angr 9.2.132__py3-none-manylinux2014_aarch64.whl → 9.2.133__py3-none-manylinux2014_aarch64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +128 -128
- angr/analyses/__init__.py +38 -38
- angr/analyses/backward_slice.py +3 -4
- angr/analyses/binary_optimizer.py +5 -12
- angr/analyses/bindiff.py +3 -6
- angr/analyses/calling_convention.py +3 -4
- angr/analyses/cfg/__init__.py +3 -3
- angr/analyses/cfg/cfg_base.py +1 -1
- angr/analyses/cfg/cfg_fast.py +17 -15
- angr/analyses/cfg/indirect_jump_resolvers/__init__.py +5 -5
- angr/analyses/cfg/indirect_jump_resolvers/amd64_elf_got.py +1 -1
- angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +9 -7
- angr/analyses/data_dep/__init__.py +4 -4
- angr/analyses/datagraph_meta.py +1 -1
- angr/analyses/ddg.py +2 -6
- angr/analyses/decompiler/__init__.py +12 -12
- angr/analyses/decompiler/ail_simplifier.py +21 -10
- angr/analyses/decompiler/block_similarity.py +2 -4
- angr/analyses/decompiler/callsite_maker.py +1 -1
- angr/analyses/decompiler/ccall_rewriters/rewriter_base.py +1 -1
- angr/analyses/decompiler/clinic.py +14 -7
- angr/analyses/decompiler/condition_processor.py +45 -29
- angr/analyses/decompiler/counters/__init__.py +3 -3
- angr/analyses/decompiler/decompilation_cache.py +7 -7
- angr/analyses/decompiler/dephication/__init__.py +1 -1
- angr/analyses/decompiler/dephication/graph_vvar_mapping.py +11 -3
- angr/analyses/decompiler/expression_narrower.py +1 -1
- angr/analyses/decompiler/graph_region.py +8 -8
- angr/analyses/decompiler/optimization_passes/__init__.py +20 -20
- angr/analyses/decompiler/optimization_passes/deadblock_remover.py +1 -2
- angr/analyses/decompiler/optimization_passes/duplication_reverter/duplication_reverter.py +8 -7
- angr/analyses/decompiler/optimization_passes/duplication_reverter/utils.py +1 -3
- angr/analyses/decompiler/optimization_passes/engine_base.py +1 -1
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +2 -4
- angr/analyses/decompiler/optimization_passes/ite_region_converter.py +2 -5
- angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +5 -5
- angr/analyses/decompiler/optimization_passes/mod_simplifier.py +9 -3
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +3 -0
- angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py +9 -5
- angr/analyses/decompiler/peephole_optimizations/__init__.py +1 -1
- angr/analyses/decompiler/peephole_optimizations/base.py +6 -6
- angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py +1 -1
- angr/analyses/decompiler/presets/__init__.py +1 -1
- angr/analyses/decompiler/region_simplifiers/expr_folding.py +3 -3
- angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +8 -12
- angr/analyses/decompiler/ssailification/rewriting_engine.py +1 -1
- angr/analyses/decompiler/structured_codegen/__init__.py +5 -5
- angr/analyses/decompiler/structured_codegen/base.py +3 -3
- angr/analyses/decompiler/structured_codegen/c.py +34 -37
- angr/analyses/decompiler/structuring/__init__.py +3 -3
- angr/analyses/decompiler/structuring/phoenix.py +19 -20
- angr/analyses/decompiler/structuring/structurer_base.py +2 -2
- angr/analyses/decompiler/structuring/structurer_nodes.py +14 -14
- angr/analyses/deobfuscator/__init__.py +3 -3
- angr/analyses/deobfuscator/string_obf_opt_passes.py +1 -1
- angr/analyses/disassembly.py +4 -4
- angr/analyses/forward_analysis/__init__.py +1 -1
- angr/analyses/forward_analysis/visitors/graph.py +6 -6
- angr/analyses/loop_analysis.py +1 -1
- angr/analyses/loopfinder.py +1 -1
- angr/analyses/propagator/outdated_definition_walker.py +12 -6
- angr/analyses/propagator/vex_vars.py +3 -3
- angr/analyses/reaching_definitions/__init__.py +9 -9
- angr/analyses/reaching_definitions/call_trace.py +2 -2
- angr/analyses/reaching_definitions/function_handler_library/__init__.py +1 -1
- angr/analyses/reaching_definitions/rd_state.py +10 -10
- angr/analyses/reassembler.py +26 -31
- angr/analyses/s_liveness.py +8 -0
- angr/analyses/s_reaching_definitions/s_rda_view.py +2 -5
- angr/analyses/stack_pointer_tracker.py +4 -4
- angr/analyses/typehoon/simple_solver.py +7 -9
- angr/analyses/typehoon/translator.py +2 -2
- angr/analyses/typehoon/typeconsts.py +1 -1
- angr/analyses/typehoon/typevars.py +17 -19
- angr/analyses/unpacker/__init__.py +1 -1
- angr/analyses/variable_recovery/engine_base.py +3 -4
- angr/analyses/variable_recovery/variable_recovery_base.py +1 -1
- angr/analyses/variable_recovery/variable_recovery_fast.py +2 -6
- angr/analyses/veritesting.py +2 -2
- angr/analyses/vfg.py +5 -5
- angr/angrdb/serializers/__init__.py +1 -1
- angr/annocfg.py +1 -1
- angr/blade.py +2 -2
- angr/block.py +16 -16
- angr/calling_conventions.py +11 -13
- angr/code_location.py +6 -10
- angr/codenode.py +3 -3
- angr/engines/__init__.py +12 -14
- angr/engines/engine.py +1 -54
- angr/engines/light/__init__.py +4 -4
- angr/engines/light/data.py +1 -1
- angr/engines/pcode/__init__.py +1 -1
- angr/engines/pcode/behavior.py +1 -1
- angr/engines/pcode/lifter.py +13 -15
- angr/engines/soot/expressions/__init__.py +12 -12
- angr/engines/soot/statements/__init__.py +6 -6
- angr/engines/soot/values/__init__.py +6 -6
- angr/engines/soot/values/arrayref.py +2 -2
- angr/engines/soot/values/constants.py +1 -1
- angr/engines/soot/values/instancefieldref.py +1 -1
- angr/engines/soot/values/paramref.py +1 -1
- angr/engines/soot/values/staticfieldref.py +1 -1
- angr/engines/successors.py +2 -5
- angr/engines/vex/__init__.py +5 -5
- angr/engines/vex/claripy/ccall.py +2 -2
- angr/engines/vex/claripy/irop.py +18 -18
- angr/engines/vex/heavy/__init__.py +2 -2
- angr/engines/vex/heavy/actions.py +1 -3
- angr/engines/vex/heavy/heavy.py +4 -6
- angr/engines/vex/lifter.py +2 -4
- angr/engines/vex/light/light.py +0 -2
- angr/engines/vex/light/slicing.py +3 -3
- angr/exploration_techniques/__init__.py +18 -18
- angr/exploration_techniques/threading.py +0 -6
- angr/factory.py +36 -6
- angr/keyed_region.py +4 -4
- angr/knowledge_base.py +1 -1
- angr/knowledge_plugins/__init__.py +11 -11
- angr/knowledge_plugins/cfg/__init__.py +5 -5
- angr/knowledge_plugins/cfg/cfg_manager.py +2 -2
- angr/knowledge_plugins/cfg/cfg_model.py +8 -8
- angr/knowledge_plugins/cfg/cfg_node.py +19 -19
- angr/knowledge_plugins/cfg/indirect_jump.py +6 -6
- angr/knowledge_plugins/cfg/memory_data.py +5 -7
- angr/knowledge_plugins/functions/function.py +48 -52
- angr/knowledge_plugins/functions/function_parser.py +4 -4
- angr/knowledge_plugins/key_definitions/__init__.py +3 -3
- angr/knowledge_plugins/key_definitions/atoms.py +6 -6
- angr/knowledge_plugins/key_definitions/definition.py +1 -1
- angr/knowledge_plugins/key_definitions/live_definitions.py +14 -14
- angr/knowledge_plugins/labels.py +1 -1
- angr/knowledge_plugins/propagations/__init__.py +1 -1
- angr/knowledge_plugins/propagations/prop_value.py +2 -2
- angr/knowledge_plugins/propagations/propagation_model.py +7 -8
- angr/knowledge_plugins/propagations/states.py +31 -31
- angr/knowledge_plugins/variables/variable_access.py +2 -2
- angr/knowledge_plugins/variables/variable_manager.py +1 -1
- angr/knowledge_plugins/xrefs/xref.py +5 -8
- angr/misc/__init__.py +4 -4
- angr/misc/hookset.py +4 -5
- angr/misc/loggers.py +2 -2
- angr/misc/telemetry.py +1 -1
- angr/procedures/__init__.py +1 -1
- angr/procedures/cgc/fdwait.py +2 -2
- angr/procedures/definitions/__init__.py +2 -2
- angr/procedures/definitions/linux_kernel.py +0 -1
- angr/procedures/definitions/parse_syscalls_from_local_system.py +1 -1
- angr/procedures/definitions/parse_win32json.py +0 -1
- angr/procedures/ntdll/exceptions.py +1 -1
- angr/procedures/stubs/format_parser.py +3 -3
- angr/procedures/win32/dynamic_loading.py +1 -1
- angr/protos/__init__.py +3 -3
- angr/sim_manager.py +2 -2
- angr/sim_state.py +1 -1
- angr/sim_state_options.py +3 -3
- angr/sim_type.py +10 -14
- angr/sim_variable.py +13 -17
- angr/simos/__init__.py +4 -4
- angr/simos/cgc.py +1 -1
- angr/simos/simos.py +1 -1
- angr/simos/userland.py +1 -1
- angr/slicer.py +4 -7
- angr/state_plugins/__init__.py +34 -34
- angr/state_plugins/callstack.py +5 -12
- angr/state_plugins/heap/__init__.py +2 -2
- angr/state_plugins/heap/heap_brk.py +2 -4
- angr/state_plugins/heap/heap_ptmalloc.py +1 -1
- angr/state_plugins/jni_references.py +3 -2
- angr/state_plugins/scratch.py +1 -1
- angr/state_plugins/sim_action.py +1 -4
- angr/state_plugins/sim_event.py +1 -1
- angr/state_plugins/solver.py +7 -9
- angr/state_plugins/uc_manager.py +1 -1
- angr/state_plugins/view.py +2 -2
- angr/storage/__init__.py +1 -1
- angr/storage/file.py +10 -10
- angr/storage/memory_mixins/__init__.py +46 -46
- angr/storage/memory_mixins/default_filler_mixin.py +1 -3
- angr/storage/memory_mixins/javavm_memory_mixin.py +2 -2
- angr/storage/memory_mixins/name_resolution_mixin.py +2 -2
- angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +1 -3
- angr/storage/memory_mixins/paged_memory/pages/__init__.py +6 -6
- angr/storage/memory_mixins/paged_memory/pages/list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/multi_values.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +2 -4
- angr/storage/memory_mixins/regioned_memory/__init__.py +3 -3
- angr/storage/memory_mixins/regioned_memory/region_data.py +5 -5
- angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +7 -9
- angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +4 -4
- angr/storage/memory_object.py +4 -4
- angr/utils/__init__.py +3 -3
- angr/utils/dynamic_dictlist.py +1 -1
- angr/utils/graph.py +1 -1
- angr/utils/segment_list.py +2 -2
- angr/utils/ssa/__init__.py +12 -5
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/METADATA +6 -6
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/RECORD +202 -202
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/LICENSE +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/WHEEL +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/entry_points.txt +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/top_level.txt +0 -0
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
2
|
import logging
|
|
3
|
-
from typing import Dict
|
|
4
3
|
|
|
5
4
|
from angr.sim_type import SimTypeFunction, SimTypePointer, SimTypeLong, SimStruct, SimTypeInt, SimTypeChar, SimTypeBottom, SimTypeFd, SimTypeLongLong
|
|
6
5
|
from angr.procedures import SIM_PROCEDURES as P
|
|
@@ -26,7 +26,7 @@ def parse_unistd_include_header(header_path):
|
|
|
26
26
|
def dump_mapping(abi, mapping):
|
|
27
27
|
print(f'\nlib.add_number_mapping_from_dict("{abi}", {{')
|
|
28
28
|
for num in sorted(mapping):
|
|
29
|
-
print('
|
|
29
|
+
print(f' {num}: "{mapping[num]}",')
|
|
30
30
|
print('})')
|
|
31
31
|
|
|
32
32
|
def main():
|
|
@@ -44,7 +44,7 @@ class KiUserExceptionDispatcher(angr.SimProcedure):
|
|
|
44
44
|
elif disposition == 3:
|
|
45
45
|
raise angr.errors.SimUnsupportedError("Exception disposition ExceptionCollidedUnwind is unsupported")
|
|
46
46
|
else:
|
|
47
|
-
raise angr.errors.SimError("Bad exception disposition
|
|
47
|
+
raise angr.errors.SimError(f"Bad exception disposition {disposition}")
|
|
48
48
|
|
|
49
49
|
# todo: check cur_ptr against stack bounds
|
|
50
50
|
cur_ptr = self.cur_ptr
|
|
@@ -323,11 +323,11 @@ class FormatSpecifier:
|
|
|
323
323
|
"""
|
|
324
324
|
|
|
325
325
|
__slots__ = (
|
|
326
|
-
"string",
|
|
327
|
-
"size",
|
|
328
|
-
"signed",
|
|
329
326
|
"length_spec",
|
|
330
327
|
"pad_chr",
|
|
328
|
+
"signed",
|
|
329
|
+
"size",
|
|
330
|
+
"string",
|
|
331
331
|
)
|
|
332
332
|
|
|
333
333
|
def __init__(self, string, length_spec, pad_chr, size, signed):
|
|
@@ -59,7 +59,7 @@ class GetProcAddress(angr.SimProcedure):
|
|
|
59
59
|
if claripy.is_true(name_addr < 0x10000):
|
|
60
60
|
# this matches the bogus name specified in the loader...
|
|
61
61
|
ordinal = self.state.solver.eval(name_addr)
|
|
62
|
-
name = "ordinal
|
|
62
|
+
name = f"ordinal.{ordinal}.{obj.provides}"
|
|
63
63
|
else:
|
|
64
64
|
name = self.state.mem[name_addr].string.concrete.decode("utf-8")
|
|
65
65
|
|
angr/protos/__init__.py
CHANGED
angr/sim_manager.py
CHANGED
|
@@ -155,10 +155,10 @@ class SimulationManager:
|
|
|
155
155
|
self.use_technique(t)
|
|
156
156
|
|
|
157
157
|
def __repr__(self):
|
|
158
|
-
stashes_repr = ", ".join(("
|
|
158
|
+
stashes_repr = ", ".join((f"{len(v)} {k}") for k, v in self._stashes.items() if len(v) != 0)
|
|
159
159
|
if not stashes_repr:
|
|
160
160
|
stashes_repr = "all stashes empty"
|
|
161
|
-
errored_repr = " (
|
|
161
|
+
errored_repr = f" ({len(self.errored)} errored)" if self.errored else ""
|
|
162
162
|
return f"<SimulationManager with {stashes_repr}{errored_repr}>"
|
|
163
163
|
|
|
164
164
|
def __getattr__(self, item):
|
angr/sim_state.py
CHANGED
|
@@ -598,7 +598,7 @@ class SimState(Generic[IPTypeConc, IPTypeSym], PluginHub[SimStatePlugin]):
|
|
|
598
598
|
|
|
599
599
|
if merge_conditions is None:
|
|
600
600
|
# TODO: maybe make the length of this smaller? Maybe: math.ceil(math.log(len(others)+1, 2))
|
|
601
|
-
merge_flag = claripy.BVS("state_merge_
|
|
601
|
+
merge_flag = claripy.BVS(f"state_merge_{next(merge_counter)}", 16)
|
|
602
602
|
merge_values = range(len(others) + 1)
|
|
603
603
|
merge_conditions = [merge_flag == b for b in merge_values]
|
|
604
604
|
else:
|
angr/sim_state_options.py
CHANGED
|
@@ -11,11 +11,11 @@ class StateOption:
|
|
|
11
11
|
"""
|
|
12
12
|
|
|
13
13
|
__slots__ = (
|
|
14
|
-
"
|
|
15
|
-
"types",
|
|
14
|
+
"_one_type",
|
|
16
15
|
"default",
|
|
17
16
|
"description",
|
|
18
|
-
"
|
|
17
|
+
"name",
|
|
18
|
+
"types",
|
|
19
19
|
)
|
|
20
20
|
|
|
21
21
|
def __init__(self, name, types, default=_NO_DEFAULT_VALUE, description=None):
|
angr/sim_type.py
CHANGED
|
@@ -428,7 +428,7 @@ class SimTypeInt(SimTypeReg):
|
|
|
428
428
|
name = "unsigned " + name
|
|
429
429
|
|
|
430
430
|
try:
|
|
431
|
-
return name
|
|
431
|
+
return f"{name} ({self.size} bits)"
|
|
432
432
|
except ValueError:
|
|
433
433
|
return name
|
|
434
434
|
|
|
@@ -516,7 +516,7 @@ class SimTypeFixedSizeInt(SimTypeInt):
|
|
|
516
516
|
name = "u" + name
|
|
517
517
|
|
|
518
518
|
try:
|
|
519
|
-
return name
|
|
519
|
+
return f"{name} ({self.size} bits)"
|
|
520
520
|
except ValueError:
|
|
521
521
|
return name
|
|
522
522
|
|
|
@@ -778,12 +778,8 @@ class SimTypePointer(SimTypeReg):
|
|
|
778
778
|
return out
|
|
779
779
|
|
|
780
780
|
def _init_str(self):
|
|
781
|
-
|
|
782
|
-
|
|
783
|
-
self.pts_to._init_str(),
|
|
784
|
-
(f', label="{self.label}"') if self.label is not None else "",
|
|
785
|
-
self.offset,
|
|
786
|
-
)
|
|
781
|
+
label_str = f', label="{self.label}"' if self.label is not None else ""
|
|
782
|
+
return f"{self.__class__.__name__}({self.pts_to._init_str()}{label_str}, offset={self.offset})"
|
|
787
783
|
|
|
788
784
|
def copy(self):
|
|
789
785
|
return SimTypePointer(self.pts_to, label=self.label, offset=self.offset)
|
|
@@ -1282,7 +1278,7 @@ class SimTypeLength(SimTypeLong):
|
|
|
1282
1278
|
return self._arch.bits
|
|
1283
1279
|
|
|
1284
1280
|
def _init_str(self):
|
|
1285
|
-
return "
|
|
1281
|
+
return f"{self.__class__.__name__}(size={self.size})"
|
|
1286
1282
|
|
|
1287
1283
|
def copy(self):
|
|
1288
1284
|
return SimTypeLength(signed=self.signed, addr=self.addr, length=self.length, label=self.label)
|
|
@@ -1322,7 +1318,7 @@ class SimTypeFloat(SimTypeReg):
|
|
|
1322
1318
|
return "float"
|
|
1323
1319
|
|
|
1324
1320
|
def _init_str(self):
|
|
1325
|
-
return "
|
|
1321
|
+
return f"{self.__class__.__name__}(size={self.size})"
|
|
1326
1322
|
|
|
1327
1323
|
def copy(self):
|
|
1328
1324
|
return SimTypeFloat(self.size)
|
|
@@ -1510,7 +1506,7 @@ class SimStruct(NamedTypeMixin, SimType):
|
|
|
1510
1506
|
raise TypeError(f"Can't store struct of type {type(value)}")
|
|
1511
1507
|
|
|
1512
1508
|
if len(value) != len(self.fields):
|
|
1513
|
-
raise ValueError("Passed bad values for
|
|
1509
|
+
raise ValueError(f"Passed bad values for {self}; expected {len(self.offsets)}, got {len(value)}")
|
|
1514
1510
|
|
|
1515
1511
|
for field, offset in self.offsets.items():
|
|
1516
1512
|
ty = self.fields[field]
|
|
@@ -1793,7 +1789,7 @@ class SimCppClass(SimStruct):
|
|
|
1793
1789
|
raise TypeError(f"Can't store struct of type {type(value)}")
|
|
1794
1790
|
|
|
1795
1791
|
if len(value) != len(self.fields):
|
|
1796
|
-
raise ValueError("Passed bad values for
|
|
1792
|
+
raise ValueError(f"Passed bad values for {self}; expected {len(self.offsets)}, got {len(value)}")
|
|
1797
1793
|
|
|
1798
1794
|
for field, offset in self.offsets.items():
|
|
1799
1795
|
ty = self.fields[field]
|
|
@@ -3507,7 +3503,7 @@ def parse_cpp_file(cpp_decl, with_param_names: bool = False):
|
|
|
3507
3503
|
idx = s.find(",", last_pos)
|
|
3508
3504
|
if idx == -1:
|
|
3509
3505
|
break
|
|
3510
|
-
arg_name = "a
|
|
3506
|
+
arg_name = f"a{i}"
|
|
3511
3507
|
i += 1
|
|
3512
3508
|
s = s[:idx] + " " + arg_name + s[idx:]
|
|
3513
3509
|
last_pos = idx + len(arg_name) + 1 + 1
|
|
@@ -3516,7 +3512,7 @@ def parse_cpp_file(cpp_decl, with_param_names: bool = False):
|
|
|
3516
3512
|
idx = s.find(")", last_pos)
|
|
3517
3513
|
# TODO: consider the case where there are one or multiple spaces between ( and )
|
|
3518
3514
|
if idx != -1 and s[idx - 1] != "(":
|
|
3519
|
-
arg_name = "a
|
|
3515
|
+
arg_name = f"a{i}"
|
|
3520
3516
|
s = s[:idx] + " " + arg_name + s[idx:]
|
|
3521
3517
|
|
|
3522
3518
|
# CppHeaderParser does not like missing function body
|
angr/sim_variable.py
CHANGED
|
@@ -13,12 +13,12 @@ if TYPE_CHECKING:
|
|
|
13
13
|
|
|
14
14
|
class SimVariable(Serializable):
|
|
15
15
|
__slots__ = [
|
|
16
|
+
"candidate_names",
|
|
17
|
+
"category",
|
|
16
18
|
"ident",
|
|
17
19
|
"name",
|
|
18
20
|
"region",
|
|
19
|
-
"category",
|
|
20
21
|
"renamed",
|
|
21
|
-
"candidate_names",
|
|
22
22
|
"size",
|
|
23
23
|
]
|
|
24
24
|
|
|
@@ -87,7 +87,7 @@ class SimVariable(Serializable):
|
|
|
87
87
|
|
|
88
88
|
|
|
89
89
|
class SimConstantVariable(SimVariable):
|
|
90
|
-
__slots__ = ["
|
|
90
|
+
__slots__ = ["_hash", "value"]
|
|
91
91
|
|
|
92
92
|
def __init__(self, size: int, ident=None, value=None, region=None):
|
|
93
93
|
super().__init__(ident=ident, region=region, size=size)
|
|
@@ -122,7 +122,7 @@ class SimConstantVariable(SimVariable):
|
|
|
122
122
|
|
|
123
123
|
|
|
124
124
|
class SimTemporaryVariable(SimVariable):
|
|
125
|
-
__slots__ = ["
|
|
125
|
+
__slots__ = ["_hash", "tmp_id"]
|
|
126
126
|
|
|
127
127
|
def __init__(self, tmp_id: int, size: int):
|
|
128
128
|
SimVariable.__init__(self, size=size)
|
|
@@ -131,14 +131,14 @@ class SimTemporaryVariable(SimVariable):
|
|
|
131
131
|
self._hash = None
|
|
132
132
|
|
|
133
133
|
def __repr__(self):
|
|
134
|
-
return "<tmp
|
|
134
|
+
return f"<tmp {self.tmp_id}>"
|
|
135
135
|
|
|
136
136
|
def loc_repr(self, arch):
|
|
137
137
|
return f"tmp #{self.tmp_id}"
|
|
138
138
|
|
|
139
139
|
def __hash__(self):
|
|
140
140
|
if self._hash is None:
|
|
141
|
-
self._hash = hash("tmp_
|
|
141
|
+
self._hash = hash(f"tmp_{self.tmp_id}")
|
|
142
142
|
return self._hash
|
|
143
143
|
|
|
144
144
|
def __eq__(self, other):
|
|
@@ -170,7 +170,7 @@ class SimTemporaryVariable(SimVariable):
|
|
|
170
170
|
|
|
171
171
|
|
|
172
172
|
class SimRegisterVariable(SimVariable):
|
|
173
|
-
__slots__ = ["
|
|
173
|
+
__slots__ = ["_hash", "reg"]
|
|
174
174
|
|
|
175
175
|
def __init__(self, reg_offset: int, size: int, ident=None, name=None, region=None, category=None):
|
|
176
176
|
SimVariable.__init__(self, ident=ident, name=name, region=region, category=category, size=size)
|
|
@@ -236,7 +236,7 @@ class SimRegisterVariable(SimVariable):
|
|
|
236
236
|
|
|
237
237
|
|
|
238
238
|
class SimMemoryVariable(SimVariable):
|
|
239
|
-
__slots__ = ["
|
|
239
|
+
__slots__ = ["_hash", "addr"]
|
|
240
240
|
|
|
241
241
|
def __init__(self, addr, size: int, ident=None, name=None, region=None, category=None):
|
|
242
242
|
SimVariable.__init__(self, ident=ident, name=name, region=region, category=category, size=size)
|
|
@@ -251,12 +251,10 @@ class SimMemoryVariable(SimVariable):
|
|
|
251
251
|
self._hash = None
|
|
252
252
|
|
|
253
253
|
def __repr__(self):
|
|
254
|
-
size = "%d" % self.size if type(self.size) is int else f"{self.size}"
|
|
255
|
-
|
|
256
254
|
if type(self.addr) is int:
|
|
257
|
-
s = f"<{self.name}: {self.region}-Mem {self.addr:#x} {size}>"
|
|
255
|
+
s = f"<{self.name}: {self.region}-Mem {self.addr:#x} {self.size}>"
|
|
258
256
|
else:
|
|
259
|
-
s = f"<{self.name}: {self.region}-Mem {self.addr} {size}>"
|
|
257
|
+
s = f"<{self.name}: {self.region}-Mem {self.addr} {self.size}>"
|
|
260
258
|
|
|
261
259
|
return s
|
|
262
260
|
|
|
@@ -311,8 +309,8 @@ class SimMemoryVariable(SimVariable):
|
|
|
311
309
|
class SimStackVariable(SimMemoryVariable):
|
|
312
310
|
__slots__ = (
|
|
313
311
|
"base",
|
|
314
|
-
"offset",
|
|
315
312
|
"base_addr",
|
|
313
|
+
"offset",
|
|
316
314
|
)
|
|
317
315
|
|
|
318
316
|
def __init__(
|
|
@@ -333,8 +331,6 @@ class SimStackVariable(SimMemoryVariable):
|
|
|
333
331
|
self.base_addr = base_addr
|
|
334
332
|
|
|
335
333
|
def __repr__(self):
|
|
336
|
-
size = "%d" % self.size if type(self.size) is int else f"{self.size}"
|
|
337
|
-
|
|
338
334
|
prefix = f"{self.name}(stack)" if self.name is not None else "Stack"
|
|
339
335
|
ident = f"[{self.ident}]" if self.ident else ""
|
|
340
336
|
region_str = hex(self.region) if isinstance(self.region, int) else self.region
|
|
@@ -347,9 +343,9 @@ class SimStackVariable(SimMemoryVariable):
|
|
|
347
343
|
else:
|
|
348
344
|
offset = ""
|
|
349
345
|
|
|
350
|
-
s = f"<{region_str}{ident}|{prefix} {self.base}{offset}, {size} B>"
|
|
346
|
+
s = f"<{region_str}{ident}|{prefix} {self.base}{offset}, {self.size} B>"
|
|
351
347
|
else:
|
|
352
|
-
s = f"<{region_str}{ident}|{prefix} {self.base}{self.addr}, {size} B>"
|
|
348
|
+
s = f"<{region_str}{ident}|{prefix} {self.base}{self.addr}, {self.size} B>"
|
|
353
349
|
|
|
354
350
|
return s
|
|
355
351
|
|
angr/simos/__init__.py
CHANGED
|
@@ -34,12 +34,12 @@ register_simos("snimmuc_nxp", SimSnimmucNxp)
|
|
|
34
34
|
|
|
35
35
|
|
|
36
36
|
__all__ = (
|
|
37
|
-
"SimOS",
|
|
38
|
-
"SimUserland",
|
|
39
|
-
"SimLinux",
|
|
40
37
|
"SimCGC",
|
|
41
|
-
"SimWindows",
|
|
42
38
|
"SimJavaVM",
|
|
39
|
+
"SimLinux",
|
|
40
|
+
"SimOS",
|
|
43
41
|
"SimSnimmucNxp",
|
|
42
|
+
"SimUserland",
|
|
43
|
+
"SimWindows",
|
|
44
44
|
"os_mapping",
|
|
45
45
|
)
|
angr/simos/cgc.py
CHANGED
|
@@ -50,7 +50,7 @@ class SimCGC(SimUserland):
|
|
|
50
50
|
|
|
51
51
|
# Set up the flag page
|
|
52
52
|
if flag_page is None:
|
|
53
|
-
flag_page = [s.solver.BVS("cgc-flag-byte
|
|
53
|
+
flag_page = [s.solver.BVS(f"cgc-flag-byte-{i}", 8, key=("flag", i), eternal=True) for i in range(0x1000)]
|
|
54
54
|
elif type(flag_page) is bytes:
|
|
55
55
|
flag_page = [claripy.BVV(c, 8) for c in flag_page]
|
|
56
56
|
elif type(flag_page) is list:
|
angr/simos/simos.py
CHANGED
|
@@ -214,7 +214,7 @@ class SimOS:
|
|
|
214
214
|
empty_bools = [((val >> (x * 2)) & 3) == 3 for x in range(8)]
|
|
215
215
|
tag_chars = [claripy.BVV(0 if x else 1, 8) for x in empty_bools]
|
|
216
216
|
for i, tag in enumerate(tag_chars):
|
|
217
|
-
setattr(state.regs, "fpu_t
|
|
217
|
+
setattr(state.regs, f"fpu_t{i}", tag)
|
|
218
218
|
elif reg in ("fiseg", "fioff", "foseg", "fooff", "fop"):
|
|
219
219
|
pass
|
|
220
220
|
elif reg == "mxcsr":
|
angr/simos/userland.py
CHANGED
|
@@ -149,7 +149,7 @@ class SimUserland(SimOS):
|
|
|
149
149
|
raise AngrUnsupportedSyscallError(f"{self.name} does not have a library of syscalls implemented")
|
|
150
150
|
proc = P["stubs"]["syscall"]()
|
|
151
151
|
elif not allow_unsupported and not self.syscall_library.has_implementation(number, self.arch, abilist):
|
|
152
|
-
raise AngrUnsupportedSyscallError("No implementation for syscall
|
|
152
|
+
raise AngrUnsupportedSyscallError(f"No implementation for syscall {number}")
|
|
153
153
|
else:
|
|
154
154
|
proc = self.syscall_library.get(number, self.arch, abilist)
|
|
155
155
|
|
angr/slicer.py
CHANGED
|
@@ -11,10 +11,10 @@ class SimLightState:
|
|
|
11
11
|
"""
|
|
12
12
|
|
|
13
13
|
__slots__ = (
|
|
14
|
-
"
|
|
14
|
+
"options",
|
|
15
15
|
"regs",
|
|
16
16
|
"stack_offsets",
|
|
17
|
-
"
|
|
17
|
+
"temps",
|
|
18
18
|
)
|
|
19
19
|
|
|
20
20
|
def __init__(self, temps=None, regs=None, stack_offsets=None, options=None):
|
|
@@ -155,11 +155,8 @@ class SimSlicer:
|
|
|
155
155
|
def _forward_handler_expr_Get(self, expr, state):
|
|
156
156
|
reg = expr.offset
|
|
157
157
|
|
|
158
|
-
if (
|
|
159
|
-
state.options["
|
|
160
|
-
and reg == self._arch.sp_offset
|
|
161
|
-
or state.options["mock_bp"]
|
|
162
|
-
and reg == self._arch.bp_offset
|
|
158
|
+
if (state.options["mock_sp"] and reg == self._arch.sp_offset) or (
|
|
159
|
+
state.options["mock_bp"] and reg == self._arch.bp_offset
|
|
163
160
|
):
|
|
164
161
|
return state.regs[reg]
|
|
165
162
|
|
angr/state_plugins/__init__.py
CHANGED
|
@@ -31,56 +31,56 @@ from .debug_variables import SimDebugVariable, SimDebugVariablePlugin
|
|
|
31
31
|
|
|
32
32
|
|
|
33
33
|
__all__ = (
|
|
34
|
-
"SimStatePlugin",
|
|
35
|
-
"SimStateLibc",
|
|
36
|
-
"SimInspector",
|
|
37
|
-
"NO_OVERRIDE",
|
|
38
|
-
"BP_BEFORE",
|
|
39
34
|
"BP_AFTER",
|
|
35
|
+
"BP_BEFORE",
|
|
40
36
|
"BP_BOTH",
|
|
41
37
|
"BP_IPDB",
|
|
42
38
|
"BP_IPYTHON",
|
|
39
|
+
"GDB",
|
|
40
|
+
"NO_OVERRIDE",
|
|
41
|
+
"CallStack",
|
|
42
|
+
"Concrete",
|
|
43
|
+
"PTChunk",
|
|
44
|
+
"PTChunkIterator",
|
|
43
45
|
"PosixDevFS",
|
|
44
46
|
"PosixProcFS",
|
|
45
|
-
"SimSystemPosix",
|
|
46
|
-
"SimSolver",
|
|
47
|
-
"SimLightRegisters",
|
|
48
|
-
"SimStateLog",
|
|
49
|
-
"SimStateHistory",
|
|
50
|
-
"SimStateScratch",
|
|
51
|
-
"SimStateCGC",
|
|
52
|
-
"GDB",
|
|
53
|
-
"SimUCManager",
|
|
54
|
-
"Unicorn",
|
|
55
47
|
"SimAction",
|
|
56
|
-
"SimActionExit",
|
|
57
48
|
"SimActionConstraint",
|
|
58
|
-
"SimActionOperation",
|
|
59
49
|
"SimActionData",
|
|
50
|
+
"SimActionExit",
|
|
60
51
|
"SimActionObject",
|
|
52
|
+
"SimActionOperation",
|
|
53
|
+
"SimDebugVariable",
|
|
54
|
+
"SimDebugVariablePlugin",
|
|
61
55
|
"SimEvent",
|
|
62
|
-
"resource_event",
|
|
63
|
-
"CallStack",
|
|
64
|
-
"SimStateGlobals",
|
|
65
|
-
"SimStatePreconstrainer",
|
|
66
|
-
"SimStateLoopData",
|
|
67
|
-
"SimRegNameView",
|
|
68
|
-
"SimMemView",
|
|
69
|
-
"StructMode",
|
|
70
|
-
"Stat",
|
|
71
56
|
"SimFilesystem",
|
|
72
|
-
"SimMount",
|
|
73
|
-
"SimHostFilesystem",
|
|
74
57
|
"SimHeapBase",
|
|
75
58
|
"SimHeapBrk",
|
|
76
59
|
"SimHeapLibc",
|
|
77
60
|
"SimHeapPTMalloc",
|
|
78
|
-
"
|
|
79
|
-
"
|
|
80
|
-
"Concrete",
|
|
81
|
-
"SimStateJNIReferences",
|
|
61
|
+
"SimHostFilesystem",
|
|
62
|
+
"SimInspector",
|
|
82
63
|
"SimJavaVmClassloader",
|
|
64
|
+
"SimLightRegisters",
|
|
65
|
+
"SimMemView",
|
|
66
|
+
"SimMount",
|
|
67
|
+
"SimRegNameView",
|
|
68
|
+
"SimSolver",
|
|
69
|
+
"SimStateCGC",
|
|
70
|
+
"SimStateGlobals",
|
|
71
|
+
"SimStateHistory",
|
|
72
|
+
"SimStateJNIReferences",
|
|
73
|
+
"SimStateLibc",
|
|
74
|
+
"SimStateLog",
|
|
75
|
+
"SimStateLoopData",
|
|
76
|
+
"SimStatePlugin",
|
|
77
|
+
"SimStatePreconstrainer",
|
|
78
|
+
"SimStateScratch",
|
|
83
79
|
"SimSymbolizer",
|
|
84
|
-
"
|
|
85
|
-
"
|
|
80
|
+
"SimSystemPosix",
|
|
81
|
+
"SimUCManager",
|
|
82
|
+
"Stat",
|
|
83
|
+
"StructMode",
|
|
84
|
+
"Unicorn",
|
|
85
|
+
"resource_event",
|
|
86
86
|
)
|
angr/state_plugins/callstack.py
CHANGED
|
@@ -119,14 +119,11 @@ class CallStack(SimStatePlugin):
|
|
|
119
119
|
:return: A printable representation of the CallStack object
|
|
120
120
|
:rtype: str
|
|
121
121
|
"""
|
|
122
|
-
return "<CallStack (depth
|
|
122
|
+
return f"<CallStack (depth {len(self)})>"
|
|
123
123
|
|
|
124
124
|
def __str__(self):
|
|
125
|
-
return "Backtrace:\n
|
|
126
|
-
"
|
|
127
|
-
"Frame %d: %#x => %#x, sp = %#x" % (i, f.call_site_addr, f.func_addr, f.stack_ptr)
|
|
128
|
-
for i, f in enumerate(self)
|
|
129
|
-
)
|
|
125
|
+
return "Backtrace:\n" + "\n".join(
|
|
126
|
+
f"Frame {i}: {f.call_site_addr:#x} => {f.func_addr:#x}, sp = {f.stack_ptr:#x}" for i, f in enumerate(self)
|
|
130
127
|
)
|
|
131
128
|
|
|
132
129
|
def __eq__(self, other):
|
|
@@ -319,13 +316,9 @@ class CallStack(SimStatePlugin):
|
|
|
319
316
|
|
|
320
317
|
stack = []
|
|
321
318
|
for i, frame in enumerate(self):
|
|
322
|
-
|
|
323
|
-
i,
|
|
324
|
-
"None" if frame.call_site_addr is None else f"{frame.call_site_addr:#x}",
|
|
325
|
-
"None" if frame.func_addr is None else f"{frame.func_addr:#x}",
|
|
326
|
-
"None" if frame.current_return_target is None else f"{frame.current_return_target:#x}",
|
|
319
|
+
stack.append(
|
|
320
|
+
f"{i} | {frame.call_site_addr:#x} -> {frame.func_addr:#x}, returning to {frame.current_return_target:#x}"
|
|
327
321
|
)
|
|
328
|
-
stack.append(s)
|
|
329
322
|
|
|
330
323
|
return "\n".join(stack)
|
|
331
324
|
|
|
@@ -6,10 +6,10 @@ from .heap_libc import SimHeapLibc
|
|
|
6
6
|
from .heap_ptmalloc import SimHeapPTMalloc, PTChunk, PTChunkIterator
|
|
7
7
|
|
|
8
8
|
__all__ = (
|
|
9
|
+
"PTChunk",
|
|
10
|
+
"PTChunkIterator",
|
|
9
11
|
"SimHeapBase",
|
|
10
12
|
"SimHeapBrk",
|
|
11
13
|
"SimHeapLibc",
|
|
12
14
|
"SimHeapPTMalloc",
|
|
13
|
-
"PTChunk",
|
|
14
|
-
"PTChunkIterator",
|
|
15
15
|
)
|
|
@@ -90,10 +90,8 @@ class SimHeapBrk(SimHeapBase):
|
|
|
90
90
|
|
|
91
91
|
final_size = size * nmemb
|
|
92
92
|
|
|
93
|
-
if (
|
|
94
|
-
self.state.solver.symbolic(
|
|
95
|
-
or self.state.solver.symbolic(sim_size)
|
|
96
|
-
and final_size > plugin.max_variable_size
|
|
93
|
+
if self.state.solver.symbolic(sim_nmemb) or (
|
|
94
|
+
self.state.solver.symbolic(sim_size) and final_size > plugin.max_variable_size
|
|
97
95
|
):
|
|
98
96
|
final_size = plugin.max_variable_size
|
|
99
97
|
|
|
@@ -75,7 +75,7 @@ class PTChunk(Chunk):
|
|
|
75
75
|
next_chunk.set_prev_freeness(is_free)
|
|
76
76
|
else:
|
|
77
77
|
self.heap._set_final_freeness(is_free)
|
|
78
|
-
if (is_free is not None and is_free or self.is_free()) and next_chunk is not None:
|
|
78
|
+
if ((is_free is not None and is_free) or self.is_free()) and next_chunk is not None:
|
|
79
79
|
self.state.memory.store(next_chunk.base, size, size=self.state.arch.bytes)
|
|
80
80
|
|
|
81
81
|
def set_prev_freeness(self, is_free):
|
|
@@ -30,8 +30,9 @@ class SimStateJNIReferences(SimStatePlugin):
|
|
|
30
30
|
if opaque_ref_value in self.global_refs:
|
|
31
31
|
return self.global_refs[opaque_ref_value]
|
|
32
32
|
raise KeyError(
|
|
33
|
-
"Unknown JNI reference
|
|
34
|
-
|
|
33
|
+
f"Unknown JNI reference {opaque_ref_value}. "
|
|
34
|
+
f"Local references: {self.local_refs} "
|
|
35
|
+
f"Global references: {self.global_refs}"
|
|
35
36
|
)
|
|
36
37
|
|
|
37
38
|
def create_new_reference(self, obj, global_ref=False):
|
angr/state_plugins/scratch.py
CHANGED
|
@@ -108,7 +108,7 @@ class SimStateScratch(SimStatePlugin):
|
|
|
108
108
|
v = self.temps[tmp]
|
|
109
109
|
if v is None:
|
|
110
110
|
raise SimMissingTempError(
|
|
111
|
-
"VEX temp variable
|
|
111
|
+
f"VEX temp variable {tmp} does not exist. This is usually the result of an incorrect slicing."
|
|
112
112
|
)
|
|
113
113
|
except IndexError as err:
|
|
114
114
|
raise SimMissingTempError("Accessing a temp that is illegal in this tyenv") from err
|
angr/state_plugins/sim_action.py
CHANGED
|
@@ -38,10 +38,7 @@ class SimAction(SimEvent):
|
|
|
38
38
|
if self.sim_procedure is not None:
|
|
39
39
|
location = f"{self.sim_procedure.display_name}()"
|
|
40
40
|
else:
|
|
41
|
-
if self.stmt_idx is not None:
|
|
42
|
-
location = "0x%x:%d" % (self.ins_addr, self.stmt_idx) # TODO: Revert this!
|
|
43
|
-
else:
|
|
44
|
-
location = f"0x{self.bbl_addr:x}"
|
|
41
|
+
location = f"0x{self.ins_addr:x}:{self.stmt_idx}" if self.stmt_idx is not None else f"0x{self.bbl_addr:x}"
|
|
45
42
|
return f"<{self.__class__.__name__} {location} {self._desc()}>"
|
|
46
43
|
|
|
47
44
|
def _desc(self):
|
angr/state_plugins/sim_event.py
CHANGED
|
@@ -25,7 +25,7 @@ class SimEvent:
|
|
|
25
25
|
self.arch = state.arch
|
|
26
26
|
|
|
27
27
|
def __repr__(self):
|
|
28
|
-
return "<SimEvent
|
|
28
|
+
return f"<SimEvent {self.type} {self.id}, with fields {', '.join(self.objects.keys())}>"
|
|
29
29
|
|
|
30
30
|
def _copy_event(self):
|
|
31
31
|
c = self.__class__.__new__(self.__class__)
|
angr/state_plugins/solver.py
CHANGED
|
@@ -112,7 +112,7 @@ def error_converter(f):
|
|
|
112
112
|
def _concrete_bool(e):
|
|
113
113
|
if isinstance(e, bool):
|
|
114
114
|
return e
|
|
115
|
-
if isinstance(e, claripy.ast.Base) and e.op == "BoolV" or isinstance(e, SimActionObject) and e.op == "BoolV":
|
|
115
|
+
if (isinstance(e, claripy.ast.Base) and e.op == "BoolV") or (isinstance(e, SimActionObject) and e.op == "BoolV"):
|
|
116
116
|
return e.args[0]
|
|
117
117
|
return None
|
|
118
118
|
|
|
@@ -302,10 +302,8 @@ class SimSolver(SimStatePlugin):
|
|
|
302
302
|
elif o.SYMBOLIC in self.state.options and o.COMPOSITE_SOLVER in self.state.options:
|
|
303
303
|
self._stored_solver = claripy.SolverComposite(track=track)
|
|
304
304
|
elif (
|
|
305
|
-
o.SYMBOLIC in self.state.options
|
|
306
|
-
|
|
307
|
-
or o.HYBRID_SOLVER in self.state.options
|
|
308
|
-
):
|
|
305
|
+
o.SYMBOLIC in self.state.options and any(opt in self.state.options for opt in o.approximation)
|
|
306
|
+
) or o.HYBRID_SOLVER in self.state.options:
|
|
309
307
|
self._stored_solver = claripy.SolverHybrid(track=track, approximate_first=approximate_first)
|
|
310
308
|
elif o.SYMBOLIC in self.state.options:
|
|
311
309
|
self._stored_solver = claripy.Solver(track=track)
|
|
@@ -856,7 +854,7 @@ class SimSolver(SimStatePlugin):
|
|
|
856
854
|
|
|
857
855
|
cast_vals = [self._cast_to(e, v, cast_to) for v in self._eval(e, n, **kwargs)]
|
|
858
856
|
if len(cast_vals) == 0:
|
|
859
|
-
raise SimUnsatError("Not satisfiable:
|
|
857
|
+
raise SimUnsatError(f"Not satisfiable: {e.shallow_repr()}, expected up to {n} solutions")
|
|
860
858
|
return cast_vals
|
|
861
859
|
|
|
862
860
|
@overload
|
|
@@ -967,7 +965,7 @@ class SimSolver(SimStatePlugin):
|
|
|
967
965
|
"""
|
|
968
966
|
r = self.eval_upto(e, n + 1, cast_to, **kwargs)
|
|
969
967
|
if len(r) > n:
|
|
970
|
-
raise SimValueError("Concretized
|
|
968
|
+
raise SimValueError(f"Concretized {len(r)} values (must be at most {n}) in eval_atmost")
|
|
971
969
|
return r
|
|
972
970
|
|
|
973
971
|
@overload
|
|
@@ -1002,7 +1000,7 @@ class SimSolver(SimStatePlugin):
|
|
|
1002
1000
|
"""
|
|
1003
1001
|
r = self.eval_upto(e, n, cast_to, **kwargs)
|
|
1004
1002
|
if len(r) != n:
|
|
1005
|
-
raise SimValueError("Concretized
|
|
1003
|
+
raise SimValueError(f"Concretized {len(r)} values (must be at least {n}) in eval_atleast")
|
|
1006
1004
|
return r
|
|
1007
1005
|
|
|
1008
1006
|
@overload
|
|
@@ -1038,7 +1036,7 @@ class SimSolver(SimStatePlugin):
|
|
|
1038
1036
|
"""
|
|
1039
1037
|
r = self.eval_upto(e, n + 1, cast_to, **kwargs)
|
|
1040
1038
|
if len(r) != n:
|
|
1041
|
-
raise SimValueError("Concretized
|
|
1039
|
+
raise SimValueError(f"Concretized {len(r)} values (must be exactly {n}) in eval_exact")
|
|
1042
1040
|
return r
|
|
1043
1041
|
|
|
1044
1042
|
min_int = min
|