angr 9.2.159__tar.gz → 9.2.161__tar.gz

{angr-9.2.159 → angr-9.2.161}/Cargo.toml

@@ -1,7 +1,7 @@
 [workspace]
 resolver = "3"
 rust-version = "1.86.0"
-members = ["crates/angr"]
+members = ["native/angr"]
 
 [workspace.package]
 license = "BSD-2-Clause"

angr-9.2.161/MANIFEST.in

@@ -0,0 +1,5 @@
+include LICENSE
+include README.md
+include Cargo.toml
+include Cargo.lock
+graft native

{angr-9.2.159 → angr-9.2.161}/PKG-INFO

@@ -1,11 +1,10 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.159
+Version: 9.2.161
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
 Project-URL: Repository, https://github.com/angr/angr
-Classifier: License :: OSI Approved :: BSD License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: 3.10
@@ -17,12 +16,12 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: archinfo==9.2.159
+Requires-Dist: archinfo==9.2.161
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.159
-Requires-Dist: cle==9.2.159
+Requires-Dist: claripy==9.2.161
+Requires-Dist: cle==9.2.161
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
 Requires-Dist: protobuf>=5.28.2
@@ -31,7 +30,7 @@ Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
 Requires-Dist: pypcode<4.0,>=3.2.1
-Requires-Dist: pyvex==9.2.159
+Requires-Dist: pyvex==9.2.161
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.159 → angr-9.2.161}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.159"
+__version__ = "9.2.161"
 
 if bytes is str:
     raise Exception(
@@ -192,6 +192,7 @@ from . import concretization_strategies
 from .distributed import Server
 from .knowledge_base import KnowledgeBase
 from .procedures.definitions import load_external_definitions
+from .emulator import Emulator, EmulatorStopReason
 
 # for compatibility reasons
 from . import sim_manager as manager
@@ -259,6 +260,8 @@ __all__ = (
     "AngrVaultError",
     "Blade",
     "Block",
+    "Emulator",
+    "EmulatorStopReason",
     "ExplorationTechnique",
     "KnowledgeBase",
     "PTChunk",

{angr-9.2.159 → angr-9.2.161}/angr/analyses/decompiler/ail_simplifier.py

@@ -226,6 +226,15 @@ class AILSimplifier(Analysis):
             # reaching definition analysis results are no longer reliable
             self._clear_cache()
 
+        _l.debug("Rewriting constant expressions with phi variables")
+        phi_const_rewritten = self._rewrite_phi_const_exprs()
+        self.simplified |= phi_const_rewritten
+        if phi_const_rewritten:
+            _l.debug("... constant expressions with phi variables rewritten")
+            self._rebuild_func_graph()
+            # reaching definition analysis results are no longer reliable
+            self._clear_cache()
+
         if self._only_consts:
             return
 
@@ -698,6 +707,11 @@ class AILSimplifier(Analysis):
         if not replacements_by_block_addrs_and_idx:
             return False
 
+        return self._replace_exprs_in_blocks(replacements_by_block_addrs_and_idx)
+
+    def _replace_exprs_in_blocks(
+        self, replacements: dict[tuple[int, int | None], dict[CodeLocation, dict[Expression, Expression]]]
+    ) -> bool:
         blocks_by_addr_and_idx = {(node.addr, node.idx): node for node in self.func_graph.nodes()}
 
         if self._stack_arg_offsets:
@@ -706,7 +720,7 @@ class AILSimplifier(Analysis):
             insn_addrs_using_stack_args = None
 
         replaced = False
-        for (block_addr, block_idx), reps in replacements_by_block_addrs_and_idx.items():
+        for (block_addr, block_idx), reps in replacements.items():
             block = blocks_by_addr_and_idx[(block_addr, block_idx)]
 
             # only replace loads if there are stack arguments in this block
@@ -787,6 +801,72 @@ class AILSimplifier(Analysis):
 
         return changed
 
+    #
+    # Rewriting constant expressions with phi variables
+    #
+
+    def _rewrite_phi_const_exprs(self) -> bool:
+        """
+        Rewrite phi variables that are definitely constant expressions to constants.
+        """
+
+        # gather constant assignments
+
+        vvar_values: dict[int, tuple[int, int]] = {}
+        for block in self.func_graph:
+            for stmt in block.statements:
+                if (
+                    isinstance(stmt, Assignment)
+                    and isinstance(stmt.dst, VirtualVariable)
+                    and isinstance(stmt.src, Const)
+                    and isinstance(stmt.src.value, int)
+                ):
+                    vvar_values[stmt.dst.varid] = stmt.src.value, stmt.src.bits
+
+        srda = self._compute_reaching_definitions()
+        # compute vvar reachability for phi variables
+        # ensure that each phi variable is fully defined, i.e., all its source variables are defined
+        g = networkx.Graph()
+        for phi_vvar_id, vvar_ids in srda.phivarid_to_varids_with_unknown.items():
+            for vvar_id in vvar_ids:
+                # we cannot store None to networkx graph, so we use -1 to represent unknown source vvars
+                g.add_edge(phi_vvar_id, vvar_id if vvar_id is not None else -1)
+
+        phi_vvar_ids = srda.phi_vvar_ids
+        to_replace = {}
+        for cc in networkx.algorithms.connected_components(g):
+            if -1 in cc:
+                continue
+            normal_vvar_ids = cc.difference(phi_vvar_ids)
+            # ensure there is at least one phi variable and all remaining vvars are constant non-phi variables
+            if len(normal_vvar_ids) < len(cc) and len(normal_vvar_ids.intersection(vvar_values)) == len(
+                normal_vvar_ids
+            ):
+                all_values = {vvar_values[vvar_id] for vvar_id in normal_vvar_ids}
+                if len(all_values) == 1:
+                    # found it!
+                    value, bits = next(iter(all_values))
+                    for var_id in cc:
+                        to_replace[var_id] = value, bits
+
+        # build the replacement dictionary
+        blocks_dict = {(node.addr, node.idx): node for node in self.func_graph.nodes()}
+        replacements: dict[tuple[int, int | None], dict[CodeLocation, dict[Expression, Expression]]] = defaultdict(dict)
+        for vvar_id, (value, bits) in to_replace.items():
+            for expr, use_loc in srda.all_vvar_uses[vvar_id]:
+                if expr is None:
+                    continue
+                assert use_loc.block_addr is not None
+                key = use_loc.block_addr, use_loc.block_idx
+                stmt = blocks_dict[key].statements[use_loc.stmt_idx]
+                if is_phi_assignment(stmt):
+                    continue
+                if use_loc not in replacements[key]:
+                    replacements[key][use_loc] = {}
+                replacements[key][use_loc][expr] = Const(None, None, value, bits, **expr.tags)
+
+        return self._replace_exprs_in_blocks(replacements) if replacements else False
+
     #
     # Unifying local variables
     #

{angr-9.2.159 → angr-9.2.161}/angr/analyses/decompiler/block_simplifier.py

@@ -330,18 +330,20 @@ class BlockSimplifier(Analysis):
         for idx, stmt in enumerate(block.statements):
             if type(stmt) is Assignment:
                 # tmps can't execute new code
-                if type(stmt.dst) is Tmp and stmt.dst.tmp_idx not in used_tmps:
-                    continue
+                if (type(stmt.dst) is Tmp and stmt.dst.tmp_idx not in used_tmps) or idx in dead_defs_stmt_idx:
+                    # is it assigning to an unused tmp or a dead virgin?
 
-                # is it a dead virgin?
-                if idx in dead_defs_stmt_idx:
                     # does .src involve any Call expressions? if so, we cannot remove it
                     walker = HasCallExprWalker()
                     walker.walk_expression(stmt.src)
                     if not walker.has_call_expr:
                         continue
 
-                if stmt.src == stmt.dst:
+                    if type(stmt.dst) is Tmp and isinstance(stmt.src, Call):
+                        # eliminate the assignment and replace it with the call
+                        stmt = stmt.src
+
+                if isinstance(stmt, Assignment) and stmt.src == stmt.dst:
                     continue
 
             new_statements.append(stmt)

{angr-9.2.159 → angr-9.2.161}/angr/analyses/decompiler/clinic.py

@@ -143,7 +143,8 @@ class Clinic(Analysis):
         desired_variables: set[str] | None = None,
         force_loop_single_exit: bool = True,
         complete_successors: bool = False,
-        max_type_constraints: int = 4000,
+        max_type_constraints: int = 100_000,
+        type_constraint_set_degradation_threshold: int = 150,
         ail_graph: networkx.DiGraph | None = None,
         arg_vvars: dict[int, tuple[ailment.Expr.VirtualVariable, SimVariable]] | None = None,
         start_stage: ClinicStage | None = ClinicStage.INITIALIZATION,
@@ -185,6 +186,7 @@ class Clinic(Analysis):
         self._cache = cache
         self._mode = mode
         self._max_type_constraints = max_type_constraints
+        self._type_constraint_set_degradation_threshold = type_constraint_set_degradation_threshold
         self.vvar_id_start = vvar_id_start
         self.vvar_to_vvar: dict[int, int] | None = None
         # during SSA conversion, we create secondary stack variables because they overlap and are larger than the
@@ -1814,6 +1816,7 @@ class Clinic(Analysis):
             self.function,  # pylint:disable=unused-variable
             fail_fast=self._fail_fast,  # type:ignore
             func_graph=ail_graph,
+            entry_node_addr=self.entry_node_addr,
             kb=tmp_kb,  # type:ignore
             track_sp=False,
             func_args=arg_list,
@@ -1871,6 +1874,7 @@ class Clinic(Analysis):
                     must_struct=must_struct,
                     ground_truth=groundtruth,
                     stackvar_max_sizes=tv_max_sizes,
+                    constraint_set_degradation_threshold=self._type_constraint_set_degradation_threshold,
                 )
                 # tp.pp_constraints()
                 # tp.pp_solution()

{angr-9.2.159 → angr-9.2.161}/angr/analyses/decompiler/decompiler.py

@@ -23,7 +23,7 @@ from .ailgraph_walker import AILGraphWalker
 from .condition_processor import ConditionProcessor
 from .decompilation_options import DecompilationOption
 from .decompilation_cache import DecompilationCache
-from .utils import remove_labels, remove_edges_in_ailgraph
+from .utils import remove_edges_in_ailgraph
 from .sequence_walker import SequenceWalker
 from .structuring.structurer_nodes import SequenceNode
 from .presets import DECOMPILATION_PRESETS, DecompilationPreset
@@ -319,12 +319,8 @@ class Decompiler(Analysis):
         # removed!
         remove_edges_in_ailgraph(clinic.graph, clinic.edges_to_remove)
 
-        # Rewrite the graph to remove phi expressions
-        # this is probably optional if we do not pretty-print clinic.graph
-        clinic.graph = self._transform_graph_from_ssa(clinic.graph)
-
         # save the graph before structuring happens (for AIL view)
-        clinic.cc_graph = remove_labels(clinic.copy_graph())
+        clinic.cc_graph = clinic.copy_graph()
 
         codegen = None
         seq_node = None
@@ -357,7 +353,7 @@ class Decompiler(Analysis):
             )
 
             # rewrite the sequence node to remove phi expressions
-            seq_node = self._transform_seqnode_from_ssa(seq_node)
+            seq_node = self.transform_seqnode_from_ssa(seq_node)
 
             # update memory data
             if self._cfg is not None and self._update_memory_data:
@@ -670,14 +666,21 @@ class Decompiler(Analysis):
             memory_data_addrs=added_memory_data_addrs,
         )
 
-    def _transform_graph_from_ssa(self, ail_graph: networkx.DiGraph) -> networkx.DiGraph:
+    def transform_graph_from_ssa(self, ail_graph: networkx.DiGraph) -> networkx.DiGraph:
+        """
+        Translate an SSA AIL graph out of SSA form. This is useful for producing a non-SSA AIL graph for displaying in
+        angr management.
+
+        :param ail_graph:   The AIL graph to transform out of SSA form.
+        :return:            The translated AIL graph.
+        """
         variable_kb = self._variable_kb
         dephication = self.project.analyses.GraphDephication(
             self.func, ail_graph, rewrite=True, variable_kb=variable_kb, kb=self.kb, fail_fast=self._fail_fast
         )
         return dephication.output
 
-    def _transform_seqnode_from_ssa(self, seq_node: SequenceNode) -> SequenceNode:
+    def transform_seqnode_from_ssa(self, seq_node: SequenceNode) -> SequenceNode:
         variable_kb = self._variable_kb
         dephication = self.project.analyses.SeqNodeDephication(
             self.func, seq_node, rewrite=True, variable_kb=variable_kb, kb=self.kb, fail_fast=self._fail_fast

{angr-9.2.159 → angr-9.2.161}/angr/analyses/decompiler/peephole_optimizations/__init__.py

@@ -4,14 +4,14 @@ from .a_div_const_add_a_mul_n_div_const import ADivConstAddAMulNDivConst
 from .a_mul_const_div_shr_const import AMulConstDivShrConst
 from .a_shl_const_sub_a import AShlConstSubA
 from .a_sub_a_div import ASubADiv
-from .a_sub_a_div_const_mul_const import ASubADivConstMulConst
+from .modulo_simplifier import ModuloSimplifier
 from .a_sub_a_shr_const_shr_const import ASubAShrConstShrConst
 from .arm_cmpf import ARMCmpF
 from .bswap import Bswap
 from .cas_intrinsics import CASIntrinsics
 from .coalesce_same_cascading_ifs import CoalesceSameCascadingIfs
 from .constant_derefs import ConstantDereferences
-from .const_mull_a_shift import ConstMullAShift
+from .optimized_div_simplifier import OptimizedDivisionSimplifier
 from .extended_byte_and_mask import ExtendedByteAndMask
 from .remove_empty_if_body import RemoveEmptyIfBody
 from .remove_redundant_ite_branch import RemoveRedundantITEBranches
@@ -61,14 +61,14 @@ ALL_PEEPHOLE_OPTS: list[type[PeepholeOptimizationExprBase]] = [
     AShlConstSubA,
     AMulConstSubA,
     ASubADiv,
-    ASubADivConstMulConst,
+    ModuloSimplifier,
     ASubAShrConstShrConst,
     ARMCmpF,
     Bswap,
     CASIntrinsics,
     CoalesceSameCascadingIfs,
     ConstantDereferences,
-    ConstMullAShift,
+    OptimizedDivisionSimplifier,
     ExtendedByteAndMask,
     RemoveEmptyIfBody,
     RemoveRedundantITEBranches,

{angr-9.2.159 → angr-9.2.161}/angr/analyses/decompiler/peephole_optimizations/eager_eval.py

@@ -170,6 +170,10 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
             if isinstance(expr.operands[0], Const) and expr.operands[0].value == 0:
                 return UnaryOp(expr.idx, "Neg", expr.operands[1], **expr.tags)
 
+            r = EagerEvaluation._combine_like_terms(expr)
+            if r is not None:
+                return r
+
             if isinstance(expr.operands[0], StackBaseOffset) and isinstance(expr.operands[1], StackBaseOffset):
                 assert isinstance(expr.operands[0].offset, int) and isinstance(expr.operands[1].offset, int)
                 return Const(expr.idx, None, expr.operands[0].offset - expr.operands[1].offset, expr.bits, **expr.tags)
@@ -354,6 +358,55 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
 
         return None
 
+    @staticmethod
+    def _combine_like_terms(expr: BinaryOp) -> BinaryOp | None:
+        """
+        Combine like terms for binary operations.
+        """
+
+        op = expr.op
+        assert op in {"Add", "Sub"}
+
+        expr0, expr1 = expr.operands
+
+        conv = None
+        if isinstance(expr0, Convert) and expr0.from_bits < expr0.to_bits:
+            conv = expr0.from_bits, expr0.to_bits, expr0.is_signed
+            expr0 = expr0.operand
+
+        if isinstance(expr0, BinaryOp) and expr0.op == "Mul" and isinstance(expr0.operands[1], Const):
+            n = expr0.operands[0]
+
+            if isinstance(n, Convert) and n.from_bits > n.to_bits:
+                if conv is not None and (n.to_bits, n.from_bits, n.is_signed) != conv:
+                    return None
+                n = n.operand
+
+            if n.likes(expr1):
+                # (n * C) - n  ==>  (C - 1) * n
+                coeff_0 = expr0.operands[1]
+                coeff = Const(coeff_0.idx, None, coeff_0.value - 1, expr.bits, **coeff_0.tags)
+                return BinaryOp(
+                    expr.idx, "Mul", [n, coeff], expr.signed, variable=expr.variable, bits=expr.bits, **expr.tags
+                )
+            if isinstance(expr1, BinaryOp) and expr1.op == "Mul" and isinstance(expr.operands[1].operands[1], Const):
+                n1 = expr.operands[1].operands[0]
+                if n.likes(n1):
+                    # (n * C) - (n1 * C1)  ==>  n * (C - C1)
+                    coeff_0 = expr0.operands[1]
+                    coeff_1 = expr1.operands[1]
+                    coeff = Const(coeff_0.idx, None, coeff_0.value - coeff_1.value, expr.bits, **coeff_0.tags)
+                    return BinaryOp(
+                        expr.idx,
+                        "Mul",
+                        [n, coeff],
+                        expr.signed,
+                        variable=expr.variable,
+                        bits=expr.bits,
+                        **expr.tags,
+                    )
+        return None
+
     @staticmethod
     def _optimize_unaryop(expr: UnaryOp):
         if expr.op == "Neg" and isinstance(expr.operand, Const) and isinstance(expr.operand.value, int):

angr-9.2.161/angr/analyses/decompiler/peephole_optimizations/modulo_simplifier.py

@@ -0,0 +1,89 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const, Convert
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ModuloSimplifier(PeepholeOptimizationExprBase):
+    """
+    Simplify division and multiplication expressions that can be reduced to a modulo operation.
+    """
+
+    __slots__ = ()
+
+    NAME = "a - (a / N) * N => a % N"
+    expr_classes = (BinaryOp,)
+
+    def optimize(  # pylint:disable=unused-argument
+        self, expr: BinaryOp, stmt_idx: int | None = None, block=None, **kwargs
+    ):
+        if expr.op == "Sub" and len(expr.operands) == 2:
+            sub0, sub1 = expr.operands
+            # unpack Conversions
+            outer_conv_expr = None
+            if (
+                isinstance(sub0, Convert)
+                and isinstance(sub1, Convert)
+                and sub0.to_bits == sub1.to_bits
+                and sub0.from_bits == sub1.from_bits
+                and sub0.to_bits > sub0.from_bits
+                and sub0.is_signed == sub1.is_signed
+            ):
+                # Convert(a) - Convert(a / N * N)  ==> Convert(a % N)
+                outer_conv_expr = sub0
+                sub0 = sub0.operand
+                sub1 = sub1.operand
+
+            if isinstance(sub1, BinaryOp) and sub1.op == "Mul" and isinstance(sub1.operands[1], Const):
+                a0, op1 = sub0, sub1
+                op1_left = op1.operands[0]
+                mul_const = sub1.operands[1]
+
+                if (
+                    isinstance(op1_left, Convert)
+                    and isinstance(a0, Convert)
+                    and op1_left.to_bits == a0.to_bits
+                    and op1_left.from_bits == a0.from_bits
+                ):
+                    # Convert(a) - (Convert(a / N)) * N  ==>  Convert(a) % N
+                    inner_conv_expr = a0
+                    a0 = a0.operand
+                    op1_left = op1_left.operand
+                else:
+                    inner_conv_expr = None
+
+                if isinstance(op1_left, BinaryOp) and op1_left.op == "Div" and isinstance(op1_left.operands[1], Const):
+                    # a - (a / N) * N  ==>  a % N
+                    a1 = op1_left.operands[0]
+                    div_const = op1_left.operands[1]
+
+                    if a0.likes(a1) and mul_const.value == div_const.value:
+                        operands = [a0, div_const]
+                        mod = BinaryOp(expr.idx, "Mod", operands, False, bits=a0.bits, **expr.tags)
+                        if inner_conv_expr is not None:
+                            conv_from_bits = inner_conv_expr.from_bits
+                            conv_to_bits = (
+                                inner_conv_expr.to_bits if outer_conv_expr is None else outer_conv_expr.to_bits
+                            )
+                            conv_signed = inner_conv_expr.is_signed
+                            conv_expr = inner_conv_expr
+                        elif outer_conv_expr is not None:
+                            conv_from_bits = outer_conv_expr.from_bits
+                            conv_to_bits = outer_conv_expr.to_bits
+                            conv_signed = outer_conv_expr.is_signed
+                            conv_expr = outer_conv_expr
+                        else:
+                            # no conversion necessary
+                            return mod
+
+                        return Convert(
+                            conv_expr.idx,
+                            conv_from_bits,
+                            conv_to_bits,
+                            conv_signed,
+                            mod,
+                            **conv_expr.tags,
+                        )
+
+        return None