angr 9.2.152__tar.gz → 9.2.154__tar.gz

{angr-9.2.152/angr.egg-info → angr-9.2.154}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.152
+Version: 9.2.154
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.152
-Requires-Dist: archinfo==9.2.152
+Requires-Dist: ailment==9.2.154
+Requires-Dist: archinfo==9.2.154
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.152
-Requires-Dist: cle==9.2.152
+Requires-Dist: claripy==9.2.154
+Requires-Dist: cle==9.2.154
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -31,7 +31,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.152
+Requires-Dist: pyvex==9.2.154
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.152 → angr-9.2.154}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.152"
+__version__ = "9.2.154"
 
 if bytes is str:
     raise Exception(

{angr-9.2.152 → angr-9.2.154}/angr/analyses/analysis.py

@@ -5,7 +5,7 @@ import sys
 import contextlib
 from collections import defaultdict
 from inspect import Signature
-from typing import TYPE_CHECKING, TypeVar, Generic, cast
+from typing import TYPE_CHECKING, TypeVar, Generic, cast, Any
 from collections.abc import Callable
 from types import NoneType
 from itertools import chain
@@ -111,7 +111,7 @@ class AnalysisLogEntry:
 A = TypeVar("A", bound="Analysis")
 
 
-class AnalysesHub(PluginVendor[A]):
+class AnalysesHub(PluginVendor[Any]):
     """
     This class contains functions for all the registered and runnable analyses,
     """
@@ -123,7 +123,7 @@ class AnalysesHub(PluginVendor[A]):
     def _init_plugin(self, plugin_cls: type[A]) -> AnalysisFactory[A]:
         return AnalysisFactory(self.project, plugin_cls)
 
-    def __getstate__(self):
+    def __getstate__(self):  # type: ignore[reportIncompatibleMethodOverride]
         s = super().__getstate__()
         return (s, self.project)
 

{angr-9.2.152 → angr-9.2.154}/angr/analyses/calling_convention/fact_collector.py

@@ -6,7 +6,6 @@ from collections import defaultdict
 import pyvex
 import claripy
 
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from angr.utils.bits import s2u, u2s
 from angr.block import Block
 from angr.analyses.analysis import Analysis
@@ -15,7 +14,8 @@ from angr.knowledge_plugins.functions import Function
 from angr.codenode import BlockNode, HookNode
 from angr.engines.light import SimEngineNostmtVEX, SimEngineLight, SpOffset, RegisterOffset
 from angr.calling_conventions import SimRegArg, SimStackArg, default_cc
-from angr.sim_type import SimTypeBottom, dereference_simtype, SimTypeFunction
+from angr.sim_type import SimTypeBottom, SimTypeFunction
+from angr.utils.types import dereference_simtype_by_lib
 from .utils import is_sane_register_variable
 
 if TYPE_CHECKING:
@@ -121,7 +121,7 @@ class SimEngineFactCollectorVEX(
         if self.block.vex.jumpkind == "Ijk_Call" and self.arch.ret_offset is not None:
             self.state.register_written(self.arch.ret_offset, self.arch.bytes)
 
-    def _top(self, bits: int):
+    def _top(self, bits: int):  # type: ignore
         return None
 
     def _is_top(self, expr: Any) -> bool:
@@ -190,13 +190,13 @@ class SimEngineFactCollectorVEX(
         self.state.register_read(expr.offset, bits // self.arch.byte_width)
         return RegisterOffset(bits, expr.offset, 0)
 
-    def _handle_expr_GetI(self, expr):
+    def _handle_expr_GetI(self, expr):  # type: ignore
         return None
 
-    def _handle_expr_ITE(self, expr):
+    def _handle_expr_ITE(self, expr):  # type: ignore
         return None
 
-    def _handle_expr_Load(self, expr):
+    def _handle_expr_Load(self, expr):  # type: ignore
         addr = self._expr(expr.addr)
         if isinstance(addr, SpOffset):
             self.state.stack_read(addr.offset, expr.result_size(self.tyenv) // self.arch.byte_width)
@@ -206,7 +206,7 @@ class SimEngineFactCollectorVEX(
     def _handle_expr_RdTmp(self, expr):
         return self.state.tmps.get(expr.tmp, None)
 
-    def _handle_expr_VECRET(self, expr):
+    def _handle_expr_VECRET(self, expr):  # type: ignore
         return None
 
     @binop_handler
@@ -444,13 +444,7 @@ class FactCollector(Analysis):
                             proto = func_succ.prototype
                             if func_succ.prototype_libname is not None:
                                 # we need to deref the prototype in case it uses SimTypeRef internally
-                                type_collections = []
-                                for prototype_lib in SIM_LIBRARIES[func_succ.prototype_libname]:
-                                    if prototype_lib.type_collection_names:
-                                        for typelib_name in prototype_lib.type_collection_names:
-                                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                                if type_collections:
-                                    proto = dereference_simtype(proto, type_collections)
+                                proto = dereference_simtype_by_lib(proto, func_succ.prototype_libname)
 
                             assert isinstance(proto, SimTypeFunction) and proto.returnty is not None
                             returnty_size = proto.returnty.with_arch(self.project.arch).size

{angr-9.2.152 → angr-9.2.154}/angr/analyses/cfg/cfg_base.py

@@ -1515,7 +1515,7 @@ class CFGBase(Analysis):
         Revisit the entire control flow graph, create Function instances accordingly, and correctly put blocks into
         each function.
 
-        Although Function objects are crated during the CFG recovery, they are neither sound nor accurate. With a
+        Although Function objects are created during the CFG recovery, they are neither sound nor accurate. With a
         pre-constructed CFG, this method rebuilds all functions bearing the following rules:
 
             - A block may only belong to one function.

{angr-9.2.152 → angr-9.2.154}/angr/analyses/cfg/cfg_fast.py

@@ -1554,6 +1554,45 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                 }:
                     func.info["is_alloca_probe"] = True
 
+            # determine if the function is _guard_xfg_dispatch_icall_nop or _guard_xfg_dispatch_icall_fptr
+            if func is not None and not func.is_simprocedure and len(func.block_addrs_set) in {1, 2}:
+                # _guard_xfg_dispatch_icall_nop jumps to _guard_xfg_dispatch_icall_fptr, but we may or may not identify
+                # _guard_xfg_dispatch_icall_fptr as a separate function.
+                # so, two possibilities:
+                # - _guard_xfg_dispatch_icall_nop is a function with one block and jumps to
+                #   _guard_xfg_dispatch_icall_fptr.
+                # - _guard_xfg_dispatch_icall_nop is a function with 2 blocks, and the second block is the body of
+                #   _guard_xfg_dispatch_icall_fptr.
+                try:
+                    block = func.get_block(func.addr)
+                except SimTranslationError:
+                    block = None
+                if block is not None and block.instructions == 1 and len(block.capstone.insns) == 1:
+                    insn = block.capstone.insns[0]
+                    if block.bytes == b"\xff\xe0":
+                        func.info["jmp_rax"] = True
+                    elif (
+                        insn.mnemonic == "jmp"
+                        and insn.operands[0].type == capstone.x86.X86_OP_MEM
+                        and insn.operands[0].mem.base == capstone.x86.X86_REG_RIP
+                        and insn.operands[0].mem.disp > 0
+                        and insn.operands[0].mem.index == 0
+                    ):
+                        # where is it jumping to?
+                        jumpout_targets = list(self.graph.successors(self.model.get_any_node(func.addr)))
+                        if len(jumpout_targets) == 1:
+                            jumpout_target = jumpout_targets[0].addr
+                            if len(func.block_addrs_set) == 1 and len(func.jumpout_sites) == 1:
+                                if (
+                                    self.kb.functions.contains_addr(jumpout_target)
+                                    and self.kb.functions.get_by_addr(jumpout_target).get_block(jumpout_target).bytes
+                                    == b"\xff\xe0"
+                                ):
+                                    func.info["jmp_rax"] = True
+                            elif len(func.block_addrs_set) == 2 and func.get_block(jumpout_target).bytes == b"\xff\xe0":
+                                # check the second block and ensure it's jmp rax
+                                func.info["jmp_rax"] = True
+
         elif self.project.arch.name == "X86":
             # determine if the function is __alloca_probe
             func = self.kb.functions.get_by_addr(func_addr) if self.kb.functions.contains_addr(func_addr) else None
@@ -1882,7 +1921,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     if cfg_node is None:
                         continue
                     func_addr = cfg_node.function_address
-                    if func_addr not in tested_func_addrs:
+                    if func_addr not in tested_func_addrs and self.kb.functions.contains_addr(func_addr):
                         func = self.kb.functions.get_by_addr(func_addr)
                         if not security_check_cookie_found and is_function_security_check_cookie(
                             func, self.project, security_cookie_addr

{angr-9.2.152 → angr-9.2.154}/angr/analyses/decompiler/ail_simplifier.py

@@ -203,7 +203,6 @@ class AILSimplifier(Analysis):
         AILGraphWalker(self.func_graph, _handler, replace_nodes=True).walk()
         self.blocks = {}
 
-    @timethis
     def _compute_reaching_definitions(self) -> SRDAModel:
         # Computing reaching definitions or return the cached one
         if self._reaching_definitions is not None:

{angr-9.2.152 → angr-9.2.154}/angr/analyses/decompiler/callsite_maker.py

@@ -1,5 +1,5 @@
 from __future__ import annotations
-from typing import Any, TYPE_CHECKING
+from typing import cast, Any, TYPE_CHECKING
 import copy
 import logging
 
@@ -14,7 +14,6 @@ from angr.sim_type import (
     SimTypeChar,
     SimTypeInt,
     SimTypeFloat,
-    dereference_simtype,
     SimTypeFunction,
     SimTypeLongLong,
 )
@@ -22,7 +21,7 @@ from angr.calling_conventions import SimReferenceArgument, SimRegArg, SimStackAr
 from angr.knowledge_plugins.key_definitions.constants import OP_BEFORE
 from angr.analyses import Analysis, register_analysis
 from angr.analyses.s_reaching_definitions import SRDAView
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
+from angr.utils.types import dereference_simtype_by_lib
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.functions import Function
@@ -37,12 +36,14 @@ class CallSiteMaker(Analysis):
     Add calling convention, declaration, and args to a call site.
     """
 
-    def __init__(self, block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager: Manager = None):
+    def __init__(
+        self, block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager: Manager | None = None
+    ):
         self.block = block
 
         self._reaching_definitions = reaching_definitions
         self._stack_pointer_tracker = stack_pointer_tracker
-        self._ail_manager = ail_manager
+        self._ail_manager: Manager | None = ail_manager
 
         self.result_block = None
         self.stack_arg_offsets: set[tuple[int, int]] | None = None  # call ins addr, stack_offset
@@ -109,16 +110,8 @@ class CallSiteMaker(Analysis):
             # make sure the function prototype is resolved.
             # TODO: Cache resolved function prototypes globally
             prototype_libname = func.prototype_libname
-            type_collections = []
             if prototype_libname is not None:
-                for prototype_lib in SIM_LIBRARIES[prototype_libname]:
-                    if prototype_lib.type_collection_names:
-                        for typelib_name in prototype_lib.type_collection_names:
-                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-            if type_collections:
-                prototype = dereference_simtype(prototype, type_collections).with_arch(  # type: ignore
-                    self.project.arch
-                )
+                prototype = cast(SimTypeFunction, dereference_simtype_by_lib(prototype, prototype_libname))
 
         args = []
         arg_vvars = []
@@ -151,6 +144,10 @@ class CallSiteMaker(Analysis):
                     # across registers). most importantly, a ComboArg represents one variable, not multiple, but we
                     # have no way to know that until later down the pipeline.
                     expanded_arg_locs += arg_loc.locations
+                elif isinstance(arg_loc, SimStructArg):
+                    expanded_arg_locs += [  # type: ignore
+                        arg_loc.locs[field_name] for field_name in arg_loc.struct.fields if field_name in arg_loc.locs
+                    ]
                 elif isinstance(arg_loc, (SimRegArg, SimStackArg, SimReferenceArgument)):
                     expanded_arg_locs.append(arg_loc)
                 else:
@@ -195,12 +192,15 @@ class CallSiteMaker(Analysis):
                         if vvar_def_reg_offset is not None and offset > vvar_def_reg_offset:
                             # we need to shift the value
                             vvar_use = Expr.BinaryOp(
-                                self._ail_manager.next_atom(),
+                                self._ail_manager.next_atom() if self._ail_manager is not None else None,
                                 "Shr",
                                 [
                                     vvar_use,
                                     Expr.Const(
-                                        self._ail_manager.next_atom(), None, (offset - vvar_def_reg_offset) * 8, 8
+                                        self._ail_manager.next_atom() if self._ail_manager is not None else None,
+                                        None,
+                                        (offset - vvar_def_reg_offset) * 8,
+                                        8,
                                     ),
                                 ],
                                 **vvar_use.tags,
@@ -208,7 +208,7 @@ class CallSiteMaker(Analysis):
                         if vvar_def.size > arg_loc.size:
                             # we need to narrow the value
                             vvar_use = Expr.Convert(
-                                self._ail_manager.next_atom(),
+                                self._ail_manager.next_atom() if self._ail_manager is not None else None,
                                 vvar_use.bits,
                                 arg_loc.size * self.project.arch.byte_width,
                                 False,

angr-9.2.154/angr/analyses/decompiler/ccall_rewriters/x86_ccalls.py

@@ -0,0 +1,278 @@
+from __future__ import annotations
+
+from ailment import Expr
+
+from angr.engines.vex.claripy.ccall import data
+from .rewriter_base import CCallRewriterBase
+
+
+X86_CondTypes = data["X86"]["CondTypes"]
+X86_OpTypes = data["X86"]["OpTypes"]
+X86_CondBitMasks = data["X86"]["CondBitMasks"]
+X86_CondBitOffsets = data["X86"]["CondBitOffsets"]
+
+
+class X86CCallRewriter(CCallRewriterBase):
+    """
+    Implements VEX ccall rewriter for X86.
+
+    From libVEX:
+
+    A summary of the field usages is:
+
+    Operation          DEP1               DEP2               NDEP
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    add/sub/mul        first arg          second arg         unused
+    adc/sbb            first arg          (second arg)
+                                          XOR old_carry      old_carry
+    and/or/xor         result             zero               unused
+    inc/dec            result             zero               old_carry
+    shl/shr/sar        result             subshifted-        unused
+                                          result
+    rol/ror            result             zero               old_flags
+    copy               old_flags          zero               unused.
+    """
+
+    __slots__ = ()
+
+    def _rewrite(self, ccall: Expr.VEXCCallExpression) -> Expr.Expression | None:
+        if ccall.callee == "x86g_calculate_condition":
+            cond = ccall.operands[0]
+            op = ccall.operands[1]
+            dep_1 = ccall.operands[2]
+            dep_2 = ccall.operands[3]
+            if isinstance(cond, Expr.Const) and isinstance(op, Expr.Const):
+                cond_v = cond.value
+                op_v = op.value
+                if cond_v == X86_CondTypes["CondLE"]:
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 <=s dep_2
+                        dep_1 = self._fix_size(
+                            dep_1,
+                            op_v,
+                            X86_OpTypes["G_CC_OP_SUBB"],
+                            X86_OpTypes["G_CC_OP_SUBW"],
+                            ccall.tags,
+                        )
+                        dep_2 = self._fix_size(
+                            dep_2,
+                            op_v,
+                            X86_OpTypes["G_CC_OP_SUBB"],
+                            X86_OpTypes["G_CC_OP_SUBW"],
+                            ccall.tags,
+                        )
+
+                        r = Expr.BinaryOp(ccall.idx, "CmpLE", (dep_1, dep_2), True, **ccall.tags)
+                        return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
+                elif cond_v == X86_CondTypes["CondO"]:
+                    op_v = op.value
+                    ret_cond = None
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_UMULB"],
+                        X86_OpTypes["G_CC_OP_UMULW"],
+                        X86_OpTypes["G_CC_OP_UMULL"],
+                    }:
+                        # dep_1 * dep_2 >= max_signed_byte/word/dword
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Mul",
+                            (dep_1, dep_2),
+                            bits=dep_1.bits * 2,
+                            **ccall.tags,
+                        )
+                        max_signed = Expr.Const(
+                            None,
+                            None,
+                            (1 << (dep_1.bits - 1)),
+                            bits=dep_1.bits * 2,
+                            **ccall.tags,
+                        )
+                        ret_cond = Expr.BinaryOp(None, "CmpGE", (ret, max_signed), signed=False, **ccall.tags)
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_INCB"],
+                        X86_OpTypes["G_CC_OP_INCW"],
+                        X86_OpTypes["G_CC_OP_INCL"],
+                    }:
+                        # dep_1 is the result
+                        overflowed = Expr.Const(
+                            None,
+                            None,
+                            1 << (dep_1.bits - 1),
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        ret_cond = Expr.BinaryOp(None, "CmpEQ", (dep_1, overflowed), **ccall.tags)
+
+                    if ret_cond is not None:
+                        return Expr.ITE(
+                            ccall.idx,
+                            ret_cond,
+                            Expr.Const(None, None, 0, 1, **ccall.tags),
+                            Expr.Const(None, None, 1, 1, **ccall.tags),
+                            **ccall.tags,
+                        )
+                elif cond_v == X86_CondTypes["CondZ"]:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_ADDB"],
+                        X86_OpTypes["G_CC_OP_ADDW"],
+                        X86_OpTypes["G_CC_OP_ADDL"],
+                    }:
+                        # dep_1 + dep_2 == 0
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Add",
+                            (dep_1, dep_2),
+                            bits=dep_1.bits,
+                            **ccall.tags,
+                        )
+                        zero = Expr.Const(
+                            None,
+                            None,
+                            0,
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (ret, zero),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 - dep_2 == 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (dep_1, dep_2),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 == 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            True,
+                            **ccall.tags,
+                        )
+                elif cond_v == X86_CondTypes["CondL"]:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 - dep_2 < 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLT",
+                            (dep_1, dep_2),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 < 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLT",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            True,
+                            **ccall.tags,
+                        )
+                elif cond_v in {
+                    X86_CondTypes["CondBE"],
+                    X86_CondTypes["CondB"],
+                }:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_ADDB"],
+                        X86_OpTypes["G_CC_OP_ADDW"],
+                        X86_OpTypes["G_CC_OP_ADDL"],
+                    }:
+                        # dep_1 + dep_2 <= 0  if CondBE
+                        # dep_1 + dep_2 < 0   if CondB
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Add",
+                            (dep_1, dep_2),
+                            signed=False,
+                            bits=dep_1.bits,
+                            **ccall.tags,
+                        )
+                        zero = Expr.Const(
+                            None,
+                            None,
+                            0,
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (ret, zero),
+                            False,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 <= dep_2  if CondBE
+                        # dep_1 < dep_2   if CondB
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (dep_1, dep_2),
+                            False,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 <= 0  if CondBE
+                        # dep_1 < 0   if CondB
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            False,
+                            **ccall.tags,
+                        )
+        return None
+
+    @staticmethod
+    def _fix_size(expr, op_v: int, type_8bit, type_16bit, tags):
+        if op_v == type_8bit:
+            bits = 8
+        elif op_v == type_16bit:
+            bits = 16
+        else:
+            bits = 32
+        if bits < 32:
+            if isinstance(expr, Expr.Const):
+                return Expr.Const(expr.idx, None, expr.value & ((1 << bits) - 1), bits, **tags)
+            return Expr.Convert(None, 32, bits, False, expr, **tags)
+        return expr