angr 9.2.142__py3-none-win_amd64.whl → 9.2.143__py3-none-win_amd64.whl

angr/analyses/decompiler/optimization_passes/condition_constprop.py

@@ -1,10 +1,11 @@
 from __future__ import annotations
 from typing import TYPE_CHECKING
+from collections import defaultdict
 
 import networkx
 
 from ailment import AILBlockWalker, Block
-from ailment.statement import ConditionalJump, Statement
+from ailment.statement import ConditionalJump, Statement, Assignment
 from ailment.expression import Const, BinaryOp, VirtualVariable
 
 from angr.analyses.decompiler.utils import first_nonlabel_nonphi_statement
@@ -41,6 +42,7 @@ class CCondPropBlockWalker(AILBlockWalker):
         self._new_block: Block | None = None  # output
         self.vvar_id = vvar_id
         self.const_value = const_value
+        self.abort = False
 
     def walk(self, block: Block):
         self._new_block = None
@@ -48,6 +50,17 @@ class CCondPropBlockWalker(AILBlockWalker):
         return self._new_block
 
     def _handle_stmt(self, stmt_idx: int, stmt: Statement, block: Block):  # type: ignore
+        if self.abort:
+            return
+
+        if isinstance(stmt, Assignment) and isinstance(stmt.dst, VirtualVariable) and stmt.dst.varid == self.vvar_id:
+            # we see the assignment of this virtual variable; this is the original block that creates this variable
+            # and checks if this variable is equal to a constant value. as such, we stop processing this block.
+            # an example appears in binary 1de5cda760f9ed80bb6f4a35edcebc86ccec14c49cf4775ddf2ffc3e05ff35f4, function
+            # 0x4657C0, blocks 0x465bd6 and 0x465a5c
+            self.abort = True
+            return
+
         r = super()._handle_stmt(stmt_idx, stmt, block)
         if r is not None:
             # replace the original statement
@@ -58,7 +71,9 @@ class CCondPropBlockWalker(AILBlockWalker):
     def _handle_VirtualVariable(  # type: ignore
         self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt: Statement, block: Block | None
     ) -> Const | None:
-        if expr.varid == self.vvar_id:
+        if expr.varid == self.vvar_id and not (
+            isinstance(stmt, Assignment) and isinstance(stmt.dst, VirtualVariable) and stmt.dst.varid == self.vvar_id
+        ):
             return Const(expr.idx, None, self.const_value.value, self.const_value.bits, **expr.tags)
         return None
 
@@ -80,19 +95,9 @@ class ConditionConstantPropagation(OptimizationPass):
 
     def _check(self):
         cconds = self._find_const_conditions()
-        if not cconds:
-            return False, None
-        return True, {"cconds": cconds}
-
-    @timethis
-    def _analyze(self, cache=None):
-        if not cache or cache.get("cconds", None) is None:  # noqa: SIM108
-            cconds = self._find_const_conditions()
-        else:
-            cconds = cache["cconds"]
 
         if not cconds:
-            return
+            return False, None
 
         # group cconds according to their sources
         cconds_by_src: dict[tuple[int, int | None], list[ConstantCondition]] = {}
@@ -102,6 +107,36 @@ class ConditionConstantPropagation(OptimizationPass):
                 cconds_by_src[src] = []
             cconds_by_src[src].append(ccond)
 
+        # eliminate conflicting conditions
+        for src in list(cconds_by_src):
+            cconds = cconds_by_src[src]
+            vvar_id_to_values = defaultdict(set)
+            ccond_dict = {}  # keyed by vvar_id; used for deduplication
+            for ccond in cconds:
+                vvar_id_to_values[ccond.vvar_id].add(ccond.value)
+                ccond_dict[ccond.vvar_id] = ccond
+            new_cconds = []
+            for vid, vvalues in vvar_id_to_values.items():
+                if len(vvalues) == 1:
+                    new_cconds.append(ccond_dict[vid])
+            if new_cconds:
+                cconds_by_src[src] = new_cconds
+            else:
+                del cconds_by_src[src]
+
+        if not cconds_by_src:
+            return False, None
+        return True, {"cconds_by_src": cconds_by_src}
+
+    @timethis
+    def _analyze(self, cache=None):
+        if not cache or cache.get("cconds_by_src", None) is None:
+            return
+        cconds_by_src = cache["cconds_by_src"]
+
+        if not cconds_by_src:
+            return
+
         # calculate a dominance frontier for each block
         entry_node_addr, entry_node_idx = self.entry_node_addr
         entry_node = self._get_block(entry_node_addr, idx=entry_node_idx)
@@ -114,7 +149,7 @@ class ConditionConstantPropagation(OptimizationPass):
                 continue
 
             for ccond in cconds:
-                for _, loc in rda.all_vvar_uses[rda.varid_to_vvar[ccond.vvar_id]]:
+                for _, loc in rda.all_vvar_uses[ccond.vvar_id]:
                     loc_block = self._get_block(loc.block_addr, idx=loc.block_idx)
                     if loc_block is None:
                         continue

angr/analyses/decompiler/optimization_passes/ite_region_converter.py

@@ -192,6 +192,14 @@ class ITERegionConverter(OptimizationPass):
         if region_head not in self._graph or region_tail not in self._graph:
             return False
 
+        # ensure all phi statements in region_tail have valid source vvars
+        for stmt in region_tail.statements:
+            if not is_phi_assignment(stmt):
+                continue
+            for _, vvar in stmt.src.src_and_vvars:
+                if vvar is None:
+                    return False
+
         #
         # create a new region_head
         #

angr/analyses/decompiler/peephole_optimizations/simplify_pc_relative_loads.py

@@ -1,3 +1,4 @@
+# pylint:disable=too-many-boolean-expressions
 from __future__ import annotations
 from ailment.expression import BinaryOp, Const, Load
 
@@ -20,10 +21,23 @@ class SimplifyPcRelativeLoads(PeepholeOptimizationExprBase):
         if expr.op == "Add" and len(expr.operands) == 2 and isinstance(expr.operands[0], Load):
             op0, op1 = expr.operands
 
+            assert self.project is not None
+            if not hasattr(expr, "ins_addr"):
+                return expr
+            assert expr.ins_addr is not None
+
             # check if op1 is PC
-            if isinstance(op1, Const) and hasattr(expr, "ins_addr") and is_pc(self.project, expr.ins_addr, op1.value):
+            if (
+                isinstance(op1, Const)
+                and op1.is_int
+                and hasattr(expr, "ins_addr")
+                and is_pc(self.project, expr.ins_addr, op1.value)  # type: ignore
+                and isinstance(op0.addr, Const)
+                and op0.addr.is_int
+            ):
                 # check if op0.addr points to a read-only section
                 addr = op0.addr.value
+                assert isinstance(addr, int)
                 if is_in_readonly_section(self.project, addr) or is_in_readonly_segment(self.project, addr):
                     # found it!
                     # do the load first

angr/analyses/decompiler/sequence_walker.py

@@ -186,6 +186,14 @@ class SequenceWalker:
         new_condition = (
             self._handle(node.condition, parent=node, label="condition") if node.condition is not None else None
         )
+
+        # note that initializer and iterator are both statements, so they can return empty tuples
+        # TODO: Handle the case where multiple statements are returned
+        if new_initializer == ():
+            new_initializer = None
+        if new_iterator == ():
+            new_iterator = None
+
         seq_node = self._handle(node.sequence_node, parent=node, label="body", index=0)
         if seq_node is not None or new_initializer is not None or new_iterator is not None or new_condition is not None:
             return LoopNode(

angr/analyses/decompiler/utils.py

@@ -214,6 +214,19 @@ def switch_extract_switch_expr_from_jump_target(target: ailment.Expr.Expression)
                     target = target.operands[0]
                 else:
                     return None
+            elif target.op == "And":
+                # it must be and-ing the target expr with a constant
+                if (
+                    isinstance(target.operands[1], ailment.Expr.VirtualVariable)
+                    and isinstance(target.operands[0], ailment.Expr.Const)
+                ) or (
+                    isinstance(target.operands[0], ailment.Expr.VirtualVariable)
+                    and isinstance(target.operands[1], ailment.Expr.Const)
+                ):
+                    break
+                return None
+            else:
+                return None
         elif isinstance(target, ailment.Expr.Load):
             # we want the address!
             found_load = True

angr/analyses/s_propagator.py

@@ -26,6 +26,7 @@ from angr.utils.ssa import (
     get_vvar_deflocs,
     has_ite_expr,
     has_ite_stmt,
+    has_tmp_expr,
     is_phi_assignment,
     is_const_assignment,
     is_const_and_vvar_assignment,
@@ -126,7 +127,7 @@ class SPropagatorAnalysis(Analysis):
         # update vvar_deflocs using function arguments
         if self.func_args:
             for func_arg in self.func_args:
-                vvar_deflocs[func_arg] = ExternalCodeLocation()
+                vvar_deflocs[func_arg.varid] = func_arg, ExternalCodeLocation()
 
         # find all ret sites and indirect jump sites
         retsites: set[tuple[int, int | None, int]] = set()
@@ -143,11 +144,11 @@ class SPropagatorAnalysis(Analysis):
         # find constant and other propagatable assignments
         vvarid_to_vvar = {}
         const_vvars: dict[int, Const] = {}
-        for vvar, defloc in vvar_deflocs.items():
+        for vvar_id, (vvar, defloc) in vvar_deflocs.items():
             if not vvar.was_reg and not vvar.was_parameter:
                 continue
 
-            vvarid_to_vvar[vvar.varid] = vvar
+            vvarid_to_vvar[vvar_id] = vvar
             if isinstance(defloc, ExternalCodeLocation):
                 continue
 
@@ -160,8 +161,8 @@ class SPropagatorAnalysis(Analysis):
             if r:
                 # replace wherever it's used
                 assert v is not None
-                const_vvars[vvar.varid] = v
-                for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                const_vvars[vvar_id] = v
+                for vvar_at_use, useloc in vvar_uselocs[vvar_id]:
                     replacements[useloc][vvar_at_use] = v
                 continue
 
@@ -189,10 +190,10 @@ class SPropagatorAnalysis(Analysis):
         if self.mode == "function":
             assert self.func_graph is not None
 
-            for vvar, defloc in vvar_deflocs.items():
-                if vvar.varid not in vvar_uselocs:
+            for vvar_id, (vvar, defloc) in vvar_deflocs.items():
+                if vvar_id not in vvar_uselocs:
                     continue
-                if vvar.varid in const_vvars:
+                if vvar_id in const_vvars:
                     continue
                 if isinstance(defloc, ExternalCodeLocation):
                     continue
@@ -200,11 +201,13 @@ class SPropagatorAnalysis(Analysis):
                 assert defloc.block_addr is not None
                 assert defloc.stmt_idx is not None
 
+                vvar_uselocs_set = set(vvar_uselocs[vvar_id])  # deduplicate
+
                 block = blocks[(defloc.block_addr, defloc.block_idx)]
                 stmt = block.statements[defloc.stmt_idx]
                 if (
                     (vvar.was_reg or vvar.was_parameter)
-                    and len(vvar_uselocs[vvar.varid]) <= 2
+                    and len(vvar_uselocs_set) <= 2
                     and isinstance(stmt, Assignment)
                     and isinstance(stmt.src, Load)
                 ):
@@ -215,43 +218,46 @@ class SPropagatorAnalysis(Analysis):
                     #       v1 = v0 + 1;
                     #    }
                     can_replace = True
-                    for _, vvar_useloc in vvar_uselocs[vvar.varid]:
+                    for _, vvar_useloc in vvar_uselocs_set:
                         if has_store_stmt_in_between_stmts(self.func_graph, blocks, defloc, vvar_useloc):
                             can_replace = False
 
                     if can_replace:
                         # we can propagate this load because there is no store between its def and use
-                        for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                        for vvar_used, vvar_useloc in vvar_uselocs_set:
                             replacements[vvar_useloc][vvar_used] = stmt.src
                         continue
 
                 if (
                     (vvar.was_reg or vvar.was_stack)
-                    and len(vvar_uselocs[vvar.varid]) == 2
+                    and len(vvar_uselocs_set) == 2
+                    and isinstance(stmt, Assignment)
                     and not is_phi_assignment(stmt)
                 ):
                     # a special case: in a typical switch-case construct, a variable may be used once for comparison
                     # for the default case and then used again for constructing the jump target. we can propagate this
                     # variable for such cases.
-                    uselocs = {loc for _, loc in vvar_uselocs[vvar.varid]}
-                    if self.is_vvar_used_for_addr_loading_switch_case(uselocs, blocks):
-                        for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                    uselocs = {loc for _, loc in vvar_uselocs_set}
+                    if self.is_vvar_used_for_addr_loading_switch_case(uselocs, blocks) and not has_tmp_expr(stmt.src):
+                        for vvar_used, vvar_useloc in vvar_uselocs_set:
                             replacements[vvar_useloc][vvar_used] = stmt.src
                         # mark the vvar as dead and should be removed
                         self.model.dead_vvar_ids.add(vvar.varid)
                         continue
 
                 if vvar.was_reg or vvar.was_parameter:
-                    if len(vvar_uselocs[vvar.varid]) == 1:
-                        vvar_used, vvar_useloc = next(iter(vvar_uselocs[vvar.varid]))
-                        if is_const_vvar_load_assignment(stmt) and not has_store_stmt_in_between_stmts(
-                            self.func_graph, blocks, defloc, vvar_useloc
+                    if len(vvar_uselocs_set) == 1:
+                        vvar_used, vvar_useloc = next(iter(vvar_uselocs_set))
+                        if (
+                            is_const_vvar_load_assignment(stmt)
+                            and not has_store_stmt_in_between_stmts(self.func_graph, blocks, defloc, vvar_useloc)
+                            and not has_tmp_expr(stmt.src)
                         ):
                             # we can propagate this load because there is no store between its def and use
                             replacements[vvar_useloc][vvar_used] = stmt.src
                             continue
 
-                        if is_const_and_vvar_assignment(stmt):
+                        if is_const_and_vvar_assignment(stmt) and not has_tmp_expr(stmt.src):
                             # if the useloc is a phi assignment statement, ensure that stmt.src is the same as the phi
                             # variable
                             assert vvar_useloc.block_addr is not None
@@ -273,18 +279,22 @@ class SPropagatorAnalysis(Analysis):
                     else:
                         non_exitsite_uselocs = [
                             loc
-                            for _, loc in vvar_uselocs[vvar.varid]
+                            for _, loc in vvar_uselocs_set
                             if (loc.block_addr, loc.block_idx, loc.stmt_idx) not in (retsites | jumpsites)
                         ]
                         if is_const_and_vvar_assignment(stmt):
                             if len(non_exitsite_uselocs) == 1:
                                 # this vvar is used once if we exclude its uses at ret sites or jump sites. we can
                                 # propagate it
-                                for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                                for vvar_used, vvar_useloc in vvar_uselocs_set:
                                     replacements[vvar_useloc][vvar_used] = stmt.src
                                 continue
 
-                            if len(set(non_exitsite_uselocs)) == 1 and not has_ite_expr(stmt.src):
+                            if (
+                                len(set(non_exitsite_uselocs)) == 1
+                                and not has_ite_expr(stmt.src)
+                                and not has_tmp_expr(stmt.src)
+                            ):
                                 useloc = non_exitsite_uselocs[0]
                                 assert useloc.block_addr is not None
                                 assert useloc.stmt_idx is not None
@@ -292,13 +302,13 @@ class SPropagatorAnalysis(Analysis):
                                 if stmt.src.depth <= 3 and not has_ite_stmt(useloc_stmt):
                                     # remove duplicate use locs (e.g., if the variable is used multiple times by the
                                     # same statement) - but ensure stmt is simple enough
-                                    for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                                    for vvar_used, vvar_useloc in vvar_uselocs_set:
                                         replacements[vvar_useloc][vvar_used] = stmt.src
                                     continue
 
                 # special logic for global variables: if it's used once or multiple times, and the variable is never
                 # updated before it's used, we will propagate the load
-                if (vvar.was_reg or vvar.was_parameter) and isinstance(stmt, Assignment):
+                if (vvar.was_reg or vvar.was_parameter) and isinstance(stmt, Assignment) and not has_tmp_expr(stmt.src):
                     stmt_src = stmt.src
                     # unpack conversions
                     while isinstance(stmt_src, Convert):
@@ -309,7 +319,7 @@ class SPropagatorAnalysis(Analysis):
                         and isinstance(stmt_src.addr.value, int)
                     ):
                         gv_updated = False
-                        for _vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                        for _vvar_used, vvar_useloc in vvar_uselocs_set:
                             gv_updated |= self.is_global_variable_updated(
                                 self.func_graph,
                                 blocks,
@@ -320,12 +330,13 @@ class SPropagatorAnalysis(Analysis):
                                 vvar_useloc,
                             )
                         if not gv_updated:
-                            for vvar_used, vvar_useloc in vvar_uselocs[vvar.varid]:
+                            for vvar_used, vvar_useloc in vvar_uselocs_set:
                                 replacements[vvar_useloc][vvar_used] = stmt.src
                             continue
 
         for vvar_id, uselocs in vvar_uselocs.items():
             vvar = next(iter(uselocs))[0] if vvar_id not in vvarid_to_vvar else vvarid_to_vvar[vvar_id]
+            vvar_uselocs_set = set(uselocs)  # deduplicate
 
             if self._sp_tracker is not None and vvar.category == VirtualVariableCategory.REGISTER:
                 if vvar.oident == self.project.arch.sp_offset:
@@ -334,7 +345,7 @@ class SPropagatorAnalysis(Analysis):
                         if "sp" in self.project.arch.registers
                         else None
                     )
-                    for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                    for vvar_at_use, useloc in vvar_uselocs_set:
                         sb_offset = self._sp_tracker.offset_before(useloc.ins_addr, self.project.arch.sp_offset)
                         if sb_offset is not None:
                             v = StackBaseOffset(None, self.project.arch.bits, sb_offset)
@@ -349,7 +360,7 @@ class SPropagatorAnalysis(Analysis):
                         if "bp" in self.project.arch.registers
                         else None
                     )
-                    for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
+                    for vvar_at_use, useloc in vvar_uselocs_set:
                         sb_offset = self._sp_tracker.offset_before(useloc.ins_addr, self.project.arch.bp_offset)
                         if sb_offset is not None:
                             v = StackBaseOffset(None, self.project.arch.bits, sb_offset)

angr/analyses/s_reaching_definitions/s_rda_model.py

@@ -20,26 +20,35 @@ class SRDAModel:
         self.func_args = func_args
         self.arch = arch
         self.varid_to_vvar: dict[int, VirtualVariable] = {}
-        self.all_vvar_definitions: dict[VirtualVariable, CodeLocation] = {}
-        self.all_vvar_uses: dict[VirtualVariable, set[tuple[VirtualVariable | None, CodeLocation]]] = defaultdict(set)
+        self.all_vvar_definitions: dict[int, CodeLocation] = {}
+        self.all_vvar_uses: dict[int, list[tuple[VirtualVariable | None, CodeLocation]]] = defaultdict(list)
         self.all_tmp_definitions: dict[CodeLocation, dict[atoms.Tmp, int]] = defaultdict(dict)
         self.all_tmp_uses: dict[CodeLocation, dict[atoms.Tmp, set[tuple[Tmp, int]]]] = defaultdict(dict)
         self.phi_vvar_ids: set[int] = set()
         self.phivarid_to_varids: dict[int, set[int]] = {}
+        self.vvar_uses_by_loc: dict[CodeLocation, list[int]] = {}
+
+    def add_vvar_use(self, vvar_id: int, expr: VirtualVariable | None, loc: CodeLocation) -> None:
+        self.all_vvar_uses[vvar_id].append((expr, loc))
+        if loc not in self.vvar_uses_by_loc:
+            self.vvar_uses_by_loc[loc] = []
+        self.vvar_uses_by_loc[loc].append(vvar_id)
 
     @property
     def all_definitions(self) -> Generator[Definition]:
-        for vvar, defloc in self.all_vvar_definitions.items():
-            yield Definition(atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident), defloc)
+        for vvar_id, defloc in self.all_vvar_definitions.items():
+            vvar = self.varid_to_vvar[vvar_id]
+            yield Definition(atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident), defloc)
 
     def is_phi_vvar_id(self, idx: int) -> bool:
         return idx in self.phi_vvar_ids
 
     def get_all_definitions(self, block_loc: CodeLocation) -> set[Definition]:
         s = set()
-        for vvar, codeloc in self.all_vvar_definitions.items():
+        for vvar_id, codeloc in self.all_vvar_definitions.items():
+            vvar = self.varid_to_vvar[vvar_id]
             if codeloc.block_addr == block_loc.block_addr and codeloc.block_idx == block_loc.block_idx:
-                s.add(Definition(atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident), codeloc))
+                s.add(Definition(atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident), codeloc))
         return s | self.get_all_tmp_definitions(block_loc)
 
     def get_all_tmp_definitions(self, block_loc: CodeLocation) -> set[Definition]:
@@ -64,45 +73,45 @@ class SRDAModel:
         :return:        A set of definitions that are used at the given location.
         """
         if exprs:
-            defs: set[tuple[Definition, Any]] = set()
-            for vvar, uses in self.all_vvar_uses.items():
-                for expr, loc_ in uses:
-                    if loc_ == loc:
-                        defs.add(
-                            (
-                                Definition(
-                                    atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident),
-                                    self.all_vvar_definitions[vvar],
-                                ),
-                                expr,
-                            )
-                        )
-            return defs
-
-        defs: set[Definition] = set()
-        for vvar, uses in self.all_vvar_uses.items():
-            for _, loc_ in uses:
-                if loc_ == loc:
-                    defs.add(
+            def_with_exprs: set[tuple[Definition, Any]] = set()
+            if loc not in self.vvar_uses_by_loc:
+                return def_with_exprs
+            for vvar_id in self.vvar_uses_by_loc[loc]:
+                vvar = self.varid_to_vvar[vvar_id]
+                def_with_exprs.add(
+                    (
                         Definition(
-                            atoms.VirtualVariable(vvar.varid, vvar.size, vvar.category, vvar.oident),
-                            self.all_vvar_definitions[vvar],
-                        )
+                            atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident),
+                            self.all_vvar_definitions[vvar_id],
+                        ),
+                        vvar,
                     )
+                )
+            return def_with_exprs
+
+        defs: set[Definition] = set()
+        if loc not in self.vvar_uses_by_loc:
+            return defs
+        for vvar_id in self.vvar_uses_by_loc[loc]:
+            vvar = self.varid_to_vvar[vvar_id]
+            defs.add(
+                Definition(
+                    atoms.VirtualVariable(vvar_id, vvar.size, vvar.category, vvar.oident),
+                    self.all_vvar_definitions[vvar_id],
+                )
+            )
         return defs
 
     def get_vvar_uses(self, obj: VirtualVariable | atoms.VirtualVariable) -> set[CodeLocation]:
-        the_vvar = self.varid_to_vvar.get(obj.varid, None)
-        if the_vvar is not None:
-            return {loc for _, loc in self.all_vvar_uses[the_vvar]}
+        if obj.varid in self.all_vvar_uses:
+            return {loc for _, loc in self.all_vvar_uses[obj.varid]}
         return set()
 
     def get_vvar_uses_with_expr(
         self, obj: VirtualVariable | atoms.VirtualVariable
-    ) -> set[tuple[CodeLocation, VirtualVariable]]:
-        the_vvar = self.varid_to_vvar.get(obj.varid, None)
-        if the_vvar is not None:
-            return {(loc, expr) for expr, loc in self.all_vvar_uses[the_vvar]}
+    ) -> set[tuple[VirtualVariable | None, CodeLocation]]:
+        if obj.varid in self.all_vvar_uses:
+            return set(self.all_vvar_uses[obj.varid])
         return set()
 
     def get_tmp_uses(self, obj: atoms.Tmp, block_loc: CodeLocation) -> set[CodeLocation]:

angr/analyses/s_reaching_definitions/s_rda_view.py

@@ -185,7 +185,10 @@ class SRDAView:
                             vvars.append(func_arg)
         # there might be multiple vvars; we prioritize the one whose size fits the best
         for v in vvars:
-            if v.stack_offset == stack_offset and v.size == size:
+            if (
+                (v.was_stack and v.stack_offset == stack_offset)
+                or (v.was_parameter and v.parameter_stack_offset == stack_offset)
+            ) and v.size == size:
                 return v
         return vvars[0] if vvars else None
 
@@ -239,9 +242,9 @@ class SRDAView:
         return vvars[0] if vvars else None
 
     def get_vvar_value(self, vvar: VirtualVariable) -> Expression | None:
-        if vvar not in self.model.all_vvar_definitions:
+        if vvar.varid not in self.model.all_vvar_definitions:
             return None
-        codeloc = self.model.all_vvar_definitions[vvar]
+        codeloc = self.model.all_vvar_definitions[vvar.varid]
 
         for block in self.model.func_graph:
             if block.addr == codeloc.block_addr and block.idx == codeloc.block_idx:

angr/analyses/s_reaching_definitions/s_reaching_definitions.py

@@ -63,7 +63,7 @@ class SReachingDefinitionsAnalysis(Analysis):
             case _:
                 raise NotImplementedError
 
-        phi_vvars = {}
+        phi_vvars: dict[int, set[int]] = {}
         # find all vvar definitions
         vvar_deflocs = get_vvar_deflocs(blocks.values(), phi_vvars=phi_vvars)
         # find all explicit vvar uses
@@ -72,34 +72,35 @@ class SReachingDefinitionsAnalysis(Analysis):
         # update vvar definitions using function arguments
         if self.func_args:
             for vvar in self.func_args:
-                if vvar not in vvar_deflocs:
-                    vvar_deflocs[vvar] = ExternalCodeLocation()
+                if vvar.varid not in vvar_deflocs:
+                    vvar_deflocs[vvar.varid] = vvar, ExternalCodeLocation()
             self.model.func_args = self.func_args
 
         # update model
-        for vvar, defloc in vvar_deflocs.items():
-            self.model.varid_to_vvar[vvar.varid] = vvar
-            self.model.all_vvar_definitions[vvar] = defloc
-
-            for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
-                self.model.all_vvar_uses[vvar].add((vvar_at_use, useloc))
-
-        self.model.phi_vvar_ids = {vvar.varid for vvar in phi_vvars}
+        for vvar_id, (vvar, defloc) in vvar_deflocs.items():
+            self.model.varid_to_vvar[vvar_id] = vvar
+            self.model.all_vvar_definitions[vvar_id] = defloc
+            if vvar_id in vvar_uselocs:
+                for useloc in vvar_uselocs[vvar_id]:
+                    self.model.add_vvar_use(vvar_id, *useloc)
+
+        self.model.phi_vvar_ids = set(phi_vvars)
         self.model.phivarid_to_varids = {}
-        for vvar, src_vvars in phi_vvars.items():
-            self.model.phivarid_to_varids[vvar.varid] = {
-                src_vvar.varid for src_vvar in src_vvars if src_vvar is not None
-            }
+        for vvar_id, src_vvars in phi_vvars.items():
+            self.model.phivarid_to_varids[vvar_id] = src_vvars
 
         if self.mode == "function":
+
             # fix register definitions for arguments
-            defined_vvarids = {vvar.varid for vvar in vvar_deflocs}
+            defined_vvarids = set(vvar_deflocs)
             undefined_vvarids = set(vvar_uselocs.keys()).difference(defined_vvarids)
             for vvar_id in undefined_vvarids:
                 used_vvar = next(iter(vvar_uselocs[vvar_id]))[0]
-                self.model.varid_to_vvar[used_vvar.varid] = used_vvar
-                self.model.all_vvar_definitions[used_vvar] = ExternalCodeLocation()
-                self.model.all_vvar_uses[used_vvar] |= vvar_uselocs[vvar_id]
+                self.model.varid_to_vvar[vvar_id] = used_vvar
+                self.model.all_vvar_definitions[vvar_id] = ExternalCodeLocation()
+                if vvar_id in vvar_uselocs:
+                    for vvar_useloc in vvar_uselocs[vvar_id]:
+                        self.model.add_vvar_use(vvar_id, *vvar_useloc)
 
             srda_view = SRDAView(self.model)
 
@@ -151,8 +152,7 @@ class SReachingDefinitionsAnalysis(Analysis):
                         reg_offset = self.project.arch.registers[arg_reg_name][0]
                         if reg_offset in reg_to_vvarids:
                             vvarid = reg_to_vvarids[reg_offset]
-                            vvar = self.model.varid_to_vvar[vvarid]
-                            self.model.all_vvar_uses[vvar].add((None, codeloc))
+                            self.model.add_vvar_use(vvarid, None, codeloc)
 
         if self._track_tmps:
             # track tmps

angr/analyses/variable_recovery/engine_ail.py

@@ -143,9 +143,9 @@ class SimEngineVRAIL(
             # this is a dynamically calculated call target
             target_expr = self._expr(target)
             funcaddr_typevar = target_expr.typevar
-            assert funcaddr_typevar is not None
-            load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
-            self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
+            if funcaddr_typevar is not None:
+                load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
+                self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
 
         # discover the prototype
         prototype: SimTypeFunction | None = None
@@ -212,9 +212,9 @@ class SimEngineVRAIL(
             # this is a dynamically calculated call target
             target_expr = self._expr(target)
             funcaddr_typevar = target_expr.typevar
-            assert funcaddr_typevar is not None
-            load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
-            self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
+            if funcaddr_typevar is not None:
+                load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
+                self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
 
         # discover the prototype
         prototype: SimTypeFunction | None = None