angr 9.2.144__tar.gz → 9.2.146__tar.gz

{angr-9.2.144/angr.egg-info → angr-9.2.146}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: angr
-Version: 9.2.144
+Version: 9.2.146
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: CppHeaderParser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.144
-Requires-Dist: archinfo==9.2.144
+Requires-Dist: ailment==9.2.146
+Requires-Dist: archinfo==9.2.146
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.144
-Requires-Dist: cle==9.2.144
+Requires-Dist: claripy==9.2.146
+Requires-Dist: cle==9.2.146
 Requires-Dist: mulpyplexer
 Requires-Dist: nampa
 Requires-Dist: networkx!=2.8.1,>=2.0
@@ -32,7 +32,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.144
+Requires-Dist: pyvex==9.2.146
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.144 → angr-9.2.146}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.144"
+__version__ = "9.2.146"
 
 if bytes is str:
     raise Exception(

{angr-9.2.144 → angr-9.2.146}/angr/analyses/cfg/cfg_fast.py

@@ -1540,6 +1540,19 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                 }:
                     func.info["is_alloca_probe"] = True
 
+        elif self.project.arch.name == "X86":
+            # determine if the function is __alloca_probe
+            func = self.kb.functions.get_by_addr(func_addr) if self.kb.functions.contains_addr(func_addr) else None
+            if func is not None and len(func.block_addrs_set) == 4:
+                block_bytes = {func.get_block(block_addr).bytes for block_addr in func.block_addrs_set}
+                if block_bytes == {
+                    b"-\x00\x10\x00\x00\x85\x00\xeb\xe9",
+                    b";\xc8r\n",
+                    b"Q\x8dL$\x04+\xc8\x1b\xc0\xf7\xd0#\xc8\x8b\xc4%\x00\xf0\xff\xff;\xc8r\n",
+                    b"\x8b\xc1Y\x94\x8b\x00\x89\x04$\xc3",
+                }:
+                    func.info["is_alloca_probe"] = True
+
         if self._collect_data_ref and self.project is not None and ":" in self.project.arch.name:
             # this is a pcode arch - use Clinic to recover data references
 
@@ -1829,7 +1842,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
 
         if (
             self.project.simos is not None
-            and self.project.arch.name == "AMD64"
+            and self.project.arch.name in {"X86", "AMD64"}
             and self.project.simos.name == "Win32"
             and isinstance(self.project.loader.main_object, cle.PE)
         ):

{angr-9.2.144 → angr-9.2.146}/angr/analyses/decompiler/clinic.py

@@ -2951,7 +2951,7 @@ class Clinic(Analysis):
                     if self.project.kb.functions.contains_addr(last_stmt.target.value)
                     else None
                 )
-                if func is not None and func.name == "__chkstk":
+                if func is not None and (func.name == "__chkstk" or func.info.get("is_alloca_probe", False) is True):
                     # get rid of this call
                     node.statements = node.statements[:-1]
                     if self.project.arch.call_pushes_ret and node.statements:

{angr-9.2.144 → angr-9.2.146}/angr/analyses/decompiler/optimization_passes/engine_base.py

@@ -312,7 +312,15 @@ class SimplifierAILEngine(
         return expr
 
     def _handle_expr_ITE(self, expr):
-        return expr
+        return ailment.expression.ITE(
+            expr.idx,
+            self._expr(expr.cond),
+            self._expr(expr.iffalse),
+            self._expr(expr.iftrue),
+            variable=expr.variable,
+            variable_offset=expr.variable_offset,
+            **expr.tags,
+        )
 
     def _handle_expr_Call(self, expr):
         return expr

{angr-9.2.144 → angr-9.2.146}/angr/analyses/decompiler/optimization_passes/win_stack_canary_simplifier.py

@@ -110,8 +110,11 @@ class WinStackCanarySimplifier(OptimizationPass):
                     _l.debug("Cannot find the statement calling _security_check_cookie() in the predecessor.")
                     continue
 
-                # TODO: Support x86
-                canary_storing_stmt_idx = self._find_amd64_canary_storing_stmt(pred, store_offset)
+                canary_storing_stmt_idx = (
+                    self._find_amd64_canary_storing_stmt(pred, store_offset)
+                    if self.project.arch.name == "AMD64"
+                    else self._find_x86_canary_storing_stmt(pred, store_offset)
+                )
                 if canary_storing_stmt_idx is None:
                     _l.debug("Cannot find the canary check statement in the predecessor.")
                     continue
@@ -270,6 +273,59 @@ class WinStackCanarySimplifier(OptimizationPass):
                 return idx
         return None
 
+    def _find_x86_canary_storing_stmt(self, block, canary_value_stack_offset):
+        load_stmt_idx = None
+
+        for idx, stmt in enumerate(block.statements):
+            # when we are lucky, we have one instruction
+            if (
+                (
+                    isinstance(stmt, ailment.Stmt.Assignment)
+                    and isinstance(stmt.dst, ailment.Expr.VirtualVariable)
+                    and stmt.dst.was_reg
+                    and stmt.dst.reg_offset == self.project.arch.registers["eax"][0]
+                )
+                and isinstance(stmt.src, ailment.Expr.BinaryOp)
+                and stmt.src.op == "Xor"
+            ):
+                op0, op1 = stmt.src.operands
+                if (
+                    isinstance(op0, ailment.Expr.Load)
+                    and isinstance(op0.addr, ailment.Expr.StackBaseOffset)
+                    and op0.addr.offset == canary_value_stack_offset
+                ) and isinstance(op1, ailment.Expr.StackBaseOffset):
+                    # found it
+                    return idx
+            # or when we are unlucky, we have two instructions...
+            if (
+                isinstance(stmt, ailment.Stmt.Assignment)
+                and isinstance(stmt.dst, ailment.Expr.VirtualVariable)
+                and stmt.dst.reg_offset == self.project.arch.registers["eax"][0]
+                and isinstance(stmt.src, ailment.Expr.Load)
+                and isinstance(stmt.src.addr, ailment.Expr.StackBaseOffset)
+                and stmt.src.addr.offset == canary_value_stack_offset
+            ):
+                load_stmt_idx = idx
+            if (
+                load_stmt_idx is not None
+                and idx >= load_stmt_idx + 1
+                and (
+                    isinstance(stmt, ailment.Stmt.Assignment)
+                    and isinstance(stmt.dst, ailment.Expr.VirtualVariable)
+                    and stmt.dst.was_reg
+                    and isinstance(stmt.src, ailment.Expr.BinaryOp)
+                    and stmt.src.op == "Xor"
+                )
+                and (
+                    isinstance(stmt.src.operands[0], ailment.Expr.VirtualVariable)
+                    and stmt.src.operands[0].was_reg
+                    and stmt.src.operands[0].reg_offset == self.project.arch.registers["eax"][0]
+                    and isinstance(stmt.src.operands[1], ailment.Expr.StackBaseOffset)
+                )
+            ):
+                return idx
+        return None
+
     @staticmethod
     def _find_return_addr_storing_stmt(block):
         for idx, stmt in enumerate(block.statements):

{angr-9.2.144 → angr-9.2.146}/angr/analyses/decompiler/peephole_optimizations/eager_eval.py

@@ -222,6 +222,17 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
                     )
                     return BinaryOp(expr.idx, "Div", (mul, new_const_0), expr.signed, bits=expr.bits, **expr.tags)
 
+        elif expr.op == "Mod":
+            op0, op1 = expr.operands
+            if (
+                isinstance(op0, Const)
+                and isinstance(op0.value, int)
+                and isinstance(op1, Const)
+                and isinstance(op1.value, int)
+                and op1.value != 0
+            ):
+                return Const(expr.idx, None, op0.value % op1.value, expr.bits, **expr.tags)
+
         elif expr.op in {"Shr", "Sar"} and isinstance(expr.operands[1], Const):
             expr0, expr1 = expr.operands
             if isinstance(expr0, BinaryOp) and expr0.op == "Shr" and isinstance(expr0.operands[1], Const):

{angr-9.2.144 → angr-9.2.146}/angr/analyses/decompiler/ssailification/ssailification.py

@@ -145,7 +145,7 @@ class Ssailification(Analysis):  # pylint:disable=abstract-method
             stackvar_locs = {}
             sorted_stackvar_offs = []
 
-        # computer phi node locations for each unified definition
+        # compute phi node locations for each unified definition
         udef_to_defs = defaultdict(set)
         udef_to_blockkeys = defaultdict(set)
         for def_, loc in def_to_loc:

{angr-9.2.144 → angr-9.2.146}/angr/analyses/stack_pointer_tracker.py

@@ -15,6 +15,7 @@ from angr.analyses import AnalysesHub
 from angr.knowledge_plugins import Function
 from angr.block import BlockNode
 from angr.errors import SimTranslationError
+from angr.calling_conventions import SimStackArg
 from .analysis import Analysis
 
 try:
@@ -554,7 +555,7 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
         if vex_block is not None:
             if isinstance(vex_block, pyvex.IRSB):
                 curr_stmt_start_addr = self._process_vex_irsb(node, vex_block, state)
-            elif pypcode is not None and isinstance(vex_block, pcode.lifter.IRSB):
+            elif pypcode is not None and isinstance(vex_block, pcode.lifter.IRSB):  # type: ignore
                 curr_stmt_start_addr = self._process_pcode_irsb(node, vex_block, state)
             else:
                 raise NotImplementedError(f"Unsupported block type {type(vex_block)}")
@@ -587,7 +588,7 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
                         raise CouldNotResolveException
                     if arg1_expr is BOTTOM:
                         return BOTTOM
-                    return arg0_expr + arg1_expr
+                    return arg0_expr + arg1_expr  # type: ignore
                 if expr.op.startswith("Iop_Sub"):
                     arg0_expr = _resolve_expr(arg0)
                     if arg0_expr is None:
@@ -599,7 +600,7 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
                         raise CouldNotResolveException
                     if arg1_expr is BOTTOM:
                         return BOTTOM
-                    return arg0_expr - arg1_expr
+                    return arg0_expr - arg1_expr  # type: ignore
                 if expr.op.startswith("Iop_And"):
                     # handle stack pointer alignments
                     arg0_expr = _resolve_expr(arg0)
@@ -713,43 +714,78 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
                     pass
             # who are we calling?
             callees = [] if self._func is None else self._find_callees(node)
+            sp_adjusted = False
             if callees:
                 if len(callees) == 1:
+
                     callee = callees[0]
-                    track_rax = False
-                    if (
-                        (callee.info.get("is_rust_probestack", False) and self.project.arch.name == "AMD64")
-                        or (callee.info.get("is_alloca_probe", False) and self.project.arch.name == "AMD64")
-                        or callee.name == "__chkstk"
-                    ):
-                        # sp = sp - rax right after returning from the call
-                        track_rax = True
-
-                    if track_rax:
-                        for stmt in reversed(vex_block.statements):
-                            if (
-                                isinstance(stmt, pyvex.IRStmt.Put)
-                                and stmt.offset == self.project.arch.registers["rax"][0]
-                                and isinstance(stmt.data, pyvex.IRExpr.Const)
-                            ):
-                                state.put(stmt.offset, Constant(stmt.data.con.value), force=True)
-                                break
+                    if callee.info.get("is_rust_probestack", False):
+                        # sp = sp - rax/eax right after returning from the call
+                        rust_probe_stack_rax_regname: str | None = None
+                        if self.project.arch.name == "AMD64":
+                            rust_probe_stack_rax_regname = "rax"
+                        elif self.project.arch.name == "X86":
+                            rust_probe_stack_rax_regname = "eax"
+
+                        if rust_probe_stack_rax_regname is not None:
+                            for stmt in reversed(vex_block.statements):
+                                if (
+                                    isinstance(stmt, pyvex.IRStmt.Put)
+                                    and stmt.offset == self.project.arch.registers[rust_probe_stack_rax_regname][0]
+                                    and isinstance(stmt.data, pyvex.IRExpr.Const)
+                                ):
+                                    sp_adjusted = True
+                                    state.put(stmt.offset, Constant(stmt.data.con.value), force=True)
+                                    break
+
+                    if not sp_adjusted and (callee.info.get("is_alloca_probe", False) or callee.name == "__chkstk"):
+                        # sp = sp - rax, but it's adjusted within the callee
+                        chkstk_stack_rax_regname: str | None = None
+                        if self.project.arch.name == "AMD64":
+                            chkstk_stack_rax_regname = "rax"
+                        elif self.project.arch.name == "X86":
+                            chkstk_stack_rax_regname = "eax"
+
+                        if chkstk_stack_rax_regname is not None:
+                            for stmt in reversed(vex_block.statements):
+                                if (
+                                    isinstance(stmt, pyvex.IRStmt.Put)
+                                    and stmt.offset == self.project.arch.registers[chkstk_stack_rax_regname][0]
+                                    and isinstance(stmt.data, pyvex.IRExpr.Const)
+                                    and self.project.arch.sp_offset in state.regs
+                                ):
+                                    sp_adjusted = True
+                                    sp_v = state.regs[self.project.arch.sp_offset]
+                                    sp_v -= Constant(stmt.data.con.value)
+                                    state.put(self.project.arch.sp_offset, sp_v, force=True)
+                                    break
 
                 callee_cleanups = [
                     callee
                     for callee in callees
-                    if callee.calling_convention is not None and callee.calling_convention.CALLEE_CLEANUP
+                    if callee.calling_convention is not None
+                    and callee.calling_convention.CALLEE_CLEANUP
+                    and callee.prototype is not None
                 ]
                 if callee_cleanups:
                     # found callee clean-up cases...
+                    callee = callee_cleanups[0]
+                    assert callee.calling_convention is not None  # just to make pyright happy
                     try:
                         v = state.get(self.project.arch.sp_offset)
                         incremented = None
                         if v is BOTTOM:
                             incremented = BOTTOM
-                        elif callee_cleanups[0].prototype is not None:
-                            num_args = len(callee_cleanups[0].prototype.args)
-                            incremented = v + Constant(self.project.arch.bytes * num_args)
+                        elif callee.prototype is not None:
+                            num_stack_args = len(
+                                [
+                                    arg_loc
+                                    for arg_loc in callee.calling_convention.arg_locs(callee.prototype)
+                                    if isinstance(arg_loc, SimStackArg)
+                                ]
+                            )
+                            if num_stack_args > 0:
+                                incremented = v + Constant(self.project.arch.bytes * num_stack_args)
                         if incremented is not None:
                             state.put(self.project.arch.sp_offset, incremented)
                     except CouldNotResolveException:

{angr-9.2.144 → angr-9.2.146}/angr/analyses/typehoon/lifter.py

@@ -11,8 +11,10 @@ from angr.sim_type import (
     SimTypePointer,
     SimStruct,
     SimTypeArray,
+    SimTypeFloat,
+    SimTypeDouble,
 )
-from .typeconsts import BottomType, Int8, Int16, Int32, Int64, Pointer32, Pointer64, Struct, Array
+from .typeconsts import BottomType, Int8, Int16, Int32, Int64, Pointer32, Pointer64, Struct, Array, Float32, Float64
 
 if TYPE_CHECKING:
     from .typeconsts import TypeConstant
@@ -79,6 +81,12 @@ class TypeLifter:
         elem_type = self.lift(ty.elem_type)
         return Array(elem_type, count=ty.length)
 
+    def _lift_SimTypeFloat(self, ty: SimTypeFloat) -> Float32:  # pylint:disable=unused-argument,no-self-use
+        return Float32()
+
+    def _lift_SimTypeDouble(self, ty: SimTypeDouble) -> Float64:  # pylint:disable=unused-argument,no-self-use
+        return Float64()
+
 
 _mapping = {
     SimTypeChar: TypeLifter._lift_SimTypeChar,
@@ -89,4 +97,6 @@ _mapping = {
     SimTypePointer: TypeLifter._lift_SimTypePointer,
     SimStruct: TypeLifter._lift_SimStruct,
     SimTypeArray: TypeLifter._lift_SimTypeArray,
+    SimTypeFloat: TypeLifter._lift_SimTypeFloat,
+    SimTypeDouble: TypeLifter._lift_SimTypeDouble,
 }

{angr-9.2.144 → angr-9.2.146}/angr/analyses/typehoon/simple_solver.py

@@ -41,6 +41,9 @@ from .typeconsts import (
     Array,
     Function,
     int_type,
+    Float,
+    Float32,
+    Float64,
 )
 from .variance import Variance
 from .dfa import DFAConstraintSolver, EmptyEpsilonNFAError
@@ -60,6 +63,9 @@ PRIMITIVE_TYPES = {
     BottomType(),
     Struct(),
     Array(),
+    Float(),
+    Float32(),
+    Float64(),
 }
 
 Top_ = TopType()
@@ -73,6 +79,9 @@ Pointer64_ = Pointer64()
 Pointer32_ = Pointer32()
 Struct_ = Struct()
 Array_ = Array()
+Float_ = Float()
+Float32_ = Float32()
+Float64_ = Float64()
 
 # lattice for 64-bit binaries
 BASE_LATTICE_64 = networkx.DiGraph()

{angr-9.2.144 → angr-9.2.146}/angr/analyses/typehoon/translator.py

@@ -161,6 +161,12 @@ class TypeTranslator:
         self._has_nonexistent_ref = True
         return SimTypeTempRef(tc.typevar)
 
+    def _translate_Float32(self, tc: typeconsts.Float32) -> sim_type.SimTypeFloat:  # pylint:disable=unused-argument
+        return sim_type.SimTypeFloat().with_arch(self.arch)
+
+    def _translate_Float64(self, tc: typeconsts.Float64) -> sim_type.SimTypeDouble:  # pylint:disable=unused-argument
+        return sim_type.SimTypeDouble().with_arch(self.arch)
+
     #
     # Backpatching
     #
@@ -229,6 +235,12 @@ class TypeTranslator:
             return typeconsts.Pointer64(base)
         raise TypeError(f"Unsupported pointer size {self.arch.bits}")
 
+    def _translate_SimTypeFloat(self, st: sim_type.SimTypeFloat) -> typeconsts.Float32:
+        return typeconsts.Float32()
+
+    def _translate_SimTypeDouble(self, st: sim_type.SimTypeDouble) -> typeconsts.Float64:
+        return typeconsts.Float64()
+
 
 TypeConstHandlers = {
     typeconsts.Pointer64: TypeTranslator._translate_Pointer64,
@@ -243,6 +255,8 @@ TypeConstHandlers = {
     typeconsts.Int256: TypeTranslator._translate_Int256,
     typeconsts.Int512: TypeTranslator._translate_Int512,
     typeconsts.TypeVariableReference: TypeTranslator._translate_TypeVariableReference,
+    typeconsts.Float32: TypeTranslator._translate_Float32,
+    typeconsts.Float64: TypeTranslator._translate_Float64,
 }
 
 
@@ -257,4 +271,6 @@ SimTypeHandlers = {
     sim_type.SimTypeInt512: TypeTranslator._translate_SimTypeInt512,
     sim_type.SimStruct: TypeTranslator._translate_SimStruct,
     sim_type.SimTypeArray: TypeTranslator._translate_SimTypeArray,
+    sim_type.SimTypeFloat: TypeTranslator._translate_SimTypeFloat,
+    sim_type.SimTypeDouble: TypeTranslator._translate_SimTypeDouble,
 }

{angr-9.2.144 → angr-9.2.146}/angr/analyses/typehoon/typeconsts.py

@@ -114,23 +114,23 @@ class Int512(Int):
         return "int512"
 
 
-class FloatBase(TypeConstant):
+class Float(TypeConstant):
     def __repr__(self, memo=None) -> str:
         return "floatbase"
 
 
-class Float(FloatBase):
+class Float32(Float):
     SIZE = 4
 
     def __repr__(self, memo=None):
-        return "float"
+        return "float32"
 
 
-class Double(FloatBase):
+class Float64(Float):
     SIZE = 8
 
     def __repr__(self, memo=None):
-        return "double"
+        return "float64"
 
 
 class Pointer(TypeConstant):
@@ -317,9 +317,9 @@ def int_type(bits: int) -> Int:
     raise TypeError(f"Not a known size of int: {bits}")
 
 
-def float_type(bits: int) -> FloatBase | None:
+def float_type(bits: int) -> Float | None:
     if bits == 32:
-        return Float()
+        return Float32()
     if bits == 64:
-        return Double()
+        return Float64()
     return None

{angr-9.2.144 → angr-9.2.146}/angr/analyses/vfg.py

@@ -1547,7 +1547,7 @@ class VFG(ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis):  # pyl
                 reg_sp_si = self._create_stack_region(successor_state, successor_addr)
 
                 # Save the new sp register
-                new_reg_sp_expr = reg_sp_si.annotate(claripy.annotation.RegionAnnotation("global", 0, reg_sp_si))
+                new_reg_sp_expr = reg_sp_si.annotate(claripy.annotation.RegionAnnotation("global", 0))
                 successor_state.regs.sp = new_reg_sp_expr
 
             new_job = VFGJob(

{angr-9.2.144 → angr-9.2.146}/angr/knowledge_plugins/functions/function.py

@@ -638,12 +638,12 @@ class Function(Serializable):
         return self.binary.loader.find_symbol(self.addr)
 
     @property
-    def pseudocode(self) -> str:
+    def pseudocode(self) -> str | None:
         """
         :return: the function's pseudocode
         """
         dec = self.project.analyses.Decompiler(self, cfg=self._function_manager._kb.cfgs.get_most_accurate())
-        return dec.codegen.text
+        return dec.codegen.text if dec.codegen else None
 
     def add_jumpout_site(self, node: CodeNode):
         """

{angr-9.2.144 → angr-9.2.146}/angr/utils/funcid.py

@@ -17,7 +17,8 @@ def is_function_security_check_cookie(func, project, security_cookie_addr: int)
         return False
     ins0 = block.capstone.insns[0]
     if (
-        ins0.mnemonic == "cmp"
+        project.arch.name == "AMD64"
+        and ins0.mnemonic == "cmp"
         and len(ins0.operands) == 2
         and ins0.operands[0].type == capstone.x86.X86_OP_REG
         and ins0.operands[0].reg == capstone.x86.X86_REG_RCX
@@ -29,6 +30,20 @@ def is_function_security_check_cookie(func, project, security_cookie_addr: int)
         ins1 = block.capstone.insns[1]
         if ins1.mnemonic == "jne":
             return True
+    if (
+        project.arch.name == "X86"
+        and ins0.mnemonic == "cmp"
+        and len(ins0.operands) == 2
+        and ins0.operands[0].type == capstone.x86.X86_OP_REG
+        and ins0.operands[0].reg == capstone.x86.X86_REG_ECX
+        and ins0.operands[1].type == capstone.x86.X86_OP_MEM
+        and ins0.operands[1].mem.base == 0
+        and ins0.operands[1].mem.disp == security_cookie_addr
+        and ins0.operands[1].mem.index == 0
+    ):
+        ins1 = block.capstone.insns[1]
+        if ins1.mnemonic == "jne":
+            return True
     return False
 
 
@@ -63,13 +78,23 @@ def is_function_security_init_cookie(func: Function, project, security_cookie_ad
             continue
         last_insn = block.capstone.insns[-1]
         if (
-            last_insn.mnemonic == "mov"
+            project.arch.name == "AMD64"
+            and last_insn.mnemonic == "mov"
             and len(last_insn.operands) == 2
             and last_insn.operands[0].type == capstone.x86.X86_OP_MEM
             and last_insn.operands[0].mem.base == capstone.x86.X86_REG_RIP
             and last_insn.operands[0].mem.index == 0
             and last_insn.operands[0].mem.disp + last_insn.address + last_insn.size == security_cookie_addr
             and last_insn.operands[1].type == capstone.x86.X86_OP_REG
+        ) or (
+            project.arch.name == "X86"
+            and last_insn.mnemonic == "mov"
+            and len(last_insn.operands) == 2
+            and last_insn.operands[0].type == capstone.x86.X86_OP_MEM
+            and last_insn.operands[0].mem.base == 0
+            and last_insn.operands[0].mem.index == 0
+            and last_insn.operands[0].mem.disp == security_cookie_addr
+            and last_insn.operands[1].type == capstone.x86.X86_OP_REG
         ):
             return True
     return False

{angr-9.2.144 → angr-9.2.146/angr.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: angr
-Version: 9.2.144
+Version: 9.2.146
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: CppHeaderParser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.144
-Requires-Dist: archinfo==9.2.144
+Requires-Dist: ailment==9.2.146
+Requires-Dist: archinfo==9.2.146
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.144
-Requires-Dist: cle==9.2.144
+Requires-Dist: claripy==9.2.146
+Requires-Dist: cle==9.2.146
 Requires-Dist: mulpyplexer
 Requires-Dist: nampa
 Requires-Dist: networkx!=2.8.1,>=2.0
@@ -32,7 +32,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.144
+Requires-Dist: pyvex==9.2.146
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.144 → angr-9.2.146}/angr.egg-info/requires.txt

@@ -1,12 +1,12 @@
 CppHeaderParser
 GitPython
-ailment==9.2.144
-archinfo==9.2.144
+ailment==9.2.146
+archinfo==9.2.146
 cachetools
 capstone==5.0.3
 cffi>=1.14.0
-claripy==9.2.144
-cle==9.2.144
+claripy==9.2.146
+cle==9.2.146
 mulpyplexer
 nampa
 networkx!=2.8.1,>=2.0
@@ -15,7 +15,7 @@ psutil
 pycparser>=2.18
 pydemumble
 pyformlang
-pyvex==9.2.144
+pyvex==9.2.146
 rich>=13.1.0
 sortedcontainers
 sympy

{angr-9.2.144 → angr-9.2.146}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=61.2", "wheel", "pyvex==9.2.144"]
+requires = ["setuptools>=61.2", "wheel", "pyvex==9.2.146"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -19,13 +19,13 @@ requires-python = ">=3.10"
 dependencies = [
     "CppHeaderParser",
     "GitPython",
-    "ailment==9.2.144",
-    "archinfo==9.2.144",
+    "ailment==9.2.146",
+    "archinfo==9.2.146",
     "cachetools",
     "capstone==5.0.3",
     "cffi>=1.14.0",
-    "claripy==9.2.144",
-    "cle==9.2.144",
+    "claripy==9.2.146",
+    "cle==9.2.146",
     "mulpyplexer",
     "nampa",
     "networkx!=2.8.1,>=2.0",
@@ -34,7 +34,7 @@ dependencies = [
     "pycparser>=2.18",
     "pydemumble",
     "pyformlang",
-    "pyvex==9.2.144",
+    "pyvex==9.2.146",
     "rich>=13.1.0",
     "sortedcontainers",
     "sympy",