angr 9.2.165__cp310-abi3-macosx_10_12_x86_64.whl

angr/analyses/decompiler/peephole_optimizations/a_mul_const_div_shr_const.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class AMulConstDivShrConst(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "(A * N0 / N1) >> N2 => (A * (N0 / 2 ** N2) / N1)"
+    expr_classes = (BinaryOp,)
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if (
+            expr.op == "Shr"
+            and len(expr.operands) == 2
+            and isinstance(expr.operands[1], Const)
+            and isinstance(expr.operands[0], BinaryOp)
+            and expr.operands[0].op == "Div"
+            and isinstance(expr.operands[0].operands[1], Const)
+        ):
+            inner = expr.operands[0].operands[0]
+            if isinstance(inner, BinaryOp) and inner.op == "Mul" and isinstance(inner.operands[1], Const):
+                a = inner.operands[0]
+                N0 = inner.operands[1].value
+                N1 = expr.operands[0].operands[1]
+                N2 = expr.operands[1].value
+
+                mul = BinaryOp(
+                    inner.idx,
+                    "Mul",
+                    [a, Const(None, None, N0 // (2**N2), expr.bits, **expr.operands[0].operands[1].tags)],
+                    False,
+                    **inner.tags,
+                )
+                return BinaryOp(expr.idx, "Div", [mul, N1], False, **expr.tags)
+
+        return None

angr/analyses/decompiler/peephole_optimizations/a_mul_const_sub_a.py

@@ -0,0 +1,34 @@
+# pylint:disable=missing-class-docstring,no-self-use,too-many-boolean-expressions
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class AMulConstSubA(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "a * N - a => a * (N - 1)"
+    expr_classes = (BinaryOp,)
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if (
+            expr.op == "Sub"
+            and len(expr.operands) == 2
+            and isinstance(expr.operands[0], BinaryOp)
+            and expr.operands[0].op == "Mul"
+            and isinstance(expr.operands[0].operands[1], Const)
+            and expr.signed == expr.operands[0].signed
+        ):
+            a = expr.operands[1]
+            if expr.operands[0].operands[0].likes(a):
+                N = expr.operands[0].operands[1].value
+                return BinaryOp(
+                    expr.idx,
+                    "Mul",
+                    [a, Const(None, None, N - 1, expr.bits, **expr.operands[0].operands[1].tags)],
+                    expr.signed,
+                    **expr.tags,
+                )
+
+        return None

angr/analyses/decompiler/peephole_optimizations/a_shl_const_sub_a.py

@@ -0,0 +1,34 @@
+# pylint:disable=missing-class-docstring,no-self-use
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class AShlConstSubA(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "(a << N) - a => (a * (2 ** N - 1))"
+    expr_classes = (BinaryOp,)
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if (
+            expr.op == "Sub"
+            and len(expr.operands) == 2
+            and isinstance(expr.operands[0], BinaryOp)
+            and expr.operands[0].op == "Shl"
+            and isinstance(expr.operands[0].operands[1], Const)
+            and expr.signed == expr.operands[0].signed
+        ):
+            a = expr.operands[1]
+            if expr.operands[0].operands[0].likes(a):
+                N = expr.operands[0].operands[1].value
+                return BinaryOp(
+                    expr.idx,
+                    "Mul",
+                    [a, Const(None, None, 2**N - 1, expr.bits, **expr.operands[0].operands[1].tags)],
+                    expr.signed,
+                    **expr.tags,
+                )
+
+        return None

angr/analyses/decompiler/peephole_optimizations/a_sub_a_div.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ASubADiv(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "a - a / N => a * (N - 1) / N"
+    expr_classes = (BinaryOp,)
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if expr.op == "Sub" and len(expr.operands) == 2:
+            expr0, expr1 = expr.operands
+            if isinstance(expr1, BinaryOp) and expr1.op == "Div" and isinstance(expr1.operands[1], Const):
+                a = expr0
+                if expr1.operands[0].likes(a):
+                    N = expr1.operands[1].value
+                    mul = BinaryOp(expr.idx, "Mul", [a, Const(None, None, N - 1, expr.bits)], False, **expr.tags)
+                    return BinaryOp(
+                        expr1.idx, "Div", [mul, Const(None, None, N, expr.bits, **expr1.tags)], False, **expr1.tags
+                    )
+
+        return None

angr/analyses/decompiler/peephole_optimizations/a_sub_a_shr_const_shr_const.py

@@ -0,0 +1,37 @@
+# pylint:disable=no-self-use,too-many-boolean-expressions
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ASubAShrConstShrConst(PeepholeOptimizationExprBase):
+    """
+    Convert `cdq; sub eax, edx; sar eax, 1` to `eax /= 2`.
+    """
+
+    __slots__ = ()
+
+    NAME = "(a - (a >> 31)) >> N => a / 2 ** N (signed)"
+    expr_classes = (BinaryOp,)
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if (
+            expr.op == "Sar"
+            and len(expr.operands) == 2
+            and isinstance(expr.operands[1], Const)
+            and expr.operands[1].is_int
+            and isinstance(expr.operands[0], BinaryOp)
+            and expr.operands[0].op == "Sub"
+        ):
+            a0, a1 = expr.operands[0].operands
+            if (
+                isinstance(a1, BinaryOp)
+                and a1.op == "Sar"
+                and isinstance(a1.operands[1], Const)
+                and a1.operands[1].value == 31
+                and a0.likes(a1.operands[0])
+            ):
+                dividend = 2 ** expr.operands[1].value
+                return BinaryOp(a0.idx, "Div", [a0, Const(None, None, dividend, expr.bits)], True, **expr.tags)
+        return None

angr/analyses/decompiler/peephole_optimizations/a_sub_a_sub_n.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ASubASubN(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "expr - (expr - N) => N"
+    expr_classes = (BinaryOp,)  # all expressions are allowed
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        # Sub(A, Sub(A, N)) ==> N
+        if (
+            expr.op == "Sub"
+            and isinstance(expr.operands[1], BinaryOp)
+            and expr.operands[1].op == "Sub"
+            and expr.operands[0] == expr.operands[1].operands[0]
+        ):
+            return expr.operands[1].operands[1]
+
+        return None

angr/analyses/decompiler/peephole_optimizations/arm_cmpf.py

@@ -0,0 +1,236 @@
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const, Convert
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ARMCmpF(PeepholeOptimizationExprBase):
+    """
+    Optimizes floating-point comparison expressions.
+    """
+
+    __slots__ = ()
+
+    NAME = "Simplifying CmpF on ARM"
+    expr_classes = (Convert,)  # all expressions are allowed
+
+    def optimize(self, expr: Convert, **kwargs):
+        # CmpF values
+        # - 0x45 Unordered
+        # - 0x01 LT
+        # - 0x00 GT
+        # - 0x40 EQ
+
+        # we identify nzcv, termL, termR, and ix. then we determine which bit is parsed out of nzcv, and finally convert
+        # this large expression into a comparison
+        if expr.from_bits == 32 and expr.to_bits == 1:
+            convert_from = expr.operand
+            negate = False
+            bit_mask = None
+            if (
+                isinstance(convert_from, BinaryOp)
+                and convert_from.op == "Xor"
+                and isinstance(convert_from.operands[1], Const)
+                and convert_from.operands[1].value == 1
+            ):
+                negate = True
+                convert_from = convert_from.operands[0]
+            if (
+                isinstance(convert_from, BinaryOp)
+                and convert_from.op == "And"
+                and isinstance(convert_from.operands[1], Const)
+            ):
+                bit_mask = convert_from.operands[1].value
+
+            if bit_mask is not None and isinstance(convert_from.operands[0], BinaryOp):
+                r, high_nzcv0, high_nzcv1, high_nzcv2 = self._match_nzcv_bits_extraction(convert_from.operands[0])
+                if not r:
+                    return None
+                irRes = None
+                for high_nczv in [high_nzcv0, high_nzcv1, high_nzcv2]:
+                    r, termL, termR = self._match_nzcv(high_nczv)
+                    if not r:
+                        return None
+                    r, ixL = self._match_termL(termL)
+                    if not r:
+                        return None
+                    r, irResL = self._match_ix(ixL)
+                    if not r:
+                        return None
+                    if irRes is None:
+                        irRes = irResL
+                    elif irRes != irResL:
+                        return None
+                    r, ixR = self._match_termR(termR)
+                    if not r:
+                        return None
+                    r, irResR = self._match_ix(ixR)
+                    if not r:
+                        return None
+                    if irRes != irResR:
+                        return None
+
+                if isinstance(irRes, BinaryOp) and irRes.op == "CmpF":
+                    # everything matches
+                    if bit_mask == 1:
+                        op = "CmpGT" if negate else "CmpLE"
+                    else:
+                        raise NotImplementedError
+                    return BinaryOp(
+                        expr.idx,
+                        op,
+                        irRes.operands[::],
+                        False,
+                        floating_point=True,
+                        **expr.tags,
+                    )
+
+        return None
+
+    @staticmethod
+    def _match_nzcv_bits_extraction(expr: BinaryOp):
+        # ((high_nzcv >> 0x1e<8>) | ((high_nzcv >> 0x1f<8>) ^ (high_nzcv >> 0x1c<8>)))
+        if expr.op == "Or" and isinstance(expr.operands[1], BinaryOp) and expr.operands[1].op == "Xor":
+            chunk0 = expr.operands[0]
+            chunk1, chunk2 = expr.operands[1].operands
+
+            if (
+                (
+                    isinstance(chunk0, BinaryOp)
+                    and chunk0.op == "Shr"
+                    and isinstance(chunk0.operands[1], Const)
+                    and chunk0.operands[1].value == 0x1E
+                )
+                and (
+                    isinstance(chunk1, BinaryOp)
+                    and chunk1.op == "Shr"
+                    and isinstance(chunk1.operands[1], Const)
+                    and chunk1.operands[1].value == 0x1F
+                )
+                and (
+                    isinstance(chunk2, BinaryOp)
+                    and chunk2.op == "Shr"
+                    and isinstance(chunk2.operands[1], Const)
+                    and chunk2.operands[1].value == 0x1C
+                )
+            ):
+                return True, chunk0.operands[0], chunk1.operands[0], chunk2.operands[0]
+        return False, None, None, None
+
+    @staticmethod
+    def _match_nzcv(expr: BinaryOp):
+        # high_nzcv ==> ((0x0<32> | ((termL - termR) << 0x1c<8>)) & 0xf0000000<32>)
+        # TODO: I'm not sure the leading 0x0 is real or just an artifact of me forcing fpscr to 0
+        if expr.op == "And" and isinstance(expr.operands[1], Const) and expr.operands[1].value == 0xF000_0000:
+            inner = expr.operands[0]
+            if isinstance(inner, BinaryOp) and inner.op == "Or":
+                # ignore the first operand because it might be optimized away
+                inner = inner.operands[1]
+            if (
+                (
+                    isinstance(inner, BinaryOp)
+                    and inner.op == "Shl"
+                    and isinstance(inner.operands[1], Const)
+                    and inner.operands[1].value == 0x1C
+                )
+                and isinstance(inner.operands[0], BinaryOp)
+                and inner.operands[0].op == "Sub"
+            ):
+                return True, inner.operands[0].operands[0], inner.operands[0].operands[1]
+        return False, None, None
+
+    @staticmethod
+    def _match_termL(expr: BinaryOp):
+        # ((((((ix ^ 0x1<32>) << 0x1e<8>) - 0x1<32>) >> 0x1d<8>) + 0x1<32>)
+        if (
+            isinstance(expr, BinaryOp)
+            and expr.op == "Add"
+            and isinstance(expr.operands[1], Const)
+            and expr.operands[1].value == 1
+        ):
+            lhs0 = expr.operands[0]
+            if (
+                isinstance(lhs0, BinaryOp)
+                and lhs0.op == "Shr"
+                and isinstance(lhs0.operands[1], Const)
+                and lhs0.operands[1].value == 0x1D
+            ):
+                lhs1 = lhs0.operands[0]
+                if (
+                    isinstance(lhs1, BinaryOp)
+                    and lhs1.op == "Sub"
+                    and isinstance(lhs1.operands[1], Const)
+                    and lhs1.operands[1].value == 1
+                ):
+                    lhs2 = lhs1.operands[0]
+                    if (
+                        isinstance(lhs2, BinaryOp)
+                        and lhs2.op == "Shl"
+                        and isinstance(lhs2.operands[1], Const)
+                        and lhs2.operands[1].value == 0x1E
+                    ):
+                        lhs3 = lhs2.operands[0]
+                        if (
+                            isinstance(lhs3, BinaryOp)
+                            and lhs3.op == "Xor"
+                            and isinstance(lhs3.operands[1], Const)
+                            and lhs3.operands[1].value == 1
+                        ):
+                            ix = lhs3.operands[0]
+                            return True, ix
+        return False, None
+
+    @staticmethod
+    def _match_termR(expr: BinaryOp):
+        # ((ix & (ix >> 0x1<8>)) & 0x1<32>)
+        if (
+            isinstance(expr, BinaryOp)
+            and expr.op == "And"
+            and isinstance(expr.operands[1], Const)
+            and expr.operands[1].value == 1
+        ):
+            lhs0 = expr.operands[0]
+            if isinstance(lhs0, BinaryOp) and lhs0.op == "And":
+                ix0, op1 = lhs0.operands
+                if (
+                    isinstance(op1, BinaryOp)
+                    and op1.op == "Shr"
+                    and isinstance(op1.operands[1], Const)
+                    and op1.operands[1].value == 1
+                ):
+                    ix1 = op1.operands[0]
+                    if ix0 == ix1:
+                        return True, ix0
+        return False, None
+
+    @staticmethod
+    def _match_ix(expr: BinaryOp):
+        # ((((Conv(32->s64, r7<4>) CmpF t81) >> 0x5<8>) & 0x3<32>) | ((Conv(32->s64, r7<4>) CmpF t81) & 0x1<32>))
+        if isinstance(expr, BinaryOp) and expr.op == "Or":
+            left, right = expr.operands
+            cmpf_0, cmpf_1 = None, None
+            if (
+                isinstance(left, BinaryOp)
+                and left.op == "And"
+                and isinstance(left.operands[1], Const)
+                and left.operands[1].value == 3
+            ):
+                left_inner = left.operands[0]
+                if (
+                    isinstance(left_inner, BinaryOp)
+                    and left_inner.op == "Shr"
+                    and isinstance(left_inner.operands[1], Const)
+                    and left_inner.operands[1].value == 5
+                ):
+                    cmpf_0 = left_inner.operands[0]
+            if (
+                isinstance(right, BinaryOp)
+                and right.op == "And"
+                and isinstance(right.operands[1], Const)
+                and right.operands[1].value == 1
+            ):
+                cmpf_1 = right.operands[0]
+
+            if cmpf_0 is not None and cmpf_1 is not None and cmpf_0 == cmpf_1:
+                return True, cmpf_0
+        return None

angr/analyses/decompiler/peephole_optimizations/base.py

@@ -0,0 +1,157 @@
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, UnaryOp, Expression
+from angr.ailment.statement import Statement, Assignment
+from angr.ailment import Block
+from angr.project import Project
+from angr.knowledge_base import KnowledgeBase
+from angr.knowledge_plugins.key_definitions import atoms
+
+
+class PeepholeOptimizationStmtBase:
+    """
+    The base class for all peephole optimizations that are applied on AIL statements.
+    """
+
+    __slots__ = (
+        "func_addr",
+        "kb",
+        "preserve_vvar_ids",
+        "project",
+        "type_hints",
+    )
+    project: Project | None
+    kb: KnowledgeBase | None
+    func_addr: int | None
+    preserve_vvar_ids: set[int]
+    type_hints: list[tuple[atoms.VirtualVariable | atoms.MemoryLocation, str]]
+
+    NAME = "Peephole Optimization - Statement"
+    DESCRIPTION = "Peephole Optimization - Statement"
+    stmt_classes = None
+
+    def __init__(
+        self,
+        project: Project | None,
+        kb: KnowledgeBase | None,
+        func_addr: int | None = None,
+        preserve_vvar_ids: set[int] | None = None,
+        type_hints: list[tuple[atoms.VirtualVariable | atoms.MemoryLocation, str]] | None = None,
+    ):
+        self.project = project
+        self.kb = kb
+        self.func_addr = func_addr
+        self.preserve_vvar_ids = set() if preserve_vvar_ids is None else preserve_vvar_ids
+        self.type_hints = [] if type_hints is None else type_hints
+
+    def optimize(self, stmt, stmt_idx: int | None = None, block=None, **kwargs):
+        raise NotImplementedError("_optimize() is not implemented.")
+
+
+class PeepholeOptimizationMultiStmtBase:
+    """
+    The base class for all peephole optimizations that are applied on multiple AIL statements at once.
+    """
+
+    __slots__ = (
+        "func_addr",
+        "kb",
+        "preserve_vvar_ids",
+        "project",
+        "type_hints",
+    )
+    project: Project | None
+    kb: KnowledgeBase | None
+    func_addr: int | None
+    preserve_vvar_ids: set[int]
+    type_hints: list[tuple[atoms.VirtualVariable | atoms.MemoryLocation, str]]
+
+    NAME = "Peephole Optimization - Multi-statement"
+    DESCRIPTION = "Peephole Optimization - Multi-statement"
+    stmt_classes = None
+
+    def __init__(
+        self,
+        project: Project | None,
+        kb: KnowledgeBase | None,
+        func_addr: int | None = None,
+        preserve_vvar_ids: set[int] | None = None,
+        type_hints: list[tuple[atoms.VirtualVariable | atoms.MemoryLocation, str]] | None = None,
+    ):
+        self.project = project
+        self.kb = kb
+        self.func_addr = func_addr
+        self.preserve_vvar_ids = set() if preserve_vvar_ids is None else preserve_vvar_ids
+        self.type_hints = [] if type_hints is None else type_hints
+
+    def optimize(self, stmts: list[Statement], stmt_idx: int | None = None, block=None, **kwargs):
+        raise NotImplementedError("_optimize() is not implemented.")
+
+
+class PeepholeOptimizationExprBase:
+    """
+    The base class for all peephole optimizations that are applied on AIL expressions.
+    """
+
+    __slots__ = (
+        "func_addr",
+        "kb",
+        "preserve_vvar_ids",
+        "project",
+        "type_hints",
+    )
+    project: Project | None
+    kb: KnowledgeBase | None
+    func_addr: int | None
+    preserve_vvar_ids: set[int]
+    type_hints: list[tuple[atoms.VirtualVariable | atoms.MemoryLocation, str]]
+
+    NAME = "Peephole Optimization - Expression"
+    DESCRIPTION = "Peephole Optimization - Expression"
+    expr_classes = None
+
+    def __init__(
+        self,
+        project: Project | None,
+        kb: KnowledgeBase | None,
+        func_addr: int | None = None,
+        preserve_vvar_ids: set[int] | None = None,
+        type_hints: list[tuple[atoms.VirtualVariable | atoms.MemoryLocation, str]] | None = None,
+    ):
+        self.project = project
+        self.kb = kb
+        self.func_addr = func_addr
+        self.preserve_vvar_ids = set() if preserve_vvar_ids is None else preserve_vvar_ids
+        self.type_hints = [] if type_hints is None else type_hints
+
+    def optimize(self, expr, stmt_idx: int | None = None, block=None, **kwargs):
+        raise NotImplementedError("_optimize() is not implemented.")
+
+    #
+    # Util methods
+    #
+
+    @staticmethod
+    def find_definition(ail_expr: Expression, stmt_idx: int, block: Block) -> None:
+        idx = stmt_idx - 1
+        if idx >= 0:
+            stmt = block.statements[idx]
+            if isinstance(stmt, Assignment) and stmt.dst.likes(ail_expr):
+                return stmt.src
+        return None
+
+    @staticmethod
+    def is_bool_expr(ail_expr):
+        if isinstance(ail_expr, BinaryOp) and ail_expr.op in {
+            "CmpEQ",
+            "CmpNE",
+            "CmpLT",
+            "CmpLE",
+            "CmpGT",
+            "CmpGE",
+            "CmpLTs",
+            "CmpLEs",
+            "CmpGTs",
+            "CmpGEs",
+        }:
+            return True
+        return bool(isinstance(ail_expr, UnaryOp) and ail_expr.op == "Not")

angr/analyses/decompiler/peephole_optimizations/basepointeroffset_add_n.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, BasePointerOffset, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class BasePointerOffsetAddN(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "(Ptr - M) + N => Ptr - (M - N)"
+    expr_classes = (BinaryOp,)  # all expressions are allowed
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if (
+            expr.op in ("Add", "Sub")
+            and isinstance(expr.operands[0], BasePointerOffset)
+            and isinstance(expr.operands[1], Const)
+        ):
+            offset = expr.operands[0].offset
+            if expr.op == "Add":
+                offset += expr.operands[1].value
+            else:  # expr.op == "Sub"
+                offset -= expr.operands[1].value
+
+            # convert offset to a signed integer
+            max_int = (1 << (self.project.arch.bits - 1)) - 1
+            if offset > max_int:
+                offset -= 1 << self.project.arch.bits
+
+            r = expr.operands[0].copy()
+            r.offset = offset
+            return r
+
+        return None

angr/analyses/decompiler/peephole_optimizations/basepointeroffset_and_mask.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, BasePointerOffset, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class BasePointerOffsetAndMask(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "Ptr & mask => Ptr"
+    expr_classes = (BinaryOp,)  # all expressions are allowed
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        if expr.op == "And" and isinstance(expr.operands[0], BasePointerOffset) and isinstance(expr.operands[1], Const):
+            # is it a mask?
+            mask = expr.operands[1].value
+            if mask not in {
+                0xFFFE,
+                0xFFFC,
+                0xFFF8,
+                0xFFF0,
+                0xFFFF_FFFE,
+                0xFFFF_FFFC,
+                0xFFFF_FFF8,
+                0xFFFF_FFF0,
+                0xFFFF_FFFF_FFFF_FFFE,
+                0xFFFF_FFFF_FFFF_FFFC,
+                0xFFFF_FFFF_FFFF_FFF8,
+                0xFFFF_FFFF_FFFF_FFF0,
+            }:
+                return None
+
+            # we ignore this mask
+            return expr.operands[0]
+
+        return None