angr 9.2.152__tar.gz → 9.2.153__tar.gz

{angr-9.2.152/angr.egg-info → angr-9.2.153}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.152
+Version: 9.2.153
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.152
-Requires-Dist: archinfo==9.2.152
+Requires-Dist: ailment==9.2.153
+Requires-Dist: archinfo==9.2.153
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.152
-Requires-Dist: cle==9.2.152
+Requires-Dist: claripy==9.2.153
+Requires-Dist: cle==9.2.153
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -31,7 +31,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.152
+Requires-Dist: pyvex==9.2.153
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.152 → angr-9.2.153}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.152"
+__version__ = "9.2.153"
 
 if bytes is str:
     raise Exception(

{angr-9.2.152 → angr-9.2.153}/angr/analyses/cfg/cfg_base.py

@@ -1515,7 +1515,7 @@ class CFGBase(Analysis):
         Revisit the entire control flow graph, create Function instances accordingly, and correctly put blocks into
         each function.
 
-        Although Function objects are crated during the CFG recovery, they are neither sound nor accurate. With a
+        Although Function objects are created during the CFG recovery, they are neither sound nor accurate. With a
         pre-constructed CFG, this method rebuilds all functions bearing the following rules:
 
             - A block may only belong to one function.

{angr-9.2.152 → angr-9.2.153}/angr/analyses/cfg/cfg_fast.py

@@ -1554,6 +1554,45 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                 }:
                     func.info["is_alloca_probe"] = True
 
+            # determine if the function is _guard_xfg_dispatch_icall_nop or _guard_xfg_dispatch_icall_fptr
+            if func is not None and not func.is_simprocedure and len(func.block_addrs_set) in {1, 2}:
+                # _guard_xfg_dispatch_icall_nop jumps to _guard_xfg_dispatch_icall_fptr, but we may or may not identify
+                # _guard_xfg_dispatch_icall_fptr as a separate function.
+                # so, two possibilities:
+                # - _guard_xfg_dispatch_icall_nop is a function with one block and jumps to
+                #   _guard_xfg_dispatch_icall_fptr.
+                # - _guard_xfg_dispatch_icall_nop is a function with 2 blocks, and the second block is the body of
+                #   _guard_xfg_dispatch_icall_fptr.
+                try:
+                    block = func.get_block(func.addr)
+                except SimTranslationError:
+                    block = None
+                if block is not None and block.instructions == 1:
+                    insn = block.capstone.insns[0]
+                    if block.bytes == b"\xff\xe0":
+                        func.info["jmp_rax"] = True
+                    elif (
+                        insn.mnemonic == "jmp"
+                        and insn.operands[0].type == capstone.x86.X86_OP_MEM
+                        and insn.operands[0].mem.base == capstone.x86.X86_REG_RIP
+                        and insn.operands[0].mem.disp > 0
+                        and insn.operands[0].mem.index == 0
+                    ):
+                        # where is it jumping to?
+                        jumpout_targets = list(self.graph.successors(self.model.get_any_node(func.addr)))
+                        if len(jumpout_targets) == 1:
+                            jumpout_target = jumpout_targets[0].addr
+                            if len(func.block_addrs_set) == 1 and len(func.jumpout_sites) == 1:
+                                if (
+                                    self.kb.functions.contains_addr(jumpout_target)
+                                    and self.kb.functions.get_by_addr(jumpout_target).get_block(jumpout_target).bytes
+                                    == b"\xff\xe0"
+                                ):
+                                    func.info["jmp_rax"] = True
+                            elif len(func.block_addrs_set) == 2 and func.get_block(jumpout_target).bytes == b"\xff\xe0":
+                                # check the second block and ensure it's jmp rax
+                                func.info["jmp_rax"] = True
+
         elif self.project.arch.name == "X86":
             # determine if the function is __alloca_probe
             func = self.kb.functions.get_by_addr(func_addr) if self.kb.functions.contains_addr(func_addr) else None

{angr-9.2.152 → angr-9.2.153}/angr/analyses/decompiler/ail_simplifier.py

@@ -203,7 +203,6 @@ class AILSimplifier(Analysis):
         AILGraphWalker(self.func_graph, _handler, replace_nodes=True).walk()
         self.blocks = {}
 
-    @timethis
     def _compute_reaching_definitions(self) -> SRDAModel:
         # Computing reaching definitions or return the cached one
         if self._reaching_definitions is not None:

{angr-9.2.152 → angr-9.2.153}/angr/analyses/decompiler/clinic.py

@@ -485,6 +485,8 @@ class Clinic(Analysis):
 
         # duplicate orphaned conditional jump blocks
         ail_graph = self._duplicate_orphaned_cond_jumps(ail_graph)
+        # rewrite jmp_rax function calls
+        ail_graph = self._rewrite_jump_rax_calls(ail_graph)
 
         # Transform the graph into partial SSA form
         self._update_progress(35.0, text="Transforming to partial-SSA form")
@@ -930,7 +932,7 @@ class Clinic(Analysis):
                     self.kb.callsite_prototypes.set_prototype(callsite.addr, cc.cc, cc.prototype, manual=False)
                     if func_graph is not None and cc.prototype.returnty is not None:
                         # patch the AIL call statement if we can find one
-                        callsite_ail_block: ailment.Block = next(
+                        callsite_ail_block: ailment.Block | None = next(
                             iter(bb for bb in func_graph if bb.addr == callsite.addr), None
                         )
                         if callsite_ail_block is not None and callsite_ail_block.statements:
@@ -1005,6 +1007,7 @@ class Clinic(Analysis):
         :return:    None
         """
         assert self._func_graph is not None
+        assert self._blocks_by_addr_and_size is not None
 
         for block_node in self._func_graph.nodes():
             ail_block = self._convert(block_node)
@@ -2178,6 +2181,47 @@ class Clinic(Analysis):
 
         return ail_graph
 
+    def _rewrite_jump_rax_calls(self, ail_graph: networkx.DiGraph) -> networkx.DiGraph:
+        """
+        Rewrite calls to special functions (e.g., guard_dispatch_icall_nop) into `call rax`.
+        """
+
+        if self.project.arch.name != "AMD64":
+            return ail_graph
+        if self._cfg is None:
+            return ail_graph
+
+        for block in ail_graph:
+            if not block.statements:
+                continue
+            assert block.addr is not None
+            last_stmt = block.statements[-1]
+            if isinstance(last_stmt, ailment.Stmt.Call):
+                # we can't examine the call target at this point because constant propagation hasn't run yet; we consult
+                # the CFG instead
+                callsite_node = self._cfg.get_any_node(block.addr, anyaddr=True)
+                if callsite_node is None:
+                    break
+                callees = self._cfg.get_successors(callsite_node, jumpkind="Ijk_Call")
+                if len(callees) != 1:
+                    break
+                callee = callees[0].addr
+                if self.kb.functions.contains_addr(callee):
+                    callee_func = self.kb.functions.get_by_addr(callee)
+                    if callee_func.info.get("jmp_rax", False) is True:
+                        # rewrite this statement into Call(rax)
+                        call_stmt = last_stmt.copy()
+                        call_stmt.target = ailment.Expr.Register(
+                            self._ail_manager.next_atom(),
+                            None,
+                            self.project.arch.registers["rax"][0],
+                            64,
+                            ins_addr=call_stmt.ins_addr,
+                        )
+                        block.statements[-1] = call_stmt
+
+        return ail_graph
+
     def _rewrite_ite_expressions(self, ail_graph):
         cfg = self._cfg
         for block in list(ail_graph):

{angr-9.2.152 → angr-9.2.153}/angr/analyses/decompiler/region_identifier.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from typing import Any
 from itertools import count
 from collections import defaultdict
 import logging
@@ -70,6 +71,9 @@ class RegionIdentifier(Analysis):
         self._largest_successor_tree_outside_loop = largest_successor_tree_outside_loop
         self._force_loop_single_exit = force_loop_single_exit
         self._complete_successors = complete_successors
+        # we keep a dictionary of node and their traversal order in a quasi-topological traversal and update this
+        # dictionary as we update the graph
+        self._node_order: dict[Any, tuple[int, int]] = {}
 
         self._analyze()
 
@@ -102,11 +106,30 @@ class RegionIdentifier(Analysis):
 
         self._start_node = self._get_start_node(graph)
 
+        self._node_order = self._compute_node_order(graph)
+
         self.region = self._make_regions(graph)
 
         # make regions into block address lists
         self.regions_by_block_addrs = self._make_regions_by_block_addrs()
 
+    @staticmethod
+    def _compute_node_order(graph: networkx.DiGraph) -> dict[Any, tuple[int, int]]:
+        sorted_nodes = GraphUtils.quasi_topological_sort_nodes(graph)
+        node_order = {}
+        for i, n in enumerate(sorted_nodes):
+            node_order[n] = i, 0
+        return node_order
+
+    def _sort_nodes(self, nodes: list | set) -> list:
+        """
+        Sorts the nodes in the order specified in self._node_order.
+
+        :param nodes:   A list or set of nodes to be sorted.
+        :return:        A sorted list of nodes.
+        """
+        return sorted(nodes, key=lambda n: self._node_order[n])
+
     def _make_regions_by_block_addrs(self) -> list[list[tuple[int, int | None]]]:
         """
         Creates a list of addr lists representing each region without recursion. A single region is defined
@@ -182,30 +205,6 @@ class RegionIdentifier(Analysis):
             None,
         )
 
-    def _test_reducibility(self):
-        # make a copy of the graph
-        graph = networkx.DiGraph(self._graph)
-
-        # preprocess: make it a super graph
-        self._make_supergraph(graph)
-
-        while True:
-            changed = False
-
-            # find a node with a back-edge, remove the edge (deleting the loop), and replace it with a MultiNode
-            changed |= self._remove_self_loop(graph)
-
-            # find a node that has only one predecessor, and merge it with its predecessor (replace them with a
-            # MultiNode)
-            changed |= self._merge_single_entry_node(graph)
-
-            if not changed:
-                # a fixed-point is reached
-                break
-
-        # Flow graph reducibility, Hecht and Ullman
-        return len(graph.nodes) == 1
-
     def _make_supergraph(self, graph: networkx.DiGraph):
 
         entry_node = None
@@ -236,7 +235,7 @@ class RegionIdentifier(Analysis):
 
     def _find_loop_headers(self, graph: networkx.DiGraph) -> list:
         heads = list({t for _, t in dfs_back_edges(graph, self._start_node)})
-        return GraphUtils.quasi_topological_sort_nodes(graph, heads)
+        return self._sort_nodes(heads)
 
     def _find_initial_loop_nodes(self, graph: networkx.DiGraph, head):
         # TODO optimize
@@ -290,7 +289,7 @@ class RegionIdentifier(Analysis):
         # node.
         subgraph = networkx.DiGraph()
 
-        sorted_refined_exit_nodes = GraphUtils.quasi_topological_sort_nodes(graph, refined_exit_nodes)
+        sorted_refined_exit_nodes = self._sort_nodes(refined_exit_nodes)
         while len(sorted_refined_exit_nodes) > 1 and new_exit_nodes:
             # visit each node in refined_exit_nodes once and determine which nodes to consider as loop nodes
             candidate_nodes = {}
@@ -324,7 +323,7 @@ class RegionIdentifier(Analysis):
 
             sorted_refined_exit_nodes += list(new_exit_nodes)
             sorted_refined_exit_nodes = list(set(sorted_refined_exit_nodes))
-            sorted_refined_exit_nodes = GraphUtils.quasi_topological_sort_nodes(graph, sorted_refined_exit_nodes)
+            sorted_refined_exit_nodes = self._sort_nodes(sorted_refined_exit_nodes)
 
         refined_exit_nodes = set(sorted_refined_exit_nodes)
         refined_loop_nodes = refined_loop_nodes - refined_exit_nodes
@@ -373,37 +372,6 @@ class RegionIdentifier(Analysis):
 
         return refined_loop_nodes, refined_exit_nodes
 
-    def _remove_self_loop(self, graph: networkx.DiGraph):
-        r = False
-
-        while True:
-            for node in graph.nodes():
-                if node in graph[node]:
-                    # found a self loop
-                    self._remove_node(graph, node)
-                    r = True
-                    break
-            else:
-                break
-
-        return r
-
-    def _merge_single_entry_node(self, graph: networkx.DiGraph):
-        r = False
-
-        while True:
-            for node in networkx.dfs_postorder_nodes(graph):
-                preds = list(graph.predecessors(node))
-                if len(preds) == 1:
-                    # merge the two nodes
-                    self._absorb_node(graph, preds[0], node)
-                    r = True
-                    break
-            else:
-                break
-
-        return r
-
     def _make_regions(self, graph: networkx.DiGraph):
         structured_loop_headers = set()
         new_regions = []
@@ -535,7 +503,14 @@ class RegionIdentifier(Analysis):
             abnormal_exit_nodes = set()
 
         region = self._abstract_cyclic_region(
-            graph, refined_loop_nodes, head, normal_entries, abnormal_entries, normal_exit_node, abnormal_exit_nodes
+            graph,
+            refined_loop_nodes,
+            head,
+            normal_entries,
+            abnormal_entries,
+            normal_exit_node,
+            abnormal_exit_nodes,
+            self._node_order,
         )
         if region.successors is not None and len(region.successors) > 1 and self._force_loop_single_exit:
             # multi-successor region. refinement is required
@@ -661,6 +636,10 @@ class RegionIdentifier(Analysis):
             graph.remove_edge(region, succ)
             graph.add_edge(cond, succ, **edge_data)
 
+        # compute the node order of newly created nodes
+        self._node_order[region] = region_node_order = min(self._node_order[node_] for node_ in region.graph)
+        self._node_order[cond] = region_node_order[0], region_node_order[1] + 1
+
     #
     # Acyclic regions
     #
@@ -733,6 +712,7 @@ class RegionIdentifier(Analysis):
                         graph,
                         GraphRegion(node, subgraph, None, None, False, None, cyclic_ancestor=cyclic),
                         [],
+                        self._node_order,
                         secondary_graph=secondary_graph,
                     )
                 continue
@@ -780,7 +760,12 @@ class RegionIdentifier(Analysis):
                         l.debug("Node %r, frontier %r.", node, frontier)
                         # l.debug("Identified an acyclic region %s.", self._dbg_block_list(region.graph.nodes()))
                         self._abstract_acyclic_region(
-                            graph, region, frontier, dummy_endnode=dummy_endnode, secondary_graph=secondary_graph
+                            graph,
+                            region,
+                            frontier,
+                            self._node_order,
+                            dummy_endnode=dummy_endnode,
+                            secondary_graph=secondary_graph,
                         )
                         # assert dummy_endnode not in graph
                         region_created = True
@@ -909,11 +894,17 @@ class RegionIdentifier(Analysis):
             )
         return None
 
+    @staticmethod
     def _abstract_acyclic_region(
-        self, graph: networkx.DiGraph, region, frontier, dummy_endnode=None, secondary_graph=None
+        graph: networkx.DiGraph,
+        region,
+        frontier,
+        node_order: dict[Any, tuple[int, int]],
+        dummy_endnode=None,
+        secondary_graph=None,
     ):
-        in_edges = self._region_in_edges(graph, region, data=True)
-        out_edges = self._region_out_edges(graph, region, data=True)
+        in_edges = RegionIdentifier._region_in_edges(graph, region, data=True)
+        out_edges = RegionIdentifier._region_out_edges(graph, region, data=True)
 
         nodes_set = set()
         for node_ in list(region.graph.nodes()):
@@ -922,6 +913,7 @@ class RegionIdentifier(Analysis):
                 graph.remove_node(node_)
 
         graph.add_node(region)
+        node_order[region] = min(node_order[node_] for node_ in nodes_set)
 
         for src, _, data in in_edges:
             if src not in nodes_set:
@@ -937,7 +929,7 @@ class RegionIdentifier(Analysis):
                     graph.add_edge(region, frontier_node)
 
         if secondary_graph is not None:
-            self._abstract_acyclic_region(secondary_graph, region, {})
+            RegionIdentifier._abstract_acyclic_region(secondary_graph, region, {}, node_order)
 
     @staticmethod
     def _abstract_cyclic_region(
@@ -948,6 +940,7 @@ class RegionIdentifier(Analysis):
         abnormal_entries,
         normal_exit_node,
         abnormal_exit_nodes,
+        node_order: dict[Any, tuple[int, int]],
     ):
         region = GraphRegion(head, None, None, None, True, None)
 
@@ -1019,6 +1012,8 @@ class RegionIdentifier(Analysis):
         graph.add_node(region)
         for src, dst, data in delayed_edges:
             graph.add_edge(src, dst, **data)
+        # update node order
+        node_order[region] = node_order[head]
 
         region.full_graph = full_graph
 
@@ -1039,25 +1034,8 @@ class RegionIdentifier(Analysis):
                 out_edges.append((region, dst, data_))
         return out_edges
 
-    def _remove_node(self, graph: networkx.DiGraph, node):  # pylint:disable=no-self-use
-        in_edges = [(src, dst, data) for (src, dst, data) in graph.in_edges(node, data=True) if src is not node]
-        out_edges = [(src, dst, data) for (src, dst, data) in graph.out_edges(node, data=True) if dst is not node]
-
-        # true case: it forms a region by itself :-)
-        new_node = None if len(in_edges) <= 1 and len(out_edges) <= 1 else MultiNode([node])
-
-        graph.remove_node(node)
-
-        if new_node is not None:
-            for src, _, data in in_edges:
-                graph.add_edge(src, new_node, **data)
-
-            for _, dst, data in out_edges:
-                graph.add_edge(new_node, dst, **data)
-
-    def _merge_nodes(
-        self, graph: networkx.DiGraph, node_a, node_b, force_multinode=False
-    ):  # pylint:disable=no-self-use
+    @staticmethod
+    def _merge_nodes(graph: networkx.DiGraph, node_a, node_b, force_multinode=False):
         in_edges = list(graph.in_edges(node_a, data=True))
         out_edges = list(graph.out_edges(node_b, data=True))
 
@@ -1089,9 +1067,116 @@ class RegionIdentifier(Analysis):
 
         return new_node
 
-    def _absorb_node(
-        self, graph: networkx.DiGraph, node_mommy, node_kiddie, force_multinode=False
-    ):  # pylint:disable=no-self-use
+    def _ensure_jump_at_loop_exit_ends(self, node: Block | MultiNode) -> None:
+        if isinstance(node, Block):
+            if not node.statements:
+                node.statements.append(
+                    Jump(
+                        None,
+                        Const(None, None, node.addr + node.original_size, self.project.arch.bits),
+                        ins_addr=node.addr,
+                    )
+                )
+            else:
+                if not isinstance(first_nonlabel_nonphi_statement(node), ConditionalJump) and not isinstance(
+                    node.statements[-1],
+                    (
+                        Jump,
+                        ConditionalJump,
+                        IncompleteSwitchCaseHeadStatement,
+                    ),
+                ):
+                    node.statements.append(
+                        Jump(
+                            None,
+                            Const(None, None, node.addr + node.original_size, self.project.arch.bits),
+                            ins_addr=node.addr,
+                        )
+                    )
+        elif isinstance(node, MultiNode) and node.nodes:
+            self._ensure_jump_at_loop_exit_ends(node.nodes[-1])
+
+    @staticmethod
+    def _dbg_block_list(blocks):
+        return [(hex(b.addr) if hasattr(b, "addr") else repr(b)) for b in blocks]
+
+    #
+    # Reducibility
+    #
+
+    def test_reducibility(self) -> bool:
+        # make a copy of the graph
+        graph = networkx.DiGraph(self._graph)
+
+        # preprocess: make it a super graph
+        self._make_supergraph(graph)
+
+        while True:
+            changed = False
+
+            # find a node with a back-edge, remove the edge (deleting the loop), and replace it with a MultiNode
+            changed |= self._remove_self_loop(graph)
+
+            # find a node that has only one predecessor, and merge it with its predecessor (replace them with a
+            # MultiNode)
+            changed |= self._merge_single_entry_node(graph)
+
+            if not changed:
+                # a fixed-point is reached
+                break
+
+        # Flow graph reducibility, Hecht and Ullman
+        return len(graph.nodes) == 1
+
+    def _remove_self_loop(self, graph: networkx.DiGraph) -> bool:
+        r = False
+
+        while True:
+            for node in graph.nodes():
+                if node in graph[node]:
+                    # found a self loop
+                    self._remove_node(graph, node)
+                    r = True
+                    break
+            else:
+                break
+
+        return r
+
+    def _merge_single_entry_node(self, graph: networkx.DiGraph) -> bool:
+        r = False
+
+        while True:
+            for node in networkx.dfs_postorder_nodes(graph):
+                preds = list(graph.predecessors(node))
+                if len(preds) == 1:
+                    # merge the two nodes
+                    self._absorb_node(graph, preds[0], node)
+                    r = True
+                    break
+            else:
+                break
+
+        return r
+
+    def _remove_node(self, graph: networkx.DiGraph, node):  # pylint:disable=no-self-use
+        in_edges = [(src, dst, data) for (src, dst, data) in graph.in_edges(node, data=True) if src is not node]
+        out_edges = [(src, dst, data) for (src, dst, data) in graph.out_edges(node, data=True) if dst is not node]
+
+        # true case: it forms a region by itself :-)
+        new_node = None if len(in_edges) <= 1 and len(out_edges) <= 1 else MultiNode([node])
+
+        graph.remove_node(node)
+
+        if new_node is not None:
+            for src, _, data in in_edges:
+                graph.add_edge(src, new_node, **data)
+
+            for _, dst, data in out_edges:
+                graph.add_edge(new_node, dst, **data)
+
+    @staticmethod
+    def _absorb_node(graph: networkx.DiGraph, node_mommy, node_kiddie, force_multinode=False):
         in_edges_mommy = graph.in_edges(node_mommy, data=True)
         out_edges_mommy = graph.out_edges(node_mommy, data=True)
         out_edges_kiddie = graph.out_edges(node_kiddie, data=True)
@@ -1129,38 +1214,5 @@ class RegionIdentifier(Analysis):
         assert node_mommy not in graph
         assert node_kiddie not in graph
 
-    def _ensure_jump_at_loop_exit_ends(self, node: Block | MultiNode) -> None:
-        if isinstance(node, Block):
-            if not node.statements:
-                node.statements.append(
-                    Jump(
-                        None,
-                        Const(None, None, node.addr + node.original_size, self.project.arch.bits),
-                        ins_addr=node.addr,
-                    )
-                )
-            else:
-                if not isinstance(first_nonlabel_nonphi_statement(node), ConditionalJump) and not isinstance(
-                    node.statements[-1],
-                    (
-                        Jump,
-                        ConditionalJump,
-                        IncompleteSwitchCaseHeadStatement,
-                    ),
-                ):
-                    node.statements.append(
-                        Jump(
-                            None,
-                            Const(None, None, node.addr + node.original_size, self.project.arch.bits),
-                            ins_addr=node.addr,
-                        )
-                    )
-        elif isinstance(node, MultiNode) and node.nodes:
-            self._ensure_jump_at_loop_exit_ends(node.nodes[-1])
-
-    @staticmethod
-    def _dbg_block_list(blocks):
-        return [(hex(b.addr) if hasattr(b, "addr") else repr(b)) for b in blocks]
-
 
 register_analysis(RegionIdentifier, "RegionIdentifier")

{angr-9.2.152 → angr-9.2.153}/angr/analyses/smc.py

@@ -42,6 +42,8 @@ class TraceClassifier:
         """
         addr = state.solver.eval(state.inspect.mem_write_address)
         length = state.inspect.mem_write_length
+        if length is None:
+            length = len(state.inspect.mem_write_expr) // state.arch.byte_width
         if not isinstance(length, int):
             length = state.solver.eval(length)
         self.map.add(addr, length, TraceActions.WRITE)
@@ -103,7 +105,7 @@ class SelfModifyingCodeAnalysis(Analysis):
         """
         :param subject: Subject of analysis
         :param max_bytes: Maximum number of bytes from subject address. 0 for no limit (default).
-        :param state: State to begin executing from from.
+        :param state: State to begin executing from.
         """
         assert self.project.selfmodifying_code