angr 9.2.154__tar.gz → 9.2.156__tar.gz

angr-9.2.156/Cargo.lock

@@ -0,0 +1,178 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "angr"
+version = "0.1.0"
+dependencies = [
+ "pyo3",
+ "rangemap",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "indoc"
+version = "2.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c7245a08504955605670dbf141fceab975f15ca21570696aebe9d2e71576bd"
+
+[[package]]
+name = "libc"
+version = "0.2.172"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "portable-atomic"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5203598f366b11a02b13aa20cab591229ff0a89fd121a308a5df751d5fc9219"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99636d423fa2ca130fa5acde3059308006d46f98caac629418e53f7ebb1e9999"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78f9cf92ba9c409279bc3305b5409d90db2d2c22392d443a87df3a1adad59e33"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b999cb1a6ce21f9a6b147dcf1be9ffedf02e0043aec74dc390f3007047cecd9"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "822ece1c7e1012745607d5cf0bcb2874769f0f7cb34c4cde03b9358eb9ef911a"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rangemap"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60fcc7d6849342eff22c4350c8b9a989ee8ceabc4b481253e8946b9fe83d684"
+
+[[package]]
+name = "syn"
+version = "2.0.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e502f78cdbb8ba4718f566c418c52bc729126ffd16baee5baa718cf25dd5a69a"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+
+[[package]]
+name = "unindent"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"

angr-9.2.156/Cargo.toml

@@ -0,0 +1,28 @@
+[workspace]
+resolver = "3"
+rust-version = "1.86.0"
+members = ["crates/angr"]
+
+[workspace.package]
+license = "BSD-2-Clause"
+readme = "README.md"
+keywords = [
+    "analysis",
+    "angr",
+    "binary",
+    "decompiler",
+    "emulator",
+    "engineering",
+    "execution",
+    "research",
+    "reverse",
+    "security",
+    "symbolic",
+    "vulnerability",
+]
+categories = ["science", "security"]
+repository = "https://github.com/angr/angr.git"
+
+[workspace.lints.clippy]
+all = "warn"
+cargo = "warn"

{angr-9.2.154 → angr-9.2.156}/MANIFEST.in

@@ -1,3 +1,6 @@
 include LICENSE
 include README.md
 recursive-include native *.c *.cpp *.h *.hpp *.def Makefile Makefile-win
+include Cargo.toml
+include Cargo.lock
+graft crates

{angr-9.2.154/angr.egg-info → angr-9.2.156}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.154
+Version: 9.2.156
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.154
-Requires-Dist: archinfo==9.2.154
+Requires-Dist: ailment==9.2.156
+Requires-Dist: archinfo==9.2.156
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.154
-Requires-Dist: cle==9.2.154
+Requires-Dist: claripy==9.2.156
+Requires-Dist: cle==9.2.156
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -31,7 +31,7 @@ Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.154
+Requires-Dist: pyvex==9.2.156
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy
@@ -39,23 +39,12 @@ Requires-Dist: unique-log-filter
 Requires-Dist: colorama; platform_system == "Windows"
 Provides-Extra: angrdb
 Requires-Dist: sqlalchemy; extra == "angrdb"
-Provides-Extra: docs
-Requires-Dist: furo; extra == "docs"
-Requires-Dist: myst-parser; extra == "docs"
-Requires-Dist: sphinx; extra == "docs"
-Requires-Dist: sphinx-autodoc-typehints; extra == "docs"
 Provides-Extra: pcode
 Requires-Dist: pypcode~=3.0; extra == "pcode"
+Provides-Extra: keystone
+Requires-Dist: keystone-engine; extra == "keystone"
 Provides-Extra: telemetry
 Requires-Dist: opentelemetry-api; extra == "telemetry"
-Provides-Extra: testing
-Requires-Dist: keystone-engine; extra == "testing"
-Requires-Dist: pypcode~=3.0; extra == "testing"
-Requires-Dist: pytest; extra == "testing"
-Requires-Dist: pytest-split; extra == "testing"
-Requires-Dist: pytest-xdist; extra == "testing"
-Requires-Dist: sqlalchemy; extra == "testing"
-Requires-Dist: unicorn==2.0.1.post1; extra == "testing"
 Provides-Extra: unicorn
 Requires-Dist: unicorn==2.0.1.post1; extra == "unicorn"
 Dynamic: license-file

{angr-9.2.154 → angr-9.2.156}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.154"
+__version__ = "9.2.156"
 
 if bytes is str:
     raise Exception(

{angr-9.2.154 → angr-9.2.156}/angr/analyses/cfg/cfg_fast.py

@@ -45,7 +45,7 @@ from angr.utils.funcid import (
     is_function_likely_security_init_cookie,
 )
 from angr.analyses import ForwardAnalysis
-from angr.utils.segment_list import SegmentList
+from angr.rustylib import SegmentList
 from .cfg_arch_options import CFGArchOptions
 from .cfg_base import CFGBase
 from .indirect_jump_resolvers.jumptable import JumpTableResolver

{angr-9.2.154 → angr-9.2.156}/angr/analyses/decompiler/ail_simplifier.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from typing import Any, TYPE_CHECKING
 from collections.abc import Iterable
 from collections import defaultdict
+from enum import Enum
 import logging
 
 import networkx
@@ -22,12 +23,18 @@ from ailment.expression import (
     Const,
     BinaryOp,
     VirtualVariable,
+    UnaryOp,
 )
 
 from angr.analyses.s_propagator import SPropagatorAnalysis
 from angr.analyses.s_reaching_definitions import SRDAModel
 from angr.utils.ail import is_phi_assignment, HasExprWalker
-from angr.utils.ssa import has_call_in_between_stmts, has_store_stmt_in_between_stmts, has_load_expr_in_between_stmts
+from angr.utils.ssa import (
+    has_call_in_between_stmts,
+    has_store_stmt_in_between_stmts,
+    has_load_expr_in_between_stmts,
+    is_vvar_eliminatable,
+)
 from angr.code_location import CodeLocation, ExternalCodeLocation
 from angr.sim_variable import SimStackVariable, SimMemoryVariable, SimVariable
 from angr.knowledge_plugins.propagations.states import Equivalence
@@ -62,6 +69,12 @@ class HasVVarNotification(Exception):
     """
 
 
+class HasRefVVarNotification(Exception):
+    """
+    Notifies the existence of a reference to a VirtualVariable.
+    """
+
+
 class AILBlockTempCollector(AILBlockWalker):
     """
     Collects any temporaries used in a block.
@@ -78,6 +91,17 @@ class AILBlockTempCollector(AILBlockWalker):
             self.temps.add(expr)
 
 
+class DefEqRelation(Enum):
+    """
+    Describes the location relationship between a virtual variable definition and the equivalence statement.
+    """
+
+    UNKNOWN = 0
+    DEF_IS_FUNCARG = 1
+    DEF_EQ_SAME_BLOCK = 2
+    DEF_IN_EQ_PRED_BLOCK = 3
+
+
 class AILSimplifier(Analysis):
     """
     Perform function-level simplifications.
@@ -739,14 +763,21 @@ class AILSimplifier(Analysis):
                     continue
 
             elif isinstance(eq.atom0, VirtualVariable) and eq.atom0.was_reg:
-                if isinstance(eq.atom1, VirtualVariable) and (eq.atom1.was_reg or eq.atom1.was_parameter):
-                    # register == register
-                    if self.project.arch.is_artificial_register(eq.atom0.reg_offset, eq.atom0.size):
+                if isinstance(eq.atom1, VirtualVariable):
+                    if eq.atom1.was_reg or eq.atom1.was_parameter:
+                        # register == register
+                        if self.project.arch.is_artificial_register(eq.atom0.reg_offset, eq.atom0.size):
+                            to_replace = eq.atom0
+                            to_replace_is_def = True
+                        else:
+                            to_replace = eq.atom1
+                            to_replace_is_def = False
+                    elif eq.atom1.was_stack:
+                        # register == stack (but we try to replace the register vvar with the stack vvar)
                         to_replace = eq.atom0
                         to_replace_is_def = True
                     else:
-                        to_replace = eq.atom1
-                        to_replace_is_def = False
+                        continue
                 else:
                     continue
 
@@ -788,6 +819,7 @@ class AILSimplifier(Analysis):
                 # the definition is in a callee function
                 continue
 
+            def_eq_rel: DefEqRelation = DefEqRelation.UNKNOWN
             if isinstance(the_def.codeloc, ExternalCodeLocation) or (
                 isinstance(eq.atom1, VirtualVariable) and eq.atom1.was_parameter
             ):
@@ -800,6 +832,7 @@ class AILSimplifier(Analysis):
                 all_uses_with_def = None
                 replace_with = None
                 remove_initial_assignment = None
+                def_eq_rel = DefEqRelation.DEF_IS_FUNCARG
 
                 if defs and len(defs) == 1:
                     arg_copy_def = defs[0]
@@ -861,6 +894,7 @@ class AILSimplifier(Analysis):
                     # the eq location.
                     if eq.codeloc.stmt_idx < the_def.codeloc.stmt_idx:
                         continue
+                    def_eq_rel = DefEqRelation.DEF_EQ_SAME_BLOCK
                 else:
                     # the definition is in the predecessor block of the eq
                     eq_block = next(
@@ -876,6 +910,7 @@ class AILSimplifier(Analysis):
                         for pred in eq_block_preds
                     ):
                         continue
+                    def_eq_rel = DefEqRelation.DEF_IN_EQ_PRED_BLOCK
 
                 if isinstance(eq.atom0, VirtualVariable) and eq.atom0.was_stack:
                     # create the replacement expression
@@ -912,11 +947,16 @@ class AILSimplifier(Analysis):
                         **eq.atom1.tags,
                     )
                 elif isinstance(eq.atom0, VirtualVariable) and eq.atom0.was_reg:
-                    if isinstance(eq.atom1, VirtualVariable) and eq.atom1.was_reg:
-                        if self.project.arch.is_artificial_register(eq.atom0.reg_offset, eq.atom0.size):
+                    if isinstance(eq.atom1, VirtualVariable):
+                        if eq.atom1.was_reg:
+                            if self.project.arch.is_artificial_register(eq.atom0.reg_offset, eq.atom0.size):
+                                replace_with = eq.atom1
+                            else:
+                                replace_with = eq.atom0
+                        elif eq.atom1.was_stack:
                             replace_with = eq.atom1
                         else:
-                            replace_with = eq.atom0
+                            raise AngrRuntimeError(f"Unsupported atom1 vvar type {eq.atom1.category}.")
                     else:
                         raise AngrRuntimeError(f"Unsupported atom1 type {type(eq.atom1)}.")
                 else:
@@ -979,6 +1019,19 @@ class AILSimplifier(Analysis):
 
             assert replace_with is not None
 
+            to_replace_used_in_refs = False
+            if isinstance(to_replace, VirtualVariable) and to_replace.was_stack:
+                # if the variable being replaced has ever been accessed as a reference, we cannot replace it safely
+                for _, (_, use_loc) in all_uses_with_def:
+                    assert use_loc.block_addr is not None and use_loc.stmt_idx is not None
+                    block = addr_and_idx_to_block[(use_loc.block_addr, use_loc.block_idx)]
+                    stmt = block.statements[use_loc.stmt_idx]
+                    if self._statement_uses_ref_vvar(stmt, to_replace.varid):
+                        to_replace_used_in_refs = True
+                        break
+            if to_replace_used_in_refs:
+                continue
+
             if any(not isinstance(expr_and_use[0], VirtualVariable) for _, expr_and_use in all_uses_with_def):
                 # if any of the uses are phi assignments, we skip
                 used_in_phi_assignment = False
@@ -1005,6 +1058,11 @@ class AILSimplifier(Analysis):
                 ):
                     # this use happens before the assignment - ignore it
                     continue
+                if def_eq_rel == DefEqRelation.DEF_IN_EQ_PRED_BLOCK and u.block_addr == def_.codeloc.block_addr:
+                    # the definition is in a predecessor block of the eq location, so all uses must be in the same
+                    # block as the eq location. (technically it can also be in a successor block to the eq location, but
+                    # we don't support it yet).
+                    continue
                 filtered_all_uses_with_def.append((def_, expr_and_use))
             all_uses_with_def = filtered_all_uses_with_def
 
@@ -1420,7 +1478,17 @@ class AILSimplifier(Analysis):
 
                 if uses is None:
                     vvar = rd.varid_to_vvar[vvar_id]
-                    if vvar.was_stack:
+                    def_codeloc = rd.all_vvar_definitions[vvar_id]
+                    if isinstance(def_codeloc, ExternalCodeLocation):
+                        def_stmt = None
+                    else:
+                        assert def_codeloc.block_addr is not None and def_codeloc.stmt_idx is not None
+                        def_stmt = blocks[(def_codeloc.block_addr, def_codeloc.block_idx)].statements[
+                            def_codeloc.stmt_idx
+                        ]
+                    if is_vvar_eliminatable(vvar, def_stmt):
+                        uses = rd.all_vvar_uses[vvar_id]
+                    elif vvar.was_stack:
                         if not self._remove_dead_memdefs:
                             if rd.is_phi_vvar_id(vvar_id):
                                 # we always remove unused phi variables
@@ -1437,9 +1505,6 @@ class AILSimplifier(Analysis):
                                 continue
                         uses = rd.all_vvar_uses[vvar_id]
 
-                    elif vvar.was_tmp or vvar.was_reg or vvar.was_parameter:
-                        uses = rd.all_vvar_uses[vvar_id]
-
                     else:
                         uses = set()
 
@@ -1740,6 +1805,10 @@ class AILSimplifier(Analysis):
 
         return updated
 
+    #
+    # Util functions
+    #
+
     @staticmethod
     def _statement_has_call_exprs(stmt: Statement) -> bool:
         def _handle_callexpr(expr_idx, expr, stmt_idx, stmt, block):  # pylint:disable=unused-argument
@@ -1784,5 +1853,20 @@ class AILSimplifier(Analysis):
                 return True
         return False
 
+    @staticmethod
+    def _statement_uses_ref_vvar(stmt: Statement, vvar_id: int) -> bool:
+        def _handle_UnaryOp(expr_idx, expr, stmt_idx, stmt, block):  # pylint:disable=unused-argument
+            if expr.op == "Reference" and isinstance(expr.operand, VirtualVariable) and expr.operand.varid == vvar_id:
+                raise HasRefVVarNotification
+
+        walker = AILBlockWalker()
+        walker.expr_handlers[UnaryOp] = _handle_UnaryOp
+        try:
+            walker.walk_statement(stmt)
+        except HasRefVVarNotification:
+            return True
+
+        return False
+
 
 AnalysesHub.register_default("AILSimplifier", AILSimplifier)