angr 9.2.166__cp310-abi3-manylinux_2_28_aarch64.whl

angr/analyses/typehoon/translator.py

@@ -0,0 +1,279 @@
+# pylint:disable=unused-argument,no-self-use
+from __future__ import annotations
+from itertools import count
+
+from angr import sim_type
+from angr.sim_type import SimType
+from . import typeconsts
+from .typeconsts import TypeConstant
+
+
+class SimTypeTempRef(sim_type.SimType):
+    """
+    Represents a temporary reference to another type. TypeVariableReference is translated to SimTypeTempRef.
+    """
+
+    def __init__(self, typevar):
+        super().__init__()
+        self.typevar = typevar
+
+    def c_repr(self, **kwargs):
+        return "<SimTypeTempRef>"
+
+
+class TypeTranslator:
+    """
+    Translate type variables to SimType equivalence.
+    """
+
+    def __init__(self, arch=None):
+        self.arch = arch
+
+        self.translated: dict[TypeConstant, SimType] = {}
+        self.translated_simtypes: dict[SimType, TypeConstant] = {}
+        self.structs = {}
+        self._struct_ctr = count()
+
+        # will be updated every time .translate() is called
+        self._has_nonexistent_ref = False
+
+    #
+    # Naming
+    #
+
+    def struct_name(self):
+        return f"struct_{next(self._struct_ctr)}"
+
+    #
+    # Type translation
+    #
+
+    def tc2simtype(self, tc):
+        self._has_nonexistent_ref = False
+        return self._tc2simtype(tc), self._has_nonexistent_ref
+
+    def _tc2simtype(self, tc):
+        if tc is None:
+            return sim_type.SimTypeBottom().with_arch(self.arch)
+
+        try:
+            handler = TypeConstHandlers[tc.__class__]
+        except KeyError:
+            return sim_type.SimTypeBottom().with_arch(self.arch)
+
+        return handler(self, tc)
+
+    def simtype2tc(self, simtype: sim_type.SimType) -> typeconsts.TypeConstant:
+        return self._simtype2tc(simtype)
+
+    def _simtype2tc(self, simtype: sim_type.SimType) -> typeconsts.TypeConstant:
+        if simtype in self.translated_simtypes:
+            return self.translated_simtypes[simtype]
+        try:
+            handler = SimTypeHandlers[simtype.__class__]
+            return handler(self, simtype)
+        except KeyError:
+            return typeconsts.BottomType()
+
+    #
+    # Typehoon type handlers
+    #
+
+    def _translate_Pointer64(self, tc):
+        if isinstance(tc.basetype, typeconsts.BottomType):
+            # void *
+            internal = sim_type.SimTypeBottom(label="void").with_arch(self.arch)
+        else:
+            internal = self._tc2simtype(tc.basetype)
+        return sim_type.SimTypePointer(internal).with_arch(self.arch)
+
+    def _translate_Pointer32(self, tc):
+        if isinstance(tc.basetype, typeconsts.BottomType):
+            # void *
+            internal = sim_type.SimTypeBottom(label="void").with_arch(self.arch)
+        else:
+            internal = self._tc2simtype(tc.basetype)
+        return sim_type.SimTypePointer(internal).with_arch(self.arch)
+
+    def _translate_Array(self, tc: typeconsts.Array) -> sim_type.SimTypeArray:
+        elem_type = self._tc2simtype(tc.element)
+        return sim_type.SimTypeArray(elem_type, length=tc.count).with_arch(self.arch)
+
+    def _translate_Struct(self, tc: typeconsts.Struct):
+        if tc in self.structs:
+            return self.structs[tc]
+
+        name = tc.name if tc.name else self.struct_name()
+
+        if tc.is_cppclass:
+            s = sim_type.SimCppClass(name=name).with_arch(self.arch)
+        else:
+            s = sim_type.SimStruct({}, name=name).with_arch(self.arch)
+        self.structs[tc] = s
+
+        next_offset = 0
+        for offset, typ in sorted(tc.fields.items(), key=lambda item: item[0]):
+            if offset > next_offset:
+                # we need padding!
+                padding_size = offset - next_offset
+                s.fields[f"padding_{next_offset:x}"] = sim_type.SimTypeFixedSizeArray(
+                    sim_type.SimTypeChar(signed=False).with_arch(self.arch), padding_size
+                ).with_arch(self.arch)
+
+            translated_type = self._tc2simtype(typ)
+            if isinstance(translated_type, sim_type.SimTypeBottom):
+                # we cannot have bottom types in a struct since that would mess with offsets of all future types
+                # for now, we replace it with an unsigned char
+                translated_type = sim_type.SimTypeChar(signed=False).with_arch(self.arch)
+
+            field_name = tc.field_names[offset] if tc.field_names and offset in tc.field_names else f"field_{offset:x}"
+            s.fields[field_name] = translated_type
+
+            if isinstance(translated_type, SimTypeTempRef):
+                next_offset = self.arch.bytes + offset
+            else:
+                next_offset = translated_type.size // self.arch.byte_width + offset
+
+        return s
+
+    def _translate_Int8(self, tc):  # pylint:disable=unused-argument
+        return sim_type.SimTypeChar(signed=False).with_arch(self.arch)
+
+    def _translate_Int16(self, tc):  # pylint:disable=unused-argument
+        return sim_type.SimTypeShort(signed=False).with_arch(self.arch)
+
+    def _translate_Int32(self, tc):  # pylint:disable=unused-argument
+        return sim_type.SimTypeInt(signed=False).with_arch(self.arch)
+
+    def _translate_Int64(self, tc):  # pylint:disable=unused-argument
+        return sim_type.SimTypeLongLong(signed=False).with_arch(self.arch)
+
+    def _translate_Int128(self, tc):  # pylint:disable=unused-argument
+        return sim_type.SimTypeInt128(signed=False).with_arch(self.arch)
+
+    def _translate_Int256(self, tc):  # pylint:disable=unused-argument
+        return sim_type.SimTypeInt256(signed=False).with_arch(self.arch)
+
+    def _translate_Int512(self, tc):  # pylint:disable=unused-argument
+        return sim_type.SimTypeInt512(signed=False).with_arch(self.arch)
+
+    def _translate_TypeVariableReference(self, tc):
+        if tc.typevar in self.translated:
+            return self.translated[tc.typevar]
+
+        self._has_nonexistent_ref = True
+        return SimTypeTempRef(tc.typevar)
+
+    def _translate_Float32(self, tc: typeconsts.Float32) -> sim_type.SimTypeFloat:  # pylint:disable=unused-argument
+        return sim_type.SimTypeFloat().with_arch(self.arch)
+
+    def _translate_Float64(self, tc: typeconsts.Float64) -> sim_type.SimTypeDouble:  # pylint:disable=unused-argument
+        return sim_type.SimTypeDouble().with_arch(self.arch)
+
+    #
+    # Backpatching
+    #
+
+    def backpatch(self, st, translated):
+        """
+
+        :param sim_type.SimType st:
+        :param dict translated:
+        :return:
+        """
+
+        if isinstance(st, sim_type.SimTypePointer):
+            self.backpatch(st.pts_to, translated)
+
+        elif isinstance(st, sim_type.SimStruct):
+            fields_patch = {}
+            for offset, fld in st.fields.items():
+                if isinstance(fld, SimTypeTempRef) and fld.typevar in translated:
+                    fields_patch[offset] = translated[fld.typevar]
+                st.fields.update(fields_patch)
+
+    #
+    # SimType handlers
+    #
+
+    def _translate_SimTypeInt128(self, st: sim_type.SimTypeChar) -> typeconsts.Int128:
+        return typeconsts.Int128()
+
+    def _translate_SimTypeInt256(self, st: sim_type.SimTypeChar) -> typeconsts.Int256:
+        return typeconsts.Int256()
+
+    def _translate_SimTypeInt512(self, st: sim_type.SimTypeChar) -> typeconsts.Int512:
+        return typeconsts.Int512()
+
+    def _translate_SimTypeInt(self, st: sim_type.SimTypeInt) -> typeconsts.Int32:
+        return typeconsts.Int32()
+
+    def _translate_SimTypeLong(self, st: sim_type.SimTypeLong) -> typeconsts.Int32:
+        return typeconsts.Int32()
+
+    def _translate_SimTypeLongLong(self, st: sim_type.SimTypeLongLong) -> typeconsts.Int64:
+        return typeconsts.Int64()
+
+    def _translate_SimTypeChar(self, st: sim_type.SimTypeChar) -> typeconsts.Int8:
+        return typeconsts.Int8()
+
+    def _translate_SimStruct(self, st: sim_type.SimStruct) -> typeconsts.Struct:
+        fields = {}
+        offsets = st.offsets
+        for name, ty in st.fields.items():
+            offset = offsets[name]
+            fields[offset] = self._simtype2tc(ty)
+
+        return typeconsts.Struct(fields=fields)
+
+    def _translate_SimTypeArray(self, st: sim_type.SimTypeArray) -> typeconsts.Array:
+        elem_type = self._simtype2tc(st.elem_type)
+        return typeconsts.Array(elem_type, count=st.length)
+
+    def _translate_SimTypePointer(self, st: sim_type.SimTypePointer) -> typeconsts.Pointer32 | typeconsts.Pointer64:
+        base = self._simtype2tc(st.pts_to)
+        if self.arch.bits == 32:
+            return typeconsts.Pointer32(base)
+        if self.arch.bits == 64:
+            return typeconsts.Pointer64(base)
+        raise TypeError(f"Unsupported pointer size {self.arch.bits}")
+
+    def _translate_SimTypeFloat(self, st: sim_type.SimTypeFloat) -> typeconsts.Float32:
+        return typeconsts.Float32()
+
+    def _translate_SimTypeDouble(self, st: sim_type.SimTypeDouble) -> typeconsts.Float64:
+        return typeconsts.Float64()
+
+
+TypeConstHandlers = {
+    typeconsts.Pointer64: TypeTranslator._translate_Pointer64,
+    typeconsts.Pointer32: TypeTranslator._translate_Pointer32,
+    typeconsts.Array: TypeTranslator._translate_Array,
+    typeconsts.Struct: TypeTranslator._translate_Struct,
+    typeconsts.Int8: TypeTranslator._translate_Int8,
+    typeconsts.Int16: TypeTranslator._translate_Int16,
+    typeconsts.Int32: TypeTranslator._translate_Int32,
+    typeconsts.Int64: TypeTranslator._translate_Int64,
+    typeconsts.Int128: TypeTranslator._translate_Int128,
+    typeconsts.Int256: TypeTranslator._translate_Int256,
+    typeconsts.Int512: TypeTranslator._translate_Int512,
+    typeconsts.TypeVariableReference: TypeTranslator._translate_TypeVariableReference,
+    typeconsts.Float32: TypeTranslator._translate_Float32,
+    typeconsts.Float64: TypeTranslator._translate_Float64,
+}
+
+
+SimTypeHandlers = {
+    sim_type.SimTypePointer: TypeTranslator._translate_SimTypePointer,
+    sim_type.SimTypeInt: TypeTranslator._translate_SimTypeInt,
+    sim_type.SimTypeLong: TypeTranslator._translate_SimTypeLong,
+    sim_type.SimTypeLongLong: TypeTranslator._translate_SimTypeLongLong,
+    sim_type.SimTypeChar: TypeTranslator._translate_SimTypeChar,
+    sim_type.SimTypeInt128: TypeTranslator._translate_SimTypeInt128,
+    sim_type.SimTypeInt256: TypeTranslator._translate_SimTypeInt256,
+    sim_type.SimTypeInt512: TypeTranslator._translate_SimTypeInt512,
+    sim_type.SimStruct: TypeTranslator._translate_SimStruct,
+    sim_type.SimTypeArray: TypeTranslator._translate_SimTypeArray,
+    sim_type.SimTypeFloat: TypeTranslator._translate_SimTypeFloat,
+    sim_type.SimTypeDouble: TypeTranslator._translate_SimTypeDouble,
+}

angr/analyses/typehoon/typeconsts.py

@@ -0,0 +1,338 @@
+# pylint:disable=missing-class-docstring
+"""
+All type constants used in type inference. They can be mapped, translated, or rewritten to C-style types.
+"""
+from __future__ import annotations
+
+import functools
+
+
+def memoize(f):
+    @functools.wraps(f)
+    def wrapped_repr(self, *args, **kwargs):
+        memo = set() if not kwargs or "memo" not in kwargs else kwargs.pop("memo")
+        if self in memo:
+            return "..."
+        memo.add(self)
+        r = f(self, *args, memo=memo, **kwargs)
+        memo.remove(self)
+        return r
+
+    return wrapped_repr
+
+
+class TypeConstant:
+    SIZE = None
+
+    def pp_str(self, mapping) -> str:  # pylint:disable=unused-argument
+        return repr(self)
+
+    def _hash(self, visited: set[int]):  # pylint:disable=unused-argument
+        return hash(type(self))
+
+    def __eq__(self, other):
+        return type(self) is type(other)
+
+    def __hash__(self):
+        return self._hash(set())
+
+    @property
+    def size(self) -> int:
+        if self.SIZE is None:
+            raise NotImplementedError
+        return self.SIZE
+
+    def __repr__(self, memo=None) -> str:
+        raise NotImplementedError
+
+
+class TopType(TypeConstant):
+    def __repr__(self, memo=None):
+        return "TOP"
+
+
+class BottomType(TypeConstant):
+    def __repr__(self, memo=None):
+        return "BOT"
+
+
+class Int(TypeConstant):
+    def __repr__(self, memo=None) -> str:
+        return "intbase"
+
+
+class Int1(Int):
+    SIZE = 1
+
+
+class Int8(Int):
+    SIZE = 1
+
+    def __repr__(self, memo=None):
+        return "int8"
+
+
+class Int16(Int):
+    SIZE = 2
+
+    def __repr__(self, memo=None):
+        return "int16"
+
+
+class Int32(Int):
+    SIZE = 4
+
+    def __repr__(self, memo=None) -> str:
+        return "int32"
+
+
+class Int64(Int):
+    SIZE = 8
+
+    def __repr__(self, memo=None) -> str:
+        return "int64"
+
+
+class Int128(Int):
+    SIZE = 16
+
+    def __repr__(self, memo=None):
+        return "int128"
+
+
+class Int256(Int):
+    SIZE = 32
+
+    def __repr__(self, memo=None):
+        return "int256"
+
+
+class Int512(Int):
+    SIZE = 32
+
+    def __repr__(self, memo=None):
+        return "int512"
+
+
+class IntVar(Int):
+    def __init__(self, size):
+        self._size = size
+
+    @property
+    def size(self) -> int:
+        return self._size
+
+    def __repr__(self, memo=None):
+        return "intvar"
+
+
+class Float(TypeConstant):
+    def __repr__(self, memo=None) -> str:
+        return "floatbase"
+
+
+class Float32(Float):
+    SIZE = 4
+
+    def __repr__(self, memo=None):
+        return "float32"
+
+
+class Float64(Float):
+    SIZE = 8
+
+    def __repr__(self, memo=None):
+        return "float64"
+
+
+class Pointer(TypeConstant):
+    def __init__(self, basetype: TypeConstant | None):
+        self.basetype: TypeConstant | None = basetype
+
+    def __eq__(self, other):
+        return type(self) is type(other) and self.basetype == other.basetype
+
+    def _hash(self, visited: set[int]):
+        if self.basetype is None:
+            return hash(type(self))
+        return hash((type(self), self.basetype._hash(visited)))
+
+    def new(self, basetype):
+        return self.__class__(basetype)
+
+    def __hash__(self):
+        return self._hash(set())
+
+
+class Pointer32(Pointer, Int32):
+    """
+    32-bit pointers.
+    """
+
+    def __init__(self, basetype=None):
+        Pointer.__init__(self, basetype)
+
+    @memoize
+    def __repr__(self, memo=None):
+        bt = self.basetype.__repr__(memo=memo) if isinstance(self.basetype, TypeConstant) else repr(self.basetype)
+        return f"ptr32({bt})"
+
+
+class Pointer64(Pointer, Int64):
+    """
+    64-bit pointers.
+    """
+
+    def __init__(self, basetype=None):
+        Pointer.__init__(self, basetype)
+
+    @memoize
+    def __repr__(self, memo=None):
+        bt = self.basetype.__repr__(memo=memo) if isinstance(self.basetype, TypeConstant) else repr(self.basetype)
+        return f"ptr64({bt})"
+
+
+class Array(TypeConstant):
+    def __init__(self, element=None, count=None):
+        self.element: TypeConstant | None = element
+        self.count: int | None = count
+
+    @property
+    def size(self) -> int:
+        if not self.count or not self.element:
+            return 0
+        return self.element.size * self.count
+
+    @memoize
+    def __repr__(self, memo=None):
+        if self.count is None:
+            return f"{self.element!r}[?]"
+        return f"{self.element!r}[{self.count}]"
+
+    def __eq__(self, other):
+        return type(other) is type(self) and self.element == other.element and self.count == other.count
+
+    def _hash(self, visited: set[int]):
+        if id(self) in visited:
+            return 0
+        visited.add(id(self))
+        return hash((type(self), self.element, self.count))
+
+    def __hash__(self):
+        return self._hash(set())
+
+
+class Struct(TypeConstant):
+    def __init__(self, fields=None, name=None, field_names=None, is_cppclass: bool = False):
+        self.fields = {} if fields is None else fields  # offset to type
+        self.name = name
+        self.field_names = field_names
+        self.is_cppclass = is_cppclass
+
+    def _hash(self, visited: set[int]):
+        if id(self) in visited:
+            return 0
+        visited.add(id(self))
+        return hash((type(self), self._hash_fields(visited)))
+
+    def _hash_fields(self, visited: set[int]):
+        keys = sorted(self.fields.keys())
+        tpl = tuple((k, self.fields[k]._hash(visited) if self.fields[k] is not None else None) for k in keys)
+        return hash(tpl)
+
+    @property
+    def size(self) -> int:
+        if not self.fields:
+            return 0
+        max_field_off = max(self.fields.keys())
+        return max_field_off + (
+            self.fields[max_field_off].size if not isinstance(self.fields[max_field_off], BottomType) else 1
+        )
+
+    @memoize
+    def __repr__(self, memo=None):
+        prefix = "CppClass" if self.is_cppclass else "struct"
+        if self.name:
+            prefix = f"{prefix} {self.name}"
+        return (
+            prefix
+            + "{"
+            + ", ".join(f"{k}:{v.__repr__(memo=memo) if v is not None else 'None'}" for k, v in self.fields.items())
+            + "}"
+        )
+
+    def __eq__(self, other):
+        return type(other) is type(self) and hash(self) == hash(other)
+
+    def __hash__(self):
+        return self._hash(set())
+
+
+class Function(TypeConstant):
+    def __init__(self, params: list, outputs: list):
+        self.params = params
+        self.outputs = outputs
+
+    @memoize
+    def __repr__(self, memo=None):
+        param_str = ", ".join(repr(param) for param in self.params)
+        outputs_str = ", ".join(repr(output) for output in self.outputs)
+        return f"func({param_str}) -> {outputs_str}"
+
+    def __eq__(self, other):
+        if not isinstance(other, Function):
+            return False
+        return self.params == other.params and self.outputs == other.outputs
+
+    def _hash(self, visited: set[int]):
+        if id(self) in visited:
+            return 0
+        visited.add(id(self))
+
+        params_hash = tuple(param._hash(visited) for param in self.params)
+        outputs_hash = tuple(out._hash(visited) for out in self.outputs)
+        return hash((Function, params_hash, outputs_hash))
+
+    def __hash__(self):
+        return self._hash(set())
+
+
+class TypeVariableReference(TypeConstant):
+    def __init__(self, typevar):
+        self.typevar = typevar
+
+    def __repr__(self, memo=None):
+        return f"ref({self.typevar})"
+
+    def __eq__(self, other):
+        return type(other) is type(self) and self.typevar == other.typevar
+
+    def __hash__(self):
+        return hash((type(self), self.typevar))
+
+
+#
+# Methods
+#
+
+
+def int_type(bits: int) -> Int:
+    mapping = {
+        1: Int1,
+        8: Int8,
+        16: Int16,
+        32: Int32,
+        64: Int64,
+        128: Int128,
+        256: Int256,
+        512: Int512,
+    }
+    return mapping[bits]() if bits in mapping else IntVar(bits)
+
+
+def float_type(bits: int) -> Float | None:
+    if bits == 32:
+        return Float32()
+    if bits == 64:
+        return Float64()
+    return None