angr 9.2.141__py3-none-macosx_11_0_arm64.whl → 9.2.143__py3-none-macosx_11_0_arm64.whl

angr/analyses/decompiler/clinic.py

@@ -13,7 +13,6 @@ import capstone
 
 import ailment
 
-from angr.analyses.decompiler.ssailification.ssailification import Ssailification
 from angr.errors import AngrDecompilationError
 from angr.knowledge_base import KnowledgeBase
 from angr.knowledge_plugins.functions import Function
@@ -39,6 +38,8 @@ from angr.procedures.stubs.UnresolvableJumpTarget import UnresolvableJumpTarget
 from angr.analyses import Analysis, register_analysis
 from angr.analyses.cfg.cfg_base import CFGBase
 from angr.analyses.reaching_definitions import ReachingDefinitionsAnalysis
+from .ssailification.ssailification import Ssailification
+from .stack_item import StackItem, StackItemType
 from .return_maker import ReturnMaker
 from .ailgraph_walker import AILGraphWalker, RemoveNodeNotice
 from .optimization_passes import (
@@ -170,6 +171,7 @@ class Clinic(Analysis):
 
         self._register_save_areas_removed: bool = False
         self.edges_to_remove: list[tuple[tuple[int, int | None], tuple[int, int | None]]] = []
+        self.copied_var_ids: set[int] = set()
 
         self._new_block_addrs = set()
 
@@ -182,6 +184,10 @@ class Clinic(Analysis):
         else:
             self._optimization_passes = []
 
+        self.stack_items: dict[int, StackItem] = {}
+        if self.project.arch.call_pushes_ret:
+            self.stack_items[0] = StackItem(0, self.project.arch.bytes, "ret_addr", StackItemType.RET_ADDR)
+
         if self._mode == ClinicMode.DECOMPILE:
             self._analyze_for_decompiling()
         elif self._mode == ClinicMode.COLLECT_DATA_REFS:
@@ -502,7 +508,7 @@ class Clinic(Analysis):
         # Run simplification passes
         self._update_progress(40.0, text="Running simplifications 1")
         ail_graph = self._run_simplification_passes(
-            ail_graph, stage=OptimizationPassStage.AFTER_SINGLE_BLOCK_SIMPLIFICATION
+            ail_graph, stack_items=self.stack_items, stage=OptimizationPassStage.AFTER_SINGLE_BLOCK_SIMPLIFICATION
         )
 
         # Simplify the entire function for the first time
@@ -565,7 +571,9 @@ class Clinic(Analysis):
 
         # Run simplification passes
         self._update_progress(65.0, text="Running simplifications 3 ")
-        ail_graph = self._run_simplification_passes(ail_graph, stage=OptimizationPassStage.AFTER_GLOBAL_SIMPLIFICATION)
+        ail_graph = self._run_simplification_passes(
+            ail_graph, stack_items=self.stack_items, stage=OptimizationPassStage.AFTER_GLOBAL_SIMPLIFICATION
+        )
 
         # Simplify the entire function for the third time
         self._update_progress(70.0, text="Simplifying function 3")
@@ -632,6 +640,7 @@ class Clinic(Analysis):
         self.cc_graph = self.copy_graph(ail_graph)
         self.externs = self._collect_externs(ail_graph, variable_kb)
         self.vvar_to_vvar = vvar2vvar
+        self.copied_var_ids = copied_vvar_ids
         return ail_graph
 
     def _analyze_for_data_refs(self):
@@ -780,6 +789,8 @@ class Clinic(Analysis):
         :return: None
         """
 
+        attempted_funcs: set[int] = set()
+
         for node in self.function.transition_graph:
             if (
                 isinstance(node, BlockNode)
@@ -791,7 +802,12 @@ class Clinic(Analysis):
             elif isinstance(node, Function):
                 target_func = node
             else:
+                # TODO: Enable call-site analysis for indirect calls
+                continue
+
+            if target_func.addr in attempted_funcs:
                 continue
+            attempted_funcs.add(target_func.addr)
 
             # case 0: the calling convention and prototype are available
             if target_func.calling_convention is not None and target_func.prototype is not None:
@@ -811,6 +827,7 @@ class Clinic(Analysis):
                 if cc.cc is not None and cc.prototype is not None:
                     target_func.calling_convention = cc.cc
                     target_func.prototype = cc.prototype
+                    target_func.prototype_libname = cc.prototype_libname
                     continue
 
             # case 3: the callee is a PLT function
@@ -819,6 +836,7 @@ class Clinic(Analysis):
                 if cc.cc is not None and cc.prototype is not None:
                     target_func.calling_convention = cc.cc
                     target_func.prototype = cc.prototype
+                    target_func.prototype_libname = cc.prototype_libname
                     continue
 
             # case 4: fall back to call site analysis
@@ -970,7 +988,29 @@ class Clinic(Analysis):
             return ailment.Block(block_node.addr, 0, statements=[])
 
         block = self.project.factory.block(block_node.addr, block_node.size, cross_insn_opt=False)
-        return self._convert_vex(block)
+        converted = self._convert_vex(block)
+
+        # architecture-specific setup
+        if block.addr == self.function.addr and self.project.arch.name in {"X86", "AMD64"}:
+            # setup dflag; this is a hack for most sane ABIs. we may move this logic elsewhere if there are adversarial
+            # binaries that mess with dflags and pass them across functions
+            dflag_offset, dflag_size = self.project.arch.registers["d"]
+            dflag = ailment.Expr.Register(
+                self._ail_manager.next_atom(),
+                None,
+                dflag_offset,
+                dflag_size * self.project.arch.byte_width,
+                ins_addr=block.addr,
+            )
+            forward = ailment.Expr.Const(
+                self._ail_manager.next_atom(), None, 1, dflag_size * self.project.arch.byte_width, ins_addr=block.addr
+            )
+            dflag_assignment = ailment.Stmt.Assignment(
+                self._ail_manager.next_atom(), dflag, forward, ins_addr=block.addr
+            )
+            converted.statements.insert(0, dflag_assignment)
+
+        return converted
 
     def _convert_vex(self, block):
         if block.vex.jumpkind not in {"Ijk_Call", "Ijk_Boring", "Ijk_Ret"} and not block.vex.jumpkind.startswith(
@@ -1012,7 +1052,11 @@ class Clinic(Analysis):
                 node = self._cfg.get_any_node(block.addr)
                 if node is None:
                     continue
-                successors = self._cfg.get_successors(node, excluding_fakeret=True, jumpkind="Ijk_Call")
+                successors = [
+                    node
+                    for node, jk in self._cfg.get_successors_and_jumpkinds(node)
+                    if jk == "Ijk_Call" or jk.startswith("Ijk_Sys")
+                ]
                 if len(successors) == 1:
                     succ_addr = successors[0].addr
                     if not self.project.is_hooked(succ_addr) or not isinstance(
@@ -1256,6 +1300,7 @@ class Clinic(Analysis):
         ail_graph,
         stage: OptimizationPassStage = OptimizationPassStage.AFTER_GLOBAL_SIMPLIFICATION,
         variable_kb=None,
+        stack_items: dict[int, StackItem] | None = None,
         **kwargs,
     ):
         addr_and_idx_to_blocks: dict[tuple[int, int | None], ailment.Block] = {}
@@ -1301,6 +1346,8 @@ class Clinic(Analysis):
                     # clear the cached RDA result
                     self.reaching_definitions = None
                 self.vvar_id_start = a.vvar_id_start
+            if stack_items is not None and a.stack_items:
+                stack_items.update(a.stack_items)
 
         return ail_graph
 
@@ -1559,6 +1606,13 @@ class Clinic(Analysis):
             if vartype is not None:
                 for tv in vr.var_to_typevars[variable]:
                     groundtruth[tv] = vartype
+        # get maximum sizes of each stack variable, regardless of its original type
+        stackvar_max_sizes = var_manager.get_stackvar_max_sizes(self.stack_items)
+        tv_max_sizes = {}
+        for v, s in stackvar_max_sizes.items():
+            if v in vr.var_to_typevars:
+                for tv in vr.var_to_typevars[v]:
+                    tv_max_sizes[tv] = s
         # clean up existing types for this function
         var_manager.remove_types()
         # TODO: Type inference for global variables
@@ -1579,6 +1633,7 @@ class Clinic(Analysis):
                 var_mapping=vr.var_to_typevars,
                 must_struct=must_struct,
                 ground_truth=groundtruth,
+                stackvar_max_sizes=tv_max_sizes,
             )
             # tp.pp_constraints()
             # tp.pp_solution()
@@ -2439,6 +2494,19 @@ class Clinic(Analysis):
                                     last_stmt.target.value = succs[0].addr
                                 elif isinstance(last_stmt, ailment.Stmt.ConditionalJump):
                                     patch_conditional_jump_target(last_stmt, node.addr, succs[0].addr)
+                                    # if both branches jump to the same location, we replace it with a jump
+                                    if (
+                                        isinstance(last_stmt.true_target, ailment.Expr.Const)
+                                        and isinstance(last_stmt.false_target, ailment.Expr.Const)
+                                        and last_stmt.true_target.value == last_stmt.false_target.value
+                                    ):
+                                        last_stmt = ailment.Stmt.Jump(
+                                            last_stmt.idx,
+                                            last_stmt.true_target,
+                                            target_idx=last_stmt.true_target.idx,
+                                            ins_addr=last_stmt.ins_addr,
+                                        )
+                                        pred.statements[-1] = last_stmt
                                 first_cond_jump = first_conditional_jump(pred)
                                 if first_cond_jump is not None and first_cond_jump is not last_stmt:
                                     patch_conditional_jump_target(first_cond_jump, node.addr, succs[0].addr)

angr/analyses/decompiler/condition_processor.py

@@ -16,6 +16,7 @@ from angr.utils.graph import GraphUtils
 from angr.utils.lazy_import import lazy_import
 from angr.utils import is_pyinstaller
 from angr.utils.graph import dominates, inverted_idoms
+from angr.utils.ail import is_head_controlled_loop_block
 from angr.block import Block, BlockNode
 from angr.errors import AngrRuntimeError
 from .peephole_optimizations import InvertNegatedLogicalConjunctionsAndDisjunctions, RemoveRedundantNots
@@ -34,7 +35,7 @@ from .structuring.structurer_nodes import (
     IncompleteSwitchCaseNode,
 )
 from .graph_region import GraphRegion
-from .utils import first_nonlabel_nonphi_statement, peephole_optimize_expr
+from .utils import peephole_optimize_expr
 
 if is_pyinstaller():
     # PyInstaller is not happy with lazy import
@@ -671,12 +672,11 @@ class ConditionProcessor:
             return claripy.true()
 
         # sometimes the last statement is the conditional jump. sometimes it's the first statement of the block
-        if (
-            isinstance(src_block, ailment.Block)
-            and src_block.statements
-            and isinstance(first_nonlabel_nonphi_statement(src_block), ailment.Stmt.ConditionalJump)
-        ):
-            last_stmt = first_nonlabel_nonphi_statement(src_block)
+        if isinstance(src_block, ailment.Block) and src_block.statements and is_head_controlled_loop_block(src_block):
+            last_stmt = next(
+                iter(stmt for stmt in src_block.statements[:-1] if isinstance(stmt, ailment.Stmt.ConditionalJump)), None
+            )
+            assert last_stmt is not None
         else:
             last_stmt = self.get_last_statement(src_block)
 

angr/analyses/decompiler/decompilation_cache.py

@@ -6,6 +6,7 @@ from .structured_codegen import BaseStructuredCodeGenerator
 
 if TYPE_CHECKING:
     from angr.analyses.decompiler.optimization_passes.expr_op_swapper import OpDescriptor
+    from angr.analyses.typehoon.typevars import TypeVariable, TypeConstraint
 
 
 class DecompilationCache:
@@ -29,7 +30,7 @@ class DecompilationCache:
     def __init__(self, addr):
         self.parameters: dict[str, Any] = {}
         self.addr = addr
-        self.type_constraints: set | None = None
+        self.type_constraints: dict[TypeVariable, set[TypeConstraint]] | None = None
         self.func_typevar = None
         self.var_to_typevar: dict | None = None
         self.codegen: BaseStructuredCodeGenerator | None = None

angr/analyses/decompiler/decompiler.py

@@ -31,6 +31,7 @@ from .presets import DECOMPILATION_PRESETS, DecompilationPreset
 if TYPE_CHECKING:
     from angr.knowledge_plugins.cfg.cfg_model import CFGModel
     from .peephole_optimizations import PeepholeOptimizationExprBase, PeepholeOptimizationStmtBase
+    from angr.analyses.typehoon.typevars import TypeVariable, TypeConstraint
 
 l = logging.getLogger(name=__name__)
 
@@ -135,6 +136,7 @@ class Decompiler(Analysis):
         self.unoptimized_ail_graph: networkx.DiGraph | None = None
         self.ail_graph: networkx.DiGraph | None = None
         self.vvar_id_start = None
+        self._copied_var_ids: set[int] = set()
         self._optimization_scratch: dict[str, Any] = {}
         self.expr_collapse_depth = expr_collapse_depth
 
@@ -267,6 +269,7 @@ class Decompiler(Analysis):
         self._variable_kb = clinic.variable_kb
         self._update_progress(70.0, text="Identifying regions")
         self.vvar_id_start = clinic.vvar_id_start
+        self._copied_var_ids = clinic.copied_var_ids
 
         if clinic.graph is None:
             # the function is empty
@@ -501,6 +504,7 @@ class Decompiler(Analysis):
                 force_loop_single_exit=self._force_loop_single_exit,
                 complete_successors=self._complete_successors,
                 peephole_optimizations=self._peephole_optimizations,
+                avoid_vvar_ids=self._copied_var_ids,
                 **kwargs,
             )
 
@@ -546,7 +550,9 @@ class Decompiler(Analysis):
                     SimMemoryVariable(symbol.rebased_addr, 1, name=symbol.name, ident=ident),
                 )
 
-    def reflow_variable_types(self, type_constraints: set, func_typevar, var_to_typevar: dict, codegen):
+    def reflow_variable_types(
+        self, type_constraints: dict[TypeVariable, set[TypeConstraint]], func_typevar, var_to_typevar: dict, codegen
+    ):
         """
         Re-run type inference on an existing variable recovery result, then rerun codegen to generate new results.
 
@@ -606,7 +612,9 @@ class Decompiler(Analysis):
                     var = arg.variable
                     new_type = var_manager.get_variable_type(var)
                     if new_type is not None:
-                        self.func.prototype.args[i] = new_type
+                        self.func.prototype.args = (
+                            self.func.prototype.args[:i] + (new_type,) + self.func.prototype.args[i + 1 :]
+                        )
         except Exception:  # pylint:disable=broad-except
             l.warning(
                 "Typehoon analysis failed. Variables will not have types. Please report to GitHub.", exc_info=True

angr/analyses/decompiler/dephication/graph_vvar_mapping.py

@@ -283,14 +283,12 @@ class GraphDephicationVVarMapping(Analysis):  # pylint:disable=abstract-method
 
     @staticmethod
     def _prepend_stmt(block, stmt):
-        # TODO: This insertion breaks the assumption that all phi statements appear before any assignments. We must
-        # TODO: fix the assumption elsewhere in the code base.
-        first_nonlabel_idx = len(block.statements)
+        first_nonlabel_nonphi_idx = len(block.statements)
         for i, s in enumerate(block.statements):
-            if not isinstance(s, Label):
-                first_nonlabel_idx = i
+            if not isinstance(s, Label) and not is_phi_assignment(s):
+                first_nonlabel_nonphi_idx = i
                 break
-        block.statements.insert(first_nonlabel_idx, stmt)
+        block.statements.insert(first_nonlabel_nonphi_idx, stmt)
 
     @staticmethod
     def _used_in_phi(dst_block, src_block, vvar_id: int) -> bool:

angr/analyses/decompiler/optimization_passes/base_ptr_save_simplifier.py

@@ -4,6 +4,7 @@ import logging
 
 import ailment
 
+from angr.analyses.decompiler.stack_item import StackItem, StackItemType
 from .optimization_pass import OptimizationPass, OptimizationPassStage
 
 _l = logging.getLogger(name=__name__)
@@ -62,11 +63,16 @@ class BasePointerSaveSimplifier(OptimizationPass):
             return
 
         # update the first block
-        block, stmt_idx, _ = save_stmt
+        block, stmt_idx, save_dst = save_stmt
         block_copy = block.copy()
         block_copy.statements.pop(stmt_idx)
         self._update_block(block, block_copy)
 
+        # update stack_items
+        self.stack_items[save_dst.stack_offset] = StackItem(
+            save_dst.stack_offset, save_dst.size, "saved_bp", StackItemType.SAVED_BP
+        )
+
         # update all endpoint blocks
         if restore_stmts:
             for block, stmt_idx, _ in restore_stmts:
@@ -74,7 +80,7 @@ class BasePointerSaveSimplifier(OptimizationPass):
                 block_copy.statements.pop(stmt_idx)
                 self._update_block(block, block_copy)
 
-    def _find_baseptr_save_stmt(self):
+    def _find_baseptr_save_stmt(self) -> tuple[ailment.Block, int, ailment.Expr.VirtualVariable] | None:
         """
         Find the AIL statement that saves the base pointer to a stack slot.
 

angr/analyses/decompiler/optimization_passes/condition_constprop.py

@@ -1,14 +1,21 @@
 from __future__ import annotations
+from typing import TYPE_CHECKING
+from collections import defaultdict
 
 import networkx
 
 from ailment import AILBlockWalker, Block
-from ailment.statement import ConditionalJump, Statement
+from ailment.statement import ConditionalJump, Statement, Assignment
 from ailment.expression import Const, BinaryOp, VirtualVariable
 
-from angr.analyses.decompiler.region_identifier import RegionIdentifier
+from angr.analyses.decompiler.utils import first_nonlabel_nonphi_statement
+from angr.utils.graph import dominates
+from angr.utils.timing import timethis
 from .optimization_pass import OptimizationPass, OptimizationPassStage
 
+if TYPE_CHECKING:
+    from angr.analyses.s_reaching_definitions import SRDAModel
+
 
 class ConstantCondition:
     """
@@ -35,6 +42,7 @@ class CCondPropBlockWalker(AILBlockWalker):
         self._new_block: Block | None = None  # output
         self.vvar_id = vvar_id
         self.const_value = const_value
+        self.abort = False
 
     def walk(self, block: Block):
         self._new_block = None
@@ -42,6 +50,17 @@ class CCondPropBlockWalker(AILBlockWalker):
         return self._new_block
 
     def _handle_stmt(self, stmt_idx: int, stmt: Statement, block: Block):  # type: ignore
+        if self.abort:
+            return
+
+        if isinstance(stmt, Assignment) and isinstance(stmt.dst, VirtualVariable) and stmt.dst.varid == self.vvar_id:
+            # we see the assignment of this virtual variable; this is the original block that creates this variable
+            # and checks if this variable is equal to a constant value. as such, we stop processing this block.
+            # an example appears in binary 1de5cda760f9ed80bb6f4a35edcebc86ccec14c49cf4775ddf2ffc3e05ff35f4, function
+            # 0x4657C0, blocks 0x465bd6 and 0x465a5c
+            self.abort = True
+            return
+
         r = super()._handle_stmt(stmt_idx, stmt, block)
         if r is not None:
             # replace the original statement
@@ -52,7 +71,9 @@ class CCondPropBlockWalker(AILBlockWalker):
     def _handle_VirtualVariable(  # type: ignore
         self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt: Statement, block: Block | None
     ) -> Const | None:
-        if expr.varid == self.vvar_id:
+        if expr.varid == self.vvar_id and not (
+            isinstance(stmt, Assignment) and isinstance(stmt.dst, VirtualVariable) and stmt.dst.varid == self.vvar_id
+        ):
             return Const(expr.idx, None, self.const_value.value, self.const_value.bits, **expr.tags)
         return None
 
@@ -74,18 +95,9 @@ class ConditionConstantPropagation(OptimizationPass):
 
     def _check(self):
         cconds = self._find_const_conditions()
-        if not cconds:
-            return False, None
-        return True, {"cconds": cconds}
-
-    def _analyze(self, cache=None):
-        if not cache or cache.get("cconds", None) is None:  # noqa: SIM108
-            cconds = self._find_const_conditions()
-        else:
-            cconds = cache["cconds"]
 
         if not cconds:
-            return
+            return False, None
 
         # group cconds according to their sources
         cconds_by_src: dict[tuple[int, int | None], list[ConstantCondition]] = {}
@@ -95,26 +107,60 @@ class ConditionConstantPropagation(OptimizationPass):
                 cconds_by_src[src] = []
             cconds_by_src[src].append(ccond)
 
+        # eliminate conflicting conditions
+        for src in list(cconds_by_src):
+            cconds = cconds_by_src[src]
+            vvar_id_to_values = defaultdict(set)
+            ccond_dict = {}  # keyed by vvar_id; used for deduplication
+            for ccond in cconds:
+                vvar_id_to_values[ccond.vvar_id].add(ccond.value)
+                ccond_dict[ccond.vvar_id] = ccond
+            new_cconds = []
+            for vid, vvalues in vvar_id_to_values.items():
+                if len(vvalues) == 1:
+                    new_cconds.append(ccond_dict[vid])
+            if new_cconds:
+                cconds_by_src[src] = new_cconds
+            else:
+                del cconds_by_src[src]
+
+        if not cconds_by_src:
+            return False, None
+        return True, {"cconds_by_src": cconds_by_src}
+
+    @timethis
+    def _analyze(self, cache=None):
+        if not cache or cache.get("cconds_by_src", None) is None:
+            return
+        cconds_by_src = cache["cconds_by_src"]
+
+        if not cconds_by_src:
+            return
+
         # calculate a dominance frontier for each block
         entry_node_addr, entry_node_idx = self.entry_node_addr
         entry_node = self._get_block(entry_node_addr, idx=entry_node_idx)
-        df = networkx.algorithms.dominance_frontiers(self._graph, entry_node)
+        idoms = networkx.algorithms.immediate_dominators(self._graph, entry_node)
+        rda: SRDAModel = self.project.analyses.SReachingDefinitions(self._func, func_graph=self._graph).model
 
         for src, cconds in cconds_by_src.items():
             head_block = self._get_block(src[0], idx=src[1])
             if head_block is None:
                 continue
-            frontier = df.get(head_block)
-            if frontier is None:
-                continue
-            graph_slice = RegionIdentifier.slice_graph(self._graph, head_block, frontier, include_frontier=False)
-            for ccond in cconds:
-                walker = CCondPropBlockWalker(ccond.vvar_id, ccond.value)
-                for block in graph_slice:
-                    new_block = walker.walk(block)
-                    if new_block is not None:
-                        self._update_block(block, new_block)
 
+            for ccond in cconds:
+                for _, loc in rda.all_vvar_uses[ccond.vvar_id]:
+                    loc_block = self._get_block(loc.block_addr, idx=loc.block_idx)
+                    if loc_block is None:
+                        continue
+                    if dominates(idoms, head_block, loc_block):
+                        # the constant condition dominates the use site
+                        walker = CCondPropBlockWalker(ccond.vvar_id, ccond.value)
+                        new_block = walker.walk(loc_block)
+                        if new_block is not None:
+                            self._update_block(loc_block, new_block)
+
+    @timethis
     def _find_const_conditions(self) -> list[ConstantCondition]:
         cconds = []
 
@@ -122,28 +168,46 @@ class ConditionConstantPropagation(OptimizationPass):
             if block.statements:
                 last_stmt = block.statements[-1]
                 if (
-                    not isinstance(last_stmt, ConditionalJump)
-                    or not isinstance(last_stmt.true_target, Const)
-                    or not isinstance(last_stmt.false_target, Const)
+                    isinstance(last_stmt, ConditionalJump)
+                    and isinstance(last_stmt.true_target, Const)
+                    and isinstance(last_stmt.false_target, Const)
                 ):
-                    continue
-
-                if isinstance(last_stmt.condition, BinaryOp):
-                    cond = last_stmt.condition
-                    op = cond.op
-                    op0, op1 = cond.operands
-                    if isinstance(op0, Const):
-                        op0, op1 = op1, op0
-                    if isinstance(op0, VirtualVariable) and isinstance(op1, Const) and op1.is_int:
-                        if op == "CmpEQ":
-                            ccond = ConstantCondition(
-                                op0.varid, op1, last_stmt.true_target.value, last_stmt.true_target_idx  # type: ignore
-                            )
-                            cconds.append(ccond)
-                        elif op == "CmpNE":
-                            ccond = ConstantCondition(
-                                op0.varid, op1, last_stmt.false_target.value, last_stmt.false_target_idx  # type: ignore
-                            )
-                            cconds.append(ccond)
+                    self._extract_const_condition_from_stmt(last_stmt, cconds)
+                else:
+                    # also check the first non-phi statement; rep stos may generate blocks whose conditional checks
+                    # are at the beginning of the block
+
+                    # we could have used is_head_controlled_loop_block, but at this point the block is simplified enough
+                    # that the first non-label, non-phi statement must be a ConditionalJump that controls the execution
+                    # of the loop body, so the following logic should work fine.
+
+                    first_stmt = first_nonlabel_nonphi_statement(block)
+                    if (
+                        first_stmt is not last_stmt
+                        and isinstance(first_stmt, ConditionalJump)
+                        and isinstance(first_stmt.true_target, Const)
+                        and isinstance(first_stmt.false_target, Const)
+                    ):
+                        self._extract_const_condition_from_stmt(first_stmt, cconds)
 
         return cconds
+
+    @staticmethod
+    def _extract_const_condition_from_stmt(stmt: ConditionalJump, cconds: list[ConstantCondition]) -> None:
+        if isinstance(stmt.condition, BinaryOp):
+            cond = stmt.condition
+            op = cond.op
+            op0, op1 = cond.operands
+            if isinstance(op0, Const):
+                op0, op1 = op1, op0
+            if isinstance(op0, VirtualVariable) and isinstance(op1, Const) and op1.is_int:
+                if op == "CmpEQ":
+                    ccond = ConstantCondition(
+                        op0.varid, op1, stmt.true_target.value, stmt.true_target_idx  # type: ignore
+                    )
+                    cconds.append(ccond)
+                elif op == "CmpNE":
+                    ccond = ConstantCondition(
+                        op0.varid, op1, stmt.false_target.value, stmt.false_target_idx  # type: ignore
+                    )
+                    cconds.append(ccond)

angr/analyses/decompiler/optimization_passes/ite_region_converter.py

@@ -192,6 +192,14 @@ class ITERegionConverter(OptimizationPass):
         if region_head not in self._graph or region_tail not in self._graph:
             return False
 
+        # ensure all phi statements in region_tail have valid source vvars
+        for stmt in region_tail.statements:
+            if not is_phi_assignment(stmt):
+                continue
+            for _, vvar in stmt.src.src_and_vvars:
+                if vvar is None:
+                    return False
+
         #
         # create a new region_head
         #

angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py

@@ -216,7 +216,7 @@ class LoweredSwitchSimplifier(StructuringOptimizationPass):
     def _analyze(self, cache=None):
         variablehash_to_cases = self._find_cascading_switch_variable_comparisons()
 
-        if not variablehash_to_cases:
+        if not variablehash_to_cases or all(not caselists for caselists in variablehash_to_cases.values()):
             return False
 
         graph_copy = networkx.DiGraph(self._graph)

angr/analyses/decompiler/optimization_passes/optimization_pass.py

@@ -21,6 +21,7 @@ from angr.project import Project
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.functions import Function
+    from angr.analyses.decompiler.stack_item import StackItem
 
 
 _l = logging.getLogger(__name__)
@@ -160,6 +161,7 @@ class OptimizationPass(BaseOptimizationPass):
 
         # output
         self.out_graph: networkx.DiGraph | None = None
+        self.stack_items: dict[int, StackItem] = {}
 
     @property
     def blocks_by_addr(self) -> dict[int, set[ailment.Block]]: