angr 9.2.131__py3-none-manylinux2014_x86_64.whl → 9.2.132__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +1 -1
- angr/analyses/analysis.py +6 -2
- angr/analyses/cfg/cfg_emulated.py +5 -5
- angr/analyses/cfg/cfg_fast.py +2 -2
- angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +139 -94
- angr/analyses/cfg/indirect_jump_resolvers/x86_elf_pic_plt.py +1 -1
- angr/analyses/ddg.py +14 -11
- angr/analyses/decompiler/ail_simplifier.py +3 -2
- angr/analyses/decompiler/block_simplifier.py +10 -21
- angr/analyses/decompiler/clinic.py +108 -34
- angr/analyses/decompiler/condition_processor.py +12 -10
- angr/analyses/decompiler/dephication/graph_rewriting.py +1 -1
- angr/analyses/decompiler/dephication/rewriting_engine.py +169 -45
- angr/analyses/decompiler/dephication/seqnode_dephication.py +5 -4
- angr/analyses/decompiler/optimization_passes/const_derefs.py +1 -0
- angr/analyses/decompiler/optimization_passes/div_simplifier.py +41 -16
- angr/analyses/decompiler/optimization_passes/engine_base.py +261 -83
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +173 -35
- angr/analyses/decompiler/optimization_passes/mod_simplifier.py +5 -2
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +39 -19
- angr/analyses/decompiler/peephole_optimizations/remove_noop_conversions.py +2 -0
- angr/analyses/decompiler/ssailification/rewriting.py +1 -2
- angr/analyses/decompiler/ssailification/rewriting_engine.py +138 -55
- angr/analyses/decompiler/ssailification/ssailification.py +2 -1
- angr/analyses/decompiler/ssailification/traversal.py +4 -6
- angr/analyses/decompiler/ssailification/traversal_engine.py +125 -42
- angr/analyses/decompiler/structured_codegen/c.py +5 -3
- angr/analyses/decompiler/structuring/phoenix.py +26 -9
- angr/analyses/decompiler/structuring/structurer_nodes.py +9 -0
- angr/analyses/deobfuscator/irsb_reg_collector.py +29 -60
- angr/analyses/deobfuscator/string_obf_finder.py +2 -2
- angr/analyses/init_finder.py +47 -22
- angr/analyses/propagator/engine_base.py +21 -14
- angr/analyses/propagator/engine_vex.py +149 -179
- angr/analyses/propagator/propagator.py +10 -28
- angr/analyses/propagator/top_checker_mixin.py +211 -5
- angr/analyses/propagator/vex_vars.py +1 -1
- angr/analyses/reaching_definitions/dep_graph.py +1 -1
- angr/analyses/reaching_definitions/engine_ail.py +304 -329
- angr/analyses/reaching_definitions/engine_vex.py +243 -229
- angr/analyses/reaching_definitions/function_handler.py +3 -3
- angr/analyses/reaching_definitions/rd_state.py +37 -32
- angr/analyses/s_propagator.py +18 -3
- angr/analyses/s_reaching_definitions/s_reaching_definitions.py +9 -5
- angr/analyses/typehoon/simple_solver.py +7 -5
- angr/analyses/typehoon/translator.py +8 -0
- angr/analyses/typehoon/typeconsts.py +10 -2
- angr/analyses/typehoon/typevars.py +9 -7
- angr/analyses/variable_recovery/engine_ail.py +299 -259
- angr/analyses/variable_recovery/engine_base.py +135 -117
- angr/analyses/variable_recovery/engine_vex.py +175 -185
- angr/analyses/variable_recovery/irsb_scanner.py +49 -38
- angr/analyses/variable_recovery/variable_recovery.py +28 -5
- angr/analyses/variable_recovery/variable_recovery_base.py +32 -33
- angr/analyses/variable_recovery/variable_recovery_fast.py +2 -2
- angr/analyses/xrefs.py +46 -19
- angr/annocfg.py +19 -14
- angr/block.py +4 -9
- angr/calling_conventions.py +1 -1
- angr/engines/engine.py +30 -14
- angr/engines/light/__init__.py +11 -3
- angr/engines/light/engine.py +1003 -1185
- angr/engines/pcode/cc.py +2 -0
- angr/engines/successors.py +13 -9
- angr/engines/vex/claripy/datalayer.py +1 -1
- angr/engines/vex/claripy/irop.py +1 -1
- angr/engines/vex/light/slicing.py +2 -2
- angr/exploration_techniques/__init__.py +1 -124
- angr/exploration_techniques/base.py +126 -0
- angr/exploration_techniques/bucketizer.py +1 -1
- angr/exploration_techniques/dfs.py +3 -1
- angr/exploration_techniques/director.py +2 -3
- angr/exploration_techniques/driller_core.py +1 -1
- angr/exploration_techniques/explorer.py +4 -2
- angr/exploration_techniques/lengthlimiter.py +2 -1
- angr/exploration_techniques/local_loop_seer.py +2 -1
- angr/exploration_techniques/loop_seer.py +5 -5
- angr/exploration_techniques/manual_mergepoint.py +2 -1
- angr/exploration_techniques/memory_watcher.py +3 -1
- angr/exploration_techniques/oppologist.py +4 -5
- angr/exploration_techniques/slicecutor.py +4 -2
- angr/exploration_techniques/spiller.py +1 -1
- angr/exploration_techniques/stochastic.py +2 -1
- angr/exploration_techniques/stub_stasher.py +2 -1
- angr/exploration_techniques/suggestions.py +3 -1
- angr/exploration_techniques/symbion.py +3 -1
- angr/exploration_techniques/tech_builder.py +2 -1
- angr/exploration_techniques/threading.py +4 -7
- angr/exploration_techniques/timeout.py +4 -2
- angr/exploration_techniques/tracer.py +4 -3
- angr/exploration_techniques/unique.py +3 -2
- angr/exploration_techniques/veritesting.py +1 -1
- angr/knowledge_plugins/key_definitions/atoms.py +2 -2
- angr/knowledge_plugins/key_definitions/live_definitions.py +16 -13
- angr/knowledge_plugins/propagations/states.py +13 -8
- angr/knowledge_plugins/variables/variable_manager.py +23 -9
- angr/sim_manager.py +1 -3
- angr/sim_state.py +39 -41
- angr/sim_type.py +5 -0
- angr/sim_variable.py +29 -28
- angr/utils/bits.py +12 -0
- angr/utils/orderedset.py +4 -1
- angr/utils/ssa/__init__.py +21 -3
- {angr-9.2.131.dist-info → angr-9.2.132.dist-info}/METADATA +6 -6
- {angr-9.2.131.dist-info → angr-9.2.132.dist-info}/RECORD +109 -110
- angr/analyses/propagator/engine_ail.py +0 -1562
- angr/storage/memory_mixins/__init__.pyi +0 -48
- {angr-9.2.131.dist-info → angr-9.2.132.dist-info}/LICENSE +0 -0
- {angr-9.2.131.dist-info → angr-9.2.132.dist-info}/WHEEL +0 -0
- {angr-9.2.131.dist-info → angr-9.2.132.dist-info}/entry_points.txt +0 -0
- {angr-9.2.131.dist-info → angr-9.2.132.dist-info}/top_level.txt +0 -0
angr/block.py
CHANGED
|
@@ -13,12 +13,9 @@ except ImportError:
|
|
|
13
13
|
|
|
14
14
|
from .protos import primitives_pb2 as pb2
|
|
15
15
|
from .serializable import Serializable
|
|
16
|
-
from .engines.vex import VEXLifter
|
|
17
16
|
|
|
18
17
|
l = logging.getLogger(name=__name__)
|
|
19
18
|
|
|
20
|
-
DEFAULT_VEX_ENGINE = VEXLifter(None) # this is only used when Block is not initialized with a project
|
|
21
|
-
|
|
22
19
|
|
|
23
20
|
class DisassemblerBlock:
|
|
24
21
|
"""
|
|
@@ -38,7 +35,7 @@ class DisassemblerBlock:
|
|
|
38
35
|
print(str(self))
|
|
39
36
|
|
|
40
37
|
def __str__(self):
|
|
41
|
-
return "\n".join(
|
|
38
|
+
return "\n".join(str(x) for x in self.insns)
|
|
42
39
|
|
|
43
40
|
def __repr__(self):
|
|
44
41
|
return f"<DisassemblerBlock for {self.addr:#x}>"
|
|
@@ -326,8 +323,6 @@ class Block(Serializable):
|
|
|
326
323
|
|
|
327
324
|
@property
|
|
328
325
|
def _vex_engine(self):
|
|
329
|
-
if self._project is None:
|
|
330
|
-
return DEFAULT_VEX_ENGINE
|
|
331
326
|
return self._project.factory.default_engine
|
|
332
327
|
|
|
333
328
|
@property
|
|
@@ -436,7 +431,7 @@ class Block(Serializable):
|
|
|
436
431
|
return self._bytes
|
|
437
432
|
|
|
438
433
|
@property
|
|
439
|
-
def instructions(self):
|
|
434
|
+
def instructions(self) -> int:
|
|
440
435
|
if not self._instructions and self._vex is None:
|
|
441
436
|
# initialize from VEX
|
|
442
437
|
_ = self.vex
|
|
@@ -457,7 +452,7 @@ class Block(Serializable):
|
|
|
457
452
|
|
|
458
453
|
@classmethod
|
|
459
454
|
def _get_cmsg(cls):
|
|
460
|
-
return pb2.Block()
|
|
455
|
+
return pb2.Block() # pylint: disable=no-member
|
|
461
456
|
|
|
462
457
|
def serialize_to_cmessage(self):
|
|
463
458
|
obj = self._get_cmsg()
|
|
@@ -490,7 +485,7 @@ class SootBlock:
|
|
|
490
485
|
@property
|
|
491
486
|
def _soot_engine(self):
|
|
492
487
|
if self._project is None:
|
|
493
|
-
|
|
488
|
+
assert False, "This should be unreachable"
|
|
494
489
|
return self._project.factory.default_engine
|
|
495
490
|
|
|
496
491
|
@property
|
angr/calling_conventions.py
CHANGED
|
@@ -229,7 +229,7 @@ class SimFunctionArgument:
|
|
|
229
229
|
:ivar bool is_fp: Whether loads from this location should return a floating point bitvector
|
|
230
230
|
"""
|
|
231
231
|
|
|
232
|
-
def __init__(self, size, is_fp=False):
|
|
232
|
+
def __init__(self, size: int, is_fp: bool = False):
|
|
233
233
|
self.size = size
|
|
234
234
|
self.is_fp = is_fp
|
|
235
235
|
|
angr/engines/engine.py
CHANGED
|
@@ -1,33 +1,44 @@
|
|
|
1
|
-
# pylint: disable=no-self-use,unused-private-member
|
|
2
1
|
from __future__ import annotations
|
|
3
2
|
|
|
3
|
+
from typing import Generic, TypeVar
|
|
4
4
|
import abc
|
|
5
5
|
import logging
|
|
6
6
|
import threading
|
|
7
7
|
|
|
8
|
+
|
|
8
9
|
from archinfo.arch_soot import SootAddressDescriptor
|
|
10
|
+
import claripy
|
|
9
11
|
|
|
10
12
|
import angr
|
|
13
|
+
from angr.sim_state import SimState
|
|
11
14
|
from angr import sim_options as o
|
|
12
15
|
from angr.errors import SimException
|
|
13
16
|
from angr.state_plugins.inspect import BP_AFTER, BP_BEFORE
|
|
14
|
-
|
|
15
17
|
from .successors import SimSuccessors
|
|
16
18
|
|
|
19
|
+
|
|
17
20
|
l = logging.getLogger(name=__name__)
|
|
18
21
|
|
|
19
22
|
|
|
20
|
-
|
|
23
|
+
StateType = TypeVar("StateType")
|
|
24
|
+
ResultType = TypeVar("ResultType")
|
|
25
|
+
DataType_co = TypeVar("DataType_co", covariant=True)
|
|
26
|
+
HeavyState = SimState[int | SootAddressDescriptor, claripy.ast.BV | SootAddressDescriptor]
|
|
27
|
+
|
|
28
|
+
|
|
29
|
+
class SimEngineBase(Generic[StateType]):
|
|
21
30
|
"""
|
|
22
31
|
Even more basey of a base class for SimEngine. Used as a base by mixins which want access to the project but for
|
|
23
32
|
which having method `process` (contained in `SimEngine`) doesn't make sense
|
|
24
33
|
"""
|
|
25
34
|
|
|
26
|
-
|
|
35
|
+
state: StateType
|
|
36
|
+
|
|
37
|
+
def __init__(self, project: angr.Project, **kwargs):
|
|
27
38
|
if kwargs:
|
|
28
39
|
raise TypeError("Unused initializer args: " + ", ".join(kwargs.keys()))
|
|
29
|
-
self.project
|
|
30
|
-
self.
|
|
40
|
+
self.project = project
|
|
41
|
+
self.arch = self.project.arch
|
|
31
42
|
|
|
32
43
|
__tls = ("state",)
|
|
33
44
|
|
|
@@ -36,16 +47,15 @@ class SimEngineBase:
|
|
|
36
47
|
|
|
37
48
|
def __setstate__(self, state):
|
|
38
49
|
self.project = state[0]
|
|
39
|
-
self.state = None
|
|
40
50
|
|
|
41
51
|
|
|
42
|
-
class SimEngine(SimEngineBase, metaclass=abc.ABCMeta):
|
|
52
|
+
class SimEngine(Generic[StateType, ResultType], SimEngineBase[StateType], metaclass=abc.ABCMeta):
|
|
43
53
|
"""
|
|
44
54
|
A SimEngine is a class which understands how to perform execution on a state. This is a base class.
|
|
45
55
|
"""
|
|
46
56
|
|
|
47
57
|
@abc.abstractmethod
|
|
48
|
-
def process(self, state, **kwargs):
|
|
58
|
+
def process(self, state: StateType, **kwargs) -> ResultType:
|
|
49
59
|
"""
|
|
50
60
|
The main entry point for an engine. Should take a state and return a result.
|
|
51
61
|
|
|
@@ -62,6 +72,8 @@ class TLSMixin:
|
|
|
62
72
|
MAGIC MAGIC MAGIC
|
|
63
73
|
"""
|
|
64
74
|
|
|
75
|
+
__local: threading.local # pylint: disable=unused-private-member
|
|
76
|
+
|
|
65
77
|
def __new__(cls, *args, **kwargs): # pylint:disable=unused-argument
|
|
66
78
|
obj = super().__new__(cls)
|
|
67
79
|
obj.__local = threading.local()
|
|
@@ -76,8 +88,9 @@ class TLSMixin:
|
|
|
76
88
|
attr = f"_{subcls.__name__}{attr}"
|
|
77
89
|
|
|
78
90
|
if hasattr(cls, attr):
|
|
79
|
-
|
|
80
|
-
|
|
91
|
+
assert (
|
|
92
|
+
type(getattr(cls, attr, None)) is TLSProperty
|
|
93
|
+
), f"Programming error: {attr} is both in __tls and __class__"
|
|
81
94
|
else:
|
|
82
95
|
setattr(cls, attr, TLSProperty(attr))
|
|
83
96
|
|
|
@@ -98,7 +111,7 @@ class TLSProperty: # pylint:disable=missing-class-docstring
|
|
|
98
111
|
delattr(instance._TLSMixin__local, self.name)
|
|
99
112
|
|
|
100
113
|
|
|
101
|
-
class SuccessorsMixin(SimEngine):
|
|
114
|
+
class SuccessorsMixin(SimEngine[HeavyState, SimSuccessors]):
|
|
102
115
|
"""
|
|
103
116
|
A mixin for SimEngine which implements ``process`` to perform common operations related to symbolic execution
|
|
104
117
|
and dispatches to a ``process_successors`` method to fill a SimSuccessors object with the results.
|
|
@@ -111,7 +124,7 @@ class SuccessorsMixin(SimEngine):
|
|
|
111
124
|
|
|
112
125
|
__tls = ("successors",)
|
|
113
126
|
|
|
114
|
-
def process(self, state
|
|
127
|
+
def process(self, state: HeavyState, **kwargs) -> SimSuccessors: # pylint:disable=unused-argument
|
|
115
128
|
"""
|
|
116
129
|
Perform execution with a state.
|
|
117
130
|
|
|
@@ -148,6 +161,7 @@ class SuccessorsMixin(SimEngine):
|
|
|
148
161
|
new_state.register_plugin("history", old_state.history.make_child())
|
|
149
162
|
new_state.history.recent_bbl_addrs.append(addr)
|
|
150
163
|
if new_state.arch.unicorn_support:
|
|
164
|
+
assert isinstance(addr, int)
|
|
151
165
|
new_state.scratch.executed_pages_set = {addr & ~0xFFF}
|
|
152
166
|
|
|
153
167
|
self.successors = SimSuccessors(addr, old_state)
|
|
@@ -161,10 +175,12 @@ class SuccessorsMixin(SimEngine):
|
|
|
161
175
|
except SimException as e:
|
|
162
176
|
if o.EXCEPTION_HANDLING not in old_state.options:
|
|
163
177
|
raise
|
|
178
|
+
assert old_state.project is not None
|
|
164
179
|
old_state.project.simos.handle_exception(self.successors, self, e)
|
|
165
180
|
|
|
166
181
|
new_state._inspect("engine_process", when=BP_AFTER, sim_successors=self.successors, address=addr)
|
|
167
182
|
self.successors = new_state._inspect_getattr("sim_successors", self.successors)
|
|
183
|
+
assert self.successors is not None
|
|
168
184
|
|
|
169
185
|
# downsizing
|
|
170
186
|
if new_state.supports_inspect:
|
|
@@ -183,7 +199,7 @@ class SuccessorsMixin(SimEngine):
|
|
|
183
199
|
|
|
184
200
|
return self.successors
|
|
185
201
|
|
|
186
|
-
def process_successors(self, successors, **kwargs): # pylint:disable=unused-argument
|
|
202
|
+
def process_successors(self, successors, **kwargs): # pylint:disable=unused-argument,no-self-use
|
|
187
203
|
"""
|
|
188
204
|
Implement this function to fill out the SimSuccessors object with the results of stepping state.
|
|
189
205
|
|
angr/engines/light/__init__.py
CHANGED
|
@@ -1,15 +1,23 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
2
|
|
|
3
3
|
from .data import ArithmeticExpression, SpOffset, RegisterOffset
|
|
4
|
-
from .engine import
|
|
4
|
+
from .engine import (
|
|
5
|
+
SimEngineLight,
|
|
6
|
+
SimEngineLightVEX,
|
|
7
|
+
SimEngineLightAIL,
|
|
8
|
+
SimEngineNostmtVEX,
|
|
9
|
+
SimEngineNostmtAIL,
|
|
10
|
+
SimEngineNoexprAIL,
|
|
11
|
+
)
|
|
5
12
|
|
|
6
13
|
__all__ = (
|
|
7
14
|
"ArithmeticExpression",
|
|
8
15
|
"SpOffset",
|
|
9
16
|
"RegisterOffset",
|
|
10
17
|
"SimEngineLight",
|
|
11
|
-
"SimEngineLightVEXMixin",
|
|
12
|
-
"SimEngineLightAILMixin",
|
|
13
18
|
"SimEngineLightVEX",
|
|
14
19
|
"SimEngineLightAIL",
|
|
20
|
+
"SimEngineNostmtVEX",
|
|
21
|
+
"SimEngineNostmtAIL",
|
|
22
|
+
"SimEngineNoexprAIL",
|
|
15
23
|
)
|