angr 9.2.153__py3-none-macosx_10_9_x86_64.whl → 9.2.154__py3-none-macosx_10_9_x86_64.whl

angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.153"
+__version__ = "9.2.154"
 
 if bytes is str:
     raise Exception(

angr/analyses/analysis.py

@@ -5,7 +5,7 @@ import sys
 import contextlib
 from collections import defaultdict
 from inspect import Signature
-from typing import TYPE_CHECKING, TypeVar, Generic, cast
+from typing import TYPE_CHECKING, TypeVar, Generic, cast, Any
 from collections.abc import Callable
 from types import NoneType
 from itertools import chain
@@ -111,7 +111,7 @@ class AnalysisLogEntry:
 A = TypeVar("A", bound="Analysis")
 
 
-class AnalysesHub(PluginVendor[A]):
+class AnalysesHub(PluginVendor[Any]):
     """
     This class contains functions for all the registered and runnable analyses,
     """
@@ -123,7 +123,7 @@ class AnalysesHub(PluginVendor[A]):
     def _init_plugin(self, plugin_cls: type[A]) -> AnalysisFactory[A]:
         return AnalysisFactory(self.project, plugin_cls)
 
-    def __getstate__(self):
+    def __getstate__(self):  # type: ignore[reportIncompatibleMethodOverride]
         s = super().__getstate__()
         return (s, self.project)
 

angr/analyses/calling_convention/fact_collector.py

@@ -6,7 +6,6 @@ from collections import defaultdict
 import pyvex
 import claripy
 
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from angr.utils.bits import s2u, u2s
 from angr.block import Block
 from angr.analyses.analysis import Analysis
@@ -15,7 +14,8 @@ from angr.knowledge_plugins.functions import Function
 from angr.codenode import BlockNode, HookNode
 from angr.engines.light import SimEngineNostmtVEX, SimEngineLight, SpOffset, RegisterOffset
 from angr.calling_conventions import SimRegArg, SimStackArg, default_cc
-from angr.sim_type import SimTypeBottom, dereference_simtype, SimTypeFunction
+from angr.sim_type import SimTypeBottom, SimTypeFunction
+from angr.utils.types import dereference_simtype_by_lib
 from .utils import is_sane_register_variable
 
 if TYPE_CHECKING:
@@ -121,7 +121,7 @@ class SimEngineFactCollectorVEX(
         if self.block.vex.jumpkind == "Ijk_Call" and self.arch.ret_offset is not None:
             self.state.register_written(self.arch.ret_offset, self.arch.bytes)
 
-    def _top(self, bits: int):
+    def _top(self, bits: int):  # type: ignore
         return None
 
     def _is_top(self, expr: Any) -> bool:
@@ -190,13 +190,13 @@ class SimEngineFactCollectorVEX(
         self.state.register_read(expr.offset, bits // self.arch.byte_width)
         return RegisterOffset(bits, expr.offset, 0)
 
-    def _handle_expr_GetI(self, expr):
+    def _handle_expr_GetI(self, expr):  # type: ignore
         return None
 
-    def _handle_expr_ITE(self, expr):
+    def _handle_expr_ITE(self, expr):  # type: ignore
         return None
 
-    def _handle_expr_Load(self, expr):
+    def _handle_expr_Load(self, expr):  # type: ignore
         addr = self._expr(expr.addr)
         if isinstance(addr, SpOffset):
             self.state.stack_read(addr.offset, expr.result_size(self.tyenv) // self.arch.byte_width)
@@ -206,7 +206,7 @@ class SimEngineFactCollectorVEX(
     def _handle_expr_RdTmp(self, expr):
         return self.state.tmps.get(expr.tmp, None)
 
-    def _handle_expr_VECRET(self, expr):
+    def _handle_expr_VECRET(self, expr):  # type: ignore
         return None
 
     @binop_handler
@@ -444,13 +444,7 @@ class FactCollector(Analysis):
                             proto = func_succ.prototype
                             if func_succ.prototype_libname is not None:
                                 # we need to deref the prototype in case it uses SimTypeRef internally
-                                type_collections = []
-                                for prototype_lib in SIM_LIBRARIES[func_succ.prototype_libname]:
-                                    if prototype_lib.type_collection_names:
-                                        for typelib_name in prototype_lib.type_collection_names:
-                                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                                if type_collections:
-                                    proto = dereference_simtype(proto, type_collections)
+                                proto = dereference_simtype_by_lib(proto, func_succ.prototype_libname)
 
                             assert isinstance(proto, SimTypeFunction) and proto.returnty is not None
                             returnty_size = proto.returnty.with_arch(self.project.arch).size

angr/analyses/cfg/cfg_fast.py

@@ -1567,7 +1567,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     block = func.get_block(func.addr)
                 except SimTranslationError:
                     block = None
-                if block is not None and block.instructions == 1:
+                if block is not None and block.instructions == 1 and len(block.capstone.insns) == 1:
                     insn = block.capstone.insns[0]
                     if block.bytes == b"\xff\xe0":
                         func.info["jmp_rax"] = True
@@ -1921,7 +1921,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     if cfg_node is None:
                         continue
                     func_addr = cfg_node.function_address
-                    if func_addr not in tested_func_addrs:
+                    if func_addr not in tested_func_addrs and self.kb.functions.contains_addr(func_addr):
                         func = self.kb.functions.get_by_addr(func_addr)
                         if not security_check_cookie_found and is_function_security_check_cookie(
                             func, self.project, security_cookie_addr

angr/analyses/decompiler/callsite_maker.py

@@ -1,5 +1,5 @@
 from __future__ import annotations
-from typing import Any, TYPE_CHECKING
+from typing import cast, Any, TYPE_CHECKING
 import copy
 import logging
 
@@ -14,7 +14,6 @@ from angr.sim_type import (
     SimTypeChar,
     SimTypeInt,
     SimTypeFloat,
-    dereference_simtype,
     SimTypeFunction,
     SimTypeLongLong,
 )
@@ -22,7 +21,7 @@ from angr.calling_conventions import SimReferenceArgument, SimRegArg, SimStackAr
 from angr.knowledge_plugins.key_definitions.constants import OP_BEFORE
 from angr.analyses import Analysis, register_analysis
 from angr.analyses.s_reaching_definitions import SRDAView
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
+from angr.utils.types import dereference_simtype_by_lib
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.functions import Function
@@ -37,12 +36,14 @@ class CallSiteMaker(Analysis):
     Add calling convention, declaration, and args to a call site.
     """
 
-    def __init__(self, block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager: Manager = None):
+    def __init__(
+        self, block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager: Manager | None = None
+    ):
         self.block = block
 
         self._reaching_definitions = reaching_definitions
         self._stack_pointer_tracker = stack_pointer_tracker
-        self._ail_manager = ail_manager
+        self._ail_manager: Manager | None = ail_manager
 
         self.result_block = None
         self.stack_arg_offsets: set[tuple[int, int]] | None = None  # call ins addr, stack_offset
@@ -109,16 +110,8 @@ class CallSiteMaker(Analysis):
             # make sure the function prototype is resolved.
             # TODO: Cache resolved function prototypes globally
             prototype_libname = func.prototype_libname
-            type_collections = []
             if prototype_libname is not None:
-                for prototype_lib in SIM_LIBRARIES[prototype_libname]:
-                    if prototype_lib.type_collection_names:
-                        for typelib_name in prototype_lib.type_collection_names:
-                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-            if type_collections:
-                prototype = dereference_simtype(prototype, type_collections).with_arch(  # type: ignore
-                    self.project.arch
-                )
+                prototype = cast(SimTypeFunction, dereference_simtype_by_lib(prototype, prototype_libname))
 
         args = []
         arg_vvars = []
@@ -151,6 +144,10 @@ class CallSiteMaker(Analysis):
                     # across registers). most importantly, a ComboArg represents one variable, not multiple, but we
                     # have no way to know that until later down the pipeline.
                     expanded_arg_locs += arg_loc.locations
+                elif isinstance(arg_loc, SimStructArg):
+                    expanded_arg_locs += [  # type: ignore
+                        arg_loc.locs[field_name] for field_name in arg_loc.struct.fields if field_name in arg_loc.locs
+                    ]
                 elif isinstance(arg_loc, (SimRegArg, SimStackArg, SimReferenceArgument)):
                     expanded_arg_locs.append(arg_loc)
                 else:
@@ -195,12 +192,15 @@ class CallSiteMaker(Analysis):
                         if vvar_def_reg_offset is not None and offset > vvar_def_reg_offset:
                             # we need to shift the value
                             vvar_use = Expr.BinaryOp(
-                                self._ail_manager.next_atom(),
+                                self._ail_manager.next_atom() if self._ail_manager is not None else None,
                                 "Shr",
                                 [
                                     vvar_use,
                                     Expr.Const(
-                                        self._ail_manager.next_atom(), None, (offset - vvar_def_reg_offset) * 8, 8
+                                        self._ail_manager.next_atom() if self._ail_manager is not None else None,
+                                        None,
+                                        (offset - vvar_def_reg_offset) * 8,
+                                        8,
                                     ),
                                 ],
                                 **vvar_use.tags,
@@ -208,7 +208,7 @@ class CallSiteMaker(Analysis):
                         if vvar_def.size > arg_loc.size:
                             # we need to narrow the value
                             vvar_use = Expr.Convert(
-                                self._ail_manager.next_atom(),
+                                self._ail_manager.next_atom() if self._ail_manager is not None else None,
                                 vvar_use.bits,
                                 arg_loc.size * self.project.arch.byte_width,
                                 False,

angr/analyses/decompiler/ccall_rewriters/x86_ccalls.py

@@ -15,6 +15,23 @@ X86_CondBitOffsets = data["X86"]["CondBitOffsets"]
 class X86CCallRewriter(CCallRewriterBase):
     """
     Implements VEX ccall rewriter for X86.
+
+    From libVEX:
+
+    A summary of the field usages is:
+
+    Operation          DEP1               DEP2               NDEP
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    add/sub/mul        first arg          second arg         unused
+    adc/sbb            first arg          (second arg)
+                                          XOR old_carry      old_carry
+    and/or/xor         result             zero               unused
+    inc/dec            result             zero               old_carry
+    shl/shr/sar        result             subshifted-        unused
+                                          result
+    rol/ror            result             zero               old_flags
+    copy               old_flags          zero               unused.
     """
 
     __slots__ = ()
@@ -28,7 +45,7 @@ class X86CCallRewriter(CCallRewriterBase):
             if isinstance(cond, Expr.Const) and isinstance(op, Expr.Const):
                 cond_v = cond.value
                 op_v = op.value
-                if cond_v == X86_CondTypes["CondLE"]:  # noqa: SIM102
+                if cond_v == X86_CondTypes["CondLE"]:
                     if op_v in {
                         X86_OpTypes["G_CC_OP_SUBB"],
                         X86_OpTypes["G_CC_OP_SUBW"],
@@ -52,6 +69,198 @@ class X86CCallRewriter(CCallRewriterBase):
 
                         r = Expr.BinaryOp(ccall.idx, "CmpLE", (dep_1, dep_2), True, **ccall.tags)
                         return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
+                elif cond_v == X86_CondTypes["CondO"]:
+                    op_v = op.value
+                    ret_cond = None
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_UMULB"],
+                        X86_OpTypes["G_CC_OP_UMULW"],
+                        X86_OpTypes["G_CC_OP_UMULL"],
+                    }:
+                        # dep_1 * dep_2 >= max_signed_byte/word/dword
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Mul",
+                            (dep_1, dep_2),
+                            bits=dep_1.bits * 2,
+                            **ccall.tags,
+                        )
+                        max_signed = Expr.Const(
+                            None,
+                            None,
+                            (1 << (dep_1.bits - 1)),
+                            bits=dep_1.bits * 2,
+                            **ccall.tags,
+                        )
+                        ret_cond = Expr.BinaryOp(None, "CmpGE", (ret, max_signed), signed=False, **ccall.tags)
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_INCB"],
+                        X86_OpTypes["G_CC_OP_INCW"],
+                        X86_OpTypes["G_CC_OP_INCL"],
+                    }:
+                        # dep_1 is the result
+                        overflowed = Expr.Const(
+                            None,
+                            None,
+                            1 << (dep_1.bits - 1),
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        ret_cond = Expr.BinaryOp(None, "CmpEQ", (dep_1, overflowed), **ccall.tags)
+
+                    if ret_cond is not None:
+                        return Expr.ITE(
+                            ccall.idx,
+                            ret_cond,
+                            Expr.Const(None, None, 0, 1, **ccall.tags),
+                            Expr.Const(None, None, 1, 1, **ccall.tags),
+                            **ccall.tags,
+                        )
+                elif cond_v == X86_CondTypes["CondZ"]:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_ADDB"],
+                        X86_OpTypes["G_CC_OP_ADDW"],
+                        X86_OpTypes["G_CC_OP_ADDL"],
+                    }:
+                        # dep_1 + dep_2 == 0
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Add",
+                            (dep_1, dep_2),
+                            bits=dep_1.bits,
+                            **ccall.tags,
+                        )
+                        zero = Expr.Const(
+                            None,
+                            None,
+                            0,
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (ret, zero),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 - dep_2 == 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (dep_1, dep_2),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 == 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpEQ",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            True,
+                            **ccall.tags,
+                        )
+                elif cond_v == X86_CondTypes["CondL"]:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 - dep_2 < 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLT",
+                            (dep_1, dep_2),
+                            True,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 < 0
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLT",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            True,
+                            **ccall.tags,
+                        )
+                elif cond_v in {
+                    X86_CondTypes["CondBE"],
+                    X86_CondTypes["CondB"],
+                }:
+                    op_v = op.value
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_ADDB"],
+                        X86_OpTypes["G_CC_OP_ADDW"],
+                        X86_OpTypes["G_CC_OP_ADDL"],
+                    }:
+                        # dep_1 + dep_2 <= 0  if CondBE
+                        # dep_1 + dep_2 < 0   if CondB
+                        ret = Expr.BinaryOp(
+                            None,
+                            "Add",
+                            (dep_1, dep_2),
+                            signed=False,
+                            bits=dep_1.bits,
+                            **ccall.tags,
+                        )
+                        zero = Expr.Const(
+                            None,
+                            None,
+                            0,
+                            dep_1.bits,
+                            **ccall.tags,
+                        )
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (ret, zero),
+                            False,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_SUBB"],
+                        X86_OpTypes["G_CC_OP_SUBW"],
+                        X86_OpTypes["G_CC_OP_SUBL"],
+                    }:
+                        # dep_1 <= dep_2  if CondBE
+                        # dep_1 < dep_2   if CondB
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (dep_1, dep_2),
+                            False,
+                            **ccall.tags,
+                        )
+                    if op_v in {
+                        X86_OpTypes["G_CC_OP_LOGICB"],
+                        X86_OpTypes["G_CC_OP_LOGICW"],
+                        X86_OpTypes["G_CC_OP_LOGICL"],
+                    }:
+                        # dep_1 <= 0  if CondBE
+                        # dep_1 < 0   if CondB
+                        return Expr.BinaryOp(
+                            ccall.idx,
+                            "CmpLE" if cond_v == X86_CondTypes["CondBE"] else "CmpLT",
+                            (dep_1, Expr.Const(None, None, 0, dep_1.bits, **ccall.tags)),
+                            False,
+                            **ccall.tags,
+                        )
         return None
 
     @staticmethod

angr/analyses/decompiler/clinic.py

@@ -12,7 +12,6 @@ import networkx
 import capstone
 
 import ailment
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 
 from angr.errors import AngrDecompilationError
 from angr.knowledge_base import KnowledgeBase
@@ -22,9 +21,9 @@ from angr.knowledge_plugins.key_definitions import atoms
 from angr.codenode import BlockNode
 from angr.utils import timethis
 from angr.utils.graph import GraphUtils
+from angr.utils.types import dereference_simtype_by_lib
 from angr.calling_conventions import SimRegArg, SimStackArg, SimFunctionArgument
 from angr.sim_type import (
-    dereference_simtype,
     SimTypeChar,
     SimTypeInt,
     SimTypeLongLong,
@@ -1240,16 +1239,8 @@ class Clinic(Analysis):
                 # make sure the function prototype is resolved.
                 # TODO: Cache resolved function prototypes globally
                 prototype_libname = func.prototype_libname
-                type_collections = []
                 if prototype_libname is not None:
-                    for prototype_lib in SIM_LIBRARIES[prototype_libname]:
-                        if prototype_lib.type_collection_names:
-                            for typelib_name in prototype_lib.type_collection_names:
-                                type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                if type_collections:
-                    prototype = dereference_simtype(prototype, type_collections).with_arch(  # type: ignore
-                        self.project.arch
-                    )
+                    prototype = dereference_simtype_by_lib(prototype, prototype_libname)
 
             if cc is None:
                 l.warning("Call site %#x (callee %s) has an unknown calling convention.", block.addr, repr(func))
@@ -1541,6 +1532,7 @@ class Clinic(Analysis):
             vvar_id_start=self.vvar_id_start,
         )
         self.vvar_id_start = ssailification.max_vvar_id + 1
+        assert ssailification.out_graph is not None
         return ssailification.out_graph
 
     @timethis
@@ -1921,6 +1913,7 @@ class Clinic(Analysis):
                 self._link_variables_on_call(variable_manager, global_variables, block, stmt_idx, stmt, is_expr=False)
 
             elif stmt_type is ailment.Stmt.Return:
+                assert isinstance(stmt, ailment.Stmt.Return)
                 self._link_variables_on_return(variable_manager, global_variables, block, stmt_idx, stmt)
 
     def _link_variables_on_return(
@@ -2252,6 +2245,7 @@ class Clinic(Analysis):
     def _create_triangle_for_ite_expression(self, ail_graph, block_addr: int, ite_ins_addr: int):
         ite_insn_only_block = self.project.factory.block(ite_ins_addr, num_inst=1)
         ite_insn_size = ite_insn_only_block.size
+        assert ite_insn_size is not None
         if ite_insn_size <= 2:  # we need an address for true_block and another address for false_block
             return None
         if ite_insn_only_block.vex.exit_statements:
@@ -3205,7 +3199,7 @@ class Clinic(Analysis):
                         )
                         break
 
-        if alloca_node is not None:
+        if alloca_node is not None and sp_equal_to is not None:
             stmt0 = alloca_node.statements[1]
             statements = [ailment.Stmt.Call(stmt0.idx, "alloca", args=[sp_equal_to], **stmt0.tags)]
             new_node = ailment.Block(alloca_node.addr, alloca_node.original_size, statements=statements)

angr/analyses/decompiler/decompilation_cache.py

@@ -31,7 +31,7 @@ class DecompilationCache:
         self.parameters: dict[str, Any] = {}
         self.addr = addr
         self.type_constraints: dict[TypeVariable, set[TypeConstraint]] | None = None
-        self.func_typevar = None
+        self.func_typevar: TypeVariable | None = None
         self.var_to_typevar: dict | None = None
         self.codegen: BaseStructuredCodeGenerator | None = None
         self.clinic: Clinic | None = None

angr/analyses/decompiler/ssailification/ssailification.py

@@ -107,7 +107,7 @@ class Ssailification(Analysis):  # pylint:disable=abstract-method
         )
         self.secondary_stackvars = rewriter.secondary_stackvars
         self.out_graph = rewriter.out_graph
-        self.max_vvar_id = rewriter.max_vvar_id
+        self.max_vvar_id: int = rewriter.max_vvar_id if rewriter.max_vvar_id is not None else 0
 
     def _calculate_virtual_variables(
         self,

angr/analyses/decompiler/structured_codegen/c.py

@@ -1,6 +1,6 @@
 # pylint:disable=missing-class-docstring,too-many-boolean-expressions,unused-argument,no-self-use
 from __future__ import annotations
-from typing import Any, TYPE_CHECKING
+from typing import cast, Any, TYPE_CHECKING
 from collections.abc import Callable
 from collections import defaultdict, Counter
 import logging
@@ -12,7 +12,6 @@ from ailment.constant import UNDETERMINED_SIZE
 from ailment.expression import StackBaseOffset, BinaryOp
 from unique_log_filter import UniqueLogFilter
 
-from angr.procedures import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from angr.sim_type import (
     SimTypeLongLong,
     SimTypeInt,
@@ -32,7 +31,6 @@ from angr.sim_type import (
     SimTypeFixedSizeArray,
     SimTypeLength,
     SimTypeReg,
-    dereference_simtype,
     SimTypeInt128,
     SimTypeInt256,
     SimTypeInt512,
@@ -43,7 +41,7 @@ from angr.sim_variable import SimVariable, SimTemporaryVariable, SimStackVariabl
 from angr.utils.constants import is_alignment_mask
 from angr.utils.library import get_cpp_function_name
 from angr.utils.loader import is_in_readonly_segment, is_in_readonly_section
-from angr.utils.types import unpack_typeref, unpack_pointer_and_array
+from angr.utils.types import unpack_typeref, unpack_pointer_and_array, dereference_simtype_by_lib
 from angr.analyses.decompiler.utils import structured_node_is_simple_return
 from angr.errors import UnsupportedNodeTypeError, AngrRuntimeError
 from angr.knowledge_plugins.cfg.memory_data import MemoryData, MemoryDataSort
@@ -1301,12 +1299,7 @@ class CFunctionCall(CStatement, CExpression):
             proto = self.callee_func.prototype
             if self.callee_func.prototype_libname is not None:
                 # we need to deref the prototype in case it uses SimTypeRef internally
-                type_collections = []
-                for prototype_lib in SIM_LIBRARIES[self.callee_func.prototype_libname]:
-                    if prototype_lib.type_collection_names:
-                        for typelib_name in prototype_lib.type_collection_names:
-                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                proto = dereference_simtype(proto, type_collections)
+                proto = cast(SimTypeFunction, dereference_simtype_by_lib(proto, self.callee_func.prototype_libname))
             return proto
         returnty = SimTypeInt(signed=False)
         return SimTypeFunction([arg.type for arg in self.args], returnty).with_arch(self.codegen.project.arch)
@@ -1314,7 +1307,9 @@ class CFunctionCall(CStatement, CExpression):
     @property
     def type(self):
         if self.is_expr:
-            return self.prototype.returnty or SimTypeInt(signed=False).with_arch(self.codegen.project.arch)
+            return (self.prototype.returnty if self.prototype is not None else None) or SimTypeInt(
+                signed=False
+            ).with_arch(self.codegen.project.arch)
         raise AngrRuntimeError("CFunctionCall.type should not be accessed if the function call is used as a statement.")
 
     def _is_target_ambiguous(self, func_name: str) -> bool:
@@ -1323,6 +1318,8 @@ class CFunctionCall(CStatement, CExpression):
         """
         caller, callee = self.codegen._func, self.callee_func
 
+        assert self.codegen._variables_in_use is not None
+
         for var in self.codegen._variables_in_use.values():
             if func_name == var.name:
                 return True
@@ -1461,7 +1458,7 @@ class CGoto(CStatement):
     def c_repr_chunks(self, indent=0, asexpr=False):
         indent_str = self.indent_str(indent=indent)
         lbl = None
-        if self.codegen is not None:
+        if self.codegen is not None and isinstance(self.target, int):
             lbl = self.codegen.map_addr_to_label.get((self.target, self.target_idx))
 
         yield indent_str, None
@@ -1609,7 +1606,9 @@ class CVariable(CExpression):
 
         self.variable: SimVariable = variable
         self.unified_variable: SimVariable | None = unified_variable
-        self.variable_type: SimType = variable_type.with_arch(self.codegen.project.arch)
+        self.variable_type: SimType | None = (
+            variable_type.with_arch(self.codegen.project.arch) if variable_type is not None else None
+        )
         self.vvar_id = vvar_id
 
     @property
@@ -3970,7 +3969,8 @@ class MakeTypecastsImplicit(CStructuredCodeWalker):
         return super().handle_CAssignment(obj)
 
     def handle_CFunctionCall(self, obj: CFunctionCall):
-        for i, (c_arg, arg_ty) in enumerate(zip(obj.args, obj.prototype.args)):
+        prototype_args = [] if obj.prototype is None else obj.prototype.args
+        for i, (c_arg, arg_ty) in enumerate(zip(obj.args, prototype_args)):
             obj.args[i] = self.collapse(arg_ty, c_arg)
         return super().handle_CFunctionCall(obj)
 
@@ -4033,7 +4033,7 @@ class PointerArithmeticFixer(CStructuredCodeWalker):
     a_ptr = a_ptr + 1.
     """
 
-    def handle_CBinaryOp(self, obj):
+    def handle_CBinaryOp(self, obj: CBinaryOp):  # type: ignore
         obj: CBinaryOp = super().handle_CBinaryOp(obj)
         if (
             obj.op in ("Add", "Sub")