angr 9.2.138__py3-none-manylinux2014_x86_64.whl → 9.2.140__py3-none-manylinux2014_x86_64.whl

angr/analyses/decompiler/structuring/phoenix.py

@@ -15,7 +15,7 @@ from ailment.expression import Const, UnaryOp, MultiStatementExpression
 
 from angr.utils.graph import GraphUtils
 from angr.utils.ail import is_phi_assignment
-from angr.knowledge_plugins.cfg import IndirectJumpType
+from angr.knowledge_plugins.cfg import IndirectJump, IndirectJumpType
 from angr.utils.constants import SWITCH_MISSING_DEFAULT_NODE_ADDR
 from angr.utils.graph import dominates, to_acyclic_graph, dfs_back_edges
 from angr.analyses.decompiler.sequence_walker import SequenceWalker
@@ -28,6 +28,7 @@ from angr.analyses.decompiler.utils import (
     has_nonlabel_nonphi_statements,
     first_nonlabel_nonphi_statement,
     switch_extract_bitwiseand_jumptable_info,
+    switch_extract_switch_expr_from_jump_target,
 )
 from angr.analyses.decompiler.counters.call_counter import AILCallCounter
 from .structurer_nodes import (
@@ -241,6 +242,7 @@ class PhoenixStructurer(StructurerBase):
     def _match_cyclic_schemas(self, node, head, graph, full_graph) -> bool:
         matched, loop_node, successor_node = self._match_cyclic_while(node, head, graph, full_graph)
         if matched:
+            assert loop_node is not None and successor_node is not None
             # traverse this node and rewrite all conditional jumps that go outside the loop to breaks
             self._rewrite_conditional_jumps_to_breaks(loop_node.sequence_node, [successor_node.addr])
             # traverse this node and rewrite all jumps that go to the beginning of the loop to continue
@@ -249,6 +251,7 @@ class PhoenixStructurer(StructurerBase):
 
         matched, loop_node, successor_node = self._match_cyclic_dowhile(node, head, graph, full_graph)
         if matched:
+            assert loop_node is not None and successor_node is not None
             # traverse this node and rewrite all conditional jumps that go outside the loop to breaks
             self._rewrite_conditional_jumps_to_breaks(loop_node.sequence_node, [successor_node.addr])
             # traverse this node and rewrite all jumps that go to the beginning of the loop to continue
@@ -260,6 +263,7 @@ class PhoenixStructurer(StructurerBase):
                 node, head, graph, full_graph
             )
             if matched:
+                assert loop_node is not None and successor_node is not None
                 # traverse this node and rewrite all conditional jumps that go outside the loop to breaks
                 self._rewrite_conditional_jumps_to_breaks(loop_node.sequence_node, [successor_node.addr])
                 # traverse this node and rewrite all jumps that go to the beginning of the loop to continue
@@ -268,6 +272,7 @@ class PhoenixStructurer(StructurerBase):
 
         matched, loop_node = self._match_cyclic_natural_loop(node, head, graph, full_graph)
         if matched:
+            assert loop_node is not None
             if self._region.successors is not None and len(self._region.successors) == 1:
                 # traverse this node and rewrite all conditional jumps that go outside the loop to breaks
                 self._rewrite_conditional_jumps_to_breaks(
@@ -318,7 +323,7 @@ class PhoenixStructurer(StructurerBase):
                     # otherwise it's a do-while loop
                     edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, head_block, left)
                     edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, head_block, right)
-                    if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                    if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                         # c = !c
                         if head_block_idx == 0:
                             self._remove_first_statement_if_jump(head_block)
@@ -346,7 +351,7 @@ class PhoenixStructurer(StructurerBase):
                 if head_block is not None:
                     edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, head_block, left)
                     edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, head_block, right)
-                    if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                    if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                         # c = !c
                         if PhoenixStructurer._is_single_statement_block(node):
                             # the single-statement-block check is to ensure we don't execute any code before the
@@ -366,6 +371,7 @@ class PhoenixStructurer(StructurerBase):
                             return True, loop_node, right
                         # we generate a while-true loop instead
                         last_stmt = self._remove_last_statement_if_jump(head_block)
+                        assert last_stmt is not None
                         cond_jump = Jump(
                             None,
                             Const(None, None, right.addr, self.project.arch.bits),
@@ -394,7 +400,7 @@ class PhoenixStructurer(StructurerBase):
                     if head_block is not None:
                         edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, head_block, left)
                         edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, head_block, right)
-                        if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                        if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                             # c = !c
                             self._remove_last_statement_if_jump(head_block)
                             cond_break = ConditionalBreakNode(node.addr, edge_cond_right, right.addr)
@@ -426,6 +432,8 @@ class PhoenixStructurer(StructurerBase):
             return False, None, None
 
         loop_cond = None
+        successor_node = None
+        succ_node_is_true_node = None
         if (
             isinstance(node, SequenceNode)
             and node.nodes
@@ -436,21 +444,27 @@ class PhoenixStructurer(StructurerBase):
             and node.nodes[-1].true_node is not None
             and node.nodes[-1].false_node is not None
         ):
-            successor_node = node.nodes[-1].true_node
-            # test if the successor_node returns or not
-            # FIXME: It might be too strict
-            try:
-                last_stmt = self.cond_proc.get_last_statement(successor_node)
-            except EmptyBlockNotice:
-                last_stmt = None
-            if last_stmt is not None and isinstance(last_stmt, Return):
+            # try both true node and false node; pick the first node with only Returns as last statements as the
+            # successor.
+            if self._cyclic_while_with_single_successor_must_return(node.nodes[-1].true_node):
+                succ_node_is_true_node = True
+                successor_node = node.nodes[-1].true_node
                 loop_cond = claripy.Not(node.nodes[-1].condition)
+            elif self._cyclic_while_with_single_successor_must_return(node.nodes[-1].false_node):
+                succ_node_is_true_node = False
+                successor_node = node.nodes[-1].false_node
+                loop_cond = node.nodes[-1].condition
+            else:
+                loop_cond = None
 
         if loop_cond is None:
             return False, None, None
 
         node_copy = node.copy()
-        node_copy.nodes[-1] = node_copy.nodes[-1].false_node  # replace the last node with the false node
+        # replace the last node with the intended successor node
+        node_copy.nodes[-1] = (
+            node_copy.nodes[-1].false_node if succ_node_is_true_node else node_copy.nodes[-1].true_node
+        )
         # check if there is a cycle that starts with node and ends with node
         next_node = node
         seq_node = SequenceNode(node.addr, nodes=[node_copy])
@@ -487,6 +501,15 @@ class PhoenixStructurer(StructurerBase):
 
         return True, loop_node, successor_node
 
+    def _cyclic_while_with_single_successor_must_return(self, successor_node: SequenceNode) -> bool:
+        try:
+            last_stmts = self.cond_proc.get_last_statements(successor_node)
+        except EmptyBlockNotice:
+            return False
+        if not last_stmts:
+            return False
+        return all(isinstance(stmt, Return) for stmt in last_stmts)
+
     def _match_cyclic_dowhile(self, node, head, graph, full_graph) -> tuple[bool, LoopNode | None, BaseNode | None]:
         preds = list(full_graph.predecessors(node))
         succs = list(full_graph.successors(node))
@@ -504,7 +527,7 @@ class PhoenixStructurer(StructurerBase):
                     if succ_block is not None:
                         edge_cond_succhead = self.cond_proc.recover_edge_condition(full_graph, succ_block, node)
                         edge_cond_succout = self.cond_proc.recover_edge_condition(full_graph, succ_block, out_node)
-                        if claripy.is_true(claripy.Not(edge_cond_succhead) == edge_cond_succout):
+                        if claripy.is_true(claripy.Not(edge_cond_succhead) == edge_cond_succout):  # type: ignore
                             # c = !c
                             self._remove_last_statement_if_jump(succ)
                             drop_succ = False
@@ -543,7 +566,7 @@ class PhoenixStructurer(StructurerBase):
                 # possible candidate
                 edge_cond_head = self.cond_proc.recover_edge_condition(full_graph, node, node)
                 edge_cond_head_succ = self.cond_proc.recover_edge_condition(full_graph, node, succ)
-                if claripy.is_true(claripy.Not(edge_cond_head) == edge_cond_head_succ):
+                if claripy.is_true(claripy.Not(edge_cond_head) == edge_cond_head_succ):  # type: ignore
                     # c = !c
                     self._remove_last_statement_if_jump(node)
                     seq_node = SequenceNode(node.addr, nodes=[node]) if not isinstance(node, SequenceNode) else node
@@ -617,9 +640,11 @@ class PhoenixStructurer(StructurerBase):
 
     def _refine_cyclic_core(self, loop_head) -> bool:
         graph: networkx.DiGraph = self._region.graph
-        fullgraph: networkx.DiGraph = self._region.graph_with_successors
-        if fullgraph is None:
-            fullgraph = networkx.DiGraph(self._region.graph)
+        fullgraph: networkx.DiGraph = (
+            self._region.graph_with_successors
+            if self._region.graph_with_successors is not None
+            else networkx.DiGraph(self._region.graph)
+        )
 
         # check if there is an out-going edge from the loop head
         head_succs = list(fullgraph.successors(loop_head))
@@ -638,6 +663,7 @@ class PhoenixStructurer(StructurerBase):
         # for now, we handle the most common case: both successors exist in the graph of the parent region, and
         # one successor has a path to the other successor
         if is_while and is_dowhile and self._parent_region is not None:
+            assert result_while is not None and result_dowhile is not None
             succ_while = result_while[-1]
             succ_dowhile = result_dowhile[-1]
             if succ_while in self._parent_region.graph and succ_dowhile in self._parent_region.graph:
@@ -651,9 +677,11 @@ class PhoenixStructurer(StructurerBase):
                     is_while = False
 
         if is_while:
+            assert result_while is not None
             loop_type = "while"
             continue_edges, outgoing_edges, continue_node, successor = result_while
         elif is_dowhile:
+            assert result_dowhile is not None
             loop_type = "do-while"
             continue_edges, outgoing_edges, continue_node, successor = result_dowhile
 
@@ -736,7 +764,9 @@ class PhoenixStructurer(StructurerBase):
                         # unwanted results, e.g., inserting a break (that's intended to break out of the loop) inside a
                         # switch-case that is nested within a loop.
                         last_src_stmt = self.cond_proc.get_last_statement(src_block)
+                        assert last_src_stmt is not None
                         break_cond = self.cond_proc.recover_edge_condition(fullgraph, src_block, dst)
+                        assert successor.addr is not None
                         if claripy.is_true(break_cond):
                             break_stmt = Jump(
                                 None,
@@ -761,7 +791,9 @@ class PhoenixStructurer(StructurerBase):
                             )
                         new_node = SequenceNode(src_block.addr, nodes=[src_block, break_node])
                         if has_continue:
-                            if self.is_a_jump_target(last_src_stmt, continue_node.addr):
+                            if continue_node.addr is not None and self.is_a_jump_target(
+                                last_src_stmt, continue_node.addr
+                            ):
                                 # instead of a conditional break node, we should insert a condition node instead
                                 break_stmt = Jump(
                                     None,
@@ -817,7 +849,7 @@ class PhoenixStructurer(StructurerBase):
                     if fullgraph.in_degree[dst] == 0:
                         # drop this node
                         fullgraph.remove_node(dst)
-                        if dst in self._region.successors:
+                        if self._region.successors and dst in self._region.successors:
                             self._region.successors.remove(dst)
 
         if len(continue_edges) > 1:
@@ -839,7 +871,7 @@ class PhoenixStructurer(StructurerBase):
                 if cont_block is None:
                     # cont_block is not found. but it's ok. one possibility is that src is a jump table head with one
                     # case being the loop head. in such cases, we can just remove the edge.
-                    if src.addr not in self.kb.cfgs["CFGFast"].jump_tables:
+                    if src.addr not in self.jump_tables:
                         l.debug(
                             "_refine_cyclic_core: Cannot find the block going to loop head for edge %r -> %r. "
                             "Remove the edge anyway.",
@@ -1040,25 +1072,29 @@ class PhoenixStructurer(StructurerBase):
     # switch cases
 
     def _match_acyclic_switch_cases(self, graph: networkx.DiGraph, full_graph: networkx.DiGraph, node) -> bool:
-        if isinstance(node, (SwitchCaseNode, IncompleteSwitchCaseNode)):
+        if isinstance(node, SwitchCaseNode):
+            return False
+
+        r = self._match_acyclic_switch_cases_address_loaded_from_memory_no_default_node(node, graph, full_graph)
+        if r:
+            return r
+
+        if isinstance(node, IncompleteSwitchCaseNode):
             return False
 
         r = self._match_acyclic_switch_cases_incomplete_switch_head(node, graph, full_graph)
         if r:
             return r
-        jump_tables = self.kb.cfgs["CFGFast"].jump_tables
-        r = self._match_acyclic_switch_cases_address_loaded_from_memory_no_ob_check(
-            node, graph, full_graph, jump_tables
-        )
+        r = self._match_acyclic_switch_cases_address_loaded_from_memory_no_ob_check(node, graph, full_graph)
         if r:
             return r
-        r = self._match_acyclic_switch_cases_address_loaded_from_memory(node, graph, full_graph, jump_tables)
+        r = self._match_acyclic_switch_cases_address_loaded_from_memory(node, graph, full_graph)
         if r:
             return r
-        r = self._match_acyclic_switch_cases_address_computed(node, graph, full_graph, jump_tables)
+        r = self._match_acyclic_switch_cases_address_computed(node, graph, full_graph)
         if r:
             return r
-        return self._match_acyclic_incomplete_switch_cases(node, graph, full_graph, jump_tables)
+        return self._match_acyclic_incomplete_switch_cases(node, graph, full_graph)
 
     def _match_acyclic_switch_cases_incomplete_switch_head(self, node, graph, full_graph) -> bool:
         try:
@@ -1074,7 +1110,7 @@ class PhoenixStructurer(StructurerBase):
 
         # make a fake jumptable
         node_default_addr = None
-        case_entries: dict[int, tuple[int, int | None]] = {}
+        case_entries: dict[int, int | tuple[int, int | None]] = {}
         for _, case_value, case_target_addr, case_target_idx, _ in last_stmt.case_addrs:
             if isinstance(case_value, str):
                 if case_value == "default":
@@ -1127,28 +1163,33 @@ class PhoenixStructurer(StructurerBase):
                     if self._region.graph_with_successors is not None:
                         self._region.graph_with_successors.remove_node(o)
 
-        self._switch_handle_gotos(cases, node_default, None)
+        switch_end_addr = self._switch_find_switch_end_addr(cases, node_default, {nn.addr for nn in self._region.graph})
+        if switch_end_addr is not None:
+            self._switch_handle_gotos(cases, node_default, switch_end_addr)
         return True
 
-    def _match_acyclic_switch_cases_address_loaded_from_memory(self, node, graph, full_graph, jump_tables) -> bool:
+    def _match_acyclic_switch_cases_address_loaded_from_memory(self, node, graph, full_graph) -> bool:
         try:
             last_stmt = self.cond_proc.get_last_statement(node)
         except EmptyBlockNotice:
             return False
 
+        if last_stmt is None:
+            return False
+
         successor_addrs = extract_jump_targets(last_stmt)
         if len(successor_addrs) != 2:
             return False
 
         for t in successor_addrs:
-            if t in jump_tables:
+            if t in self.jump_tables:
                 # this is a candidate!
                 target = t
                 break
         else:
             return False
 
-        jump_table = jump_tables[target]
+        jump_table = self.jump_tables[target]
         if jump_table.type != IndirectJumpType.Jumptable_AddressLoadedFromMemory:
             return False
 
@@ -1168,6 +1209,7 @@ class PhoenixStructurer(StructurerBase):
             return False
 
         # populate whitelist_edges
+        assert jump_table.jumptable_entries is not None
         for case_node_addr in jump_table.jumptable_entries:
             self.whitelist_edges.add((node_a.addr, case_node_addr))
         self.whitelist_edges.add((node.addr, node_b_addr))
@@ -1193,6 +1235,12 @@ class PhoenixStructurer(StructurerBase):
         if not r:
             return False
 
+        node_default = self._switch_find_default_node(graph, node, node_b_addr)
+        if node_default is not None:
+            # ensure we have successfully structured node_default
+            if full_graph.out_degree(node_default) > 1:
+                return False
+
         # un-structure IncompleteSwitchCaseNode
         if isinstance(node_a, SequenceNode) and node_a.nodes and isinstance(node_a.nodes[0], IncompleteSwitchCaseNode):
             _, new_seq_node = self._unpack_sequencenode_head(graph, node_a)
@@ -1222,7 +1270,9 @@ class PhoenixStructurer(StructurerBase):
             switch_end_addr = node_b_addr
         else:
             # we don't know what the end address of this switch-case structure is. let's figure it out
-            switch_end_addr = None
+            switch_end_addr = self._switch_find_switch_end_addr(
+                cases, node_default, {nn.addr for nn in self._region.graph}
+            )
             to_remove.add(node_default)
 
         to_remove.add(node_a)  # add node_a
@@ -1243,14 +1293,104 @@ class PhoenixStructurer(StructurerBase):
 
         # fully structured into a switch-case. remove node from switch_case_known_heads
         self.switch_case_known_heads.remove(node)
-        self._switch_handle_gotos(cases, node_default, switch_end_addr)
+        if switch_end_addr is not None:
+            self._switch_handle_gotos(cases, node_default, switch_end_addr)
 
         return True
 
-    def _match_acyclic_switch_cases_address_loaded_from_memory_no_ob_check(
-        self, node, graph, full_graph, jump_tables
-    ) -> bool:
-        if node.addr not in jump_tables:
+    def _match_acyclic_switch_cases_address_loaded_from_memory_no_default_node(self, node, graph, full_graph) -> bool:
+        # sanity checks
+        if not isinstance(node, IncompleteSwitchCaseNode):
+            return False
+        if node.addr not in self.jump_tables:
+            return False
+        # ensure _match_acyclic_switch_cases_address_load_from_memory cannot structure its predecessor (and this node)
+        preds = list(graph.predecessors(node))
+        if len(preds) != 1:
+            return False
+        pred = preds[0]
+        if full_graph.out_degree[pred] != 1:
+            return False
+        jump_table: IndirectJump = self.jump_tables[node.addr]
+        if jump_table.type != IndirectJumpType.Jumptable_AddressLoadedFromMemory:
+            return False
+
+        # extract the comparison expression, lower-, and upper-bounds from the last statement
+        last_stmt = self.cond_proc.get_last_statement(node.head)
+        if not isinstance(last_stmt, Jump):
+            return False
+        cmp_expr = switch_extract_switch_expr_from_jump_target(last_stmt.target)
+        if cmp_expr is None:
+            return False
+        cmp_lb = 0
+
+        # populate whitelist_edges
+        assert jump_table.jumptable_entries is not None
+
+        # sanity check: case nodes are successors to node_a. all case nodes must have at most common one successor
+        node_pred = None
+        if graph.in_degree[node] == 1:
+            node_pred = next(iter(graph.predecessors(node)))
+
+        case_nodes = list(graph.successors(node))
+
+        # case 1: the common successor happens to be directly reachable from node_a (usually as a result of compiler
+        # optimization)
+        # example: touch_touch_no_switch.o:main
+        r = self.switch_case_entry_node_has_common_successor_case_1(graph, jump_table, case_nodes, node_pred)
+
+        # case 2: the common successor is not directly reachable from node_a. this is a more common case.
+        if not r:
+            r |= self.switch_case_entry_node_has_common_successor_case_2(graph, jump_table, case_nodes, node_pred)
+
+        if not r:
+            return False
+
+        # un-structure IncompleteSwitchCaseNode
+        if isinstance(node, IncompleteSwitchCaseNode):
+            r = self._unpack_incompleteswitchcasenode(graph, node)
+            if not r:
+                return False
+            self._unpack_incompleteswitchcasenode(full_graph, node)  # this shall not fail
+            # update node
+            node = next(iter(nn for nn in graph.nodes if nn.addr == jump_table.addr))
+
+        case_and_entry_addrs = self._find_case_and_entry_addrs(node, graph, cmp_lb, jump_table)
+
+        cases, _, to_remove = self._switch_build_cases(
+            case_and_entry_addrs,
+            node,
+            node,
+            None,
+            graph,
+            full_graph,
+        )
+
+        # we don't know what the end address of this switch-case structure is. let's figure it out
+        switch_end_addr = self._switch_find_switch_end_addr(cases, None, {nn.addr for nn in self._region.graph})
+        r = self._make_switch_cases_core(
+            node,
+            cmp_expr,
+            cases,
+            None,
+            None,
+            last_stmt.ins_addr,
+            to_remove,
+            graph,
+            full_graph,
+            node_a=None,
+        )
+        if not r:
+            return False
+
+        # fully structured into a switch-case. remove node from switch_case_known_heads
+        if switch_end_addr is not None:
+            self._switch_handle_gotos(cases, None, switch_end_addr)
+
+        return True
+
+    def _match_acyclic_switch_cases_address_loaded_from_memory_no_ob_check(self, node, graph, full_graph) -> bool:
+        if node.addr not in self.jump_tables:
             return False
 
         try:
@@ -1260,7 +1400,7 @@ class PhoenixStructurer(StructurerBase):
         if not (isinstance(last_stmt, Jump) and not isinstance(last_stmt.target, Const)):
             return False
 
-        jump_table = jump_tables[node.addr]
+        jump_table = self.jump_tables[node.addr]
         if jump_table.type != IndirectJumpType.Jumptable_AddressLoadedFromMemory:
             return False
 
@@ -1272,6 +1412,7 @@ class PhoenixStructurer(StructurerBase):
         case_count = cmp_ub - cmp_lb + 1
 
         # ensure we have the same number of cases
+        assert jump_table.jumptable_entries is not None
         if case_count != len(jump_table.jumptable_entries):
             return False
 
@@ -1311,7 +1452,7 @@ class PhoenixStructurer(StructurerBase):
         )
 
         assert node_default is None
-        switch_end_addr = None
+        switch_end_addr = self._switch_find_switch_end_addr(cases, node_default, {nn.addr for nn in self._region.graph})
 
         r = self._make_switch_cases_core(
             node,
@@ -1330,14 +1471,15 @@ class PhoenixStructurer(StructurerBase):
 
         # fully structured into a switch-case. remove node from switch_case_known_heads
         self.switch_case_known_heads.remove(node)
-        self._switch_handle_gotos(cases, node_default, switch_end_addr)
+        if switch_end_addr is not None:
+            self._switch_handle_gotos(cases, node_default, switch_end_addr)
 
         return True
 
-    def _match_acyclic_switch_cases_address_computed(self, node, graph, full_graph, jump_tables) -> bool:
-        if node.addr not in jump_tables:
+    def _match_acyclic_switch_cases_address_computed(self, node, graph, full_graph) -> bool:
+        if node.addr not in self.jump_tables:
             return False
-        jump_table = jump_tables[node.addr]
+        jump_table = self.jump_tables[node.addr]
         if jump_table.type != IndirectJumpType.Jumptable_AddressComputed:
             return False
 
@@ -1364,9 +1506,16 @@ class PhoenixStructurer(StructurerBase):
 
         if isinstance(last_stmt.false_target, Const):
             default_addr = last_stmt.false_target.value
+            assert isinstance(default_addr, int)
         else:
             return False
 
+        node_default = self._switch_find_default_node(graph, node, default_addr)
+        if node_default is not None:
+            # ensure we have successfully structured node_default
+            if full_graph.out_degree(node_default) > 1:
+                return False
+
         case_and_entry_addrs = self._find_case_and_entry_addrs(node, graph, cmp_lb, jump_table)
 
         cases, node_default, to_remove = self._switch_build_cases(
@@ -1386,10 +1535,10 @@ class PhoenixStructurer(StructurerBase):
         )
 
     def _match_acyclic_incomplete_switch_cases(
-        self, node, graph: networkx.DiGraph, full_graph: networkx.DiGraph, jump_tables: dict
+        self, node, graph: networkx.DiGraph, full_graph: networkx.DiGraph
     ) -> bool:
         # sanity checks
-        if node.addr not in jump_tables:
+        if node.addr not in self.jump_tables:
             return False
         if isinstance(node, IncompleteSwitchCaseNode):
             return False
@@ -1398,9 +1547,11 @@ class PhoenixStructurer(StructurerBase):
 
         successors = list(graph.successors(node))
 
+        jump_table = self.jump_tables[node.addr]
+        assert jump_table.jumptable_entries is not None
         if (
             successors
-            and {succ.addr for succ in successors} == set(jump_tables[node.addr].jumptable_entries)
+            and {succ.addr for succ in successors} == set(jump_table.jumptable_entries)
             and all(graph.in_degree[succ] == 1 for succ in successors)
         ):
             out_nodes = set()
@@ -1431,19 +1582,15 @@ class PhoenixStructurer(StructurerBase):
         graph,
         full_graph,
     ) -> tuple[OrderedDict, Any, set[Any]]:
-        cases: OrderedDict[int | tuple[int], SequenceNode] = OrderedDict()
+        cases: OrderedDict[int | tuple[int, ...], SequenceNode] = OrderedDict()
         to_remove = set()
 
-        # it is possible that the default node gets duplicated by other analyses and creates a default node (addr.a)
-        # and a case node (addr.b). The addr.a node is a successor to the head node while the addr.b node is a
-        # successor to node_a
         default_node_candidates = (
             [nn for nn in graph.nodes if nn.addr == node_b_addr] if node_b_addr is not None else []
         )
-        node_default: BaseNode | None = next(
-            iter(nn for nn in default_node_candidates if graph.has_edge(head_node, nn)), None
+        node_default = (
+            self._switch_find_default_node(graph, head_node, node_b_addr) if node_b_addr is not None else None
         )
-
         if node_default is not None and not isinstance(node_default, SequenceNode):
             # make the default node a SequenceNode so that we can insert Break and Continue nodes into it later
             new_node = SequenceNode(node_default.addr, nodes=[node_default])
@@ -1634,6 +1781,7 @@ class PhoenixStructurer(StructurerBase):
                 for _out_src, out_dst in out_edges[1:]:
                     if out_dst in full_graph and out_dst not in graph and full_graph.in_degree[out_dst] == 0:
                         full_graph.remove_node(out_dst)
+                        assert self._region.successors is not None
                         if out_dst in self._region.successors:
                             self._region.successors.remove(out_dst)
 
@@ -1666,8 +1814,7 @@ class PhoenixStructurer(StructurerBase):
         return case_and_entry_addrs
 
     def _is_node_unstructured_switch_case_head(self, node) -> bool:
-        jump_tables = self.kb.cfgs["CFGFast"].jump_tables
-        if node.addr in jump_tables:
+        if node.addr in self.jump_tables:
             # maybe it has been structured?
             try:
                 last_stmts = self.cond_proc.get_last_statements(node)
@@ -1700,6 +1847,7 @@ class PhoenixStructurer(StructurerBase):
                 and not self._is_switch_cases_address_loaded_from_memory_head_or_jumpnode(full_graph, end_node)
                 and not self._is_switch_cases_address_loaded_from_memory_head_or_jumpnode(full_graph, start_node)
                 and end_node not in self.dowhile_known_tail_nodes
+                and not isinstance(end_node, IncompleteSwitchCaseNode)
             ):
                 # merge two blocks
                 new_seq = self._merge_nodes(start_node, end_node)
@@ -1719,6 +1867,8 @@ class PhoenixStructurer(StructurerBase):
         succs = list(full_graph.successors(start_node))
         if len(succs) == 2:
             left, right = succs
+            if left.addr > right.addr:
+                left, right = right, left
             if self._is_switch_cases_address_loaded_from_memory_head_or_jumpnode(
                 full_graph, left
             ) or self._is_switch_cases_address_loaded_from_memory_head_or_jumpnode(full_graph, right):
@@ -1747,7 +1897,7 @@ class PhoenixStructurer(StructurerBase):
                 ):
                     edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                     edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, start_node, right)
-                    if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                    if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                         # c = !c
                         last_if_jump = self._remove_last_statement_if_jump(start_node)
                         new_cond_node = ConditionNode(
@@ -1789,7 +1939,7 @@ class PhoenixStructurer(StructurerBase):
                 ) and not self._is_node_unstructured_switch_case_head(right):
                     edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                     edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, start_node, right)
-                    if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                    if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                         # c = !c
                         last_if_jump = self._remove_last_statement_if_jump(start_node)
                         new_cond_node = ConditionNode(
@@ -1822,7 +1972,7 @@ class PhoenixStructurer(StructurerBase):
             ):
                 edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                 edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, start_node, right)
-                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                     # c = !c
                     last_if_jump = self._remove_last_statement_if_jump(start_node)
                     new_cond_node = ConditionNode(
@@ -1857,7 +2007,7 @@ class PhoenixStructurer(StructurerBase):
             ):
                 edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                 edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, start_node, right)
-                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                     # c = !c
                     try:
                         last_stmt = self.cond_proc.get_last_statement(start_node)
@@ -1876,7 +2026,7 @@ class PhoenixStructurer(StructurerBase):
                         self._remove_last_statement_if_jump(start_node)
                         # add a goto node at the end
                         new_jump_node = Block(
-                            new_cond_node.addr,
+                            new_cond_node.addr if new_cond_node.addr is not None else 0x7EFF_FFFF,
                             0,
                             statements=[
                                 Jump(
@@ -2162,7 +2312,7 @@ class PhoenixStructurer(StructurerBase):
             ):
                 edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                 edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, start_node, right)
-                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                     # c0 = !c0
                     left_succs = list(full_graph.successors(left))
                     if len(left_succs) == 2 and right in left_succs:
@@ -2171,7 +2321,9 @@ class PhoenixStructurer(StructurerBase):
                             # there must be an edge between right and other_succ
                             edge_cond_left_right = self.cond_proc.recover_edge_condition(full_graph, left, right)
                             edge_cond_left_other = self.cond_proc.recover_edge_condition(full_graph, left, other_succ)
-                            if claripy.is_true(claripy.Not(edge_cond_left_right) == edge_cond_left_other):
+                            if claripy.is_true(
+                                claripy.Not(edge_cond_left_right) == edge_cond_left_other  # type: ignore
+                            ):
                                 # c1 = !c1
                                 return left, edge_cond_left, right, edge_cond_left_right, other_succ
         return None
@@ -2211,7 +2363,7 @@ class PhoenixStructurer(StructurerBase):
             ):
                 edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                 edge_cond_right = self.cond_proc.recover_edge_condition(full_graph, start_node, right)
-                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):
+                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_right):  # type: ignore
                     # c0 = !c0
                     right_succs = list(full_graph.successors(right))
                     left_succs = list(full_graph.successors(left))
@@ -2220,7 +2372,9 @@ class PhoenixStructurer(StructurerBase):
                         if len([succ for succ in left_succs if succ is not else_node]) == 1:
                             edge_cond_right_left = self.cond_proc.recover_edge_condition(full_graph, right, left)
                             edge_cond_right_else = self.cond_proc.recover_edge_condition(full_graph, right, else_node)
-                            if claripy.is_true(claripy.Not(edge_cond_right_left) == edge_cond_right_else):
+                            if claripy.is_true(
+                                claripy.Not(edge_cond_right_left) == edge_cond_right_else  # type: ignore
+                            ):
                                 # c1 = !c1
                                 return left, edge_cond_left, right, edge_cond_right_left, else_node
         return None
@@ -2254,7 +2408,7 @@ class PhoenixStructurer(StructurerBase):
             ):
                 edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                 edge_cond_successor = self.cond_proc.recover_edge_condition(full_graph, start_node, successor)
-                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_successor):
+                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_successor):  # type: ignore
                     # c0 = !c0
                     left_succs = list(full_graph.successors(left))
                     if len(left_succs) == 2 and successor in left_succs:
@@ -2265,7 +2419,9 @@ class PhoenixStructurer(StructurerBase):
                             edge_cond_left_successor = self.cond_proc.recover_edge_condition(
                                 full_graph, left, successor
                             )
-                            if claripy.is_true(claripy.Not(edge_cond_left_right) == edge_cond_left_successor):
+                            if claripy.is_true(
+                                claripy.Not(edge_cond_left_right) == edge_cond_left_successor  # type: ignore
+                            ):
                                 # c1 = !c1
                                 return left, edge_cond_left, successor, edge_cond_left_successor, right
         return None
@@ -2304,19 +2460,19 @@ class PhoenixStructurer(StructurerBase):
             ):
                 edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                 edge_cond_else = self.cond_proc.recover_edge_condition(full_graph, start_node, else_node)
-                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_else):
+                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_else):  # type: ignore
                     # c0 = !c0
                     left_succs = list(full_graph.successors(left))
                     if len(left_succs) == 2 and else_node in left_succs:
                         right = next(iter(succ for succ in left_succs if succ is not else_node))
                         edge_cond_left_right = self.cond_proc.recover_edge_condition(full_graph, left, right)
                         edge_cond_left_else = self.cond_proc.recover_edge_condition(full_graph, left, else_node)
-                        if claripy.is_true(claripy.Not(edge_cond_left_right) == edge_cond_left_else):
+                        if claripy.is_true(claripy.Not(edge_cond_left_right) == edge_cond_left_else):  # type: ignore
                             # c1 = !c1
                             return left, edge_cond_left, right, edge_cond_left_right, else_node
         return None
 
-    def _last_resort_refinement(self, head, graph: networkx.DiGraph, full_graph: networkx.DiGraph | None) -> bool:
+    def _last_resort_refinement(self, head, graph: networkx.DiGraph, full_graph: networkx.DiGraph) -> bool:
         if self._improve_algorithm:
             while self._edge_virtualization_hints:
                 src, dst = self._edge_virtualization_hints.pop(0)
@@ -2396,6 +2552,7 @@ class PhoenixStructurer(StructurerBase):
                 goto1_target = None
 
             if goto0_condition is not None:
+                assert goto0_target is not None and goto1_target is not None
                 goto0 = Block(
                     last_stmt.ins_addr,
                     0,
@@ -2461,11 +2618,11 @@ class PhoenixStructurer(StructurerBase):
 
     @staticmethod
     def _find_node_going_to_dst(
-        node: SequenceNode,
+        node: BaseNode,
         dst: Block | BaseNode,
         last=True,
         condjump_only=False,
-    ) -> tuple[int | None, BaseNode | None, Block | None]:
+    ) -> tuple[int | None, BaseNode | None, Block | MultiNode | BreakNode | None]:
         """
 
         :param node:
@@ -2477,6 +2634,14 @@ class PhoenixStructurer(StructurerBase):
         dst_addr = dst.addr
         dst_idx = dst.idx if isinstance(dst, Block) else ...
 
+        class _Holder:
+            """
+            Holds parent_and_block and is accessible from within the handlers.
+            """
+
+            parent_and_block: list[tuple[int, Any, Block | MultiNode | BreakNode]] = []
+            block_id: int = -1
+
         def _check(last_stmt):
             return (
                 (
@@ -2512,34 +2677,34 @@ class PhoenixStructurer(StructurerBase):
                 first_stmt = first_nonlabel_nonphi_statement(block)
                 if first_stmt is not None:
                     # this block has content. increment the block ID counter
-                    walker.block_id += 1
+                    _Holder.block_id += 1
 
                 if _check(first_stmt):
-                    walker.parent_and_block.append((walker.block_id, parent, block))
+                    _Holder.parent_and_block.append((_Holder.block_id, parent, block))
                 elif len(block.statements) > 1:
                     last_stmt = block.statements[-1]
                     if _check(last_stmt) or (
                         not isinstance(last_stmt, (Jump, ConditionalJump))
                         and block.addr + block.original_size == dst_addr
                     ):
-                        walker.parent_and_block.append((walker.block_id, parent, block))
+                        _Holder.parent_and_block.append((_Holder.block_id, parent, block))
 
         def _handle_MultiNode(block: MultiNode, parent=None, **kwargs):  # pylint:disable=unused-argument
             if block.nodes and isinstance(block.nodes[-1], Block) and block.nodes[-1].statements:
                 first_stmt = first_nonlabel_nonphi_statement(block)
                 if first_stmt is not None:
                     # this block has content. increment the block ID counter
-                    walker.block_id += 1
+                    _Holder.block_id += 1
                 if _check(block.nodes[-1].statements[-1]):
-                    walker.parent_and_block.append((walker.block_id, parent, block))
+                    _Holder.parent_and_block.append((_Holder.block_id, parent, block))
 
         def _handle_BreakNode(break_node: BreakNode, parent=None, **kwargs):  # pylint:disable=unused-argument
-            walker.block_id += 1
+            _Holder.block_id += 1
             if break_node.target == dst_addr or (
                 isinstance(break_node.target, Const) and break_node.target.value == dst_addr
             ):
                 # FIXME: idx is ignored
-                walker.parent_and_block.append((walker.block_id, parent, break_node))
+                _Holder.parent_and_block.append((_Holder.block_id, parent, break_node))
 
         walker = SequenceWalker(
             handlers={
@@ -2550,14 +2715,13 @@ class PhoenixStructurer(StructurerBase):
             update_seqnode_in_place=False,
             force_forward_scan=True,
         )
-        walker.parent_and_block: list[tuple[int, Any, Block | MultiNode]] = []
-        walker.block_id = -1
+        _Holder.block_id = -1
         walker.walk(node)
-        if not walker.parent_and_block:
+        if not _Holder.parent_and_block:
             return None, None, None
         if last:
-            return walker.parent_and_block[-1]
-        return walker.parent_and_block[0]
+            return _Holder.parent_and_block[-1]
+        return _Holder.parent_and_block[0]
 
     @staticmethod
     def _unpack_sequencenode_head(graph: networkx.DiGraph, seq: SequenceNode, new_seq=None):
@@ -2626,7 +2790,7 @@ class PhoenixStructurer(StructurerBase):
                 return True
             return all(not isinstance(stmt, (ConditionalJump, Jump)) for stmt in stmts[:-1])
 
-        def _to_statement_list(node: Block | MultiNode | SequenceNode) -> list[Statement]:
+        def _to_statement_list(node: Block | MultiNode | SequenceNode | BaseNode) -> list[Statement]:
             if isinstance(node, Block):
                 return node.statements
             if isinstance(node, MultiNode):
@@ -2681,7 +2845,7 @@ class PhoenixStructurer(StructurerBase):
                 graph.remove_edge(src, succ)
 
     @staticmethod
-    def _remove_first_statement_if_jump(node: BaseNode | Block) -> Jump | ConditionalJump | None:
+    def _remove_first_statement_if_jump(node: BaseNode | Block | MultiNode) -> Jump | ConditionalJump | None:
         if isinstance(node, Block):
             if node.statements:
                 idx = 0
@@ -2729,7 +2893,7 @@ class PhoenixStructurer(StructurerBase):
             src, dst = edge_
             dst_in_degree = graph.in_degree[dst]
             src_out_degree = graph.out_degree[src]
-            return -node_seq.get(dst), dst_in_degree, src_out_degree, -src.addr, -dst.addr
+            return -node_seq.get(dst), dst_in_degree, src_out_degree, -src.addr, -dst.addr  # type: ignore
 
         return sorted(edges, key=_sort_edge, reverse=True)