angr 9.2.142__tar.gz → 9.2.143__tar.gz

{angr-9.2.142/angr.egg-info → angr-9.2.143}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: angr
-Version: 9.2.142
+Version: 9.2.143
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 Home-page: https://github.com/angr/angr
 License: BSD-2-Clause
@@ -16,13 +16,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: CppHeaderParser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.142
-Requires-Dist: archinfo==9.2.142
+Requires-Dist: ailment==9.2.143
+Requires-Dist: archinfo==9.2.143
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.142
-Requires-Dist: cle==9.2.142
+Requires-Dist: claripy==9.2.143
+Requires-Dist: cle==9.2.143
 Requires-Dist: mulpyplexer
 Requires-Dist: nampa
 Requires-Dist: networkx!=2.8.1,>=2.0
@@ -31,7 +31,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.142
+Requires-Dist: pyvex==9.2.143
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.142 → angr-9.2.143}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.142"
+__version__ = "9.2.143"
 
 if bytes is str:
     raise Exception(

{angr-9.2.142 → angr-9.2.143}/angr/analyses/calling_convention/calling_convention.py

@@ -220,9 +220,9 @@ class CallingConventionAnalysis(Analysis):
                 self.prototype = prototype  # type: ignore
             return
         if self._function.is_plt:
-            r = self._analyze_plt()
-            if r is not None:
-                self.cc, self.prototype = r
+            r_plt = self._analyze_plt()
+            if r_plt is not None:
+                self.cc, self.prototype, self.prototype_libname = r_plt
             return
 
         r = self._analyze_function()
@@ -278,11 +278,11 @@ class CallingConventionAnalysis(Analysis):
         self.cc = cc
         self.prototype = prototype
 
-    def _analyze_plt(self) -> tuple[SimCC, SimTypeFunction | None] | None:
+    def _analyze_plt(self) -> tuple[SimCC, SimTypeFunction | None, str | None] | None:
         """
         Get the calling convention for a PLT stub.
 
-        :return:    A calling convention.
+        :return:    A calling convention, the function type, as well as the library name if available.
         """
         assert self._function is not None
 
@@ -326,11 +326,11 @@ class CallingConventionAnalysis(Analysis):
                         # we only take the prototype from the SimProcedure if
                         # - the SimProcedure is a function
                         # - the prototype of the SimProcedure is not guessed
-                        return cc, hooker.prototype
+                        return cc, hooker.prototype, hooker.library_name
                 if real_func.prototype is not None:
-                    return cc, real_func.prototype
+                    return cc, real_func.prototype, real_func.prototype_libname
             else:
-                return cc, real_func.prototype
+                return cc, real_func.prototype, real_func.prototype_libname
 
         if self.analyze_callsites:
             # determine the calling convention by analyzing its callsites
@@ -344,7 +344,7 @@ class CallingConventionAnalysis(Analysis):
             prototype = self._adjust_prototype(
                 prototype, callsite_facts, update_arguments=UpdateArgumentsOption.AlwaysUpdate
             )
-            return cc, prototype
+            return cc, prototype, None
 
         return None
 

{angr-9.2.142 → angr-9.2.143}/angr/analyses/calling_convention/fact_collector.py

@@ -1,10 +1,11 @@
 # pylint:disable=too-many-boolean-expressions
 from __future__ import annotations
-from typing import Any
+from typing import Any, TYPE_CHECKING
 
 import pyvex
 import claripy
 
+from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from angr.utils.bits import s2u, u2s
 from angr.block import Block
 from angr.analyses.analysis import Analysis
@@ -13,9 +14,12 @@ from angr.knowledge_plugins.functions import Function
 from angr.codenode import BlockNode, HookNode
 from angr.engines.light import SimEngineNostmtVEX, SimEngineLight, SpOffset, RegisterOffset
 from angr.calling_conventions import SimRegArg, SimStackArg, default_cc
-from angr.sim_type import SimTypeBottom
+from angr.sim_type import SimTypeBottom, dereference_simtype, SimTypeFunction
 from .utils import is_sane_register_variable
 
+if TYPE_CHECKING:
+    from angr.codenode import CodeNode
+
 
 class FactCollectorState:
     """
@@ -224,9 +228,12 @@ class FactCollector(Analysis):
         callee_restored_regs = self._analyze_endpoints_for_restored_regs()
         self._determine_input_args(end_states, callee_restored_regs)
 
-    def _analyze_startpoint(self):
+    def _analyze_startpoint(self) -> list[FactCollectorState]:
         func_graph = self.function.transition_graph
         startpoint = self.function.startpoint
+        if startpoint is None:
+            return []
+
         bp_as_gpr = self.function.info.get("bp_as_gpr", False)
         engine = SimEngineFactCollectorVEX(self.project, bp_as_gpr)
         init_state = FactCollectorState()
@@ -235,9 +242,9 @@ class FactCollector(Analysis):
         init_state.bp_value = init_state.sp_value
 
         traversed = set()
-        queue: list[tuple[int, FactCollectorState, BlockNode | HookNode | Function, BlockNode | HookNode | None]] = [
-            (0, init_state, startpoint, None)
-        ]
+        queue: list[
+            tuple[int, FactCollectorState, CodeNode | BlockNode | HookNode | Function, BlockNode | HookNode | None]
+        ] = [(0, init_state, startpoint, None)]
         end_states: list[FactCollectorState] = []
         while queue:
             depth, state, node, retnode = queue.pop(0)
@@ -398,9 +405,24 @@ class FactCollector(Analysis):
                             and not isinstance(func_succ.prototype.returnty, SimTypeBottom)
                         ):
                             # assume the function overwrites the return variable
-                            returnty_size = func_succ.prototype.returnty.with_arch(self.project.arch).size
-                            assert returnty_size is not None
-                            retval_size = returnty_size // self.project.arch.byte_width
+                            proto = func_succ.prototype
+                            if func_succ.prototype_libname is not None:
+                                # we need to deref the prototype in case it uses SimTypeRef internally
+                                type_collections = []
+                                prototype_lib = SIM_LIBRARIES[func_succ.prototype_libname]
+                                if prototype_lib.type_collection_names:
+                                    for typelib_name in prototype_lib.type_collection_names:
+                                        type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
+                                    proto = dereference_simtype(proto, type_collections)
+
+                            assert isinstance(proto, SimTypeFunction) and proto.returnty is not None
+                            returnty_size = proto.returnty.with_arch(self.project.arch).size
+                            if returnty_size is None:
+                                # it may be None if somehow we cannot resolve a SimTypeRef; we fall back to the full
+                                # machine word size
+                                retval_size = self.project.arch.bytes
+                            else:
+                                retval_size = returnty_size // self.project.arch.byte_width
                             retval_sizes.append(retval_size)
                         continue
 

{angr-9.2.142 → angr-9.2.143}/angr/analyses/cfg/indirect_jump_resolvers/const_resolver.py

@@ -43,11 +43,22 @@ class ConstantResolver(IndirectJumpResolver):
     be resolved to a constant value. This resolver must be run after all other more specific resolvers.
     """
 
-    def __init__(self, project):
+    def __init__(self, project, max_func_nodes: int = 512):
         super().__init__(project, timeless=False)
+        self.max_func_nodes = max_func_nodes
 
     def filter(self, cfg, addr, func_addr, block, jumpkind):
+        if not cfg.functions.contains_addr(func_addr):
+            # the function does not exist
+            return False
+
+        # for performance, we don't run constant resolver if the function is too large
+        func = cfg.functions.get_by_addr(func_addr)
+        if len(func.block_addrs_set) > self.max_func_nodes:
+            return False
+
         # we support both an indirect call and jump since the value can be resolved
+
         return jumpkind in {"Ijk_Boring", "Ijk_Call"}
 
     def resolve(  # pylint:disable=unused-argument

{angr-9.2.142 → angr-9.2.143}/angr/analyses/cfg/indirect_jump_resolvers/jumptable.py

@@ -6,6 +6,7 @@ from collections.abc import Sequence
 from collections import defaultdict, OrderedDict
 import logging
 import functools
+import contextlib
 
 import pyvex
 import claripy
@@ -1798,7 +1799,9 @@ class JumpTableResolver(IndirectJumpResolver):
                         # swap the two tmps
                         jump_base_addr.tmp, jump_base_addr.tmp_1 = jump_base_addr.tmp_1, jump_base_addr.tmp
                     # Load the concrete base address
-                    jump_base_addr.base_addr = state.solver.eval(state.scratch.temps[jump_base_addr.tmp_1])
+                    with contextlib.suppress(SimError):
+                        # silently eat the claripy exception
+                        jump_base_addr.base_addr = state.solver.eval(state.scratch.temps[jump_base_addr.tmp_1])
             else:
                 # We do not support the cases where the base address involves more than one addition.
                 # One such case exists in libc-2.27.so shipped with Ubuntu x86 where esi is used as the address of the

{angr-9.2.142 → angr-9.2.143}/angr/analyses/complete_calling_conventions.py

@@ -63,7 +63,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
         max_function_size: int | None = None,
         workers: int = 0,
         cc_callback: Callable | None = None,
-        prioritize_func_addrs: Iterable[int] | None = None,
+        prioritize_func_addrs: list[int] | set[int] | None = None,
         skip_other_funcs: bool = False,
         auto_start: bool = True,
         func_graphs: dict[int, networkx.DiGraph] | None = None,
@@ -130,9 +130,20 @@ class CompleteCallingConventionsAnalysis(Analysis):
         Infer calling conventions for all functions in the current project.
         """
 
-        # get an ordering of functions based on the call graph
-        # note that the call graph is a multi-digraph. we convert it to a digraph to speed up topological sort
-        directed_callgraph = networkx.DiGraph(self.kb.functions.callgraph)
+        # special case: if both _prioritize_func_addrs and _skip_other_funcs are set, we only need to sort part of
+        # the call graph; even better, if there is only one function set, we don't need to sort the call graph at all!
+        if self._prioritize_func_addrs and self._skip_other_funcs:
+            if len(self._prioritize_func_addrs) == 1:
+                self._func_addrs = list(self._prioritize_func_addrs)
+                self._total_funcs = 1
+                return
+            directed_callgraph = networkx.DiGraph(self.kb.functions.callgraph)
+            directed_callgraph = directed_callgraph.subgraph(self._prioritize_func_addrs)
+        else:
+            # get an ordering of functions based on the call graph
+            # note that the call graph is a multi-digraph. we convert it to a digraph to speed up topological sort
+            directed_callgraph = networkx.DiGraph(self.kb.functions.callgraph)
+        assert isinstance(directed_callgraph, networkx.DiGraph)
         sorted_funcs = GraphUtils.quasi_topological_sort_nodes(directed_callgraph)
 
         total_funcs = 0
@@ -148,7 +159,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
                     continue
 
                 if self._max_function_size is not None:
-                    func_size = sum(block.size for block in func.blocks)
+                    func_size = sum(block.size for block in func.blocks if block.size is not None)
                     if func_size > self._max_function_size:
                         _l.info(
                             "Skipping variable recovery for %r since its size (%d) is greater than the cutoff "
@@ -189,6 +200,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
 
     def work(self):
         total_funcs = self._total_funcs
+        assert total_funcs is not None
         if self._workers == 0:
             self._update_progress(0)
             for idx, func_addr in enumerate(self._func_addrs):
@@ -211,6 +223,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
             self._finish_progress()
 
         else:
+            assert self._remaining_funcs is not None and self._func_queue is not None
             self._remaining_funcs.value = len(self._func_addrs)
 
             # generate a call tree (obviously, it's acyclic)