angr 9.2.137__tar.gz → 9.2.138__tar.gz

{angr-9.2.137/angr.egg-info → angr-9.2.138}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: angr
-Version: 9.2.137
+Version: 9.2.138
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 Home-page: https://github.com/angr/angr
 License: BSD-2-Clause
@@ -16,13 +16,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: CppHeaderParser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.137
-Requires-Dist: archinfo==9.2.137
+Requires-Dist: ailment==9.2.138
+Requires-Dist: archinfo==9.2.138
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.137
-Requires-Dist: cle==9.2.137
+Requires-Dist: claripy==9.2.138
+Requires-Dist: cle==9.2.138
 Requires-Dist: itanium-demangler
 Requires-Dist: mulpyplexer
 Requires-Dist: nampa
@@ -31,7 +31,7 @@ Requires-Dist: protobuf>=5.28.2
 Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.137
+Requires-Dist: pyvex==9.2.138
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.137 → angr-9.2.138}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.137"
+__version__ = "9.2.138"
 
 if bytes is str:
     raise Exception(

{angr-9.2.137 → angr-9.2.138}/angr/analyses/cfg/cfg_fast.py

@@ -2103,6 +2103,9 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     addr_ = addr_.concrete_value
                 if not isinstance(addr_, int):
                     continue
+                # is it valid?
+                if self.project.loader.find_object_containing(addr_) is None:
+                    continue
                 entries += self._create_jobs(
                     addr_,
                     jumpkind,

{angr-9.2.137 → angr-9.2.138}/angr/analyses/complete_calling_conventions.py

@@ -17,7 +17,7 @@ from angr.utils.graph import GraphUtils
 from angr.simos import SimWindows
 from angr.utils.mp import mp_context, Initializer
 from angr.knowledge_plugins.cfg import CFGModel
-from . import Analysis, register_analysis, VariableRecoveryFast, CallingConventionAnalysis, FactCollector
+from . import Analysis, register_analysis, VariableRecoveryFast, CallingConventionAnalysis, FactCollector, CFGFast
 
 if TYPE_CHECKING:
     from angr.calling_conventions import SimCC
@@ -56,7 +56,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
         recover_variables=False,
         low_priority=False,
         force=False,
-        cfg: CFGModel | None = None,
+        cfg: CFGFast | CFGModel | None = None,
         analyze_callsites: bool = False,
         skip_signature_matched_functions: bool = False,
         max_function_blocks: int | None = None,
@@ -89,7 +89,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
         self._recover_variables = recover_variables
         self._low_priority = low_priority
         self._force = force
-        self._cfg = cfg
+        self._cfg: CFGModel | None = cfg.model if isinstance(cfg, CFGFast) else cfg
         self._analyze_callsites = analyze_callsites
         self._skip_signature_matched_functions = skip_signature_matched_functions
         self._max_function_blocks = max_function_blocks

{angr-9.2.137 → angr-9.2.138}/angr/analyses/decompiler/decompilation_options.py

@@ -229,6 +229,16 @@ options = [
         default_value=True,
         clears_cache=True,
     ),
+    O(
+        "Show block addresses",
+        "Show block addresses as comments",
+        bool,
+        "codegen",
+        "display_block_addrs",
+        category="Display",
+        default_value=False,
+        clears_cache=True,
+    ),
     O(
         "Multi-expression statements generation",
         "Should the structuring algorithm generate multi-expression statements? If so, under what conditions?",

{angr-9.2.137 → angr-9.2.138}/angr/analyses/decompiler/optimization_passes/flip_boolean_cmp.py

@@ -17,7 +17,7 @@ class FlipBooleanWalker(SequenceWalker):
     Uses the flip_size to determine when to flip the condition on large if-statement bodies.
     """
 
-    def __init__(self, graph, flip_size=10, last_node=None):
+    def __init__(self, graph, flip_size=9, last_node=None):
         super().__init__()
         self._graph = graph
         self._last_node = last_node
@@ -77,7 +77,7 @@ class FlipBooleanCmp(SequenceOptimizationPass):
     NAME = "Flip small ret booleans"
     DESCRIPTION = "When false node has no successors, flip condition so else scope can be simplified later"
 
-    def __init__(self, func, flip_size=10, **kwargs):
+    def __init__(self, func, flip_size=9, **kwargs):
         super().__init__(func, **kwargs)
         self._graph = kwargs.get("graph")
         self._flip_size = flip_size

angr-9.2.138/angr/analyses/decompiler/peephole_optimizations/remove_redundant_nots.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+from ailment.expression import BinaryOp, UnaryOp
+
+from .base import PeepholeOptimizationExprBase
+
+
+class RemoveRedundantNots(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "Remove redundant Nots"
+    expr_classes = (UnaryOp,)  # all expressions are allowed
+
+    def optimize(self, expr: UnaryOp, **kwargs):
+        # Not(Not(expr)) ==> expr
+        if expr.op == "Not":
+            if isinstance(expr.operand, UnaryOp):
+                if expr.operand.op == "Not":
+                    return expr.operand.operand
+            elif isinstance(expr.operand, BinaryOp) and expr.operand.op in BinaryOp.COMPARISON_NEGATION:
+                inner = expr.operand
+                negated_op = BinaryOp.COMPARISON_NEGATION[expr.operand.op]
+                return BinaryOp(
+                    inner.idx,
+                    negated_op,
+                    inner.operands,
+                    inner.signed,
+                    bits=inner.bits,
+                    floating_point=inner.floating_point,
+                    rounding_mode=inner.rounding_mode,
+                    vector_count=inner.vector_count,
+                    vector_size=inner.vector_size,
+                    **inner.tags,
+                )
+
+        return None

{angr-9.2.137 → angr-9.2.138}/angr/analyses/s_propagator.py

@@ -4,6 +4,8 @@ import contextlib
 from collections.abc import Mapping
 from collections import defaultdict
 
+import networkx
+
 from ailment.block import Block
 from ailment.expression import (
     Const,
@@ -22,6 +24,8 @@ from angr.analyses import Analysis, register_analysis
 from angr.utils.ssa import (
     get_vvar_uselocs,
     get_vvar_deflocs,
+    has_ite_expr,
+    has_ite_stmt,
     is_phi_assignment,
     is_const_assignment,
     is_const_and_vvar_assignment,
@@ -51,7 +55,7 @@ class SPropagatorAnalysis(Analysis):
     def __init__(  # pylint: disable=too-many-positional-arguments
         self,
         subject: Block | Function,
-        func_graph=None,
+        func_graph: networkx.DiGraph | None = None,
         only_consts: bool = True,
         stack_pointer_tracker=None,
         func_args: set[VirtualVariable] | None = None,
@@ -140,6 +144,9 @@ class SPropagatorAnalysis(Analysis):
             if isinstance(defloc, ExternalCodeLocation):
                 continue
 
+            assert defloc.block_addr is not None
+            assert defloc.stmt_idx is not None
+
             block = blocks[(defloc.block_addr, defloc.block_idx)]
             stmt = block.statements[defloc.stmt_idx]
             r, v = is_const_assignment(stmt)
@@ -155,32 +162,45 @@ class SPropagatorAnalysis(Analysis):
             if v is not None:
                 src_varids = {vvar.varid if vvar is not None else None for _, vvar in v.src_and_vvars}
                 if None not in src_varids and all(varid in const_vvars for varid in src_varids):
+                    all_int_src_varids: set[int] = {varid for varid in src_varids if varid is not None}
                     src_values = {
                         (
                             (const_vvars[varid].value, const_vvars[varid].bits)
                             if isinstance(const_vvars[varid], Const)
                             else const_vvars[varid]
                         )
-                        for varid in src_varids
+                        for varid in all_int_src_varids
                     }
                     if len(src_values) == 1:
                         # replace it!
-                        const_value = const_vvars[next(iter(src_varids))]
+                        const_value = const_vvars[next(iter(all_int_src_varids))]
                         const_vvars[vvar.varid] = const_value
                         for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
                             replacements[useloc][vvar_at_use] = const_value
 
             if self.mode == "function" and vvar.varid in vvar_uselocs:
+                if len(vvar_uselocs[vvar.varid]) <= 2 and isinstance(stmt, Assignment) and isinstance(stmt.src, Load):
+                    # do we want to propagate this Load expression if it's used for less than twice?
+                    # it's often seen in the following pattern, where propagation will be beneficial:
+                    #    v0 = Load(...)
+                    #    if (!v0) {
+                    #       v1 = v0 + 1;
+                    #    }
+                    can_replace = True
+                    for _, vvar_useloc in vvar_uselocs[vvar.varid]:
+                        if self.has_store_stmt_in_between(blocks, defloc, vvar_useloc):
+                            can_replace = False
+
+                    if can_replace:
+                        # we can propagate this load because there is no store between its def and use
+                        for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                            replacements[vvar_useloc][vvar_used] = stmt.src
+                        continue
+
                 if len(vvar_uselocs[vvar.varid]) == 1:
                     vvar_used, vvar_useloc = next(iter(vvar_uselocs[vvar.varid]))
-                    if (
-                        is_const_vvar_load_assignment(stmt)
-                        and vvar_useloc.block_addr == defloc.block_addr
-                        and vvar_useloc.block_idx == defloc.block_idx
-                        and not any(
-                            isinstance(stmt_, Store)
-                            for stmt_ in block.statements[defloc.stmt_idx + 1 : vvar_useloc.stmt_idx]
-                        )
+                    if is_const_vvar_load_assignment(stmt) and not self.has_store_stmt_in_between(
+                        blocks, defloc, vvar_useloc
                     ):
                         # we can propagate this load because there is no store between its def and use
                         replacements[vvar_useloc][vvar_used] = stmt.src
@@ -189,6 +209,8 @@ class SPropagatorAnalysis(Analysis):
                     if is_const_and_vvar_assignment(stmt):
                         # if the useloc is a phi assignment statement, ensure that stmt.src is the same as the phi
                         # variable
+                        assert vvar_useloc.block_addr is not None
+                        assert vvar_useloc.stmt_idx is not None
                         useloc_stmt = blocks[(vvar_useloc.block_addr, vvar_useloc.block_idx)].statements[
                             vvar_useloc.stmt_idx
                         ]
@@ -203,21 +225,31 @@ class SPropagatorAnalysis(Analysis):
                             replacements[vvar_useloc][vvar_used] = stmt.src
                         continue
 
-                elif (
-                    len(
-                        {
-                            loc
-                            for _, loc in vvar_uselocs[vvar.varid]
-                            if (loc.block_addr, loc.block_idx, loc.stmt_idx) not in (retsites | jumpsites)
-                        }
-                    )
-                    == 1
-                ):
+                else:
+                    non_exitsite_uselocs = [
+                        loc
+                        for _, loc in vvar_uselocs[vvar.varid]
+                        if (loc.block_addr, loc.block_idx, loc.stmt_idx) not in (retsites | jumpsites)
+                    ]
                     if is_const_and_vvar_assignment(stmt):
-                        # this vvar is used once if we exclude its uses at ret sites or jump sites. we can propagate it
-                        for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
-                            replacements[vvar_useloc][vvar_used] = stmt.src
-                        continue
+                        if len(non_exitsite_uselocs) == 1:
+                            # this vvar is used once if we exclude its uses at ret sites or jump sites. we can
+                            # propagate it
+                            for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                                replacements[vvar_useloc][vvar_used] = stmt.src
+                            continue
+
+                        if len(set(non_exitsite_uselocs)) == 1 and not has_ite_expr(stmt.src):
+                            useloc = non_exitsite_uselocs[0]
+                            assert useloc.block_addr is not None
+                            assert useloc.stmt_idx is not None
+                            useloc_stmt = blocks[(useloc.block_addr, useloc.block_idx)].statements[useloc.stmt_idx]
+                            if stmt.src.depth <= 3 and not has_ite_stmt(useloc_stmt):
+                                # remove duplicate use locs (e.g., if the variable is used multiple times by the same
+                                # statement) - but ensure stmt is simple enough
+                                for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                                    replacements[vvar_useloc][vvar_used] = stmt.src
+                                continue
 
                 # special logic for global variables: if it's used once or multiple times, and the variable is never
                 # updated before it's used, we will propagate the load
@@ -226,7 +258,11 @@ class SPropagatorAnalysis(Analysis):
                     # unpack conversions
                     while isinstance(stmt_src, Convert):
                         stmt_src = stmt_src.operand
-                    if isinstance(stmt_src, Load) and isinstance(stmt_src.addr, Const):
+                    if (
+                        isinstance(stmt_src, Load)
+                        and isinstance(stmt_src.addr, Const)
+                        and isinstance(stmt_src.addr.value, int)
+                    ):
                         gv_updated = False
                         for _vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
                             gv_updated |= self.is_global_variable_updated(
@@ -286,6 +322,8 @@ class SPropagatorAnalysis(Analysis):
         for block_loc, tmp_and_uses in tmp_uselocs.items():
             for tmp_atom, tmp_uses in tmp_and_uses.items():
                 # take a look at the definition and propagate the definition if supported
+                assert block_loc.block_addr is not None
+
                 block = blocks[(block_loc.block_addr, block_loc.block_idx)]
                 tmp_def_stmtidx = tmp_deflocs[block_loc][tmp_atom]
 
@@ -350,6 +388,8 @@ class SPropagatorAnalysis(Analysis):
 
             start_stmt_idx = defloc.stmt_idx if block is defblock else 0  # inclusive
             end_stmt_idx = useloc.stmt_idx if block is useblock else len(block.statements)  # exclusive
+            assert start_stmt_idx is not None
+            assert end_stmt_idx is not None
 
             for idx in range(start_stmt_idx, end_stmt_idx):
                 stmt = block.statements[idx]
@@ -380,5 +420,43 @@ class SPropagatorAnalysis(Analysis):
 
         return False
 
+    def has_store_stmt_in_between(
+        self, blocks: dict[tuple[int, int | None], Block], defloc: CodeLocation, useloc: CodeLocation
+    ) -> bool:
+        assert defloc.block_addr is not None
+        assert defloc.stmt_idx is not None
+        assert useloc.block_addr is not None
+        assert useloc.stmt_idx is not None
+        assert self.func_graph is not None
+
+        use_block = blocks[(useloc.block_addr, useloc.block_idx)]
+        def_block = blocks[(defloc.block_addr, defloc.block_idx)]
+
+        # traverse the graph, go from use_block until we reach def_block, and look for Store statements
+        seen = {use_block}
+        queue = [use_block]
+        while queue:
+            block = queue.pop(0)
+
+            starting_stmt_idx, ending_stmt_idx = 0, len(block.statements)
+            if block is def_block:
+                starting_stmt_idx = defloc.stmt_idx + 1
+            if block is use_block:
+                ending_stmt_idx = useloc.stmt_idx + 1
+
+            for i in range(starting_stmt_idx, ending_stmt_idx):
+                if isinstance(block.statements[i], Store):
+                    return True
+
+            if block is def_block:
+                continue
+
+            for pred in self.func_graph.predecessors(block):
+                if pred not in seen:
+                    seen.add(pred)
+                    queue.append(pred)
+
+        return False
+
 
 register_analysis(SPropagatorAnalysis, "SPropagator")

{angr-9.2.137 → angr-9.2.138}/angr/procedures/glibc/__libc_start_main.py

@@ -251,11 +251,18 @@ class __libc_start_main(angr.SimProcedure):
         args = cc.get_args(state, ty)
         main, _, _, init, fini = self._extract_args(blank_state, *args)
 
-        return [
-            {"address": init, "jumpkind": "Ijk_Call", "namehint": "init"},
+        # skip invalid results
+        result = [
             {"address": main, "jumpkind": "Ijk_Call", "namehint": "main"},
-            {"address": fini, "jumpkind": "Ijk_Call", "namehint": "fini"},
         ]
+        if init.concrete and init.concrete_value != 0:
+            init_item = {"address": init, "jumpkind": "Ijk_Call", "namehint": "init"}
+            result.insert(0, init_item)
+        if fini.concrete and fini.concrete_value != 0:
+            fini_item = {"address": fini, "jumpkind": "Ijk_Call", "namehint": "fini"}
+            result.append(fini_item)
+
+        return result
 
     @staticmethod
     def _extract_args(state, main, argc, argv, init, fini):

{angr-9.2.137 → angr-9.2.138}/angr/utils/ssa/__init__.py

@@ -4,7 +4,7 @@ from typing import Any, Literal, overload
 
 import archinfo
 from ailment import Expression, Block
-from ailment.expression import VirtualVariable, Const, Phi, Tmp, Load, Register, StackBaseOffset, DirtyExpression
+from ailment.expression import VirtualVariable, Const, Phi, Tmp, Load, Register, StackBaseOffset, DirtyExpression, ITE
 from ailment.statement import Statement, Assignment, Call
 from ailment.block_walker import AILBlockWalkerBase
 
@@ -213,12 +213,25 @@ def is_dephi_vvar(vvar: VirtualVariable) -> bool:
     return vvar.varid == DEPHI_VVAR_REG_OFFSET
 
 
+def has_ite_expr(expr: Expression) -> bool:
+    walker = AILBlacklistExprTypeWalker((ITE,))
+    walker.walk_expression(expr)
+    return walker.has_blacklisted_exprs
+
+
+def has_ite_stmt(stmt: Statement) -> bool:
+    walker = AILBlacklistExprTypeWalker((ITE,))
+    walker.walk_statement(stmt)
+    return walker.has_blacklisted_exprs
+
+
 __all__ = (
     "VVarUsesCollector",
     "get_tmp_deflocs",
     "get_tmp_uselocs",
     "get_vvar_deflocs",
     "get_vvar_uselocs",
+    "has_ite_expr",
     "is_const_and_vvar_assignment",
     "is_const_assignment",
     "is_const_vvar_load_assignment",

{angr-9.2.137 → angr-9.2.138/angr.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: angr
-Version: 9.2.137
+Version: 9.2.138
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 Home-page: https://github.com/angr/angr
 License: BSD-2-Clause
@@ -16,13 +16,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: CppHeaderParser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.137
-Requires-Dist: archinfo==9.2.137
+Requires-Dist: ailment==9.2.138
+Requires-Dist: archinfo==9.2.138
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.137
-Requires-Dist: cle==9.2.137
+Requires-Dist: claripy==9.2.138
+Requires-Dist: cle==9.2.138
 Requires-Dist: itanium-demangler
 Requires-Dist: mulpyplexer
 Requires-Dist: nampa
@@ -31,7 +31,7 @@ Requires-Dist: protobuf>=5.28.2
 Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.137
+Requires-Dist: pyvex==9.2.138
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.137 → angr-9.2.138}/angr.egg-info/requires.txt

@@ -1,12 +1,12 @@
 CppHeaderParser
 GitPython
-ailment==9.2.137
-archinfo==9.2.137
+ailment==9.2.138
+archinfo==9.2.138
 cachetools
 capstone==5.0.3
 cffi>=1.14.0
-claripy==9.2.137
-cle==9.2.137
+claripy==9.2.138
+cle==9.2.138
 itanium-demangler
 mulpyplexer
 nampa
@@ -15,7 +15,7 @@ protobuf>=5.28.2
 psutil
 pycparser>=2.18
 pyformlang
-pyvex==9.2.137
+pyvex==9.2.138
 rich>=13.1.0
 sortedcontainers
 sympy

{angr-9.2.137 → angr-9.2.138}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=59", "wheel", "pyvex==9.2.137", "unicorn==2.0.1.post1"]
+requires = ["setuptools>=59", "wheel", "pyvex==9.2.138", "unicorn==2.0.1.post1"]
 build-backend = "setuptools.build_meta"
 
 [tool.black]

{angr-9.2.137 → angr-9.2.138}/setup.cfg

@@ -21,13 +21,13 @@ packages = find:
 install_requires = 
 	CppHeaderParser
 	GitPython
-	ailment==9.2.137
-	archinfo==9.2.137
+	ailment==9.2.138
+	archinfo==9.2.138
 	cachetools
 	capstone==5.0.3
 	cffi>=1.14.0
-	claripy==9.2.137
-	cle==9.2.137
+	claripy==9.2.138
+	cle==9.2.138
 	itanium-demangler
 	mulpyplexer
 	nampa
@@ -36,7 +36,7 @@ install_requires =
 	psutil
 	pycparser>=2.18
 	pyformlang
-	pyvex==9.2.137
+	pyvex==9.2.138
 	rich>=13.1.0
 	sortedcontainers
 	sympy

angr-9.2.137/angr/analyses/decompiler/peephole_optimizations/remove_redundant_nots.py

@@ -1,18 +0,0 @@
-from __future__ import annotations
-from ailment.expression import UnaryOp
-
-from .base import PeepholeOptimizationExprBase
-
-
-class RemoveRedundantNots(PeepholeOptimizationExprBase):
-    __slots__ = ()
-
-    NAME = "Remove redundant Nots"
-    expr_classes = (UnaryOp,)  # all expressions are allowed
-
-    def optimize(self, expr: UnaryOp, **kwargs):
-        # Not(Not(expr)) ==> expr
-        if expr.op == "Not" and isinstance(expr.operand, UnaryOp) and expr.operand.op == "Not":
-            return expr.operand.operand
-
-        return None