6 @@ class VEXMixin(SimEngineBase):
|
|
|
22
22
|
self.stmt_idx = None
|
|
23
23
|
self.tmps = None
|
|
24
24
|
|
|
25
|
-
__tls = ("irsb", "stmt_idx", "tmps")
|
|
26
|
-
|
|
27
25
|
def __init_handlers(self):
|
|
28
26
|
self._vex_expr_handlers = [None] * pyvex.expr.tag_count
|
|
29
27
|
self._vex_stmt_handlers = [None] * pyvex.stmt.tag_count
|
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
|
|
2
|
+
|
|
3
3
|
from angr.utils.constants import DEFAULT_STATEMENT
|
|
4
4
|
|
|
5
|
+
from .light import VEXMixin
|
|
6
|
+
|
|
5
7
|
|
|
6
8
|
class VEXSlicingMixin(VEXMixin):
|
|
7
9
|
def __init__(self, *args, **kwargs):
|
|
@@ -12,13 +14,11 @@ class VEXSlicingMixin(VEXMixin):
|
|
|
12
14
|
self._last_stmt = None
|
|
13
15
|
self._whitelist = None
|
|
14
16
|
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
def process(self, *args, skip_stmts=0, last_stmt=None, whitelist=None, **kwargs):
|
|
17
|
+
def process(self, state, block=None, skip_stmts=0, last_stmt=None, whitelist=None, **kwargs):
|
|
18
18
|
self._skip_stmts = skip_stmts
|
|
19
19
|
self._last_stmt = last_stmt
|
|
20
20
|
self._whitelist = whitelist
|
|
21
|
-
return super().process(
|
|
21
|
+
return super().process(state, block=block, **kwargs)
|
|
22
22
|
|
|
23
23
|
def handle_vex_block(self, irsb):
|
|
24
24
|
self.__no_exit_sliced = not self._check_vex_slice(DEFAULT_STATEMENT) and not any(
|