angr 9.2.131__py3-none-manylinux2014_aarch64.whl → 9.2.133__py3-none-manylinux2014_aarch64.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of angr might be problematic. Click here for more details.

Files changed (264) hide show
  1. angr/__init__.py +128 -128
  2. angr/analyses/__init__.py +38 -38
  3. angr/analyses/analysis.py +6 -2
  4. angr/analyses/backward_slice.py +3 -4
  5. angr/analyses/binary_optimizer.py +5 -12
  6. angr/analyses/bindiff.py +3 -6
  7. angr/analyses/calling_convention.py +3 -4
  8. angr/analyses/cfg/__init__.py +3 -3
  9. angr/analyses/cfg/cfg_base.py +1 -1
  10. angr/analyses/cfg/cfg_emulated.py +5 -5
  11. angr/analyses/cfg/cfg_fast.py +19 -17
  12. angr/analyses/cfg/indirect_jump_resolvers/__init__.py +5 -5
  13. angr/analyses/cfg/indirect_jump_resolvers/amd64_elf_got.py +1 -1
  14. angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +148 -101
  15. angr/analyses/cfg/indirect_jump_resolvers/x86_elf_pic_plt.py +1 -1
  16. angr/analyses/data_dep/__init__.py +4 -4
  17. angr/analyses/datagraph_meta.py +1 -1
  18. angr/analyses/ddg.py +16 -17
  19. angr/analyses/decompiler/__init__.py +12 -12
  20. angr/analyses/decompiler/ail_simplifier.py +24 -12
  21. angr/analyses/decompiler/block_similarity.py +2 -4
  22. angr/analyses/decompiler/block_simplifier.py +10 -21
  23. angr/analyses/decompiler/callsite_maker.py +1 -1
  24. angr/analyses/decompiler/ccall_rewriters/rewriter_base.py +1 -1
  25. angr/analyses/decompiler/clinic.py +122 -41
  26. angr/analyses/decompiler/condition_processor.py +57 -39
  27. angr/analyses/decompiler/counters/__init__.py +3 -3
  28. angr/analyses/decompiler/decompilation_cache.py +7 -7
  29. angr/analyses/decompiler/dephication/__init__.py +1 -1
  30. angr/analyses/decompiler/dephication/graph_rewriting.py +1 -1
  31. angr/analyses/decompiler/dephication/graph_vvar_mapping.py +11 -3
  32. angr/analyses/decompiler/dephication/rewriting_engine.py +169 -45
  33. angr/analyses/decompiler/dephication/seqnode_dephication.py +5 -4
  34. angr/analyses/decompiler/expression_narrower.py +1 -1
  35. angr/analyses/decompiler/graph_region.py +8 -8
  36. angr/analyses/decompiler/optimization_passes/__init__.py +20 -20
  37. angr/analyses/decompiler/optimization_passes/const_derefs.py +1 -0
  38. angr/analyses/decompiler/optimization_passes/deadblock_remover.py +1 -2
  39. angr/analyses/decompiler/optimization_passes/div_simplifier.py +41 -16
  40. angr/analyses/decompiler/optimization_passes/duplication_reverter/duplication_reverter.py +8 -7
  41. angr/analyses/decompiler/optimization_passes/duplication_reverter/utils.py +1 -3
  42. angr/analyses/decompiler/optimization_passes/engine_base.py +262 -84
  43. angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +175 -39
  44. angr/analyses/decompiler/optimization_passes/ite_region_converter.py +2 -5
  45. angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +5 -5
  46. angr/analyses/decompiler/optimization_passes/mod_simplifier.py +12 -3
  47. angr/analyses/decompiler/optimization_passes/optimization_pass.py +42 -19
  48. angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py +9 -5
  49. angr/analyses/decompiler/peephole_optimizations/__init__.py +1 -1
  50. angr/analyses/decompiler/peephole_optimizations/base.py +6 -6
  51. angr/analyses/decompiler/peephole_optimizations/remove_noop_conversions.py +2 -0
  52. angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py +1 -1
  53. angr/analyses/decompiler/presets/__init__.py +1 -1
  54. angr/analyses/decompiler/region_simplifiers/expr_folding.py +3 -3
  55. angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +8 -12
  56. angr/analyses/decompiler/ssailification/rewriting.py +1 -2
  57. angr/analyses/decompiler/ssailification/rewriting_engine.py +139 -56
  58. angr/analyses/decompiler/ssailification/ssailification.py +2 -1
  59. angr/analyses/decompiler/ssailification/traversal.py +4 -6
  60. angr/analyses/decompiler/ssailification/traversal_engine.py +125 -42
  61. angr/analyses/decompiler/structured_codegen/__init__.py +5 -5
  62. angr/analyses/decompiler/structured_codegen/base.py +3 -3
  63. angr/analyses/decompiler/structured_codegen/c.py +39 -40
  64. angr/analyses/decompiler/structuring/__init__.py +3 -3
  65. angr/analyses/decompiler/structuring/phoenix.py +45 -29
  66. angr/analyses/decompiler/structuring/structurer_base.py +2 -2
  67. angr/analyses/decompiler/structuring/structurer_nodes.py +23 -14
  68. angr/analyses/deobfuscator/__init__.py +3 -3
  69. angr/analyses/deobfuscator/irsb_reg_collector.py +29 -60
  70. angr/analyses/deobfuscator/string_obf_finder.py +2 -2
  71. angr/analyses/deobfuscator/string_obf_opt_passes.py +1 -1
  72. angr/analyses/disassembly.py +4 -4
  73. angr/analyses/forward_analysis/__init__.py +1 -1
  74. angr/analyses/forward_analysis/visitors/graph.py +6 -6
  75. angr/analyses/init_finder.py +47 -22
  76. angr/analyses/loop_analysis.py +1 -1
  77. angr/analyses/loopfinder.py +1 -1
  78. angr/analyses/propagator/engine_base.py +21 -14
  79. angr/analyses/propagator/engine_vex.py +149 -179
  80. angr/analyses/propagator/outdated_definition_walker.py +12 -6
  81. angr/analyses/propagator/propagator.py +10 -28
  82. angr/analyses/propagator/top_checker_mixin.py +211 -5
  83. angr/analyses/propagator/vex_vars.py +4 -4
  84. angr/analyses/reaching_definitions/__init__.py +9 -9
  85. angr/analyses/reaching_definitions/call_trace.py +2 -2
  86. angr/analyses/reaching_definitions/dep_graph.py +1 -1
  87. angr/analyses/reaching_definitions/engine_ail.py +304 -329
  88. angr/analyses/reaching_definitions/engine_vex.py +243 -229
  89. angr/analyses/reaching_definitions/function_handler.py +3 -3
  90. angr/analyses/reaching_definitions/function_handler_library/__init__.py +1 -1
  91. angr/analyses/reaching_definitions/rd_state.py +47 -42
  92. angr/analyses/reassembler.py +26 -31
  93. angr/analyses/s_liveness.py +8 -0
  94. angr/analyses/s_propagator.py +18 -3
  95. angr/analyses/s_reaching_definitions/s_rda_view.py +2 -5
  96. angr/analyses/s_reaching_definitions/s_reaching_definitions.py +9 -5
  97. angr/analyses/stack_pointer_tracker.py +4 -4
  98. angr/analyses/typehoon/simple_solver.py +14 -14
  99. angr/analyses/typehoon/translator.py +10 -2
  100. angr/analyses/typehoon/typeconsts.py +11 -3
  101. angr/analyses/typehoon/typevars.py +26 -26
  102. angr/analyses/unpacker/__init__.py +1 -1
  103. angr/analyses/variable_recovery/engine_ail.py +299 -259
  104. angr/analyses/variable_recovery/engine_base.py +138 -121
  105. angr/analyses/variable_recovery/engine_vex.py +175 -185
  106. angr/analyses/variable_recovery/irsb_scanner.py +49 -38
  107. angr/analyses/variable_recovery/variable_recovery.py +28 -5
  108. angr/analyses/variable_recovery/variable_recovery_base.py +33 -34
  109. angr/analyses/variable_recovery/variable_recovery_fast.py +4 -8
  110. angr/analyses/veritesting.py +2 -2
  111. angr/analyses/vfg.py +5 -5
  112. angr/analyses/xrefs.py +46 -19
  113. angr/angrdb/serializers/__init__.py +1 -1
  114. angr/annocfg.py +20 -15
  115. angr/blade.py +2 -2
  116. angr/block.py +20 -25
  117. angr/calling_conventions.py +12 -14
  118. angr/code_location.py +6 -10
  119. angr/codenode.py +3 -3
  120. angr/engines/__init__.py +12 -14
  121. angr/engines/engine.py +24 -61
  122. angr/engines/light/__init__.py +13 -5
  123. angr/engines/light/data.py +1 -1
  124. angr/engines/light/engine.py +1003 -1185
  125. angr/engines/pcode/__init__.py +1 -1
  126. angr/engines/pcode/behavior.py +1 -1
  127. angr/engines/pcode/cc.py +2 -0
  128. angr/engines/pcode/lifter.py +13 -15
  129. angr/engines/soot/expressions/__init__.py +12 -12
  130. angr/engines/soot/statements/__init__.py +6 -6
  131. angr/engines/soot/values/__init__.py +6 -6
  132. angr/engines/soot/values/arrayref.py +2 -2
  133. angr/engines/soot/values/constants.py +1 -1
  134. angr/engines/soot/values/instancefieldref.py +1 -1
  135. angr/engines/soot/values/paramref.py +1 -1
  136. angr/engines/soot/values/staticfieldref.py +1 -1
  137. angr/engines/successors.py +15 -14
  138. angr/engines/vex/__init__.py +5 -5
  139. angr/engines/vex/claripy/ccall.py +2 -2
  140. angr/engines/vex/claripy/datalayer.py +1 -1
  141. angr/engines/vex/claripy/irop.py +19 -19
  142. angr/engines/vex/heavy/__init__.py +2 -2
  143. angr/engines/vex/heavy/actions.py +1 -3
  144. angr/engines/vex/heavy/heavy.py +4 -6
  145. angr/engines/vex/lifter.py +2 -4
  146. angr/engines/vex/light/light.py +0 -2
  147. angr/engines/vex/light/slicing.py +5 -5
  148. angr/exploration_techniques/__init__.py +19 -142
  149. angr/exploration_techniques/base.py +126 -0
  150. angr/exploration_techniques/bucketizer.py +1 -1
  151. angr/exploration_techniques/dfs.py +3 -1
  152. angr/exploration_techniques/director.py +2 -3
  153. angr/exploration_techniques/driller_core.py +1 -1
  154. angr/exploration_techniques/explorer.py +4 -2
  155. angr/exploration_techniques/lengthlimiter.py +2 -1
  156. angr/exploration_techniques/local_loop_seer.py +2 -1
  157. angr/exploration_techniques/loop_seer.py +5 -5
  158. angr/exploration_techniques/manual_mergepoint.py +2 -1
  159. angr/exploration_techniques/memory_watcher.py +3 -1
  160. angr/exploration_techniques/oppologist.py +4 -5
  161. angr/exploration_techniques/slicecutor.py +4 -2
  162. angr/exploration_techniques/spiller.py +1 -1
  163. angr/exploration_techniques/stochastic.py +2 -1
  164. angr/exploration_techniques/stub_stasher.py +2 -1
  165. angr/exploration_techniques/suggestions.py +3 -1
  166. angr/exploration_techniques/symbion.py +3 -1
  167. angr/exploration_techniques/tech_builder.py +2 -1
  168. angr/exploration_techniques/threading.py +2 -11
  169. angr/exploration_techniques/timeout.py +4 -2
  170. angr/exploration_techniques/tracer.py +4 -3
  171. angr/exploration_techniques/unique.py +3 -2
  172. angr/exploration_techniques/veritesting.py +1 -1
  173. angr/factory.py +36 -6
  174. angr/keyed_region.py +4 -4
  175. angr/knowledge_base.py +1 -1
  176. angr/knowledge_plugins/__init__.py +11 -11
  177. angr/knowledge_plugins/cfg/__init__.py +5 -5
  178. angr/knowledge_plugins/cfg/cfg_manager.py +2 -2
  179. angr/knowledge_plugins/cfg/cfg_model.py +8 -8
  180. angr/knowledge_plugins/cfg/cfg_node.py +19 -19
  181. angr/knowledge_plugins/cfg/indirect_jump.py +6 -6
  182. angr/knowledge_plugins/cfg/memory_data.py +5 -7
  183. angr/knowledge_plugins/functions/function.py +48 -52
  184. angr/knowledge_plugins/functions/function_parser.py +4 -4
  185. angr/knowledge_plugins/key_definitions/__init__.py +3 -3
  186. angr/knowledge_plugins/key_definitions/atoms.py +8 -8
  187. angr/knowledge_plugins/key_definitions/definition.py +1 -1
  188. angr/knowledge_plugins/key_definitions/live_definitions.py +30 -27
  189. angr/knowledge_plugins/labels.py +1 -1
  190. angr/knowledge_plugins/propagations/__init__.py +1 -1
  191. angr/knowledge_plugins/propagations/prop_value.py +2 -2
  192. angr/knowledge_plugins/propagations/propagation_model.py +7 -8
  193. angr/knowledge_plugins/propagations/states.py +44 -39
  194. angr/knowledge_plugins/variables/variable_access.py +2 -2
  195. angr/knowledge_plugins/variables/variable_manager.py +24 -10
  196. angr/knowledge_plugins/xrefs/xref.py +5 -8
  197. angr/misc/__init__.py +4 -4
  198. angr/misc/hookset.py +4 -5
  199. angr/misc/loggers.py +2 -2
  200. angr/misc/telemetry.py +1 -1
  201. angr/procedures/__init__.py +1 -1
  202. angr/procedures/cgc/fdwait.py +2 -2
  203. angr/procedures/definitions/__init__.py +2 -2
  204. angr/procedures/definitions/linux_kernel.py +0 -1
  205. angr/procedures/definitions/parse_syscalls_from_local_system.py +1 -1
  206. angr/procedures/definitions/parse_win32json.py +0 -1
  207. angr/procedures/ntdll/exceptions.py +1 -1
  208. angr/procedures/stubs/format_parser.py +3 -3
  209. angr/procedures/win32/dynamic_loading.py +1 -1
  210. angr/protos/__init__.py +3 -3
  211. angr/sim_manager.py +3 -5
  212. angr/sim_state.py +40 -42
  213. angr/sim_state_options.py +3 -3
  214. angr/sim_type.py +15 -14
  215. angr/sim_variable.py +42 -45
  216. angr/simos/__init__.py +4 -4
  217. angr/simos/cgc.py +1 -1
  218. angr/simos/simos.py +1 -1
  219. angr/simos/userland.py +1 -1
  220. angr/slicer.py +4 -7
  221. angr/state_plugins/__init__.py +34 -34
  222. angr/state_plugins/callstack.py +5 -12
  223. angr/state_plugins/heap/__init__.py +2 -2
  224. angr/state_plugins/heap/heap_brk.py +2 -4
  225. angr/state_plugins/heap/heap_ptmalloc.py +1 -1
  226. angr/state_plugins/jni_references.py +3 -2
  227. angr/state_plugins/scratch.py +1 -1
  228. angr/state_plugins/sim_action.py +1 -4
  229. angr/state_plugins/sim_event.py +1 -1
  230. angr/state_plugins/solver.py +7 -9
  231. angr/state_plugins/uc_manager.py +1 -1
  232. angr/state_plugins/view.py +2 -2
  233. angr/storage/__init__.py +1 -1
  234. angr/storage/file.py +10 -10
  235. angr/storage/memory_mixins/__init__.py +46 -46
  236. angr/storage/memory_mixins/default_filler_mixin.py +1 -3
  237. angr/storage/memory_mixins/javavm_memory_mixin.py +2 -2
  238. angr/storage/memory_mixins/name_resolution_mixin.py +2 -2
  239. angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +1 -3
  240. angr/storage/memory_mixins/paged_memory/pages/__init__.py +6 -6
  241. angr/storage/memory_mixins/paged_memory/pages/list_page.py +1 -1
  242. angr/storage/memory_mixins/paged_memory/pages/multi_values.py +1 -1
  243. angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +1 -1
  244. angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +2 -4
  245. angr/storage/memory_mixins/regioned_memory/__init__.py +3 -3
  246. angr/storage/memory_mixins/regioned_memory/region_data.py +5 -5
  247. angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +7 -9
  248. angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +4 -4
  249. angr/storage/memory_object.py +4 -4
  250. angr/utils/__init__.py +3 -3
  251. angr/utils/bits.py +12 -0
  252. angr/utils/dynamic_dictlist.py +1 -1
  253. angr/utils/graph.py +1 -1
  254. angr/utils/orderedset.py +4 -1
  255. angr/utils/segment_list.py +2 -2
  256. angr/utils/ssa/__init__.py +33 -8
  257. {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/METADATA +6 -6
  258. {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/RECORD +262 -263
  259. angr/analyses/propagator/engine_ail.py +0 -1562
  260. angr/storage/memory_mixins/__init__.pyi +0 -48
  261. {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/LICENSE +0 -0
  262. {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/WHEEL +0 -0
  263. {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/entry_points.txt +0 -0
  264. {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/top_level.txt +0 -0
@@ -1,129 +1,6 @@
1
- # pylint:disable=unused-import,missing-class-docstring,wrong-import-position
2
1
  from __future__ import annotations
3
- import angr # For type annotations
4
-
5
-
6
- class ExplorationTechnique:
7
- """
8
- An otiegnqwvk is a set of hooks for a simulation manager that assists in the implementation of new techniques in
9
- symbolic exploration.
10
-
11
- TODO: choose actual name for the functionality (techniques? strategies?)
12
-
13
- Any number of these methods may be overridden by a subclass.
14
- To use an exploration technique, call ``simgr.use_technique`` with an *instance* of the technique.
15
- """
16
-
17
- # this is the master list of hook functinos
18
- _hook_list = ("step", "filter", "selector", "step_state", "successors")
19
-
20
- def _get_hooks(self):
21
- return {name: getattr(self, name) for name in self._hook_list if self._is_overridden(name)}
22
-
23
- def _is_overridden(self, name):
24
- return getattr(self, name).__code__ is not getattr(ExplorationTechnique, name).__code__
25
-
26
- def __init__(self):
27
- # this attribute will be set from above by the manager
28
- if not hasattr(self, "project"):
29
- self.project: angr.project.Project = None
30
-
31
- def setup(self, simgr):
32
- """
33
- Perform any initialization on this manager you might need to do.
34
-
35
- :param angr.SimulationManager simgr: The simulation manager to which you have just been added
36
- """
37
-
38
- def step(self, simgr, stash="active", **kwargs): # pylint:disable=no-self-use
39
- """
40
- Hook the process of stepping a stash forward. Should call ``simgr.step(stash, **kwargs)`` in order to do the
41
- actual processing.
42
-
43
- :param angr.SimulationManager simgr:
44
- :param str stash:
45
- """
46
- simgr.step(stash=stash, **kwargs)
47
-
48
- def filter(self, simgr, state, **kwargs): # pylint:disable=no-self-use
49
- """
50
- Perform filtering on which stash a state should be inserted into.
51
-
52
- If the state should be filtered, return the name of the stash to move the state to.
53
- If you want to modify the state before filtering it, return a tuple of the stash to move the state to and the
54
- modified state.
55
- To defer to the original categorization procedure, return the result of ``simgr.filter(state, **kwargs)``
56
-
57
- If the user provided a ``filter_func`` in their step or run command, it will appear here.
58
-
59
- :param angr.SimulationManager simgr:
60
- :param angr.SimState state:
61
- """
62
- return simgr.filter(state, **kwargs)
63
-
64
- def selector(self, simgr, state, **kwargs): # pylint:disable=no-self-use
65
- """
66
- Determine if a state should participate in the current round of stepping.
67
- Return True if the state should be stepped, and False if the state should not be stepped.
68
- To defer to the original selection procedure, return the result of ``simgr.selector(state, **kwargs)``.
69
-
70
- If the user provided a ``selector_func`` in their step or run command, it will appear here.
71
-
72
- :param angr.SimulationManager simgr:
73
- :param angr.SimState state:
74
- """
75
- return simgr.selector(state, **kwargs)
76
-
77
- def step_state(self, simgr, state, **kwargs): # pylint:disable=no-self-use
78
- """
79
- Determine the categorization of state successors into stashes. The result should be a dict mapping stash names
80
- to the list of successor states that fall into that stash, or None as a stash name to use the original stash
81
- name.
82
-
83
- If you would like to directly work with a `SimSuccessors` object, you can obtain it with
84
- ``simgr.successors(state, **kwargs)``. This is not recommended, as it denies other hooks the opportunity to
85
- look at the successors. Therefore, the usual technique is to call ``simgr.step_state(state, **kwargs)`` and
86
- then mutate the returned dict before returning it yourself.
87
-
88
- ..note:: This takes precedence over the `filter` hook - `filter` is only applied to states returned from here
89
- in the None stash.
90
-
91
- :param angr.SimulationManager simgr:
92
- :param angr.SimState state:
93
- """
94
- return simgr.step_state(state, **kwargs)
95
-
96
- def successors(self, simgr, state, **kwargs): # pylint:disable=no-self-use
97
- """
98
- Perform the process of stepping a state forward, returning a SimSuccessors object.
99
-
100
- To defer to the original succession procedure, return the result of ``simgr.successors(state, **kwargs)``.
101
- Be careful about not calling this method (e.g. calling ``project.factory.successors`` manually) as it denies
102
- other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs for the step before
103
- calling the original, and mutate the result before returning it yourself.
104
-
105
- If the user provided a ``successor_func`` in their step or run command, it will appear here.
106
-
107
- :param angr.SimulationManager simgr:
108
- :param angr.SimState state:
109
- """
110
- return simgr.successors(state, **kwargs)
111
-
112
- def complete(self, simgr): # pylint:disable=no-self-use,unused-argument
113
- """
114
- Return whether or not this manager has reached a "completed" state, i.e. ``SimulationManager.run()`` should
115
- halt.
116
-
117
- This is the one hook which is *not* subject to the nesting rules of hooks.
118
- You should *not* call ``simgr.complete``, you should make your own decision and return True or False.
119
- Each of the techniques' completion checkers will be called and the final result will be compted with
120
- ``simgr.completion_mode``.
121
-
122
- :param angr.SimulationManager simgr:
123
- """
124
- return False
125
-
126
2
 
3
+ from .base import ExplorationTechnique
127
4
  from .slicecutor import Slicecutor
128
5
  from .driller_core import DrillerCore
129
6
  from .loop_seer import LoopSeer
@@ -149,30 +26,30 @@ from .suggestions import Suggestions
149
26
  from .stub_stasher import StubStasher
150
27
 
151
28
  __all__ = (
152
- "ExplorationTechnique",
153
- "Slicecutor",
29
+ "DFS",
30
+ "Bucketizer",
31
+ "CallFunctionGoal",
32
+ "Director",
154
33
  "DrillerCore",
155
- "LoopSeer",
156
- "Tracer",
34
+ "ExecuteAddressGoal",
35
+ "ExplorationTechnique",
157
36
  "Explorer",
158
- "Threading",
159
- "DFS",
160
37
  "LengthLimiter",
161
- "Veritesting",
38
+ "LocalLoopSeer",
39
+ "LoopSeer",
40
+ "ManualMergepoint",
41
+ "MemoryWatcher",
162
42
  "Oppologist",
163
- "Director",
164
- "ExecuteAddressGoal",
165
- "CallFunctionGoal",
43
+ "Slicecutor",
166
44
  "Spiller",
167
- "ManualMergepoint",
168
- "TechniqueBuilder",
169
45
  "StochasticSearch",
170
- "UniqueSearch",
46
+ "StubStasher",
47
+ "Suggestions",
171
48
  "Symbion",
172
- "MemoryWatcher",
173
- "Bucketizer",
174
- "LocalLoopSeer",
49
+ "TechniqueBuilder",
50
+ "Threading",
175
51
  "Timeout",
176
- "Suggestions",
177
- "StubStasher",
52
+ "Tracer",
53
+ "UniqueSearch",
54
+ "Veritesting",
178
55
  )
@@ -0,0 +1,126 @@
1
+ from __future__ import annotations
2
+
3
+ from typing import TYPE_CHECKING
4
+
5
+ if TYPE_CHECKING:
6
+ import angr
7
+
8
+
9
+ class ExplorationTechnique:
10
+ """
11
+ An ExplorationTechnique is a set of hooks for a simulation manager that
12
+ assists in the implementation of new techniques in symbolic exploration.
13
+
14
+ Any number of these methods may be overridden by a subclass.
15
+ To use an exploration technique, call ``simgr.use_technique`` with an
16
+ *instance* of the technique.
17
+ """
18
+
19
+ # this is the master list of hook functinos
20
+ _hook_list = ("step", "filter", "selector", "step_state", "successors")
21
+
22
+ def _get_hooks(self):
23
+ return {name: getattr(self, name) for name in self._hook_list if self._is_overridden(name)}
24
+
25
+ def _is_overridden(self, name):
26
+ return getattr(self, name).__code__ is not getattr(ExplorationTechnique, name).__code__
27
+
28
+ def __init__(self):
29
+ # this attribute will be set from above by the manager
30
+ if not hasattr(self, "project"):
31
+ self.project: angr.Project = None
32
+
33
+ def setup(self, simgr):
34
+ """
35
+ Perform any initialization on this manager you might need to do.
36
+
37
+ :param angr.SimulationManager simgr: The simulation manager to which you have just been added
38
+ """
39
+
40
+ def step(self, simgr, stash="active", **kwargs): # pylint:disable=no-self-use
41
+ """
42
+ Hook the process of stepping a stash forward. Should call ``simgr.step(stash, **kwargs)`` in order to do the
43
+ actual processing.
44
+
45
+ :param angr.SimulationManager simgr:
46
+ :param str stash:
47
+ """
48
+ simgr.step(stash=stash, **kwargs)
49
+
50
+ def filter(self, simgr, state, **kwargs): # pylint:disable=no-self-use
51
+ """
52
+ Perform filtering on which stash a state should be inserted into.
53
+
54
+ If the state should be filtered, return the name of the stash to move the state to.
55
+ If you want to modify the state before filtering it, return a tuple of the stash to move the state to and the
56
+ modified state.
57
+ To defer to the original categorization procedure, return the result of ``simgr.filter(state, **kwargs)``
58
+
59
+ If the user provided a ``filter_func`` in their step or run command, it will appear here.
60
+
61
+ :param angr.SimulationManager simgr:
62
+ :param angr.SimState state:
63
+ """
64
+ return simgr.filter(state, **kwargs)
65
+
66
+ def selector(self, simgr, state, **kwargs): # pylint:disable=no-self-use
67
+ """
68
+ Determine if a state should participate in the current round of stepping.
69
+ Return True if the state should be stepped, and False if the state should not be stepped.
70
+ To defer to the original selection procedure, return the result of ``simgr.selector(state, **kwargs)``.
71
+
72
+ If the user provided a ``selector_func`` in their step or run command, it will appear here.
73
+
74
+ :param angr.SimulationManager simgr:
75
+ :param angr.SimState state:
76
+ """
77
+ return simgr.selector(state, **kwargs)
78
+
79
+ def step_state(self, simgr, state, **kwargs): # pylint:disable=no-self-use
80
+ """
81
+ Determine the categorization of state successors into stashes. The result should be a dict mapping stash names
82
+ to the list of successor states that fall into that stash, or None as a stash name to use the original stash
83
+ name.
84
+
85
+ If you would like to directly work with a `SimSuccessors` object, you can obtain it with
86
+ ``simgr.successors(state, **kwargs)``. This is not recommended, as it denies other hooks the opportunity to
87
+ look at the successors. Therefore, the usual technique is to call ``simgr.step_state(state, **kwargs)`` and
88
+ then mutate the returned dict before returning it yourself.
89
+
90
+ ..note:: This takes precedence over the `filter` hook - `filter` is only applied to states returned from here
91
+ in the None stash.
92
+
93
+ :param angr.SimulationManager simgr:
94
+ :param angr.SimState state:
95
+ """
96
+ return simgr.step_state(state, **kwargs)
97
+
98
+ def successors(self, simgr, state, **kwargs): # pylint:disable=no-self-use
99
+ """
100
+ Perform the process of stepping a state forward, returning a SimSuccessors object.
101
+
102
+ To defer to the original succession procedure, return the result of ``simgr.successors(state, **kwargs)``.
103
+ Be careful about not calling this method (e.g. calling ``project.factory.successors`` manually) as it denies
104
+ other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs for the step before
105
+ calling the original, and mutate the result before returning it yourself.
106
+
107
+ If the user provided a ``successor_func`` in their step or run command, it will appear here.
108
+
109
+ :param angr.SimulationManager simgr:
110
+ :param angr.SimState state:
111
+ """
112
+ return simgr.successors(state, **kwargs)
113
+
114
+ def complete(self, simgr): # pylint:disable=no-self-use,unused-argument
115
+ """
116
+ Return whether or not this manager has reached a "completed" state, i.e. ``SimulationManager.run()`` should
117
+ halt.
118
+
119
+ This is the one hook which is *not* subject to the nesting rules of hooks.
120
+ You should *not* call ``simgr.complete``, you should make your own decision and return True or False.
121
+ Each of the techniques' completion checkers will be called and the final result will be compted with
122
+ ``simgr.completion_mode``.
123
+
124
+ :param angr.SimulationManager simgr:
125
+ """
126
+ return False
@@ -4,7 +4,7 @@ from collections import defaultdict
4
4
  import logging
5
5
 
6
6
  from angr.engines.successors import SimSuccessors
7
- from . import ExplorationTechnique
7
+ from .base import ExplorationTechnique
8
8
 
9
9
  _l = logging.getLogger(__name__)
10
10
 
@@ -1,7 +1,9 @@
1
1
  from __future__ import annotations
2
- from . import ExplorationTechnique
2
+
3
3
  import random
4
4
 
5
+ from .base import ExplorationTechnique
6
+
5
7
 
6
8
  class DFS(ExplorationTechnique):
7
9
  """
@@ -2,15 +2,14 @@ from __future__ import annotations
2
2
  import logging
3
3
  from collections import defaultdict
4
4
 
5
- import networkx
6
-
7
5
  import claripy
6
+ import networkx
8
7
 
9
8
  from angr.sim_type import SimType, SimTypePointer, SimTypeChar, SimTypeString, SimTypeReg
10
9
  from angr.calling_conventions import default_cc
11
10
  from angr.knowledge_base import KnowledgeBase
12
11
  from angr.errors import AngrDirectorError
13
- from . import ExplorationTechnique
12
+ from .base import ExplorationTechnique
14
13
 
15
14
  l = logging.getLogger(name=__name__)
16
15
 
@@ -4,7 +4,7 @@ from itertools import islice
4
4
 
5
5
  import claripy
6
6
 
7
- from . import ExplorationTechnique
7
+ from .base import ExplorationTechnique
8
8
 
9
9
 
10
10
  l = logging.getLogger(name=__name__)
@@ -1,11 +1,13 @@
1
1
  from __future__ import annotations
2
+
2
3
  import logging
4
+
3
5
  import claripy
4
6
 
5
- from . import ExplorationTechnique
6
- from .common import condition_to_lambda
7
7
  from angr import sim_options
8
8
  from angr.state_plugins.sim_event import resource_event
9
+ from .base import ExplorationTechnique
10
+ from .common import condition_to_lambda
9
11
 
10
12
  l = logging.getLogger(name=__name__)
11
13
 
@@ -1,5 +1,6 @@
1
1
  from __future__ import annotations
2
- from . import ExplorationTechnique
2
+
3
+ from .base import ExplorationTechnique
3
4
 
4
5
 
5
6
  class LengthLimiter(ExplorationTechnique):
@@ -1,8 +1,9 @@
1
1
  from __future__ import annotations
2
+
2
3
  import logging
3
4
  from collections import defaultdict
4
5
 
5
- from . import ExplorationTechnique
6
+ from .base import ExplorationTechnique
6
7
 
7
8
 
8
9
  l = logging.getLogger(name=__name__)
@@ -1,10 +1,9 @@
1
1
  from __future__ import annotations
2
2
  import logging
3
3
 
4
- from . import ExplorationTechnique
5
4
  from angr.knowledge_base import KnowledgeBase
6
5
  from angr.knowledge_plugins.functions import Function
7
-
6
+ from .base import ExplorationTechnique
8
7
 
9
8
  l = logging.getLogger(name=__name__)
10
9
 
@@ -52,6 +51,10 @@ class LoopSeer(ExplorationTechnique):
52
51
  self.limit_concrete_loops = limit_concrete_loops
53
52
  self.loops = {}
54
53
  self.cut_succs = []
54
+
55
+ # Delayed import
56
+ from angr.analyses.loopfinder import Loop
57
+
55
58
  if type(loops) is Loop:
56
59
  loops = [loops]
57
60
 
@@ -231,6 +234,3 @@ class LoopSeer(ExplorationTechnique):
231
234
  f = func
232
235
 
233
236
  return f
234
-
235
-
236
- from angr.analyses.loopfinder import Loop
@@ -1,7 +1,8 @@
1
1
  from __future__ import annotations
2
+
2
3
  import logging
3
4
 
4
- from . import ExplorationTechnique
5
+ from .base import ExplorationTechnique
5
6
 
6
7
  l = logging.getLogger(name=__name__)
7
8
 
@@ -1,7 +1,9 @@
1
1
  from __future__ import annotations
2
- from . import ExplorationTechnique
2
+
3
3
  import psutil
4
4
 
5
+ from .base import ExplorationTechnique
6
+
5
7
 
6
8
  class MemoryWatcher(ExplorationTechnique):
7
9
  """Memory Watcher
@@ -1,18 +1,17 @@
1
1
  from __future__ import annotations
2
- import claripy
3
2
  import functools
4
-
5
3
  import logging
6
4
 
7
- l = logging.getLogger(name=__name__)
5
+ import claripy
8
6
 
9
7
  from angr.errors import AngrError, SimError, SimUnsupportedError, SimCCallError
10
8
  from angr import sim_options
11
9
  from angr.engines.successors import SimSuccessors
10
+ from .base import ExplorationTechnique
12
11
 
13
- exc_list = (AngrError, SimError, claripy.ClaripyError, TypeError, ValueError, ArithmeticError, MemoryError)
12
+ l = logging.getLogger(name=__name__)
14
13
 
15
- from . import ExplorationTechnique
14
+ exc_list = (AngrError, SimError, claripy.ClaripyError, TypeError, ValueError, ArithmeticError, MemoryError)
16
15
 
17
16
 
18
17
  class Oppologist(ExplorationTechnique):
@@ -1,9 +1,11 @@
1
1
  from __future__ import annotations
2
- from angr.errors import AngrExitError
3
- from . import ExplorationTechnique
4
2
 
5
3
  import logging
6
4
 
5
+ from angr.errors import AngrExitError
6
+ from .base import ExplorationTechnique
7
+
8
+
7
9
  l = logging.getLogger(name=__name__)
8
10
 
9
11
 
@@ -4,7 +4,7 @@ from __future__ import annotations
4
4
  import contextlib
5
5
  import logging
6
6
 
7
- from . import ExplorationTechnique
7
+ from .base import ExplorationTechnique
8
8
 
9
9
 
10
10
  l = logging.getLogger(name=__name__)
@@ -1,8 +1,9 @@
1
1
  from __future__ import annotations
2
+
2
3
  import random
3
4
  from collections import defaultdict
4
5
 
5
- from . import ExplorationTechnique
6
+ from .base import ExplorationTechnique
6
7
 
7
8
 
8
9
  class StochasticSearch(ExplorationTechnique):
@@ -1,5 +1,6 @@
1
1
  from __future__ import annotations
2
- from . import ExplorationTechnique
2
+
3
+ from .base import ExplorationTechnique
3
4
 
4
5
 
5
6
  class StubStasher(ExplorationTechnique):
@@ -1,12 +1,14 @@
1
1
  from __future__ import annotations
2
+
2
3
  import logging
4
+
3
5
  import claripy
4
6
 
5
- from . import ExplorationTechnique
6
7
  from angr.misc.ux import once
7
8
  from angr.misc.picklable_lock import PicklableLock
8
9
  from angr.state_plugins.sim_action import SimActionConstraint
9
10
  from angr.state_plugins.sim_action_object import SimActionObject
11
+ from .base import ExplorationTechnique
10
12
 
11
13
  l = logging.getLogger(__name__)
12
14
 
@@ -1,7 +1,9 @@
1
1
  from __future__ import annotations
2
+
2
3
  import logging
4
+
5
+ from .base import ExplorationTechnique
3
6
  from .common import condition_to_lambda
4
- from . import ExplorationTechnique
5
7
 
6
8
  l = logging.getLogger("angr.exploration_techniques.symbion")
7
9
 
@@ -1,5 +1,6 @@
1
1
  from __future__ import annotations
2
- from . import ExplorationTechnique
2
+
3
+ from .base import ExplorationTechnique
3
4
 
4
5
 
5
6
  class TechniqueBuilder(ExplorationTechnique):
@@ -1,11 +1,9 @@
1
- # pylint: disable=cell-var-from-loop
2
1
  from __future__ import annotations
2
+
3
3
  import concurrent.futures
4
4
  import logging
5
5
 
6
- from . import ExplorationTechnique
7
- from angr.engines.engine import TLSMixin
8
- from angr.misc.ux import once
6
+ from .base import ExplorationTechnique
9
7
 
10
8
  l = logging.getLogger(__name__)
11
9
 
@@ -69,10 +67,3 @@ class Threading(ExplorationTechnique):
69
67
  error_list = []
70
68
  simgr.step(stash=self.local_stash, error_list=error_list, **kwargs)
71
69
  return state, error_list, simgr
72
-
73
- def successors(self, simgr, state, engine=None, **kwargs):
74
- engine = engine or self.project.factory.default_engine
75
- if not isinstance(engine, TLSMixin) and once("tls_engine"):
76
- l.error("Using Threading exploration technique but your engine is not thread-safe.")
77
- l.error("Do you want to add the TLSMixin to your engine?")
78
- return simgr.successors(state, engine=engine, **kwargs)
@@ -1,7 +1,9 @@
1
1
  from __future__ import annotations
2
- import time
2
+
3
3
  import logging
4
- from . import ExplorationTechnique
4
+ import time
5
+
6
+ from .base import ExplorationTechnique
5
7
 
6
8
  l = logging.getLogger(name=__name__)
7
9
 
@@ -1,14 +1,15 @@
1
1
  from __future__ import annotations
2
- from typing import TYPE_CHECKING
2
+
3
3
  import logging
4
- import cle
4
+ from typing import TYPE_CHECKING
5
5
 
6
6
  import claripy
7
+ import cle
7
8
  from capstone import CS_GRP_CALL, CS_GRP_IRET, CS_GRP_JUMP, CS_GRP_RET
8
9
 
9
- from . import ExplorationTechnique
10
10
  from angr import BP_BEFORE, BP_AFTER, sim_options
11
11
  from angr.errors import AngrTracerError, SimIRSBNoDecodeError
12
+ from .base import ExplorationTechnique
12
13
 
13
14
  if TYPE_CHECKING:
14
15
  from angr.sim_state import SimState
@@ -1,8 +1,9 @@
1
1
  from __future__ import annotations
2
- from difflib import SequenceMatcher
2
+
3
3
  from collections import Counter
4
+ from difflib import SequenceMatcher
4
5
 
5
- from . import ExplorationTechnique
6
+ from .base import ExplorationTechnique
6
7
 
7
8
 
8
9
  class UniqueSearch(ExplorationTechnique):
@@ -1,7 +1,7 @@
1
1
  from __future__ import annotations
2
- from . import ExplorationTechnique
3
2
 
4
3
  from angr.sim_options import EFFICIENT_STATE_MERGING
4
+ from .base import ExplorationTechnique
5
5
 
6
6
 
7
7
  class Veritesting(ExplorationTechnique):