angr 9.2.165__cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl

angr/analyses/decompiler/empty_node_remover.py

@@ -0,0 +1,212 @@
+# pylint:disable=unused-argument,no-self-use
+from __future__ import annotations
+from collections import OrderedDict
+
+import claripy
+import angr.ailment as ailment
+from angr.ailment.expression import negate
+
+from .sequence_walker import SequenceWalker
+from .structuring.structurer_nodes import (
+    MultiNode,
+    SequenceNode,
+    CodeNode,
+    ConditionNode,
+    SwitchCaseNode,
+    ConditionalBreakNode,
+    BreakNode,
+    LoopNode,
+    CascadingConditionNode,
+    ContinueNode,
+)
+from .condition_processor import ConditionProcessor
+
+
+class EmptyNodeRemover:
+    """
+    Rewrites a node and its children to remove empty nodes.
+
+    The following optimizations are performed at the same time:
+    - Convert if (A) { } else { ... } to if(!A) { ... } else { }
+
+    :ivar _claripy_ast_conditions:  True if all node conditions are claripy ASTs. False if all node conditions are AIL
+                                    expressions.
+    """
+
+    def __init__(self, node, claripy_ast_conditions: bool = True):
+        self.root = node
+        self._claripy_ast_conditions = claripy_ast_conditions
+
+        self.removed_sequences = []
+        self.replaced_sequences = {}
+
+        handlers = {
+            SequenceNode: self._handle_Sequence,
+            CodeNode: self._handle_Code,
+            ConditionNode: self._handle_Condition,
+            CascadingConditionNode: self._handle_CascadingCondition,
+            SwitchCaseNode: self._handle_SwitchCase,
+            LoopNode: self._handle_Loop,
+            ContinueNode: self._handle_Continue,
+            MultiNode: self._handle_MultiNode,
+            BreakNode: self._handle_Default,
+            ConditionalBreakNode: self._handle_Default,
+            ailment.Block: self._handle_Block,
+        }
+        self._walker = SequenceWalker(handlers=handlers)
+        r = self._walker.walk(self.root)
+        if r is None:
+            self.result = SequenceNode(None, nodes=[])
+        else:
+            # Make sure it's still a sequence node
+            if not isinstance(r, SequenceNode):
+                r = SequenceNode(node.addr, nodes=[r])
+            self.result = r
+
+    #
+    # Handlers
+    #
+
+    def _handle_Sequence(self, node, **kwargs):
+        new_nodes = []
+        for node_ in node.nodes:
+            new_node = self._walker._handle(node_)
+            if new_node is not None:
+                if isinstance(new_node, SequenceNode):
+                    new_nodes.extend(new_node.nodes)
+                else:
+                    new_nodes.append(new_node)
+
+        if not new_nodes:
+            self.removed_sequences.append(node)
+            return None
+        if len(new_nodes) == 1:
+            # Remove the unnecessary sequence node
+            self.replaced_sequences[node] = new_nodes[0]
+            return new_nodes[0]
+
+        sn = SequenceNode(node.addr, nodes=new_nodes)
+        self.replaced_sequences[node] = sn
+        return sn
+
+    def _handle_MultiNode(self, node: MultiNode, **kwargs):
+        new_nodes = []
+        for node_ in node.nodes:
+            new_node = self._walker._handle(node_)
+            if new_node is not None:
+                if isinstance(new_node, MultiNode):
+                    new_nodes.extend(new_node.nodes)
+                else:
+                    new_nodes.append(new_node)
+
+        if not new_nodes:
+            return None
+        if len(new_nodes) == 1:
+            # Remove the unnecessary MultiNode
+            return new_nodes[0]
+        return MultiNode(new_nodes)
+
+    def _handle_Code(self, node, **kwargs):
+        inner_node = self._walker._handle(node.node)
+        if inner_node is None:
+            return None
+        if (
+            self._claripy_ast_conditions
+            and node.reaching_condition is not None
+            and claripy.is_true(node.reaching_condition)
+        ):
+            # Remove the unnecessary CodeNode
+            return inner_node
+        if self._claripy_ast_conditions and isinstance(inner_node, CodeNode):
+            # unpack the codenode so we don't have directly nested CodeNodes
+            return CodeNode(inner_node.node, claripy.And(node.reaching_condition, inner_node.reaching_condition))
+        return CodeNode(inner_node, node.reaching_condition)
+
+    def _handle_Condition(self, node, **kwargs):
+        true_node = self._walker._handle(node.true_node)
+        false_node = self._walker._handle(node.false_node)
+
+        if true_node is None and false_node is None:
+            # empty node
+            return None
+        if true_node is None and false_node is not None:
+            # swap them
+            return ConditionNode(
+                node.addr,
+                node.reaching_condition,
+                (
+                    ConditionProcessor.simplify_condition(claripy.Not(node.condition))
+                    if self._claripy_ast_conditions
+                    else negate(node.condition)
+                ),
+                false_node,
+                false_node=None,
+            )
+        if (
+            self._claripy_ast_conditions
+            and claripy.is_true(node.condition)
+            and node.true_node is not None
+            and node.false_node is None
+        ):
+            return node.true_node
+        return ConditionNode(node.addr, node.reaching_condition, node.condition, true_node, false_node=false_node)
+
+    def _handle_CascadingCondition(self, node: CascadingConditionNode, **kwargs):
+        new_else_node = None if node.else_node is None else self._walker._handle(node.else_node)
+
+        new_cond_and_nodes = []
+        for cond, child_node in node.condition_and_nodes:
+            new_node = self._walker._handle(child_node)
+            if new_node is not None:
+                new_cond_and_nodes.append((cond, new_node))
+            else:
+                if new_else_node is not None:
+                    # do not allow any empty condition nodes, otherwise the condition for the else node will be wrong
+                    new_cond_and_nodes.append((cond, child_node))
+
+        if not new_cond_and_nodes and new_else_node is None:
+            # empty node
+            return None
+        return CascadingConditionNode(node.addr, new_cond_and_nodes, else_node=new_else_node)
+
+    def _handle_Loop(self, node: LoopNode, **kwargs):
+        new_seq = self._walker._handle(node.sequence_node)
+
+        if (
+            new_seq is None
+            and node.sort == "while"
+            and (node.condition is None or (isinstance(node.condition, ailment.Const) and node.condition.value == 0))
+        ):
+            return None
+
+        result = node.copy()
+        result.sequence_node = new_seq
+        return result
+
+    def _handle_Continue(self, node: ContinueNode, **kwargs):
+        return node
+
+    def _handle_SwitchCase(self, node, **kwargs):
+        new_cases = OrderedDict()
+
+        for idx, case in node.cases.items():
+            new_case = self._walker._handle(case)
+            if new_case is not None:
+                new_cases[idx] = new_case
+
+        new_default_node = self._walker._handle(node.default_node)
+
+        if not new_cases and new_default_node is None:
+            return None
+
+        return SwitchCaseNode(node.switch_expr, new_cases, new_default_node, addr=node.addr)
+
+    @staticmethod
+    def _handle_Default(node, **kwargs):
+        return node
+
+    @staticmethod
+    def _handle_Block(block, **kwargs):
+        if not block.statements:
+            return None
+        return block

angr/analyses/decompiler/expression_narrower.py

@@ -0,0 +1,287 @@
+from __future__ import annotations
+from typing import Any, TYPE_CHECKING
+from collections import defaultdict
+import logging
+
+from angr.ailment import AILBlockWalkerBase, AILBlockWalker
+from angr.ailment.statement import Assignment, Call
+from angr.ailment.expression import VirtualVariable, Convert, BinaryOp, Phi
+
+from angr.knowledge_plugins.key_definitions import atoms
+from angr.code_location import CodeLocation
+
+if TYPE_CHECKING:
+    from angr.ailment.expression import (
+        Expression,
+        Load,
+        UnaryOp,
+        ITE,
+        DirtyExpression,
+        VEXCCallExpression,
+    )
+    from angr.ailment.statement import Statement
+    from angr.ailment.block import Block
+
+
+_l = logging.getLogger(__name__)
+
+
+class ExprNarrowingInfo:
+    """
+    Stores the analysis result of _narrowing_needed().
+    """
+
+    __slots__ = ("narrowable", "phi_vars", "to_size", "use_exprs")
+
+    def __init__(
+        self,
+        narrowable: bool,
+        to_size: int | None = None,
+        use_exprs: list[tuple[atoms.VirtualVariable, CodeLocation, tuple[str, tuple[Expression, ...]]]] | None = None,
+        phi_vars: set[VirtualVariable] | None = None,
+    ):
+        self.narrowable = narrowable
+        self.to_size = to_size
+        self.use_exprs = use_exprs
+        self.phi_vars = phi_vars
+
+
+class NarrowingInfoExtractor(AILBlockWalkerBase):
+    """
+    Walks a statement or an expression and extracts the operations that are applied on the given expression.
+
+    For example, for target expression rax, `(rax & 0xff) + 0x1` means the following operations are applied on `rax`:
+    rax & 0xff
+    (rax & 0xff) + 0x1
+
+    The previous expression is always used in the succeeding expression.
+    """
+
+    def __init__(self, target_expr: Expression):
+        super().__init__()
+        self._target_expr = target_expr
+        self.operations = []
+
+    def _handle_expr(
+        self, expr_idx: int, expr: Expression, stmt_idx: int, stmt: Statement | None, block: Block | None
+    ) -> Any:
+        if expr == self._target_expr:
+            # we are done!
+            return True
+        has_target_expr = super()._handle_expr(expr_idx, expr, stmt_idx, stmt, block)
+        if has_target_expr:
+            # record the current operation
+            self.operations.append(expr)
+            return True
+        return False
+
+    def _handle_Load(self, expr_idx: int, expr: Load, stmt_idx: int, stmt: Statement, block: Block | None):
+        return self._handle_expr(0, expr.addr, stmt_idx, stmt, block)
+
+    def _handle_CallExpr(self, expr_idx: int, expr: Call, stmt_idx: int, stmt: Statement, block: Block | None):
+        r = False
+        if expr.args:
+            for i, arg in enumerate(expr.args):
+                r |= self._handle_expr(i, arg, stmt_idx, stmt, block)
+        return r
+
+    def _handle_BinaryOp(self, expr_idx: int, expr: BinaryOp, stmt_idx: int, stmt: Statement, block: Block | None):
+        r = self._handle_expr(0, expr.operands[0], stmt_idx, stmt, block)
+        r |= self._handle_expr(1, expr.operands[1], stmt_idx, stmt, block)
+        return r
+
+    def _handle_UnaryOp(self, expr_idx: int, expr: UnaryOp, stmt_idx: int, stmt: Statement, block: Block | None):
+        return self._handle_expr(0, expr.operand, stmt_idx, stmt, block)
+
+    def _handle_Convert(self, expr_idx: int, expr: Convert, stmt_idx: int, stmt: Statement, block: Block | None):
+        return self._handle_expr(expr_idx, expr.operand, stmt_idx, stmt, block)
+
+    def _handle_ITE(self, expr_idx: int, expr: ITE, stmt_idx: int, stmt: Statement, block: Block | None):
+        r = self._handle_expr(0, expr.cond, stmt_idx, stmt, block)
+        r |= self._handle_expr(1, expr.iftrue, stmt_idx, stmt, block)
+        r |= self._handle_expr(2, expr.iffalse, stmt_idx, stmt, block)
+        return r
+
+    def _handle_DirtyExpression(
+        self, expr_idx: int, expr: DirtyExpression, stmt_idx: int, stmt: Statement, block: Block | None
+    ):
+        r = False
+        if expr.operands:
+            for i, op in enumerate(expr.operands):
+                r |= self._handle_expr(i, op, stmt_idx, stmt, block)
+        return r
+
+    def _handle_VEXCCallExpression(
+        self, expr_idx: int, expr: VEXCCallExpression, stmt_idx: int, stmt: Statement, block: Block | None
+    ):
+        r = False
+        for idx, operand in enumerate(expr.operands):
+            r |= self._handle_expr(idx, operand, stmt_idx, stmt, block)
+        return r
+
+
+class ExpressionNarrower(AILBlockWalker):
+    """
+    Narrows an expression regardless of whether the expression is a definition or a use.
+    """
+
+    def __init__(
+        self, project, rd, narrowables, addr2blocks: dict[tuple[int, int | None], Block], new_blocks: dict[Block, Block]
+    ):
+        super().__init__(update_block=False)
+
+        self.project = project
+        self._rd = rd
+        self._addr2blocks = addr2blocks
+        self._new_blocks = new_blocks
+
+        self.new_vvar_sizes: dict[int, int] = {}
+        self.replacement_core_vvars: dict[int, list[VirtualVariable]] = defaultdict(list)
+        self.narrowed_any = False
+
+        for def_, narrow_info in narrowables:
+            self.new_vvar_sizes[def_.atom.varid] = narrow_info.to_size
+
+    def walk(self, block: Block):
+        self.narrowed_any = False
+        return super().walk(block)
+
+    def _handle_Assignment(self, stmt_idx: int, stmt: Assignment, block: Block | None) -> Assignment | None:
+
+        if isinstance(stmt.src, Phi):
+            changed = False
+
+            src_and_vvars = []
+            for src, vvar in stmt.src.src_and_vvars:
+                if vvar is None:
+                    src_and_vvars.append((src, None))
+                    continue
+                if vvar.varid in self.new_vvar_sizes and self.new_vvar_sizes[vvar.varid] != vvar.size:
+                    self.narrowed_any = True
+                    changed = True
+                    new_var = VirtualVariable(
+                        vvar.idx,
+                        vvar.varid,
+                        self.new_vvar_sizes[vvar.varid] * self.project.arch.byte_width,
+                        category=vvar.category,
+                        oident=vvar.oident,
+                        **vvar.tags,
+                    )
+
+                    self.replacement_core_vvars[new_var.varid].append(new_var)
+                else:
+                    new_var = None
+
+                src_and_vvars.append((src, new_var))
+
+            new_src = Phi(stmt.src.idx, stmt.src.bits, src_and_vvars, **stmt.src.tags)
+
+        else:
+            new_src = self._handle_expr(1, stmt.src, stmt_idx, stmt, block)
+            if new_src is None:
+                changed = False
+                new_src = stmt.src
+            else:
+                changed = True
+
+        if isinstance(stmt.dst, VirtualVariable) and stmt.dst.varid in self.new_vvar_sizes:
+            changed = True
+            new_dst = VirtualVariable(
+                stmt.dst.idx,
+                stmt.dst.varid,
+                self.new_vvar_sizes[stmt.dst.varid] * self.project.arch.byte_width,
+                category=stmt.dst.category,
+                oident=stmt.dst.oident,
+                **stmt.dst.tags,
+            )
+
+            self.replacement_core_vvars[new_dst.varid].append(new_dst)
+
+            if isinstance(new_src, Phi):
+                new_src.bits = self.new_vvar_sizes[stmt.dst.varid] * self.project.arch.byte_width
+            else:
+                new_src = Convert(
+                    None,
+                    stmt.src.bits,
+                    self.new_vvar_sizes[stmt.dst.varid] * self.project.arch.byte_width,
+                    False,
+                    new_src,
+                    **new_src.tags,
+                )
+        else:
+            new_dst = self._handle_expr(0, stmt.dst, stmt_idx, stmt, block)
+            if new_dst is not None:
+                changed = True
+            else:
+                new_dst = stmt.dst
+
+        if changed:
+            self.narrowed_any = True
+            return Assignment(stmt.idx, new_dst, new_src, **stmt.tags)
+
+        return None
+
+    def _handle_VirtualVariable(
+        self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt: Statement, block: Block | None
+    ) -> Convert | None:
+        if expr.varid in self.new_vvar_sizes and self.new_vvar_sizes[expr.varid] != expr.size:
+            self.narrowed_any = True
+            new_expr = VirtualVariable(
+                expr.idx,
+                expr.varid,
+                self.new_vvar_sizes[expr.varid] * self.project.arch.byte_width,
+                category=expr.category,
+                oident=expr.oident,
+                **expr.tags,
+            )
+
+            self.replacement_core_vvars[expr.varid].append(new_expr)
+
+            return Convert(
+                None,
+                new_expr.bits,
+                expr.bits,
+                False,
+                new_expr,
+                **new_expr.tags,
+            )
+        return None
+
+    def _handle_Call(self, stmt_idx: int, stmt: Call, block: Block | None) -> Call | None:
+        new_stmt = super()._handle_Call(stmt_idx, stmt, block)
+        if new_stmt is None:
+            changed = False
+            new_stmt = stmt
+        else:
+            changed = True
+
+        if (
+            stmt.ret_expr is not None
+            and isinstance(stmt.ret_expr, VirtualVariable)
+            and stmt.ret_expr.was_reg
+            and stmt.ret_expr.varid in self.new_vvar_sizes
+            and stmt.ret_expr.size != self.new_vvar_sizes[stmt.ret_expr.varid]
+        ):
+            changed = True
+
+            # update reg name
+            tags = dict(stmt.ret_expr.tags)
+            tags["reg_name"] = self.project.arch.translate_register_name(
+                stmt.ret_expr.reg_offset, size=self.new_vvar_sizes[stmt.ret_expr.varid]
+            )
+            new_ret_expr = VirtualVariable(
+                stmt.ret_expr.idx,
+                stmt.ret_expr.varid,
+                self.new_vvar_sizes[stmt.ret_expr.varid] * self.project.arch.byte_width,
+                category=stmt.ret_expr.category,
+                oident=stmt.ret_expr.oident,
+                **tags,
+            )
+            self.replacement_core_vvars[new_ret_expr.varid].append(new_ret_expr)
+            new_stmt.ret_expr = new_ret_expr
+
+        if changed:
+            self.narrowed_any = True
+            return new_stmt
+
+        return None

angr/analyses/decompiler/goto_manager.py

@@ -0,0 +1,112 @@
+from __future__ import annotations
+import angr.ailment as ailment
+from angr.ailment.block import Block
+import networkx
+
+from .utils import find_block_by_addr
+
+
+class Goto:
+    """
+    Describe the existence of a goto (jump) statement. May have multiple gotos with the same address (targets
+    will differ).
+    """
+
+    def __init__(self, src_addr, dst_addr, src_idx=None, dst_idx=None, src_ins_addr=None):
+        self.src_addr = src_addr
+        self.dst_addr = dst_addr
+        self.src_idx = src_idx
+        self.dst_idx = dst_idx
+        self.src_ins_addr = src_ins_addr
+
+    def __hash__(self):
+        return hash(f"{self.src_addr}{self.dst_addr}{self.src_idx}{self.dst_idx}")
+
+    def __str__(self):
+        if self.src_addr is None or self.dst_addr is None:
+            return f"<Goto {self.__hash__()}>"
+
+        src_idx_str = "" if self.src_idx is None else f".{self.src_idx}"
+        dst_idx_str = "" if self.dst_idx is None else f".{self.dst_idx}"
+        src_ins_addr_str = "" if self.src_ins_addr is None else f"{hex(self.src_ins_addr)}"
+        return f"<Goto: [{hex(self.src_addr)}@{src_ins_addr_str}{src_idx_str}] -> {hex(self.dst_addr)}{dst_idx_str}>"
+
+    def __repr__(self):
+        return self.__str__()
+
+
+class GotoManager:
+    """
+    Container class for all Gotos found in a function after decompilation structuring.
+    This should be populated using GotoSimplifier.
+    """
+
+    def __init__(self, func, gotos=None):
+        self.func = func
+        self.gotos: set[Goto] = gotos or set()
+
+        self._gotos_by_addr = None
+
+    def __str__(self):
+        return f"<GotoManager: func[{hex(self.func.addr)}] {len(self.gotos)} gotos>"
+
+    def __repr__(self):
+        return self.__str__()
+
+    def gotos_in_block(self, block: ailment.Block) -> set[Goto]:
+        gotos_found = set()
+        for goto in self.gotos:
+            if goto.src_addr == block.addr:
+                gotos_found.add(goto)
+            else:
+                block_addrs = {stmt.ins_addr for stmt in block.statements if "ins_addr" in stmt.tags}
+                if goto.src_ins_addr in block_addrs:
+                    gotos_found.add(goto)
+
+        return gotos_found
+
+    def is_goto_edge(self, src: ailment.Block, dst: ailment.Block):
+        src_gotos = self.gotos_in_block(src)
+        for goto in src_gotos:
+            if goto.dst_addr == dst.addr:
+                return True
+            block_addrs = {stmt.ins_addr for stmt in dst.statements if "ins_addr" in stmt.tags}
+            if goto.dst_addr in block_addrs:
+                return True
+
+        return False
+
+    def find_goto_edges(self, graph: networkx.DiGraph) -> list[tuple[Block, Block]]:
+        """
+        This function finds all edges that are _potential_ gotos in the graph.
+        The gotos are not guaranteed to be correct, but they are an approximation based on how the Phoenix
+        structuring algorithm will select edges from the graph to be gotos in structuring.
+        """
+        # first collect all simple destinations known by the goto managers
+        dst_blocks = set()
+        goto_edges = []
+        for goto in self.gotos:
+            try:
+                dst_block = find_block_by_addr(graph, goto.dst_addr)
+            except ValueError:
+                continue
+
+            try:
+                src_block = find_block_by_addr(graph, goto.src_addr)
+            except ValueError:
+                src_block = None
+
+            if src_block is None:
+                # try the instruction addrs in the block to find the goto
+                try:
+                    src_block = find_block_by_addr(graph, goto.src_ins_addr, insn_addr=True)
+                except ValueError:
+                    src_block = None
+
+            if src_block is not None and dst_block is not None:
+                # if you found the source, we dont need to try later things on this dst
+                goto_edges.append((src_block, dst_block))
+            elif dst_block is not None:
+                dst_blocks.add(dst_block)
+
+        return goto_edges