angr 9.2.152__py3-none-win_amd64.whl → 9.2.154__py3-none-win_amd64.whl

angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.152"
+__version__ = "9.2.154"
 
 if bytes is str:
     raise Exception(

angr/analyses/analysis.py

@@ -5,7 +5,7 @@ import sys
 import contextlib
 from collections import defaultdict
 from inspect import Signature
-from typing import TYPE_CHECKING, TypeVar, Generic, cast
+from typing import TYPE_CHECKING, TypeVar, Generic, cast, Any
 from collections.abc import Callable
 from types import NoneType
 from itertools import chain
@@ -111,7 +111,7 @@ class AnalysisLogEntry:
 A = TypeVar("A", bound="Analysis")
 
 
-class AnalysesHub(PluginVendor[A]):
+class AnalysesHub(PluginVendor[Any]):
     """
     This class contains functions for all the registered and runnable analyses,
     """
@@ -123,7 +123,7 @@ class AnalysesHub(PluginVendor[A]):
     def _init_plugin(self, plugin_cls: type[A]) -> AnalysisFactory[A]:
         return AnalysisFactory(self.project, plugin_cls)
 
-    def __getstate__(self):
+    def __getstate__(self):  # type: ignore[reportIncompatibleMethodOverride]
         s = super().__getstate__()
         return (s, self.project)
 

angr/analyses/calling_convention/fact_collector.py

@@ -6,7 +6,6 @@ from collections import defaultdict
 import pyvex
 import claripy
 
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from angr.utils.bits import s2u, u2s
 from angr.block import Block
 from angr.analyses.analysis import Analysis
@@ -15,7 +14,8 @@ from angr.knowledge_plugins.functions import Function
 from angr.codenode import BlockNode, HookNode
 from angr.engines.light import SimEngineNostmtVEX, SimEngineLight, SpOffset, RegisterOffset
 from angr.calling_conventions import SimRegArg, SimStackArg, default_cc
-from angr.sim_type import SimTypeBottom, dereference_simtype, SimTypeFunction
+from angr.sim_type import SimTypeBottom, SimTypeFunction
+from angr.utils.types import dereference_simtype_by_lib
 from .utils import is_sane_register_variable
 
 if TYPE_CHECKING:
@@ -121,7 +121,7 @@ class SimEngineFactCollectorVEX(
         if self.block.vex.jumpkind == "Ijk_Call" and self.arch.ret_offset is not None:
             self.state.register_written(self.arch.ret_offset, self.arch.bytes)
 
-    def _top(self, bits: int):
+    def _top(self, bits: int):  # type: ignore
         return None
 
     def _is_top(self, expr: Any) -> bool:
@@ -190,13 +190,13 @@ class SimEngineFactCollectorVEX(
         self.state.register_read(expr.offset, bits // self.arch.byte_width)
         return RegisterOffset(bits, expr.offset, 0)
 
-    def _handle_expr_GetI(self, expr):
+    def _handle_expr_GetI(self, expr):  # type: ignore
         return None
 
-    def _handle_expr_ITE(self, expr):
+    def _handle_expr_ITE(self, expr):  # type: ignore
         return None
 
-    def _handle_expr_Load(self, expr):
+    def _handle_expr_Load(self, expr):  # type: ignore
         addr = self._expr(expr.addr)
         if isinstance(addr, SpOffset):
             self.state.stack_read(addr.offset, expr.result_size(self.tyenv) // self.arch.byte_width)
@@ -206,7 +206,7 @@ class SimEngineFactCollectorVEX(
     def _handle_expr_RdTmp(self, expr):
         return self.state.tmps.get(expr.tmp, None)
 
-    def _handle_expr_VECRET(self, expr):
+    def _handle_expr_VECRET(self, expr):  # type: ignore
         return None
 
     @binop_handler
@@ -444,13 +444,7 @@ class FactCollector(Analysis):
                             proto = func_succ.prototype
                             if func_succ.prototype_libname is not None:
                                 # we need to deref the prototype in case it uses SimTypeRef internally
-                                type_collections = []
-                                for prototype_lib in SIM_LIBRARIES[func_succ.prototype_libname]:
-                                    if prototype_lib.type_collection_names:
-                                        for typelib_name in prototype_lib.type_collection_names:
-                                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                                if type_collections:
-                                    proto = dereference_simtype(proto, type_collections)
+                                proto = dereference_simtype_by_lib(proto, func_succ.prototype_libname)
 
                             assert isinstance(proto, SimTypeFunction) and proto.returnty is not None
                             returnty_size = proto.returnty.with_arch(self.project.arch).size

angr/analyses/cfg/cfg_base.py

@@ -1515,7 +1515,7 @@ class CFGBase(Analysis):
         Revisit the entire control flow graph, create Function instances accordingly, and correctly put blocks into
         each function.
 
-        Although Function objects are crated during the CFG recovery, they are neither sound nor accurate. With a
+        Although Function objects are created during the CFG recovery, they are neither sound nor accurate. With a
         pre-constructed CFG, this method rebuilds all functions bearing the following rules:
 
             - A block may only belong to one function.

angr/analyses/cfg/cfg_fast.py

@@ -1554,6 +1554,45 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                 }:
                     func.info["is_alloca_probe"] = True
 
+            # determine if the function is _guard_xfg_dispatch_icall_nop or _guard_xfg_dispatch_icall_fptr
+            if func is not None and not func.is_simprocedure and len(func.block_addrs_set) in {1, 2}:
+                # _guard_xfg_dispatch_icall_nop jumps to _guard_xfg_dispatch_icall_fptr, but we may or may not identify
+                # _guard_xfg_dispatch_icall_fptr as a separate function.
+                # so, two possibilities:
+                # - _guard_xfg_dispatch_icall_nop is a function with one block and jumps to
+                #   _guard_xfg_dispatch_icall_fptr.
+                # - _guard_xfg_dispatch_icall_nop is a function with 2 blocks, and the second block is the body of
+                #   _guard_xfg_dispatch_icall_fptr.
+                try:
+                    block = func.get_block(func.addr)
+                except SimTranslationError:
+                    block = None
+                if block is not None and block.instructions == 1 and len(block.capstone.insns) == 1:
+                    insn = block.capstone.insns[0]
+                    if block.bytes == b"\xff\xe0":
+                        func.info["jmp_rax"] = True
+                    elif (
+                        insn.mnemonic == "jmp"
+                        and insn.operands[0].type == capstone.x86.X86_OP_MEM
+                        and insn.operands[0].mem.base == capstone.x86.X86_REG_RIP
+                        and insn.operands[0].mem.disp > 0
+                        and insn.operands[0].mem.index == 0
+                    ):
+                        # where is it jumping to?
+                        jumpout_targets = list(self.graph.successors(self.model.get_any_node(func.addr)))
+                        if len(jumpout_targets) == 1:
+                            jumpout_target = jumpout_targets[0].addr
+                            if len(func.block_addrs_set) == 1 and len(func.jumpout_sites) == 1:
+                                if (
+                                    self.kb.functions.contains_addr(jumpout_target)
+                                    and self.kb.functions.get_by_addr(jumpout_target).get_block(jumpout_target).bytes
+                                    == b"\xff\xe0"
+                                ):
+                                    func.info["jmp_rax"] = True
+                            elif len(func.block_addrs_set) == 2 and func.get_block(jumpout_target).bytes == b"\xff\xe0":
+                                # check the second block and ensure it's jmp rax
+                                func.info["jmp_rax"] = True
+
         elif self.project.arch.name == "X86":
             # determine if the function is __alloca_probe
             func = self.kb.functions.get_by_addr(func_addr) if self.kb.functions.contains_addr(func_addr) else None
@@ -1882,7 +1921,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     if cfg_node is None:
                         continue
                     func_addr = cfg_node.function_address
-                    if func_addr not in tested_func_addrs:
+                    if func_addr not in tested_func_addrs and self.kb.functions.contains_addr(func_addr):
                         func = self.kb.functions.get_by_addr(func_addr)
                         if not security_check_cookie_found and is_function_security_check_cookie(
                             func, self.project, security_cookie_addr

angr/analyses/decompiler/ail_simplifier.py

@@ -203,7 +203,6 @@ class AILSimplifier(Analysis):
         AILGraphWalker(self.func_graph, _handler, replace_nodes=True).walk()
         self.blocks = {}
 
-    @timethis
     def _compute_reaching_definitions(self) -> SRDAModel:
         # Computing reaching definitions or return the cached one
         if self._reaching_definitions is not None:

angr/analyses/decompiler/callsite_maker.py

@@ -1,5 +1,5 @@
 from __future__ import annotations
-from typing import Any, TYPE_CHECKING
+from typing import cast, Any, TYPE_CHECKING
 import copy
 import logging
 
@@ -14,7 +14,6 @@ from angr.sim_type import (
     SimTypeChar,
     SimTypeInt,
     SimTypeFloat,
-    dereference_simtype,
     SimTypeFunction,
     SimTypeLongLong,
 )
@@ -22,7 +21,7 @@ from angr.calling_conventions import SimReferenceArgument, SimRegArg, SimStackAr
 from angr.knowledge_plugins.key_definitions.constants import OP_BEFORE
 from angr.analyses import Analysis, register_analysis
 from angr.analyses.s_reaching_definitions import SRDAView
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
+from angr.utils.types import dereference_simtype_by_lib
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.functions import Function
@@ -37,12 +36,14 @@ class CallSiteMaker(Analysis):
     Add calling convention, declaration, and args to a call site.
     """
 
-    def __init__(self, block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager: Manager = None):
+    def __init__(
+        self, block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager: Manager | None = None
+    ):
         self.block = block
 
         self._reaching_definitions = reaching_definitions
         self._stack_pointer_tracker = stack_pointer_tracker
-        self._ail_manager = ail_manager
+        self._ail_manager: Manager | None = ail_manager
 
         self.result_block = None
         self.stack_arg_offsets: set[tuple[int, int]] | None = None  # call ins addr, stack_offset
@@ -109,16 +110,8 @@ class CallSiteMaker(Analysis):
             # make sure the function prototype is resolved.
             # TODO: Cache resolved function prototypes globally
             prototype_libname = func.prototype_libname
-            type_collections = []
             if prototype_libname is not None:
-                for prototype_lib in SIM_LIBRARIES[prototype_libname]:
-                    if prototype_lib.type_collection_names:
-                        for typelib_name in prototype_lib.type_collection_names:
-                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-            if type_collections:
-                prototype = dereference_simtype(prototype, type_collections).with_arch(  # type: ignore
-                    self.project.arch
-                )
+                prototype = cast(SimTypeFunction, dereference_simtype_by_lib(prototype, prototype_libname))
 
         args = []
         arg_vvars = []
@@ -151,6 +144,10 @@ class CallSiteMaker(Analysis):
                     # across registers). most importantly, a ComboArg represents one variable, not multiple, but we
                     # have no way to know that until later down the pipeline.
                     expanded_arg_locs += arg_loc.locations
+                elif isinstance(arg_loc, SimStructArg):
+                    expanded_arg_locs += [  # type: ignore
+                        arg_loc.locs[field_name] for field_name in arg_loc.struct.fields if field_name in arg_loc.locs
+                    ]
                 elif isinstance(arg_loc, (SimRegArg, SimStackArg, SimReferenceArgument)):
                     expanded_arg_locs.append(arg_loc)
                 else:
@@ -195,12 +192,15 @@ class CallSiteMaker(Analysis):
                         if vvar_def_reg_offset is not None and offset > vvar_def_reg_offset:
                             # we need to shift the value
                             vvar_use = Expr.BinaryOp(
-                                self._ail_manager.next_atom(),
+                                self._ail_manager.next_atom() if self._ail_manager is not None else None,
                                 "Shr",
                                 [
                                     vvar_use,
                                     Expr.Const(
-                                        self._ail_manager.next_atom(), None, (offset - vvar_def_reg_offset) * 8, 8
+                                        self._ail_manager.next_atom() if self._ail_manager is not None else None,
+                                        None,
+                                        (offset - vvar_def_reg_offset) * 8,
+                                        8,
                                     ),
                                 ],
                                 **vvar_use.tags,
@@ -208,7 +208,7 @@ class CallSiteMaker(Analysis):
                         if vvar_def.size > arg_loc.size:
                             # we need to narrow the value
                             vvar_use = Expr.Convert(
-                                self._ail_manager.next_atom(),
+                                self._ail_manager.next_atom() if self._ail_manager is not None else None,
                                 vvar_use.bits,
                                 arg_loc.size * self.project.arch.byte_width,
                                 False,

angr/analyses/decompiler/ccall_rewriters/x86_ccalls.py

@@ -15,6 +15,23 @@ X86_CondBitOffsets = data["X86"]["CondBitOffsets"]
 class X86CCallRewriter(CCallRewriterBase):
     """
     Implements VEX ccall rewriter for X86.
+
+    From libVEX:
+
+    A summary of the field usages is:
+
+    Operation          DEP1               DEP2               NDEP
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    add/sub/mul        first arg          second arg         unused
+    adc/sbb            first arg          (second arg)
+                                          XOR old_carry      old_carry
+    and/or/xor         result             zero               unused
+    inc/dec            result             zero               old_carry
+    shl/shr/sar        result             subshifted-        unused
+                                          result
+    rol/ror            result             zero               old_flags
+    copy               old_flags          zero               unused.
     """
 
     __slots__ = ()
@@ -28,7 +45,7 @@ class X86CCallRewriter(CCallRewriterBase):
             if isinstance(cond, Expr.Const) and isinstance(op, Expr.Const):
                 cond_v = cond.value
                 op_v = op.value
-                if cond_v == X86_CondTypes["CondLE"]:  # noqa: SIM102
+                if cond_v == X86_CondTypes["CondLE"]:
                     if op_v in {
                         X86_OpTypes["G_CC_OP_SUBB"],
                         X86_OpTypes["G_CC_OP_SUBW"],
@@ -52,6 +69,198 @@ class X86CCallRewriter(CCallRewriterBase):
 
                         r = Expr.BinaryOp(ccall.idx, "CmpLE", (dep_1, dep_2), True, **ccall.tags)
                         return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
+                elif cond_v == X86_CondTypes["CondO"]:
+                    op_v = op.value
+                    ret_cond = None
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_UMULB"],
+                        X86_OpTypes["G_CC_OP_UMULW"],
+                        X86_OpTypes["G_CC_OP_UMULL"],
+                    }:
+                        # dep_1 * dep_2 >= max_signed_byte/word/dword
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Mul",
+                            (dep_1, dep_2),
+                            bits=dep_1.bits * 2,
+                            **ccall.tags,
+                        )
+                        max_signed = Expr.Const(
+                            None,
+                            None,
+                            (1 << (dep_1.bits - 1)),
+                            bits=dep_1.bits * 2,
+                            **ccall.tags,
+                        )
+                        ret_cond = Expr.BinaryOp(None, "CmpGE", (ret, max_signed), signed=False, **ccall.tags)
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_INCB"],
+                        X86_OpTypes["G_CC_OP_INCW"],
+                        X86_OpTypes["G_CC_OP_INCL"],
+                    }:
+                        # dep_1 is the result
+                        overflowed = Expr.Const(
+                            None,
+                            None,
+                            1 << (dep_1.bits - 1),
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        ret_cond = Expr.BinaryOp(None, "CmpEQ", (dep_1, overflowed), **ccall.tags)
+
+                    if ret_cond is not None:
+                        return Expr.ITE(
+                            ccall.idx,
+                            ret_cond,
+                            Expr.Const(None, None, 0, 1, **ccall.tags),
+                            Expr.Const(None, None, 1, 1, **ccall.tags),
+                            **ccall.tags,
+                        )
+                elif cond_v == X86_CondTypes["CondZ"]:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_ADDB"],
+                        X86_OpTypes["G_CC_OP_ADDW"],
+                        X86_OpTypes["G_CC_OP_ADDL"],
+                    }:
+                        # dep_1 + dep_2 == 0
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Add",
+                            (dep_1, dep_2),
+                            bits=dep_1.bits,
+                            **ccall.tags,
+                        )
+                        zero = Expr.Const(
+                            None,
+                            None,
+                            0,
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (ret, zero),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 - dep_2 == 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (dep_1, dep_2),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 == 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            True,
+                            **ccall.tags,
+                        )
+                elif cond_v == X86_CondTypes["CondL"]:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 - dep_2 < 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLT",
+                            (dep_1, dep_2),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 < 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLT",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            True,
+                            **ccall.tags,
+                        )
+                elif cond_v in {
+                    X86_CondTypes["CondBE"],
+                    X86_CondTypes["CondB"],
+                }:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_ADDB"],
+                        X86_OpTypes["G_CC_OP_ADDW"],
+                        X86_OpTypes["G_CC_OP_ADDL"],
+                    }:
+                        # dep_1 + dep_2 <= 0  if CondBE
+                        # dep_1 + dep_2 < 0   if CondB
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Add",
+                            (dep_1, dep_2),
+                            signed=False,
+                            bits=dep_1.bits,
+                            **ccall.tags,
+                        )
+                        zero = Expr.Const(
+                            None,
+                            None,
+                            0,
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (ret, zero),
+                            False,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 <= dep_2  if CondBE
+                        # dep_1 < dep_2   if CondB
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (dep_1, dep_2),
+                            False,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 <= 0  if CondBE
+                        # dep_1 < 0   if CondB
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            False,
+                            **ccall.tags,
+                        )
         return None
 
     @staticmethod

angr/analyses/decompiler/clinic.py

@@ -12,7 +12,6 @@ import networkx
 import capstone
 
 import ailment
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 
 from angr.errors import AngrDecompilationError
 from angr.knowledge_base import KnowledgeBase
@@ -22,9 +21,9 @@ from angr.knowledge_plugins.key_definitions import atoms
 from angr.codenode import BlockNode
 from angr.utils import timethis
 from angr.utils.graph import GraphUtils
+from angr.utils.types import dereference_simtype_by_lib
 from angr.calling_conventions import SimRegArg, SimStackArg, SimFunctionArgument
 from angr.sim_type import (
-    dereference_simtype,
     SimTypeChar,
     SimTypeInt,
     SimTypeLongLong,
@@ -485,6 +484,8 @@ class Clinic(Analysis):
 
         # duplicate orphaned conditional jump blocks
         ail_graph = self._duplicate_orphaned_cond_jumps(ail_graph)
+        # rewrite jmp_rax function calls
+        ail_graph = self._rewrite_jump_rax_calls(ail_graph)
 
         # Transform the graph into partial SSA form
         self._update_progress(35.0, text="Transforming to partial-SSA form")
@@ -930,7 +931,7 @@ class Clinic(Analysis):
                     self.kb.callsite_prototypes.set_prototype(callsite.addr, cc.cc, cc.prototype, manual=False)
                     if func_graph is not None and cc.prototype.returnty is not None:
                         # patch the AIL call statement if we can find one
-                        callsite_ail_block: ailment.Block = next(
+                        callsite_ail_block: ailment.Block | None = next(
                             iter(bb for bb in func_graph if bb.addr == callsite.addr), None
                         )
                         if callsite_ail_block is not None and callsite_ail_block.statements:
@@ -1005,6 +1006,7 @@ class Clinic(Analysis):
         :return:    None
         """
         assert self._func_graph is not None
+        assert self._blocks_by_addr_and_size is not None
 
         for block_node in self._func_graph.nodes():
             ail_block = self._convert(block_node)
@@ -1237,16 +1239,8 @@ class Clinic(Analysis):
                 # make sure the function prototype is resolved.
                 # TODO: Cache resolved function prototypes globally
                 prototype_libname = func.prototype_libname
-                type_collections = []
                 if prototype_libname is not None:
-                    for prototype_lib in SIM_LIBRARIES[prototype_libname]:
-                        if prototype_lib.type_collection_names:
-                            for typelib_name in prototype_lib.type_collection_names:
-                                type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                if type_collections:
-                    prototype = dereference_simtype(prototype, type_collections).with_arch(  # type: ignore
-                        self.project.arch
-                    )
+                    prototype = dereference_simtype_by_lib(prototype, prototype_libname)
 
             if cc is None:
                 l.warning("Call site %#x (callee %s) has an unknown calling convention.", block.addr, repr(func))
@@ -1538,6 +1532,7 @@ class Clinic(Analysis):
             vvar_id_start=self.vvar_id_start,
         )
         self.vvar_id_start = ssailification.max_vvar_id + 1
+        assert ssailification.out_graph is not None
         return ssailification.out_graph
 
     @timethis
@@ -1918,6 +1913,7 @@ class Clinic(Analysis):
                 self._link_variables_on_call(variable_manager, global_variables, block, stmt_idx, stmt, is_expr=False)
 
             elif stmt_type is ailment.Stmt.Return:
+                assert isinstance(stmt, ailment.Stmt.Return)
                 self._link_variables_on_return(variable_manager, global_variables, block, stmt_idx, stmt)
 
     def _link_variables_on_return(
@@ -2178,6 +2174,47 @@ class Clinic(Analysis):
 
         return ail_graph
 
+    def _rewrite_jump_rax_calls(self, ail_graph: networkx.DiGraph) -> networkx.DiGraph:
+        """
+        Rewrite calls to special functions (e.g., guard_dispatch_icall_nop) into `call rax`.
+        """
+
+        if self.project.arch.name != "AMD64":
+            return ail_graph
+        if self._cfg is None:
+            return ail_graph
+
+        for block in ail_graph:
+            if not block.statements:
+                continue
+            assert block.addr is not None
+            last_stmt = block.statements[-1]
+            if isinstance(last_stmt, ailment.Stmt.Call):
+                # we can't examine the call target at this point because constant propagation hasn't run yet; we consult
+                # the CFG instead
+                callsite_node = self._cfg.get_any_node(block.addr, anyaddr=True)
+                if callsite_node is None:
+                    break
+                callees = self._cfg.get_successors(callsite_node, jumpkind="Ijk_Call")
+                if len(callees) != 1:
+                    break
+                callee = callees[0].addr
+                if self.kb.functions.contains_addr(callee):
+                    callee_func = self.kb.functions.get_by_addr(callee)
+                    if callee_func.info.get("jmp_rax", False) is True:
+                        # rewrite this statement into Call(rax)
+                        call_stmt = last_stmt.copy()
+                        call_stmt.target = ailment.Expr.Register(
+                            self._ail_manager.next_atom(),
+                            None,
+                            self.project.arch.registers["rax"][0],
+                            64,
+                            ins_addr=call_stmt.ins_addr,
+                        )
+                        block.statements[-1] = call_stmt
+
+        return ail_graph
+
     def _rewrite_ite_expressions(self, ail_graph):
         cfg = self._cfg
         for block in list(ail_graph):
@@ -2208,6 +2245,7 @@ class Clinic(Analysis):
     def _create_triangle_for_ite_expression(self, ail_graph, block_addr: int, ite_ins_addr: int):
         ite_insn_only_block = self.project.factory.block(ite_ins_addr, num_inst=1)
         ite_insn_size = ite_insn_only_block.size
+        assert ite_insn_size is not None
         if ite_insn_size <= 2:  # we need an address for true_block and another address for false_block
             return None
         if ite_insn_only_block.vex.exit_statements:
@@ -3161,7 +3199,7 @@ class Clinic(Analysis):
                         )
                         break
 
-        if alloca_node is not None:
+        if alloca_node is not None and sp_equal_to is not None:
             stmt0 = alloca_node.statements[1]
             statements = [ailment.Stmt.Call(stmt0.idx, "alloca", args=[sp_equal_to], **stmt0.tags)]
             new_node = ailment.Block(alloca_node.addr, alloca_node.original_size, statements=statements)

angr/analyses/decompiler/decompilation_cache.py

@@ -31,7 +31,7 @@ class DecompilationCache:
         self.parameters: dict[str, Any] = {}
         self.addr = addr
         self.type_constraints: dict[TypeVariable, set[TypeConstraint]] | None = None
-        self.func_typevar = None
+        self.func_typevar: TypeVariable | None = None
         self.var_to_typevar: dict | None = None
         self.codegen: BaseStructuredCodeGenerator | None = None
         self.clinic: Clinic | None = None