angr 9.2.142__py3-none-manylinux2014_x86_64.whl → 9.2.144__py3-none-manylinux2014_x86_64.whl

angr/analyses/decompiler/peephole_optimizations/a_sub_a_shr_const_shr_const.py

@@ -0,0 +1,37 @@
+# pylint:disable=no-self-use,too-many-boolean-expressions
+from __future__ import annotations
+from ailment.expression import BinaryOp, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ASubAShrConstShrConst(PeepholeOptimizationExprBase):
+    """
+    Convert `cdq; sub eax, edx; sar eax, 1` to `eax /= 2`.
+    """
+
+    __slots__ = ()
+
+    NAME = "(a - (a >> 31)) >> N => a / 2 ** N (signed)"
+    expr_classes = (BinaryOp,)
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if (
+            expr.op == "Sar"
+            and len(expr.operands) == 2
+            and isinstance(expr.operands[1], Const)
+            and expr.operands[1].is_int
+            and isinstance(expr.operands[0], BinaryOp)
+            and expr.operands[0].op == "Sub"
+        ):
+            a0, a1 = expr.operands[0].operands
+            if (
+                isinstance(a1, BinaryOp)
+                and a1.op == "Sar"
+                and isinstance(a1.operands[1], Const)
+                and a1.operands[1].value == 31
+                and a0.likes(a1.operands[0])
+            ):
+                dividend = 2 ** expr.operands[1].value
+                return BinaryOp(a0.idx, "Div", [a0, Const(None, None, dividend, expr.bits)], True, **expr.tags)
+        return None

angr/analyses/decompiler/peephole_optimizations/simplify_pc_relative_loads.py

@@ -1,3 +1,4 @@
+# pylint:disable=too-many-boolean-expressions
 from __future__ import annotations
 from ailment.expression import BinaryOp, Const, Load
 
@@ -20,10 +21,23 @@ class SimplifyPcRelativeLoads(PeepholeOptimizationExprBase):
         if expr.op == "Add" and len(expr.operands) == 2 and isinstance(expr.operands[0], Load):
             op0, op1 = expr.operands
 
+            assert self.project is not None
+            if not hasattr(expr, "ins_addr"):
+                return expr
+            assert expr.ins_addr is not None
+
             # check if op1 is PC
-            if isinstance(op1, Const) and hasattr(expr, "ins_addr") and is_pc(self.project, expr.ins_addr, op1.value):
+            if (
+                isinstance(op1, Const)
+                and op1.is_int
+                and hasattr(expr, "ins_addr")
+                and is_pc(self.project, expr.ins_addr, op1.value)  # type: ignore
+                and isinstance(op0.addr, Const)
+                and op0.addr.is_int
+            ):
                 # check if op0.addr points to a read-only section
                 addr = op0.addr.value
+                assert isinstance(addr, int)
                 if is_in_readonly_section(self.project, addr) or is_in_readonly_segment(self.project, addr):
                     # found it!
                     # do the load first

angr/analyses/decompiler/sequence_walker.py

@@ -186,6 +186,14 @@ class SequenceWalker:
         new_condition = (
             self._handle(node.condition, parent=node, label="condition") if node.condition is not None else None
         )
+
+        # note that initializer and iterator are both statements, so they can return empty tuples
+        # TODO: Handle the case where multiple statements are returned
+        if new_initializer == ():
+            new_initializer = None
+        if new_iterator == ():
+            new_iterator = None
+
         seq_node = self._handle(node.sequence_node, parent=node, label="body", index=0)
         if seq_node is not None or new_initializer is not None or new_iterator is not None or new_condition is not None:
             return LoopNode(

angr/analyses/decompiler/ssailification/rewriting_engine.py

@@ -698,6 +698,8 @@ class SimEngineSSARewriting(
             raise NotImplementedError("Store expressions are not supported in _replace_use_expr.")
         if isinstance(thing, Tmp) and self.rewrite_tmps:
             return self._replace_use_tmp(self.block.addr, self.block.idx, self.stmt_idx, thing)
+        if isinstance(thing, Load):
+            return self._replace_use_load(thing)
         return None
 
     def _replace_use_reg(self, reg_expr: Register) -> VirtualVariable | Expression:

angr/analyses/decompiler/ssailification/ssailification.py

@@ -5,7 +5,15 @@ from collections import defaultdict
 from itertools import count
 from bisect import bisect_left
 
-from ailment.expression import Expression, Register, StackBaseOffset, Tmp, VirtualVariable, VirtualVariableCategory
+from ailment.expression import (
+    Expression,
+    Register,
+    StackBaseOffset,
+    Tmp,
+    VirtualVariable,
+    VirtualVariableCategory,
+    Load,
+)
 from ailment.statement import Statement, Store
 
 from angr.knowledge_plugins.functions import Function
@@ -151,7 +159,7 @@ class Ssailification(Analysis):  # pylint:disable=abstract-method
                     reg_bits = def_.size * self.project.arch.byte_width
                     udef_to_defs[("reg", def_.reg_offset, reg_bits)].add(def_)
                     udef_to_blockkeys[("reg", def_.reg_offset, reg_bits)].add((loc.block_addr, loc.block_idx))
-            elif isinstance(def_, Store):
+            elif isinstance(def_, (Store, Load)):
                 if isinstance(def_.addr, StackBaseOffset) and isinstance(def_.addr.offset, int):
                     idx_begin = bisect_left(sorted_stackvar_offs, def_.addr.offset)
                     for i in range(idx_begin, len(sorted_stackvar_offs)):

angr/analyses/decompiler/ssailification/traversal_engine.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 from collections import OrderedDict
 
 from ailment.statement import Call, Store, ConditionalJump
-from ailment.expression import Register, BinaryOp, StackBaseOffset, ITE, VEXCCallExpression, Tmp, DirtyExpression
+from ailment.expression import Register, BinaryOp, StackBaseOffset, ITE, VEXCCallExpression, Tmp, DirtyExpression, Load
 
 from angr.engines.light import SimEngineLightAIL
 from angr.project import Project
@@ -133,6 +133,22 @@ class SimEngineSSATraversal(SimEngineLightAIL[TraversalState, None, None, None])
 
             self.state.live_registers.add(base_offset)
 
+    def _handle_expr_Load(self, expr: Load):
+        self._expr(expr.addr)
+        if (
+            self.stackvars
+            and isinstance(expr.addr, StackBaseOffset)
+            and isinstance(expr.addr.offset, int)
+            and (expr.addr.offset, expr.size) not in self.state.live_stackvars
+        ):
+            # we must create this stack variable on the fly; we did not see its creation before it is first used
+            codeloc = self._codeloc()
+            self.def_to_loc.append((expr, codeloc))
+            if codeloc not in self.loc_to_defs:
+                self.loc_to_defs[codeloc] = OrderedSet()
+            self.loc_to_defs[codeloc].add(expr)
+            self.state.live_stackvars.add((expr.addr.offset, expr.size))
+
     def _handle_expr_Tmp(self, expr: Tmp):
         if self.use_tmps:
             codeloc = self._codeloc()
@@ -251,7 +267,6 @@ class SimEngineSSATraversal(SimEngineLightAIL[TraversalState, None, None, None])
 
     _handle_expr_VirtualVariable = _handle_Dummy
     _handle_expr_Phi = _handle_Dummy
-    _handle_expr_Load = _handle_Dummy
     _handle_expr_Const = _handle_Dummy
     _handle_expr_MultiStatementExpression = _handle_Dummy
     _handle_expr_StackBaseOffset = _handle_Dummy

angr/analyses/decompiler/structured_codegen/c.py

@@ -3426,8 +3426,13 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
             return old_ty
 
         if expr.variable is not None:
-            cvar = self._variable(expr.variable, expr.size)
-            offset = expr.variable_offset or 0
+            if "struct_member_info" in expr.tags:
+                offset, var, _ = expr.struct_member_info
+                cvar = self._variable(var, var.size)
+            else:
+                cvar = self._variable(expr.variable, expr.size)
+                offset = expr.variable_offset or 0
+
             assert type(offset) is int  # I refuse to deal with the alternative
             return self._access_constant_offset(CUnaryOp("Reference", cvar, codegen=self), offset, ty, False, negotiate)
 
@@ -3649,8 +3654,24 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
         return CMultiStatementExpression(cstmts, cexpr, tags=expr.tags, codegen=self)
 
     def _handle_VirtualVariable(self, expr: Expr.VirtualVariable, **kwargs):
-        if expr.variable:
-            cvar = self._variable(expr.variable, None, vvar_id=expr.varid)
+        def negotiate(old_ty: SimType, proposed_ty: SimType) -> SimType:
+            # we do not allow returning a struct for a primitive type
+            if old_ty.size == proposed_ty.size and (
+                not isinstance(proposed_ty, SimStruct) or isinstance(old_ty, SimStruct)
+            ):
+                return proposed_ty
+            return old_ty
+
+        if expr.variable is not None:
+            if "struct_member_info" in expr.tags:
+                offset, var, _ = expr.struct_member_info
+                cbasevar = self._variable(var, expr.size)
+                cvar = self._access_constant_offset(
+                    self._get_variable_reference(cbasevar), offset, cbasevar.type, False, negotiate
+                )
+            else:
+                cvar = self._variable(expr.variable, None, vvar_id=expr.varid)
+
             if expr.variable.size != expr.size:
                 l.warning(
                     "VirtualVariable size (%d) and variable size (%d) do not match. Force a type cast.",

angr/analyses/decompiler/utils.py

@@ -214,6 +214,19 @@ def switch_extract_switch_expr_from_jump_target(target: ailment.Expr.Expression)
                     target = target.operands[0]
                 else:
                     return None
+            elif target.op == "And":
+                # it must be and-ing the target expr with a constant
+                if (
+                    isinstance(target.operands[1], ailment.Expr.VirtualVariable)
+                    and isinstance(target.operands[0], ailment.Expr.Const)
+                ) or (
+                    isinstance(target.operands[0], ailment.Expr.VirtualVariable)
+                    and isinstance(target.operands[1], ailment.Expr.Const)
+                ):
+                    break
+                return None
+            else:
+                return None
         elif isinstance(target, ailment.Expr.Load):
             # we want the address!
             found_load = True

angr/analyses/disassembly.py

@@ -4,7 +4,7 @@ import contextlib
 import logging
 from collections import defaultdict
 from collections.abc import Sequence
-from typing import Union, Any
+from typing import Any
 
 import pyvex
 import archinfo
@@ -24,8 +24,8 @@ try:
     from angr.engines import pcode
     import pypcode
 
-    IRSBType = Union[pyvex.IRSB, pcode.lifter.IRSB]
-    IROpObjType = Union[pyvex.stmt.IRStmt, pypcode.PcodeOp]
+    IRSBType = pyvex.IRSB | pcode.lifter.IRSB
+    IROpObjType = pyvex.stmt.IRStmt | pypcode.PcodeOp
 except ImportError:
     pcode = None
     IRSBType = pyvex.IRSB

angr/analyses/fcp/fcp.py

@@ -407,10 +407,7 @@ class FastConstantPropagation(Analysis):
             except (TypeError, ValueError):
                 arg_locs = None
 
-            if None in arg_locs:
-                arg_locs = None
-
-            if arg_locs is not None:
+            if arg_locs is not None and None not in arg_locs:
                 for arg_loc in arg_locs:
                     for loc in arg_loc.get_footprint():
                         if isinstance(loc, SimStackArg):

angr/analyses/s_propagator.py

@@ -26,6 +26,7 @@ from angr.utils.ssa import (
     get_vvar_deflocs,
     has_ite_expr,
     has_ite_stmt,
+    has_tmp_expr,
     is_phi_assignment,
     is_const_assignment,
     is_const_and_vvar_assignment,
@@ -126,7 +127,7 @@ class SPropagatorAnalysis(Analysis):
         # update vvar_deflocs using function arguments
         if self.func_args:
             for func_arg in self.func_args:
-                vvar_deflocs[func_arg] = ExternalCodeLocation()
+                vvar_deflocs[func_arg.varid] = func_arg, ExternalCodeLocation()
 
         # find all ret sites and indirect jump sites
         retsites: set[tuple[int, int | None, int]] = set()
@@ -143,11 +144,11 @@ class SPropagatorAnalysis(Analysis):
         # find constant and other propagatable assignments
         vvarid_to_vvar = {}
         const_vvars: dict[int, Const] = {}
-        for vvar, defloc in vvar_deflocs.items():
+        for vvar_id, (vvar, defloc) in vvar_deflocs.items():
             if not vvar.was_reg and not vvar.was_parameter:
                 continue
 
-            vvarid_to_vvar[vvar.varid] = vvar
+            vvarid_to_vvar[vvar_id] = vvar
             if isinstance(defloc, ExternalCodeLocation):
                 continue
 
@@ -160,8 +161,8 @@ class SPropagatorAnalysis(Analysis):
             if r:
                 # replace wherever it's used
                 assert v is not None
-                const_vvars[vvar.varid] = v
-                for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                const_vvars[vvar_id] = v
+                for vvar_at_use, useloc in vvar_uselocs[vvar_id]:
                     replacements[useloc][vvar_at_use] = v
                 continue
 
@@ -189,10 +190,10 @@ class SPropagatorAnalysis(Analysis):
         if self.mode == "function":
             assert self.func_graph is not None
 
-            for vvar, defloc in vvar_deflocs.items():
-                if vvar.varid not in vvar_uselocs:
+            for vvar_id, (vvar, defloc) in vvar_deflocs.items():
+                if vvar_id not in vvar_uselocs:
                     continue
-                if vvar.varid in const_vvars:
+                if vvar_id in const_vvars:
                     continue
                 if isinstance(defloc, ExternalCodeLocation):
                     continue
@@ -200,11 +201,13 @@ class SPropagatorAnalysis(Analysis):
                 assert defloc.block_addr is not None
                 assert defloc.stmt_idx is not None
 
+                vvar_uselocs_set = set(vvar_uselocs[vvar_id])  # deduplicate
+
                 block = blocks[(defloc.block_addr, defloc.block_idx)]
                 stmt = block.statements[defloc.stmt_idx]
                 if (
                     (vvar.was_reg or vvar.was_parameter)
-                    and len(vvar_uselocs[vvar.varid]) <= 2
+                    and len(vvar_uselocs_set) <= 2
                     and isinstance(stmt, Assignment)
                     and isinstance(stmt.src, Load)
                 ):
@@ -215,43 +218,46 @@ class SPropagatorAnalysis(Analysis):
                     #       v1 = v0 + 1;
                     #    }
                     can_replace = True
-                    for _, vvar_useloc in vvar_uselocs[vvar.varid]:
+                    for _, vvar_useloc in vvar_uselocs_set:
                         if has_store_stmt_in_between_stmts(self.func_graph, blocks, defloc, vvar_useloc):
                             can_replace = False
 
                     if can_replace:
                         # we can propagate this load because there is no store between its def and use
-                        for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                        for vvar_used, vvar_useloc in vvar_uselocs_set:
                             replacements[vvar_useloc][vvar_used] = stmt.src
                         continue
 
                 if (
                     (vvar.was_reg or vvar.was_stack)
-                    and len(vvar_uselocs[vvar.varid]) == 2
+                    and len(vvar_uselocs_set) == 2
+                    and isinstance(stmt, Assignment)
                     and not is_phi_assignment(stmt)
                 ):
                     # a special case: in a typical switch-case construct, a variable may be used once for comparison
                     # for the default case and then used again for constructing the jump target. we can propagate this
                     # variable for such cases.
-                    uselocs = {loc for _, loc in vvar_uselocs[vvar.varid]}
-                    if self.is_vvar_used_for_addr_loading_switch_case(uselocs, blocks):
-                        for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                    uselocs = {loc for _, loc in vvar_uselocs_set}
+                    if self.is_vvar_used_for_addr_loading_switch_case(uselocs, blocks) and not has_tmp_expr(stmt.src):
+                        for vvar_used, vvar_useloc in vvar_uselocs_set:
                             replacements[vvar_useloc][vvar_used] = stmt.src
                         # mark the vvar as dead and should be removed
                         self.model.dead_vvar_ids.add(vvar.varid)
                         continue
 
                 if vvar.was_reg or vvar.was_parameter:
-                    if len(vvar_uselocs[vvar.varid]) == 1:
-                        vvar_used, vvar_useloc = next(iter(vvar_uselocs[vvar.varid]))
-                        if is_const_vvar_load_assignment(stmt) and not has_store_stmt_in_between_stmts(
-                            self.func_graph, blocks, defloc, vvar_useloc
+                    if len(vvar_uselocs_set) == 1:
+                        vvar_used, vvar_useloc = next(iter(vvar_uselocs_set))
+                        if (
+                            is_const_vvar_load_assignment(stmt)
+                            and not has_store_stmt_in_between_stmts(self.func_graph, blocks, defloc, vvar_useloc)
+                            and not has_tmp_expr(stmt.src)
                         ):
                             # we can propagate this load because there is no store between its def and use
                             replacements[vvar_useloc][vvar_used] = stmt.src
                             continue
 
-                        if is_const_and_vvar_assignment(stmt):
+                        if is_const_and_vvar_assignment(stmt) and not has_tmp_expr(stmt.src):
                             # if the useloc is a phi assignment statement, ensure that stmt.src is the same as the phi
                             # variable
                             assert vvar_useloc.block_addr is not None
@@ -273,18 +279,22 @@ class SPropagatorAnalysis(Analysis):
                     else:
                         non_exitsite_uselocs = [
                             loc
-                            for _, loc in vvar_uselocs[vvar.varid]
+                            for _, loc in vvar_uselocs_set
                             if (loc.block_addr, loc.block_idx, loc.stmt_idx) not in (retsites | jumpsites)
                         ]
                         if is_const_and_vvar_assignment(stmt):
                             if len(non_exitsite_uselocs) == 1:
                                 # this vvar is used once if we exclude its uses at ret sites or jump sites. we can
                                 # propagate it
-                                for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                                for vvar_used, vvar_useloc in vvar_uselocs_set:
                                     replacements[vvar_useloc][vvar_used] = stmt.src
                                 continue
 
-                            if len(set(non_exitsite_uselocs)) == 1 and not has_ite_expr(stmt.src):
+                            if (
+                                len(set(non_exitsite_uselocs)) == 1
+                                and not has_ite_expr(stmt.src)
+                                and not has_tmp_expr(stmt.src)
+                            ):
                                 useloc = non_exitsite_uselocs[0]
                                 assert useloc.block_addr is not None
                                 assert useloc.stmt_idx is not None
@@ -292,13 +302,13 @@ class SPropagatorAnalysis(Analysis):
                                 if stmt.src.depth <= 3 and not has_ite_stmt(useloc_stmt):
                                     # remove duplicate use locs (e.g., if the variable is used multiple times by the
                                     # same statement) - but ensure stmt is simple enough
-                                    for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                                    for vvar_used, vvar_useloc in vvar_uselocs_set:
                                         replacements[vvar_useloc][vvar_used] = stmt.src
                                     continue
 
                 # special logic for global variables: if it's used once or multiple times, and the variable is never
                 # updated before it's used, we will propagate the load
-                if (vvar.was_reg or vvar.was_parameter) and isinstance(stmt, Assignment):
+                if (vvar.was_reg or vvar.was_parameter) and isinstance(stmt, Assignment) and not has_tmp_expr(stmt.src):
                     stmt_src = stmt.src
                     # unpack conversions
                     while isinstance(stmt_src, Convert):
@@ -309,7 +319,7 @@ class SPropagatorAnalysis(Analysis):
                         and isinstance(stmt_src.addr.value, int)
                     ):
                         gv_updated = False
-                        for _vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                        for _vvar_used, vvar_useloc in vvar_uselocs_set:
                             gv_updated |= self.is_global_variable_updated(
                                 self.func_graph,
                                 blocks,
@@ -320,12 +330,13 @@ class SPropagatorAnalysis(Analysis):
                                 vvar_useloc,
                             )
                         if not gv_updated:
-                            for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                            for vvar_used, vvar_useloc in vvar_uselocs_set:
                                 replacements[vvar_useloc][vvar_used] = stmt.src
                             continue
 
         for vvar_id, uselocs in vvar_uselocs.items():
             vvar = next(iter(uselocs))[0] if vvar_id not in vvarid_to_vvar else vvarid_to_vvar[vvar_id]
+            vvar_uselocs_set = set(uselocs)  # deduplicate
 
             if self._sp_tracker is not None and vvar.category == VirtualVariableCategory.REGISTER:
                 if vvar.oident == self.project.arch.sp_offset:
@@ -334,7 +345,7 @@ class SPropagatorAnalysis(Analysis):
                         if "sp" in self.project.arch.registers
                         else None
                     )
-                    for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                    for vvar_at_use, useloc in vvar_uselocs_set:
                         sb_offset = self._sp_tracker.offset_before(useloc.ins_addr, self.project.arch.sp_offset)
                         if sb_offset is not None:
                             v = StackBaseOffset(None, self.project.arch.bits, sb_offset)
@@ -349,7 +360,7 @@ class SPropagatorAnalysis(Analysis):
                         if "bp" in self.project.arch.registers
                         else None
                     )
-                    for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                    for vvar_at_use, useloc in vvar_uselocs_set:
                         sb_offset = self._sp_tracker.offset_before(useloc.ins_addr, self.project.arch.bp_offset)
                         if sb_offset is not None:
                             v = StackBaseOffset(None, self.project.arch.bits, sb_offset)

angr/analyses/s_reaching_definitions/s_rda_model.py

@@ -20,26 +20,35 @@ class SRDAModel:
         self.func_args = func_args
         self.arch = arch
         self.varid_to_vvar: dict[int, VirtualVariable] = {}
-        self.all_vvar_definitions: dict[VirtualVariable, CodeLocation] = {}
-        self.all_vvar_uses: dict[VirtualVariable, set[tuple[VirtualVariable | None, CodeLocation]]] = defaultdict(set)
+        self.all_vvar_definitions: dict[int, CodeLocation] = {}
+        self.all_vvar_uses: dict[int, list[tuple[VirtualVariable | None, CodeLocation]]] = defaultdict(list)
         self.all_tmp_definitions: dict[CodeLocation, dict[atoms.Tmp, int]] = defaultdict(dict)
         self.all_tmp_uses: dict[CodeLocation, dict[atoms.Tmp, set[tuple[Tmp, int]]]] = defaultdict(dict)
         self.phi_vvar_ids: set[int] = set()
         self.phivarid_to_varids: dict[int, set[int]] = {}
+        self.vvar_uses_by_loc: dict[CodeLocation, list[int]] = {}
+
+    def add_vvar_use(self, vvar_id: int, expr: VirtualVariable | None, loc: CodeLocation) -> None:
+        self.all_vvar_uses[vvar_id].append((expr, loc))
+        if loc not in self.vvar_uses_by_loc:
+            self.vvar_uses_by_loc[loc] = []
+        self.vvar_uses_by_loc[loc].append(vvar_id)
 
     @property
     def all_definitions(self) -> Generator[Definition]:
-        for vvar, defloc in self.all_vvar_definitions.items():
-            yield Definition(atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident), defloc)
+        for vvar_id, defloc in self.all_vvar_definitions.items():
+            vvar = self.varid_to_vvar[vvar_id]
+            yield Definition(atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident), defloc)
 
     def is_phi_vvar_id(self, idx: int) -> bool:
         return idx in self.phi_vvar_ids
 
     def get_all_definitions(self, block_loc: CodeLocation) -> set[Definition]:
         s = set()
-        for vvar, codeloc in self.all_vvar_definitions.items():
+        for vvar_id, codeloc in self.all_vvar_definitions.items():
+            vvar = self.varid_to_vvar[vvar_id]
             if codeloc.block_addr == block_loc.block_addr and codeloc.block_idx == block_loc.block_idx:
-                s.add(Definition(atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident), codeloc))
+                s.add(Definition(atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident), codeloc))
         return s | self.get_all_tmp_definitions(block_loc)
 
     def get_all_tmp_definitions(self, block_loc: CodeLocation) -> set[Definition]:
@@ -64,45 +73,45 @@ class SRDAModel:
         :return:        A set of definitions that are used at the given location.
         """
         if exprs:
-            defs: set[tuple[Definition, Any]] = set()
-            for vvar, uses in self.all_vvar_uses.items():
-                for expr, loc_ in uses:
-                    if loc_ == loc:
-                        defs.add(
-                            (
-                                Definition(
-                                    atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident),
-                                    self.all_vvar_definitions[vvar],
-                                ),
-                                expr,
-                            )
-                        )
-            return defs
-
-        defs: set[Definition] = set()
-        for vvar, uses in self.all_vvar_uses.items():
-            for _, loc_ in uses:
-                if loc_ == loc:
-                    defs.add(
+            def_with_exprs: set[tuple[Definition, Any]] = set()
+            if loc not in self.vvar_uses_by_loc:
+                return def_with_exprs
+            for vvar_id in self.vvar_uses_by_loc[loc]:
+                vvar = self.varid_to_vvar[vvar_id]
+                def_with_exprs.add(
+                    (
                         Definition(
-                            atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident),
-                            self.all_vvar_definitions[vvar],
-                        )
+                            atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident),
+                            self.all_vvar_definitions[vvar_id],
+                        ),
+                        vvar,
                     )
+                )
+            return def_with_exprs
+
+        defs: set[Definition] = set()
+        if loc not in self.vvar_uses_by_loc:
+            return defs
+        for vvar_id in self.vvar_uses_by_loc[loc]:
+            vvar = self.varid_to_vvar[vvar_id]
+            defs.add(
+                Definition(
+                    atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident),
+                    self.all_vvar_definitions[vvar_id],
+                )
+            )
         return defs
 
     def get_vvar_uses(self, obj: VirtualVariable | atoms.VirtualVariable) -> set[CodeLocation]:
-        the_vvar = self.varid_to_vvar.get(obj.varid, None)
-        if the_vvar is not None:
-            return {loc for _, loc in self.all_vvar_uses[the_vvar]}
+        if obj.varid in self.all_vvar_uses:
+            return {loc for _, loc in self.all_vvar_uses[obj.varid]}
         return set()
 
     def get_vvar_uses_with_expr(
         self, obj: VirtualVariable | atoms.VirtualVariable
-    ) -> set[tuple[CodeLocation, VirtualVariable]]:
-        the_vvar = self.varid_to_vvar.get(obj.varid, None)
-        if the_vvar is not None:
-            return {(loc, expr) for expr, loc in self.all_vvar_uses[the_vvar]}
+    ) -> set[tuple[VirtualVariable | None, CodeLocation]]:
+        if obj.varid in self.all_vvar_uses:
+            return set(self.all_vvar_uses[obj.varid])
         return set()
 
     def get_tmp_uses(self, obj: atoms.Tmp, block_loc: CodeLocation) -> set[CodeLocation]:

angr/analyses/s_reaching_definitions/s_rda_view.py

@@ -185,7 +185,10 @@ class SRDAView:
                             vvars.append(func_arg)
         # there might be multiple vvars; we prioritize the one whose size fits the best
         for v in vvars:
-            if v.stack_offset == stack_offset and v.size == size:
+            if (
+                (v.was_stack and v.stack_offset == stack_offset)
+                or (v.was_parameter and v.parameter_stack_offset == stack_offset)
+            ) and v.size == size:
                 return v
         return vvars[0] if vvars else None
 
@@ -239,9 +242,9 @@ class SRDAView:
         return vvars[0] if vvars else None
 
     def get_vvar_value(self, vvar: VirtualVariable) -> Expression | None:
-        if vvar not in self.model.all_vvar_definitions:
+        if vvar.varid not in self.model.all_vvar_definitions:
             return None
-        codeloc = self.model.all_vvar_definitions[vvar]
+        codeloc = self.model.all_vvar_definitions[vvar.varid]
 
         for block in self.model.func_graph:
             if block.addr == codeloc.block_addr and block.idx == codeloc.block_idx: