angr 9.2.139__py3-none-manylinux2014_x86_64.whl → 9.2.140__py3-none-manylinux2014_x86_64.whl

angr/analyses/stack_pointer_tracker.py

@@ -22,6 +22,7 @@ try:
     from angr.engines import pcode
 except ImportError:
     pypcode = None
+    pcode = None
 
 if TYPE_CHECKING:
     from angr.block import Block
@@ -93,6 +94,11 @@ class Register:
             return self.offset == other.offset
         return False
 
+    def __add__(self, other) -> OffsetVal:
+        if type(other) is Constant:
+            return OffsetVal(self, other.val)
+        raise CouldNotResolveException
+
     def __repr__(self):
         return str(self.offset)
 
@@ -232,6 +238,7 @@ class StackPointerTrackerState:
     def give_up_on_memory_tracking(self):
         self.memory = {}
         self.is_tracking_memory = False
+        return self
 
     def store(self, addr, val):
         # strong update
@@ -370,7 +377,8 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
         self._mem_merge_cache = {}
 
         if initial_reg_values:
-            self._reg_value_at_block_start[func.addr if func is not None else block.addr] = initial_reg_values
+            block_start_addr = func.addr if func is not None else block.addr  # type: ignore
+            self._reg_value_at_block_start[block_start_addr] = initial_reg_values
 
         _l.debug("Running on function %r", self._func)
         self._analyze()
@@ -461,9 +469,13 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
         return any(self.inconsistent_for(r) for r in self.reg_offsets)
 
     def inconsistent_for(self, reg):
+        if self._func is None:
+            raise ValueError("inconsistent_for() is only supported in function mode")
         return any(self.offset_after_block(endpoint.addr, reg) is TOP for endpoint in self._func.endpoints)
 
     def offsets_for(self, reg):
+        if self._func is None:
+            raise ValueError("offsets_for() is only supported in function mode")
         return [
             o for block in self._func.blocks if (o := self.offset_after_block(block.addr, reg)) not in (TOP, BOTTOM)
         ]
@@ -481,7 +493,7 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
     def _post_analysis(self):
         pass
 
-    def _get_register(self, offset):
+    def _get_register(self, offset) -> Register:
         name = self.project.arch.register_names[offset]
         size = self.project.arch.registers[name][1]
         return Register(offset, size * self.project.arch.byte_width)
@@ -557,7 +569,7 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
         output_state = state.freeze()
         return None, output_state
 
-    def _process_vex_irsb(self, node, vex_block: pyvex.IRSB, state: StackPointerTrackerState) -> int:
+    def _process_vex_irsb(self, node, vex_block: pyvex.IRSB, state: StackPointerTrackerState) -> int | None:
         tmps = {}
         curr_stmt_start_addr = None
 
@@ -704,21 +716,16 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
             if callees:
                 if len(callees) == 1:
                     callee = callees[0]
+                    track_rax = False
+                    if (
+                        (callee.info.get("is_rust_probestack", False) and self.project.arch.name == "AMD64")
+                        or (callee.info.get("is_alloca_probe", False) and self.project.arch.name == "AMD64")
+                        or callee.name == "__chkstk"
+                    ):
+                        # sp = sp - rax right after returning from the call
+                        track_rax = True
 
-                    if callee.info.get("is_rust_probestack", False) is True and self.project.arch.name == "AMD64":
-                        # special-case for rust_probestack: sp = sp - rax right after returning from the call, so we
-                        # need to keep track of rax
-                        for stmt in reversed(vex_block.statements):
-                            if (
-                                isinstance(stmt, pyvex.IRStmt.Put)
-                                and stmt.offset == self.project.arch.registers["rax"][0]
-                                and isinstance(stmt.data, pyvex.IRExpr.Const)
-                            ):
-                                state.put(stmt.offset, Constant(stmt.data.con.value), force=True)
-                                break
-                    elif callee.name == "__chkstk":
-                        # special-case for __chkstk: sp = sp - rax right after returning from the call, so we need to
-                        # keep track of rax
+                    if track_rax:
                         for stmt in reversed(vex_block.statements):
                             if (
                                 isinstance(stmt, pyvex.IRStmt.Put)
@@ -737,18 +744,20 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
                     # found callee clean-up cases...
                     try:
                         v = state.get(self.project.arch.sp_offset)
+                        incremented = None
                         if v is BOTTOM:
                             incremented = BOTTOM
                         elif callee_cleanups[0].prototype is not None:
                             num_args = len(callee_cleanups[0].prototype.args)
                             incremented = v + Constant(self.project.arch.bytes * num_args)
-                        state.put(self.project.arch.sp_offset, incremented)
+                        if incremented is not None:
+                            state.put(self.project.arch.sp_offset, incremented)
                     except CouldNotResolveException:
                         pass
 
         return curr_stmt_start_addr
 
-    def _process_pcode_irsb(self, node, pcode_irsb: pcode.lifter.IRSB, state: StackPointerTrackerState) -> int:
+    def _process_pcode_irsb(self, node, pcode_irsb: pcode.lifter.IRSB, state: StackPointerTrackerState) -> int | None:
         unique = {}
         curr_stmt_start_addr = None
 
@@ -830,18 +839,20 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
                     # found callee clean-up cases...
                     try:
                         v = state.get(self.project.arch.sp_offset)
+                        incremented = None
                         if v is BOTTOM:
                             incremented = BOTTOM
                         elif callee_cleanups[0].prototype is not None:
                             num_args = len(callee_cleanups[0].prototype.args)
                             incremented = v + Constant(self.project.arch.bytes * num_args)
-                        state.put(self.project.arch.sp_offset, incremented)
+                        if incremented is not None:
+                            state.put(self.project.arch.sp_offset, incremented)
                     except CouldNotResolveException:
                         pass
 
         return curr_stmt_start_addr
 
-    def _widen_states(self, *states):
+    def _widen_states(self, *states: FrozenStackPointerTrackerState):
         assert len(states) == 2
         merged, _ = self._merge_states(None, *states)
         if len(merged.memory) > 5:
@@ -849,13 +860,16 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
             merged = merged.unfreeze().give_up_on_memory_tracking().freeze()
         return merged
 
-    def _merge_states(self, node, *states: StackPointerTrackerState):
+    def _merge_states(self, node, *states: FrozenStackPointerTrackerState):
         merged_state = states[0]
         for other in states[1:]:
             merged_state = merged_state.merge(other, node.addr, self._reg_merge_cache, self._mem_merge_cache)
         return merged_state, merged_state == states[0]
 
     def _find_callees(self, node) -> list[Function]:
+        if self._func is None:
+            raise ValueError("find_callees() is only supported in function mode")
+
         callees: list[Function] = []
         for _, dst, data in self._func.transition_graph.out_edges(node, data=True):
             if data.get("type") == "call" and isinstance(dst, Function):

angr/analyses/typehoon/simple_solver.py

@@ -5,6 +5,7 @@ from collections import defaultdict
 import logging
 
 import networkx
+from sortedcontainers import SortedDict
 
 from angr.utils.constants import MAX_POINTSTO_BITS
 from .typevars import (
@@ -1165,25 +1166,45 @@ class SimpleSolver:
             # this might be a struct
             fields = {}
 
-            candidate_bases = defaultdict(set)
+            candidate_bases = SortedDict()
 
             for labels, _succ in path_and_successors:
                 last_label = labels[-1] if labels else None
                 if isinstance(last_label, HasField):
                     # TODO: Really determine the maximum possible size of the field when MAX_POINTSTO_BITS is in use
+                    if last_label.offset not in candidate_bases:
+                        candidate_bases[last_label.offset] = set()
                     candidate_bases[last_label.offset].add(
                         1 if last_label.bits == MAX_POINTSTO_BITS else (last_label.bits // 8)
                     )
 
+            # determine possible bases and map each offset to its base
+            offset_to_base = SortedDict()
+            for start_offset, sizes in candidate_bases.items():
+                for size in sizes:
+                    for i in range(size):
+                        access_off = start_offset + i
+                        if access_off not in offset_to_base:
+                            offset_to_base[access_off] = start_offset
+
+            # determine again the maximum size of each field (at each offset)
+            offset_to_maxsize = defaultdict(int)
+            offset_to_sizes = defaultdict(set)  # we do not consider offsets to each base offset
+            for labels, _succ in path_and_successors:
+                last_label = labels[-1] if labels else None
+                if isinstance(last_label, HasField):
+                    base = offset_to_base[last_label.offset]
+                    access_size = 1 if last_label.bits == MAX_POINTSTO_BITS else (last_label.bits // 8)
+                    offset_to_maxsize[base] = max(offset_to_maxsize[base], (last_label.offset - base) + access_size)
+                    offset_to_sizes[base].add(access_size)
+
             node_to_base = {}
 
             for labels, succ in path_and_successors:
                 last_label = labels[-1] if labels else None
                 if isinstance(last_label, HasField):
-                    for start_offset, sizes in candidate_bases.items():
-                        for size in sizes:
-                            if last_label.offset > start_offset and last_label.offset < start_offset + size:  # ???
-                                node_to_base[succ] = start_offset
+                    prev_offset = next(offset_to_base.irange(maximum=last_label.offset, reverse=True))
+                    node_to_base[succ] = offset_to_base[prev_offset]
 
             node_by_offset = defaultdict(set)
 
@@ -1195,16 +1216,33 @@ class SimpleSolver:
                     else:
                         node_by_offset[last_label.offset].add(succ)
 
-            for offset, child_nodes in node_by_offset.items():
+            sorted_offsets: list[int] = sorted(node_by_offset)
+            for i in range(len(sorted_offsets)):  # pylint:disable=consider-using-enumerate
+                offset = sorted_offsets[i]
+
+                child_nodes = node_by_offset[offset]
                 sol = self._determine(equivalent_classes, the_typevar, sketch, solution, nodes=child_nodes)
                 if isinstance(sol, TopType):
-                    sol = int_type(min(candidate_bases[offset]) * 8)
+                    # make it an array if possible
+                    elem_size = min(offset_to_sizes[offset])
+                    array_size = offset_to_maxsize[offset]
+                    if array_size % elem_size != 0:
+                        # fall back to byte_t
+                        elem_size = 1
+                    elem_type = int_type(elem_size * 8)
+                    sol = elem_type if array_size == elem_size else Array(elem_type, array_size // elem_size)
                 fields[offset] = sol
 
             if not fields:
                 result = Top_
                 for node in nodes:
                     self._solution_cache[node.typevar] = result
+                    solution[node.typevar] = result
+            elif any(off < 0 for off in fields):
+                result = self._pointer_class()(Bottom_)
+                for node in nodes:
+                    self._solution_cache[node.typevar] = result
+                    solution[node.typevar] = result
             else:
                 # back-patch
                 struct_type.fields = fields

angr/analyses/typehoon/typeconsts.py

@@ -42,7 +42,7 @@ class TypeConstant:
             raise NotImplementedError
         return self.SIZE
 
-    def __repr__(self, memo=None):
+    def __repr__(self, memo=None) -> str:
         raise NotImplementedError
 
 
@@ -57,7 +57,7 @@ class BottomType(TypeConstant):
 
 
 class Int(TypeConstant):
-    def __repr__(self, memo=None):
+    def __repr__(self, memo=None) -> str:
         return "intbase"
 
 
@@ -82,14 +82,14 @@ class Int16(Int):
 class Int32(Int):
     SIZE = 4
 
-    def __repr__(self, memo=None):
+    def __repr__(self, memo=None) -> str:
         return "int32"
 
 
 class Int64(Int):
     SIZE = 8
 
-    def __repr__(self, memo=None):
+    def __repr__(self, memo=None) -> str:
         return "int64"
 
 
@@ -115,7 +115,7 @@ class Int512(Int):
 
 
 class FloatBase(TypeConstant):
-    def __repr__(self, memo=None):
+    def __repr__(self, memo=None) -> str:
         return "floatbase"
 
 
@@ -185,6 +185,12 @@ class Array(TypeConstant):
         self.element: TypeConstant | None = element
         self.count: int | None = count
 
+    @property
+    def size(self) -> int:
+        if not self.count or not self.element:
+            return 0
+        return self.element.size * self.count
+
     @memoize
     def __repr__(self, memo=None):
         if self.count is None:
@@ -221,6 +227,13 @@ class Struct(TypeConstant):
         tpl = tuple((k, self.fields[k]._hash(visited) if self.fields[k] is not None else None) for k in keys)
         return hash(tpl)
 
+    @property
+    def size(self) -> int:
+        if not self.fields:
+            return 0
+        max_field_off = max(self.fields.keys())
+        return max_field_off + self.fields[max_field_off].size
+
     @memoize
     def __repr__(self, memo=None):
         prefix = "struct"

angr/analyses/variable_recovery/engine_base.py

@@ -430,6 +430,7 @@ class SimEngineVRBase(
                 self.state.variable_manager[self.func_addr].add_variable("register", vvar.oident, variable)
             elif vvar.was_tmp:
                 # FIXME: we treat all tmp vvars as registers
+                assert vvar.tmp_idx is not None
                 variable = SimRegisterVariable(
                     4096 + vvar.tmp_idx,
                     vvar.size,
@@ -503,7 +504,7 @@ class SimEngineVRBase(
                     self.state.variable_manager[self.func_addr].remove_variable_by_atom(codeloc, existing_var, atom)
 
             # storing to a location specified by a pointer whose value cannot be determined at this point
-            self._store_to_variable(richr_addr, size)
+            self._store_to_variable(richr_addr, data, size)
 
     def _store_to_stack(
         self, stack_offset, data: RichR[claripy.ast.BV | claripy.ast.FP], size, offset=0, atom=None, endness=None
@@ -669,7 +670,7 @@ class SimEngineVRBase(
                 self.state.add_type_constraint(typevars.Subtype(store_typevar, typeconsts.TopType()))
                 self.state.add_type_constraint(typevars.Subtype(data.typevar, store_typevar))
 
-    def _store_to_variable(self, richr_addr: RichR[claripy.ast.BV], size: int):
+    def _store_to_variable(self, richr_addr: RichR[claripy.ast.BV], data: RichR, size: int):
         addr_variable = richr_addr.variable
         codeloc = self._codeloc()
 
@@ -691,7 +692,8 @@ class SimEngineVRBase(
             store_typevar = self._create_access_typevar(base_typevar, True, size, field_offset)
             if addr_variable is not None:
                 self.state.typevars.add_type_variable(addr_variable, codeloc, typevar)
-            self.state.add_type_constraint(typevars.Subtype(store_typevar, typeconsts.TopType()))
+            data_typevar = data.typevar if data.typevar is not None else typeconsts.TopType()
+            self.state.add_type_constraint(typevars.Subtype(store_typevar, data_typevar))
 
     def _load(self, richr_addr: RichR[claripy.ast.BV], size: int, expr=None):
         """
@@ -941,13 +943,13 @@ class SimEngineVRBase(
             # it's an array!
             if offset.concrete:
                 concrete_offset = offset.concrete_value * elem_size
-                load_typevar = self._create_access_typevar(typevar, True, size, concrete_offset)
+                load_typevar = self._create_access_typevar(typevar, False, size, concrete_offset)
                 self.state.add_type_constraint(typevars.Subtype(load_typevar, typeconsts.TopType()))
             else:
                 # FIXME: This is a hack
                 for i in range(4):
                     concrete_offset = size * i
-                    load_typevar = self._create_access_typevar(typevar, True, size, concrete_offset)
+                    load_typevar = self._create_access_typevar(typevar, False, size, concrete_offset)
                     self.state.add_type_constraint(typevars.Subtype(load_typevar, typeconsts.TopType()))
 
         return RichR(self.state.top(size * self.project.arch.byte_width), typevar=typevar)

angr/block.py

@@ -130,19 +130,23 @@ class Block(Serializable):
     BLOCK_MAX_SIZE = 4096
 
     __slots__ = [
+        "_backup_state",
         "_bytes",
         "_capstone",
         "_collect_data_refs",
         "_const_prop",
         "_cross_insn_opt",
         "_disassembly",
+        "_extra_stop_points",
         "_initial_regs",
         "_instruction_addrs",
         "_instructions",
         "_load_from_ro_regions",
+        "_max_size",
         "_opt_level",
         "_project",
         "_strict_block_end",
+        "_traceflags",
         "_vex",
         "_vex_nostmt",
         "addr",
@@ -155,11 +159,10 @@ class Block(Serializable):
         self,
         addr,
         project=None,
-        arch: Arch = None,
+        arch: Arch | None = None,
         size=None,
         max_size=None,
         byte_string=None,
-        vex=None,
         thumb=False,
         backup_state=None,
         extra_stop_points=None,
@@ -174,14 +177,11 @@ class Block(Serializable):
         initial_regs=None,
         skip_stmts=False,
     ):
-        # set up arch
-        self.arch: Arch
-        if project is not None:
+        if arch is not None:
+            self.arch = arch
+        elif project is not None:
             self.arch = project.arch
         else:
-            self.arch = arch
-
-        if self.arch is None:
             raise ValueError('Either "project" or "arch" has to be specified.')
 
         if project is not None and backup_state is None and project.kb.patches.values():
@@ -195,63 +195,23 @@ class Block(Serializable):
         else:
             thumb = False
 
-        self._project: Project | None = project
-        self.thumb = thumb
+        self._project = project
         self.addr = addr
+        self._backup_state = backup_state
+        self.thumb = thumb
         self._opt_level = opt_level
-        self._initial_regs: list[tuple[int, int, int]] | None = (
-            initial_regs if (collect_data_refs or const_prop) else None
-        )
+        self._initial_regs = initial_regs if (collect_data_refs or const_prop) else None
+        self._traceflags = traceflags
+        self._extra_stop_points = extra_stop_points
+        self._max_size = max_size if max_size is not None else self.BLOCK_MAX_SIZE
 
         if self._project is None and byte_string is None:
             raise ValueError('"byte_string" has to be specified if "project" is not provided.')
 
-        if size is None:
-            if byte_string is not None:
-                size = len(byte_string)
-            elif vex is not None:
-                size = vex.size
-            else:
-                if self._initial_regs:
-                    self.set_initial_regs()
-                clemory = None
-                if project is not None:
-                    clemory = (
-                        project.loader.memory_ro_view
-                        if project.loader.memory_ro_view is not None
-                        else project.loader.memory
-                    )
-                vex = self._vex_engine.lift_vex(
-                    clemory=clemory,
-                    state=backup_state,
-                    insn_bytes=byte_string,
-                    addr=addr,
-                    size=max_size,
-                    thumb=thumb,
-                    extra_stop_points=extra_stop_points,
-                    opt_level=opt_level,
-                    num_inst=num_inst,
-                    traceflags=traceflags,
-                    strict_block_end=strict_block_end,
-                    collect_data_refs=collect_data_refs,
-                    load_from_ro_regions=load_from_ro_regions,
-                    const_prop=const_prop,
-                    cross_insn_opt=cross_insn_opt,
-                    skip_stmts=skip_stmts,
-                )
-                if self._initial_regs:
-                    self.reset_initial_regs()
-                size = vex.size
-
-        if skip_stmts:
-            self._vex = None
-            self._vex_nostmt = vex
-        else:
-            self._vex = vex
-            self._vex_nostmt = None
+        self._vex = None
+        self._vex_nostmt = None
         self._disassembly = None
         self._capstone = None
-        self.size = size
         self._collect_data_refs = collect_data_refs
         self._strict_block_end = strict_block_end
         self._cross_insn_opt = cross_insn_opt
@@ -261,6 +221,23 @@ class Block(Serializable):
         self._instructions: int | None = num_inst
         self._instruction_addrs: list[int] = []
 
+        self._bytes = byte_string
+        self.size = size
+
+        if size is None:
+            if byte_string is not None:
+                size = len(byte_string)
+            else:
+                vex = self._lift_nocache(skip_stmts)
+                size = vex.size
+
+                if skip_stmts:
+                    self._vex_nostmt = vex
+                else:
+                    self._vex = vex
+
+        self.size = size
+
         if skip_stmts:
             self._parse_vex_info(self._vex_nostmt)
         else:
@@ -343,50 +320,7 @@ class Block(Serializable):
             raise ValueError("Project is not set")
         return self._project.factory.default_engine  # type:ignore
 
-    @property
-    def vex(self) -> IRSB | PcodeIRSB:
-        if not self._vex:
-            if self._initial_regs:
-                self.set_initial_regs()
-            clemory = None
-            if self._project is not None:
-                clemory = (
-                    self._project.loader.memory_ro_view
-                    if self._project.loader.memory_ro_view is not None
-                    else self._project.loader.memory
-                )
-            self._vex = self._vex_engine.lift_vex(
-                clemory=clemory,
-                insn_bytes=self._bytes,
-                addr=self.addr,
-                thumb=self.thumb,
-                size=self.size,
-                num_inst=self._instructions,
-                opt_level=self._opt_level,
-                arch=self.arch,
-                collect_data_refs=self._collect_data_refs,
-                strict_block_end=self._strict_block_end,
-                cross_insn_opt=self._cross_insn_opt,
-                load_from_ro_regions=self._load_from_ro_regions,
-                const_prop=self._const_prop,
-            )
-            if self._initial_regs:
-                self.reset_initial_regs()
-            self._parse_vex_info(self._vex)
-
-        assert self._vex is not None
-        return self._vex
-
-    @property
-    def vex_nostmt(self):
-        if self._vex_nostmt:
-            return self._vex_nostmt
-
-        if self._vex:
-            return self._vex
-
-        if self._initial_regs:
-            self.set_initial_regs()
+    def _lift_nocache(self, skip_stmts: bool) -> IRSB | PcodeIRSB:
         clemory = None
         if self._project is not None:
             clemory = (
@@ -394,25 +328,53 @@ class Block(Serializable):
                 if self._project.loader.memory_ro_view is not None
                 else self._project.loader.memory
             )
-        self._vex_nostmt = self._vex_engine.lift_vex(
+
+        if self._initial_regs:
+            self.set_initial_regs()
+
+        vex = self._vex_engine.lift_vex(
+            addr=self.addr,
+            state=self._backup_state,
             clemory=clemory,
             insn_bytes=self._bytes,
-            addr=self.addr,
-            thumb=self.thumb,
+            arch=self.arch,
             size=self.size,
             num_inst=self._instructions,
+            traceflags=self._traceflags,
+            thumb=self.thumb,
+            extra_stop_points=self._extra_stop_points,
             opt_level=self._opt_level,
-            arch=self.arch,
-            skip_stmts=True,
-            collect_data_refs=self._collect_data_refs,
             strict_block_end=self._strict_block_end,
+            skip_stmts=skip_stmts,
+            collect_data_refs=self._collect_data_refs,
             cross_insn_opt=self._cross_insn_opt,
             load_from_ro_regions=self._load_from_ro_regions,
             const_prop=self._const_prop,
         )
+
         if self._initial_regs:
             self.reset_initial_regs()
+
+        return vex
+
+    @property
+    def vex(self) -> IRSB | PcodeIRSB:
+        if not self._vex:
+            self._vex = self._lift_nocache(False)
+            self._parse_vex_info(self._vex)
+
+        return self._vex
+
+    @property
+    def vex_nostmt(self):
+        if self._vex_nostmt:
+            return self._vex_nostmt
+        if self._vex:
+            return self._vex
+
+        self._vex_nostmt = self._lift_nocache(True)
         self._parse_vex_info(self._vex_nostmt)
+
         return self._vex_nostmt
 
     @property