angr 9.2.132__py3-none-macosx_11_0_arm64.whl → 9.2.133__py3-none-macosx_11_0_arm64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +128 -128
- angr/analyses/__init__.py +38 -38
- angr/analyses/backward_slice.py +3 -4
- angr/analyses/binary_optimizer.py +5 -12
- angr/analyses/bindiff.py +3 -6
- angr/analyses/calling_convention.py +3 -4
- angr/analyses/cfg/__init__.py +3 -3
- angr/analyses/cfg/cfg_base.py +1 -1
- angr/analyses/cfg/cfg_fast.py +17 -15
- angr/analyses/cfg/indirect_jump_resolvers/__init__.py +5 -5
- angr/analyses/cfg/indirect_jump_resolvers/amd64_elf_got.py +1 -1
- angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +9 -7
- angr/analyses/data_dep/__init__.py +4 -4
- angr/analyses/datagraph_meta.py +1 -1
- angr/analyses/ddg.py +2 -6
- angr/analyses/decompiler/__init__.py +12 -12
- angr/analyses/decompiler/ail_simplifier.py +21 -10
- angr/analyses/decompiler/block_similarity.py +2 -4
- angr/analyses/decompiler/callsite_maker.py +1 -1
- angr/analyses/decompiler/ccall_rewriters/rewriter_base.py +1 -1
- angr/analyses/decompiler/clinic.py +14 -7
- angr/analyses/decompiler/condition_processor.py +45 -29
- angr/analyses/decompiler/counters/__init__.py +3 -3
- angr/analyses/decompiler/decompilation_cache.py +7 -7
- angr/analyses/decompiler/dephication/__init__.py +1 -1
- angr/analyses/decompiler/dephication/graph_vvar_mapping.py +11 -3
- angr/analyses/decompiler/expression_narrower.py +1 -1
- angr/analyses/decompiler/graph_region.py +8 -8
- angr/analyses/decompiler/optimization_passes/__init__.py +20 -20
- angr/analyses/decompiler/optimization_passes/deadblock_remover.py +1 -2
- angr/analyses/decompiler/optimization_passes/duplication_reverter/duplication_reverter.py +8 -7
- angr/analyses/decompiler/optimization_passes/duplication_reverter/utils.py +1 -3
- angr/analyses/decompiler/optimization_passes/engine_base.py +1 -1
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +2 -4
- angr/analyses/decompiler/optimization_passes/ite_region_converter.py +2 -5
- angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +5 -5
- angr/analyses/decompiler/optimization_passes/mod_simplifier.py +9 -3
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +3 -0
- angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py +9 -5
- angr/analyses/decompiler/peephole_optimizations/__init__.py +1 -1
- angr/analyses/decompiler/peephole_optimizations/base.py +6 -6
- angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py +1 -1
- angr/analyses/decompiler/presets/__init__.py +1 -1
- angr/analyses/decompiler/region_simplifiers/expr_folding.py +3 -3
- angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +8 -12
- angr/analyses/decompiler/ssailification/rewriting_engine.py +1 -1
- angr/analyses/decompiler/structured_codegen/__init__.py +5 -5
- angr/analyses/decompiler/structured_codegen/base.py +3 -3
- angr/analyses/decompiler/structured_codegen/c.py +34 -37
- angr/analyses/decompiler/structuring/__init__.py +3 -3
- angr/analyses/decompiler/structuring/phoenix.py +19 -20
- angr/analyses/decompiler/structuring/structurer_base.py +2 -2
- angr/analyses/decompiler/structuring/structurer_nodes.py +14 -14
- angr/analyses/deobfuscator/__init__.py +3 -3
- angr/analyses/deobfuscator/string_obf_opt_passes.py +1 -1
- angr/analyses/disassembly.py +4 -4
- angr/analyses/forward_analysis/__init__.py +1 -1
- angr/analyses/forward_analysis/visitors/graph.py +6 -6
- angr/analyses/loop_analysis.py +1 -1
- angr/analyses/loopfinder.py +1 -1
- angr/analyses/propagator/outdated_definition_walker.py +12 -6
- angr/analyses/propagator/vex_vars.py +3 -3
- angr/analyses/reaching_definitions/__init__.py +9 -9
- angr/analyses/reaching_definitions/call_trace.py +2 -2
- angr/analyses/reaching_definitions/function_handler_library/__init__.py +1 -1
- angr/analyses/reaching_definitions/rd_state.py +10 -10
- angr/analyses/reassembler.py +26 -31
- angr/analyses/s_liveness.py +8 -0
- angr/analyses/s_reaching_definitions/s_rda_view.py +2 -5
- angr/analyses/stack_pointer_tracker.py +4 -4
- angr/analyses/typehoon/simple_solver.py +7 -9
- angr/analyses/typehoon/translator.py +2 -2
- angr/analyses/typehoon/typeconsts.py +1 -1
- angr/analyses/typehoon/typevars.py +17 -19
- angr/analyses/unpacker/__init__.py +1 -1
- angr/analyses/variable_recovery/engine_base.py +3 -4
- angr/analyses/variable_recovery/variable_recovery_base.py +1 -1
- angr/analyses/variable_recovery/variable_recovery_fast.py +2 -6
- angr/analyses/veritesting.py +2 -2
- angr/analyses/vfg.py +5 -5
- angr/angrdb/serializers/__init__.py +1 -1
- angr/annocfg.py +1 -1
- angr/blade.py +2 -2
- angr/block.py +16 -16
- angr/calling_conventions.py +11 -13
- angr/code_location.py +6 -10
- angr/codenode.py +3 -3
- angr/engines/__init__.py +12 -14
- angr/engines/engine.py +1 -54
- angr/engines/light/__init__.py +4 -4
- angr/engines/light/data.py +1 -1
- angr/engines/pcode/__init__.py +1 -1
- angr/engines/pcode/behavior.py +1 -1
- angr/engines/pcode/lifter.py +13 -15
- angr/engines/soot/expressions/__init__.py +12 -12
- angr/engines/soot/statements/__init__.py +6 -6
- angr/engines/soot/values/__init__.py +6 -6
- angr/engines/soot/values/arrayref.py +2 -2
- angr/engines/soot/values/constants.py +1 -1
- angr/engines/soot/values/instancefieldref.py +1 -1
- angr/engines/soot/values/paramref.py +1 -1
- angr/engines/soot/values/staticfieldref.py +1 -1
- angr/engines/successors.py +2 -5
- angr/engines/vex/__init__.py +5 -5
- angr/engines/vex/claripy/ccall.py +2 -2
- angr/engines/vex/claripy/irop.py +18 -18
- angr/engines/vex/heavy/__init__.py +2 -2
- angr/engines/vex/heavy/actions.py +1 -3
- angr/engines/vex/heavy/heavy.py +4 -6
- angr/engines/vex/lifter.py +2 -4
- angr/engines/vex/light/light.py +0 -2
- angr/engines/vex/light/slicing.py +3 -3
- angr/exploration_techniques/__init__.py +18 -18
- angr/exploration_techniques/threading.py +0 -6
- angr/factory.py +36 -6
- angr/keyed_region.py +4 -4
- angr/knowledge_base.py +1 -1
- angr/knowledge_plugins/__init__.py +11 -11
- angr/knowledge_plugins/cfg/__init__.py +5 -5
- angr/knowledge_plugins/cfg/cfg_manager.py +2 -2
- angr/knowledge_plugins/cfg/cfg_model.py +8 -8
- angr/knowledge_plugins/cfg/cfg_node.py +19 -19
- angr/knowledge_plugins/cfg/indirect_jump.py +6 -6
- angr/knowledge_plugins/cfg/memory_data.py +5 -7
- angr/knowledge_plugins/functions/function.py +48 -52
- angr/knowledge_plugins/functions/function_parser.py +4 -4
- angr/knowledge_plugins/key_definitions/__init__.py +3 -3
- angr/knowledge_plugins/key_definitions/atoms.py +6 -6
- angr/knowledge_plugins/key_definitions/definition.py +1 -1
- angr/knowledge_plugins/key_definitions/live_definitions.py +14 -14
- angr/knowledge_plugins/labels.py +1 -1
- angr/knowledge_plugins/propagations/__init__.py +1 -1
- angr/knowledge_plugins/propagations/prop_value.py +2 -2
- angr/knowledge_plugins/propagations/propagation_model.py +7 -8
- angr/knowledge_plugins/propagations/states.py +31 -31
- angr/knowledge_plugins/variables/variable_access.py +2 -2
- angr/knowledge_plugins/variables/variable_manager.py +1 -1
- angr/knowledge_plugins/xrefs/xref.py +5 -8
- angr/lib/angr_native.dylib +0 -0
- angr/misc/__init__.py +4 -4
- angr/misc/hookset.py +4 -5
- angr/misc/loggers.py +2 -2
- angr/misc/telemetry.py +1 -1
- angr/procedures/__init__.py +1 -1
- angr/procedures/cgc/fdwait.py +2 -2
- angr/procedures/definitions/__init__.py +2 -2
- angr/procedures/definitions/linux_kernel.py +0 -1
- angr/procedures/definitions/parse_syscalls_from_local_system.py +1 -1
- angr/procedures/definitions/parse_win32json.py +0 -1
- angr/procedures/ntdll/exceptions.py +1 -1
- angr/procedures/stubs/format_parser.py +3 -3
- angr/procedures/win32/dynamic_loading.py +1 -1
- angr/protos/__init__.py +3 -3
- angr/sim_manager.py +2 -2
- angr/sim_state.py +1 -1
- angr/sim_state_options.py +3 -3
- angr/sim_type.py +10 -14
- angr/sim_variable.py +13 -17
- angr/simos/__init__.py +4 -4
- angr/simos/cgc.py +1 -1
- angr/simos/simos.py +1 -1
- angr/simos/userland.py +1 -1
- angr/slicer.py +4 -7
- angr/state_plugins/__init__.py +34 -34
- angr/state_plugins/callstack.py +5 -12
- angr/state_plugins/heap/__init__.py +2 -2
- angr/state_plugins/heap/heap_brk.py +2 -4
- angr/state_plugins/heap/heap_ptmalloc.py +1 -1
- angr/state_plugins/jni_references.py +3 -2
- angr/state_plugins/scratch.py +1 -1
- angr/state_plugins/sim_action.py +1 -4
- angr/state_plugins/sim_event.py +1 -1
- angr/state_plugins/solver.py +7 -9
- angr/state_plugins/uc_manager.py +1 -1
- angr/state_plugins/view.py +2 -2
- angr/storage/__init__.py +1 -1
- angr/storage/file.py +10 -10
- angr/storage/memory_mixins/__init__.py +46 -46
- angr/storage/memory_mixins/default_filler_mixin.py +1 -3
- angr/storage/memory_mixins/javavm_memory_mixin.py +2 -2
- angr/storage/memory_mixins/name_resolution_mixin.py +2 -2
- angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +1 -3
- angr/storage/memory_mixins/paged_memory/pages/__init__.py +6 -6
- angr/storage/memory_mixins/paged_memory/pages/list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/multi_values.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +2 -4
- angr/storage/memory_mixins/regioned_memory/__init__.py +3 -3
- angr/storage/memory_mixins/regioned_memory/region_data.py +5 -5
- angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +7 -9
- angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +4 -4
- angr/storage/memory_object.py +4 -4
- angr/utils/__init__.py +3 -3
- angr/utils/dynamic_dictlist.py +1 -1
- angr/utils/graph.py +1 -1
- angr/utils/segment_list.py +2 -2
- angr/utils/ssa/__init__.py +12 -5
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/METADATA +6 -6
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/RECORD +203 -203
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/LICENSE +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/WHEEL +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/entry_points.txt +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/top_level.txt +0 -0
|
@@ -1701,7 +1701,7 @@ def armg_calculate_condition(state, cond_n_op, cc_dep1, cc_dep2, cc_dep3):
|
|
|
1701
1701
|
return flag
|
|
1702
1702
|
|
|
1703
1703
|
l.error("Unrecognized condition %d in armg_calculate_condition", concrete_cond)
|
|
1704
|
-
raise SimCCallError("Unrecognized condition
|
|
1704
|
+
raise SimCCallError(f"Unrecognized condition {concrete_cond} in armg_calculate_condition")
|
|
1705
1705
|
|
|
1706
1706
|
|
|
1707
1707
|
ARM64G_CC_SHIFT_N = 31
|
|
@@ -1991,7 +1991,7 @@ def arm64g_calculate_condition(state, cond_n_op, cc_dep1, cc_dep2, cc_dep3):
|
|
|
1991
1991
|
return flag
|
|
1992
1992
|
|
|
1993
1993
|
l.error("Unrecognized condition %d in arm64g_calculate_condition", concrete_cond)
|
|
1994
|
-
raise SimCCallError("Unrecognized condition
|
|
1994
|
+
raise SimCCallError(f"Unrecognized condition {concrete_cond} in arm64g_calculate_condition")
|
|
1995
1995
|
|
|
1996
1996
|
|
|
1997
1997
|
#
|
angr/engines/vex/claripy/irop.py
CHANGED
|
@@ -134,7 +134,7 @@ for _vec_lanewidth in (8, 16, 32, 64):
|
|
|
134
134
|
continue
|
|
135
135
|
|
|
136
136
|
# the regex thinks the I is an integral descriptor
|
|
137
|
-
explicit_attrs["Iop_InterleaveHI
|
|
137
|
+
explicit_attrs[f"Iop_InterleaveHI{_vec_lanewidth}x{_vec_count}"] = {
|
|
138
138
|
"generic_name": "InterleaveHI",
|
|
139
139
|
"to_size": _vec_width,
|
|
140
140
|
"vector_size": _vec_lanewidth,
|
|
@@ -220,29 +220,29 @@ class SimIROp:
|
|
|
220
220
|
"""
|
|
221
221
|
|
|
222
222
|
__slots__ = (
|
|
223
|
-
"
|
|
224
|
-
"
|
|
225
|
-
"
|
|
226
|
-
"_from_size",
|
|
223
|
+
"_calculate",
|
|
224
|
+
"_conversion",
|
|
225
|
+
"_float",
|
|
227
226
|
"_from_side",
|
|
228
|
-
"_from_type",
|
|
229
227
|
"_from_signed",
|
|
230
|
-
"
|
|
231
|
-
"
|
|
232
|
-
"
|
|
228
|
+
"_from_size",
|
|
229
|
+
"_from_type",
|
|
230
|
+
"_generic_name",
|
|
231
|
+
"_output_size_bits",
|
|
232
|
+
"_output_type",
|
|
233
|
+
"_rounding_mode",
|
|
233
234
|
"_set_side",
|
|
234
235
|
"_set_size",
|
|
235
|
-
"
|
|
236
|
-
"
|
|
236
|
+
"_to_signed",
|
|
237
|
+
"_to_size",
|
|
238
|
+
"_to_type",
|
|
239
|
+
"_vector_count",
|
|
237
240
|
"_vector_signed",
|
|
241
|
+
"_vector_size",
|
|
238
242
|
"_vector_type",
|
|
239
243
|
"_vector_zero",
|
|
240
|
-
"
|
|
241
|
-
"
|
|
242
|
-
"_output_type",
|
|
243
|
-
"_output_size_bits",
|
|
244
|
-
"_float",
|
|
245
|
-
"_calculate",
|
|
244
|
+
"name",
|
|
245
|
+
"op_attrs",
|
|
246
246
|
)
|
|
247
247
|
|
|
248
248
|
def __init__(self, name, **attrs):
|
|
@@ -567,7 +567,7 @@ class SimIROp:
|
|
|
567
567
|
"""
|
|
568
568
|
arg_num = len(args)
|
|
569
569
|
if arg_num != 1:
|
|
570
|
-
raise SimOperationError("expect exactly one vector to be duplicated, got
|
|
570
|
+
raise SimOperationError(f"expect exactly one vector to be duplicated, got {arg_num}")
|
|
571
571
|
# Duplicate the vector for this many times
|
|
572
572
|
vector_count = self._vector_count
|
|
573
573
|
# Keep a copy of the vector to be duplicated
|
|
@@ -14,8 +14,6 @@ class TrackActionsMixin(HeavyVEXMixin):
|
|
|
14
14
|
|
|
15
15
|
self.__tmp_deps = {}
|
|
16
16
|
|
|
17
|
-
__tls = ("__tmp_deps",)
|
|
18
|
-
|
|
19
17
|
def _optimize_guarded_addr(self, addr, guard):
|
|
20
18
|
addr, addr_deps = addr
|
|
21
19
|
guard, _ = guard
|
|
@@ -150,7 +148,7 @@ class TrackActionsMixin(HeavyVEXMixin):
|
|
|
150
148
|
|
|
151
149
|
# statements
|
|
152
150
|
|
|
153
|
-
def _perform_vex_stmt_WrTmp(self, tmp, data_bundle, **kwargs):
|
|
151
|
+
def _perform_vex_stmt_WrTmp(self, tmp, data_bundle, **kwargs): # pylint:disable=unused-argument
|
|
154
152
|
data, data_deps = data_bundle
|
|
155
153
|
|
|
156
154
|
if o.TRACK_TMP_ACTIONS not in self.state.options:
|
angr/engines/vex/heavy/heavy.py
CHANGED
|
@@ -285,17 +285,15 @@ class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEX
|
|
|
285
285
|
if o.COPY_STATES not in self.state.options:
|
|
286
286
|
# very special logic to try to minimize copies
|
|
287
287
|
# first, check if this branch is impossible
|
|
288
|
-
if (
|
|
289
|
-
|
|
290
|
-
or o.LAZY_SOLVES not in self.state.options
|
|
288
|
+
if guard.is_false() or (
|
|
289
|
+
o.LAZY_SOLVES not in self.state.options
|
|
291
290
|
and not self.state.solver.satisfiable(extra_constraints=(guard,))
|
|
292
291
|
):
|
|
293
292
|
cont_state = self.state
|
|
294
293
|
|
|
295
294
|
# then, check if it's impossible to continue from this branch
|
|
296
|
-
elif (
|
|
297
|
-
|
|
298
|
-
or o.LAZY_SOLVES not in self.state.options
|
|
295
|
+
elif guard.is_true() or (
|
|
296
|
+
o.LAZY_SOLVES not in self.state.options
|
|
299
297
|
and not self.state.solver.satisfiable(extra_constraints=(claripy.Not(guard),))
|
|
300
298
|
):
|
|
301
299
|
exit_state = self.state
|
angr/engines/vex/lifter.py
CHANGED
|
@@ -384,10 +384,8 @@ class VEXLifter(SimEngineBase):
|
|
|
384
384
|
|
|
385
385
|
def __is_stop_point(self, addr, extra_stop_points=None):
|
|
386
386
|
return bool(
|
|
387
|
-
self.project is not None
|
|
388
|
-
and addr in
|
|
389
|
-
or extra_stop_points is not None
|
|
390
|
-
and addr in extra_stop_points
|
|
387
|
+
(self.project is not None and addr in self.project._sim_procedures)
|
|
388
|
+
or (extra_stop_points is not None and addr in extra_stop_points)
|
|
391
389
|
)
|
|
392
390
|
|
|
393
391
|
def __getstate__(self):
|
angr/engines/vex/light/light.py
CHANGED
|
@@ -22,8 +22,6 @@ class VEXMixin(SimEngineBase):
|
|
|
22
22
|
self.stmt_idx = None
|
|
23
23
|
self.tmps = None
|
|
24
24
|
|
|
25
|
-
__tls = ("irsb", "stmt_idx", "tmps")
|
|
26
|
-
|
|
27
25
|
def __init_handlers(self):
|
|
28
26
|
self._vex_expr_handlers = [None] * pyvex.expr.tag_count
|
|
29
27
|
self._vex_stmt_handlers = [None] * pyvex.stmt.tag_count
|
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
|
|
2
|
+
|
|
3
3
|
from angr.utils.constants import DEFAULT_STATEMENT
|
|
4
4
|
|
|
5
|
+
from .light import VEXMixin
|
|
6
|
+
|
|
5
7
|
|
|
6
8
|
class VEXSlicingMixin(VEXMixin):
|
|
7
9
|
def __init__(self, *args, **kwargs):
|
|
@@ -12,8 +14,6 @@ class VEXSlicingMixin(VEXMixin):
|
|
|
12
14
|
self._last_stmt = None
|
|
13
15
|
self._whitelist = None
|
|
14
16
|
|
|
15
|
-
__tls = ("__no_exit_sliced", "_skip_stmts", "_last_stmt", "_whitelist")
|
|
16
|
-
|
|
17
17
|
def process(self, state, block=None, skip_stmts=0, last_stmt=None, whitelist=None, **kwargs):
|
|
18
18
|
self._skip_stmts = skip_stmts
|
|
19
19
|
self._last_stmt = last_stmt
|
|
@@ -26,30 +26,30 @@ from .suggestions import Suggestions
|
|
|
26
26
|
from .stub_stasher import StubStasher
|
|
27
27
|
|
|
28
28
|
__all__ = (
|
|
29
|
-
"
|
|
30
|
-
"
|
|
29
|
+
"DFS",
|
|
30
|
+
"Bucketizer",
|
|
31
|
+
"CallFunctionGoal",
|
|
32
|
+
"Director",
|
|
31
33
|
"DrillerCore",
|
|
32
|
-
"
|
|
33
|
-
"
|
|
34
|
+
"ExecuteAddressGoal",
|
|
35
|
+
"ExplorationTechnique",
|
|
34
36
|
"Explorer",
|
|
35
|
-
"Threading",
|
|
36
|
-
"DFS",
|
|
37
37
|
"LengthLimiter",
|
|
38
|
-
"
|
|
38
|
+
"LocalLoopSeer",
|
|
39
|
+
"LoopSeer",
|
|
40
|
+
"ManualMergepoint",
|
|
41
|
+
"MemoryWatcher",
|
|
39
42
|
"Oppologist",
|
|
40
|
-
"
|
|
41
|
-
"ExecuteAddressGoal",
|
|
42
|
-
"CallFunctionGoal",
|
|
43
|
+
"Slicecutor",
|
|
43
44
|
"Spiller",
|
|
44
|
-
"ManualMergepoint",
|
|
45
|
-
"TechniqueBuilder",
|
|
46
45
|
"StochasticSearch",
|
|
47
|
-
"
|
|
46
|
+
"StubStasher",
|
|
47
|
+
"Suggestions",
|
|
48
48
|
"Symbion",
|
|
49
|
-
"
|
|
50
|
-
"
|
|
51
|
-
"LocalLoopSeer",
|
|
49
|
+
"TechniqueBuilder",
|
|
50
|
+
"Threading",
|
|
52
51
|
"Timeout",
|
|
53
|
-
"
|
|
54
|
-
"
|
|
52
|
+
"Tracer",
|
|
53
|
+
"UniqueSearch",
|
|
54
|
+
"Veritesting",
|
|
55
55
|
)
|
|
@@ -67,9 +67,3 @@ class Threading(ExplorationTechnique):
|
|
|
67
67
|
error_list = []
|
|
68
68
|
simgr.step(stash=self.local_stash, error_list=error_list, **kwargs)
|
|
69
69
|
return state, error_list, simgr
|
|
70
|
-
|
|
71
|
-
def successors(self, simgr, state, engine=None, **kwargs):
|
|
72
|
-
if engine is not None:
|
|
73
|
-
l.warning("Threading exploration teqchnique does not support custom engines")
|
|
74
|
-
engine = engine or self.project.factory.default_engine
|
|
75
|
-
return simgr.successors(state, engine=engine, **kwargs)
|
angr/factory.py
CHANGED
|
@@ -1,6 +1,9 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
|
|
2
|
+
|
|
3
3
|
import logging
|
|
4
|
+
import threading
|
|
5
|
+
from typing import overload, TYPE_CHECKING
|
|
6
|
+
|
|
4
7
|
import archinfo
|
|
5
8
|
from archinfo.arch_soot import ArchSoot, SootAddressDescriptor
|
|
6
9
|
|
|
@@ -8,7 +11,7 @@ from .sim_state import SimState
|
|
|
8
11
|
from .calling_conventions import default_cc, SimRegArg, SimStackArg, PointerWrapper, SimCCUnknown
|
|
9
12
|
from .callable import Callable
|
|
10
13
|
from .errors import AngrAssemblyError, AngrError
|
|
11
|
-
from .engines import UberEngine, ProcedureEngine, SimEngineConcrete
|
|
14
|
+
from .engines import UberEngine, ProcedureEngine, SimEngineConcrete
|
|
12
15
|
from .sim_type import SimTypeFunction, SimTypeInt
|
|
13
16
|
from .codenode import HookNode, SyscallNode
|
|
14
17
|
from .block import Block, SootBlock
|
|
@@ -20,6 +23,10 @@ try:
|
|
|
20
23
|
except ImportError:
|
|
21
24
|
UberEnginePcode = None
|
|
22
25
|
|
|
26
|
+
if TYPE_CHECKING:
|
|
27
|
+
from angr import Project, SimCC
|
|
28
|
+
from angr.engines import SimEngine
|
|
29
|
+
|
|
23
30
|
|
|
24
31
|
l = logging.getLogger(name=__name__)
|
|
25
32
|
|
|
@@ -29,15 +36,26 @@ class AngrObjectFactory:
|
|
|
29
36
|
This factory provides access to important analysis elements.
|
|
30
37
|
"""
|
|
31
38
|
|
|
39
|
+
project: Project
|
|
40
|
+
default_engine_factory: type[SimEngine]
|
|
41
|
+
procedure_engine: ProcedureEngine
|
|
42
|
+
concrete_engine: SimEngineConcrete | None
|
|
43
|
+
_default_cc: type[SimCC] | None
|
|
44
|
+
|
|
45
|
+
# We use thread local storage to cache engines on a per-thread basis
|
|
46
|
+
_tls: threading.local
|
|
47
|
+
|
|
32
48
|
def __init__(self, project, default_engine: type[SimEngine] | None = None):
|
|
49
|
+
self._tls = threading.local()
|
|
50
|
+
|
|
33
51
|
if default_engine is None:
|
|
34
52
|
if isinstance(project.arch, archinfo.ArchPcode) and UberEnginePcode is not None:
|
|
35
53
|
l.warning("Creating project with the experimental 'UberEnginePcode' engine")
|
|
36
|
-
|
|
54
|
+
self.default_engine_factory = UberEnginePcode
|
|
37
55
|
else:
|
|
38
|
-
|
|
56
|
+
self.default_engine_factory = UberEngine
|
|
39
57
|
else:
|
|
40
|
-
|
|
58
|
+
self.default_engine_factory = default_engine
|
|
41
59
|
|
|
42
60
|
if isinstance(project.arch, archinfo.ArchPcode):
|
|
43
61
|
register_pcode_arch_default_cc(project.arch)
|
|
@@ -46,7 +64,6 @@ class AngrObjectFactory:
|
|
|
46
64
|
self._default_cc = default_cc(
|
|
47
65
|
project.arch.name, platform=project.simos.name if project.simos is not None else None, default=SimCCUnknown
|
|
48
66
|
)
|
|
49
|
-
self.default_engine = default_engine_n(project)
|
|
50
67
|
self.procedure_engine = ProcedureEngine(project)
|
|
51
68
|
|
|
52
69
|
if project.concrete_target:
|
|
@@ -54,6 +71,19 @@ class AngrObjectFactory:
|
|
|
54
71
|
else:
|
|
55
72
|
self.concrete_engine = None
|
|
56
73
|
|
|
74
|
+
def __getstate__(self):
|
|
75
|
+
return self.project, self.default_engine_factory, self.procedure_engine, self.concrete_engine, self._default_cc
|
|
76
|
+
|
|
77
|
+
def __setstate__(self, state):
|
|
78
|
+
self.project, self.default_engine_factory, self.procedure_engine, self.concrete_engine, self._default_cc = state
|
|
79
|
+
self._tls = threading.local()
|
|
80
|
+
|
|
81
|
+
@property
|
|
82
|
+
def default_engine(self):
|
|
83
|
+
if not hasattr(self._tls, "default_engine"):
|
|
84
|
+
self._tls.default_engine = self.default_engine_factory(self.project)
|
|
85
|
+
return self._tls.default_engine
|
|
86
|
+
|
|
57
87
|
def snippet(self, addr, jumpkind=None, **block_opts):
|
|
58
88
|
if self.project.is_hooked(addr) and jumpkind != "Ijk_NoHook":
|
|
59
89
|
hook = self.project._sim_procedures[addr]
|
angr/keyed_region.py
CHANGED
|
@@ -13,7 +13,7 @@ l = logging.getLogger(name=__name__)
|
|
|
13
13
|
|
|
14
14
|
|
|
15
15
|
class StoredObject:
|
|
16
|
-
__slots__ = ("__weakref__", "
|
|
16
|
+
__slots__ = ("__weakref__", "obj", "size", "start")
|
|
17
17
|
|
|
18
18
|
def __init__(self, start, obj, size):
|
|
19
19
|
self.start = start
|
|
@@ -41,7 +41,7 @@ class RegionObject:
|
|
|
41
41
|
Represents one or more objects occupying one or more bytes in KeyedRegion.
|
|
42
42
|
"""
|
|
43
43
|
|
|
44
|
-
__slots__ = ("
|
|
44
|
+
__slots__ = ("_internal_objects", "size", "start", "stored_objects")
|
|
45
45
|
|
|
46
46
|
def __init__(self, start, size, objects=None):
|
|
47
47
|
self.start = start
|
|
@@ -114,10 +114,10 @@ class KeyedRegion:
|
|
|
114
114
|
"""
|
|
115
115
|
|
|
116
116
|
__slots__ = (
|
|
117
|
-
"
|
|
117
|
+
"_canonical_size",
|
|
118
118
|
"_object_mapping",
|
|
119
119
|
"_phi_node_contains",
|
|
120
|
-
"
|
|
120
|
+
"_storage",
|
|
121
121
|
)
|
|
122
122
|
|
|
123
123
|
def __init__(self, tree=None, phi_node_contains=None, canonical_size=8):
|
angr/knowledge_base.py
CHANGED
|
@@ -49,7 +49,7 @@ class KnowledgeBase:
|
|
|
49
49
|
object.__setattr__(self, "_project", project)
|
|
50
50
|
object.__setattr__(self, "_plugins", {})
|
|
51
51
|
|
|
52
|
-
self.name = name if name else
|
|
52
|
+
self.name = name if name else f"kb_{next(kb_ctr)}"
|
|
53
53
|
|
|
54
54
|
@property
|
|
55
55
|
def callgraph(self):
|
|
@@ -21,23 +21,23 @@ from .obfuscations import Obfuscations
|
|
|
21
21
|
|
|
22
22
|
|
|
23
23
|
__all__ = (
|
|
24
|
-
"
|
|
25
|
-
"
|
|
26
|
-
"VariableManager",
|
|
27
|
-
"DebugVariableManager",
|
|
24
|
+
"CFGManager",
|
|
25
|
+
"CallsitePrototypes",
|
|
28
26
|
"Comments",
|
|
27
|
+
"CustomStrings",
|
|
29
28
|
"Data",
|
|
29
|
+
"DebugVariableManager",
|
|
30
|
+
"Function",
|
|
31
|
+
"FunctionManager",
|
|
30
32
|
"IndirectJumps",
|
|
31
|
-
"
|
|
32
|
-
"CFGManager",
|
|
33
|
-
"XRefManager",
|
|
33
|
+
"KeyDefinitionManager",
|
|
34
34
|
"KnowledgeBasePlugin",
|
|
35
|
+
"Labels",
|
|
36
|
+
"Obfuscations",
|
|
35
37
|
"PatchManager",
|
|
36
|
-
"KeyDefinitionManager",
|
|
37
38
|
"PropagationManager",
|
|
38
39
|
"StructuredCodeManager",
|
|
39
40
|
"TypesStore",
|
|
40
|
-
"
|
|
41
|
-
"
|
|
42
|
-
"Obfuscations",
|
|
41
|
+
"VariableManager",
|
|
42
|
+
"XRefManager",
|
|
43
43
|
)
|
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
2
|
|
|
3
3
|
__all__ = (
|
|
4
|
-
"MemoryDataSort",
|
|
5
|
-
"MemoryData",
|
|
6
|
-
"CFGNode",
|
|
7
4
|
"CFGENode",
|
|
5
|
+
"CFGManager",
|
|
6
|
+
"CFGModel",
|
|
7
|
+
"CFGNode",
|
|
8
8
|
"IndirectJump",
|
|
9
9
|
"IndirectJumpType",
|
|
10
|
-
"
|
|
11
|
-
"
|
|
10
|
+
"MemoryData",
|
|
11
|
+
"MemoryDataSort",
|
|
12
12
|
)
|
|
13
13
|
|
|
14
14
|
from .memory_data import MemoryDataSort, MemoryData
|
|
@@ -18,7 +18,7 @@ class CFGManager(KnowledgeBasePlugin):
|
|
|
18
18
|
self.cfgs = {}
|
|
19
19
|
|
|
20
20
|
def __repr__(self):
|
|
21
|
-
return "<CFGManager with
|
|
21
|
+
return f"<CFGManager with {len(self.cfgs)} CFGs>"
|
|
22
22
|
|
|
23
23
|
def __contains__(self, ident):
|
|
24
24
|
return ident in self.cfgs
|
|
@@ -42,7 +42,7 @@ class CFGManager(KnowledgeBasePlugin):
|
|
|
42
42
|
# find a unique ident
|
|
43
43
|
i = 0
|
|
44
44
|
while True:
|
|
45
|
-
ident = prefix
|
|
45
|
+
ident = f"{prefix}_{i}"
|
|
46
46
|
if ident not in self.cfgs:
|
|
47
47
|
break
|
|
48
48
|
i += 1
|
|
@@ -41,19 +41,19 @@ class CFGModel(Serializable):
|
|
|
41
41
|
"""
|
|
42
42
|
|
|
43
43
|
__slots__ = (
|
|
44
|
-
"ident",
|
|
45
|
-
"graph",
|
|
46
|
-
"jump_tables",
|
|
47
|
-
"memory_data",
|
|
48
|
-
"insn_addr_to_memory_data",
|
|
49
|
-
"_nodes_by_addr",
|
|
50
|
-
"_nodes",
|
|
51
44
|
"_cfg_manager",
|
|
52
45
|
"_iropt_level",
|
|
53
46
|
"_node_addrs",
|
|
47
|
+
"_nodes",
|
|
48
|
+
"_nodes_by_addr",
|
|
49
|
+
"edges_to_repair",
|
|
50
|
+
"graph",
|
|
51
|
+
"ident",
|
|
52
|
+
"insn_addr_to_memory_data",
|
|
54
53
|
"is_arm",
|
|
54
|
+
"jump_tables",
|
|
55
|
+
"memory_data",
|
|
55
56
|
"normalized",
|
|
56
|
-
"edges_to_repair",
|
|
57
57
|
)
|
|
58
58
|
|
|
59
59
|
def __init__(self, ident, cfg_manager=None, is_arm=False):
|
|
@@ -29,7 +29,7 @@ class CFGNodeCreationFailure:
|
|
|
29
29
|
and the exception messages.
|
|
30
30
|
"""
|
|
31
31
|
|
|
32
|
-
__slots__ = ["
|
|
32
|
+
__slots__ = ["long_reason", "short_reason", "traceback"]
|
|
33
33
|
|
|
34
34
|
def __init__(self, exc_info=None, to_copy=None):
|
|
35
35
|
if to_copy is None:
|
|
@@ -52,23 +52,23 @@ class CFGNode(Serializable):
|
|
|
52
52
|
"""
|
|
53
53
|
|
|
54
54
|
__slots__ = (
|
|
55
|
+
"_cfg_model",
|
|
56
|
+
"_hash",
|
|
57
|
+
"_name",
|
|
55
58
|
"addr",
|
|
56
|
-
"simprocedure_name",
|
|
57
|
-
"syscall_name",
|
|
58
|
-
"size",
|
|
59
|
-
"no_ret",
|
|
60
|
-
"is_syscall",
|
|
61
|
-
"function_address",
|
|
62
59
|
"block_id",
|
|
63
|
-
"thumb",
|
|
64
60
|
"byte_string",
|
|
65
|
-
"
|
|
61
|
+
"function_address",
|
|
62
|
+
"has_return",
|
|
66
63
|
"instruction_addrs",
|
|
67
64
|
"irsb",
|
|
68
|
-
"
|
|
69
|
-
"
|
|
70
|
-
"
|
|
65
|
+
"is_syscall",
|
|
66
|
+
"no_ret",
|
|
67
|
+
"simprocedure_name",
|
|
68
|
+
"size",
|
|
71
69
|
"soot_block",
|
|
70
|
+
"syscall_name",
|
|
71
|
+
"thumb",
|
|
72
72
|
)
|
|
73
73
|
|
|
74
74
|
def __init__(
|
|
@@ -320,7 +320,7 @@ class CFGNode(Serializable):
|
|
|
320
320
|
elif not isinstance(self.addr, SootAddressDescriptor):
|
|
321
321
|
s += hex(self.addr)
|
|
322
322
|
if self.size is not None:
|
|
323
|
-
s += "[
|
|
323
|
+
s += f"[{self.size}]"
|
|
324
324
|
s += ">"
|
|
325
325
|
return s
|
|
326
326
|
|
|
@@ -362,14 +362,14 @@ class CFGENode(CFGNode):
|
|
|
362
362
|
"""
|
|
363
363
|
|
|
364
364
|
__slots__ = [
|
|
365
|
-
"
|
|
366
|
-
"
|
|
365
|
+
"_callstack_key",
|
|
366
|
+
"creation_failure_info",
|
|
367
367
|
"depth",
|
|
368
368
|
"final_states",
|
|
369
|
-
"
|
|
369
|
+
"input_state",
|
|
370
|
+
"looping_times",
|
|
370
371
|
"return_target",
|
|
371
372
|
"syscall",
|
|
372
|
-
"_callstack_key",
|
|
373
373
|
]
|
|
374
374
|
|
|
375
375
|
def __init__(
|
|
@@ -452,9 +452,9 @@ class CFGENode(CFGNode):
|
|
|
452
452
|
s += self.name + " "
|
|
453
453
|
s += hex(self.addr)
|
|
454
454
|
if self.size is not None:
|
|
455
|
-
s += "[
|
|
455
|
+
s += f"[{self.size}]"
|
|
456
456
|
if self.looping_times > 0:
|
|
457
|
-
s += " -
|
|
457
|
+
s += f" - {self.looping_times}"
|
|
458
458
|
if self.creation_failure_info is not None:
|
|
459
459
|
s += f" - creation failed: {self.creation_failure_info.long_reason}"
|
|
460
460
|
s += ">"
|
|
@@ -12,16 +12,16 @@ class IndirectJumpType:
|
|
|
12
12
|
class IndirectJump(Serializable):
|
|
13
13
|
__slots__ = (
|
|
14
14
|
"addr",
|
|
15
|
-
"ins_addr",
|
|
16
15
|
"func_addr",
|
|
16
|
+
"ins_addr",
|
|
17
17
|
"jumpkind",
|
|
18
|
-
"stmt_idx",
|
|
19
|
-
"resolved_targets",
|
|
20
18
|
"jumptable",
|
|
21
19
|
"jumptable_addr",
|
|
22
|
-
"jumptable_size",
|
|
23
|
-
"jumptable_entry_size",
|
|
24
20
|
"jumptable_entries",
|
|
21
|
+
"jumptable_entry_size",
|
|
22
|
+
"jumptable_size",
|
|
23
|
+
"resolved_targets",
|
|
24
|
+
"stmt_idx",
|
|
25
25
|
"type",
|
|
26
26
|
)
|
|
27
27
|
|
|
@@ -60,6 +60,6 @@ class IndirectJump(Serializable):
|
|
|
60
60
|
if self.jumptable_addr is not None:
|
|
61
61
|
status += f"@{self.jumptable_addr:#08x}"
|
|
62
62
|
if self.jumptable_entries is not None:
|
|
63
|
-
status += " with
|
|
63
|
+
status += f" with {len(self.jumptable_entries)} entries"
|
|
64
64
|
|
|
65
65
|
return "<IndirectJump {:#08x} - ins {:#08x}{}>".format(self.addr, self.ins_addr, " " + status if status else "")
|
|
@@ -47,12 +47,12 @@ class MemoryData(Serializable):
|
|
|
47
47
|
|
|
48
48
|
__slots__ = (
|
|
49
49
|
"addr",
|
|
50
|
-
"
|
|
51
|
-
"reference_size",
|
|
52
|
-
"sort",
|
|
50
|
+
"content",
|
|
53
51
|
"max_size",
|
|
54
52
|
"pointer_addr",
|
|
55
|
-
"
|
|
53
|
+
"reference_size",
|
|
54
|
+
"size",
|
|
55
|
+
"sort",
|
|
56
56
|
)
|
|
57
57
|
|
|
58
58
|
def __init__(
|
|
@@ -90,9 +90,7 @@ class MemoryData(Serializable):
|
|
|
90
90
|
return self.addr
|
|
91
91
|
|
|
92
92
|
def __repr__(self):
|
|
93
|
-
return "\\{:#x}, {}, {}/"
|
|
94
|
-
self.address, "%d bytes" % self.size if self.size is not None else "size unknown", self.sort
|
|
95
|
-
)
|
|
93
|
+
return f"\\{self.address:#x}, {self.size if self.size is not None else 'size unknown'} bytes, {self.sort}/"
|
|
96
94
|
|
|
97
95
|
def copy(self):
|
|
98
96
|
"""
|