angr 9.2.165__cp310-abi3-macosx_10_12_x86_64.whl

angr/analyses/decompiler/peephole_optimizations/inlined_strcpy.py

@@ -0,0 +1,217 @@
+# pylint:disable=arguments-differ,too-many-boolean-expressions
+from __future__ import annotations
+import string
+
+from archinfo import Endness
+
+from angr.ailment.expression import Const, StackBaseOffset, VirtualVariable, UnaryOp
+from angr.ailment.statement import Call, Assignment, Store, Statement
+
+from angr import SIM_LIBRARIES
+from angr.utils.endness import ail_const_to_be
+from .base import PeepholeOptimizationStmtBase
+
+
+ASCII_PRINTABLES = set(string.printable)
+ASCII_DIGITS = set(string.digits)
+
+
+class InlinedStrcpy(PeepholeOptimizationStmtBase):
+    """
+    Simplifies inlined string copying logic into calls to strcpy.
+    """
+
+    __slots__ = ()
+
+    NAME = "Simplifying inlined strcpy"
+    stmt_classes = (Assignment, Store)
+
+    def optimize(self, stmt: Assignment | Store, stmt_idx: int | None = None, block=None, **kwargs):
+        inlined_strcpy_candidate = False
+        src: Const | None = None
+        strcpy_dst: StackBaseOffset | UnaryOp | None = None
+
+        assert self.project is not None
+
+        if (
+            isinstance(stmt, Assignment)
+            and isinstance(stmt.dst, VirtualVariable)
+            and stmt.dst.was_stack
+            and isinstance(stmt.src, Const)
+            and isinstance(stmt.src.value, int)
+        ):
+            inlined_strcpy_candidate = True
+            src = stmt.src
+            strcpy_dst = StackBaseOffset(None, self.project.arch.bits, stmt.dst.stack_offset)
+        elif (
+            isinstance(stmt, Store)
+            and isinstance(stmt.addr, UnaryOp)
+            and stmt.addr.op == "Reference"
+            and isinstance(stmt.addr.operand, VirtualVariable)
+            and stmt.addr.operand.was_stack
+            and isinstance(stmt.data, Const)
+            and isinstance(stmt.data.value, int)
+        ):
+            inlined_strcpy_candidate = True
+            src = stmt.data
+            strcpy_dst = stmt.addr
+
+        if inlined_strcpy_candidate:
+            assert src is not None and strcpy_dst is not None
+            assert isinstance(src.value, int)
+            assert self.kb is not None
+
+            r, s = self.is_integer_likely_a_string(src.value, src.size, self.project.arch.memory_endness)
+            if r:
+                assert s is not None
+
+                # replace it with a call to strncpy
+                str_id = self.kb.custom_strings.allocate(s.encode("ascii"))
+                return Call(
+                    stmt.idx,
+                    "strncpy",
+                    args=[
+                        strcpy_dst,
+                        Const(None, None, str_id, self.project.arch.bits, custom_string=True),
+                        Const(None, None, len(s), self.project.arch.bits),
+                    ],
+                    prototype=SIM_LIBRARIES["libc.so"][0].get_prototype("strncpy"),
+                    **stmt.tags,
+                )
+
+            # scan forward in the current block to find all consecutive constant stores
+            if block is not None and stmt_idx is not None:
+                all_constant_stores: dict[int, tuple[int, Const | None]] = self.collect_constant_stores(block, stmt_idx)
+                if all_constant_stores:
+                    offsets = sorted(all_constant_stores.keys())
+                    next_offset = min(offsets)
+                    stride = []
+                    for offset in offsets:
+                        if next_offset is not None and offset != next_offset:
+                            next_offset = None
+                            stride = []
+                        stmt_idx_, v = all_constant_stores[offset]
+                        if v is not None:
+                            stride.append((offset, stmt_idx_, v))
+                            next_offset = offset + v.size
+                        else:
+                            next_offset = None
+                            stride = []
+
+                    if not stride:
+                        return None
+                    min_stride_stmt_idx = min(stmt_idx_ for _, stmt_idx_, _ in stride)
+                    if min_stride_stmt_idx > stmt_idx:
+                        # the current statement is not involved in the stride. we can't simplify here, otherwise we
+                        # will incorrectly remove the current statement
+                        return None
+
+                    integer, size = self.stride_to_int(stride)
+                    prev_stmt = None if stmt_idx == 0 else block.statements[stmt_idx - 1]
+                    min_str_length = 1 if prev_stmt is not None and self.is_inlined_strcpy(prev_stmt) else 4
+                    r, s = self.is_integer_likely_a_string(integer, size, Endness.BE, min_length=min_str_length)
+                    if r:
+                        assert s is not None
+
+                        # we remove all involved statements whose statement IDs are greater than the current one
+                        for _, stmt_idx_, _ in reversed(stride):
+                            if stmt_idx_ <= stmt_idx:
+                                continue
+                            block.statements[stmt_idx_] = None
+                        block.statements = [ss for ss in block.statements if ss is not None]
+
+                        str_id = self.kb.custom_strings.allocate(s.encode("ascii"))
+                        return Call(
+                            stmt.idx,
+                            "strncpy",
+                            args=[
+                                strcpy_dst,
+                                Const(None, None, str_id, self.project.arch.bits, custom_string=True),
+                                Const(None, None, len(s), self.project.arch.bits),
+                            ],
+                            prototype=SIM_LIBRARIES["libc.so"][0].get_prototype("strncpy"),
+                            **stmt.tags,
+                        )
+
+        return None
+
+    @staticmethod
+    def stride_to_int(stride: list[tuple[int, int, Const]]) -> tuple[int, int]:
+        stride = sorted(stride, key=lambda x: x[0])
+        n = 0
+        size = 0
+        for _, _, v in stride:
+            size += v.size
+            n <<= v.bits
+            assert isinstance(v.value, int)
+            n |= v.value
+        return n, size
+
+    def collect_constant_stores(self, block, starting_stmt_idx: int) -> dict[int, tuple[int, Const | None]]:
+        assert self.project is not None
+
+        r = {}
+        for idx, stmt in enumerate(block.statements):
+            if idx < starting_stmt_idx:
+                continue
+            if (
+                isinstance(stmt, Assignment)
+                and isinstance(stmt.dst, VirtualVariable)
+                and stmt.dst.was_stack
+                and isinstance(stmt.dst.stack_offset, int)
+            ):
+                if isinstance(stmt.src, Const):
+                    r[stmt.dst.stack_offset] = idx, ail_const_to_be(stmt.src, self.project.arch.memory_endness)
+                else:
+                    r[stmt.dst.stack_offset] = idx, None
+
+        return r
+
+    @staticmethod
+    def is_integer_likely_a_string(v: int, size: int, endness: Endness, min_length: int = 4) -> tuple[bool, str | None]:
+        # we need at least four bytes of printable characters
+
+        chars = []
+        if endness == Endness.LE:
+            while v != 0:
+                byt = v & 0xFF
+                if chr(byt) not in ASCII_PRINTABLES:
+                    return False, None
+                chars.append(chr(byt))
+                v >>= 8
+
+        elif endness == Endness.BE:
+            first_non_zero = False
+            for _ in range(size):
+                byt = v & 0xFF
+                v >>= 8
+                if byt == 0:
+                    if first_non_zero:
+                        return False, None
+                    continue
+                first_non_zero = True  # this is the first non-zero byte
+                if chr(byt) not in ASCII_PRINTABLES:
+                    return False, None
+                chars.append(chr(byt))
+            chars.reverse()
+        else:
+            # unsupported endness
+            return False, None
+
+        if len(chars) >= min_length:
+            if len(chars) <= 4 and all(ch in ASCII_DIGITS for ch in chars):
+                return False, None
+            return True, "".join(chars)
+        return False, None
+
+    @staticmethod
+    def is_inlined_strcpy(stmt: Statement) -> bool:
+        return (
+            isinstance(stmt, Call)
+            and isinstance(stmt.target, str)
+            and stmt.target == "strncpy"
+            and stmt.args is not None
+            and len(stmt.args) == 3
+            and isinstance(stmt.args[1], Const)
+            and hasattr(stmt.args[1], "custom_string")
+        )

angr/analyses/decompiler/peephole_optimizations/inlined_strcpy_consolidation.py

@@ -0,0 +1,106 @@
+# pylint:disable=arguments-differ
+from __future__ import annotations
+
+from angr.ailment.expression import Expression, BinaryOp, Const, Register, StackBaseOffset, UnaryOp, VirtualVariable
+from angr.ailment.statement import Call, Store
+
+from angr import SIM_LIBRARIES
+from .base import PeepholeOptimizationMultiStmtBase
+from .inlined_strcpy import InlinedStrcpy
+
+
+class InlinedStrcpyConsolidation(PeepholeOptimizationMultiStmtBase):
+    """
+    Consolidate multiple inlined strcpy calls.
+    """
+
+    __slots__ = ()
+
+    NAME = "Consolidate multiple inlined strcpy calls"
+    stmt_classes = ((Call, Call), (Call, Store))
+
+    def optimize(self, stmts: list[Call], **kwargs):
+        last_stmt, stmt = stmts
+        if InlinedStrcpy.is_inlined_strcpy(last_stmt):
+            s_last: bytes = self.kb.custom_strings[last_stmt.args[1].value]
+            addr_last = last_stmt.args[0]
+            new_str = None  # will be set if consolidation should happen
+
+            if isinstance(stmt, Call) and InlinedStrcpy.is_inlined_strcpy(stmt):
+                # consolidating two calls
+                s_curr: bytes = self.kb.custom_strings[stmt.args[1].value]
+                addr_curr = stmt.args[0]
+                # determine if the two addresses are consecutive
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    # consolidate both calls!
+                    new_str = s_last + s_curr
+            elif isinstance(stmt, Store) and isinstance(stmt.data, Const):
+                # consolidating a call and a store, in case the store statement is storing the suffix of a string (but
+                # the suffix is too short to qualify an inlined strcpy optimization)
+                addr_curr = stmt.addr
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    if stmt.size == 1 and stmt.data.value == 0:
+                        # it's probably the terminating null byte
+                        r, s = True, "\x00"
+                    else:
+                        r, s = InlinedStrcpy.is_integer_likely_a_string(
+                            stmt.data.value, stmt.size, stmt.endness, min_length=1
+                        )
+                    if r:
+                        new_str = s_last + s.encode("ascii")
+
+            if new_str is not None:
+                if new_str.endswith(b"\x00"):
+                    call_name = "strcpy"
+                    new_str_idx = self.kb.custom_strings.allocate(new_str[:-1])
+                    args = [
+                        last_stmt.args[0],
+                        Const(None, None, new_str_idx, last_stmt.args[0].bits, custom_string=True),
+                    ]
+                    prototype = SIM_LIBRARIES["libc.so"][0].get_prototype("strcpy")
+                else:
+                    call_name = "strncpy"
+                    new_str_idx = self.kb.custom_strings.allocate(new_str)
+                    args = [
+                        last_stmt.args[0],
+                        Const(None, None, new_str_idx, last_stmt.args[0].bits, custom_string=True),
+                        Const(None, None, len(new_str), self.project.arch.bits),
+                    ]
+                    prototype = SIM_LIBRARIES["libc.so"][0].get_prototype("strncpy")
+
+                return [Call(stmt.idx, call_name, args=args, prototype=prototype, **stmt.tags)]
+
+        return None
+
+    @staticmethod
+    def _parse_addr(addr: Expression) -> tuple[Expression, int]:
+        if isinstance(addr, Register):
+            return addr, 0
+        if isinstance(addr, StackBaseOffset):
+            return StackBaseOffset(None, addr.bits, 0), addr.offset
+        if (
+            isinstance(addr, UnaryOp)
+            and addr.op == "Reference"
+            and isinstance(addr.operand, VirtualVariable)
+            and addr.operand.was_stack
+        ):
+            return StackBaseOffset(None, addr.bits, 0), addr.operand.stack_offset
+        if isinstance(addr, BinaryOp):
+            if addr.op == "Add" and isinstance(addr.operands[1], Const):
+                base_0, offset_0 = InlinedStrcpyConsolidation._parse_addr(addr.operands[0])
+                return base_0, offset_0 + addr.operands[1].value
+            if addr.op == "Sub" and isinstance(addr.operands[1], Const):
+                base_0, offset_0 = InlinedStrcpyConsolidation._parse_addr(addr.operands[0])
+                return base_0, offset_0 - addr.operands[1].value
+
+        return addr, 0
+
+    @staticmethod
+    def _get_delta(addr_0: Expression, addr_1: Expression) -> int | None:
+        base_0, offset_0 = InlinedStrcpyConsolidation._parse_addr(addr_0)
+        base_1, offset_1 = InlinedStrcpyConsolidation._parse_addr(addr_1)
+        if base_0.likes(base_1):
+            return offset_1 - offset_0
+        return None

angr/analyses/decompiler/peephole_optimizations/inlined_wstrcpy.py

@@ -0,0 +1,170 @@
+# pylint:disable=arguments-differ
+from __future__ import annotations
+import string
+
+from archinfo import Endness
+
+from angr.ailment.expression import Const, StackBaseOffset, VirtualVariable
+from angr.ailment.statement import Call, Assignment
+
+from angr.utils.endness import ail_const_to_be
+from .base import PeepholeOptimizationStmtBase
+
+
+ASCII_PRINTABLES = set(string.printable)
+ASCII_DIGITS = set(string.digits)
+
+
+class InlinedWstrcpy(PeepholeOptimizationStmtBase):
+    """
+    Simplifies inlined wide string copying logic into calls to wstrcpy.
+    """
+
+    __slots__ = ()
+
+    NAME = "Simplifying inlined wstrcpy"
+    stmt_classes = (Assignment,)
+
+    def optimize(self, stmt: Assignment, stmt_idx: int | None = None, block=None, **kwargs):
+        if (
+            isinstance(stmt.dst, VirtualVariable)
+            and stmt.dst.was_stack
+            and isinstance(stmt.src, Const)
+            and isinstance(stmt.src.value, int)
+        ):
+            r, s = self.is_integer_likely_a_wide_string(stmt.src.value, stmt.src.size, self.project.arch.memory_endness)
+            if r:
+                # replace it with a call to strncpy
+                str_id = self.kb.custom_strings.allocate(s.encode("ascii"))
+                return Call(
+                    stmt.idx,
+                    "wstrncpy",
+                    args=[
+                        StackBaseOffset(None, self.project.arch.bits, stmt.dst.stack_offset),
+                        Const(None, None, str_id, self.project.arch.bits, custom_string=True),
+                        Const(None, None, len(s), self.project.arch.bits),
+                    ],
+                    **stmt.tags,
+                )
+
+            # scan forward in the current block to find all consecutive constant stores
+            if block is not None and stmt_idx is not None:
+                all_constant_stores: dict[int, tuple[int, Const | None]] = self.collect_constant_stores(block, stmt_idx)
+                if all_constant_stores:
+                    offsets = sorted(all_constant_stores.keys())
+                    next_offset = min(offsets)
+                    stride = []
+                    for offset in offsets:
+                        if next_offset is not None and offset != next_offset:
+                            next_offset = None
+                            stride = []
+                        stmt_idx_, v = all_constant_stores[offset]
+                        if v is not None:
+                            stride.append((offset, stmt_idx_, v))
+                            next_offset = offset + v.size
+                        else:
+                            next_offset = None
+                            stride = []
+
+                    integer, size = self.stride_to_int(stride)
+                    r, s = self.is_integer_likely_a_wide_string(integer, size, Endness.BE)
+                    if r:
+                        # we remove all involved statements whose statement IDs are greater than the current one
+                        for _, stmt_idx_, _ in reversed(stride):
+                            if stmt_idx_ <= stmt_idx:
+                                continue
+                            block.statements[stmt_idx_] = None
+                        block.statements = [ss for ss in block.statements if ss is not None]
+
+                        str_id = self.kb.custom_strings.allocate(s.encode("ascii"))
+                        return Call(
+                            stmt.idx,
+                            "wstrncpy",
+                            args=[
+                                StackBaseOffset(None, self.project.arch.bits, stmt.dst.stack_offset),
+                                Const(None, None, str_id, self.project.arch.bits, custom_string=True),
+                                Const(None, None, len(s), self.project.arch.bits),
+                            ],
+                            **stmt.tags,
+                        )
+
+        return None
+
+    @staticmethod
+    def stride_to_int(stride: list[tuple[int, int, Const]]) -> tuple[int, int]:
+        stride = sorted(stride, key=lambda x: x[0])
+        n = 0
+        size = 0
+        for _, _, v in stride:
+            size += v.size
+            n <<= v.bits
+            n |= v.value
+        return n, size
+
+    def collect_constant_stores(self, block, starting_stmt_idx: int) -> dict[int, tuple[int, Const | None]]:
+        r = {}
+        for idx, stmt in enumerate(block.statements):
+            if idx < starting_stmt_idx:
+                continue
+            if (
+                isinstance(stmt, Assignment)
+                and isinstance(stmt.dst, VirtualVariable)
+                and stmt.dst.was_stack
+                and isinstance(stmt.dst.stack_offset, int)
+            ):
+                if isinstance(stmt.src, Const):
+                    r[stmt.dst.stack_offset] = idx, ail_const_to_be(stmt.src, self.project.arch.memory_endness)
+                else:
+                    r[stmt.dst.stack_offset] = idx, None
+
+        return r
+
+    @staticmethod
+    def even_offsets_are_zero(lst: list[str]) -> bool:
+        return all(ch == "\x00" for i, ch in enumerate(lst) if i % 2 == 0)
+
+    @staticmethod
+    def odd_offsets_are_zero(lst: list[str]) -> bool:
+        return all(ch == "\x00" for i, ch in enumerate(lst) if i % 2 == 1)
+
+    @staticmethod
+    def is_integer_likely_a_wide_string(
+        v: int, size: int, endness: Endness, min_length: int = 4
+    ) -> tuple[bool, str | None]:
+        # we need at least four bytes of printable characters
+
+        chars = []
+        if endness == Endness.LE:
+            while v != 0:
+                byt = v & 0xFF
+                if byt != 0 and chr(byt) not in ASCII_PRINTABLES:
+                    return False, None
+                chars.append(chr(byt))
+                v >>= 8
+
+        elif endness == Endness.BE:
+            for _ in range(size):
+                byt = v & 0xFF
+                v >>= 8
+                if byt != 0 and chr(byt) not in ASCII_PRINTABLES:
+                    return False, None
+                chars.append(chr(byt))
+            chars.reverse()
+        else:
+            # unsupported endness
+            return False, None
+
+        if InlinedWstrcpy.even_offsets_are_zero(chars):
+            chars = [ch for i, ch in enumerate(chars) if i % 2 == 1]
+        elif InlinedWstrcpy.odd_offsets_are_zero(chars):
+            chars = [ch for i, ch in enumerate(chars) if i % 2 == 0]
+        else:
+            return False, None
+
+        if chars and chars[-1] == "\x00":
+            chars = chars[:-1]
+        if len(chars) >= min_length and all(ch in ASCII_PRINTABLES for ch in chars):
+            if len(chars) <= 4 and all(ch in ASCII_DIGITS for ch in chars):
+                return False, None
+            return True, "".join(chars)
+        return False, None

angr/analyses/decompiler/peephole_optimizations/invert_negated_logical_conjuction_disjunction.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+from angr.ailment.expression import UnaryOp, BinaryOp
+
+from .base import PeepholeOptimizationExprBase
+
+
+class InvertNegatedLogicalConjunctionsAndDisjunctions(PeepholeOptimizationExprBase):
+    """
+    Push negations into subexpressions of logical conjunctions and logical disjunctions.
+    """
+
+    __slots__ = ()
+
+    NAME = "!(A && B) => A || B; !(A || B) => A && B"
+    expr_classes = (UnaryOp,)  # all expressions are allowed
+
+    def optimize(self, expr: UnaryOp, **kwargs):
+        if expr.op == "Not" and isinstance(expr.operand, BinaryOp):
+            if expr.operand.op == "LogicalAnd":
+                inner_operands = [
+                    UnaryOp(None, "Not", expr.operand.operands[0], **expr.operand.operands[0].tags),
+                    UnaryOp(None, "Not", expr.operand.operands[1], **expr.operand.operands[1].tags),
+                ]
+                return BinaryOp(
+                    expr.operand.idx,
+                    "LogicalOr",
+                    inner_operands,
+                    expr.operand.signed,
+                    variable=expr.operand.variable,
+                    variable_offset=expr.operand.variable_offset,
+                    bits=expr.operand.bits,
+                    **expr.tags,
+                )
+            if expr.operand.op == "LogicalOr":
+                inner_operands = [
+                    UnaryOp(None, "Not", expr.operand.operands[0], **expr.operand.operands[0].tags),
+                    UnaryOp(None, "Not", expr.operand.operands[1], **expr.operand.operands[1].tags),
+                ]
+                return BinaryOp(
+                    expr.idx,
+                    "LogicalAnd",
+                    inner_operands,
+                    expr.operand.signed,
+                    variable=expr.operand.variable,
+                    variable_offset=expr.operand.variable_offset,
+                    bits=expr.operand.bits,
+                    **expr.tags,
+                )
+
+        return None

angr/analyses/decompiler/peephole_optimizations/modulo_simplifier.py

@@ -0,0 +1,89 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
+from angr.ailment.expression import BinaryOp, Const, Convert
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ModuloSimplifier(PeepholeOptimizationExprBase):
+    """
+    Simplify division and multiplication expressions that can be reduced to a modulo operation.
+    """
+
+    __slots__ = ()
+
+    NAME = "a - (a / N) * N => a % N"
+    expr_classes = (BinaryOp,)
+
+    def optimize(  # pylint:disable=unused-argument
+        self, expr: BinaryOp, stmt_idx: int | None = None, block=None, **kwargs
+    ):
+        if expr.op == "Sub" and len(expr.operands) == 2:
+            sub0, sub1 = expr.operands
+            # unpack Conversions
+            outer_conv_expr = None
+            if (
+                isinstance(sub0, Convert)
+                and isinstance(sub1, Convert)
+                and sub0.to_bits == sub1.to_bits
+                and sub0.from_bits == sub1.from_bits
+                and sub0.to_bits > sub0.from_bits
+                and sub0.is_signed == sub1.is_signed
+            ):
+                # Convert(a) - Convert(a / N * N)  ==> Convert(a % N)
+                outer_conv_expr = sub0
+                sub0 = sub0.operand
+                sub1 = sub1.operand
+
+            if isinstance(sub1, BinaryOp) and sub1.op == "Mul" and isinstance(sub1.operands[1], Const):
+                a0, op1 = sub0, sub1
+                op1_left = op1.operands[0]
+                mul_const = sub1.operands[1]
+
+                if (
+                    isinstance(op1_left, Convert)
+                    and isinstance(a0, Convert)
+                    and op1_left.to_bits == a0.to_bits
+                    and op1_left.from_bits == a0.from_bits
+                ):
+                    # Convert(a) - (Convert(a / N)) * N  ==>  Convert(a) % N
+                    inner_conv_expr = a0
+                    a0 = a0.operand
+                    op1_left = op1_left.operand
+                else:
+                    inner_conv_expr = None
+
+                if isinstance(op1_left, BinaryOp) and op1_left.op == "Div" and isinstance(op1_left.operands[1], Const):
+                    # a - (a / N) * N  ==>  a % N
+                    a1 = op1_left.operands[0]
+                    div_const = op1_left.operands[1]
+
+                    if a0.likes(a1) and mul_const.value == div_const.value:
+                        operands = [a0, div_const]
+                        mod = BinaryOp(expr.idx, "Mod", operands, False, bits=a0.bits, **expr.tags)
+                        if inner_conv_expr is not None:
+                            conv_from_bits = inner_conv_expr.from_bits
+                            conv_to_bits = (
+                                inner_conv_expr.to_bits if outer_conv_expr is None else outer_conv_expr.to_bits
+                            )
+                            conv_signed = inner_conv_expr.is_signed
+                            conv_expr = inner_conv_expr
+                        elif outer_conv_expr is not None:
+                            conv_from_bits = outer_conv_expr.from_bits
+                            conv_to_bits = outer_conv_expr.to_bits
+                            conv_signed = outer_conv_expr.is_signed
+                            conv_expr = outer_conv_expr
+                        else:
+                            # no conversion necessary
+                            return mod
+
+                        return Convert(
+                            conv_expr.idx,
+                            conv_from_bits,
+                            conv_to_bits,
+                            conv_signed,
+                            mod,
+                            **conv_expr.tags,
+                        )
+
+        return None

angr/analyses/decompiler/peephole_optimizations/one_sub_bool.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+from angr.ailment.expression import Convert, BinaryOp, Const, UnaryOp
+
+from .base import PeepholeOptimizationExprBase
+
+
+class OneSubBool(PeepholeOptimizationExprBase):
+    __slots__ = ()
+
+    NAME = "1 - bool_expr => !bool_expr"
+    expr_classes = (BinaryOp,)  # all expressions are allowed
+
+    def optimize(self, expr: BinaryOp, **kwargs):
+        # Sub(1, Conv(1->N, some bool expression)) ==> Conv(1->N, Not(some bool expression))
+        if (
+            expr.op == "Sub"
+            and isinstance(expr.operands[0], Const)
+            and expr.operands[0].value == 1
+            and isinstance(expr.operands[1], Convert)
+            and expr.operands[1].from_bits == 1
+        ):
+            conv_expr = expr.operands[1]
+            if self.is_bool_expr(conv_expr.operand):
+                return Convert(
+                    None,
+                    1,
+                    conv_expr.to_bits,
+                    conv_expr.is_signed,
+                    UnaryOp(None, "Not", conv_expr.operand, **conv_expr.operand.tags),
+                    **conv_expr.tags,
+                )
+
+        return None