angr 9.2.138__py3-none-manylinux2014_x86_64.whl → 9.2.140__py3-none-manylinux2014_x86_64.whl

angr/analyses/decompiler/optimization_passes/__init__.py

@@ -32,6 +32,7 @@ from .const_prop_reverter import ConstPropOptReverter
 from .call_stmt_rewriter import CallStatementRewriter
 from .duplication_reverter import DuplicationReverter
 from .switch_reused_entry_rewriter import SwitchReusedEntryRewriter
+from .condition_constprop import ConditionConstantPropagation
 
 if TYPE_CHECKING:
     from angr.analyses.decompiler.presets import DecompilationPreset
@@ -66,6 +67,7 @@ ALL_OPTIMIZATION_PASSES = [
     InlinedStringTransformationSimplifier,
     CallStatementRewriter,
     TagSlicer,
+    ConditionConstantPropagation,
 ]
 
 # these passes may duplicate code to remove gotos or improve the structure of the graph
@@ -113,6 +115,7 @@ __all__ = (
     "BasePointerSaveSimplifier",
     "CallStatementRewriter",
     "CodeMotionOptimization",
+    "ConditionConstantPropagation",
     "ConstPropOptReverter",
     "ConstantDereferencesSimplifier",
     "CrossJumpReverter",

angr/analyses/decompiler/optimization_passes/condition_constprop.py

@@ -0,0 +1,149 @@
+from __future__ import annotations
+
+import networkx
+
+from ailment import AILBlockWalker, Block
+from ailment.statement import ConditionalJump, Statement
+from ailment.expression import Const, BinaryOp, VirtualVariable
+
+from angr.analyses.decompiler.region_identifier import RegionIdentifier
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+class ConstantCondition:
+    """
+    Describes an opportunity for replacing a vvar with a constant value.
+    """
+
+    def __init__(self, vvar_id: int, value: Const, block_addr: int, block_idx: int | None):
+        self.vvar_id = vvar_id
+        self.value = value
+        self.block_addr = block_addr
+        self.block_idx = block_idx
+
+    def __repr__(self):
+        return f"<ConstCond vvar_{self.vvar_id} == {self.value} since {self.block_addr:#x}-{self.block_idx}>"
+
+
+class CCondPropBlockWalker(AILBlockWalker):
+    """
+    Block walker for ConditionConstantPropagation to replace vvars with constant values.
+    """
+
+    def __init__(self, vvar_id: int, const_value: Const):
+        super().__init__()
+        self._new_block: Block | None = None  # output
+        self.vvar_id = vvar_id
+        self.const_value = const_value
+
+    def walk(self, block: Block):
+        self._new_block = None
+        super().walk(block)
+        return self._new_block
+
+    def _handle_stmt(self, stmt_idx: int, stmt: Statement, block: Block):  # type: ignore
+        r = super()._handle_stmt(stmt_idx, stmt, block)
+        if r is not None:
+            # replace the original statement
+            if self._new_block is None:
+                self._new_block = block.copy()
+            self._new_block.statements[stmt_idx] = r
+
+    def _handle_VirtualVariable(  # type: ignore
+        self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt: Statement, block: Block | None
+    ) -> Const | None:
+        if expr.varid == self.vvar_id:
+            return Const(expr.idx, None, self.const_value.value, self.const_value.bits, **expr.tags)
+        return None
+
+
+class ConditionConstantPropagation(OptimizationPass):
+    """
+    Reason about constant propagation opportunities from conditionals and propagate constants in the graph accordingly.
+    """
+
+    ARCHES = None
+    PLATFORMS = None
+    STAGE = OptimizationPassStage.AFTER_SINGLE_BLOCK_SIMPLIFICATION
+    NAME = "Propagate constants using information deduced from conditionals."
+    DESCRIPTION = __doc__.strip()  # type: ignore
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+        self.analyze()
+
+    def _check(self):
+        cconds = self._find_const_conditions()
+        if not cconds:
+            return False, None
+        return True, {"cconds": cconds}
+
+    def _analyze(self, cache=None):
+        if not cache or cache.get("cconds", None) is None:  # noqa: SIM108
+            cconds = self._find_const_conditions()
+        else:
+            cconds = cache["cconds"]
+
+        if not cconds:
+            return
+
+        # group cconds according to their sources
+        cconds_by_src: dict[tuple[int, int | None], list[ConstantCondition]] = {}
+        for ccond in cconds:
+            src = ccond.block_addr, ccond.block_idx
+            if src not in cconds_by_src:
+                cconds_by_src[src] = []
+            cconds_by_src[src].append(ccond)
+
+        # calculate a dominance frontier for each block
+        entry_node_addr, entry_node_idx = self.entry_node_addr
+        entry_node = self._get_block(entry_node_addr, idx=entry_node_idx)
+        df = networkx.algorithms.dominance_frontiers(self._graph, entry_node)
+
+        for src, cconds in cconds_by_src.items():
+            head_block = self._get_block(src[0], idx=src[1])
+            if head_block is None:
+                continue
+            frontier = df.get(head_block)
+            if frontier is None:
+                continue
+            graph_slice = RegionIdentifier.slice_graph(self._graph, head_block, frontier, include_frontier=False)
+            for ccond in cconds:
+                walker = CCondPropBlockWalker(ccond.vvar_id, ccond.value)
+                for block in graph_slice:
+                    new_block = walker.walk(block)
+                    if new_block is not None:
+                        self._update_block(block, new_block)
+
+    def _find_const_conditions(self) -> list[ConstantCondition]:
+        cconds = []
+
+        for block in self._graph:
+            if block.statements:
+                last_stmt = block.statements[-1]
+                if (
+                    not isinstance(last_stmt, ConditionalJump)
+                    or not isinstance(last_stmt.true_target, Const)
+                    or not isinstance(last_stmt.false_target, Const)
+                ):
+                    continue
+
+                if isinstance(last_stmt.condition, BinaryOp):
+                    cond = last_stmt.condition
+                    op = cond.op
+                    op0, op1 = cond.operands
+                    if isinstance(op0, Const):
+                        op0, op1 = op1, op0
+                    if isinstance(op0, VirtualVariable) and isinstance(op1, Const) and op1.is_int:
+                        if op == "CmpEQ":
+                            ccond = ConstantCondition(
+                                op0.varid, op1, last_stmt.true_target.value, last_stmt.true_target_idx  # type: ignore
+                            )
+                            cconds.append(ccond)
+                        elif op == "CmpNE":
+                            ccond = ConstantCondition(
+                                op0.varid, op1, last_stmt.false_target.value, last_stmt.false_target_idx  # type: ignore
+                            )
+                            cconds.append(ccond)
+
+        return cconds

angr/analyses/decompiler/optimization_passes/const_prop_reverter.py

@@ -8,7 +8,7 @@ import claripy
 from ailment import Const
 from ailment.block_walker import AILBlockWalkerBase
 from ailment.statement import Call, Statement, ConditionalJump, Assignment, Store, Return
-from ailment.expression import Convert, Register, Expression
+from ailment.expression import Convert, Register, Expression, Load
 
 from .optimization_pass import OptimizationPass, OptimizationPassStage
 from angr.analyses.decompiler.structuring import SAILRStructurer, DreamStructurer
@@ -207,16 +207,17 @@ class ConstPropOptReverter(OptimizationPass):
                     continue
 
                 unwrapped_sym_arg = sym_arg.operands[0] if isinstance(sym_arg, Convert) else sym_arg
-                try:
+                if (
+                    isinstance(unwrapped_sym_arg, Load)
+                    and isinstance(unwrapped_sym_arg.addr, Const)
+                    and isinstance(unwrapped_sym_arg.addr.value, int)
+                ):
                     # TODO: make this support more than just Loads
                     # target must be a Load of a memory location
                     target_atom = MemoryLocation(unwrapped_sym_arg.addr.value, unwrapped_sym_arg.size, "Iend_LE")
                     const_state = self.rd.get_reaching_definitions_by_node(blks[calls[const_arg]].addr, OP_BEFORE)
-
-                    state_load_vals = const_state.get_value_from_atom(target_atom)
-                except AttributeError:
-                    continue
-                except KeyError:
+                    state_load_vals = const_state.get_values(target_atom)
+                else:
                     continue
 
                 if not state_load_vals:

angr/analyses/decompiler/optimization_passes/deadblock_remover.py

@@ -25,13 +25,19 @@ class DeadblockRemover(OptimizationPass):
     PLATFORMS = None
     STAGE = OptimizationPassStage.BEFORE_REGION_IDENTIFICATION
     NAME = "Remove blocks with unsatisfiable conditions"
-    DESCRIPTION = __doc__.strip()
+    DESCRIPTION = __doc__.strip()  # type: ignore
 
-    def __init__(self, func, **kwargs):
+    def __init__(self, func, node_cutoff: int = 200, **kwargs):
         super().__init__(func, **kwargs)
+        self._node_cutoff = node_cutoff
         self.analyze()
 
     def _check(self):
+        # don't run this optimization on super large functions
+        assert self._graph is not None
+        if len(self._graph) >= self._node_cutoff:
+            return False, None
+
         cond_proc = ConditionProcessor(self.project.arch)
         if networkx.is_directed_acyclic_graph(self._graph):
             acyclic_graph = self._graph
@@ -45,7 +51,10 @@ class DeadblockRemover(OptimizationPass):
         cache = {"cond_proc": cond_proc}
         return True, cache
 
-    def _analyze(self, cache=None):
+    def _analyze(self, cache: dict | None = None):
+        assert cache is not None
+        assert self._graph is not None
+
         cond_proc = cache["cond_proc"]
         to_remove = {
             blk

angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py

@@ -136,7 +136,7 @@ class InlinedStringTransformationAILEngine(
                 # jumped to a node that we do not know about
                 break
             block = self.nodes[self.pc]
-            self._process(state, block=block, whitelist=None)
+            self.process(state, block=block, whitelist=None)
             if self.pc is None:
                 # not sure where to jump...
                 break

angr/analyses/decompiler/optimization_passes/ite_region_converter.py

@@ -287,19 +287,27 @@ class ITERegionConverter(OptimizationPass):
                     ((region_head.addr, region_head.idx), original_vvars[0] if original_vvars else None)
                 )
 
-            new_phi = Phi(
-                stmt.src.idx,
-                stmt.src.bits,
-                new_src_and_vvars,
-                **stmt.src.tags,
-            )
-            new_phi_assignment = Assignment(
-                stmt.idx,
-                stmt.dst,
-                new_phi,
-                **stmt.tags,
-            )
-            stmts.append(new_phi_assignment)
+            if len(new_src_and_vvars) == 1:
+                new_assignment = Assignment(
+                    stmt.idx,
+                    stmt.dst,
+                    new_src_and_vvars[0][1],
+                    **stmt.tags,
+                )
+            else:
+                new_phi = Phi(
+                    stmt.src.idx,
+                    stmt.src.bits,
+                    new_src_and_vvars,
+                    **stmt.src.tags,
+                )
+                new_assignment = Assignment(
+                    stmt.idx,
+                    stmt.dst,
+                    new_phi,
+                    **stmt.tags,
+                )
+            stmts.append(new_assignment)
         new_region_tail = Block(region_tail.addr, region_tail.original_size, statements=stmts, idx=region_tail.idx)
 
         #

angr/analyses/decompiler/optimization_passes/optimization_pass.py

@@ -13,7 +13,7 @@ from angr.analyses.decompiler import RegionIdentifier
 from angr.analyses.decompiler.condition_processor import ConditionProcessor
 from angr.analyses.decompiler.goto_manager import Goto, GotoManager
 from angr.analyses.decompiler.structuring import RecursiveStructurer, SAILRStructurer
-from angr.analyses.decompiler.utils import add_labels
+from angr.analyses.decompiler.utils import add_labels, remove_edges_in_ailgraph
 from angr.analyses.decompiler.counters import ControlFlowStructureCounter
 from angr.project import Project
 
@@ -111,12 +111,15 @@ class OptimizationPass(BaseOptimizationPass):
     The base class for any function-level graph optimization pass.
     """
 
+    _graph: networkx.DiGraph
+
     def __init__(
         self,
         func,
+        *,
+        graph,
         blocks_by_addr=None,
         blocks_by_addr_and_idx=None,
-        graph=None,
         variable_kb=None,
         region_identifier=None,
         reaching_definitions=None,
@@ -126,18 +129,20 @@ class OptimizationPass(BaseOptimizationPass):
         force_loop_single_exit: bool = True,
         complete_successors: bool = False,
         avoid_vvar_ids: set[int] | None = None,
+        arg_vvars: set[int] | None = None,
         **kwargs,
     ):
         super().__init__(func)
         # self._blocks is just a cache
         self._blocks_by_addr: dict[int, set[ailment.Block]] = blocks_by_addr or {}
         self._blocks_by_addr_and_idx: dict[tuple[int, int | None], ailment.Block] = blocks_by_addr_and_idx or {}
-        self._graph: networkx.DiGraph | None = graph
+        self._graph = graph
         self._variable_kb = variable_kb
         self._ri = region_identifier
         self._rd = reaching_definitions
         self._scratch = scratch if scratch is not None else {}
         self._new_block_addrs = set()
+        self._arg_vvars = arg_vvars
         self.vvar_id_start = vvar_id_start
         self.entry_node_addr: tuple[int, int | None] = (
             entry_node_addr if entry_node_addr is not None else (func.addr, None)
@@ -328,14 +333,15 @@ class StructuringOptimizationPass(OptimizationPass):
     def __init__(
         self,
         func,
-        prevent_new_gotos=True,
-        strictly_less_gotos=False,
-        recover_structure_fails=True,
-        must_improve_rel_quality=True,
-        max_opt_iters=1,
-        simplify_ail=True,
-        require_gotos=True,
-        readd_labels=False,
+        prevent_new_gotos: bool = True,
+        strictly_less_gotos: bool = False,
+        recover_structure_fails: bool = True,
+        must_improve_rel_quality: bool = True,
+        max_opt_iters: int = 1,
+        simplify_ail: bool = True,
+        require_gotos: bool = True,
+        readd_labels: bool = False,
+        edges_to_remove: list[tuple[tuple[int, int | None], tuple[int, int | None]]] | None = None,
         **kwargs,
     ):
         super().__init__(func, **kwargs)
@@ -347,6 +353,7 @@ class StructuringOptimizationPass(OptimizationPass):
         self._require_gotos = require_gotos
         self._must_improve_rel_quality = must_improve_rel_quality
         self._readd_labels = readd_labels
+        self._edges_to_remove = edges_to_remove or []
 
         # relative quality metrics (excludes gotos)
         self._initial_structure_counter = None
@@ -449,6 +456,8 @@ class StructuringOptimizationPass(OptimizationPass):
         if readd_labels:
             graph = add_labels(graph)
 
+        remove_edges_in_ailgraph(graph, self._edges_to_remove)
+
         self._ri = self.project.analyses[RegionIdentifier].prep(kb=self.kb)(
             self._func,
             graph=graph,
@@ -479,7 +488,7 @@ class StructuringOptimizationPass(OptimizationPass):
         if not rs or not rs.result or not rs.result.nodes or rs.result_incomplete:
             return False
 
-        rs = self.project.analyses.RegionSimplifier(self._func, rs.result, kb=self.kb, variable_kb=self._variable_kb)
+        rs = self.project.analyses.RegionSimplifier(self._func, rs.result, arg_vvars=self._arg_vvars, kb=self.kb)
         if not rs or rs.goto_manager is None or rs.result is None:
             return False
 

angr/analyses/decompiler/optimization_passes/return_duplicator_base.py

@@ -44,7 +44,9 @@ class FreshVirtualVariableRewriter(AILBlockWalker):
 
         return new_stmt
 
-    def _handle_VirtualVariable(self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt, block: Block | None):
+    def _handle_VirtualVariable(  # type:ignore
+        self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt, block: Block | None
+    ) -> VirtualVariable | None:
         if expr.varid in self.vvar_mapping:
             return VirtualVariable(
                 expr.idx,
@@ -58,7 +60,7 @@ class FreshVirtualVariableRewriter(AILBlockWalker):
             )
         return None
 
-    def _handle_stmt(self, stmt_idx: int, stmt, block: Block):
+    def _handle_stmt(self, stmt_idx: int, stmt, block: Block):  # type:ignore
         r = super()._handle_stmt(stmt_idx, stmt, block)
         if r is not None:
             # replace the original statement
@@ -77,10 +79,11 @@ class ReturnDuplicatorBase:
     def __init__(
         self,
         func,
+        *,
+        vvar_id_start: int,
         max_calls_in_regions: int = 2,
         minimize_copies_for_regions: bool = True,
         ri: RegionIdentifier | None = None,
-        vvar_id_start: int | None = None,
         scratch: dict[str, Any] | None = None,
     ):
         self._max_calls_in_region = max_calls_in_regions
@@ -137,11 +140,11 @@ class ReturnDuplicatorBase:
                 ):
                     # every eligible pred gets a new region copy
                     self._copy_region([pred_node], region_head, region, graph)
+                    graph_changed = True
 
             if region_head in graph and graph.in_degree(region_head) == 0:
                 graph.remove_nodes_from(region)
-
-            graph_changed = True
+                graph_changed = True
 
         return graph_changed
 
@@ -257,8 +260,7 @@ class ReturnDuplicatorBase:
                     # not used in this branch. drop this statement
                     continue
                 else:
-                    phi_var = Phi(stmt.src.idx, stmt.src.bits, [((pred.addr, pred.idx), vvar_src)], **stmt.src.tags)
-                    new_stmt = Assignment(stmt.idx, stmt.dst, phi_var, **stmt.tags)
+                    new_stmt = Assignment(stmt.idx, stmt.dst, vvar_src, **stmt.tags)
                     stmts.append(new_stmt)
                     continue
             stmts.append(stmt)
@@ -287,6 +289,8 @@ class ReturnDuplicatorBase:
         self, endnode_regions: dict[Any, tuple[list[tuple[Any, Any]], networkx.DiGraph]], graph: networkx.DiGraph
     ):
         updated_regions = endnode_regions.copy()
+        assert self._ri is not None
+        assert isinstance(self._ri.region, GraphRegion)
         all_region_block_addrs = list(self._find_block_sets_in_all_regions(self._ri.region).values())
         for region_head, (in_edges, region) in endnode_regions.items():
             is_single_const_ret_region = self._is_simple_return_graph(region)
@@ -356,7 +360,7 @@ class ReturnDuplicatorBase:
             return False
 
         # check if the graph is a single successor chain
-        if not all(labeless_graph.out_degree(n) <= 1 for n in nodes):
+        if not all(labeless_graph.out_degree[n] <= 1 for n in nodes):
             return False
 
         # collect the statements from the top node, make sure one exists
@@ -398,7 +402,11 @@ class ReturnDuplicatorBase:
         if ret_exprs and len(ret_exprs) > 1:
             return False
 
-        ret_expr = ReturnDuplicatorBase.unwrap_conv(ret_exprs[0]) if ret_exprs and len(ret_exprs) == 1 else None
+        if not ret_exprs:
+            # a simple return statement that does not carry any value or variable to return
+            return True
+
+        ret_expr = ReturnDuplicatorBase.unwrap_conv(ret_exprs[0])
         # check if ret_expr is a virtual variable or not
         if not isinstance(ret_expr, (VirtualVariable, Const)):
             return False

angr/analyses/decompiler/optimization_passes/return_duplicator_high.py

@@ -4,9 +4,9 @@ from typing import Any
 
 import networkx
 
+from angr.analyses.decompiler.structuring import SAILRStructurer, DreamStructurer
 from .return_duplicator_base import ReturnDuplicatorBase
 from .optimization_pass import OptimizationPass, OptimizationPassStage
-from angr.analyses.decompiler.structuring import SAILRStructurer, DreamStructurer
 
 _l = logging.getLogger(name=__name__)
 
@@ -19,7 +19,7 @@ class ReturnDuplicatorHigh(OptimizationPass, ReturnDuplicatorBase):
 
     ARCHES = None
     PLATFORMS = None
-    STAGE = OptimizationPassStage.AFTER_VARIABLE_RECOVERY
+    STAGE = OptimizationPassStage.AFTER_GLOBAL_SIMPLIFICATION
     NAME = "Duplicate return-only blocks (high)"
     DESCRIPTION = __doc__
     STRUCTURING = [SAILRStructurer.NAME, DreamStructurer.NAME]
@@ -28,27 +28,22 @@ class ReturnDuplicatorHigh(OptimizationPass, ReturnDuplicatorBase):
         self,
         func,
         # settings
+        *,
+        vvar_id_start: int,
         max_calls_in_regions: int = 2,
         minimize_copies_for_regions: bool = True,
-        region_identifier=None,
-        vvar_id_start: int | None = None,
         scratch: dict[str, Any] | None = None,
         **kwargs,
     ):
-        OptimizationPass.__init__(
-            self, func, vvar_id_start=vvar_id_start, scratch=scratch, region_identifier=region_identifier, **kwargs
-        )
+        OptimizationPass.__init__(self, func, vvar_id_start=vvar_id_start, scratch=scratch, **kwargs)
         ReturnDuplicatorBase.__init__(
             self,
             func,
             max_calls_in_regions=max_calls_in_regions,
             minimize_copies_for_regions=minimize_copies_for_regions,
-            ri=region_identifier,
             vvar_id_start=vvar_id_start,
             scratch=scratch,
         )
-        # since we run before the RegionIdentification pass in the decompiler, we need to collect it early here
-        self._ri = self._recover_regions(self._graph)
 
         self.analyze()
 
@@ -60,6 +55,8 @@ class ReturnDuplicatorHigh(OptimizationPass, ReturnDuplicatorBase):
         return dst_is_const_ret
 
     def _analyze(self, cache=None):
+        # since we run before the RegionIdentification pass in the decompiler, we need to collect it early here
+        self._ri = self._recover_regions(self._graph)
         copy_graph = networkx.DiGraph(self._graph)
         if self._analyze_core(copy_graph):
             self.out_graph = self._simplify_graph(copy_graph)

angr/analyses/decompiler/peephole_optimizations/eager_eval.py

@@ -150,7 +150,12 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
             if isinstance(expr.operands[1], Const) and expr.operands[1].value == 1:
                 # x * 1 => x
                 return expr.operands[0]
-            if isinstance(expr.operands[0], Const) and isinstance(expr.operands[1], Const):
+            if (
+                isinstance(expr.operands[0], Const)
+                and expr.operands[0].is_int
+                and isinstance(expr.operands[1], Const)
+                and expr.operands[1].is_int
+            ):
                 # constant multiplication
                 mask = (1 << expr.bits) - 1
                 return Const(
@@ -236,6 +241,10 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
                 return expr.operands[1]
             if isinstance(expr.operands[1], Const) and expr.operands[1].value == 0:
                 return expr.operands[0]
+            if isinstance(expr.operands[0], Const) and expr.operands[0].value == (1 << expr.operands[0].bits) - 1:
+                return expr.operands[0]
+            if isinstance(expr.operands[1], Const) and expr.operands[1].value == (1 << expr.operands[1].bits) - 1:
+                return expr.operands[1]
             if expr.operands[0].likes(expr.operands[1]):
                 return expr.operands[0]
 
@@ -290,6 +299,7 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
     def _optimize_convert(expr: Convert):
         if (
             isinstance(expr.operand, Const)
+            and expr.operand.is_int
             and expr.from_type == Convert.TYPE_INT
             and expr.to_type == Convert.TYPE_INT
             and expr.from_bits > expr.to_bits
@@ -300,6 +310,7 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
             return Const(expr.idx, expr.operand.variable, v, expr.to_bits, **expr.operand.tags)
         if (
             isinstance(expr.operand, Const)
+            and expr.operand.is_int
             and expr.from_type == Convert.TYPE_INT
             and expr.to_type == Convert.TYPE_INT
             and expr.from_bits <= expr.to_bits

angr/analyses/decompiler/peephole_optimizations/remove_redundant_conversions.py

@@ -169,29 +169,65 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
     @staticmethod
     def _optimize_Convert(expr: Convert):
         operand_expr = expr.operand
-        if isinstance(operand_expr, BinaryOp) and operand_expr.op in {
-            "Mul",
-            "Shl",
-            "Div",
-            "DivMod",
-            "Mod",
-            "Add",
-            "Sub",
-        }:
-            op0, op1 = operand_expr.operands
-            if (
-                isinstance(op0, Convert)
-                and isinstance(op1, Convert)
-                and op0.from_bits == op1.from_bits
-                and op0.to_bits == op1.to_bits
-                and expr.from_bits == op0.to_bits
-                and expr.to_bits == op1.from_bits
-            ):
-                return BinaryOp(
-                    operand_expr.idx,
-                    operand_expr.op,
-                    [op0.operand, op1.operand],
-                    expr.is_signed,
-                    **operand_expr.tags,
-                )
+        if isinstance(operand_expr, BinaryOp):
+            if operand_expr.op in {
+                "Mul",
+                "Shl",
+                "Div",
+                "DivMod",
+                "Mod",
+                "Add",
+                "Sub",
+            }:
+                op0, op1 = operand_expr.operands
+                if (
+                    isinstance(op0, Convert)
+                    and isinstance(op1, Convert)
+                    and op0.from_bits == op1.from_bits
+                    and op0.to_bits == op1.to_bits
+                    and expr.from_bits == op0.to_bits
+                    and expr.to_bits == op1.from_bits
+                ):
+                    return BinaryOp(
+                        operand_expr.idx,
+                        operand_expr.op,
+                        [op0.operand, op1.operand],
+                        expr.is_signed,
+                        **operand_expr.tags,
+                    )
+            elif operand_expr.op == "Or" and expr.from_bits > expr.to_bits:
+                # Conv(64->32,((vvar_183{reg 128} & 0xffffffff00000000<64>)
+                #   | Conv(32->64, Load(addr=0x200002dc<32>, size=4, endness=Iend_LE))))
+                # =>
+                # Conv(64->32, Load(addr=0x200002dc<32>, size=4, endness=Iend_LE))
+                high_mask = ((1 << expr.from_bits) - 1) - ((1 << expr.to_bits) - 1)
+                op0, op1 = operand_expr.operands
+                if (
+                    isinstance(op0, BinaryOp)
+                    and op0.op == "And"
+                    and isinstance(op0.operands[1], Const)
+                    and op0.operands[1].value == high_mask
+                ):
+                    return Convert(
+                        expr.idx,
+                        expr.from_bits,
+                        expr.to_bits,
+                        expr.is_signed,
+                        op1,
+                        **expr.tags,
+                    )
+                if (
+                    isinstance(op1, BinaryOp)
+                    and op1.op == "And"
+                    and isinstance(op1.operands[1], Const)
+                    and op1.operands[1].value == high_mask
+                ):
+                    return Convert(
+                        expr.idx,
+                        expr.from_bits,
+                        expr.to_bits,
+                        expr.is_signed,
+                        op0,
+                        **expr.tags,
+                    )
         return None