angr 9.2.160__cp310-abi3-manylinux2014_aarch64.whl → 9.2.162__cp310-abi3-manylinux2014_aarch64.whl

angr/analyses/decompiler/peephole_optimizations/modulo_simplifier.py

@@ -0,0 +1,89 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const, Convert
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ModuloSimplifier(PeepholeOptimizationExprBase):
+    """
+    Simplify division and multiplication expressions that can be reduced to a modulo operation.
+    """
+
+    __slots__ = ()
+
+    NAME = "a - (a / N) * N => a % N"
+    expr_classes = (BinaryOp,)
+
+    def optimize(  # pylint:disable=unused-argument
+        self, expr: BinaryOp, stmt_idx: int | None = None, block=None, **kwargs
+    ):
+        if expr.op == "Sub" and len(expr.operands) == 2:
+            sub0, sub1 = expr.operands
+            # unpack Conversions
+            outer_conv_expr = None
+            if (
+                isinstance(sub0, Convert)
+                and isinstance(sub1, Convert)
+                and sub0.to_bits == sub1.to_bits
+                and sub0.from_bits == sub1.from_bits
+                and sub0.to_bits > sub0.from_bits
+                and sub0.is_signed == sub1.is_signed
+            ):
+                # Convert(a) - Convert(a / N * N)  ==> Convert(a % N)
+                outer_conv_expr = sub0
+                sub0 = sub0.operand
+                sub1 = sub1.operand
+
+            if isinstance(sub1, BinaryOp) and sub1.op == "Mul" and isinstance(sub1.operands[1], Const):
+                a0, op1 = sub0, sub1
+                op1_left = op1.operands[0]
+                mul_const = sub1.operands[1]
+
+                if (
+                    isinstance(op1_left, Convert)
+                    and isinstance(a0, Convert)
+                    and op1_left.to_bits == a0.to_bits
+                    and op1_left.from_bits == a0.from_bits
+                ):
+                    # Convert(a) - (Convert(a / N)) * N  ==>  Convert(a) % N
+                    inner_conv_expr = a0
+                    a0 = a0.operand
+                    op1_left = op1_left.operand
+                else:
+                    inner_conv_expr = None
+
+                if isinstance(op1_left, BinaryOp) and op1_left.op == "Div" and isinstance(op1_left.operands[1], Const):
+                    # a - (a / N) * N  ==>  a % N
+                    a1 = op1_left.operands[0]
+                    div_const = op1_left.operands[1]
+
+                    if a0.likes(a1) and mul_const.value == div_const.value:
+                        operands = [a0, div_const]
+                        mod = BinaryOp(expr.idx, "Mod", operands, False, bits=a0.bits, **expr.tags)
+                        if inner_conv_expr is not None:
+                            conv_from_bits = inner_conv_expr.from_bits
+                            conv_to_bits = (
+                                inner_conv_expr.to_bits if outer_conv_expr is None else outer_conv_expr.to_bits
+                            )
+                            conv_signed = inner_conv_expr.is_signed
+                            conv_expr = inner_conv_expr
+                        elif outer_conv_expr is not None:
+                            conv_from_bits = outer_conv_expr.from_bits
+                            conv_to_bits = outer_conv_expr.to_bits
+                            conv_signed = outer_conv_expr.is_signed
+                            conv_expr = outer_conv_expr
+                        else:
+                            # no conversion necessary
+                            return mod
+
+                        return Convert(
+                            conv_expr.idx,
+                            conv_from_bits,
+                            conv_to_bits,
+                            conv_signed,
+                            mod,
+                            **conv_expr.tags,
+                        )
+
+        return None

angr/analyses/decompiler/peephole_optimizations/{const_mull_a_shift.py → optimized_div_simplifier.py}

@@ -1,22 +1,25 @@
 # pylint:disable=too-many-boolean-expressions
 from __future__ import annotations
+import math
 
 from angr.ailment.expression import Convert, BinaryOp, Const, Expression
 
 from .base import PeepholeOptimizationExprBase
 
 
-class ConstMullAShift(PeepholeOptimizationExprBase):
+class OptimizedDivisionSimplifier(PeepholeOptimizationExprBase):
     """
     Convert expressions with right shifts into expressions with divisions.
     """
 
     __slots__ = ()
 
-    NAME = "Conv(64->32, (N * a) >> M) => a / N1"
+    NAME = "Simplify optimized division expressions, e.g., (N * a) >> M => a / N1"
     expr_classes = (Convert, BinaryOp)
 
-    def optimize(self, expr: Convert | BinaryOp, **kwargs):
+    def optimize(  # pylint:disable=unused-argument
+        self, expr: Convert | BinaryOp, stmt_idx: int | None = None, block=None, **kwargs
+    ):
         r = None
 
         if isinstance(expr, Convert):
@@ -37,28 +40,16 @@ class ConstMullAShift(PeepholeOptimizationExprBase):
             # try to unify if both operands are wrapped with Convert()
             conv_expr = self._unify_conversion(original_expr)
             expr = original_expr if conv_expr is None else conv_expr.operand
+            assert isinstance(expr, BinaryOp)
 
             if expr.op == "Shr" and isinstance(expr.operands[1], Const):
-                # (N * a) >> M  ==>  a / N1
-                inner = expr.operands[0]
-                if isinstance(inner, BinaryOp) and inner.op in {"Mull", "Mul"} and not inner.signed:
-                    if isinstance(inner.operands[0], Const) and not isinstance(inner.operands[1], Const):
-                        C = inner.operands[0].value
-                        X = inner.operands[1]
-                    elif isinstance(inner.operands[1], Const) and not isinstance(inner.operands[0], Const):
-                        C = inner.operands[1].value
-                        X = inner.operands[0]
-                    else:
-                        C = X = None
-
-                    if C is not None and X is not None:
-                        V = expr.operands[1].value
-                        ndigits = 5 if V == 32 else 6
-                        divisor = self._check_divisor(pow(2, V), C, ndigits)
-                        if divisor is not None:
-                            new_const = Const(None, None, divisor, X.bits)
-                            r = BinaryOp(inner.idx, "Div", [X, new_const], inner.signed, **inner.tags)
-                            return self._reconvert(r, conv_expr) if conv_expr is not None else r
+                r = self._match_case_b(expr)
+                if r is not None:
+                    return self._reconvert(r, conv_expr) if conv_expr is not None else r
+                assert isinstance(expr.operands[1].value, int)
+                r = self._match_case_c(expr.operands[0], expr.operands[1].value)
+                if r is not None:
+                    return self._reconvert(r, conv_expr) if conv_expr is not None else r
 
             elif expr.op in {"Add", "Sub"}:
                 expr0, expr1 = expr.operands
@@ -119,13 +110,13 @@ class ConstMullAShift(PeepholeOptimizationExprBase):
 
         return None
 
-    def _match_case_a(self, expr0: Expression, expr1_op: Convert) -> BinaryOp | None:
+    def _match_case_a(self, expr0: Expression, expr1: Convert) -> BinaryOp | None:
         # (
         #   (((Conv(32->64, vvar_44{reg 32}) * 0x4325c53f<64>) >>a 0x24<8>) & 0xffffffff<64>) -
         #   Conv(32->s64, (vvar_44{reg 32} >>a 0x1f<8>))
         # )
 
-        expr1_op = expr1_op.operand
+        expr1_op = expr1.operand
 
         if (
             isinstance(expr0, BinaryOp)
@@ -187,6 +178,129 @@ class ConstMullAShift(PeepholeOptimizationExprBase):
 
         return None
 
+    @staticmethod
+    def _match_case_b(expr: BinaryOp) -> BinaryOp | Convert | None:
+        """
+        A more complex (but general) case for unsigned 32-bit division by a constant integer.
+
+        Ref: https://ridiculousfish.com/blog/posts/labor-of-division-episode-i.html
+
+        Given n and d, n//d (unsigned) can be rewritten to t >> (p - 1) where
+        - p = ceiling(log2(d))
+        - m = ceiling((2 ** (32 + p) / d))
+        - q = (m * n) >> 32
+        - t = q + ((n - q) >> 1)
+
+        We can match the expression against  t >> (p - 1).
+        """
+
+        # t >> (p - 1)
+        if not (isinstance(expr, BinaryOp) and expr.op == "Shr"):
+            return None
+        if not (isinstance(expr.operands[1], Const) and expr.operands[1].value > 0):
+            return None
+        p_minus_1 = expr.operands[1].value
+        p = p_minus_1 + 1
+        t = expr.operands[0]
+
+        # unmask
+        if isinstance(t, BinaryOp) and t.op == "And":
+            if isinstance(t.operands[1], Const) and t.operands[1].value == 0xFFFFFFFF:
+                t = t.operands[0]
+            elif isinstance(t.operands[0], Const) and t.operands[0].value == 0xFFFFFFFF:
+                t = t.operands[1]
+            else:
+                return None
+
+        # t = q + ((n - q) >> 1)
+        if not (isinstance(t, BinaryOp) and t.op == "Add"):
+            return None
+
+        if (
+            isinstance(t.operands[0], BinaryOp)
+            and t.operands[0].op == "Shr"
+            and isinstance(t.operands[0].operands[1], Const)
+            and t.operands[0].operands[1].value == 1
+        ):
+            q = t.operands[1]
+            n_minus_q = t.operands[0].operands[0]
+        elif (
+            isinstance(t.operands[1], BinaryOp)
+            and t.operands[1].op == "Shr"
+            and isinstance(t.operands[1].operands[1], Const)
+            and t.operands[1].operands[1].value == 1
+        ):
+            q = t.operands[0]
+            n_minus_q = t.operands[1]
+        else:
+            return None
+        if isinstance(q, Convert) and q.from_bits == 64 and q.to_bits == 32:
+            q = q.operand
+        if isinstance(n_minus_q, Convert) and n_minus_q.from_bits == 64 and n_minus_q.to_bits == 32:
+            n_minus_q = n_minus_q.operand
+
+        # unmask
+        if isinstance(n_minus_q, BinaryOp) and n_minus_q.op == "And":
+            if isinstance(n_minus_q.operands[1], Const) and n_minus_q.operands[1].value == 0xFFFFFFFF:
+                n_minus_q = n_minus_q.operands[0]
+            elif isinstance(n_minus_q.operands[0], Const) and n_minus_q.operands[0].value == 0xFFFFFFFF:
+                n_minus_q = n_minus_q.operands[1]
+            else:
+                return None
+
+        if not (isinstance(n_minus_q, BinaryOp) and n_minus_q.op == "Sub"):
+            return None
+        if not q.likes(n_minus_q.operands[1]):
+            return None
+
+        # q = (m * n) >> 32
+        if not (
+            isinstance(q, BinaryOp) and q.op == "Shr" and isinstance(q.operands[1], Const) and q.operands[1].value == 32
+        ):
+            return None
+        if not (isinstance(q.operands[0], BinaryOp) and q.operands[0].op in {"Mull", "Mul"}):
+            return None
+        if isinstance(q.operands[0].operands[1], Const):
+            n = q.operands[0].operands[0]
+            m = q.operands[0].operands[1].value
+        elif isinstance(q.operands[0].operands[0], Const):
+            n = q.operands[0].operands[1]
+            m = q.operands[0].operands[0].value
+        else:
+            # this should never happen, because multiplication of two constants are eagerly evaluated
+            return None
+
+        assert isinstance(m, int) and isinstance(p, int)
+        divisor = math.ceil((2 ** (32 + p)) / (m + 0x1_0000_0000))
+        if divisor == 0:
+            return None
+        divisor_expr = Const(None, None, divisor, n.bits)
+        div = BinaryOp(expr.idx, "Div", [n, divisor_expr], signed=False, **expr.tags)
+        if expr.bits != div.bits:
+            div = Convert(expr.idx, div.bits, expr.bits, False, div, **expr.tags)
+        return div
+
+    def _match_case_c(self, inner, m: int) -> BinaryOp | None:
+        # (N * a) >> M  ==>  a / N1
+        if isinstance(inner, BinaryOp) and inner.op in {"Mull", "Mul"} and not inner.signed:
+            if isinstance(inner.operands[0], Const) and not isinstance(inner.operands[1], Const):
+                C = inner.operands[0].value
+                X = inner.operands[1]
+            elif isinstance(inner.operands[1], Const) and not isinstance(inner.operands[0], Const):
+                C = inner.operands[1].value
+                X = inner.operands[0]
+            else:
+                C = X = None
+
+            if C is not None and X is not None:
+                V = m
+                ndigits = 5 if V == 32 else 6
+                divisor = self._check_divisor(pow(2, V), C, ndigits)
+                if divisor is not None:
+                    new_const = Const(None, None, divisor, X.bits)
+                    return BinaryOp(inner.idx, "Div", [X, new_const], inner.signed, **inner.tags)
+        return None
+
     @staticmethod
     def _check_divisor(a, b, ndigits=6):
         if b == 0:

angr/analyses/decompiler/peephole_optimizations/remove_redundant_bitmasks.py

@@ -33,6 +33,7 @@ class RemoveRedundantBitmasks(PeepholeOptimizationExprBase):
     def _optimize_BinaryOp(self, expr: BinaryOp):
         # And(expr, full_N_bitmask) ==> expr
         # And(SHR(expr, N), bitmask)) ==> SHR(expr, N)
+        # And(Div(Conv(M->N, expr), P), 2 ** M - 1) ==> Div(Conv(M->N, expr), P)  where M < N
         # And(Conv(1->N, expr), bitmask) ==> Conv(1->N, expr)
         # And(Conv(1->N, bool_expr), bitmask) ==> Conv(1->N, bool_expr)
         # And(ITE(?, const_expr, const_expr), bitmask) ==> ITE(?, const_expr, const_expr)
@@ -41,15 +42,23 @@ class RemoveRedundantBitmasks(PeepholeOptimizationExprBase):
             if expr.operands[1].value == _MASKS.get(inner_expr.bits, None):
                 return inner_expr
 
-            if isinstance(inner_expr, BinaryOp) and inner_expr.op == "Shr":
-                mask = expr.operands[1]
-                shift_val = inner_expr.operands[1]
-                if (
-                    isinstance(shift_val, Const)
-                    and shift_val.value in _MASKS
-                    and mask.value == _MASKS.get(int(64 - shift_val.value), None)
-                ):
-                    return inner_expr
+            if isinstance(inner_expr, BinaryOp):
+                if inner_expr.op == "Shr":
+                    mask = expr.operands[1]
+                    shift_val = inner_expr.operands[1]
+                    if (
+                        isinstance(shift_val, Const)
+                        and shift_val.value in _MASKS
+                        and mask.value == _MASKS.get(int(64 - shift_val.value), None)
+                    ):
+                        return inner_expr
+                if inner_expr.op == "Div" and isinstance(inner_expr.operands[0], Convert):
+                    from_bits = inner_expr.operands[0].from_bits
+                    to_bits = inner_expr.operands[0].to_bits
+                    if from_bits < to_bits:
+                        mask = expr.operands[1]
+                        if mask.value == _MASKS.get(from_bits):
+                            return inner_expr
 
             if isinstance(inner_expr, Convert) and self.is_bool_expr(inner_expr.operand):
                 # useless masking

angr/analyses/decompiler/region_simplifiers/goto.py

@@ -58,7 +58,7 @@ class GotoSimplifier(SequenceWalker):
         :return:
         """
 
-        for n0, n1 in zip(node.nodes, node.nodes[1:] + [successor]):
+        for n0, n1 in zip(node.nodes, [*node.nodes[1:], successor]):
             self._handle(n0, successor=n1)
 
     def _handle_codenode(self, node, successor=None, **kwargs):
@@ -109,7 +109,7 @@ class GotoSimplifier(SequenceWalker):
         :return:
         """
 
-        for n0, n1 in zip(node.nodes, node.nodes[1:] + [successor]):
+        for n0, n1 in zip(node.nodes, [*node.nodes[1:], successor]):
             self._handle(n0, successor=n1)
 
     def _handle_block(self, block, successor=None, **kwargs):  # pylint:disable=no-self-use
@@ -170,7 +170,7 @@ class GotoSimplifier(SequenceWalker):
             dst_target = goto_stmt.true_target
         # false branch of a conditional jump
         else:
-            dst_target = goto_stmt.true_target
+            dst_target = goto_stmt.false_target
 
         src_ins_addr = goto_stmt.ins_addr if "ins_addr" in goto_stmt.tags else block.addr
         goto = Goto(block.addr, dst_target.value, src_idx=block.idx, dst_idx=None, src_ins_addr=src_ins_addr)

angr/analyses/decompiler/region_simplifiers/if_.py

@@ -44,7 +44,7 @@ class IfSimplifier(SequenceWalker):
         :return:
         """
 
-        for n0, n1 in zip(node.nodes, node.nodes[1:] + [successor]):
+        for n0, n1 in zip(node.nodes, [*node.nodes[1:], successor]):
             self._handle(n0, successor=n1)
 
     def _handle_codenode(self, node, successor=None, **kwargs):
@@ -92,7 +92,7 @@ class IfSimplifier(SequenceWalker):
         :return:
         """
 
-        for n0, n1 in zip(node.nodes, node.nodes[1:] + [successor]):
+        for n0, n1 in zip(node.nodes, [*node.nodes[1:], successor]):
             self._handle(n0, successor=n1)
 
     def _handle_block(self, block, successor=None, **kwargs):  # pylint:disable=no-self-use

angr/analyses/decompiler/region_simplifiers/loop.py

@@ -47,7 +47,7 @@ class LoopSimplifier(SequenceWalker):
         )
 
     def _handle_sequencenode(self, node, predecessor=None, successor=None, loop=None, loop_successor=None, **kwargs):
-        for n0, n1, n2 in zip(node.nodes, node.nodes[1:] + [successor], [predecessor] + node.nodes[:-1]):
+        for n0, n1, n2 in zip(node.nodes, [*node.nodes[1:], successor], [predecessor, *node.nodes[:-1]]):
             self._handle(n0, predecessor=n2, successor=n1, loop=loop, loop_successor=loop_successor)
 
     def _handle_codenode(self, node, predecessor=None, successor=None, loop=None, loop_successor=None, **kwargs):
@@ -126,7 +126,7 @@ class LoopSimplifier(SequenceWalker):
             predecessor.statements = predecessor.statements[:-1]
 
     def _handle_multinode(self, node, predecessor=None, successor=None, loop=None, loop_successor=None, **kwargs):
-        for n0, n1, n2 in zip(node.nodes, node.nodes[1:] + [successor], [predecessor] + node.nodes[:-1]):
+        for n0, n1, n2 in zip(node.nodes, [*node.nodes[1:], successor], [predecessor, *node.nodes[:-1]]):
             self._handle(n0, predecessor=n2, successor=n1, loop=loop, loop_successor=loop_successor)
 
     def _handle_block(

angr/analyses/decompiler/structured_codegen/c.py

@@ -581,7 +581,7 @@ class CFunction(CConstruct):  # pylint:disable=abstract-method
         yield " ", None
         # function name
         if self.demangled_name and self.show_demangled_name:
-            normalized_name = get_cpp_function_name(self.demangled_name, specialized=False, qualified=True)
+            normalized_name = get_cpp_function_name(self.demangled_name)
         else:
             normalized_name = self.name
         yield normalized_name, self
@@ -1357,7 +1357,7 @@ class CFunctionCall(CStatement, CExpression):
 
         if self.callee_func is not None:
             if self.callee_func.demangled_name and self.show_demangled_name:
-                func_name = get_cpp_function_name(self.callee_func.demangled_name, specialized=False, qualified=True)
+                func_name = get_cpp_function_name(self.callee_func.demangled_name)
             else:
                 func_name = self.callee_func.name
             if (
@@ -2240,7 +2240,7 @@ class CConstant(CExpression):
                     yield CConstant.str_to_c_str(v.content.decode("utf-8")), self
                     return
                 elif isinstance(v, Function):
-                    yield get_cpp_function_name(v.demangled_name, specialized=False, qualified=True), self
+                    yield get_cpp_function_name(v.demangled_name), self
                     return
                 elif isinstance(v, str):
                     yield CConstant.str_to_c_str(v), self

angr/analyses/decompiler/structuring/dream.py

@@ -466,7 +466,7 @@ class DreamStructurer(StructurerBase):
                     self._merge_nodes(node_0.node, node_1.node),
                     node_0.reaching_condition,
                 )
-                seq.nodes = seq.nodes[:i] + [new_node] + seq.nodes[i + 2 :]
+                seq.nodes = [*seq.nodes[:i], new_node, *seq.nodes[i + 2 :]]
                 continue
             i += 1