angr 9.2.135__py3-none-manylinux2014_aarch64.whl → 9.2.137__py3-none-manylinux2014_aarch64.whl

angr/analyses/class_identifier.py

@@ -30,8 +30,7 @@ class ClassIdentifier(Analysis):
                 continue
             col_ind = func.demangled_name.rfind("::")
             class_name = func.demangled_name[:col_ind]
-            if class_name.startswith("non-virtual thunk for "):
-                class_name = class_name[len("non-virtual thunk for ") :]
+            class_name = class_name.removeprefix("non-virtual thunk for ")
             if col_ind != -1:
                 if class_name not in self.classes:
                     ctor = False

angr/analyses/complete_calling_conventions.py

@@ -208,6 +208,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
                 self._update_progress(percentage, text=f"{idx + 1}/{total_funcs} - {func.demangled_name}")
                 if self._low_priority:
                     self._release_gil(idx + 1, 10, 0.000001)
+            self._finish_progress()
 
         else:
             self._remaining_funcs.value = len(self._func_addrs)
@@ -298,6 +299,8 @@ class CompleteCallingConventionsAnalysis(Analysis):
             for proc in procs:
                 proc.join()
 
+            self._finish_progress()
+
     def _worker_routine(self, worker_id: int, initializer: Initializer):
         initializer.initialize()
         idx = 0

angr/analyses/congruency_check.py

@@ -3,6 +3,8 @@ import logging
 
 import claripy
 
+from angr.errors import AngrIncongruencyError
+from angr.analyses import AnalysesHub
 from . import Analysis
 
 l = logging.getLogger(name=__name__)
@@ -372,7 +374,4 @@ class CongruencyCheck(Analysis):
         return True
 
 
-from angr.errors import AngrIncongruencyError
-from angr.analyses import AnalysesHub
-
 AnalysesHub.register_default("CongruencyCheck", CongruencyCheck)

angr/analyses/data_dep/data_dependency_analysis.py

@@ -9,7 +9,7 @@ from typing import TYPE_CHECKING
 from networkx import DiGraph
 
 import claripy
-from claripy.ast.bv import BV
+from claripy.ast import BV
 from .dep_nodes import DepNodeTypes, ConstantDepNode, MemDepNode, VarDepNode, RegDepNode, TmpDepNode
 from .sim_act_location import SimActLocation, DEFAULT_LOCATION, ParsedInstruction
 from angr.analyses import Analysis
@@ -173,7 +173,7 @@ class DataDependencyGraphAnalysis(Analysis):
         self,
         type_: int,
         sim_act: SimActionData,
-        val: tuple[BV, int],
+        val: tuple[claripy.ast.BV, int],
         *constructor_params,
     ) -> BaseDepNode:
         """

angr/analyses/ddg.py

@@ -6,8 +6,7 @@ import claripy
 import networkx
 import pyvex
 
-from . import Analysis
-
+from angr.analyses import Analysis, AnalysesHub
 from angr.code_location import CodeLocation
 from angr.errors import SimSolverModeError, SimUnsatError, AngrDDGError
 from angr.sim_variable import (
@@ -1668,6 +1667,4 @@ class DDG(Analysis):
         return sources
 
 
-from angr.analyses import AnalysesHub
-
 AnalysesHub.register_default("DDG", DDG)

angr/analyses/decompiler/ail_simplifier.py

@@ -207,25 +207,28 @@ class AILSimplifier(Analysis):
         # Computing reaching definitions or return the cached one
         if self._reaching_definitions is not None:
             return self._reaching_definitions
+        func_args = {vvar for vvar, _ in self._arg_vvars.values()} if self._arg_vvars else set()
         rd = self.project.analyses.SReachingDefinitions(
             subject=self.func,
             func_graph=self.func_graph,
+            func_args=func_args,
             # use_callee_saved_regs_at_return=self._use_callee_saved_regs_at_return,
             # track_tmps=True,
         ).model
         self._reaching_definitions = rd
         return rd
 
-    def _compute_propagation(self, immediate_stmt_removal: bool = False) -> SPropagatorAnalysis:
+    def _compute_propagation(self) -> SPropagatorAnalysis:
         # Propagate expressions or return the existing result
         if self._propagator is not None:
             return self._propagator
-        prop = self.project.analyses[SPropagatorAnalysis].prep()(
+        func_args = {vvar for vvar, _ in self._arg_vvars.values()} if self._arg_vvars else set()
+        prop = self.project.analyses[SPropagatorAnalysis].prep(fail_fast=self._fail_fast)(
             subject=self.func,
             func_graph=self.func_graph,
+            func_args=func_args,
             # gp=self._gp,
             only_consts=self._only_consts,
-            immediate_stmt_removal=immediate_stmt_removal,
         )
         self._propagator = prop
         return prop
@@ -354,7 +357,7 @@ class AILSimplifier(Analysis):
     ):
         repeat = False
         narrowable_phivarids = set()
-        for def_vvarid, (_, narrow_info) in narrowing_candidates.items():
+        for def_vvarid in narrowing_candidates:
             if def_vvarid in blacklist_varids:
                 continue
             if def_vvarid in rd.phi_vvar_ids:
@@ -591,7 +594,7 @@ class AILSimplifier(Analysis):
         """
 
         # propagator
-        propagator = self._compute_propagation(immediate_stmt_removal=True)
+        propagator = self._compute_propagation()
         replacements = propagator.replacements
 
         # take replacements and rebuild the corresponding blocks
@@ -899,6 +902,13 @@ class AILSimplifier(Analysis):
 
                 to_replace_def = the_def
 
+                # check: the definition of expression being replaced should not be a phi variable
+                if (
+                    isinstance(to_replace_def.atom, atoms.VirtualVariable)
+                    and to_replace_def.atom.varid in rd.phi_vvar_ids
+                ):
+                    continue
+
                 # find all uses of this definition
                 # we make a copy of the set since we may touch the set (uses) when replacing expressions
                 all_uses: set[tuple[CodeLocation, Any]] = set(rd.get_vvar_uses_with_expr(to_replace_def.atom))

angr/analyses/decompiler/block_simplifier.py

@@ -141,7 +141,7 @@ class BlockSimplifier(Analysis):
 
     def _compute_propagation(self, block) -> SPropagatorAnalysis:
         if self._propagator is None:
-            self._propagator = self.project.analyses[SPropagatorAnalysis].prep()(
+            self._propagator = self.project.analyses[SPropagatorAnalysis].prep(fail_fast=self._fail_fast)(
                 subject=block,
                 func_addr=self.func_addr,
                 stack_pointer_tracker=self._stack_pointer_tracker,
@@ -152,7 +152,7 @@ class BlockSimplifier(Analysis):
         if self._reaching_definitions is None:
             self._reaching_definitions = (
                 self.project.analyses[SReachingDefinitionsAnalysis]
-                .prep()(
+                .prep(fail_fast=self._fail_fast)(
                     subject=block,
                     track_tmps=True,
                     func_addr=self.func_addr,

angr/analyses/decompiler/ccall_rewriters/__init__.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 from .amd64_ccalls import AMD64CCallRewriter
+from .x86_ccalls import X86CCallRewriter
 
 
 CCALL_REWRITERS = {
+    "X86": X86CCallRewriter,
     "AMD64": AMD64CCallRewriter,
 }

angr/analyses/decompiler/ccall_rewriters/amd64_ccalls.py

@@ -14,7 +14,7 @@ AMD64_CondBitOffsets = data["AMD64"]["CondBitOffsets"]
 
 class AMD64CCallRewriter(CCallRewriterBase):
     """
-    Implements ccall rewriter for AMD64.
+    Implements VEX ccall rewriter for AMD64.
     """
 
     __slots__ = ()

angr/analyses/decompiler/ccall_rewriters/x86_ccalls.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+from ailment import Expr
+
+from angr.engines.vex.claripy.ccall import data
+from .rewriter_base import CCallRewriterBase
+
+
+X86_CondTypes = data["X86"]["CondTypes"]
+X86_OpTypes = data["X86"]["OpTypes"]
+X86_CondBitMasks = data["X86"]["CondBitMasks"]
+X86_CondBitOffsets = data["X86"]["CondBitOffsets"]
+
+
+class X86CCallRewriter(CCallRewriterBase):
+    """
+    Implements VEX ccall rewriter for X86.
+    """
+
+    __slots__ = ()
+
+    def _rewrite(self, ccall: Expr.VEXCCallExpression) -> Expr.Expression | None:
+        if ccall.callee == "x86g_calculate_condition":
+            cond = ccall.operands[0]
+            op = ccall.operands[1]
+            dep_1 = ccall.operands[2]
+            dep_2 = ccall.operands[3]
+            if isinstance(cond, Expr.Const) and isinstance(op, Expr.Const):
+                cond_v = cond.value
+                op_v = op.value
+                if cond_v == X86_CondTypes["CondLE"]:  # noqa: SIM102
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 <=s dep_2
+                        dep_1 = self._fix_size(
+                            dep_1,
+                            op_v,
+                            X86_OpTypes["G_CC_OP_SUBB"],
+                            X86_OpTypes["G_CC_OP_SUBW"],
+                            ccall.tags,
+                        )
+                        dep_2 = self._fix_size(
+                            dep_2,
+                            op_v,
+                            X86_OpTypes["G_CC_OP_SUBB"],
+                            X86_OpTypes["G_CC_OP_SUBW"],
+                            ccall.tags,
+                        )
+
+                        r = Expr.BinaryOp(ccall.idx, "CmpLE", (dep_1, dep_2), True, **ccall.tags)
+                        return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
+        return None
+
+    @staticmethod
+    def _fix_size(expr, op_v: int, type_8bit, type_16bit, tags):
+        if op_v == type_8bit:
+            bits = 8
+        elif op_v == type_16bit:
+            bits = 16
+        else:
+            bits = 32
+        if bits < 32:
+            if isinstance(expr, Expr.Const):
+                return Expr.Const(expr.idx, None, expr.value & ((1 << bits) - 1), bits, **tags)
+            return Expr.Convert(None, 32, bits, False, expr, **tags)
+        return expr

angr/analyses/decompiler/clinic.py

@@ -49,7 +49,6 @@ from .optimization_passes import (
     DUPLICATING_OPTS,
     CONDENSING_OPTS,
 )
-from .utils import first_nonlabel_statement_id
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.cfg import CFGModel
@@ -461,12 +460,12 @@ class Clinic(Analysis):
         # Make function arguments
         self._update_progress(33.0, text="Making argument list")
         arg_list = self._make_argument_list()
-        arg_vvars = {}
-        ail_graph = self._create_argument_accessing_statements(arg_list, ail_graph, arg_vvars)
+        arg_vvars = self._create_function_argument_vvars(arg_list)
+        func_args = {arg_vvar for arg_vvar, _ in arg_vvars.values()}
 
         # Transform the graph into partial SSA form
         self._update_progress(35.0, text="Transforming to partial-SSA form")
-        ail_graph = self._transform_to_ssa_level0(ail_graph)
+        ail_graph = self._transform_to_ssa_level0(ail_graph, func_args)
 
         # full-function constant-only propagation
         self._update_progress(36.0, text="Constant propagation")
@@ -521,15 +520,20 @@ class Clinic(Analysis):
         )
 
         # rewrite (qualified) stack variables into SSA form
-        ail_graph = self._transform_to_ssa_level1(ail_graph)
+        ail_graph = self._transform_to_ssa_level1(ail_graph, func_args)
 
         # clear _blocks_by_addr_and_size so no one can use it again
         # TODO: Totally remove this dict
         self._blocks_by_addr_and_size = None
 
+        # Rust-specific; only call this on Rust binaries when we can identify language and compiler
+        ail_graph = self._rewrite_rust_probestack_call(ail_graph)
+        # Windows-specific
+        ail_graph = self._rewrite_windows_stkchk_call(ail_graph)
+
         # Make call-sites
         self._update_progress(50.0, text="Making callsites")
-        _, stackarg_offsets, removed_vvar_ids = self._make_callsites(ail_graph, stack_pointer_tracker=spt)
+        _, stackarg_offsets, removed_vvar_ids = self._make_callsites(ail_graph, func_args, stack_pointer_tracker=spt)
 
         # Run simplification passes
         self._update_progress(53.0, text="Running simplifications 2")
@@ -1010,13 +1014,15 @@ class Clinic(Analysis):
                 if node is None:
                     continue
                 successors = self._cfg.get_successors(node, excluding_fakeret=True, jumpkind="Ijk_Call")
-                if len(successors) == 1 and not isinstance(
-                    self.project.hooked_by(successors[0].addr), UnresolvableCallTarget
-                ):
-                    # found a single successor - replace the last statement
-                    new_last_stmt = last_stmt.copy()
-                    new_last_stmt.target = ailment.Expr.Const(None, None, successors[0].addr, last_stmt.target.bits)
-                    block.statements[-1] = new_last_stmt
+                if len(successors) == 1:
+                    succ_addr = successors[0].addr
+                    if not self.project.is_hooked(succ_addr) or not isinstance(
+                        self.project.hooked_by(successors[0].addr), UnresolvableCallTarget
+                    ):
+                        # found a single successor - replace the last statement
+                        new_last_stmt = last_stmt.copy()
+                        new_last_stmt.target = ailment.Expr.Const(None, None, successors[0].addr, last_stmt.target.bits)
+                        block.statements[-1] = new_last_stmt
 
             elif isinstance(last_stmt, ailment.Stmt.Jump) and not isinstance(last_stmt.target, ailment.Expr.Const):
                 # indirect jump
@@ -1301,84 +1307,57 @@ class Clinic(Analysis):
         return ail_graph
 
     @timethis
-    def _create_argument_accessing_statements(
-        self,
-        arg_list: list[SimVariable],
-        ail_graph: networkx.DiGraph,
-        arg_vvars: dict[int, tuple[ailment.Expr.VirtualVariable, SimVariable]],
-    ) -> networkx.DiGraph:
-        entrypoint = next(iter(bb for bb in ail_graph if (bb.addr, bb.idx) == self.entry_node_addr))
-        new_stmts = []
+    def _create_function_argument_vvars(self, arg_list) -> dict[int, tuple[ailment.Expr.VirtualVariable, SimVariable]]:
+        arg_vvars = {}
         for arg in arg_list:
-            if not isinstance(arg, SimRegisterVariable):
-                continue
-
-            # get the full register if needed
-            basereg_offset, basereg_size = self.project.arch.get_base_register(arg.reg, size=arg.size)
-
-            arg_vvar = ailment.Expr.VirtualVariable(
-                self._ail_manager.next_atom(),
-                self.vvar_id_start,
-                arg.bits,
-                ailment.Expr.VirtualVariableCategory.PARAMETER,
-                oident=arg.reg,
-                ins_addr=self.function.addr,
-                vex_block_addr=self.function.addr,
-            )
-            self.vvar_id_start += 1
-            arg_vvars[arg_vvar.varid] = arg_vvar, arg
-
-            if basereg_size != arg.size:
-                # extend the value to the full register
-                arg_vvar = ailment.Expr.Convert(
+            if isinstance(arg, SimRegisterVariable):
+                # get the full register if needed
+                arg_vvar = ailment.Expr.VirtualVariable(
                     self._ail_manager.next_atom(),
-                    arg.size * self.project.arch.byte_width,
-                    basereg_size * self.project.arch.byte_width,
-                    False,
-                    arg_vvar,
+                    self.vvar_id_start,
+                    arg.bits,
+                    ailment.Expr.VirtualVariableCategory.PARAMETER,
+                    oident=(ailment.Expr.VirtualVariableCategory.REGISTER, arg.reg),
                     ins_addr=self.function.addr,
                     vex_block_addr=self.function.addr,
                 )
+                self.vvar_id_start += 1
+                arg_vvars[arg_vvar.varid] = arg_vvar, arg
+            elif isinstance(arg, SimStackVariable):
+                arg_vvar = ailment.Expr.VirtualVariable(
+                    self._ail_manager.next_atom(),
+                    self.vvar_id_start,
+                    arg.bits,
+                    ailment.Expr.VirtualVariableCategory.PARAMETER,
+                    oident=(ailment.Expr.VirtualVariableCategory.STACK, arg.offset),
+                    ins_addr=self.function.addr,
+                    vex_block_addr=self.function.addr,
+                )
+                self.vvar_id_start += 1
+                arg_vvars[arg_vvar.varid] = arg_vvar, arg
 
-            fullreg_dst = ailment.Expr.Register(
-                self._ail_manager.next_atom(),
-                None,
-                basereg_offset,
-                basereg_size * self.project.arch.byte_width,
-                ins_addr=self.function.addr,
-                vex_block_addr=self.function.addr,
-            )
-            stmt = ailment.Stmt.Assignment(
-                self._ail_manager.next_atom(),
-                fullreg_dst,
-                arg_vvar,
-                ins_addr=self.function.addr,
-                vex_block_addr=self.function.addr,
-            )
-            new_stmts.append(stmt)
-
-        non_label_stmt_idx = first_nonlabel_statement_id(entrypoint)
-        # update the ail block in-place
-        entrypoint.statements = (
-            entrypoint.statements[:non_label_stmt_idx] + new_stmts + entrypoint.statements[non_label_stmt_idx:]
-        )
-        return ail_graph
+        return arg_vvars
 
     @timethis
-    def _transform_to_ssa_level0(self, ail_graph: networkx.DiGraph) -> networkx.DiGraph:
+    def _transform_to_ssa_level0(
+        self, ail_graph: networkx.DiGraph, func_args: set[ailment.Expr.VirtualVariable]
+    ) -> networkx.DiGraph:
         ssailification = self.project.analyses[Ssailification].prep(fail_fast=self._fail_fast)(
             self.function,
             ail_graph,
             entry=next(iter(bb for bb in ail_graph if (bb.addr, bb.idx) == self.entry_node_addr)),
             ail_manager=self._ail_manager,
             ssa_stackvars=False,
+            func_args=func_args,
             vvar_id_start=self.vvar_id_start,
         )
         self.vvar_id_start = ssailification.max_vvar_id + 1
         return ssailification.out_graph
 
     @timethis
-    def _transform_to_ssa_level1(self, ail_graph: networkx.DiGraph) -> networkx.DiGraph:
+    def _transform_to_ssa_level1(
+        self, ail_graph: networkx.DiGraph, func_args: set[ailment.Expr.VirtualVariable]
+    ) -> networkx.DiGraph:
         ssailification = self.project.analyses.Ssailification(
             self.function,
             ail_graph,
@@ -1387,6 +1366,7 @@ class Clinic(Analysis):
             ail_manager=self._ail_manager,
             ssa_tmps=True,
             ssa_stackvars=True,
+            func_args=func_args,
             vvar_id_start=self.vvar_id_start,
         )
         self.vvar_id_start = ssailification.max_vvar_id + 1
@@ -1444,7 +1424,7 @@ class Clinic(Analysis):
         return []
 
     @timethis
-    def _make_callsites(self, ail_graph, stack_pointer_tracker=None):
+    def _make_callsites(self, ail_graph, func_args: set[ailment.Expr.VirtualVariable], stack_pointer_tracker=None):
         """
         Simplify all function call statements.
         """
@@ -1453,6 +1433,7 @@ class Clinic(Analysis):
         rd = self.project.analyses.SReachingDefinitions(
             subject=self.function,
             func_graph=ail_graph,
+            func_args=func_args,
             fail_fast=self._fail_fast,
             # use_callee_saved_regs_at_return=not self._register_save_areas_removed,  FIXME
         )
@@ -1709,6 +1690,9 @@ class Clinic(Analysis):
             elif stmt_type is ailment.Stmt.ConditionalJump:
                 self._link_variables_on_expr(variable_manager, global_variables, block, stmt_idx, stmt, stmt.condition)
 
+            elif stmt_type is ailment.Stmt.Jump and not isinstance(stmt.target, ailment.Expr.Const):
+                self._link_variables_on_expr(variable_manager, global_variables, block, stmt_idx, stmt, stmt.target)
+
             elif stmt_type is ailment.Stmt.Call:
                 self._link_variables_on_call(variable_manager, global_variables, block, stmt_idx, stmt, is_expr=False)
 
@@ -2732,6 +2716,69 @@ class Clinic(Analysis):
 
         return extra_regs
 
+    def _rewrite_rust_probestack_call(self, ail_graph):
+        for node in ail_graph:
+            if not node.statements or ail_graph.out_degree[node] != 1:
+                continue
+            last_stmt = node.statements[-1]
+            if isinstance(last_stmt, ailment.Stmt.Call) and isinstance(last_stmt.target, ailment.Expr.Const):
+                func = (
+                    self.project.kb.functions.get_by_addr(last_stmt.target.value)
+                    if self.project.kb.functions.contains_addr(last_stmt.target.value)
+                    else None
+                )
+                if func is not None and func.info.get("is_rust_probestack", False) is True:
+                    # get rid of this call
+                    node.statements = node.statements[:-1]
+                    if self.project.arch.call_pushes_ret and node.statements:
+                        last_stmt = node.statements[-1]
+                        succ = next(iter(ail_graph.successors(node)))
+                        if (
+                            isinstance(last_stmt, ailment.Stmt.Store)
+                            and isinstance(last_stmt.addr, ailment.Expr.StackBaseOffset)
+                            and isinstance(last_stmt.addr.offset, int)
+                            and last_stmt.addr.offset < 0
+                            and isinstance(last_stmt.data, ailment.Expr.Const)
+                            and last_stmt.data.value == succ.addr
+                        ):
+                            # remove the statement that pushes the return address
+                            node.statements = node.statements[:-1]
+                    break
+        return ail_graph
+
+    def _rewrite_windows_stkchk_call(self, ail_graph) -> networkx.DiGraph:
+        if not (self.project.simos is not None and self.project.simos.name == "Win32"):
+            return ail_graph
+
+        for node in ail_graph:
+            if not node.statements or ail_graph.out_degree[node] != 1:
+                continue
+            last_stmt = node.statements[-1]
+            if isinstance(last_stmt, ailment.Stmt.Call) and isinstance(last_stmt.target, ailment.Expr.Const):
+                func = (
+                    self.project.kb.functions.get_by_addr(last_stmt.target.value)
+                    if self.project.kb.functions.contains_addr(last_stmt.target.value)
+                    else None
+                )
+                if func is not None and func.name == "__chkstk":
+                    # get rid of this call
+                    node.statements = node.statements[:-1]
+                    if self.project.arch.call_pushes_ret and node.statements:
+                        last_stmt = node.statements[-1]
+                        succ = next(iter(ail_graph.successors(node)))
+                        if (
+                            isinstance(last_stmt, ailment.Stmt.Store)
+                            and isinstance(last_stmt.addr, ailment.Expr.StackBaseOffset)
+                            and isinstance(last_stmt.addr.offset, int)
+                            and last_stmt.addr.offset < 0
+                            and isinstance(last_stmt.data, ailment.Expr.Const)
+                            and last_stmt.data.value == succ.addr
+                        ):
+                            # remove the statement that pushes the return address
+                            node.statements = node.statements[:-1]
+                    break
+        return ail_graph
+
     def _rewrite_alloca(self, ail_graph):
         # pylint:disable=too-many-boolean-expressions
         alloca_node = None

angr/analyses/decompiler/condition_processor.py

@@ -721,6 +721,8 @@ class ConditionProcessor:
         :return: None
         """
 
+        if not isinstance(cond, claripy.ast.Base):
+            return cond
         if memo is None:
             memo = {}
         if cond._hash in memo:

angr/analyses/decompiler/decompiler.py

@@ -368,6 +368,7 @@ class Decompiler(Analysis):
         self.cache.clinic = self.clinic
 
         self.kb.decompilations[(self.func.addr, self._flavor)] = self.cache
+        self._finish_progress()
 
     def _recover_regions(self, graph: networkx.DiGraph, condition_processor, update_graph: bool = True):
         return self.project.analyses[RegionIdentifier].prep(kb=self.kb, fail_fast=self._fail_fast)(

angr/analyses/decompiler/dephication/dephication_base.py

@@ -77,6 +77,8 @@ class DephicationBase(Analysis):
             mapped_phivarid = phivarid_to_phivarid.get(phi_varid, phi_varid)
             for varid in varids:
                 vvar_to_vvar[varid] = mapped_phivarid
+            if phi_varid != mapped_phivarid:
+                vvar_to_vvar[phi_varid] = mapped_phivarid
 
         return vvar_to_vvar
 

angr/analyses/decompiler/dephication/rewriting_engine.py

@@ -88,12 +88,14 @@ class SimEngineDephiRewriting(SimEngineNostmtAIL[None, Expression | None, Statem
             )
 
         if new_dst is not None or new_src is not None:
-            return Assignment(
-                stmt.idx,
-                stmt.dst if new_dst is None else new_dst,
-                stmt.src if new_src is None else new_src,
-                **stmt.tags,
-            )
+            # ensure we do not generate vvar_A = vvar_A
+            dst = stmt.dst if new_dst is None else new_dst
+            src = stmt.src if new_src is None else new_src
+            if isinstance(dst, VirtualVariable) and isinstance(src, VirtualVariable) and dst.varid == src.varid:
+                # skip it
+                return ()
+
+            return Assignment(stmt.idx, dst, src, **stmt.tags)
         return None
 
     def _handle_stmt_Store(self, stmt):

angr/analyses/decompiler/dephication/seqnode_dephication.py

@@ -5,7 +5,7 @@ from typing import Any
 
 from ailment.block import Block
 from ailment.statement import Assignment
-from ailment.expression import VirtualVariable, Phi
+from ailment.expression import VirtualVariable, Phi, BinaryOp, UnaryOp
 
 import angr
 from angr.utils.ail import is_phi_assignment
@@ -60,6 +60,9 @@ class SeqNodeRewriter(SequenceWalker):
                 Block: self._handle_Block,
                 # statement handlers
                 Assignment: self._handle_Assignment,
+                # expression handlers
+                BinaryOp: self._handle_BinaryOp,
+                UnaryOp: self._handle_UnaryOp,
             }
         )
 
@@ -74,6 +77,12 @@ class SeqNodeRewriter(SequenceWalker):
     def _handle_Assignment(self, stmt: Assignment, **kwargs) -> Assignment:  # pylint:disable=unused-argument
         return self.engine._handle_stmt_Assignment(stmt)
 
+    def _handle_BinaryOp(self, expr, **kwargs):  # pylint:disable=unused-argument
+        return self.engine._handle_expr_BinaryOp(expr)
+
+    def _handle_UnaryOp(self, expr, **kwargs):  # pylint:disable=unused-argument
+        return self.engine._handle_expr_UnaryOp(expr)
+
     def _handle_Block(self, block: Block, **kwargs) -> Block | None:  # pylint:disable=unused-argument
         self.engine.out_block = None
         self.engine.process(None, block=block)

angr/analyses/decompiler/optimization_passes/duplication_reverter/ail_merge_graph.py

@@ -304,7 +304,7 @@ class AILMergeGraph:
         end_pair_map = {}
         end_pairs = set()
         merge_to_end_pair = {}
-        for split, sblocks in self.merge_blocks_to_originals.items():
+        for sblocks in self.merge_blocks_to_originals.values():
             for sblock in sblocks:
                 if isinstance(sblock, AILBlockSplit) and sblock.original in self.merge_blocks_to_originals:
                     deletable_blocks.add(sblock.original)
@@ -429,7 +429,7 @@ class AILMergeGraph:
                     self.original_split_blocks[updated] = self.original_split_blocks[k]
                     del self.original_split_blocks[k]
 
-            for k, v in self.original_split_blocks.items():
+            for v in self.original_split_blocks.values():
                 for sblock in v:
                     for attr in ["up_split", "match_split", "down_split"]:
                         if getattr(sblock, attr) == original:

angr/analyses/decompiler/optimization_passes/duplication_reverter/duplication_reverter.py

@@ -167,7 +167,7 @@ class DuplicationReverter(StructuringOptimizationPass):
 
     def _reinsert_merged_candidate(self, ail_merge_graph: AILMergeGraph, candidate: tuple[Block, Block]) -> bool:
         og_succs, og_preds = {}, {}
-        for block, original_blocks in ail_merge_graph.original_blocks.items():
+        for original_blocks in ail_merge_graph.original_blocks.values():
             # collect all the old edges
             for og_block in original_blocks:
                 og_succs[og_block] = list(self.write_graph.successors(og_block))
@@ -364,7 +364,7 @@ class DuplicationReverter(StructuringOptimizationPass):
             new_nodes[node] = new_node
 
         # fixup every single jump target (before adding them to the graph)
-        for src, dst, data in graph.edges(data=True):
+        for src, dst in graph.edges():
             new_src = new_nodes[src]
             new_dst = new_nodes[dst]
             if new_dst is not dst: