PyPI - angr - Versions diffs - 9.2.153__tar.gz → 9.2.156__tar.gz - Mend

angr 9.2.153tar.gz → 9.2.156tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of angr might be problematic. Click here for more details.

Files changed (1430) hide show

angr-9.2.156/Cargo.lock ADDED Viewed

@@ -0,0 +1,178 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+[[package]]
+name = "angr"
+version = "0.1.0"
+dependencies = [
+ "pyo3",
+ "rangemap",
+]
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+[[package]]
+name = "indoc"
+version = "2.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c7245a08504955605670dbf141fceab975f15ca21570696aebe9d2e71576bd"
+[[package]]
+name = "libc"
+version = "0.2.172"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+[[package]]
+name = "portable-atomic"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
+[[package]]
+name = "proc-macro2"
+version = "1.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+dependencies = [
+ "unicode-ident",
+]
+[[package]]
+name = "pyo3"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5203598f366b11a02b13aa20cab591229ff0a89fd121a308a5df751d5fc9219"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+[[package]]
+name = "pyo3-build-config"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99636d423fa2ca130fa5acde3059308006d46f98caac629418e53f7ebb1e9999"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+[[package]]
+name = "pyo3-ffi"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78f9cf92ba9c409279bc3305b5409d90db2d2c22392d443a87df3a1adad59e33"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+[[package]]
+name = "pyo3-macros"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b999cb1a6ce21f9a6b147dcf1be9ffedf02e0043aec74dc390f3007047cecd9"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "822ece1c7e1012745607d5cf0bcb2874769f0f7cb34c4cde03b9358eb9ef911a"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+[[package]]
+name = "rangemap"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60fcc7d6849342eff22c4350c8b9a989ee8ceabc4b481253e8946b9fe83d684"
+[[package]]
+name = "syn"
+version = "2.0.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+[[package]]
+name = "target-lexicon"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e502f78cdbb8ba4718f566c418c52bc729126ffd16baee5baa718cf25dd5a69a"
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+[[package]]
+name = "unindent"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"

angr-9.2.156/Cargo.toml ADDED Viewed

@@ -0,0 +1,28 @@
+[workspace]
+resolver = "3"
+rust-version = "1.86.0"
+members = ["crates/angr"]
+[workspace.package]
+license = "BSD-2-Clause"
+readme = "README.md"
+keywords = [
+    "analysis",
+    "angr",
+    "binary",
+    "decompiler",
+    "emulator",
+    "engineering",
+    "execution",
+    "research",
+    "reverse",
+    "security",
+    "symbolic",
+    "vulnerability",
+]
+categories = ["science", "security"]
+repository = "https://github.com/angr/angr.git"
+[workspace.lints.clippy]
+all = "warn"
+cargo = "warn"

{angr-9.2.153 → angr-9.2.156}/MANIFEST.in RENAMED Viewed

@@ -1,3 +1,6 @@
 include LICENSE
 include README.md
 recursive-include native *.c *.cpp *.h *.hpp *.def Makefile Makefile-win
+include Cargo.toml
+include Cargo.lock
+graft crates

{angr-9.2.153/angr.egg-info → angr-9.2.156}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.153
+Version: 9.2.156
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.153
-Requires-Dist: archinfo==9.2.153
+Requires-Dist: ailment==9.2.156
+Requires-Dist: archinfo==9.2.156
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.153
-Requires-Dist: cle==9.2.153
+Requires-Dist: claripy==9.2.156
+Requires-Dist: cle==9.2.156
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -31,7 +31,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.153
+Requires-Dist: pyvex==9.2.156
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy
@@ -39,23 +39,12 @@ Requires-Dist: unique-log-filter
 Requires-Dist: colorama; platform_system == "Windows"
 Provides-Extra: angrdb
 Requires-Dist: sqlalchemy; extra == "angrdb"
-Provides-Extra: docs
-Requires-Dist: furo; extra == "docs"
-Requires-Dist: myst-parser; extra == "docs"
-Requires-Dist: sphinx; extra == "docs"
-Requires-Dist: sphinx-autodoc-typehints; extra == "docs"
 Provides-Extra: pcode
 Requires-Dist: pypcode~=3.0; extra == "pcode"
+Provides-Extra: keystone
+Requires-Dist: keystone-engine; extra == "keystone"
 Provides-Extra: telemetry
 Requires-Dist: opentelemetry-api; extra == "telemetry"
-Provides-Extra: testing
-Requires-Dist: keystone-engine; extra == "testing"
-Requires-Dist: pypcode~=3.0; extra == "testing"
-Requires-Dist: pytest; extra == "testing"
-Requires-Dist: pytest-split; extra == "testing"
-Requires-Dist: pytest-xdist; extra == "testing"
-Requires-Dist: sqlalchemy; extra == "testing"
-Requires-Dist: unicorn==2.0.1.post1; extra == "testing"
 Provides-Extra: unicorn
 Requires-Dist: unicorn==2.0.1.post1; extra == "unicorn"
 Dynamic: license-file

{angr-9.2.153 → angr-9.2.156}/angr/__init__.py RENAMED Viewed

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
-__version__ = "9.2.153"
+__version__ = "9.2.156"
 if bytes is str:
     raise Exception(

{angr-9.2.153 → angr-9.2.156}/angr/analyses/analysis.py RENAMED Viewed

@@ -5,7 +5,7 @@ import sys
 import contextlib
 from collections import defaultdict
 from inspect import Signature
-from typing import TYPE_CHECKING, TypeVar, Generic, cast
+from typing import TYPE_CHECKING, TypeVar, Generic, cast, Any
 from collections.abc import Callable
 from types import NoneType
 from itertools import chain
@@ -111,7 +111,7 @@ class AnalysisLogEntry:
 A = TypeVar("A", bound="Analysis")
-class AnalysesHub(PluginVendor[A]):
+class AnalysesHub(PluginVendor[Any]):
     """
     This class contains functions for all the registered and runnable analyses,
     """
@@ -123,7 +123,7 @@ class AnalysesHub(PluginVendor[A]):
     def _init_plugin(self, plugin_cls: type[A]) -> AnalysisFactory[A]:
         return AnalysisFactory(self.project, plugin_cls)
-    def __getstate__(self):
+    def __getstate__(self):  # type: ignore[reportIncompatibleMethodOverride]
         s = super().__getstate__()
         return (s, self.project)

{angr-9.2.153 → angr-9.2.156}/angr/analyses/calling_convention/fact_collector.py RENAMED Viewed

@@ -6,7 +6,6 @@ from collections import defaultdict
 import pyvex
 import claripy
-from angr import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from angr.utils.bits import s2u, u2s
 from angr.block import Block
 from angr.analyses.analysis import Analysis
@@ -15,7 +14,8 @@ from angr.knowledge_plugins.functions import Function
 from angr.codenode import BlockNode, HookNode
 from angr.engines.light import SimEngineNostmtVEX, SimEngineLight, SpOffset, RegisterOffset
 from angr.calling_conventions import SimRegArg, SimStackArg, default_cc
-from angr.sim_type import SimTypeBottom, dereference_simtype, SimTypeFunction
+from angr.sim_type import SimTypeBottom, SimTypeFunction
+from angr.utils.types import dereference_simtype_by_lib
 from .utils import is_sane_register_variable
 if TYPE_CHECKING:
@@ -121,7 +121,7 @@ class SimEngineFactCollectorVEX(
         if self.block.vex.jumpkind == "Ijk_Call" and self.arch.ret_offset is not None:
             self.state.register_written(self.arch.ret_offset, self.arch.bytes)
-    def _top(self, bits: int):
+    def _top(self, bits: int):  # type: ignore
         return None
     def _is_top(self, expr: Any) -> bool:
@@ -190,13 +190,13 @@ class SimEngineFactCollectorVEX(
         self.state.register_read(expr.offset, bits // self.arch.byte_width)
         return RegisterOffset(bits, expr.offset, 0)
-    def _handle_expr_GetI(self, expr):
+    def _handle_expr_GetI(self, expr):  # type: ignore
         return None
-    def _handle_expr_ITE(self, expr):
+    def _handle_expr_ITE(self, expr):  # type: ignore
         return None
-    def _handle_expr_Load(self, expr):
+    def _handle_expr_Load(self, expr):  # type: ignore
         addr = self._expr(expr.addr)
         if isinstance(addr, SpOffset):
             self.state.stack_read(addr.offset, expr.result_size(self.tyenv) // self.arch.byte_width)
@@ -206,7 +206,7 @@ class SimEngineFactCollectorVEX(
     def _handle_expr_RdTmp(self, expr):
         return self.state.tmps.get(expr.tmp, None)
-    def _handle_expr_VECRET(self, expr):
+    def _handle_expr_VECRET(self, expr):  # type: ignore
         return None
     @binop_handler
@@ -444,13 +444,7 @@ class FactCollector(Analysis):
                             proto = func_succ.prototype
                             if func_succ.prototype_libname is not None:
                                 # we need to deref the prototype in case it uses SimTypeRef internally
-                                type_collections = []
-                                for prototype_lib in SIM_LIBRARIES[func_succ.prototype_libname]:
-                                    if prototype_lib.type_collection_names:
-                                        for typelib_name in prototype_lib.type_collection_names:
-                                            type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
-                                if type_collections:
-                                    proto = dereference_simtype(proto, type_collections)
+                                proto = dereference_simtype_by_lib(proto, func_succ.prototype_libname)
                             assert isinstance(proto, SimTypeFunction) and proto.returnty is not None
                             returnty_size = proto.returnty.with_arch(self.project.arch).size

{angr-9.2.153 → angr-9.2.156}/angr/analyses/cfg/cfg_fast.py RENAMED Viewed

@@ -45,7 +45,7 @@ from angr.utils.funcid import (
     is_function_likely_security_init_cookie,
 )
 from angr.analyses import ForwardAnalysis
-from angr.utils.segment_list import SegmentList
+from angr.rustylib import SegmentList
 from .cfg_arch_options import CFGArchOptions
 from .cfg_base import CFGBase
 from .indirect_jump_resolvers.jumptable import JumpTableResolver
@@ -1567,7 +1567,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     block = func.get_block(func.addr)
                 except SimTranslationError:
                     block = None
-                if block is not None and block.instructions == 1:
+                if block is not None and block.instructions == 1 and len(block.capstone.insns) == 1:
                     insn = block.capstone.insns[0]
                     if block.bytes == b"\xff\xe0":
                         func.info["jmp_rax"] = True
@@ -1921,7 +1921,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                     if cfg_node is None:
                         continue
                     func_addr = cfg_node.function_address
-                    if func_addr not in tested_func_addrs:
+                    if func_addr not in tested_func_addrs and self.kb.functions.contains_addr(func_addr):
                         func = self.kb.functions.get_by_addr(func_addr)
                         if not security_check_cookie_found and is_function_security_check_cookie(
                             func, self.project, security_cookie_addr

{angr-9.2.153 → angr-9.2.156}/angr/analyses/decompiler/ail_simplifier.py RENAMED Viewed

@@ -3,6 +3,7 @@ from __future__ import annotations
 from typing import Any, TYPE_CHECKING
 from collections.abc import Iterable
 from collections import defaultdict
+from enum import Enum
 import logging
 import networkx
@@ -22,12 +23,18 @@ from ailment.expression import (
     Const,
     BinaryOp,
     VirtualVariable,
+    UnaryOp,
 )
 from angr.analyses.s_propagator import SPropagatorAnalysis
 from angr.analyses.s_reaching_definitions import SRDAModel
 from angr.utils.ail import is_phi_assignment, HasExprWalker
-from angr.utils.ssa import has_call_in_between_stmts, has_store_stmt_in_between_stmts, has_load_expr_in_between_stmts
+from angr.utils.ssa import (
+    has_call_in_between_stmts,
+    has_store_stmt_in_between_stmts,
+    has_load_expr_in_between_stmts,
+    is_vvar_eliminatable,
+)
 from angr.code_location import CodeLocation, ExternalCodeLocation
 from angr.sim_variable import SimStackVariable, SimMemoryVariable, SimVariable
 from angr.knowledge_plugins.propagations.states import Equivalence
@@ -62,6 +69,12 @@ class HasVVarNotification(Exception):
     """
+class HasRefVVarNotification(Exception):
+    """
+    Notifies the existence of a reference to a VirtualVariable.
+    """
 class AILBlockTempCollector(AILBlockWalker):
     """
     Collects any temporaries used in a block.
@@ -78,6 +91,17 @@ class AILBlockTempCollector(AILBlockWalker):
             self.temps.add(expr)
+class DefEqRelation(Enum):
+    """
+    Describes the location relationship between a virtual variable definition and the equivalence statement.
+    """
+    UNKNOWN = 0
+    DEF_IS_FUNCARG = 1
+    DEF_EQ_SAME_BLOCK = 2
+    DEF_IN_EQ_PRED_BLOCK = 3
 class AILSimplifier(Analysis):
     """
     Perform function-level simplifications.
@@ -739,14 +763,21 @@ class AILSimplifier(Analysis):
                     continue
             elif isinstance(eq.atom0, VirtualVariable) and eq.atom0.was_reg:
-                if isinstance(eq.atom1, VirtualVariable) and (eq.atom1.was_reg or eq.atom1.was_parameter):
-                    # register == register
-                    if self.project.arch.is_artificial_register(eq.atom0.reg_offset, eq.atom0.size):
+                if isinstance(eq.atom1, VirtualVariable):
+                    if eq.atom1.was_reg or eq.atom1.was_parameter:
+                        # register == register
+                        if self.project.arch.is_artificial_register(eq.atom0.reg_offset, eq.atom0.size):
+                            to_replace = eq.atom0
+                            to_replace_is_def = True
+                        else:
+                            to_replace = eq.atom1
+                            to_replace_is_def = False
+                    elif eq.atom1.was_stack:
+                        # register == stack (but we try to replace the register vvar with the stack vvar)
                         to_replace = eq.atom0
                         to_replace_is_def = True
                     else:
-                        to_replace = eq.atom1
-                        to_replace_is_def = False
+                        continue
                 else:
                     continue
@@ -788,6 +819,7 @@ class AILSimplifier(Analysis):
                 # the definition is in a callee function
                 continue
+            def_eq_rel: DefEqRelation = DefEqRelation.UNKNOWN
             if isinstance(the_def.codeloc, ExternalCodeLocation) or (
                 isinstance(eq.atom1, VirtualVariable) and eq.atom1.was_parameter
             ):
@@ -800,6 +832,7 @@ class AILSimplifier(Analysis):
                 all_uses_with_def = None
                 replace_with = None
                 remove_initial_assignment = None
+                def_eq_rel = DefEqRelation.DEF_IS_FUNCARG
                 if defs and len(defs) == 1:
                     arg_copy_def = defs[0]
@@ -861,6 +894,7 @@ class AILSimplifier(Analysis):
                     # the eq location.
                     if eq.codeloc.stmt_idx < the_def.codeloc.stmt_idx:
                         continue
+                    def_eq_rel = DefEqRelation.DEF_EQ_SAME_BLOCK
                 else:
                     # the definition is in the predecessor block of the eq
                     eq_block = next(
@@ -876,6 +910,7 @@ class AILSimplifier(Analysis):
                         for pred in eq_block_preds
                     ):
                         continue
+                    def_eq_rel = DefEqRelation.DEF_IN_EQ_PRED_BLOCK
                 if isinstance(eq.atom0, VirtualVariable) and eq.atom0.was_stack:
                     # create the replacement expression
@@ -912,11 +947,16 @@ class AILSimplifier(Analysis):
                         **eq.atom1.tags,
                     )
                 elif isinstance(eq.atom0, VirtualVariable) and eq.atom0.was_reg:
-                    if isinstance(eq.atom1, VirtualVariable) and eq.atom1.was_reg:
-                        if self.project.arch.is_artificial_register(eq.atom0.reg_offset, eq.atom0.size):
+                    if isinstance(eq.atom1, VirtualVariable):
+                        if eq.atom1.was_reg:
+                            if self.project.arch.is_artificial_register(eq.atom0.reg_offset, eq.atom0.size):
+                                replace_with = eq.atom1
+                            else:
+                                replace_with = eq.atom0
+                        elif eq.atom1.was_stack:
                             replace_with = eq.atom1
                         else:
-                            replace_with = eq.atom0
+                            raise AngrRuntimeError(f"Unsupported atom1 vvar type {eq.atom1.category}.")
                     else:
                         raise AngrRuntimeError(f"Unsupported atom1 type {type(eq.atom1)}.")
                 else:
@@ -979,6 +1019,19 @@ class AILSimplifier(Analysis):
             assert replace_with is not None
+            to_replace_used_in_refs = False
+            if isinstance(to_replace, VirtualVariable) and to_replace.was_stack:
+                # if the variable being replaced has ever been accessed as a reference, we cannot replace it safely
+                for _, (_, use_loc) in all_uses_with_def:
+                    assert use_loc.block_addr is not None and use_loc.stmt_idx is not None
+                    block = addr_and_idx_to_block[(use_loc.block_addr, use_loc.block_idx)]
+                    stmt = block.statements[use_loc.stmt_idx]
+                    if self._statement_uses_ref_vvar(stmt, to_replace.varid):
+                        to_replace_used_in_refs = True
+                        break
+            if to_replace_used_in_refs:
+                continue
             if any(not isinstance(expr_and_use[0], VirtualVariable) for _, expr_and_use in all_uses_with_def):
                 # if any of the uses are phi assignments, we skip
                 used_in_phi_assignment = False
@@ -1005,6 +1058,11 @@ class AILSimplifier(Analysis):
                 ):
                     # this use happens before the assignment - ignore it
                     continue
+                if def_eq_rel == DefEqRelation.DEF_IN_EQ_PRED_BLOCK and u.block_addr == def_.codeloc.block_addr:
+                    # the definition is in a predecessor block of the eq location, so all uses must be in the same
+                    # block as the eq location. (technically it can also be in a successor block to the eq location, but
+                    # we don't support it yet).
+                    continue
                 filtered_all_uses_with_def.append((def_, expr_and_use))
             all_uses_with_def = filtered_all_uses_with_def
@@ -1420,7 +1478,17 @@ class AILSimplifier(Analysis):
                 if uses is None:
                     vvar = rd.varid_to_vvar[vvar_id]
-                    if vvar.was_stack:
+                    def_codeloc = rd.all_vvar_definitions[vvar_id]
+                    if isinstance(def_codeloc, ExternalCodeLocation):
+                        def_stmt = None
+                    else:
+                        assert def_codeloc.block_addr is not None and def_codeloc.stmt_idx is not None
+                        def_stmt = blocks[(def_codeloc.block_addr, def_codeloc.block_idx)].statements[
+                            def_codeloc.stmt_idx
+                        ]
+                    if is_vvar_eliminatable(vvar, def_stmt):
+                        uses = rd.all_vvar_uses[vvar_id]
+                    elif vvar.was_stack:
                         if not self._remove_dead_memdefs:
                             if rd.is_phi_vvar_id(vvar_id):
                                 # we always remove unused phi variables
@@ -1437,9 +1505,6 @@ class AILSimplifier(Analysis):
                                 continue
                         uses = rd.all_vvar_uses[vvar_id]
-                    elif vvar.was_tmp or vvar.was_reg or vvar.was_parameter:
-                        uses = rd.all_vvar_uses[vvar_id]
                     else:
                         uses = set()
@@ -1740,6 +1805,10 @@ class AILSimplifier(Analysis):
         return updated
+    #
+    # Util functions
+    #
     @staticmethod
     def _statement_has_call_exprs(stmt: Statement) -> bool:
         def _handle_callexpr(expr_idx, expr, stmt_idx, stmt, block):  # pylint:disable=unused-argument
@@ -1784,5 +1853,20 @@ class AILSimplifier(Analysis):
                 return True
         return False
+    @staticmethod
+    def _statement_uses_ref_vvar(stmt: Statement, vvar_id: int) -> bool:
+        def _handle_UnaryOp(expr_idx, expr, stmt_idx, stmt, block):  # pylint:disable=unused-argument
+            if expr.op == "Reference" and isinstance(expr.operand, VirtualVariable) and expr.operand.varid == vvar_id:
+                raise HasRefVVarNotification
+        walker = AILBlockWalker()
+        walker.expr_handlers[UnaryOp] = _handle_UnaryOp
+        try:
+            walker.walk_statement(stmt)
+        except HasRefVVarNotification:
+            return True
+        return False
 AnalysesHub.register_default("AILSimplifier", AILSimplifier)

angr 9.2.153__tar.gz → 9.2.156__tar.gz

Potentially problematic release.

angr 9.2.153tar.gz → 9.2.156tar.gz