angr 9.2.132__py3-none-manylinux2014_x86_64.whl → 9.2.133__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +128 -128
- angr/analyses/__init__.py +38 -38
- angr/analyses/backward_slice.py +3 -4
- angr/analyses/binary_optimizer.py +5 -12
- angr/analyses/bindiff.py +3 -6
- angr/analyses/calling_convention.py +3 -4
- angr/analyses/cfg/__init__.py +3 -3
- angr/analyses/cfg/cfg_base.py +1 -1
- angr/analyses/cfg/cfg_fast.py +17 -15
- angr/analyses/cfg/indirect_jump_resolvers/__init__.py +5 -5
- angr/analyses/cfg/indirect_jump_resolvers/amd64_elf_got.py +1 -1
- angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +9 -7
- angr/analyses/data_dep/__init__.py +4 -4
- angr/analyses/datagraph_meta.py +1 -1
- angr/analyses/ddg.py +2 -6
- angr/analyses/decompiler/__init__.py +12 -12
- angr/analyses/decompiler/ail_simplifier.py +21 -10
- angr/analyses/decompiler/block_similarity.py +2 -4
- angr/analyses/decompiler/callsite_maker.py +1 -1
- angr/analyses/decompiler/ccall_rewriters/rewriter_base.py +1 -1
- angr/analyses/decompiler/clinic.py +14 -7
- angr/analyses/decompiler/condition_processor.py +45 -29
- angr/analyses/decompiler/counters/__init__.py +3 -3
- angr/analyses/decompiler/decompilation_cache.py +7 -7
- angr/analyses/decompiler/dephication/__init__.py +1 -1
- angr/analyses/decompiler/dephication/graph_vvar_mapping.py +11 -3
- angr/analyses/decompiler/expression_narrower.py +1 -1
- angr/analyses/decompiler/graph_region.py +8 -8
- angr/analyses/decompiler/optimization_passes/__init__.py +20 -20
- angr/analyses/decompiler/optimization_passes/deadblock_remover.py +1 -2
- angr/analyses/decompiler/optimization_passes/duplication_reverter/duplication_reverter.py +8 -7
- angr/analyses/decompiler/optimization_passes/duplication_reverter/utils.py +1 -3
- angr/analyses/decompiler/optimization_passes/engine_base.py +1 -1
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +2 -4
- angr/analyses/decompiler/optimization_passes/ite_region_converter.py +2 -5
- angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +5 -5
- angr/analyses/decompiler/optimization_passes/mod_simplifier.py +9 -3
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +3 -0
- angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py +9 -5
- angr/analyses/decompiler/peephole_optimizations/__init__.py +1 -1
- angr/analyses/decompiler/peephole_optimizations/base.py +6 -6
- angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py +1 -1
- angr/analyses/decompiler/presets/__init__.py +1 -1
- angr/analyses/decompiler/region_simplifiers/expr_folding.py +3 -3
- angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +8 -12
- angr/analyses/decompiler/ssailification/rewriting_engine.py +1 -1
- angr/analyses/decompiler/structured_codegen/__init__.py +5 -5
- angr/analyses/decompiler/structured_codegen/base.py +3 -3
- angr/analyses/decompiler/structured_codegen/c.py +34 -37
- angr/analyses/decompiler/structuring/__init__.py +3 -3
- angr/analyses/decompiler/structuring/phoenix.py +19 -20
- angr/analyses/decompiler/structuring/structurer_base.py +2 -2
- angr/analyses/decompiler/structuring/structurer_nodes.py +14 -14
- angr/analyses/deobfuscator/__init__.py +3 -3
- angr/analyses/deobfuscator/string_obf_opt_passes.py +1 -1
- angr/analyses/disassembly.py +4 -4
- angr/analyses/forward_analysis/__init__.py +1 -1
- angr/analyses/forward_analysis/visitors/graph.py +6 -6
- angr/analyses/loop_analysis.py +1 -1
- angr/analyses/loopfinder.py +1 -1
- angr/analyses/propagator/outdated_definition_walker.py +12 -6
- angr/analyses/propagator/vex_vars.py +3 -3
- angr/analyses/reaching_definitions/__init__.py +9 -9
- angr/analyses/reaching_definitions/call_trace.py +2 -2
- angr/analyses/reaching_definitions/function_handler_library/__init__.py +1 -1
- angr/analyses/reaching_definitions/rd_state.py +10 -10
- angr/analyses/reassembler.py +26 -31
- angr/analyses/s_liveness.py +8 -0
- angr/analyses/s_reaching_definitions/s_rda_view.py +2 -5
- angr/analyses/stack_pointer_tracker.py +4 -4
- angr/analyses/typehoon/simple_solver.py +7 -9
- angr/analyses/typehoon/translator.py +2 -2
- angr/analyses/typehoon/typeconsts.py +1 -1
- angr/analyses/typehoon/typevars.py +17 -19
- angr/analyses/unpacker/__init__.py +1 -1
- angr/analyses/variable_recovery/engine_base.py +3 -4
- angr/analyses/variable_recovery/variable_recovery_base.py +1 -1
- angr/analyses/variable_recovery/variable_recovery_fast.py +2 -6
- angr/analyses/veritesting.py +2 -2
- angr/analyses/vfg.py +5 -5
- angr/angrdb/serializers/__init__.py +1 -1
- angr/annocfg.py +1 -1
- angr/blade.py +2 -2
- angr/block.py +16 -16
- angr/calling_conventions.py +11 -13
- angr/code_location.py +6 -10
- angr/codenode.py +3 -3
- angr/engines/__init__.py +12 -14
- angr/engines/engine.py +1 -54
- angr/engines/light/__init__.py +4 -4
- angr/engines/light/data.py +1 -1
- angr/engines/pcode/__init__.py +1 -1
- angr/engines/pcode/behavior.py +1 -1
- angr/engines/pcode/lifter.py +13 -15
- angr/engines/soot/expressions/__init__.py +12 -12
- angr/engines/soot/statements/__init__.py +6 -6
- angr/engines/soot/values/__init__.py +6 -6
- angr/engines/soot/values/arrayref.py +2 -2
- angr/engines/soot/values/constants.py +1 -1
- angr/engines/soot/values/instancefieldref.py +1 -1
- angr/engines/soot/values/paramref.py +1 -1
- angr/engines/soot/values/staticfieldref.py +1 -1
- angr/engines/successors.py +2 -5
- angr/engines/vex/__init__.py +5 -5
- angr/engines/vex/claripy/ccall.py +2 -2
- angr/engines/vex/claripy/irop.py +18 -18
- angr/engines/vex/heavy/__init__.py +2 -2
- angr/engines/vex/heavy/actions.py +1 -3
- angr/engines/vex/heavy/heavy.py +4 -6
- angr/engines/vex/lifter.py +2 -4
- angr/engines/vex/light/light.py +0 -2
- angr/engines/vex/light/slicing.py +3 -3
- angr/exploration_techniques/__init__.py +18 -18
- angr/exploration_techniques/threading.py +0 -6
- angr/factory.py +36 -6
- angr/keyed_region.py +4 -4
- angr/knowledge_base.py +1 -1
- angr/knowledge_plugins/__init__.py +11 -11
- angr/knowledge_plugins/cfg/__init__.py +5 -5
- angr/knowledge_plugins/cfg/cfg_manager.py +2 -2
- angr/knowledge_plugins/cfg/cfg_model.py +8 -8
- angr/knowledge_plugins/cfg/cfg_node.py +19 -19
- angr/knowledge_plugins/cfg/indirect_jump.py +6 -6
- angr/knowledge_plugins/cfg/memory_data.py +5 -7
- angr/knowledge_plugins/functions/function.py +48 -52
- angr/knowledge_plugins/functions/function_parser.py +4 -4
- angr/knowledge_plugins/key_definitions/__init__.py +3 -3
- angr/knowledge_plugins/key_definitions/atoms.py +6 -6
- angr/knowledge_plugins/key_definitions/definition.py +1 -1
- angr/knowledge_plugins/key_definitions/live_definitions.py +14 -14
- angr/knowledge_plugins/labels.py +1 -1
- angr/knowledge_plugins/propagations/__init__.py +1 -1
- angr/knowledge_plugins/propagations/prop_value.py +2 -2
- angr/knowledge_plugins/propagations/propagation_model.py +7 -8
- angr/knowledge_plugins/propagations/states.py +31 -31
- angr/knowledge_plugins/variables/variable_access.py +2 -2
- angr/knowledge_plugins/variables/variable_manager.py +1 -1
- angr/knowledge_plugins/xrefs/xref.py +5 -8
- angr/misc/__init__.py +4 -4
- angr/misc/hookset.py +4 -5
- angr/misc/loggers.py +2 -2
- angr/misc/telemetry.py +1 -1
- angr/procedures/__init__.py +1 -1
- angr/procedures/cgc/fdwait.py +2 -2
- angr/procedures/definitions/__init__.py +2 -2
- angr/procedures/definitions/linux_kernel.py +0 -1
- angr/procedures/definitions/parse_syscalls_from_local_system.py +1 -1
- angr/procedures/definitions/parse_win32json.py +0 -1
- angr/procedures/ntdll/exceptions.py +1 -1
- angr/procedures/stubs/format_parser.py +3 -3
- angr/procedures/win32/dynamic_loading.py +1 -1
- angr/protos/__init__.py +3 -3
- angr/sim_manager.py +2 -2
- angr/sim_state.py +1 -1
- angr/sim_state_options.py +3 -3
- angr/sim_type.py +10 -14
- angr/sim_variable.py +13 -17
- angr/simos/__init__.py +4 -4
- angr/simos/cgc.py +1 -1
- angr/simos/simos.py +1 -1
- angr/simos/userland.py +1 -1
- angr/slicer.py +4 -7
- angr/state_plugins/__init__.py +34 -34
- angr/state_plugins/callstack.py +5 -12
- angr/state_plugins/heap/__init__.py +2 -2
- angr/state_plugins/heap/heap_brk.py +2 -4
- angr/state_plugins/heap/heap_ptmalloc.py +1 -1
- angr/state_plugins/jni_references.py +3 -2
- angr/state_plugins/scratch.py +1 -1
- angr/state_plugins/sim_action.py +1 -4
- angr/state_plugins/sim_event.py +1 -1
- angr/state_plugins/solver.py +7 -9
- angr/state_plugins/uc_manager.py +1 -1
- angr/state_plugins/view.py +2 -2
- angr/storage/__init__.py +1 -1
- angr/storage/file.py +10 -10
- angr/storage/memory_mixins/__init__.py +46 -46
- angr/storage/memory_mixins/default_filler_mixin.py +1 -3
- angr/storage/memory_mixins/javavm_memory_mixin.py +2 -2
- angr/storage/memory_mixins/name_resolution_mixin.py +2 -2
- angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +1 -3
- angr/storage/memory_mixins/paged_memory/pages/__init__.py +6 -6
- angr/storage/memory_mixins/paged_memory/pages/list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/multi_values.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +2 -4
- angr/storage/memory_mixins/regioned_memory/__init__.py +3 -3
- angr/storage/memory_mixins/regioned_memory/region_data.py +5 -5
- angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +7 -9
- angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +4 -4
- angr/storage/memory_object.py +4 -4
- angr/utils/__init__.py +3 -3
- angr/utils/dynamic_dictlist.py +1 -1
- angr/utils/graph.py +1 -1
- angr/utils/segment_list.py +2 -2
- angr/utils/ssa/__init__.py +12 -5
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/METADATA +6 -6
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/RECORD +202 -202
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/LICENSE +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/WHEEL +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/entry_points.txt +0 -0
- {angr-9.2.132.dist-info → angr-9.2.133.dist-info}/top_level.txt +0 -0
angr/blade.py
CHANGED
|
@@ -144,13 +144,13 @@ class Blade:
|
|
|
144
144
|
else:
|
|
145
145
|
stmt_str = str(stmt)
|
|
146
146
|
|
|
147
|
-
block_str += "
|
|
147
|
+
block_str += f"{'+' if i in included_stmts else ' '} {i:02d} | {stmt_str}\n"
|
|
148
148
|
|
|
149
149
|
block_str += " + " if default_exit_included else " "
|
|
150
150
|
if isinstance(block.next, pyvex.IRExpr.Const):
|
|
151
151
|
block_str += f"Next: {block.next.con.value:#x}\n"
|
|
152
152
|
elif isinstance(block.next, pyvex.IRExpr.RdTmp):
|
|
153
|
-
block_str += "Next: t
|
|
153
|
+
block_str += f"Next: t{block.next.tmp}\n"
|
|
154
154
|
else:
|
|
155
155
|
block_str += f"Next: {block.next!s}\n"
|
|
156
156
|
|
angr/block.py
CHANGED
|
@@ -23,7 +23,7 @@ class DisassemblerBlock:
|
|
|
23
23
|
instructions
|
|
24
24
|
"""
|
|
25
25
|
|
|
26
|
-
__slots__ = ["addr", "
|
|
26
|
+
__slots__ = ["addr", "arch", "insns", "thumb"]
|
|
27
27
|
|
|
28
28
|
def __init__(self, addr, insns, thumb, arch):
|
|
29
29
|
self.addr = addr
|
|
@@ -122,25 +122,25 @@ class Block(Serializable):
|
|
|
122
122
|
BLOCK_MAX_SIZE = 4096
|
|
123
123
|
|
|
124
124
|
__slots__ = [
|
|
125
|
-
"_project",
|
|
126
125
|
"_bytes",
|
|
127
|
-
"_vex",
|
|
128
|
-
"thumb",
|
|
129
|
-
"_disassembly",
|
|
130
126
|
"_capstone",
|
|
131
|
-
"addr",
|
|
132
|
-
"size",
|
|
133
|
-
"arch",
|
|
134
|
-
"_instructions",
|
|
135
|
-
"_instruction_addrs",
|
|
136
|
-
"_opt_level",
|
|
137
|
-
"_vex_nostmt",
|
|
138
127
|
"_collect_data_refs",
|
|
139
|
-
"_strict_block_end",
|
|
140
|
-
"_cross_insn_opt",
|
|
141
|
-
"_load_from_ro_regions",
|
|
142
128
|
"_const_prop",
|
|
129
|
+
"_cross_insn_opt",
|
|
130
|
+
"_disassembly",
|
|
143
131
|
"_initial_regs",
|
|
132
|
+
"_instruction_addrs",
|
|
133
|
+
"_instructions",
|
|
134
|
+
"_load_from_ro_regions",
|
|
135
|
+
"_opt_level",
|
|
136
|
+
"_project",
|
|
137
|
+
"_strict_block_end",
|
|
138
|
+
"_vex",
|
|
139
|
+
"_vex_nostmt",
|
|
140
|
+
"addr",
|
|
141
|
+
"arch",
|
|
142
|
+
"size",
|
|
143
|
+
"thumb",
|
|
144
144
|
]
|
|
145
145
|
|
|
146
146
|
def __init__(
|
|
@@ -277,7 +277,7 @@ class Block(Serializable):
|
|
|
277
277
|
self.size = vex_block.size
|
|
278
278
|
|
|
279
279
|
def __repr__(self):
|
|
280
|
-
return "<Block for
|
|
280
|
+
return f"<Block for {self.addr:#x}, {self.size} bytes>"
|
|
281
281
|
|
|
282
282
|
def __getstate__(self):
|
|
283
283
|
return {k: getattr(self, k) for k in self.__slots__ if k not in {"_capstone", "_disassembly", "_project"}}
|
angr/calling_conventions.py
CHANGED
|
@@ -243,12 +243,12 @@ class SimFunctionArgument:
|
|
|
243
243
|
if not isinstance(value, claripy.ast.Base) and self.size is None:
|
|
244
244
|
raise TypeError("Only claripy objects may be stored through SimFunctionArgument when size is not provided")
|
|
245
245
|
if self.size is not None and isinstance(value, claripy.ast.Base) and self.size * arch.byte_width < value.length:
|
|
246
|
-
raise TypeError("
|
|
246
|
+
raise TypeError(f"{value} doesn't fit in an argument of size {self.size}")
|
|
247
247
|
if isinstance(value, int):
|
|
248
248
|
value = claripy.BVV(value, self.size * arch.byte_width)
|
|
249
249
|
if isinstance(value, float):
|
|
250
250
|
if self.size not in (4, 8):
|
|
251
|
-
raise ValueError("What do I do with a float
|
|
251
|
+
raise ValueError(f"What do I do with a float {self.size} bytes long")
|
|
252
252
|
value = claripy.FPV(value, claripy.FSORT_FLOAT if self.size == 4 else claripy.FSORT_DOUBLE)
|
|
253
253
|
return value.raw_to_bv()
|
|
254
254
|
|
|
@@ -468,7 +468,7 @@ class SimArrayArg(SimFunctionArgument):
|
|
|
468
468
|
|
|
469
469
|
def set_value(self, state, value, **kwargs):
|
|
470
470
|
if len(value) != len(self.locs):
|
|
471
|
-
raise TypeError("Expected
|
|
471
|
+
raise TypeError(f"Expected {len(self.locs)} elements, got {len(value)}")
|
|
472
472
|
for subvalue, setter in zip(value, self.locs):
|
|
473
473
|
setter.set_value(state, subvalue, **kwargs)
|
|
474
474
|
|
|
@@ -505,10 +505,10 @@ class ArgSession:
|
|
|
505
505
|
"""
|
|
506
506
|
|
|
507
507
|
__slots__ = (
|
|
508
|
+
"both_iter",
|
|
508
509
|
"cc",
|
|
509
510
|
"fp_iter",
|
|
510
511
|
"int_iter",
|
|
511
|
-
"both_iter",
|
|
512
512
|
)
|
|
513
513
|
|
|
514
514
|
def __init__(self, cc):
|
|
@@ -1027,7 +1027,7 @@ class SimCC:
|
|
|
1027
1027
|
raise TypeError(f"Type mismatch: Expected {ty}, got {type(arg)} (i.e. struct)")
|
|
1028
1028
|
if type(arg) is not SimStructValue:
|
|
1029
1029
|
if len(arg) != len(ty.fields):
|
|
1030
|
-
raise TypeError("Wrong number of fields in struct, expected
|
|
1030
|
+
raise TypeError(f"Wrong number of fields in struct, expected {len(ty.fields)} got {len(arg)}")
|
|
1031
1031
|
arg = SimStructValue(ty, arg)
|
|
1032
1032
|
return SimStructValue(
|
|
1033
1033
|
ty, [SimCC._standardize_value(arg[field], ty.fields[field], state, alloc) for field in ty.fields]
|
|
@@ -1063,7 +1063,7 @@ class SimCC:
|
|
|
1063
1063
|
if len(arg) != ty.size:
|
|
1064
1064
|
if arg.concrete:
|
|
1065
1065
|
return claripy.BVV(arg.concrete_value, ty.size)
|
|
1066
|
-
raise TypeError("Type mismatch of symbolic data: expected
|
|
1066
|
+
raise TypeError(f"Type mismatch of symbolic data: expected {ty}, got {len(arg)} bits")
|
|
1067
1067
|
return arg
|
|
1068
1068
|
if isinstance(ty, (SimTypeFloat)):
|
|
1069
1069
|
raise TypeError(
|
|
@@ -2272,7 +2272,7 @@ def default_cc( # pylint:disable=unused-argument
|
|
|
2272
2272
|
platform: str | None = "Linux",
|
|
2273
2273
|
language: str | None = None,
|
|
2274
2274
|
syscall: bool = False,
|
|
2275
|
-
|
|
2275
|
+
default: type[SimCC] | None = None,
|
|
2276
2276
|
) -> type[SimCC] | None:
|
|
2277
2277
|
"""
|
|
2278
2278
|
Return the default calling convention for a given architecture, platform, and language combination.
|
|
@@ -2281,19 +2281,19 @@ def default_cc( # pylint:disable=unused-argument
|
|
|
2281
2281
|
:param platform: The platform name (e.g., "Linux" or "Win32").
|
|
2282
2282
|
:param language: The programming language name (e.g., "go").
|
|
2283
2283
|
:param syscall: Return syscall convention (True), or normal calling convention (False, default).
|
|
2284
|
+
:param default: The default calling convention to return if nothing fits.
|
|
2284
2285
|
:return: A default calling convention class if we can find one for the architecture, platform, and
|
|
2285
|
-
language combination, or
|
|
2286
|
+
language combination, or the default if nothing fits.
|
|
2286
2287
|
"""
|
|
2287
2288
|
|
|
2288
2289
|
if platform is None:
|
|
2289
2290
|
platform = "Linux"
|
|
2290
2291
|
|
|
2291
|
-
default = kwargs.get("default", ...)
|
|
2292
2292
|
cc_map = SYSCALL_CC if syscall else DEFAULT_CC
|
|
2293
2293
|
|
|
2294
2294
|
if arch in cc_map:
|
|
2295
2295
|
if platform not in cc_map[arch]:
|
|
2296
|
-
if default is not
|
|
2296
|
+
if default is not None:
|
|
2297
2297
|
return default
|
|
2298
2298
|
if "Linux" in cc_map[arch]:
|
|
2299
2299
|
return cc_map[arch]["Linux"]
|
|
@@ -2301,9 +2301,7 @@ def default_cc( # pylint:disable=unused-argument
|
|
|
2301
2301
|
|
|
2302
2302
|
alias = unify_arch_name(arch)
|
|
2303
2303
|
if alias not in cc_map or platform not in cc_map[alias]:
|
|
2304
|
-
|
|
2305
|
-
return default
|
|
2306
|
-
return None
|
|
2304
|
+
return default
|
|
2307
2305
|
return cc_map[alias][platform]
|
|
2308
2306
|
|
|
2309
2307
|
|
angr/code_location.py
CHANGED
|
@@ -9,14 +9,14 @@ class CodeLocation:
|
|
|
9
9
|
"""
|
|
10
10
|
|
|
11
11
|
__slots__ = (
|
|
12
|
+
"_hash",
|
|
12
13
|
"block_addr",
|
|
13
|
-
"
|
|
14
|
-
"sim_procedure",
|
|
15
|
-
"ins_addr",
|
|
14
|
+
"block_idx",
|
|
16
15
|
"context",
|
|
17
16
|
"info",
|
|
18
|
-
"
|
|
19
|
-
"
|
|
17
|
+
"ins_addr",
|
|
18
|
+
"sim_procedure",
|
|
19
|
+
"stmt_idx",
|
|
20
20
|
)
|
|
21
21
|
|
|
22
22
|
def __init__(
|
|
@@ -65,11 +65,7 @@ class CodeLocation:
|
|
|
65
65
|
self.block_addr,
|
|
66
66
|
)
|
|
67
67
|
else:
|
|
68
|
-
s = "
|
|
69
|
-
(f"{self.ins_addr:#x} id=") if self.ins_addr else "",
|
|
70
|
-
self.block_addr,
|
|
71
|
-
self.stmt_idx,
|
|
72
|
-
)
|
|
68
|
+
s = f"<{(f'{self.ins_addr:#x} id=') if self.ins_addr else ''}{self.block_addr:#x}[{self.stmt_idx}]"
|
|
73
69
|
|
|
74
70
|
if self.context is None:
|
|
75
71
|
s += " contextless"
|
angr/codenode.py
CHANGED
|
@@ -11,7 +11,7 @@ def repr_addr(addr):
|
|
|
11
11
|
|
|
12
12
|
|
|
13
13
|
class CodeNode:
|
|
14
|
-
__slots__ = ["
|
|
14
|
+
__slots__ = ["_graph", "_hash", "addr", "size", "thumb"]
|
|
15
15
|
|
|
16
16
|
def __init__(self, addr: int, size: int, graph=None, thumb=False):
|
|
17
17
|
self.addr: int = addr
|
|
@@ -75,7 +75,7 @@ class BlockNode(CodeNode):
|
|
|
75
75
|
self.bytestr = bytestr
|
|
76
76
|
|
|
77
77
|
def __repr__(self):
|
|
78
|
-
return "<BlockNode at
|
|
78
|
+
return f"<BlockNode at {repr_addr(self.addr)} (size {self.size})>"
|
|
79
79
|
|
|
80
80
|
def __getstate__(self):
|
|
81
81
|
return (self.addr, self.size, self.bytestr, self.thumb)
|
|
@@ -94,7 +94,7 @@ class SootBlockNode(BlockNode):
|
|
|
94
94
|
assert (stmts is None and size == 0) or (size == len(stmts))
|
|
95
95
|
|
|
96
96
|
def __repr__(self):
|
|
97
|
-
return "<SootBlockNode at
|
|
97
|
+
return f"<SootBlockNode at {repr_addr(self.addr)} ({self.size} statements)>"
|
|
98
98
|
|
|
99
99
|
def __getstate__(self):
|
|
100
100
|
return self.addr, self.size, self.stmts
|
angr/engines/__init__.py
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
2
|
|
|
3
3
|
from .successors import SimSuccessors
|
|
4
|
-
from .engine import SimEngine, SuccessorsMixin
|
|
4
|
+
from .engine import SimEngine, SuccessorsMixin
|
|
5
5
|
|
|
6
6
|
from .vex import HeavyVEXMixin, TrackActionsMixin, SimInspectMixin, HeavyResilienceMixin, SuperFastpathMixin
|
|
7
7
|
from .procedure import ProcedureMixin, ProcedureEngine
|
|
@@ -26,29 +26,27 @@ class UberEngine(
|
|
|
26
26
|
HeavyResilienceMixin,
|
|
27
27
|
SootMixin,
|
|
28
28
|
HeavyVEXMixin,
|
|
29
|
-
TLSMixin,
|
|
30
29
|
):
|
|
31
30
|
pass
|
|
32
31
|
|
|
33
32
|
|
|
34
33
|
__all__ = [
|
|
35
|
-
"SimSuccessors",
|
|
36
|
-
"SimEngine",
|
|
37
|
-
"SuccessorsMixin",
|
|
38
|
-
"TLSMixin",
|
|
39
|
-
"HeavyVEXMixin",
|
|
40
|
-
"TrackActionsMixin",
|
|
41
|
-
"SimInspectMixin",
|
|
42
34
|
"HeavyResilienceMixin",
|
|
43
|
-
"
|
|
44
|
-
"
|
|
35
|
+
"HeavyVEXMixin",
|
|
36
|
+
"HooksMixin",
|
|
45
37
|
"ProcedureEngine",
|
|
46
|
-
"
|
|
38
|
+
"ProcedureMixin",
|
|
39
|
+
"SimEngine",
|
|
40
|
+
"SimEngineConcrete",
|
|
47
41
|
"SimEngineFailure",
|
|
48
42
|
"SimEngineSyscall",
|
|
49
|
-
"
|
|
50
|
-
"
|
|
43
|
+
"SimEngineUnicorn",
|
|
44
|
+
"SimInspectMixin",
|
|
45
|
+
"SimSuccessors",
|
|
51
46
|
"SootMixin",
|
|
47
|
+
"SuccessorsMixin",
|
|
48
|
+
"SuperFastpathMixin",
|
|
49
|
+
"TrackActionsMixin",
|
|
52
50
|
"UberEngine",
|
|
53
51
|
]
|
|
54
52
|
|
angr/engines/engine.py
CHANGED
|
@@ -3,11 +3,9 @@ from __future__ import annotations
|
|
|
3
3
|
from typing import Generic, TypeVar
|
|
4
4
|
import abc
|
|
5
5
|
import logging
|
|
6
|
-
import threading
|
|
7
6
|
|
|
8
|
-
|
|
9
|
-
from archinfo.arch_soot import SootAddressDescriptor
|
|
10
7
|
import claripy
|
|
8
|
+
from archinfo.arch_soot import SootAddressDescriptor
|
|
11
9
|
|
|
12
10
|
import angr
|
|
13
11
|
from angr.sim_state import SimState
|
|
@@ -40,8 +38,6 @@ class SimEngineBase(Generic[StateType]):
|
|
|
40
38
|
self.project = project
|
|
41
39
|
self.arch = self.project.arch
|
|
42
40
|
|
|
43
|
-
__tls = ("state",)
|
|
44
|
-
|
|
45
41
|
def __getstate__(self):
|
|
46
42
|
return (self.project,)
|
|
47
43
|
|
|
@@ -64,53 +60,6 @@ class SimEngine(Generic[StateType, ResultType], SimEngineBase[StateType], metacl
|
|
|
64
60
|
"""
|
|
65
61
|
|
|
66
62
|
|
|
67
|
-
class TLSMixin:
|
|
68
|
-
"""
|
|
69
|
-
Mix this class into any class that defines __tls to make all of the attributes named in that list into
|
|
70
|
-
thread-local properties.
|
|
71
|
-
|
|
72
|
-
MAGIC MAGIC MAGIC
|
|
73
|
-
"""
|
|
74
|
-
|
|
75
|
-
__local: threading.local # pylint: disable=unused-private-member
|
|
76
|
-
|
|
77
|
-
def __new__(cls, *args, **kwargs): # pylint:disable=unused-argument
|
|
78
|
-
obj = super().__new__(cls)
|
|
79
|
-
obj.__local = threading.local()
|
|
80
|
-
return obj
|
|
81
|
-
|
|
82
|
-
def __init_subclass__(cls, **kwargs):
|
|
83
|
-
super().__init_subclass__(**kwargs)
|
|
84
|
-
|
|
85
|
-
for subcls in cls.mro():
|
|
86
|
-
for attr in subcls.__dict__.get(f"_{subcls.__name__}__tls", ()):
|
|
87
|
-
if attr.startswith("__"):
|
|
88
|
-
attr = f"_{subcls.__name__}{attr}"
|
|
89
|
-
|
|
90
|
-
if hasattr(cls, attr):
|
|
91
|
-
assert (
|
|
92
|
-
type(getattr(cls, attr, None)) is TLSProperty
|
|
93
|
-
), f"Programming error: {attr} is both in __tls and __class__"
|
|
94
|
-
else:
|
|
95
|
-
setattr(cls, attr, TLSProperty(attr))
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
class TLSProperty: # pylint:disable=missing-class-docstring
|
|
99
|
-
def __init__(self, name):
|
|
100
|
-
self.name = name
|
|
101
|
-
|
|
102
|
-
def __get__(self, instance, owner):
|
|
103
|
-
if instance is None:
|
|
104
|
-
return self
|
|
105
|
-
return getattr(instance._TLSMixin__local, self.name)
|
|
106
|
-
|
|
107
|
-
def __set__(self, instance, value):
|
|
108
|
-
setattr(instance._TLSMixin__local, self.name, value)
|
|
109
|
-
|
|
110
|
-
def __delete__(self, instance):
|
|
111
|
-
delattr(instance._TLSMixin__local, self.name)
|
|
112
|
-
|
|
113
|
-
|
|
114
63
|
class SuccessorsMixin(SimEngine[HeavyState, SimSuccessors]):
|
|
115
64
|
"""
|
|
116
65
|
A mixin for SimEngine which implements ``process`` to perform common operations related to symbolic execution
|
|
@@ -122,8 +71,6 @@ class SuccessorsMixin(SimEngine[HeavyState, SimSuccessors]):
|
|
|
122
71
|
|
|
123
72
|
self.successors: SimSuccessors | None = None
|
|
124
73
|
|
|
125
|
-
__tls = ("successors",)
|
|
126
|
-
|
|
127
74
|
def process(self, state: HeavyState, **kwargs) -> SimSuccessors: # pylint:disable=unused-argument
|
|
128
75
|
"""
|
|
129
76
|
Perform execution with a state.
|
angr/engines/light/__init__.py
CHANGED
|
@@ -12,12 +12,12 @@ from .engine import (
|
|
|
12
12
|
|
|
13
13
|
__all__ = (
|
|
14
14
|
"ArithmeticExpression",
|
|
15
|
-
"SpOffset",
|
|
16
15
|
"RegisterOffset",
|
|
17
16
|
"SimEngineLight",
|
|
18
|
-
"SimEngineLightVEX",
|
|
19
17
|
"SimEngineLightAIL",
|
|
20
|
-
"
|
|
21
|
-
"SimEngineNostmtAIL",
|
|
18
|
+
"SimEngineLightVEX",
|
|
22
19
|
"SimEngineNoexprAIL",
|
|
20
|
+
"SimEngineNostmtAIL",
|
|
21
|
+
"SimEngineNostmtVEX",
|
|
22
|
+
"SpOffset",
|
|
23
23
|
)
|
angr/engines/light/data.py
CHANGED
angr/engines/pcode/__init__.py
CHANGED
angr/engines/pcode/behavior.py
CHANGED
angr/engines/pcode/lifter.py
CHANGED
|
@@ -112,17 +112,17 @@ class IRSB:
|
|
|
112
112
|
|
|
113
113
|
__slots__ = (
|
|
114
114
|
"_direct_next",
|
|
115
|
+
"_disassembly",
|
|
115
116
|
"_exit_statements",
|
|
116
117
|
"_instruction_addresses",
|
|
117
118
|
"_ops",
|
|
118
119
|
"_size",
|
|
119
120
|
"_statements",
|
|
120
|
-
"_disassembly",
|
|
121
121
|
"addr",
|
|
122
122
|
"arch",
|
|
123
123
|
"behaviors",
|
|
124
|
-
"data_refs",
|
|
125
124
|
"const_vals",
|
|
125
|
+
"data_refs",
|
|
126
126
|
"default_exit_target",
|
|
127
127
|
"jumpkind",
|
|
128
128
|
"next",
|
|
@@ -521,19 +521,19 @@ class Lifter:
|
|
|
521
521
|
REQUIRE_DATA_PY = False
|
|
522
522
|
|
|
523
523
|
__slots__ = (
|
|
524
|
-
"
|
|
525
|
-
"bytes_offset",
|
|
526
|
-
"opt_level",
|
|
527
|
-
"traceflags",
|
|
524
|
+
"addr",
|
|
528
525
|
"allow_arch_optimizations",
|
|
529
|
-
"
|
|
526
|
+
"arch",
|
|
527
|
+
"bytes_offset",
|
|
530
528
|
"collect_data_refs",
|
|
531
|
-
"
|
|
529
|
+
"data",
|
|
530
|
+
"irsb",
|
|
532
531
|
"max_bytes",
|
|
532
|
+
"max_inst",
|
|
533
|
+
"opt_level",
|
|
533
534
|
"skip_stmts",
|
|
534
|
-
"
|
|
535
|
-
"
|
|
536
|
-
"addr",
|
|
535
|
+
"strict_block_end",
|
|
536
|
+
"traceflags",
|
|
537
537
|
)
|
|
538
538
|
|
|
539
539
|
data: str | bytes | None
|
|
@@ -1377,10 +1377,8 @@ class PcodeLifterEngineMixin(SimEngineBase):
|
|
|
1377
1377
|
|
|
1378
1378
|
def __is_stop_point(self, addr: int, extra_stop_points: Sequence[int] | None = None) -> bool:
|
|
1379
1379
|
return bool(
|
|
1380
|
-
self.project is not None
|
|
1381
|
-
and addr in
|
|
1382
|
-
or extra_stop_points is not None
|
|
1383
|
-
and addr in extra_stop_points
|
|
1380
|
+
(self.project is not None and addr in self.project._sim_procedures)
|
|
1381
|
+
or (extra_stop_points is not None and addr in extra_stop_points)
|
|
1384
1382
|
)
|
|
1385
1383
|
|
|
1386
1384
|
def __getstate__(self):
|
|
@@ -59,32 +59,32 @@ from .instanceOf import SimSootExpr_InstanceOf
|
|
|
59
59
|
|
|
60
60
|
|
|
61
61
|
__all__ = (
|
|
62
|
-
"translate_expr",
|
|
63
62
|
"SimSootExpr_ArrayRef",
|
|
64
63
|
"SimSootExpr_Binop",
|
|
65
64
|
"SimSootExpr_Cast",
|
|
65
|
+
"SimSootExpr_ClassConstant",
|
|
66
66
|
"SimSootExpr_Condition",
|
|
67
|
-
"SimSootExpr_IntConstant",
|
|
68
|
-
"SimSootExpr_LongConstant",
|
|
69
|
-
"SimSootExpr_FloatConstant",
|
|
70
67
|
"SimSootExpr_DoubleConstant",
|
|
71
|
-
"
|
|
72
|
-
"SimSootExpr_ClassConstant",
|
|
73
|
-
"SimSootExpr_NullConstant",
|
|
68
|
+
"SimSootExpr_FloatConstant",
|
|
74
69
|
"SimSootExpr_InstanceFieldRef",
|
|
75
|
-
"
|
|
76
|
-
"
|
|
77
|
-
"SimSootExpr_VirtualInvoke",
|
|
70
|
+
"SimSootExpr_InstanceOf",
|
|
71
|
+
"SimSootExpr_IntConstant",
|
|
78
72
|
"SimSootExpr_InterfaceInvoke",
|
|
79
73
|
"SimSootExpr_Length",
|
|
80
74
|
"SimSootExpr_Local",
|
|
75
|
+
"SimSootExpr_LongConstant",
|
|
81
76
|
"SimSootExpr_New",
|
|
82
77
|
"SimSootExpr_NewArray",
|
|
83
78
|
"SimSootExpr_NewMultiArray",
|
|
79
|
+
"SimSootExpr_NullConstant",
|
|
80
|
+
"SimSootExpr_ParamRef",
|
|
84
81
|
"SimSootExpr_Phi",
|
|
82
|
+
"SimSootExpr_SpecialInvoke",
|
|
85
83
|
"SimSootExpr_StaticFieldRef",
|
|
84
|
+
"SimSootExpr_StaticInvoke",
|
|
85
|
+
"SimSootExpr_StringConstant",
|
|
86
86
|
"SimSootExpr_ThisRef",
|
|
87
|
-
"SimSootExpr_ParamRef",
|
|
88
87
|
"SimSootExpr_Unsupported",
|
|
89
|
-
"
|
|
88
|
+
"SimSootExpr_VirtualInvoke",
|
|
89
|
+
"translate_expr",
|
|
90
90
|
)
|
|
@@ -32,15 +32,15 @@ from .throw import SimSootStmt_Throw
|
|
|
32
32
|
|
|
33
33
|
|
|
34
34
|
__all__ = (
|
|
35
|
-
"translate_stmt",
|
|
36
35
|
"SimSootStmt_Assign",
|
|
37
|
-
"SimSootStmt_Return",
|
|
38
|
-
"SimSootStmt_ReturnVoid",
|
|
39
|
-
"SimSootStmt_Identity",
|
|
40
36
|
"SimSootStmt_Goto",
|
|
41
|
-
"
|
|
37
|
+
"SimSootStmt_Identity",
|
|
42
38
|
"SimSootStmt_If",
|
|
43
|
-
"
|
|
39
|
+
"SimSootStmt_Invoke",
|
|
44
40
|
"SimSootStmt_LookupSwitch",
|
|
41
|
+
"SimSootStmt_Return",
|
|
42
|
+
"SimSootStmt_ReturnVoid",
|
|
43
|
+
"SimSootStmt_TableSwitch",
|
|
45
44
|
"SimSootStmt_Throw",
|
|
45
|
+
"translate_stmt",
|
|
46
46
|
)
|
|
@@ -27,14 +27,14 @@ from .strref import SimSootValue_StringRef
|
|
|
27
27
|
|
|
28
28
|
|
|
29
29
|
__all__ = (
|
|
30
|
-
"translate_value",
|
|
31
|
-
"SimSootValue_Local",
|
|
32
|
-
"SimSootValue_ParamRef",
|
|
33
|
-
"SimSootValue_ArrayRef",
|
|
34
30
|
"SimSootValue_ArrayBaseRef",
|
|
35
|
-
"
|
|
36
|
-
"SimSootValue_StaticFieldRef",
|
|
31
|
+
"SimSootValue_ArrayRef",
|
|
37
32
|
"SimSootValue_InstanceFieldRef",
|
|
38
33
|
"SimSootValue_IntConstant",
|
|
34
|
+
"SimSootValue_Local",
|
|
35
|
+
"SimSootValue_ParamRef",
|
|
36
|
+
"SimSootValue_StaticFieldRef",
|
|
39
37
|
"SimSootValue_StringRef",
|
|
38
|
+
"SimSootValue_ThisRef",
|
|
39
|
+
"translate_value",
|
|
40
40
|
)
|
|
@@ -12,7 +12,7 @@ l = logging.getLogger("angr.engines.soot.values.arrayref")
|
|
|
12
12
|
|
|
13
13
|
|
|
14
14
|
class SimSootValue_ArrayBaseRef(SimSootValue):
|
|
15
|
-
__slots__ = ["
|
|
15
|
+
__slots__ = ["_default_value_generator", "element_type", "id", "size", "type"]
|
|
16
16
|
|
|
17
17
|
def __init__(self, heap_alloc_id, element_type, size, default_value_generator=None):
|
|
18
18
|
self.id = f"{heap_alloc_id}.array_{element_type}"
|
|
@@ -48,7 +48,7 @@ class SimSootValue_ArrayBaseRef(SimSootValue):
|
|
|
48
48
|
|
|
49
49
|
|
|
50
50
|
class SimSootValue_ArrayRef(SimSootValue):
|
|
51
|
-
__slots__ = ["
|
|
51
|
+
__slots__ = ["base", "id", "index"]
|
|
52
52
|
|
|
53
53
|
def __init__(self, base, index):
|
|
54
54
|
self.id = f"{base.id}[{index}]"
|
|
@@ -5,7 +5,7 @@ from angr.engines.soot.field_dispatcher import resolve_field
|
|
|
5
5
|
|
|
6
6
|
|
|
7
7
|
class SimSootValue_InstanceFieldRef(SimSootValue):
|
|
8
|
-
__slots__ = ["
|
|
8
|
+
__slots__ = ["class_name", "field_name", "id", "type"]
|
|
9
9
|
|
|
10
10
|
def __init__(self, heap_alloc_id, class_name, field_name, type_):
|
|
11
11
|
self.id = f"{heap_alloc_id}.{class_name}.{field_name}"
|
|
@@ -4,7 +4,7 @@ from angr.engines.soot.field_dispatcher import resolve_field
|
|
|
4
4
|
|
|
5
5
|
|
|
6
6
|
class SimSootValue_StaticFieldRef(SimSootValue):
|
|
7
|
-
__slots__ = ["
|
|
7
|
+
__slots__ = ["class_name", "field_name", "id", "type"]
|
|
8
8
|
|
|
9
9
|
def __init__(self, class_name, field_name, type_):
|
|
10
10
|
self.id = f"{class_name}.{field_name}"
|
angr/engines/successors.py
CHANGED
|
@@ -268,11 +268,8 @@ class SimSuccessors:
|
|
|
268
268
|
if o.VALIDATE_APPROXIMATIONS in state.options and state.solver.satisfiable():
|
|
269
269
|
raise Exception("WTF")
|
|
270
270
|
self.unsat_successors.append(state)
|
|
271
|
-
elif (
|
|
272
|
-
not state.
|
|
273
|
-
and state.solver.is_false(state.scratch.guard)
|
|
274
|
-
or o.LAZY_SOLVES not in state.options
|
|
275
|
-
and not state.satisfiable()
|
|
271
|
+
elif (not state.scratch.guard.symbolic and state.solver.is_false(state.scratch.guard)) or (
|
|
272
|
+
o.LAZY_SOLVES not in state.options and not state.satisfiable()
|
|
276
273
|
):
|
|
277
274
|
self.unsat_successors.append(state)
|
|
278
275
|
elif o.NO_SYMBOLIC_JUMP_RESOLUTION in state.options and state.solver.symbolic(target):
|
angr/engines/vex/__init__.py
CHANGED
|
@@ -8,13 +8,13 @@ from .lifter import VEXLifter
|
|
|
8
8
|
|
|
9
9
|
__all__ = (
|
|
10
10
|
"ClaripyDataMixin",
|
|
11
|
-
"
|
|
12
|
-
"VEXResilienceMixin",
|
|
13
|
-
"VEXSlicingMixin",
|
|
14
|
-
"TrackActionsMixin",
|
|
11
|
+
"HeavyResilienceMixin",
|
|
15
12
|
"HeavyVEXMixin",
|
|
16
13
|
"SimInspectMixin",
|
|
17
|
-
"HeavyResilienceMixin",
|
|
18
14
|
"SuperFastpathMixin",
|
|
15
|
+
"TrackActionsMixin",
|
|
19
16
|
"VEXLifter",
|
|
17
|
+
"VEXMixin",
|
|
18
|
+
"VEXResilienceMixin",
|
|
19
|
+
"VEXSlicingMixin",
|
|
20
20
|
)
|