angr 9.2.149__tar.gz → 9.2.150__tar.gz

{angr-9.2.149/angr.egg-info → angr-9.2.150}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.149
+Version: 9.2.150
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.149
-Requires-Dist: archinfo==9.2.149
+Requires-Dist: ailment==9.2.150
+Requires-Dist: archinfo==9.2.150
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.149
-Requires-Dist: cle==9.2.149
+Requires-Dist: claripy==9.2.150
+Requires-Dist: cle==9.2.150
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -31,7 +31,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.149
+Requires-Dist: pyvex==9.2.150
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.149 → angr-9.2.150}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.149"
+__version__ = "9.2.150"
 
 if bytes is str:
     raise Exception(

angr-9.2.150/angr/__main__.py

@@ -0,0 +1,152 @@
+from __future__ import annotations
+
+import argparse
+import logging
+import re
+from typing import TYPE_CHECKING
+from collections.abc import Generator
+
+import angr
+from angr.analyses.decompiler import DECOMPILATION_PRESETS
+from angr.analyses.decompiler.structuring import STRUCTURER_CLASSES, DEFAULT_STRUCTURER
+from angr.analyses.decompiler.utils import decompile_functions
+
+
+if TYPE_CHECKING:
+    from angr.knowledge_plugins.functions import Function
+
+
+log = logging.getLogger(__name__)
+
+
+NUMERIC_ARG_RE = re.compile(r"^(0x)?[a-fA-F0-9]+$")
+
+
+def parse_function_args(proj: angr.Project, func_args: list[str] | None) -> Generator[Function]:
+    """
+    Generate a sequence of functions in the project kb by their identifier in func_args.
+
+    :param proj:      Project to query.
+    :param func_args: Sequence of function identifiers to query. None for all functions.
+    """
+    if func_args is None:
+        yield from sorted(proj.kb.functions.values(), key=lambda f: f.addr)
+        return
+
+    for func_arg in func_args:
+        if func_arg in proj.kb.functions:
+            yield proj.kb.functions[func_arg]
+            continue
+
+        if NUMERIC_ARG_RE.match(func_arg):
+            func_addr = int(func_arg, 0)
+            if func_addr in proj.kb.functions:
+                yield proj.kb.functions[func_addr]
+                continue
+
+        log.error('Function "%s" not found', func_arg)
+
+
+def disassemble(args):
+    """
+    Disassemble functions.
+    """
+    loader_main_opts_kwargs = {}
+    if args.base_addr is not None:
+        loader_main_opts_kwargs["base_addr"] = args.base_addr
+
+    proj = angr.Project(args.binary, auto_load_libs=False, main_opts=loader_main_opts_kwargs)
+    proj.analyses.CFG(normalize=True, data_references=True)
+
+    for func in parse_function_args(proj, args.functions):
+        try:
+            if func.is_plt or func.is_syscall or func.is_alignment or func.is_simprocedure:
+                continue
+            func.pp(show_bytes=True, min_edge_depth=10)
+        except Exception as e:  # pylint:disable=broad-exception-caught
+            if not args.catch_exceptions:
+                raise
+            log.exception(e)
+
+
+def decompile(args):
+    """
+    Decompile functions.
+    """
+    decompilation = decompile_functions(
+        args.binary,
+        functions=args.functions,
+        structurer=args.structurer,
+        catch_errors=args.catch_exceptions,
+        show_casts=not args.no_casts,
+        base_address=args.base_addr,
+        preset=args.preset,
+    )
+    print(decompilation)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="The angr CLI allows you to decompile and analyze binaries.")
+    parser.add_argument("binary", help="The path to the binary to analyze.")
+    parser.add_argument(
+        "--catch-exceptions",
+        help="""
+        Catch exceptions during analysis. The scope of error handling may depend on the command used for analysis.
+        If multiple functions are specified for analysis, each function will be handled individually.""",
+        action="store_true",
+        default=False,
+    )
+    parser.add_argument(
+        "--base-addr",
+        help="""
+        The base address of the binary. This is useful when the binary is loaded at a different address than the one
+        specified in the ELF header.""",
+        type=lambda x: int(x, 0),
+        default=None,
+    )
+    subparsers = parser.add_subparsers(metavar="command", required=True)
+
+    decompile_cmd_parser = subparsers.add_parser("decompile", aliases=["dec"], help=decompile.__doc__)
+    decompile_cmd_parser.set_defaults(func=decompile)
+    decompile_cmd_parser.add_argument(
+        "--structurer",
+        help="The structuring algorithm to use for decompilation.",
+        choices=STRUCTURER_CLASSES.keys(),
+        default=DEFAULT_STRUCTURER.NAME,
+    )
+    decompile_cmd_parser.add_argument(
+        "--no-casts",
+        help="Do not show type casts in the decompiled output.",
+        action="store_true",
+        default=False,
+    )
+    decompile_cmd_parser.add_argument(
+        "--preset",
+        help="The configuration preset to use for decompilation.",
+        choices=DECOMPILATION_PRESETS,
+        default="default",
+    )
+    decompile_cmd_parser.add_argument(
+        "--functions",
+        help="""
+        The functions to decompile. Functions can either be expressed as names found in the
+        symbols of the binary or as addresses like: 0x401000.""",
+        nargs="+",
+    )
+
+    disassemble_cmd_parser = subparsers.add_parser("disassemble", aliases=["dis"], help=disassemble.__doc__)
+    disassemble_cmd_parser.set_defaults(func=disassemble)
+    disassemble_cmd_parser.add_argument(
+        "--functions",
+        help="""
+        The functions to disassemble. Functions can either be expressed as names found in the
+        symbols of the binary or as addresses like: 0x401000.""",
+        nargs="+",
+    )
+
+    args = parser.parse_args()
+    args.func(args)
+
+
+if __name__ == "__main__":
+    main()

{angr-9.2.149 → angr-9.2.150}/angr/analyses/decompiler/optimization_passes/flip_boolean_cmp.py

@@ -8,6 +8,7 @@ from ailment.expression import Op
 from angr.analyses.decompiler.structuring.structurer_nodes import ConditionNode
 from angr.analyses.decompiler.utils import (
     structured_node_is_simple_return,
+    structured_node_is_simple_return_strict,
     sequence_to_statements,
     structured_node_has_multi_predecessors,
 )
@@ -44,7 +45,7 @@ class FlipBooleanWalker(SequenceWalker):
                 and node.true_node is not None
                 and node.false_node is None
                 and idx < len(seq_node.nodes) - 1
-                and structured_node_is_simple_return(seq_node.nodes[idx + 1], self._graph)
+                and structured_node_is_simple_return_strict(seq_node.nodes[idx + 1])
                 and node not in type1_condition_nodes
             ):
                 # Type 2: Special Filter:

{angr-9.2.149 → angr-9.2.150}/angr/analyses/decompiler/utils.py

@@ -723,6 +723,23 @@ def structured_node_is_simple_return(
     return False
 
 
+def structured_node_is_simple_return_strict(node: BaseNode | SequenceNode | MultiNode | ailment.Block) -> bool:
+    """
+    Returns True iff the node exclusively contains a return statement.
+    """
+    if isinstance(node, (SequenceNode, MultiNode)) and node.nodes:
+        flat_blocks = _flatten_structured_node(node)
+        if len(flat_blocks) != 1:
+            return False
+        node = flat_blocks[-1]
+
+    return (
+        isinstance(node, ailment.Block)
+        and len(node.statements) == 1
+        and isinstance(node.statements[0], ailment.Stmt.Return)
+    )
+
+
 def is_statement_terminating(stmt: ailment.statement.Statement, functions) -> bool:
     if isinstance(stmt, ailment.Stmt.Return):
         return True

{angr-9.2.149 → angr-9.2.150}/angr/analyses/disassembly.py

@@ -1159,6 +1159,7 @@ class Disassembly(Analysis):
         show_bytes: bool = False,
         ascii_only: bool | None = None,
         color: bool = True,
+        min_edge_depth: int = 0,
     ) -> str:
         """
         Render the disassembly to a string, with optional edges and addresses.
@@ -1288,7 +1289,7 @@ class Disassembly(Analysis):
             for f, t in sorted(edges_by_line, key=lambda e: abs(e[0] - e[1])):
                 add_edge_to_buffer(edge_buf, ref_buf, f, t, lambda s: ansi_color(s, edge_col), ascii_only=ascii_only)
                 add_edge_to_buffer(ref_buf, ref_buf, f, t, ascii_only=ascii_only)
-            max_edge_depth = max(map(len, ref_buf))
+            max_edge_depth = max(*map(len, ref_buf), min_edge_depth)
 
             # Justify edge and combine with disassembly
             for i, line in enumerate(buf):

{angr-9.2.149 → angr-9.2.150}/angr/analyses/patchfinder.py

@@ -97,7 +97,7 @@ class PatchFinderAnalysis(Analysis):
     # - Looking for instruction partials broken by a patch (nodecode)
     # - Unusual stack manipulation
 
-    atypical_alignments: list[Function]
+    atypical_alignments: list[AtypicallyAlignedFunction]
     possibly_patched_out: list[PatchedOutFunctionality]
 
     def __init__(self):

{angr-9.2.149 → angr-9.2.150}/angr/analyses/typehoon/typehoon.py

@@ -263,7 +263,10 @@ class Typehoon(Analysis):
                     max_offset = offsets[-1]
                     field0_size = 1
                     if not isinstance(field0, TopType):
-                        field0_size = field0.size
+                        try:
+                            field0_size = field0.size
+                        except NotImplementedError:
+                            field0_size = 1
                     count = (max_offset + field0_size) // alignment
                     return Array(field0, count=count)
 

{angr-9.2.149 → angr-9.2.150}/angr/engines/pcode/lifter.py

@@ -427,6 +427,13 @@ class IRSB:
 
         return exits
 
+    @property
+    def is_noop_block(self) -> bool:
+        """
+        Returns True if this block is a no-op block (i.e. it has no instructions and no jumps).
+        """
+        return not any(op.opcode != pypcode.OpCode.IMARK for op in self._ops)
+
     #
     # private methods
     #

{angr-9.2.149 → angr-9.2.150}/angr/utils/graph.py

@@ -672,9 +672,40 @@ class GraphUtils:
         addrs_to_index = {n.addr: i for (i, n) in enumerate(post_order)}
         return sorted(nodes, key=lambda n: addrs_to_index[n.addr], reverse=True)
 
+    @staticmethod
+    def _sort_node(node):
+        """
+        A sorter to make a deterministic order of nodes.
+        """
+        if hasattr(node, "addr"):
+            return node.addr
+        return node
+
+    @staticmethod
+    def _sort_edge(edge):
+        """
+        A sorter to make a deterministic order of edges.
+        """
+        _src, _dst = edge
+        src_addr, dst_addr = 0, 0
+        if hasattr(_src, "addr"):
+            src_addr = _src.addr
+        elif isinstance(_src, int):
+            src_addr = _src
+
+        if hasattr(_dst, "addr"):
+            dst_addr = _dst.addr
+        elif isinstance(_dst, int):
+            dst_addr = _dst
+
+        return src_addr + dst_addr
+
     @staticmethod
     def quasi_topological_sort_nodes(
-        graph: networkx.DiGraph, nodes: list | None = None, loop_heads: list | None = None
+        graph: networkx.DiGraph,
+        nodes: list | None = None,
+        loop_heads: list | None = None,
+        panic_mode_threshold: int = 3000,
     ) -> list:
         """
         Sort a given set of nodes from a graph based on the following rules:
@@ -688,6 +719,7 @@ class GraphUtils:
         :param graph:       A local transition graph of the function.
         :param nodes:       A list of nodes to sort. None if you want to sort all nodes inside the graph.
         :param loop_heads:  A list of nodes that should be treated loop heads.
+        :param panic_mode_threshold: Threshold of nodes in an SCC to begin aggressively removing edges.
         :return:            A list of ordered nodes.
         """
 
@@ -703,27 +735,8 @@ class GraphUtils:
         # find all strongly connected components in the graph
         sccs = [scc for scc in networkx.strongly_connected_components(graph) if len(scc) > 1]
 
-        def _sort_edge(edge):
-            """
-            A sorter to make a deterministic order of edges.
-            """
-            _src, _dst = edge
-            src_addr, dst_addr = 0, 0
-            if hasattr(_src, "addr"):
-                src_addr = _src.addr
-            elif isinstance(_src, int):
-                src_addr = _src
-
-            if hasattr(_dst, "addr"):
-                dst_addr = _dst.addr
-            elif isinstance(_dst, int):
-                dst_addr = _dst
-
-            return src_addr + dst_addr
-
         # collapse all strongly connected components
-        edges = sorted(graph.edges(), key=_sort_edge)
-        for src, dst in edges:
+        for src, dst in sorted(graph.edges(), key=GraphUtils._sort_edge):
             scc_index = GraphUtils._components_index_node(sccs, src)
             if scc_index is not None:
                 src = SCCPlaceholder(scc_index)
@@ -754,7 +767,13 @@ class GraphUtils:
         ordered_nodes = []
         for n in tmp_nodes:
             if isinstance(n, SCCPlaceholder):
-                GraphUtils._append_scc(graph, ordered_nodes, sccs[n.scc_id], loop_head_candidates=loop_heads)
+                GraphUtils._append_scc(
+                    graph,
+                    ordered_nodes,
+                    sccs[n.scc_id],
+                    loop_head_candidates=loop_heads,
+                    panic_mode_threshold=panic_mode_threshold,
+                )
             else:
                 ordered_nodes.append(n)
 
@@ -771,7 +790,11 @@ class GraphUtils:
 
     @staticmethod
     def _append_scc(
-        graph: networkx.DiGraph, ordered_nodes: list, scc: set, loop_head_candidates: list | None = None
+        graph: networkx.DiGraph,
+        ordered_nodes: list,
+        scc: set,
+        loop_head_candidates: list | None = None,
+        panic_mode_threshold: int = 3000,
     ) -> None:
         """
         Append all nodes from a strongly connected component to a list of ordered nodes and ensure the topological
@@ -780,6 +803,7 @@ class GraphUtils:
         :param graph: The graph where all nodes belong to.
         :param ordered_nodes:     Ordered nodes.
         :param scc:           A set of nodes that forms a strongly connected component in the graph.
+        :param panic_mode_threshold: Threshold of nodes in an SCC to begin aggressively removing edges.
         """
 
         loop_head = None
@@ -817,8 +841,8 @@ class GraphUtils:
                     break
 
         if loop_head is None:
-            # randomly pick one
-            loop_head = next(iter(scc))
+            # pick the first one
+            loop_head = sorted(scc, key=GraphUtils._sort_node)[0]
 
         subgraph: networkx.DiGraph = graph.subgraph(scc).copy()
         for src, _ in list(subgraph.in_edges(loop_head)):
@@ -828,8 +852,8 @@ class GraphUtils:
         # will take too long to converge if we only remove one node out of the component each time. we introduce a
         # panic mode that will aggressively remove edges
 
-        if len(subgraph) > 3000 and len(subgraph.edges) > len(subgraph) * 1.4:
-            for n0, n1 in sorted(dfs_back_edges(subgraph, loop_head), key=lambda x: (x[0].addr, x[0].addr)):
+        if len(subgraph) > panic_mode_threshold and len(subgraph.edges) > len(subgraph) * 1.4:
+            for n0, n1 in sorted(dfs_back_edges(subgraph, loop_head), key=GraphUtils._sort_edge):
                 subgraph.remove_edge(n0, n1)
                 if len(subgraph.edges) <= len(subgraph) * 1.4:
                     break

{angr-9.2.149 → angr-9.2.150/angr.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.149
+Version: 9.2.150
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.149
-Requires-Dist: archinfo==9.2.149
+Requires-Dist: ailment==9.2.150
+Requires-Dist: archinfo==9.2.150
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.149
-Requires-Dist: cle==9.2.149
+Requires-Dist: claripy==9.2.150
+Requires-Dist: cle==9.2.150
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -31,7 +31,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.149
+Requires-Dist: pyvex==9.2.150
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.149 → angr-9.2.150}/angr.egg-info/requires.txt

@@ -1,12 +1,12 @@
 cxxheaderparser
 GitPython
-ailment==9.2.149
-archinfo==9.2.149
+ailment==9.2.150
+archinfo==9.2.150
 cachetools
 capstone==5.0.3
 cffi>=1.14.0
-claripy==9.2.149
-cle==9.2.149
+claripy==9.2.150
+cle==9.2.150
 mulpyplexer
 networkx!=2.8.1,>=2.0
 protobuf>=5.28.2
@@ -14,7 +14,7 @@ psutil
 pycparser>=2.18
 pydemumble
 pyformlang
-pyvex==9.2.149
+pyvex==9.2.150
 rich>=13.1.0
 sortedcontainers
 sympy

{angr-9.2.149 → angr-9.2.150}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=61.2", "wheel", "pyvex==9.2.149"]
+requires = ["setuptools>=61.2", "wheel", "pyvex==9.2.150"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -19,13 +19,13 @@ requires-python = ">=3.10"
 dependencies = [
     "cxxheaderparser",
     "GitPython",
-    "ailment==9.2.149",
-    "archinfo==9.2.149",
+    "ailment==9.2.150",
+    "archinfo==9.2.150",
     "cachetools",
     "capstone==5.0.3",
     "cffi>=1.14.0",
-    "claripy==9.2.149",
-    "cle==9.2.149",
+    "claripy==9.2.150",
+    "cle==9.2.150",
     "mulpyplexer",
     "networkx!=2.8.1,>=2.0",
     "protobuf>=5.28.2",
@@ -33,7 +33,7 @@ dependencies = [
     "pycparser>=2.18",
     "pydemumble",
     "pyformlang",
-    "pyvex==9.2.149",
+    "pyvex==9.2.150",
     "rich>=13.1.0",
     "sortedcontainers",
     "sympy",

{angr-9.2.149 → angr-9.2.150}/tests/test_cli.py

@@ -7,7 +7,9 @@ __package__ = __package__ or "tests"  # pylint:disable=redefined-builtin
 import io
 import os
 import re
+import sys
 import unittest
+from unittest import mock
 
 import angr
 from angr.__main__ import main
@@ -20,9 +22,9 @@ test_location = os.path.join(bin_location, "tests")
 
 
 def run_cli(*args):
-    output = io.StringIO()
-    main(args, output)
-    return output.getvalue()
+    with mock.patch("sys.argv", [sys.executable, *args]), mock.patch("sys.stdout", new=io.StringIO()) as fake_out:
+        main()
+        return fake_out.getvalue()
 
 
 class TestCommandLineInterface(unittest.TestCase):
@@ -32,17 +34,17 @@ class TestCommandLineInterface(unittest.TestCase):
         f2 = "main"
 
         # test a single function
-        assert run_cli("decompile", bin_path, "--functions", f1) == decompile_functions(bin_path, [f1]) + "\n"
+        assert run_cli(bin_path, "decompile", "--functions", f1) == decompile_functions(bin_path, [f1]) + "\n"
 
         # test multiple functions
-        assert run_cli("decompile", bin_path, "--functions", f1, f2) == decompile_functions(bin_path, [f1, f2]) + "\n"
+        assert run_cli(bin_path, "decompile", "--functions", f1, f2) == decompile_functions(bin_path, [f1, f2]) + "\n"
 
     def test_structuring(self):
         bin_path = os.path.join(test_location, "x86_64", "decompiler", "sailr_motivating_example")
         f1 = "schedule_job"
 
-        dream_cli = run_cli("decompile", bin_path, "--no-casts", "--functions", f1, "--structurer", "dream")
-        sailr_cli = run_cli("decompile", bin_path, "--functions", f1, "--structurer", "sailr")
+        dream_cli = run_cli(bin_path, "decompile", "--no-casts", "--functions", f1, "--structurer", "dream")
+        sailr_cli = run_cli(bin_path, "decompile", "--functions", f1, "--structurer", "sailr")
         assert dream_cli.count("goto") == 0
         assert dream_cli != sailr_cli
 
@@ -55,12 +57,12 @@ class TestCommandLineInterface(unittest.TestCase):
         f1_offset = f1_default_addr - default_base_addr
 
         # function resolving is based on symbol
-        sym_based_dec = run_cli("decompile", bin_path, "--functions", f1, "--preset", "full")
+        sym_based_dec = run_cli(bin_path, "decompile", "--functions", f1, "--preset", "full")
         # function resolving is based on the address (with default angr loading)
-        base_addr_dec = run_cli("decompile", bin_path, "--functions", hex(f1_default_addr), "--preset", "full")
+        base_addr_dec = run_cli(bin_path, "decompile", "--functions", hex(f1_default_addr), "--preset", "full")
         # function resolving is based on the address (with base address specified)
         offset_dec = run_cli(
-            "decompile", bin_path, "--functions", hex(f1_offset), "--base-addr", hex(0), "--preset", "full"
+            bin_path, "--base-addr", "0x0", "decompile", "--functions", hex(f1_offset), "--preset", "full"
         )
 
         # since the externs can be unpredictable, we only check the function name down
@@ -75,6 +77,30 @@ class TestCommandLineInterface(unittest.TestCase):
 
         assert sym_based_dec == base_addr_dec == offset_dec
 
+    def test_disassembly(self):
+        bin_path = os.path.join(test_location, "x86_64", "fauxware")
+        disasm = run_cli(bin_path, "disassemble")
+        funcs = {
+            "_init",
+            "_start",
+            "call_gmon_start",
+            "__do_global_dtors_aux",
+            "frame_dummy",
+            "authenticate",
+            "accepted",
+            "rejected",
+            "main",
+            "__libc_csu_init",
+            "__libc_csu_fini",
+            "__do_global_ctors_aux",
+            "_fini",
+        }
+        substrs = [f"{f}:" for f in funcs]
+        substrs += "40071d  55              push    rbp"
+
+        for s in substrs:
+            assert s in disasm
+
 
 if __name__ == "__main__":
     unittest.main()