angr 9.2.165__cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

angr/storage/memory_object.py

@@ -0,0 +1,195 @@
+from __future__ import annotations
+import claripy
+
+from angr.errors import SimMemoryError
+
+
+def obj_bit_size(o):
+    if type(o) is bytes:
+        return len(o) * 8
+    return o.size()
+
+
+# TODO: get rid of is_bytes and have the bytes-backed objects be a separate class
+# pylint: disable=too-many-positional-arguments
+
+
+class SimMemoryObject:
+    """
+    A SimMemoryObject is a reference to a byte or several bytes in a specific object in memory. It should be used only
+    by the bottom layer of memory.
+    """
+
+    __slots__ = (
+        "_byte_width",
+        "_concrete_bytes",
+        "base",
+        "endness",
+        "is_bytes",
+        "length",
+        "object",
+    )
+
+    def __init__(self, obj, base, endness, length=None, byte_width=8):
+        if type(obj) is bytes:
+            assert byte_width == 8
+
+        elif not isinstance(obj, claripy.ast.Base):
+            raise SimMemoryError("memory can only store claripy Expression")
+
+        self.is_bytes = type(obj) is bytes
+        if self.is_bytes and endness != "Iend_BE":
+            raise SimMemoryError("bytes can only be stored big-endian")
+        self._byte_width = byte_width
+        self.base = base
+        self.object: claripy.ast.BV | claripy.ast.FP = obj
+        self.length = obj_bit_size(obj) // self._byte_width if length is None else length
+        self.endness = endness
+        self._concrete_bytes: bytes | None = None
+
+    def size(self):
+        return self.length * self._byte_width
+
+    def __len__(self):
+        return self.size()
+
+    @property
+    def variables(self):
+        return self.object.variables
+
+    @property
+    def symbolic(self):
+        return self.object.symbolic
+
+    @property
+    def last_addr(self):
+        return self.base + self.length - 1
+
+    def concrete_bytes(self, offset: int, size: int) -> bytes | None:
+        if (
+            self._concrete_bytes is None
+            and isinstance(self.object, claripy.ast.Bits)
+            and self.object.op == "BVV"
+            and not self.object.annotations
+        ):
+            self._concrete_bytes = self.object.concrete_value.to_bytes(len(self.object) // self._byte_width, "big")
+
+        if self._concrete_bytes is None:
+            return None
+
+        return self._concrete_bytes[offset : offset + size]
+
+    def includes(self, x):
+        return 0 <= x - self.base < self.length
+
+    def bytes_at(self, addr, length, allow_concrete=False, endness="Iend_BE"):
+        rev = endness != self.endness
+        if allow_concrete and rev:
+            raise ValueError("allow_concrete must be used with the stored endness")
+
+        if self.is_bytes:
+            if addr == self.base and length == self.length:
+                o = self.object
+            else:
+                start = addr - self.base
+                end = start + length
+                o = self.object[start:end]
+
+            return o if allow_concrete else claripy.BVV(o)
+
+        offset = addr - self.base
+        bv_obj = claripy.fpToIEEEBV(self.object) if isinstance(self.object, claripy.ast.FP) else self.object
+        try:
+            thing = bv_slice(bv_obj, offset, length, self.endness == "Iend_LE", self._byte_width)
+        except claripy.ClaripyOperationError:
+            # hacks to handle address space wrapping
+            if offset >= 0:
+                raise
+            if offset + 2**32 >= 0:
+                offset += 2**32
+            elif offset + 2**64 >= 0:
+                offset += 2**64
+            else:
+                raise
+            thing = bv_slice(bv_obj, offset, length, self.endness == "Iend_LE", self._byte_width)
+
+        if self.endness != endness:
+            thing = thing.reversed
+        return thing
+
+    def _object_equals(self, other):
+        if self.is_bytes != other.is_bytes:
+            return False
+
+        if self.is_bytes:
+            return self.object == other.object
+        return self.object.hash() == other.object.hash()
+
+    def _length_equals(self, other):
+        if type(self.length) is not type(other.length):
+            return False
+
+        if isinstance(self.length, int):
+            return self.length == other.length
+        return self.length.hash() == other.length.hash()
+
+    def __eq__(self, other):
+        if self is other:
+            return True
+
+        if type(other) is not SimMemoryObject:
+            return NotImplemented
+
+        return self.base == other.base and self._object_equals(other) and self._length_equals(other)
+
+    def __hash__(self):
+        return hash((self.object, self.base, self.length))
+
+    def __ne__(self, other):
+        return not self == other
+
+    def __repr__(self):
+        return f"MO({self.object})"
+
+
+class SimLabeledMemoryObject(SimMemoryObject):
+    """SimLabeledMemoryObject is a SimMemoryObject with a label"""
+
+    __slots__ = ("label",)
+
+    def __init__(self, obj, base, endness, length=None, byte_width=8, label=None):
+        super().__init__(obj, base, endness, length=length, byte_width=byte_width)
+        self.label = label
+
+
+def bv_slice(value: claripy.ast.BV, offset: int, size: int, rev: bool, bw: int) -> claripy.ast.BV:
+    """
+    Extremely cute utility to pretend you've serialized a value to stored bytes, sliced it a la python slicing, and then
+    deserialized those bytes to an integer again.
+
+    :param value:   The bitvector to slice
+    :param offset:  The byte offset from the first stored byte to slice from, or a negative offset from the end.
+    :param size:    The number of bytes to return. If None, return all bytes from the offset to the end. If larger than
+                    the number of bytes from the offset to the end, return all bytes from the offset to the end.
+    :param rev:     Whether the pretend-serialization should be little-endian
+    :param bw:      The byte width
+    :return:        The new bitvector
+    """
+
+    vsize = len(value) // bw
+
+    if offset < 0:
+        offset = vsize + offset
+
+    if size is None or offset + size > vsize:
+        size = vsize - offset
+    if rev:
+        offset = vsize - (offset + size)
+
+    if offset == 0 and size == vsize:
+        return value
+
+    bitstart = len(value) - offset * bw
+    if size == 0:
+        return claripy.BVV(b"")
+    return value[bitstart - 1 : bitstart - size * bw]

angr/tablespecs.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+import claripy
+
+
+class StringTableSpec:
+    def __init__(self, byte_width=8):
+        self._contents = []
+        self._str_len = 0
+        self._byte_width = byte_width
+
+    def append_args(self, args, add_null=True):
+        for arg in args:
+            self.add_string(arg)
+        if add_null:
+            self.add_null()
+
+    def append_env(self, env, add_null=True):
+        if isinstance(env, dict):
+            for k, v in env.items():
+                if type(k) is bytes:
+                    k = claripy.BVV(k)
+                elif type(k) is str:
+                    k = claripy.BVV(k.encode())
+                elif isinstance(k, claripy.ast.Bits):
+                    pass
+                else:
+                    raise TypeError("Key in env must be either string or bitvector")
+
+                if type(v) is bytes:
+                    v = claripy.BVV(v)
+                elif type(v) is str:
+                    v = claripy.BVV(v.encode())
+                elif isinstance(v, claripy.ast.Bits):
+                    pass
+                else:
+                    raise TypeError("Value in env must be either string or bitvector")
+
+                self.add_string(k.concat(claripy.BVV(b"="), v))
+        else:
+            for v in env:
+                self.add_string(v)
+        if add_null:
+            self.add_null()
+
+    def add_string(self, string):
+        if type(string) is str:
+            string = string.encode()
+
+        if type(string) is bytes:
+            self._contents.append(("string", claripy.BVV(string + b"\0")))
+            self._str_len += len(string) + 1
+        elif isinstance(string, claripy.ast.Bits):
+            self._contents.append(("string", string.concat(claripy.BVV(0, self._byte_width))))
+            self._str_len += len(string) // self._byte_width + 1
+        else:
+            raise ValueError("String must be either string literal or claripy AST")
+
+    def add_pointer(self, pointer):
+        self._contents.append(("pointer", pointer))
+
+    def add_null(self):
+        self.add_pointer(0)
+
+    def dump(self, state, end_addr, align=0x10):
+        if isinstance(end_addr, int):
+            end_addr = claripy.BVV(end_addr, state.arch.bits)
+        ptr_size = len(self._contents) * state.arch.bytes
+        size = self._str_len + ptr_size
+        start_addr = end_addr - size
+        zero_fill = state.solver.eval(start_addr % align)
+        start_addr -= zero_fill
+        start_str = start_addr + ptr_size
+
+        ptr_i = start_addr
+        str_i = start_str
+        for itemtype, item in self._contents:
+            if itemtype == "string":
+                state.memory.store(ptr_i, str_i, endness=state.arch.memory_endness)
+                state.memory.store(str_i, item)
+                ptr_i += state.arch.bytes
+                str_i += len(item) // self._byte_width
+            else:
+                if isinstance(item, int):
+                    item = claripy.BVV(item, state.arch.bits)
+                state.memory.store(ptr_i, item, endness=state.arch.memory_endness)
+                ptr_i += state.arch.bytes
+
+        if zero_fill != 0:
+            state.memory.store(end_addr - zero_fill, claripy.BVV(0, self._byte_width * zero_fill))
+
+        return start_addr

angr/utils/__init__.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+from .timing import timethis
+from . import graph
+from . import constants
+from . import enums_conv
+from . import lazy_import
+from .env import is_pyinstaller
+
+
+def looks_like_sql(s: str) -> bool:
+    """
+    Determine if string `s` looks like an SQL query.
+
+    :param str s:   The string to detect.
+    :return:        True if the string looks like an SQL, False otherwise.
+    """
+
+    sql_keywords = {"select", "update", "union", "delete", "from", "table", "insert", "into"}
+
+    s = s.lower()
+    for k in sql_keywords:
+        if k in s:
+            k_index = s.find(k)
+            # what's before k? is it a whitespace if it's not empty?
+            if k_index > 0:
+                before = s[k_index - 1]
+                if before not in " /;":
+                    continue
+            # what's after k? is it a whitespace?
+            following = s[k_index + len(k) :]
+            if not following or following.startswith(" "):
+                return True
+
+    return False
+
+
+__all__ = (
+    "constants",
+    "enums_conv",
+    "graph",
+    "is_pyinstaller",
+    "lazy_import",
+    "looks_like_sql",
+    "timethis",
+)

angr/utils/ail.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+from angr.ailment import AILBlockWalkerBase
+from angr.ailment.block import Block
+from angr.ailment.expression import Expression, VirtualVariable, Phi
+from angr.ailment.statement import Assignment, Statement, ConditionalJump
+
+
+def is_phi_assignment(stmt: Statement) -> bool:
+    return isinstance(stmt, Assignment) and isinstance(stmt.dst, VirtualVariable) and isinstance(stmt.src, Phi)
+
+
+class HasExprWalker(AILBlockWalkerBase):
+    """
+    Test if any expressions in exprs_to_check is used in another AIL expression.
+    """
+
+    def __init__(self, exprs_to_check: set[Expression]) -> None:
+        super().__init__()
+
+        self.exprs_to_check: set[Expression] = exprs_to_check
+        self.contains_exprs: bool = False
+
+    def _handle_expr(
+        self, expr_idx: int, expr: Expression, stmt_idx: int, stmt: Statement | None, block: Block | None
+    ) -> None:
+        if expr in self.exprs_to_check:
+            self.contains_exprs = True
+        if not self.contains_exprs:
+            super()._handle_expr(expr_idx, expr, stmt_idx, stmt, block)
+
+
+def is_head_controlled_loop_block(block: Block) -> bool:
+    """
+    Determine if the block is a "head-controlled loop." A head-controlled loop (for the lack of a better term) is a
+    single-block that contains a conditional jump towards the beginning of the block. This conditional jump controls
+    whether the loop body (the remaining statements after the conditional jump) will be executed or not. It is usually
+    the result of lifting rep stosX instructions on x86 and amd64.
+
+    A head-controlled loop block looks like the following (lifted from rep stosq qword ptr [rdi], rax):
+
+    ## Block 4036df
+    00 | 0x4036df | LABEL_4036df:
+    01 | 0x4036df | vvar_27{reg 72} = 𝜙@64b []
+    02 | 0x4036df | vvar_28{reg 24} = 𝜙@64b []
+    03 | 0x4036df | t1 = rcx<8>
+    04 | 0x4036df | t4 = (t1 == 0x0<64>)
+    05 | 0x4036df | if (t4) { Goto 0x4036e2<64> } else { Goto 0x4036df<64> }
+    06 | 0x4036df | t5 = (t1 - 0x1<64>)
+    07 | 0x4036df | rcx<8> = t5
+    08 | 0x4036df | t7 = d<8>
+    09 | 0x4036df | t6 = (t7 << 0x3<8>)
+    10 | 0x4036df | t2 = rax<8>
+    11 | 0x4036df | t3 = rdi<8>
+    12 | 0x4036df | STORE(addr=t3, data=t2, size=8, endness=Iend_LE, guard=None)
+    13 | 0x4036df | t8 = (t3 + t6)
+    14 | 0x4036df | rdi<8> = t8
+
+    Where statement 5 is the conditional jump that controls the execution of the remaining statements of this block.
+
+    :param block:   An AIL block.
+    :return:        True if the block represents a head-controlled loop block, False otherwise.
+    """
+
+    if not block.statements:
+        return False
+    last_stmt = block.statements[-1]
+    if isinstance(last_stmt, ConditionalJump):
+        return False
+    return any(isinstance(stmt, ConditionalJump) for stmt in block.statements[:-1])

angr/utils/algo.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+from typing import Any
+from collections.abc import Callable
+
+
+def binary_insert(lst: list, elem: Any, key: Callable, lo: int = 0, hi: int | None = None) -> None:
+    """
+    Insert an element into a sorted list, and keep the list sorted.
+
+    The major difference from bisect.bisect_left is that this function supports a key method, so user doesn't have
+    to create the key array for each insertion.
+
+    :param list lst: The list. Must be pre-ordered.
+    :param object element: An element to insert into the list.
+    :param func key: A method to get the key for each element in the list.
+    :param int lo: Lower bound of the search.
+    :param int hi: Upper bound of the search.
+    :return: None
+    """
+
+    if lo < 0:
+        raise ValueError("lo must be a non-negative number")
+
+    if hi is None:
+        hi = len(lst)
+
+    while lo < hi:
+        mid = (lo + hi) // 2
+        if key(lst[mid]) < key(elem):
+            lo = mid + 1
+        else:
+            hi = mid
+
+    lst.insert(lo, elem)

angr/utils/bits.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import claripy
+
+
+def truncate_bits(value: int, nbits: int) -> int:
+    """
+    Truncate `value` to `nbits`.
+
+    For example: truncate_bits(0x1234, 8) -> 0x34
+    """
+    if nbits < 0:
+        raise ValueError("nbits must not be negative")
+    return value & (2**nbits - 1)
+
+
+def ffs(x: int) -> int:
+    return (x & -x).bit_length() - 1
+
+
+def sign_extend(value: int, bits: int) -> int:
+    sign_bit = 1 << (bits - 1)
+    return (value & (sign_bit - 1)) - (value & sign_bit)
+
+
+def zeroextend_on_demand(op0: claripy.ast.BV, op1: claripy.ast.BV) -> claripy.ast.BV:
+    """
+    ZeroExtend op1 if the size of op1 is smaller than the size of op0. Otherwise, return op1.
+    """
+
+    if op0.size() > op1.size():
+        return claripy.ZeroExt(op0.size() - op1.size(), op1)
+    return op1
+
+
+def s2u(s, bits):
+    mask = (1 << bits) - 1
+    if s > 0:
+        return s & mask
+    return ((1 << bits) + s) & mask
+
+
+def u2s(u, bits):
+    if u < (1 << (bits - 1)):
+        return u
+    return (u & ((1 << bits) - 1)) - (1 << bits)

angr/utils/constants.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+DEFAULT_STATEMENT = -2
+SWITCH_MISSING_DEFAULT_NODE_ADDR = 0xFFFF_FFFE
+MAX_POINTSTO_BITS = -1330 * 8
+
+
+def is_alignment_mask(n):
+    return n in {0xFFFFFFFFFFFFFFE0, 0xFFFFFFFFFFFFFFF0, 0xFFFFFFE0, 0xFFFFFFF0, 0xFFFFFFFC, 0xFFFFFFF8}

angr/utils/cowdict.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+from collections import ChainMap
+
+
+class ChainMapCOW(ChainMap):
+    """
+    Implements a copy-on-write version of ChainMap that supports auto-collapsing.
+    """
+
+    def __init__(self, *args, collapse_threshold=None):
+        super().__init__(*args)
+        self.dirty = False
+        self.collapse_threshold = collapse_threshold
+
+    def copy(self):
+        self.dirty = True
+        return self
+
+    def clean(self):
+        if self.dirty:
+            # collapse?
+            if self.collapse_threshold is not None and len(self.maps) >= self.collapse_threshold:
+                collapsed = {}
+                for m in reversed(self.maps):
+                    collapsed.update(m)
+                return ChainMapCOW(collapsed, collapse_threshold=self.collapse_threshold)
+            ch = self.new_child()
+            ch.collapse_threshold = self.collapse_threshold
+            return ch
+        return self
+
+
+class DefaultChainMapCOW(ChainMapCOW):
+    """
+    Implements a copy-on-write version of ChainMap with default values that supports auto-collapsing.
+    """
+
+    def __init__(self, *args, default_factory=None, collapse_threshold=None):
+        super().__init__(*args, collapse_threshold=collapse_threshold)
+        self.default_factory = default_factory
+
+    def __getitem__(self, key):
+        try:
+            return super().__getitem__(key)
+        except KeyError:
+            self.__setitem__(key, self.default_factory())
+            return super().__getitem__(key)
+
+    def clean(self):
+        if self.dirty:
+            # collapse?
+            if self.collapse_threshold is not None and len(self.maps) >= self.collapse_threshold:
+                collapsed = {}
+                for m in reversed(self.maps):
+                    collapsed.update(m)
+                return DefaultChainMapCOW(
+                    collapsed, default_factory=self.default_factory, collapse_threshold=self.collapse_threshold
+                )
+            r = self.new_child()
+            r.default_factory = self.default_factory
+            r.collapse_threshold = self.collapse_threshold
+            return r
+        return self

angr/utils/cpp.py

@@ -0,0 +1,17 @@
+from __future__ import annotations
+
+
+def is_cpp_funcname_ctor(name: str) -> bool:
+    """
+    Check if a demangled C++ function name is a constructor.
+
+    :param name:    The demangled C++ function name.
+    :return:        True if the function name is a constructor, False otherwise.
+    """
+
+    # With pydemumble, constructor names look like:
+    #    A::A()
+    if "::" not in name:
+        return False
+    parts = name.split("::")
+    return bool(len(parts) == 2 and parts[0] and parts[0] + "()" == parts[1])