angr 9.2.131__py3-none-manylinux2014_aarch64.whl → 9.2.133__py3-none-manylinux2014_aarch64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +128 -128
- angr/analyses/__init__.py +38 -38
- angr/analyses/analysis.py +6 -2
- angr/analyses/backward_slice.py +3 -4
- angr/analyses/binary_optimizer.py +5 -12
- angr/analyses/bindiff.py +3 -6
- angr/analyses/calling_convention.py +3 -4
- angr/analyses/cfg/__init__.py +3 -3
- angr/analyses/cfg/cfg_base.py +1 -1
- angr/analyses/cfg/cfg_emulated.py +5 -5
- angr/analyses/cfg/cfg_fast.py +19 -17
- angr/analyses/cfg/indirect_jump_resolvers/__init__.py +5 -5
- angr/analyses/cfg/indirect_jump_resolvers/amd64_elf_got.py +1 -1
- angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +148 -101
- angr/analyses/cfg/indirect_jump_resolvers/x86_elf_pic_plt.py +1 -1
- angr/analyses/data_dep/__init__.py +4 -4
- angr/analyses/datagraph_meta.py +1 -1
- angr/analyses/ddg.py +16 -17
- angr/analyses/decompiler/__init__.py +12 -12
- angr/analyses/decompiler/ail_simplifier.py +24 -12
- angr/analyses/decompiler/block_similarity.py +2 -4
- angr/analyses/decompiler/block_simplifier.py +10 -21
- angr/analyses/decompiler/callsite_maker.py +1 -1
- angr/analyses/decompiler/ccall_rewriters/rewriter_base.py +1 -1
- angr/analyses/decompiler/clinic.py +122 -41
- angr/analyses/decompiler/condition_processor.py +57 -39
- angr/analyses/decompiler/counters/__init__.py +3 -3
- angr/analyses/decompiler/decompilation_cache.py +7 -7
- angr/analyses/decompiler/dephication/__init__.py +1 -1
- angr/analyses/decompiler/dephication/graph_rewriting.py +1 -1
- angr/analyses/decompiler/dephication/graph_vvar_mapping.py +11 -3
- angr/analyses/decompiler/dephication/rewriting_engine.py +169 -45
- angr/analyses/decompiler/dephication/seqnode_dephication.py +5 -4
- angr/analyses/decompiler/expression_narrower.py +1 -1
- angr/analyses/decompiler/graph_region.py +8 -8
- angr/analyses/decompiler/optimization_passes/__init__.py +20 -20
- angr/analyses/decompiler/optimization_passes/const_derefs.py +1 -0
- angr/analyses/decompiler/optimization_passes/deadblock_remover.py +1 -2
- angr/analyses/decompiler/optimization_passes/div_simplifier.py +41 -16
- angr/analyses/decompiler/optimization_passes/duplication_reverter/duplication_reverter.py +8 -7
- angr/analyses/decompiler/optimization_passes/duplication_reverter/utils.py +1 -3
- angr/analyses/decompiler/optimization_passes/engine_base.py +262 -84
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +175 -39
- angr/analyses/decompiler/optimization_passes/ite_region_converter.py +2 -5
- angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +5 -5
- angr/analyses/decompiler/optimization_passes/mod_simplifier.py +12 -3
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +42 -19
- angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py +9 -5
- angr/analyses/decompiler/peephole_optimizations/__init__.py +1 -1
- angr/analyses/decompiler/peephole_optimizations/base.py +6 -6
- angr/analyses/decompiler/peephole_optimizations/remove_noop_conversions.py +2 -0
- angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py +1 -1
- angr/analyses/decompiler/presets/__init__.py +1 -1
- angr/analyses/decompiler/region_simplifiers/expr_folding.py +3 -3
- angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +8 -12
- angr/analyses/decompiler/ssailification/rewriting.py +1 -2
- angr/analyses/decompiler/ssailification/rewriting_engine.py +139 -56
- angr/analyses/decompiler/ssailification/ssailification.py +2 -1
- angr/analyses/decompiler/ssailification/traversal.py +4 -6
- angr/analyses/decompiler/ssailification/traversal_engine.py +125 -42
- angr/analyses/decompiler/structured_codegen/__init__.py +5 -5
- angr/analyses/decompiler/structured_codegen/base.py +3 -3
- angr/analyses/decompiler/structured_codegen/c.py +39 -40
- angr/analyses/decompiler/structuring/__init__.py +3 -3
- angr/analyses/decompiler/structuring/phoenix.py +45 -29
- angr/analyses/decompiler/structuring/structurer_base.py +2 -2
- angr/analyses/decompiler/structuring/structurer_nodes.py +23 -14
- angr/analyses/deobfuscator/__init__.py +3 -3
- angr/analyses/deobfuscator/irsb_reg_collector.py +29 -60
- angr/analyses/deobfuscator/string_obf_finder.py +2 -2
- angr/analyses/deobfuscator/string_obf_opt_passes.py +1 -1
- angr/analyses/disassembly.py +4 -4
- angr/analyses/forward_analysis/__init__.py +1 -1
- angr/analyses/forward_analysis/visitors/graph.py +6 -6
- angr/analyses/init_finder.py +47 -22
- angr/analyses/loop_analysis.py +1 -1
- angr/analyses/loopfinder.py +1 -1
- angr/analyses/propagator/engine_base.py +21 -14
- angr/analyses/propagator/engine_vex.py +149 -179
- angr/analyses/propagator/outdated_definition_walker.py +12 -6
- angr/analyses/propagator/propagator.py +10 -28
- angr/analyses/propagator/top_checker_mixin.py +211 -5
- angr/analyses/propagator/vex_vars.py +4 -4
- angr/analyses/reaching_definitions/__init__.py +9 -9
- angr/analyses/reaching_definitions/call_trace.py +2 -2
- angr/analyses/reaching_definitions/dep_graph.py +1 -1
- angr/analyses/reaching_definitions/engine_ail.py +304 -329
- angr/analyses/reaching_definitions/engine_vex.py +243 -229
- angr/analyses/reaching_definitions/function_handler.py +3 -3
- angr/analyses/reaching_definitions/function_handler_library/__init__.py +1 -1
- angr/analyses/reaching_definitions/rd_state.py +47 -42
- angr/analyses/reassembler.py +26 -31
- angr/analyses/s_liveness.py +8 -0
- angr/analyses/s_propagator.py +18 -3
- angr/analyses/s_reaching_definitions/s_rda_view.py +2 -5
- angr/analyses/s_reaching_definitions/s_reaching_definitions.py +9 -5
- angr/analyses/stack_pointer_tracker.py +4 -4
- angr/analyses/typehoon/simple_solver.py +14 -14
- angr/analyses/typehoon/translator.py +10 -2
- angr/analyses/typehoon/typeconsts.py +11 -3
- angr/analyses/typehoon/typevars.py +26 -26
- angr/analyses/unpacker/__init__.py +1 -1
- angr/analyses/variable_recovery/engine_ail.py +299 -259
- angr/analyses/variable_recovery/engine_base.py +138 -121
- angr/analyses/variable_recovery/engine_vex.py +175 -185
- angr/analyses/variable_recovery/irsb_scanner.py +49 -38
- angr/analyses/variable_recovery/variable_recovery.py +28 -5
- angr/analyses/variable_recovery/variable_recovery_base.py +33 -34
- angr/analyses/variable_recovery/variable_recovery_fast.py +4 -8
- angr/analyses/veritesting.py +2 -2
- angr/analyses/vfg.py +5 -5
- angr/analyses/xrefs.py +46 -19
- angr/angrdb/serializers/__init__.py +1 -1
- angr/annocfg.py +20 -15
- angr/blade.py +2 -2
- angr/block.py +20 -25
- angr/calling_conventions.py +12 -14
- angr/code_location.py +6 -10
- angr/codenode.py +3 -3
- angr/engines/__init__.py +12 -14
- angr/engines/engine.py +24 -61
- angr/engines/light/__init__.py +13 -5
- angr/engines/light/data.py +1 -1
- angr/engines/light/engine.py +1003 -1185
- angr/engines/pcode/__init__.py +1 -1
- angr/engines/pcode/behavior.py +1 -1
- angr/engines/pcode/cc.py +2 -0
- angr/engines/pcode/lifter.py +13 -15
- angr/engines/soot/expressions/__init__.py +12 -12
- angr/engines/soot/statements/__init__.py +6 -6
- angr/engines/soot/values/__init__.py +6 -6
- angr/engines/soot/values/arrayref.py +2 -2
- angr/engines/soot/values/constants.py +1 -1
- angr/engines/soot/values/instancefieldref.py +1 -1
- angr/engines/soot/values/paramref.py +1 -1
- angr/engines/soot/values/staticfieldref.py +1 -1
- angr/engines/successors.py +15 -14
- angr/engines/vex/__init__.py +5 -5
- angr/engines/vex/claripy/ccall.py +2 -2
- angr/engines/vex/claripy/datalayer.py +1 -1
- angr/engines/vex/claripy/irop.py +19 -19
- angr/engines/vex/heavy/__init__.py +2 -2
- angr/engines/vex/heavy/actions.py +1 -3
- angr/engines/vex/heavy/heavy.py +4 -6
- angr/engines/vex/lifter.py +2 -4
- angr/engines/vex/light/light.py +0 -2
- angr/engines/vex/light/slicing.py +5 -5
- angr/exploration_techniques/__init__.py +19 -142
- angr/exploration_techniques/base.py +126 -0
- angr/exploration_techniques/bucketizer.py +1 -1
- angr/exploration_techniques/dfs.py +3 -1
- angr/exploration_techniques/director.py +2 -3
- angr/exploration_techniques/driller_core.py +1 -1
- angr/exploration_techniques/explorer.py +4 -2
- angr/exploration_techniques/lengthlimiter.py +2 -1
- angr/exploration_techniques/local_loop_seer.py +2 -1
- angr/exploration_techniques/loop_seer.py +5 -5
- angr/exploration_techniques/manual_mergepoint.py +2 -1
- angr/exploration_techniques/memory_watcher.py +3 -1
- angr/exploration_techniques/oppologist.py +4 -5
- angr/exploration_techniques/slicecutor.py +4 -2
- angr/exploration_techniques/spiller.py +1 -1
- angr/exploration_techniques/stochastic.py +2 -1
- angr/exploration_techniques/stub_stasher.py +2 -1
- angr/exploration_techniques/suggestions.py +3 -1
- angr/exploration_techniques/symbion.py +3 -1
- angr/exploration_techniques/tech_builder.py +2 -1
- angr/exploration_techniques/threading.py +2 -11
- angr/exploration_techniques/timeout.py +4 -2
- angr/exploration_techniques/tracer.py +4 -3
- angr/exploration_techniques/unique.py +3 -2
- angr/exploration_techniques/veritesting.py +1 -1
- angr/factory.py +36 -6
- angr/keyed_region.py +4 -4
- angr/knowledge_base.py +1 -1
- angr/knowledge_plugins/__init__.py +11 -11
- angr/knowledge_plugins/cfg/__init__.py +5 -5
- angr/knowledge_plugins/cfg/cfg_manager.py +2 -2
- angr/knowledge_plugins/cfg/cfg_model.py +8 -8
- angr/knowledge_plugins/cfg/cfg_node.py +19 -19
- angr/knowledge_plugins/cfg/indirect_jump.py +6 -6
- angr/knowledge_plugins/cfg/memory_data.py +5 -7
- angr/knowledge_plugins/functions/function.py +48 -52
- angr/knowledge_plugins/functions/function_parser.py +4 -4
- angr/knowledge_plugins/key_definitions/__init__.py +3 -3
- angr/knowledge_plugins/key_definitions/atoms.py +8 -8
- angr/knowledge_plugins/key_definitions/definition.py +1 -1
- angr/knowledge_plugins/key_definitions/live_definitions.py +30 -27
- angr/knowledge_plugins/labels.py +1 -1
- angr/knowledge_plugins/propagations/__init__.py +1 -1
- angr/knowledge_plugins/propagations/prop_value.py +2 -2
- angr/knowledge_plugins/propagations/propagation_model.py +7 -8
- angr/knowledge_plugins/propagations/states.py +44 -39
- angr/knowledge_plugins/variables/variable_access.py +2 -2
- angr/knowledge_plugins/variables/variable_manager.py +24 -10
- angr/knowledge_plugins/xrefs/xref.py +5 -8
- angr/misc/__init__.py +4 -4
- angr/misc/hookset.py +4 -5
- angr/misc/loggers.py +2 -2
- angr/misc/telemetry.py +1 -1
- angr/procedures/__init__.py +1 -1
- angr/procedures/cgc/fdwait.py +2 -2
- angr/procedures/definitions/__init__.py +2 -2
- angr/procedures/definitions/linux_kernel.py +0 -1
- angr/procedures/definitions/parse_syscalls_from_local_system.py +1 -1
- angr/procedures/definitions/parse_win32json.py +0 -1
- angr/procedures/ntdll/exceptions.py +1 -1
- angr/procedures/stubs/format_parser.py +3 -3
- angr/procedures/win32/dynamic_loading.py +1 -1
- angr/protos/__init__.py +3 -3
- angr/sim_manager.py +3 -5
- angr/sim_state.py +40 -42
- angr/sim_state_options.py +3 -3
- angr/sim_type.py +15 -14
- angr/sim_variable.py +42 -45
- angr/simos/__init__.py +4 -4
- angr/simos/cgc.py +1 -1
- angr/simos/simos.py +1 -1
- angr/simos/userland.py +1 -1
- angr/slicer.py +4 -7
- angr/state_plugins/__init__.py +34 -34
- angr/state_plugins/callstack.py +5 -12
- angr/state_plugins/heap/__init__.py +2 -2
- angr/state_plugins/heap/heap_brk.py +2 -4
- angr/state_plugins/heap/heap_ptmalloc.py +1 -1
- angr/state_plugins/jni_references.py +3 -2
- angr/state_plugins/scratch.py +1 -1
- angr/state_plugins/sim_action.py +1 -4
- angr/state_plugins/sim_event.py +1 -1
- angr/state_plugins/solver.py +7 -9
- angr/state_plugins/uc_manager.py +1 -1
- angr/state_plugins/view.py +2 -2
- angr/storage/__init__.py +1 -1
- angr/storage/file.py +10 -10
- angr/storage/memory_mixins/__init__.py +46 -46
- angr/storage/memory_mixins/default_filler_mixin.py +1 -3
- angr/storage/memory_mixins/javavm_memory_mixin.py +2 -2
- angr/storage/memory_mixins/name_resolution_mixin.py +2 -2
- angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +1 -3
- angr/storage/memory_mixins/paged_memory/pages/__init__.py +6 -6
- angr/storage/memory_mixins/paged_memory/pages/list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/multi_values.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +2 -4
- angr/storage/memory_mixins/regioned_memory/__init__.py +3 -3
- angr/storage/memory_mixins/regioned_memory/region_data.py +5 -5
- angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +7 -9
- angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +4 -4
- angr/storage/memory_object.py +4 -4
- angr/utils/__init__.py +3 -3
- angr/utils/bits.py +12 -0
- angr/utils/dynamic_dictlist.py +1 -1
- angr/utils/graph.py +1 -1
- angr/utils/orderedset.py +4 -1
- angr/utils/segment_list.py +2 -2
- angr/utils/ssa/__init__.py +33 -8
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/METADATA +6 -6
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/RECORD +262 -263
- angr/analyses/propagator/engine_ail.py +0 -1562
- angr/storage/memory_mixins/__init__.pyi +0 -48
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/LICENSE +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/WHEEL +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/entry_points.txt +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/top_level.txt +0 -0
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
from typing import Any, TYPE_CHECKING, overload
|
|
2
|
+
from typing import Any, TYPE_CHECKING, cast, overload
|
|
3
3
|
from collections.abc import Iterable, Generator
|
|
4
4
|
import weakref
|
|
5
5
|
import logging
|
|
@@ -14,7 +14,7 @@ import archinfo
|
|
|
14
14
|
from angr.misc.ux import deprecated
|
|
15
15
|
from angr.errors import SimMemoryMissingError, SimMemoryError
|
|
16
16
|
from angr.storage.memory_mixins import MultiValuedMemory
|
|
17
|
-
from angr.storage.memory_mixins.paged_memory.pages.multi_values import MultiValues
|
|
17
|
+
from angr.storage.memory_mixins.paged_memory.pages.multi_values import MVType, MultiValues
|
|
18
18
|
from angr.knowledge_plugins.key_definitions.definition import A
|
|
19
19
|
from angr.engines.light import SpOffset
|
|
20
20
|
from angr.code_location import CodeLocation, ExternalCodeLocation
|
|
@@ -52,7 +52,7 @@ class DefinitionAnnotation(Annotation):
|
|
|
52
52
|
An annotation that attaches a `Definition` to an AST.
|
|
53
53
|
"""
|
|
54
54
|
|
|
55
|
-
__slots__ = ("
|
|
55
|
+
__slots__ = ("_hash", "definition")
|
|
56
56
|
|
|
57
57
|
def __init__(self, definition):
|
|
58
58
|
super().__init__()
|
|
@@ -91,24 +91,24 @@ class LiveDefinitions:
|
|
|
91
91
|
_tops = {}
|
|
92
92
|
|
|
93
93
|
__slots__ = (
|
|
94
|
-
"
|
|
94
|
+
"__weakref__",
|
|
95
|
+
"_canonical_size",
|
|
95
96
|
"arch",
|
|
96
|
-
"track_tmps",
|
|
97
|
-
"registers",
|
|
98
|
-
"stack",
|
|
99
97
|
"heap",
|
|
98
|
+
"heap_uses",
|
|
100
99
|
"memory",
|
|
101
|
-
"
|
|
102
|
-
"others",
|
|
100
|
+
"memory_uses",
|
|
103
101
|
"other_uses",
|
|
102
|
+
"others",
|
|
103
|
+
"project",
|
|
104
104
|
"register_uses",
|
|
105
|
+
"registers",
|
|
106
|
+
"stack",
|
|
105
107
|
"stack_uses",
|
|
106
|
-
"heap_uses",
|
|
107
|
-
"memory_uses",
|
|
108
|
-
"uses_by_codeloc",
|
|
109
108
|
"tmp_uses",
|
|
110
|
-
"
|
|
111
|
-
"
|
|
109
|
+
"tmps",
|
|
110
|
+
"track_tmps",
|
|
111
|
+
"uses_by_codeloc",
|
|
112
112
|
)
|
|
113
113
|
|
|
114
114
|
def __init__(
|
|
@@ -230,7 +230,7 @@ class LiveDefinitions:
|
|
|
230
230
|
def __repr__(self):
|
|
231
231
|
ctnt = "LiveDefs"
|
|
232
232
|
if self.tmps:
|
|
233
|
-
ctnt += ",
|
|
233
|
+
ctnt += f", {len(self.tmps)} tmpdefs"
|
|
234
234
|
return f"<{ctnt}>"
|
|
235
235
|
|
|
236
236
|
def copy(self, discard_tmpdefs=False) -> LiveDefinitions:
|
|
@@ -324,7 +324,7 @@ class LiveDefinitions:
|
|
|
324
324
|
return True
|
|
325
325
|
return False
|
|
326
326
|
|
|
327
|
-
def stack_address(self, offset: int) -> claripy.ast.bv.BV
|
|
327
|
+
def stack_address(self, offset: int) -> claripy.ast.bv.BV:
|
|
328
328
|
base = claripy.BVS("stack_base", self.arch.bits, explicit_name=True)
|
|
329
329
|
if offset:
|
|
330
330
|
return base + offset
|
|
@@ -346,21 +346,21 @@ class LiveDefinitions:
|
|
|
346
346
|
return 0
|
|
347
347
|
if addr.op == "__add__":
|
|
348
348
|
if len(addr.args) == 2:
|
|
349
|
-
off0 = LiveDefinitions.get_stack_offset(addr.args[0], had_stack_base=True)
|
|
350
|
-
off1 = LiveDefinitions.get_stack_offset(addr.args[1], had_stack_base=True)
|
|
349
|
+
off0 = LiveDefinitions.get_stack_offset(cast(claripy.ast.BV, addr.args[0]), had_stack_base=True)
|
|
350
|
+
off1 = LiveDefinitions.get_stack_offset(cast(claripy.ast.BV, addr.args[1]), had_stack_base=True)
|
|
351
351
|
if off0 is not None and off1 is not None:
|
|
352
352
|
return off0 + off1
|
|
353
353
|
elif len(addr.args) == 1:
|
|
354
354
|
return 0
|
|
355
355
|
elif addr.op == "__sub__" and len(addr.args) == 2:
|
|
356
|
-
off0 = LiveDefinitions.get_stack_offset(addr.args[0], had_stack_base=True)
|
|
357
|
-
off1 = LiveDefinitions.get_stack_offset(addr.args[1], had_stack_base=True)
|
|
356
|
+
off0 = LiveDefinitions.get_stack_offset(cast(claripy.ast.BV, addr.args[0]), had_stack_base=True)
|
|
357
|
+
off1 = LiveDefinitions.get_stack_offset(cast(claripy.ast.BV, addr.args[1]), had_stack_base=True)
|
|
358
358
|
if off0 is not None and off1 is not None:
|
|
359
359
|
return off0 - off1
|
|
360
360
|
return None
|
|
361
361
|
|
|
362
362
|
@staticmethod
|
|
363
|
-
def annotate_with_def(symvar:
|
|
363
|
+
def annotate_with_def(symvar: MVType, definition: Definition) -> MVType:
|
|
364
364
|
"""
|
|
365
365
|
|
|
366
366
|
:param symvar:
|
|
@@ -445,7 +445,7 @@ class LiveDefinitions:
|
|
|
445
445
|
base_v = self.INITIAL_SP_64BIT
|
|
446
446
|
mask = 0xFFFF_FFFF_FFFF_FFFF
|
|
447
447
|
else:
|
|
448
|
-
raise ValueError("Unsupported architecture word size
|
|
448
|
+
raise ValueError(f"Unsupported architecture word size {self.arch.bits}")
|
|
449
449
|
return (base_v + offset) & mask
|
|
450
450
|
|
|
451
451
|
def merge(self, *others: LiveDefinitions) -> tuple[LiveDefinitions, bool]:
|
|
@@ -562,9 +562,12 @@ class LiveDefinitions:
|
|
|
562
562
|
else:
|
|
563
563
|
definition: Definition = Definition(atom, code_loc, dummy=dummy, tags=tags)
|
|
564
564
|
d = MultiValues()
|
|
565
|
+
count = 0
|
|
565
566
|
for offset, vs in data.items():
|
|
566
567
|
for v in vs:
|
|
568
|
+
count += 1
|
|
567
569
|
d.add_value(offset, self.annotate_with_def(v, definition))
|
|
570
|
+
assert count != 0, "MV may not be empty, use TOP instead"
|
|
568
571
|
|
|
569
572
|
# set_object() replaces kill (not implemented) and add (add) in one step
|
|
570
573
|
if isinstance(atom, Register):
|
|
@@ -659,7 +662,7 @@ class LiveDefinitions:
|
|
|
659
662
|
self.other_uses.add_use(definition, code_loc, expr)
|
|
660
663
|
|
|
661
664
|
def get_definitions(
|
|
662
|
-
self, thing:
|
|
665
|
+
self, thing: Atom | Definition[Atom] | Iterable[Atom] | Iterable[Definition[Atom]] | MultiValues
|
|
663
666
|
) -> set[Definition[Atom]]:
|
|
664
667
|
if isinstance(thing, MultiValues):
|
|
665
668
|
defs = set()
|
|
@@ -973,7 +976,7 @@ class LiveDefinitions:
|
|
|
973
976
|
@overload
|
|
974
977
|
def deref(
|
|
975
978
|
self,
|
|
976
|
-
pointer: MultiValues |
|
|
979
|
+
pointer: MultiValues[claripy.ast.BV] | Atom | Definition[Atom] | Iterable[Atom] | Iterable[Definition[Atom]],
|
|
977
980
|
size: int | DerefSize,
|
|
978
981
|
endness: archinfo.Endness = ...,
|
|
979
982
|
) -> set[MemoryLocation]: ...
|
|
@@ -1023,7 +1026,7 @@ class LiveDefinitions:
|
|
|
1023
1026
|
if heap_offset is not None:
|
|
1024
1027
|
addr = HeapAddress(heap_offset)
|
|
1025
1028
|
elif pointer.op == "BVV":
|
|
1026
|
-
addr = pointer.args[0]
|
|
1029
|
+
addr = cast(int, pointer.args[0])
|
|
1027
1030
|
else:
|
|
1028
1031
|
# cannot resolve
|
|
1029
1032
|
return None
|
|
@@ -1054,8 +1057,8 @@ class LiveDefinitions:
|
|
|
1054
1057
|
if "heap_base" in addr.variables:
|
|
1055
1058
|
if addr.op == "BVS":
|
|
1056
1059
|
return 0
|
|
1057
|
-
if addr.op == "__add__" and len(addr.args) == 2 and addr.args[1].op == "BVV":
|
|
1058
|
-
return addr.args[1].concrete_value
|
|
1060
|
+
if addr.op == "__add__" and len(addr.args) == 2 and cast(claripy.ast.BV, addr.args[1]).op == "BVV":
|
|
1061
|
+
return cast(claripy.ast.BV, addr.args[1]).concrete_value
|
|
1059
1062
|
return None
|
|
1060
1063
|
|
|
1061
1064
|
def heap_address(self, offset: int | HeapAddress) -> claripy.ast.BV:
|
angr/knowledge_plugins/labels.py
CHANGED
|
@@ -17,7 +17,7 @@ class Detail:
|
|
|
17
17
|
or the current function.
|
|
18
18
|
"""
|
|
19
19
|
|
|
20
|
-
__slots__ = ("
|
|
20
|
+
__slots__ = ("def_at", "expr", "size")
|
|
21
21
|
|
|
22
22
|
def __init__(self, size: int, expr: ailment.Expression | None, def_at: CodeLocation | None):
|
|
23
23
|
self.size = size
|
|
@@ -37,8 +37,8 @@ class PropValue:
|
|
|
37
37
|
"""
|
|
38
38
|
|
|
39
39
|
__slots__ = (
|
|
40
|
-
"value",
|
|
41
40
|
"offset_and_details",
|
|
41
|
+
"value",
|
|
42
42
|
)
|
|
43
43
|
|
|
44
44
|
def __init__(self, value: claripy.ast.Bits, offset_and_details: dict[int, Detail] | None = None):
|
|
@@ -15,17 +15,16 @@ class PropagationModel(Serializable):
|
|
|
15
15
|
"""
|
|
16
16
|
|
|
17
17
|
__slots__ = (
|
|
18
|
-
"
|
|
19
|
-
"
|
|
20
|
-
"states",
|
|
21
|
-
"input_states",
|
|
18
|
+
"_function",
|
|
19
|
+
"_initial_state",
|
|
22
20
|
"block_initial_reg_values",
|
|
23
|
-
"replacements",
|
|
24
21
|
"equivalence",
|
|
25
|
-
# internals of the function graph visitor
|
|
26
22
|
"graph_visitor",
|
|
27
|
-
"
|
|
28
|
-
"
|
|
23
|
+
"input_states",
|
|
24
|
+
"key",
|
|
25
|
+
"node_iterations",
|
|
26
|
+
"replacements",
|
|
27
|
+
"states",
|
|
29
28
|
)
|
|
30
29
|
|
|
31
30
|
def __init__(
|
|
@@ -1,9 +1,12 @@
|
|
|
1
1
|
# pylint:disable=too-many-boolean-expressions
|
|
2
2
|
from __future__ import annotations
|
|
3
|
+
from abc import abstractmethod
|
|
3
4
|
from typing import Any, TYPE_CHECKING
|
|
4
5
|
from collections import defaultdict
|
|
5
6
|
import weakref
|
|
6
7
|
|
|
8
|
+
from typing_extensions import Self
|
|
9
|
+
|
|
7
10
|
import ailment
|
|
8
11
|
import claripy
|
|
9
12
|
import archinfo
|
|
@@ -62,20 +65,20 @@ class PropagatorState:
|
|
|
62
65
|
"""
|
|
63
66
|
|
|
64
67
|
__slots__ = (
|
|
65
|
-
"
|
|
66
|
-
"
|
|
68
|
+
"__weakref__",
|
|
69
|
+
"_artificial_reg_offsets",
|
|
70
|
+
"_equivalence",
|
|
67
71
|
"_expr_used_locs",
|
|
72
|
+
"_gp",
|
|
73
|
+
"_max_prop_expr_occurrence",
|
|
68
74
|
"_only_consts",
|
|
69
75
|
"_replacements",
|
|
70
|
-
"_equivalence",
|
|
71
|
-
"project",
|
|
72
|
-
"rda",
|
|
73
76
|
"_store_tops",
|
|
74
|
-
"
|
|
75
|
-
"
|
|
77
|
+
"arch",
|
|
78
|
+
"gpr_size",
|
|
76
79
|
"model",
|
|
77
|
-
"
|
|
78
|
-
"
|
|
80
|
+
"project",
|
|
81
|
+
"rda",
|
|
79
82
|
)
|
|
80
83
|
|
|
81
84
|
_tops = {}
|
|
@@ -114,7 +117,7 @@ class PropagatorState:
|
|
|
114
117
|
self.model = model
|
|
115
118
|
self.rda = rda
|
|
116
119
|
|
|
117
|
-
def __repr__(self):
|
|
120
|
+
def __repr__(self) -> str:
|
|
118
121
|
return "<PropagatorState>"
|
|
119
122
|
|
|
120
123
|
@classmethod
|
|
@@ -155,6 +158,7 @@ class PropagatorState:
|
|
|
155
158
|
# comparing bytes from two sets of memory objects
|
|
156
159
|
# we don't need to resort to byte-level comparison. object-level is good enough.
|
|
157
160
|
|
|
161
|
+
# TODO what if object is bytes?
|
|
158
162
|
if mo_self.object.symbolic or mo_other.object.symbolic:
|
|
159
163
|
if type(mo_self) is SimLabeledMemoryObject and type(mo_other) is SimLabeledMemoryObject:
|
|
160
164
|
return mo_self.label == mo_other.label and mo_self.object is mo_other.object
|
|
@@ -165,7 +169,7 @@ class PropagatorState:
|
|
|
165
169
|
return None
|
|
166
170
|
|
|
167
171
|
@staticmethod
|
|
168
|
-
def top(bits: int) -> claripy.ast.
|
|
172
|
+
def top(bits: int) -> claripy.ast.BV:
|
|
169
173
|
"""
|
|
170
174
|
Get a TOP value.
|
|
171
175
|
|
|
@@ -233,20 +237,20 @@ class PropagatorState:
|
|
|
233
237
|
or isinstance(repl, claripy.ast.Base)
|
|
234
238
|
)
|
|
235
239
|
and replacements_0[loc][var] is not repl
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
|
|
240
|
-
)
|
|
240
|
+
) or (
|
|
241
|
+
not isinstance(replacements_0[loc][var], claripy.ast.Base)
|
|
242
|
+
and not isinstance(repl, claripy.ast.Base)
|
|
243
|
+
and replacements_0[loc][var] != repl
|
|
241
244
|
):
|
|
242
245
|
replacements_0[loc][var] = repl
|
|
243
246
|
merge_occurred = True
|
|
244
247
|
return merge_occurred
|
|
245
248
|
|
|
246
|
-
|
|
249
|
+
@abstractmethod
|
|
250
|
+
def copy(self) -> Self:
|
|
247
251
|
raise NotImplementedError
|
|
248
252
|
|
|
249
|
-
def merge(self, *others):
|
|
253
|
+
def merge(self, *others: Self) -> tuple[Self, bool]:
|
|
250
254
|
state = self.copy()
|
|
251
255
|
merge_occurred = False
|
|
252
256
|
|
|
@@ -263,8 +267,8 @@ class PropagatorState:
|
|
|
263
267
|
self._replacements = defaultdict(dict)
|
|
264
268
|
|
|
265
269
|
def add_replacement(
|
|
266
|
-
self, codeloc: CodeLocation, old, new, force_replace: bool = False
|
|
267
|
-
) -> bool:
|
|
270
|
+
self, codeloc: CodeLocation, old, new, force_replace: bool = False # pylint:disable=unused-argument
|
|
271
|
+
) -> bool:
|
|
268
272
|
"""
|
|
269
273
|
Add a replacement record: Replacing expression `old` with `new` at program location `codeloc`.
|
|
270
274
|
If the self._only_consts flag is set to true, only constant values will be set.
|
|
@@ -331,7 +335,7 @@ class RegisterComparisonAnnotation(claripy.Annotation):
|
|
|
331
335
|
Annotate TOP values that are the result of register values comparing against constant values.
|
|
332
336
|
"""
|
|
333
337
|
|
|
334
|
-
def __init__(self, offset, size, cmp_op, value):
|
|
338
|
+
def __init__(self, offset: int, size: int, cmp_op: str, value: int):
|
|
335
339
|
self.offset = offset
|
|
336
340
|
self.size = size
|
|
337
341
|
self.cmp_op = cmp_op
|
|
@@ -366,8 +370,8 @@ class PropagatorVEXState(PropagatorState):
|
|
|
366
370
|
__slots__ = (
|
|
367
371
|
"_registers",
|
|
368
372
|
"_stack_variables",
|
|
369
|
-
"do_binops",
|
|
370
373
|
"block_initial_reg_values",
|
|
374
|
+
"do_binops",
|
|
371
375
|
)
|
|
372
376
|
|
|
373
377
|
def __init__(
|
|
@@ -504,7 +508,7 @@ class PropagatorVEXState(PropagatorState):
|
|
|
504
508
|
# TODO: Handle size
|
|
505
509
|
self._stack_variables.store(offset, value, size=size, endness=endness)
|
|
506
510
|
|
|
507
|
-
def load_local_variable(self, offset, size, endness): # pylint:disable=unused-argument
|
|
511
|
+
def load_local_variable(self, offset, size, endness) -> claripy.ast.BV: # pylint:disable=unused-argument
|
|
508
512
|
# TODO: Handle size
|
|
509
513
|
try:
|
|
510
514
|
return self._stack_variables.load(offset, size=size, endness=endness)
|
|
@@ -546,9 +550,9 @@ class Equivalence:
|
|
|
546
550
|
"""
|
|
547
551
|
|
|
548
552
|
__slots__ = (
|
|
549
|
-
"codeloc",
|
|
550
553
|
"atom0",
|
|
551
554
|
"atom1",
|
|
555
|
+
"codeloc",
|
|
552
556
|
)
|
|
553
557
|
|
|
554
558
|
def __init__(self, codeloc, atom0, atom1):
|
|
@@ -578,14 +582,14 @@ class PropagatorAILState(PropagatorState):
|
|
|
578
582
|
|
|
579
583
|
__slots__ = (
|
|
580
584
|
"_registers",
|
|
585
|
+
"_sp_adjusted",
|
|
581
586
|
"_stack_variables",
|
|
582
587
|
"_tmps",
|
|
583
|
-
"temp_expressions",
|
|
584
|
-
"register_expressions",
|
|
585
|
-
"last_stack_store",
|
|
586
|
-
"global_stores",
|
|
587
588
|
"block_initial_reg_values",
|
|
588
|
-
"
|
|
589
|
+
"global_stores",
|
|
590
|
+
"last_stack_store",
|
|
591
|
+
"register_expressions",
|
|
592
|
+
"temp_expressions",
|
|
589
593
|
)
|
|
590
594
|
|
|
591
595
|
def __init__(
|
|
@@ -912,10 +916,8 @@ class PropagatorAILState(PropagatorState):
|
|
|
912
916
|
replaced = False
|
|
913
917
|
# count-based propagation rule only matters when we are performing a full-function copy propagation
|
|
914
918
|
if self._max_prop_expr_occurrence == 0:
|
|
915
|
-
if (
|
|
916
|
-
isinstance(old, ailment.Expr.
|
|
917
|
-
or isinstance(old, ailment.Expr.Register)
|
|
918
|
-
and self.should_replace_reg(old.reg_offset, bp_as_gpr, new)
|
|
919
|
+
if isinstance(old, ailment.Expr.Tmp) or (
|
|
920
|
+
isinstance(old, ailment.Expr.Register) and self.should_replace_reg(old.reg_offset, bp_as_gpr, new)
|
|
919
921
|
):
|
|
920
922
|
self._replacements[codeloc][old] = (
|
|
921
923
|
new if stmt_to_remove is None else {"expr": new, "stmt_to_remove": stmt_to_remove}
|
|
@@ -958,8 +960,7 @@ class PropagatorAILState(PropagatorState):
|
|
|
958
960
|
force_replace
|
|
959
961
|
or prop_count <= self._max_prop_expr_occurrence
|
|
960
962
|
or isinstance(new, ailment.Expr.StackBaseOffset)
|
|
961
|
-
or isinstance(new, ailment.Expr.Convert)
|
|
962
|
-
and isinstance(new.operand, ailment.Expr.StackBaseOffset)
|
|
963
|
+
or (isinstance(new, ailment.Expr.Convert) and isinstance(new.operand, ailment.Expr.StackBaseOffset))
|
|
963
964
|
or (
|
|
964
965
|
isinstance(old, ailment.Expr.Register)
|
|
965
966
|
and self.arch.is_artificial_register(old.reg_offset, old.size)
|
|
@@ -1015,10 +1016,14 @@ class PropagatorAILState(PropagatorState):
|
|
|
1015
1016
|
isinstance(expr, ailment.Expr.BinaryOp)
|
|
1016
1017
|
and expr.op in {"Add", "Sub"}
|
|
1017
1018
|
and (
|
|
1018
|
-
|
|
1019
|
-
|
|
1020
|
-
|
|
1021
|
-
|
|
1019
|
+
(
|
|
1020
|
+
isinstance(expr.operands[0], ailment.Expr.Register)
|
|
1021
|
+
and PropagatorAILState.is_global_variable_load(expr.operands[1])
|
|
1022
|
+
)
|
|
1023
|
+
or (
|
|
1024
|
+
isinstance(expr.operands[1], ailment.Expr.Register)
|
|
1025
|
+
and PropagatorAILState.is_global_variable_load(expr.operands[0])
|
|
1026
|
+
)
|
|
1022
1027
|
)
|
|
1023
1028
|
)
|
|
1024
1029
|
|
|
@@ -26,11 +26,11 @@ class VariableAccess(Serializable):
|
|
|
26
26
|
"""
|
|
27
27
|
|
|
28
28
|
__slots__ = (
|
|
29
|
-
"variable",
|
|
30
29
|
"access_type",
|
|
30
|
+
"atom_hash",
|
|
31
31
|
"location",
|
|
32
32
|
"offset",
|
|
33
|
-
"
|
|
33
|
+
"variable",
|
|
34
34
|
)
|
|
35
35
|
|
|
36
36
|
def __init__(self, variable, access_type, location, offset, atom_hash=None):
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
from typing import Literal, TYPE_CHECKING
|
|
2
|
+
from typing import Literal, TYPE_CHECKING, overload
|
|
3
3
|
import logging
|
|
4
4
|
from collections import defaultdict
|
|
5
5
|
from itertools import count, chain
|
|
@@ -77,14 +77,14 @@ class VariableManagerInternal(Serializable):
|
|
|
77
77
|
|
|
78
78
|
self.func_addr = func_addr
|
|
79
79
|
|
|
80
|
-
self._variables:
|
|
80
|
+
self._variables: OrderedSet[SimVariable] = OrderedSet() # all variables that are added to any region
|
|
81
81
|
self._global_region = KeyedRegion()
|
|
82
82
|
self._stack_region = KeyedRegion()
|
|
83
83
|
self._register_region = KeyedRegion()
|
|
84
84
|
self._live_variables = {} # a mapping between addresses of program points and live variable collections
|
|
85
85
|
|
|
86
86
|
self._variable_accesses: dict[SimVariable, set[VariableAccess]] = defaultdict(set)
|
|
87
|
-
self._insn_to_variable: dict[int, set[tuple[SimVariable, int]]] = defaultdict(set)
|
|
87
|
+
self._insn_to_variable: dict[int, set[tuple[SimVariable, int | None]]] = defaultdict(set)
|
|
88
88
|
self._stmt_to_variable: dict[tuple[int, int] | tuple[int, int, int], set[tuple[SimVariable, int]]] = (
|
|
89
89
|
defaultdict(set)
|
|
90
90
|
)
|
|
@@ -115,7 +115,7 @@ class VariableManagerInternal(Serializable):
|
|
|
115
115
|
# optimization
|
|
116
116
|
self._variables_without_writes = set()
|
|
117
117
|
|
|
118
|
-
self.stack_offset_to_struct_member_info: dict[SimStackVariable,
|
|
118
|
+
self.stack_offset_to_struct_member_info: dict[SimStackVariable, tuple[int, SimStackVariable, SimStruct]] = {}
|
|
119
119
|
|
|
120
120
|
self.ret_val_size = None
|
|
121
121
|
|
|
@@ -291,9 +291,11 @@ class VariableManagerInternal(Serializable):
|
|
|
291
291
|
variable_access = VariableAccess.parse_from_cmessage(varaccess_pb2, variable_by_ident=variable_by_ident)
|
|
292
292
|
variable = variable_access.variable
|
|
293
293
|
offset = variable_access.offset
|
|
294
|
+
assert variable is not None
|
|
294
295
|
tpl = (variable, offset)
|
|
295
296
|
|
|
296
297
|
model._variable_accesses[variable_access.variable].add(variable_access)
|
|
298
|
+
assert variable_access.location.ins_addr is not None
|
|
297
299
|
model._insn_to_variable[variable_access.location.ins_addr].add(tpl)
|
|
298
300
|
loc = (
|
|
299
301
|
(variable_access.location.block_addr, variable_access.location.stmt_idx)
|
|
@@ -388,7 +390,7 @@ class VariableManagerInternal(Serializable):
|
|
|
388
390
|
else:
|
|
389
391
|
prefix = "m"
|
|
390
392
|
|
|
391
|
-
return "i
|
|
393
|
+
return f"i{prefix}_{next(self._variable_counters[sort])}"
|
|
392
394
|
|
|
393
395
|
def add_variable(self, sort, start, variable: SimVariable):
|
|
394
396
|
if sort == "stack":
|
|
@@ -670,9 +672,16 @@ class VariableManagerInternal(Serializable):
|
|
|
670
672
|
|
|
671
673
|
return accesses
|
|
672
674
|
|
|
675
|
+
@overload
|
|
676
|
+
def get_variables(self, sort: Literal["stack"], collapse_same_ident: bool = False) -> list[SimStackVariable]: ...
|
|
677
|
+
@overload
|
|
678
|
+
def get_variables(self, sort: Literal["reg"], collapse_same_ident: bool = False) -> list[SimRegisterVariable]: ...
|
|
679
|
+
@overload
|
|
673
680
|
def get_variables(
|
|
674
|
-
self, sort:
|
|
675
|
-
) -> list[
|
|
681
|
+
self, sort: None, collapse_same_ident: bool = False
|
|
682
|
+
) -> list[SimRegisterVariable | SimRegisterVariable]: ...
|
|
683
|
+
|
|
684
|
+
def get_variables(self, sort=None, collapse_same_ident=False):
|
|
676
685
|
"""
|
|
677
686
|
Get a list of variables.
|
|
678
687
|
|
|
@@ -695,9 +704,14 @@ class VariableManagerInternal(Serializable):
|
|
|
695
704
|
|
|
696
705
|
return variables
|
|
697
706
|
|
|
698
|
-
|
|
699
|
-
|
|
700
|
-
|
|
707
|
+
@overload
|
|
708
|
+
def get_unified_variables(self, sort: Literal["stack"]) -> list[SimStackVariable]: ...
|
|
709
|
+
@overload
|
|
710
|
+
def get_unified_variables(self, sort: Literal["reg"]) -> list[SimRegisterVariable]: ...
|
|
711
|
+
@overload
|
|
712
|
+
def get_unified_variables(self, sort: None) -> list[SimRegisterVariable | SimRegisterVariable]: ...
|
|
713
|
+
|
|
714
|
+
def get_unified_variables(self, sort=None):
|
|
701
715
|
"""
|
|
702
716
|
Get a list of unified variables.
|
|
703
717
|
|
|
@@ -10,13 +10,13 @@ class XRef(Serializable):
|
|
|
10
10
|
"""
|
|
11
11
|
|
|
12
12
|
__slots__ = (
|
|
13
|
-
"ins_addr",
|
|
14
13
|
"block_addr",
|
|
15
|
-
"
|
|
14
|
+
"dst",
|
|
15
|
+
"ins_addr",
|
|
16
16
|
"insn_op_idx",
|
|
17
17
|
"insn_op_type",
|
|
18
18
|
"memory_data",
|
|
19
|
-
"
|
|
19
|
+
"stmt_idx",
|
|
20
20
|
"type",
|
|
21
21
|
)
|
|
22
22
|
|
|
@@ -58,11 +58,8 @@ class XRef(Serializable):
|
|
|
58
58
|
dst_str = hex(self.memory_data.addr)
|
|
59
59
|
else:
|
|
60
60
|
dst_str = "unknown"
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
f"{self.ins_addr:#x}" if self.ins_addr is not None else "%#x[%d]" % (self.block_addr, self.stmt_idx),
|
|
64
|
-
dst_str,
|
|
65
|
-
)
|
|
61
|
+
ins_addr_str = f"{self.ins_addr:#x}" if self.ins_addr is not None else f"{self.block_addr:#x}[{self.stmt_idx}]"
|
|
62
|
+
return f"<XRef {self.type_string}: {ins_addr_str}->{dst_str}>"
|
|
66
63
|
|
|
67
64
|
def __eq__(self, other):
|
|
68
65
|
return (
|
angr/misc/__init__.py
CHANGED
angr/misc/hookset.py
CHANGED
|
@@ -85,11 +85,10 @@ class HookedMethod:
|
|
|
85
85
|
self.pending = []
|
|
86
86
|
|
|
87
87
|
def __repr__(self):
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
)
|
|
88
|
+
class_name = self.func.__self__.__class__.__name__
|
|
89
|
+
func_name = self.func.__name__
|
|
90
|
+
pending_count = len(self.pending)
|
|
91
|
+
return f"<HookedMethod({class_name}.{func_name}, {pending_count} pending)>"
|
|
93
92
|
|
|
94
93
|
def __call__(self, *args, **kwargs):
|
|
95
94
|
if self.pending:
|
angr/misc/loggers.py
CHANGED
angr/misc/telemetry.py
CHANGED
angr/procedures/__init__.py
CHANGED
angr/procedures/cgc/fdwait.py
CHANGED
|
@@ -23,7 +23,7 @@ class fdwait(angr.SimProcedure):
|
|
|
23
23
|
sym_bit = claripy.BVV(1, 1)
|
|
24
24
|
else:
|
|
25
25
|
sym_bit = self.state.solver.Unconstrained(
|
|
26
|
-
"fdwait_read_
|
|
26
|
+
f"fdwait_read_{run_count}_{fd}", 1, key=("syscall", "fdwait", fd, "read_ready")
|
|
27
27
|
)
|
|
28
28
|
fd = claripy.BVV(fd, self.state.arch.bits)
|
|
29
29
|
sym_newbit = claripy.If(claripy.ULT(fd, nfds), sym_bit, 0)
|
|
@@ -40,7 +40,7 @@ class fdwait(angr.SimProcedure):
|
|
|
40
40
|
sym_bit = claripy.BVV(1, 1)
|
|
41
41
|
else:
|
|
42
42
|
sym_bit = self.state.solver.Unconstrained(
|
|
43
|
-
"fdwait_write_
|
|
43
|
+
f"fdwait_write_{run_count}_{fd}", 1, key=("syscall", "fdwait", fd, "write_ready")
|
|
44
44
|
)
|
|
45
45
|
|
|
46
46
|
fd = claripy.BVV(fd, self.state.arch.bits)
|