angr 9.2.139__py3-none-manylinux2014_x86_64.whl → 9.2.141__py3-none-manylinux2014_x86_64.whl

angr/analyses/decompiler/structuring/dream.py

@@ -10,7 +10,7 @@ import claripy
 import ailment
 
 from angr.utils.graph import GraphUtils
-from angr.knowledge_plugins.cfg import IndirectJump, IndirectJumpType
+from angr.knowledge_plugins.cfg import IndirectJumpType
 from angr.analyses.decompiler.graph_region import GraphRegion
 from angr.analyses.decompiler.empty_node_remover import EmptyNodeRemover
 from angr.analyses.decompiler.jumptable_entry_condition_rewriter import JumpTableEntryConditionRewriter
@@ -112,6 +112,7 @@ class DreamStructurer(StructurerBase):
 
         loop_subgraph = self._region.graph
         successors = self._region.successors
+        assert successors is not None
 
         assert len(successors) <= 1
 
@@ -267,6 +268,7 @@ class DreamStructurer(StructurerBase):
 
     def _to_loop_body_sequence(self, loop_head, loop_subgraph, loop_successors):
         graph = self._region.graph_with_successors
+        assert graph is not None
         loop_region_graph = networkx.DiGraph()
 
         # TODO: Make sure the loop body has been structured
@@ -312,7 +314,7 @@ class DreamStructurer(StructurerBase):
             loop_head, loop_region_graph, successors=None, graph_with_successors=None, cyclic=False, full_graph=None
         )
         structurer = self.project.analyses[DreamStructurer].prep()(
-            region, condition_processor=self.cond_proc, func=self.function
+            region, condition_processor=self.cond_proc, func=self.function, jump_tables=self.jump_tables
         )
         seq = structurer.result
 
@@ -372,7 +374,7 @@ class DreamStructurer(StructurerBase):
             node.condition_and_nodes = new_cond_and_nodes
 
             if node.else_node is not None:
-                node.else_node = walker._handle(node.else_node)
+                node.else_node = walker._handle(node.else_node)  # type: ignore
             return node
 
         def _handle_SwitchCaseNode(node, **kwargs):  # pylint:disable=unused-argument
@@ -480,8 +482,6 @@ class DreamStructurer(StructurerBase):
         :return:        None
         """
 
-        jump_tables = self.kb.cfgs["CFGFast"].jump_tables
-
         addr2nodes: dict[int, set[CodeNode]] = defaultdict(set)
         for node in seq.nodes:
             addr2nodes[node.addr].add(node)
@@ -491,14 +491,14 @@ class DreamStructurer(StructurerBase):
                 node = seq.nodes[i]
 
                 # Jumptable_AddressLoadedFromMemory
-                r = self._make_switch_cases_address_loaded_from_memory(seq, i, node, addr2nodes, jump_tables)
+                r = self._make_switch_cases_address_loaded_from_memory(seq, i, node, addr2nodes)
                 if r:
                     # we found a node that looks like a switch-case. seq.nodes are changed. resume to find the next such
                     # case
                     break
 
                 # Jumptable_AddressComputed
-                r = self._make_switch_cases_address_computed(seq, i, node, addr2nodes, jump_tables)
+                r = self._make_switch_cases_address_computed(seq, i, node, addr2nodes)
                 if r:
                     break
 
@@ -506,9 +506,7 @@ class DreamStructurer(StructurerBase):
                 # we did not find any node that looks like a switch-case. exit.
                 break
 
-    def _make_switch_cases_address_loaded_from_memory(
-        self, seq, i, node, addr2nodes: dict[int, set[CodeNode]], jump_tables: dict[int, IndirectJump]
-    ) -> bool:
+    def _make_switch_cases_address_loaded_from_memory(self, seq, i, node, addr2nodes: dict[int, set[CodeNode]]) -> bool:
         """
         A typical jump table involves multiple nodes, which look like the following:
 
@@ -526,6 +524,8 @@ class DreamStructurer(StructurerBase):
 
         try:
             last_stmt = self.cond_proc.get_last_statement(node)
+            if not isinstance(last_stmt, ailment.Stmt.ConditionalJump):
+                return False
         except EmptyBlockNotice:
             return False
         successor_addrs = extract_jump_targets(last_stmt)
@@ -533,14 +533,14 @@ class DreamStructurer(StructurerBase):
             return False
 
         for t in successor_addrs:
-            if t in addr2nodes and t in jump_tables:
+            if t in addr2nodes and t in self.jump_tables:
                 # this is a candidate!
                 target = t
                 break
         else:
             return False
 
-        jump_table = jump_tables[target]
+        jump_table = self.jump_tables[target]
         if jump_table.type != IndirectJumpType.Jumptable_AddressLoadedFromMemory:
             return False
 
@@ -563,6 +563,7 @@ class DreamStructurer(StructurerBase):
             return False
 
         # build switch-cases
+        assert jump_table.jumptable_entries is not None
         cases, node_default, to_remove = self._switch_build_cases(
             seq, cmp_lb, jump_table.jumptable_entries, i, node_b_addr, addr2nodes
         )
@@ -575,6 +576,7 @@ class DreamStructurer(StructurerBase):
         if switch_end_addr is not None:
             self._switch_handle_gotos(cases, node_default, switch_end_addr)
 
+        assert last_stmt.ins_addr is not None
         self._make_switch_cases_core(
             seq,
             i,
@@ -591,12 +593,10 @@ class DreamStructurer(StructurerBase):
 
         return True
 
-    def _make_switch_cases_address_computed(
-        self, seq, i, node, addr2nodes: dict[int, set[CodeNode]], jump_tables: dict[int, IndirectJump]
-    ) -> bool:
-        if node.addr not in jump_tables:
+    def _make_switch_cases_address_computed(self, seq, i, node, addr2nodes: dict[int, set[CodeNode]]) -> bool:
+        if node.addr not in self.jump_tables:
             return False
-        jump_table = jump_tables[node.addr]
+        jump_table = self.jump_tables[node.addr]
         if jump_table.type != IndirectJumpType.Jumptable_AddressComputed:
             return False
 
@@ -622,9 +622,11 @@ class DreamStructurer(StructurerBase):
         cmp_expr, cmp_lb, cmp_ub = cmp  # pylint:disable=unused-variable
 
         jumptable_entries = jump_table.jumptable_entries
+        assert jumptable_entries is not None
 
         if isinstance(last_stmt.false_target, ailment.Expr.Const):
             default_addr = last_stmt.false_target.value
+            assert isinstance(default_addr, int)
         else:
             return False
 
@@ -661,8 +663,9 @@ class DreamStructurer(StructurerBase):
         addr,
         addr2nodes,
         to_remove,
+        *,
+        jumptable_addr: int,
         node_a=None,
-        jumptable_addr=None,
     ):
         scnode = SwitchCaseNode(cmp_expr, cases, node_default, addr=addr)
         scnode = CodeNode(scnode, node.reaching_condition)
@@ -720,6 +723,7 @@ class DreamStructurer(StructurerBase):
         ):
             # unpacking is needed
             for n in node_a.node.nodes:
+                assert n.addr is not None
                 if isinstance(n, ConditionNode):
                     unpacked = self._switch_unpack_condition_node(n, jumptable)
                     if unpacked is None:

angr/analyses/decompiler/structuring/phoenix.py

@@ -15,7 +15,7 @@ from ailment.expression import Const, UnaryOp, MultiStatementExpression
 
 from angr.utils.graph import GraphUtils
 from angr.utils.ail import is_phi_assignment
-from angr.knowledge_plugins.cfg import IndirectJumpType
+from angr.knowledge_plugins.cfg import IndirectJump, IndirectJumpType
 from angr.utils.constants import SWITCH_MISSING_DEFAULT_NODE_ADDR
 from angr.utils.graph import dominates, to_acyclic_graph, dfs_back_edges
 from angr.analyses.decompiler.sequence_walker import SequenceWalker
@@ -28,6 +28,7 @@ from angr.analyses.decompiler.utils import (
     has_nonlabel_nonphi_statements,
     first_nonlabel_nonphi_statement,
     switch_extract_bitwiseand_jumptable_info,
+    switch_extract_switch_expr_from_jump_target,
 )
 from angr.analyses.decompiler.counters.call_counter import AILCallCounter
 from .structurer_nodes import (
@@ -765,6 +766,7 @@ class PhoenixStructurer(StructurerBase):
                         last_src_stmt = self.cond_proc.get_last_statement(src_block)
                         assert last_src_stmt is not None
                         break_cond = self.cond_proc.recover_edge_condition(fullgraph, src_block, dst)
+                        assert successor.addr is not None
                         if claripy.is_true(break_cond):
                             break_stmt = Jump(
                                 None,
@@ -869,7 +871,7 @@ class PhoenixStructurer(StructurerBase):
                 if cont_block is None:
                     # cont_block is not found. but it's ok. one possibility is that src is a jump table head with one
                     # case being the loop head. in such cases, we can just remove the edge.
-                    if src.addr not in self.kb.cfgs["CFGFast"].jump_tables:
+                    if src.addr not in self.jump_tables:
                         l.debug(
                             "_refine_cyclic_core: Cannot find the block going to loop head for edge %r -> %r. "
                             "Remove the edge anyway.",
@@ -1070,25 +1072,29 @@ class PhoenixStructurer(StructurerBase):
     # switch cases
 
     def _match_acyclic_switch_cases(self, graph: networkx.DiGraph, full_graph: networkx.DiGraph, node) -> bool:
-        if isinstance(node, (SwitchCaseNode, IncompleteSwitchCaseNode)):
+        if isinstance(node, SwitchCaseNode):
+            return False
+
+        r = self._match_acyclic_switch_cases_address_loaded_from_memory_no_default_node(node, graph, full_graph)
+        if r:
+            return r
+
+        if isinstance(node, IncompleteSwitchCaseNode):
             return False
 
         r = self._match_acyclic_switch_cases_incomplete_switch_head(node, graph, full_graph)
         if r:
             return r
-        jump_tables = self.kb.cfgs["CFGFast"].jump_tables
-        r = self._match_acyclic_switch_cases_address_loaded_from_memory_no_ob_check(
-            node, graph, full_graph, jump_tables
-        )
+        r = self._match_acyclic_switch_cases_address_loaded_from_memory_no_ob_check(node, graph, full_graph)
         if r:
             return r
-        r = self._match_acyclic_switch_cases_address_loaded_from_memory(node, graph, full_graph, jump_tables)
+        r = self._match_acyclic_switch_cases_address_loaded_from_memory(node, graph, full_graph)
         if r:
             return r
-        r = self._match_acyclic_switch_cases_address_computed(node, graph, full_graph, jump_tables)
+        r = self._match_acyclic_switch_cases_address_computed(node, graph, full_graph)
         if r:
             return r
-        return self._match_acyclic_incomplete_switch_cases(node, graph, full_graph, jump_tables)
+        return self._match_acyclic_incomplete_switch_cases(node, graph, full_graph)
 
     def _match_acyclic_switch_cases_incomplete_switch_head(self, node, graph, full_graph) -> bool:
         try:
@@ -1162,7 +1168,7 @@ class PhoenixStructurer(StructurerBase):
             self._switch_handle_gotos(cases, node_default, switch_end_addr)
         return True
 
-    def _match_acyclic_switch_cases_address_loaded_from_memory(self, node, graph, full_graph, jump_tables) -> bool:
+    def _match_acyclic_switch_cases_address_loaded_from_memory(self, node, graph, full_graph) -> bool:
         try:
             last_stmt = self.cond_proc.get_last_statement(node)
         except EmptyBlockNotice:
@@ -1176,14 +1182,14 @@ class PhoenixStructurer(StructurerBase):
             return False
 
         for t in successor_addrs:
-            if t in jump_tables:
+            if t in self.jump_tables:
                 # this is a candidate!
                 target = t
                 break
         else:
             return False
 
-        jump_table = jump_tables[target]
+        jump_table = self.jump_tables[target]
         if jump_table.type != IndirectJumpType.Jumptable_AddressLoadedFromMemory:
             return False
 
@@ -1203,6 +1209,7 @@ class PhoenixStructurer(StructurerBase):
             return False
 
         # populate whitelist_edges
+        assert jump_table.jumptable_entries is not None
         for case_node_addr in jump_table.jumptable_entries:
             self.whitelist_edges.add((node_a.addr, case_node_addr))
         self.whitelist_edges.add((node.addr, node_b_addr))
@@ -1228,6 +1235,12 @@ class PhoenixStructurer(StructurerBase):
         if not r:
             return False
 
+        node_default = self._switch_find_default_node(graph, node, node_b_addr)
+        if node_default is not None:
+            # ensure we have successfully structured node_default
+            if full_graph.out_degree(node_default) > 1:
+                return False
+
         # un-structure IncompleteSwitchCaseNode
         if isinstance(node_a, SequenceNode) and node_a.nodes and isinstance(node_a.nodes[0], IncompleteSwitchCaseNode):
             _, new_seq_node = self._unpack_sequencenode_head(graph, node_a)
@@ -1285,10 +1298,99 @@ class PhoenixStructurer(StructurerBase):
 
         return True
 
-    def _match_acyclic_switch_cases_address_loaded_from_memory_no_ob_check(
-        self, node, graph, full_graph, jump_tables
-    ) -> bool:
-        if node.addr not in jump_tables:
+    def _match_acyclic_switch_cases_address_loaded_from_memory_no_default_node(self, node, graph, full_graph) -> bool:
+        # sanity checks
+        if not isinstance(node, IncompleteSwitchCaseNode):
+            return False
+        if node.addr not in self.jump_tables:
+            return False
+        # ensure _match_acyclic_switch_cases_address_load_from_memory cannot structure its predecessor (and this node)
+        preds = list(graph.predecessors(node))
+        if len(preds) != 1:
+            return False
+        pred = preds[0]
+        if full_graph.out_degree[pred] != 1:
+            return False
+        jump_table: IndirectJump = self.jump_tables[node.addr]
+        if jump_table.type != IndirectJumpType.Jumptable_AddressLoadedFromMemory:
+            return False
+
+        # extract the comparison expression, lower-, and upper-bounds from the last statement
+        last_stmt = self.cond_proc.get_last_statement(node.head)
+        if not isinstance(last_stmt, Jump):
+            return False
+        cmp_expr = switch_extract_switch_expr_from_jump_target(last_stmt.target)
+        if cmp_expr is None:
+            return False
+        cmp_lb = 0
+
+        # populate whitelist_edges
+        assert jump_table.jumptable_entries is not None
+
+        # sanity check: case nodes are successors to node_a. all case nodes must have at most common one successor
+        node_pred = None
+        if graph.in_degree[node] == 1:
+            node_pred = next(iter(graph.predecessors(node)))
+
+        case_nodes = list(graph.successors(node))
+
+        # case 1: the common successor happens to be directly reachable from node_a (usually as a result of compiler
+        # optimization)
+        # example: touch_touch_no_switch.o:main
+        r = self.switch_case_entry_node_has_common_successor_case_1(graph, jump_table, case_nodes, node_pred)
+
+        # case 2: the common successor is not directly reachable from node_a. this is a more common case.
+        if not r:
+            r |= self.switch_case_entry_node_has_common_successor_case_2(graph, jump_table, case_nodes, node_pred)
+
+        if not r:
+            return False
+
+        # un-structure IncompleteSwitchCaseNode
+        if isinstance(node, IncompleteSwitchCaseNode):
+            r = self._unpack_incompleteswitchcasenode(graph, node)
+            if not r:
+                return False
+            self._unpack_incompleteswitchcasenode(full_graph, node)  # this shall not fail
+            # update node
+            node = next(iter(nn for nn in graph.nodes if nn.addr == jump_table.addr))
+
+        case_and_entry_addrs = self._find_case_and_entry_addrs(node, graph, cmp_lb, jump_table)
+
+        cases, _, to_remove = self._switch_build_cases(
+            case_and_entry_addrs,
+            node,
+            node,
+            None,
+            graph,
+            full_graph,
+        )
+
+        # we don't know what the end address of this switch-case structure is. let's figure it out
+        switch_end_addr = self._switch_find_switch_end_addr(cases, None, {nn.addr for nn in self._region.graph})
+        r = self._make_switch_cases_core(
+            node,
+            cmp_expr,
+            cases,
+            None,
+            None,
+            last_stmt.ins_addr,
+            to_remove,
+            graph,
+            full_graph,
+            node_a=None,
+        )
+        if not r:
+            return False
+
+        # fully structured into a switch-case. remove node from switch_case_known_heads
+        if switch_end_addr is not None:
+            self._switch_handle_gotos(cases, None, switch_end_addr)
+
+        return True
+
+    def _match_acyclic_switch_cases_address_loaded_from_memory_no_ob_check(self, node, graph, full_graph) -> bool:
+        if node.addr not in self.jump_tables:
             return False
 
         try:
@@ -1298,7 +1400,7 @@ class PhoenixStructurer(StructurerBase):
         if not (isinstance(last_stmt, Jump) and not isinstance(last_stmt.target, Const)):
             return False
 
-        jump_table = jump_tables[node.addr]
+        jump_table = self.jump_tables[node.addr]
         if jump_table.type != IndirectJumpType.Jumptable_AddressLoadedFromMemory:
             return False
 
@@ -1310,6 +1412,7 @@ class PhoenixStructurer(StructurerBase):
         case_count = cmp_ub - cmp_lb + 1
 
         # ensure we have the same number of cases
+        assert jump_table.jumptable_entries is not None
         if case_count != len(jump_table.jumptable_entries):
             return False
 
@@ -1373,10 +1476,10 @@ class PhoenixStructurer(StructurerBase):
 
         return True
 
-    def _match_acyclic_switch_cases_address_computed(self, node, graph, full_graph, jump_tables) -> bool:
-        if node.addr not in jump_tables:
+    def _match_acyclic_switch_cases_address_computed(self, node, graph, full_graph) -> bool:
+        if node.addr not in self.jump_tables:
             return False
-        jump_table = jump_tables[node.addr]
+        jump_table = self.jump_tables[node.addr]
         if jump_table.type != IndirectJumpType.Jumptable_AddressComputed:
             return False
 
@@ -1403,9 +1506,16 @@ class PhoenixStructurer(StructurerBase):
 
         if isinstance(last_stmt.false_target, Const):
             default_addr = last_stmt.false_target.value
+            assert isinstance(default_addr, int)
         else:
             return False
 
+        node_default = self._switch_find_default_node(graph, node, default_addr)
+        if node_default is not None:
+            # ensure we have successfully structured node_default
+            if full_graph.out_degree(node_default) > 1:
+                return False
+
         case_and_entry_addrs = self._find_case_and_entry_addrs(node, graph, cmp_lb, jump_table)
 
         cases, node_default, to_remove = self._switch_build_cases(
@@ -1425,10 +1535,10 @@ class PhoenixStructurer(StructurerBase):
         )
 
     def _match_acyclic_incomplete_switch_cases(
-        self, node, graph: networkx.DiGraph, full_graph: networkx.DiGraph, jump_tables: dict
+        self, node, graph: networkx.DiGraph, full_graph: networkx.DiGraph
     ) -> bool:
         # sanity checks
-        if node.addr not in jump_tables:
+        if node.addr not in self.jump_tables:
             return False
         if isinstance(node, IncompleteSwitchCaseNode):
             return False
@@ -1437,9 +1547,11 @@ class PhoenixStructurer(StructurerBase):
 
         successors = list(graph.successors(node))
 
+        jump_table = self.jump_tables[node.addr]
+        assert jump_table.jumptable_entries is not None
         if (
             successors
-            and {succ.addr for succ in successors} == set(jump_tables[node.addr].jumptable_entries)
+            and {succ.addr for succ in successors} == set(jump_table.jumptable_entries)
             and all(graph.in_degree[succ] == 1 for succ in successors)
         ):
             out_nodes = set()
@@ -1473,16 +1585,12 @@ class PhoenixStructurer(StructurerBase):
         cases: OrderedDict[int | tuple[int, ...], SequenceNode] = OrderedDict()
         to_remove = set()
 
-        # it is possible that the default node gets duplicated by other analyses and creates a default node (addr.a)
-        # and a case node (addr.b). The addr.a node is a successor to the head node while the addr.b node is a
-        # successor to node_a
         default_node_candidates = (
             [nn for nn in graph.nodes if nn.addr == node_b_addr] if node_b_addr is not None else []
         )
-        node_default: BaseNode | None = next(
-            iter(nn for nn in default_node_candidates if graph.has_edge(head_node, nn)), None
+        node_default = (
+            self._switch_find_default_node(graph, head_node, node_b_addr) if node_b_addr is not None else None
         )
-
         if node_default is not None and not isinstance(node_default, SequenceNode):
             # make the default node a SequenceNode so that we can insert Break and Continue nodes into it later
             new_node = SequenceNode(node_default.addr, nodes=[node_default])
@@ -1615,7 +1723,12 @@ class PhoenixStructurer(StructurerBase):
         for case_node in to_remove:
             if case_node is not node_default and case_node is not node_a and case_node is not head:
                 for succ in graph.successors(case_node):
-                    if succ is not case_node and succ is not head and graph.in_degree[succ] == 1:
+                    if (
+                        succ is not case_node
+                        and succ is not head
+                        and succ is not self._region.head
+                        and graph.in_degree[succ] == 1
+                    ):
                         # succ will be dangling - not ready to be structured yet - do it later
                         return False
 
@@ -1673,6 +1786,7 @@ class PhoenixStructurer(StructurerBase):
                 for _out_src, out_dst in out_edges[1:]:
                     if out_dst in full_graph and out_dst not in graph and full_graph.in_degree[out_dst] == 0:
                         full_graph.remove_node(out_dst)
+                        assert self._region.successors is not None
                         if out_dst in self._region.successors:
                             self._region.successors.remove(out_dst)
 
@@ -1705,8 +1819,7 @@ class PhoenixStructurer(StructurerBase):
         return case_and_entry_addrs
 
     def _is_node_unstructured_switch_case_head(self, node) -> bool:
-        jump_tables = self.kb.cfgs["CFGFast"].jump_tables
-        if node.addr in jump_tables:
+        if node.addr in self.jump_tables:
             # maybe it has been structured?
             try:
                 last_stmts = self.cond_proc.get_last_statements(node)
@@ -1739,6 +1852,7 @@ class PhoenixStructurer(StructurerBase):
                 and not self._is_switch_cases_address_loaded_from_memory_head_or_jumpnode(full_graph, end_node)
                 and not self._is_switch_cases_address_loaded_from_memory_head_or_jumpnode(full_graph, start_node)
                 and end_node not in self.dowhile_known_tail_nodes
+                and not isinstance(end_node, IncompleteSwitchCaseNode)
             ):
                 # merge two blocks
                 new_seq = self._merge_nodes(start_node, end_node)
@@ -2299,7 +2413,7 @@ class PhoenixStructurer(StructurerBase):
             ):
                 edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                 edge_cond_successor = self.cond_proc.recover_edge_condition(full_graph, start_node, successor)
-                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_successor):
+                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_successor):  # type: ignore
                     # c0 = !c0
                     left_succs = list(full_graph.successors(left))
                     if len(left_succs) == 2 and successor in left_succs:
@@ -2310,7 +2424,9 @@ class PhoenixStructurer(StructurerBase):
                             edge_cond_left_successor = self.cond_proc.recover_edge_condition(
                                 full_graph, left, successor
                             )
-                            if claripy.is_true(claripy.Not(edge_cond_left_right) == edge_cond_left_successor):
+                            if claripy.is_true(
+                                claripy.Not(edge_cond_left_right) == edge_cond_left_successor  # type: ignore
+                            ):
                                 # c1 = !c1
                                 return left, edge_cond_left, successor, edge_cond_left_successor, right
         return None
@@ -2349,14 +2465,14 @@ class PhoenixStructurer(StructurerBase):
             ):
                 edge_cond_left = self.cond_proc.recover_edge_condition(full_graph, start_node, left)
                 edge_cond_else = self.cond_proc.recover_edge_condition(full_graph, start_node, else_node)
-                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_else):
+                if claripy.is_true(claripy.Not(edge_cond_left) == edge_cond_else):  # type: ignore
                     # c0 = !c0
                     left_succs = list(full_graph.successors(left))
                     if len(left_succs) == 2 and else_node in left_succs:
                         right = next(iter(succ for succ in left_succs if succ is not else_node))
                         edge_cond_left_right = self.cond_proc.recover_edge_condition(full_graph, left, right)
                         edge_cond_left_else = self.cond_proc.recover_edge_condition(full_graph, left, else_node)
-                        if claripy.is_true(claripy.Not(edge_cond_left_right) == edge_cond_left_else):
+                        if claripy.is_true(claripy.Not(edge_cond_left_right) == edge_cond_left_else):  # type: ignore
                             # c1 = !c1
                             return left, edge_cond_left, right, edge_cond_left_right, else_node
         return None
@@ -2441,6 +2557,7 @@ class PhoenixStructurer(StructurerBase):
                 goto1_target = None
 
             if goto0_condition is not None:
+                assert goto0_target is not None and goto1_target is not None
                 goto0 = Block(
                     last_stmt.ins_addr,
                     0,
@@ -2510,7 +2627,7 @@ class PhoenixStructurer(StructurerBase):
         dst: Block | BaseNode,
         last=True,
         condjump_only=False,
-    ) -> tuple[int | None, BaseNode | None, Block | None]:
+    ) -> tuple[int | None, BaseNode | None, Block | MultiNode | BreakNode | None]:
         """
 
         :param node:
@@ -2678,7 +2795,7 @@ class PhoenixStructurer(StructurerBase):
                 return True
             return all(not isinstance(stmt, (ConditionalJump, Jump)) for stmt in stmts[:-1])
 
-        def _to_statement_list(node: Block | MultiNode | SequenceNode) -> list[Statement]:
+        def _to_statement_list(node: Block | MultiNode | SequenceNode | BaseNode) -> list[Statement]:
             if isinstance(node, Block):
                 return node.statements
             if isinstance(node, MultiNode):
@@ -2733,7 +2850,7 @@ class PhoenixStructurer(StructurerBase):
                 graph.remove_edge(src, succ)
 
     @staticmethod
-    def _remove_first_statement_if_jump(node: BaseNode | Block) -> Jump | ConditionalJump | None:
+    def _remove_first_statement_if_jump(node: BaseNode | Block | MultiNode) -> Jump | ConditionalJump | None:
         if isinstance(node, Block):
             if node.statements:
                 idx = 0
@@ -2781,7 +2898,7 @@ class PhoenixStructurer(StructurerBase):
             src, dst = edge_
             dst_in_degree = graph.in_degree[dst]
             src_out_degree = graph.out_degree[src]
-            return -node_seq.get(dst), dst_in_degree, src_out_degree, -src.addr, -dst.addr
+            return -node_seq.get(dst), dst_in_degree, src_out_degree, -src.addr, -dst.addr  # type: ignore
 
         return sorted(edges, key=_sort_edge, reverse=True)
 

angr/analyses/decompiler/structuring/recursive_structurer.py

@@ -92,6 +92,7 @@ class RecursiveStructurer(Analysis):
                     case_entry_to_switch_head=self._case_entry_to_switch_head,
                     func=self.function,
                     parent_region=parent_region,
+                    jump_tables=self.kb.cfgs["CFGFast"].jump_tables,
                     **self.structurer_options,
                 )
                 # replace this region with the resulting node in its parent region... if it's not an orphan