angr 9.2.157__tar.gz → 9.2.158__tar.gz

{angr-9.2.157 → angr-9.2.158}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.157
+Version: 9.2.158
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.157
-Requires-Dist: archinfo==9.2.157
+Requires-Dist: ailment==9.2.158
+Requires-Dist: archinfo==9.2.158
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.157
-Requires-Dist: cle==9.2.157
+Requires-Dist: claripy==9.2.158
+Requires-Dist: cle==9.2.158
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -32,7 +32,7 @@ Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
 Requires-Dist: pypcode<4.0,>=3.2.1
-Requires-Dist: pyvex==9.2.157
+Requires-Dist: pyvex==9.2.158
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.157 → angr-9.2.158}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.157"
+__version__ = "9.2.158"
 
 if bytes is str:
     raise Exception(

{angr-9.2.157 → angr-9.2.158}/angr/analyses/decompiler/ail_simplifier.py

@@ -102,6 +102,44 @@ class DefEqRelation(Enum):
     DEF_IN_EQ_PRED_BLOCK = 3
 
 
+class PartialConstantExprRewriter(AILBlockWalker):
+    """
+    Rewrites expressions whose high bits are definitely zero to constants (if possible) or mask them with masks
+    properly.
+    """
+
+    def __init__(self, varid: int, zero_high_bits: int):
+        super().__init__(update_block=False)
+        self.varid = varid
+        self.zero_high_bits = zero_high_bits
+
+    def _handle_BinaryOp(  # type:ignore
+        self, expr_idx: int, expr: BinaryOp, stmt_idx: int, stmt: Statement, block: Block | None
+    ):
+        if (
+            expr.op == "And"
+            and isinstance(expr.operands[0], VirtualVariable)
+            and expr.operands[0].varid == self.varid
+            and isinstance(expr.operands[1], Const)
+            and expr.operands[1].is_int
+        ):
+            vvar = expr.operands[0]
+            mask_expr = expr.operands[1]
+            mask = mask_expr.value
+            assert isinstance(mask, int)
+            # high_bits_mask[vvar.bits - 1:vvar.bits - self.zero_high_bits] == 0
+            high_bits_mask = ((1 << vvar.bits) - 1) ^ ((1 << (vvar.bits - self.zero_high_bits)) - 1)
+            high_bits_mask &= mask  # in case high bits of mask are zero
+            new_mask = mask ^ high_bits_mask
+            if new_mask == mask:
+                return None
+            if new_mask == 0:
+                return Const(expr_idx, None, 0, expr.bits, **expr.tags)
+            new_mask_expr = Const(mask_expr.idx, mask_expr.variable, new_mask, mask_expr.bits, **mask_expr.tags)
+            return BinaryOp(expr_idx, expr.op, [vvar, new_mask_expr], bits=expr.bits, **expr.tags)
+        return super()._handle_BinaryOp(expr_idx, expr, stmt_idx, stmt, block)
+
+
 class AILSimplifier(Analysis):
     """
     Perform function-level simplifications.
@@ -179,6 +217,15 @@ class AILSimplifier(Analysis):
             # reaching definition analysis results are no longer reliable
             self._clear_cache()
 
+        _l.debug("Propagating partial-constant expressions")
+        pconst_propagated = self._propagate_partial_constant_exprs()
+        self.simplified |= pconst_propagated
+        if pconst_propagated:
+            _l.debug("... partial-constant expressions propagated")
+            self._rebuild_func_graph()
+            # reaching definition analysis results are no longer reliable
+            self._clear_cache()
+
         if self._only_consts:
             return
 
@@ -687,6 +734,59 @@ class AILSimplifier(Analysis):
             self._clear_cache()
         return replaced
 
+    #
+    # Partial constant expression propagation
+    #
+
+    def _propagate_partial_constant_exprs(self) -> bool:
+        """
+        Discover virtual variables whose certain consecutive bits are constant and propagate these bits.
+        """
+
+        # vvar_zero_bits[varid] = N  ==>  the high N bits of vvar varid are 0s
+        vvar_zero_bits: dict[int, int] = {}
+
+        # go over all vvar definitions and find the ones with partial constants
+        for block in self.func_graph:
+            for stmt in block.statements:
+                if (
+                    isinstance(stmt, Assignment)
+                    and isinstance(stmt.dst, VirtualVariable)
+                    and isinstance(stmt.src, Convert)
+                    and stmt.src.to_bits > stmt.src.from_bits
+                ):
+                    # this is a conversion from a wider to a narrower type; the top N bits are 0s
+                    vvar_zero_bits[stmt.dst.varid] = stmt.src.to_bits - stmt.src.from_bits
+
+        if not vvar_zero_bits:
+            return False
+
+        # now replace the uses of these vvars
+        addr_and_idx_to_block: dict[tuple[int, int | None], Block] = {}
+        for block in self.func_graph:
+            addr_and_idx_to_block[(block.addr, block.idx)] = block
+
+        rda = self._compute_reaching_definitions()
+        changed = False
+        for vvarid, zero_high_bits in vvar_zero_bits.items():
+            rewriter = PartialConstantExprRewriter(vvarid, zero_high_bits)
+            for _, use_loc in rda.all_vvar_uses[vvarid]:
+                assert use_loc.block_addr is not None
+                original_block = addr_and_idx_to_block[(use_loc.block_addr, use_loc.block_idx)]
+                block = self.blocks.get(original_block, original_block)
+                stmt = block.statements[use_loc.stmt_idx]
+                new_stmt = rewriter.walk_statement(stmt, block)
+
+                if new_stmt is not None and new_stmt is not stmt:
+                    statements = block.statements[::]
+                    statements[use_loc.stmt_idx] = new_stmt
+                    new_block = block.copy(statements=statements)
+
+                    self.blocks[original_block] = new_block
+                    changed = True
+
+        return changed
+
     #
     # Unifying local variables
     #

{angr-9.2.157 → angr-9.2.158}/angr/analyses/decompiler/clinic.py

@@ -218,6 +218,9 @@ class Clinic(Analysis):
 
         self._new_block_addrs = set()
 
+        # a reference to the Typehoon type inference engine; useful for debugging and loading stats post decompilation
+        self.typehoon = None
+
         # sanity checks
         if not self.kb.functions:
             l.warning("No function is available in kb.functions. It will lead to a suboptimal conversion result.")
@@ -1888,6 +1891,7 @@ class Clinic(Analysis):
                         if isinstance(v, SimMemoryVariable) and not isinstance(v, SimStackVariable)
                     },
                 )
+                self.typehoon = tp
             except Exception:  # pylint:disable=broad-except
                 if self._fail_fast:
                     raise

{angr-9.2.157 → angr-9.2.158}/angr/analyses/decompiler/condition_processor.py

@@ -226,7 +226,6 @@ class ConditionProcessor:
         self.arch = arch
         self._condition_mapping: dict[str, Any] = {} if condition_mapping is None else condition_mapping
         self.jump_table_conds: dict[int, set] = defaultdict(set)
-        self.edge_conditions = {}
         self.reaching_conditions = {}
         self.guarding_conditions = {}
         self._ast2annotations = {}
@@ -264,7 +263,7 @@ class ConditionProcessor:
                     predicate = self.recover_edge_condition(graph, src, dst)
                     edge_conditions[(src, dst)] = predicate
 
-        self.edge_conditions = edge_conditions
+        return edge_conditions
 
     def recover_reaching_conditions(
         self,
@@ -285,8 +284,7 @@ class ConditionProcessor:
             """
             return dominates(inv_idoms, node_a, node_b)
 
-        self.recover_edge_conditions(region, graph=graph)
-        edge_conditions = self.edge_conditions
+        edge_conditions = self.recover_edge_conditions(region, graph=graph)
 
         if graph:
             _g = graph
@@ -549,7 +547,9 @@ class ConditionProcessor:
         raise NotImplementedError
 
     @classmethod
-    def get_last_statements(cls, block) -> list[ailment.Stmt.Statement | None]:
+    def get_last_statements(
+        cls, block
+    ) -> list[ailment.Stmt.Statement | ConditionalBreakNode | BreakNode | ContinueNode | None]:
         if type(block) is SequenceNode:
             for last_node in reversed(block.nodes):
                 try:
@@ -689,7 +689,9 @@ class ConditionProcessor:
             target_ast = self.claripy_ast_from_ail_condition(last_stmt.target, ins_addr=last_stmt.ins_addr)
             return target_ast == dst_block.addr
         if type(last_stmt) is ailment.Stmt.ConditionalJump:
-            bool_var = self.claripy_ast_from_ail_condition(last_stmt.condition, ins_addr=last_stmt.ins_addr)
+            bool_var = self.claripy_ast_from_ail_condition(
+                last_stmt.condition, must_bool=True, ins_addr=last_stmt.ins_addr
+            )
             if isinstance(last_stmt.true_target, ailment.Expr.Const) and last_stmt.true_target.value == dst_block.addr:
                 return bool_var
             return claripy.Not(bool_var)
@@ -817,7 +819,7 @@ class ConditionProcessor:
         )
 
     def claripy_ast_from_ail_condition(
-        self, condition, nobool: bool = False, *, ins_addr: int = 0
+        self, condition, *, nobool: bool = False, must_bool: bool = False, ins_addr: int = 0
     ) -> claripy.ast.Bool | claripy.ast.Bits:
         # Unpack a condition all the way to the leaves
         if isinstance(
@@ -848,7 +850,7 @@ class ConditionProcessor:
             return var
         if isinstance(condition, ailment.Expr.Convert):
             # convert is special. if it generates a 1-bit variable, it should be treated as a BoolS
-            if condition.to_bits == 1:
+            if condition.to_bits == 1 and not nobool:
                 var_ = self.claripy_ast_from_ail_condition(condition.operands[0], ins_addr=ins_addr)
                 name = f"ailcond_Conv({condition.from_bits}->{condition.to_bits}, {hash(var_)})"
                 var = claripy.BoolS(name, explicit_name=True)
@@ -910,6 +912,15 @@ class ConditionProcessor:
             self._condition_mapping[r.args[0]] = condition
         # don't lose tags
         self._ast2annotations[r] = condition.tags
+
+        if isinstance(r, claripy.ast.BV) and r.size() == 1 and must_bool:
+            # convert to a BoolS
+            if r.op == "BVV":
+                r = claripy.false() if r.args[0] == 0 else claripy.true()
+            else:
+                # r.op == "BVS"
+                r = claripy.BoolS(f"bool_from_bv1_{r.args[0]}", explicit_name=True)
+                self._condition_mapping[r.args[0]] = condition
         return r
 
     #

{angr-9.2.157 → angr-9.2.158}/angr/analyses/decompiler/peephole_optimizations/base.py

@@ -123,7 +123,7 @@ class PeepholeOptimizationExprBase:
         self.preserve_vvar_ids = set() if preserve_vvar_ids is None else preserve_vvar_ids
         self.type_hints = [] if type_hints is None else type_hints
 
-    def optimize(self, expr, **kwargs):
+    def optimize(self, expr, stmt_idx: int | None = None, block=None, **kwargs):
         raise NotImplementedError("_optimize() is not implemented.")
 
     #

angr-9.2.158/angr/analyses/decompiler/peephole_optimizations/const_mull_a_shift.py

@@ -0,0 +1,242 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
+
+from ailment.expression import Convert, BinaryOp, Const, Expression
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ConstMullAShift(PeepholeOptimizationExprBase):
+    """
+    Convert expressions with right shifts into expressions with divisions.
+    """
+
+    __slots__ = ()
+
+    NAME = "Conv(64->32, (N * a) >> M) => a / N1"
+    expr_classes = (Convert, BinaryOp)
+
+    def optimize(self, expr: Convert | BinaryOp, **kwargs):
+        r = None
+
+        if isinstance(expr, Convert):
+            if expr.from_bits == 64 and expr.to_bits == 32 and isinstance(expr.operand, BinaryOp):
+                r = self.optimize_binaryop(expr.operand)
+
+        elif isinstance(expr, BinaryOp):
+            r = self.optimize_binaryop(expr)
+
+        # keep size
+        if r is not None and r.bits < expr.bits:
+            r = Convert(expr.idx, r.bits, expr.bits, False, r, **expr.tags)
+
+        return r
+
+    def optimize_binaryop(self, original_expr: BinaryOp):
+        if isinstance(original_expr, BinaryOp):
+            # try to unify if both operands are wrapped with Convert()
+            conv_expr = self._unify_conversion(original_expr)
+            expr = original_expr if conv_expr is None else conv_expr.operand
+
+            if expr.op == "Shr" and isinstance(expr.operands[1], Const):
+                # (N * a) >> M  ==>  a / N1
+                inner = expr.operands[0]
+                if isinstance(inner, BinaryOp) and inner.op in {"Mull", "Mul"} and not inner.signed:
+                    if isinstance(inner.operands[0], Const) and not isinstance(inner.operands[1], Const):
+                        C = inner.operands[0].value
+                        X = inner.operands[1]
+                    elif isinstance(inner.operands[1], Const) and not isinstance(inner.operands[0], Const):
+                        C = inner.operands[1].value
+                        X = inner.operands[0]
+                    else:
+                        C = X = None
+
+                    if C is not None and X is not None:
+                        V = expr.operands[1].value
+                        ndigits = 5 if V == 32 else 6
+                        divisor = self._check_divisor(pow(2, V), C, ndigits)
+                        if divisor is not None:
+                            new_const = Const(None, None, divisor, X.bits)
+                            r = BinaryOp(inner.idx, "Div", [X, new_const], inner.signed, **inner.tags)
+                            return self._reconvert(r, conv_expr) if conv_expr is not None else r
+
+            elif expr.op in {"Add", "Sub"}:
+                expr0, expr1 = expr.operands
+                if isinstance(expr1, Convert) and expr1.from_bits == 32 and expr1.to_bits == 64:
+                    r = self._match_case_a(expr0, expr1)
+                    if r is not None:
+                        return self._reconvert(r, conv_expr) if conv_expr is not None else r
+
+                # with Convert in consideration
+                if (
+                    isinstance(expr0, BinaryOp)
+                    and expr0.op in {"Shr", "Sar"}
+                    and isinstance(expr0.operands[1], Const)
+                    and expr0.operands[1].value == 0x3F
+                    and isinstance(expr1, BinaryOp)
+                    and expr1.op in {"Shr", "Sar"}
+                    and isinstance(expr1.operands[1], Const)
+                    and expr1.operands[1].value == 0x20
+                ):
+                    expr0_operand = expr0.operands[0]
+                    expr1_operand = expr1.operands[0]
+                    if (
+                        isinstance(expr0_operand, BinaryOp)
+                        and expr0_operand.op in {"Mull", "Mul"}
+                        and expr0_operand.signed
+                        and isinstance(expr0_operand.operands[1], Const)
+                    ):
+                        a0 = expr0_operand.operands[0]
+                        a1 = expr1_operand.operands[0]
+                    elif (
+                        isinstance(expr1_operand, BinaryOp)
+                        and expr1_operand.op in {"Mull", "Mul"}
+                        and expr1_operand.signed
+                        and isinstance(expr1_operand.operands[1], Const)
+                    ):
+                        a0 = expr1_operand.operands[0]
+                        a1 = expr0_operand.operands[0]
+                    else:
+                        a0, a1 = None, None
+
+                    if a0 is not None and a1 is not None and a0.likes(a1):
+                        # (a * x >> 0x3f) +/- (a * x >> 0x20)  ==>  a / N
+                        C = expr0_operand.operands[1].value
+                        X = a0
+                        V = 32
+                        ndigits = 5 if V == 32 else 6
+                        divisor = self._check_divisor(pow(2, V), C, ndigits)
+                        if divisor is not None:
+                            new_const = Const(None, None, divisor, X.bits)
+                            r = BinaryOp(
+                                expr0_operand.idx,
+                                "Div",
+                                [X, new_const],
+                                expr0_operand.signed,
+                                **expr0_operand.tags,
+                            )
+                            return self._reconvert(r, conv_expr) if conv_expr is not None else r
+
+        return None
+
+    def _match_case_a(self, expr0: Expression, expr1_op: Convert) -> BinaryOp | None:
+        # (
+        #   (((Conv(32->64, vvar_44{reg 32}) * 0x4325c53f<64>) >>a 0x24<8>) & 0xffffffff<64>) -
+        #   Conv(32->s64, (vvar_44{reg 32} >>a 0x1f<8>))
+        # )
+
+        expr1_op = expr1_op.operand
+
+        if (
+            isinstance(expr0, BinaryOp)
+            and expr0.op == "And"
+            and isinstance(expr0.operands[1], Const)
+            and expr0.operands[1].value == 0xFFFFFFFF
+        ):
+            expr0 = expr0.operands[0]
+        else:
+            return None
+
+        if (
+            isinstance(expr0, BinaryOp)
+            and expr0.op in {"Shr", "Sar"}
+            and isinstance(expr0.operands[1], Const)
+            and isinstance(expr1_op, BinaryOp)
+            and expr1_op.op in {"Shr", "Sar"}
+            and isinstance(expr1_op.operands[1], Const)
+        ):
+            if (
+                isinstance(expr0.operands[0], BinaryOp)
+                and expr0.operands[0].op in {"Mull", "Mul"}
+                and isinstance(expr0.operands[0].operands[1], Const)
+            ):
+                a0 = expr0.operands[0].operands[0]
+                a1 = expr1_op.operands[0]
+            elif (
+                isinstance(expr1_op.operands[0], BinaryOp)
+                and expr1_op.operands[0].op in {"Mull", "Mul"}
+                and isinstance(expr1_op.operands[0].operands[1], Const)
+            ):
+                a1 = expr0.operands[0].operands[0]
+                a0 = expr1_op.operands[0]
+            else:
+                a0, a1 = None, None
+
+            # a0: Conv(32->64, vvar_44{reg 32})
+            # a1: vvar_44{reg 32}
+            if isinstance(a0, Convert) and a1 is not None and a0.from_bits == a1.bits:
+                a0 = a0.operand
+
+            if a0 is not None and a1 is not None and a0.likes(a1):
+                # (a * x >> M1) +/- (a >> M2)  ==>  a / N
+                C = expr0.operands[0].operands[1].value
+                X = a0
+                V = expr0.operands[1].value
+                ndigits = 5 if V == 32 else 6
+                divisor = self._check_divisor(pow(2, V), C, ndigits)
+                if divisor is not None:
+                    new_const = Const(None, None, divisor, X.bits)
+                    # we cannot drop the convert in this case
+                    return BinaryOp(
+                        expr0.operands[0].idx,
+                        "Div",
+                        [X, new_const],
+                        expr0.operands[0].signed,
+                        **expr0.operands[0].tags,
+                    )
+
+        return None
+
+    @staticmethod
+    def _check_divisor(a, b, ndigits=6):
+        if b == 0:
+            return None
+        divisor_1 = 1 + (a // b)
+        divisor_2 = int(round(a / float(b), ndigits))
+        return divisor_1 if divisor_1 == divisor_2 else None
+
+    @staticmethod
+    def _unify_conversion(expr: BinaryOp) -> Convert | None:
+        if (
+            isinstance(expr.operands[0], Convert)
+            and isinstance(expr.operands[1], Convert)
+            and expr.operands[1].to_bits == expr.operands[0].to_bits
+            and expr.operands[1].from_bits == expr.operands[0].from_bits
+            and expr.op in {"Add", "Sub"}
+        ):
+            op0 = expr.operands[0]
+            op0_inner = expr.operands[0].operand
+            # op1 = expr.operands[1]
+            op1_inner = expr.operands[1].operand
+
+            new_expr = BinaryOp(
+                expr.idx,
+                expr.op,
+                (op0_inner, op1_inner),
+                expr.signed,
+                bits=op0.from_bits,
+                **expr.tags,
+            )
+            return Convert(
+                op0.idx,
+                op0.from_bits,
+                op0.to_bits,
+                op0.is_signed,
+                new_expr,
+                **op0.tags,
+            )
+        return None
+
+    @staticmethod
+    def _reconvert(expr: Expression, conv: Convert) -> Convert:
+        return Convert(
+            conv.idx,
+            conv.from_bits,
+            conv.to_bits,
+            conv.is_signed,
+            expr,
+            from_type=conv.from_type,
+            to_type=conv.to_type,
+            rounding_mode=conv.rounding_mode,
+            **conv.tags,
+        )

{angr-9.2.157 → angr-9.2.158}/angr/analyses/decompiler/peephole_optimizations/eager_eval.py

@@ -17,7 +17,7 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
     NAME = "Eager expression evaluation"
     expr_classes = (BinaryOp, UnaryOp, Convert)
 
-    def optimize(self, expr, **kwargs):
+    def optimize(self, expr, **kwargs):  # type:ignore
         if isinstance(expr, BinaryOp):
             return self._optimize_binaryop(expr)
         if isinstance(expr, Convert):
@@ -121,6 +121,28 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
                 return Const(
                     expr.idx, None, (expr.operands[0].value - expr.operands[1].value) & mask, expr.bits, **expr.tags
                 )
+            if isinstance(expr.operands[1], Const) and expr.operands[1].is_int and expr.operands[1].sign_bit == 1:
+                # x - (-A)  ==>  x + A
+                assert isinstance(expr.operands[1].value, int)
+                mask = (1 << expr.operands[1].bits) - 1
+                complement = Const(
+                    expr.operands[1].idx,
+                    expr.operands[1].variable,
+                    ((~expr.operands[1].value) + 1) & mask,
+                    expr.operands[1].bits,
+                    **expr.operands[1].tags,
+                )
+                return BinaryOp(
+                    expr.idx,
+                    "Add",
+                    [expr.operands[0], complement],
+                    expr.signed,
+                    variable=expr.variable,
+                    variable_offset=expr.variable_offset,
+                    bits=expr.bits,
+                    **expr.tags,
+                )
+
             if (
                 isinstance(expr.operands[1], Const)
                 and isinstance(expr.operands[0], BinaryOp)

{angr-9.2.157 → angr-9.2.158}/angr/analyses/decompiler/peephole_optimizations/remove_redundant_conversions.py

@@ -8,7 +8,7 @@ from .base import PeepholeOptimizationExprBase
 class RemoveRedundantConversions(PeepholeOptimizationExprBase):
     __slots__ = ()
 
-    NAME = "Remove redundant conversions around binary operators"
+    NAME = "Remove or rewrite redundant conversions around binary operators"
     expr_classes = (BinaryOp, Convert)
 
     def optimize(self, expr: BinaryOp | Convert, **kwargs):
@@ -22,7 +22,7 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
     @staticmethod
     def _optimize_BinaryOp(expr: BinaryOp):
         # TODO make this lhs/rhs agnostic
-        if isinstance(expr.operands[0], Convert):
+        if isinstance(expr.operands[0], Convert):  # noqa: SIM102
             # check: is the lhs convert an up-cast and is rhs a const?
             if expr.operands[0].to_bits > expr.operands[0].from_bits and isinstance(expr.operands[1], Const):
                 to_bits = expr.operands[0].to_bits
@@ -79,34 +79,6 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
                         **op0.tags,
                     )
 
-            elif (
-                isinstance(expr.operands[1], Convert)
-                and expr.operands[1].to_bits == expr.operands[0].to_bits
-                and expr.operands[1].from_bits == expr.operands[0].from_bits
-            ):
-                if expr.op in {"Add", "Sub"}:
-                    op0 = expr.operands[0]
-                    op0_inner = expr.operands[0].operand
-                    # op1 = expr.operands[1]
-                    op1_inner = expr.operands[1].operand
-
-                    new_expr = BinaryOp(
-                        expr.idx,
-                        expr.op,
-                        (op0_inner, op1_inner),
-                        expr.signed,
-                        bits=op0.from_bits,
-                        **expr.tags,
-                    )
-                    return Convert(
-                        op0.idx,
-                        op0.from_bits,
-                        op0.to_bits,
-                        op0.is_signed,
-                        new_expr,
-                        **op0.tags,
-                    )
-
         # a more complex case
         # (Conv(expr) >> A) & B == C  ==>  (expr >> A) & B == C
         if expr.op in {
@@ -244,4 +216,58 @@ class RemoveRedundantConversions(PeepholeOptimizationExprBase):
                         op0,
                         **expr.tags,
                     )
+
+            if (
+                expr.to_bits < expr.from_bits
+                and expr.from_type == Convert.TYPE_INT
+                and expr.to_type == Convert.TYPE_INT
+            ):
+                if operand_expr.op in {"Add", "And", "Xor", "Or", "Mul"}:
+                    # ignore the high bits of each operand
+                    op0, op1 = operand_expr.operands
+                    new_op0 = Convert(
+                        expr.idx,
+                        expr.from_bits,
+                        expr.to_bits,
+                        False,
+                        op0,
+                        **expr.tags,
+                    )
+                    new_op1 = Convert(
+                        expr.idx,
+                        expr.from_bits,
+                        expr.to_bits,
+                        False,
+                        op1,
+                        **expr.tags,
+                    )
+
+                    return BinaryOp(
+                        expr.idx,
+                        operand_expr.op,
+                        [new_op0, new_op1],
+                        operand_expr.signed,
+                        bits=expr.to_bits,
+                        **operand_expr.tags,
+                    )
+                if operand_expr.op in {"Shr", "Sar"} and isinstance(operand_expr.operands[0], Convert):
+                    op0, op1 = operand_expr.operands
+                    assert isinstance(op0, Convert)
+                    if op0.to_bits > op0.from_bits and op0.to_bits == expr.from_bits:
+                        new_operand = BinaryOp(
+                            expr.idx,
+                            operand_expr.op,
+                            [op0.operand, op1],
+                            operand_expr.signed,
+                            bits=op0.from_bits,
+                            **operand_expr.tags,
+                        )
+                        return Convert(
+                            expr.idx,
+                            new_operand.bits,
+                            expr.to_bits,
+                            expr.is_signed,
+                            new_operand,
+                            **expr.tags,
+                        )
         return None