angr 9.2.166__cp310-abi3-manylinux_2_28_aarch64.whl

angr/procedures/definitions/win32_xinput1_4.py

@@ -0,0 +1,38 @@
+# pylint:disable=line-too-long
+from __future__ import annotations
+import logging
+from collections import OrderedDict
+
+from angr.sim_type import SimTypeFunction, SimTypeShort, SimTypeInt, SimTypeLong, SimTypeLongLong, SimTypeDouble, SimTypeFloat, SimTypePointer, SimTypeChar, SimStruct, SimTypeArray, SimTypeBottom, SimUnion, SimTypeBool, SimTypeRef
+from angr.calling_conventions import SimCCStdcall, SimCCMicrosoftAMD64
+from angr.procedures import SIM_PROCEDURES as P
+from . import SimLibrary
+
+
+_l = logging.getLogger(name=__name__)
+
+
+lib = SimLibrary()
+lib.type_collection_names = ["win32"]
+lib.set_default_cc("X86", SimCCStdcall)
+lib.set_default_cc("AMD64", SimCCMicrosoftAMD64)
+lib.set_library_names("xinput1_4.dll")
+prototypes = \
+    {
+        #
+        'XInputGetState': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeRef("XINPUT_STATE", SimStruct), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "pState"]),
+        #
+        'XInputSetState': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeRef("XINPUT_VIBRATION", SimStruct), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "pVibration"]),
+        #
+        'XInputGetCapabilities': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypeInt(signed=False, label="XINPUT_FLAG"), SimTypePointer(SimTypeRef("XINPUT_CAPABILITIES", SimStruct), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "dwFlags", "pCapabilities"]),
+        #
+        'XInputEnable': SimTypeFunction([SimTypeInt(signed=True, label="Int32")], SimTypeBottom(label="Void"), arg_names=["enable"]),
+        #
+        'XInputGetAudioDeviceIds': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeChar(label="Char"), label="LPArray", offset=0), SimTypePointer(SimTypeInt(signed=False, label="UInt32"), offset=0), SimTypePointer(SimTypeChar(label="Char"), label="LPArray", offset=0), SimTypePointer(SimTypeInt(signed=False, label="UInt32"), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "pRenderDeviceId", "pRenderCount", "pCaptureDeviceId", "pCaptureCount"]),
+        #
+        'XInputGetBatteryInformation': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypeInt(signed=False, label="BATTERY_DEVTYPE"), SimTypePointer(SimTypeRef("XINPUT_BATTERY_INFORMATION", SimStruct), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "devType", "pBatteryInformation"]),
+        #
+        'XInputGetKeystroke': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeRef("XINPUT_KEYSTROKE", SimStruct), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "dwReserved", "pKeystroke"]),
+    }
+
+lib.set_prototypes(prototypes)

angr/procedures/definitions/win32_xinputuap.py

@@ -0,0 +1,36 @@
+# pylint:disable=line-too-long
+from __future__ import annotations
+import logging
+
+from angr.sim_type import SimTypeFunction, SimTypeShort, SimTypeInt, SimTypeLong, SimTypeLongLong, SimTypeDouble, SimTypeFloat, SimTypePointer, SimTypeChar, SimStruct, SimTypeFixedSizeArray, SimTypeBottom, SimUnion, SimTypeBool
+from angr.calling_conventions import SimCCStdcall, SimCCMicrosoftAMD64
+from angr.procedures import SIM_PROCEDURES as P
+from . import SimLibrary
+
+
+_l = logging.getLogger(name=__name__)
+
+
+lib = SimLibrary()
+lib.set_default_cc('X86', SimCCStdcall)
+lib.set_default_cc('AMD64', SimCCMicrosoftAMD64)
+lib.set_library_names("xinputuap.dll")
+prototypes = \
+    {
+        #
+        'XInputGetState': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimStruct({"dwPacketNumber": SimTypeInt(signed=False, label="UInt32"), "Gamepad": SimStruct({"wButtons": SimTypeShort(signed=False, label="UInt16"), "bLeftTrigger": SimTypeChar(label="Byte"), "bRightTrigger": SimTypeChar(label="Byte"), "sThumbLX": SimTypeShort(signed=True, label="Int16"), "sThumbLY": SimTypeShort(signed=True, label="Int16"), "sThumbRX": SimTypeShort(signed=True, label="Int16"), "sThumbRY": SimTypeShort(signed=True, label="Int16")}, name="XINPUT_GAMEPAD", pack=False, align=None)}, name="XINPUT_STATE", pack=False, align=None), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "pState"]),
+        #
+        'XInputSetState': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimStruct({"wLeftMotorSpeed": SimTypeShort(signed=False, label="UInt16"), "wRightMotorSpeed": SimTypeShort(signed=False, label="UInt16")}, name="XINPUT_VIBRATION", pack=False, align=None), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "pVibration"]),
+        #
+        'XInputGetCapabilities': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimStruct({"Type": SimTypeChar(label="Byte"), "SubType": SimTypeChar(label="Byte"), "Flags": SimTypeShort(signed=False, label="UInt16"), "Gamepad": SimStruct({"wButtons": SimTypeShort(signed=False, label="UInt16"), "bLeftTrigger": SimTypeChar(label="Byte"), "bRightTrigger": SimTypeChar(label="Byte"), "sThumbLX": SimTypeShort(signed=True, label="Int16"), "sThumbLY": SimTypeShort(signed=True, label="Int16"), "sThumbRX": SimTypeShort(signed=True, label="Int16"), "sThumbRY": SimTypeShort(signed=True, label="Int16")}, name="XINPUT_GAMEPAD", pack=False, align=None), "Vibration": SimStruct({"wLeftMotorSpeed": SimTypeShort(signed=False, label="UInt16"), "wRightMotorSpeed": SimTypeShort(signed=False, label="UInt16")}, name="XINPUT_VIBRATION", pack=False, align=None)}, name="XINPUT_CAPABILITIES", pack=False, align=None), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "dwFlags", "pCapabilities"]),
+        #
+        'XInputEnable': SimTypeFunction([SimTypeInt(signed=True, label="Int32")], SimTypeBottom(label="Void"), arg_names=["enable"]),
+        #
+        'XInputGetAudioDeviceIds': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeChar(label="Char"), label="LPArray", offset=0), SimTypePointer(SimTypeInt(signed=False, label="UInt32"), offset=0), SimTypePointer(SimTypeChar(label="Char"), label="LPArray", offset=0), SimTypePointer(SimTypeInt(signed=False, label="UInt32"), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "pRenderDeviceId", "pRenderCount", "pCaptureDeviceId", "pCaptureCount"]),
+        #
+        'XInputGetBatteryInformation': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypeChar(label="Byte"), SimTypePointer(SimStruct({"BatteryType": SimTypeChar(label="Byte"), "BatteryLevel": SimTypeChar(label="Byte")}, name="XINPUT_BATTERY_INFORMATION", pack=False, align=None), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "devType", "pBatteryInformation"]),
+        #
+        'XInputGetKeystroke': SimTypeFunction([SimTypeInt(signed=False, label="UInt32"), SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimStruct({"VirtualKey": SimTypeInt(signed=False, label="XINPUT_VIRTUAL_KEY"), "Unicode": SimTypeChar(label="Char"), "Flags": SimTypeShort(signed=False, label="UInt16"), "UserIndex": SimTypeChar(label="Byte"), "HidCode": SimTypeChar(label="Byte")}, name="XINPUT_KEYSTROKE", pack=False, align=None), offset=0)], SimTypeInt(signed=False, label="UInt32"), arg_names=["dwUserIndex", "dwReserved", "pKeystroke"]),
+    }
+
+lib.set_prototypes(prototypes)

angr/procedures/definitions/win32_xmllite.py

@@ -0,0 +1,36 @@
+# pylint:disable=line-too-long
+from __future__ import annotations
+import logging
+from collections import OrderedDict
+
+from angr.sim_type import SimTypeFunction, SimTypeShort, SimTypeInt, SimTypeLong, SimTypeLongLong, SimTypeDouble, SimTypeFloat, SimTypePointer, SimTypeChar, SimStruct, SimTypeArray, SimTypeBottom, SimUnion, SimTypeBool, SimTypeRef
+from angr.calling_conventions import SimCCStdcall, SimCCMicrosoftAMD64
+from angr.procedures import SIM_PROCEDURES as P
+from . import SimLibrary
+
+
+_l = logging.getLogger(name=__name__)
+
+
+lib = SimLibrary()
+lib.type_collection_names = ["win32"]
+lib.set_default_cc("X86", SimCCStdcall)
+lib.set_default_cc("AMD64", SimCCMicrosoftAMD64)
+lib.set_library_names("xmllite.dll")
+prototypes = \
+    {
+        #
+        'CreateXmlReader': SimTypeFunction([SimTypePointer(SimTypeBottom(label="Guid"), offset=0), SimTypePointer(SimTypePointer(SimTypeBottom(label="Void"), offset=0), offset=0), SimTypeBottom(label="IMalloc")], SimTypeInt(signed=True, label="Int32"), arg_names=["riid", "ppvObject", "pMalloc"]),
+        #
+        'CreateXmlReaderInputWithEncodingCodePage': SimTypeFunction([SimTypeBottom(label="IUnknown"), SimTypeBottom(label="IMalloc"), SimTypeInt(signed=False, label="UInt32"), SimTypeInt(signed=True, label="Int32"), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeBottom(label="IUnknown"), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["pInputStream", "pMalloc", "nEncodingCodePage", "fEncodingHint", "pwszBaseUri", "ppInput"]),
+        #
+        'CreateXmlReaderInputWithEncodingName': SimTypeFunction([SimTypeBottom(label="IUnknown"), SimTypeBottom(label="IMalloc"), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypeInt(signed=True, label="Int32"), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeBottom(label="IUnknown"), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["pInputStream", "pMalloc", "pwszEncodingName", "fEncodingHint", "pwszBaseUri", "ppInput"]),
+        #
+        'CreateXmlWriter': SimTypeFunction([SimTypePointer(SimTypeBottom(label="Guid"), offset=0), SimTypePointer(SimTypePointer(SimTypeBottom(label="Void"), offset=0), offset=0), SimTypeBottom(label="IMalloc")], SimTypeInt(signed=True, label="Int32"), arg_names=["riid", "ppvObject", "pMalloc"]),
+        #
+        'CreateXmlWriterOutputWithEncodingCodePage': SimTypeFunction([SimTypeBottom(label="IUnknown"), SimTypeBottom(label="IMalloc"), SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeBottom(label="IUnknown"), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["pOutputStream", "pMalloc", "nEncodingCodePage", "ppOutput"]),
+        #
+        'CreateXmlWriterOutputWithEncodingName': SimTypeFunction([SimTypeBottom(label="IUnknown"), SimTypeBottom(label="IMalloc"), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeBottom(label="IUnknown"), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["pOutputStream", "pMalloc", "pwszEncodingName", "ppOutput"]),
+    }
+
+lib.set_prototypes(prototypes)

angr/procedures/definitions/win32_xolehlp.py

@@ -0,0 +1,32 @@
+# pylint:disable=line-too-long
+from __future__ import annotations
+import logging
+from collections import OrderedDict
+
+from angr.sim_type import SimTypeFunction, SimTypeShort, SimTypeInt, SimTypeLong, SimTypeLongLong, SimTypeDouble, SimTypeFloat, SimTypePointer, SimTypeChar, SimStruct, SimTypeArray, SimTypeBottom, SimUnion, SimTypeBool, SimTypeRef
+from angr.calling_conventions import SimCCStdcall, SimCCMicrosoftAMD64
+from angr.procedures import SIM_PROCEDURES as P
+from . import SimLibrary
+
+
+_l = logging.getLogger(name=__name__)
+
+
+lib = SimLibrary()
+lib.type_collection_names = ["win32"]
+lib.set_default_cc("X86", SimCCStdcall)
+lib.set_default_cc("AMD64", SimCCMicrosoftAMD64)
+lib.set_library_names("xolehlp.dll")
+prototypes = \
+    {
+        #
+        'DtcGetTransactionManager': SimTypeFunction([SimTypePointer(SimTypeChar(label="Byte"), offset=0), SimTypePointer(SimTypeChar(label="Byte"), offset=0), SimTypePointer(SimTypeBottom(label="Guid"), offset=0), SimTypeInt(signed=False, label="UInt32"), SimTypeShort(signed=False, label="UInt16"), SimTypePointer(SimTypeBottom(label="Void"), offset=0), SimTypePointer(SimTypePointer(SimTypeBottom(label="Void"), offset=0), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["i_pszHost", "i_pszTmName", "i_riid", "i_dwReserved1", "i_wcbReserved2", "i_pvReserved2", "o_ppvObject"]),
+        #
+        'DtcGetTransactionManagerC': SimTypeFunction([SimTypePointer(SimTypeChar(label="Byte"), offset=0), SimTypePointer(SimTypeChar(label="Byte"), offset=0), SimTypePointer(SimTypeBottom(label="Guid"), offset=0), SimTypeInt(signed=False, label="UInt32"), SimTypeShort(signed=False, label="UInt16"), SimTypePointer(SimTypeBottom(label="Void"), offset=0), SimTypePointer(SimTypePointer(SimTypeBottom(label="Void"), offset=0), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["i_pszHost", "i_pszTmName", "i_riid", "i_dwReserved1", "i_wcbReserved2", "i_pvReserved2", "o_ppvObject"]),
+        #
+        'DtcGetTransactionManagerExA': SimTypeFunction([SimTypePointer(SimTypeChar(label="Byte"), offset=0), SimTypePointer(SimTypeChar(label="Byte"), offset=0), SimTypePointer(SimTypeBottom(label="Guid"), offset=0), SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeBottom(label="Void"), offset=0), SimTypePointer(SimTypePointer(SimTypeBottom(label="Void"), offset=0), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["i_pszHost", "i_pszTmName", "i_riid", "i_grfOptions", "i_pvConfigParams", "o_ppvObject"]),
+        #
+        'DtcGetTransactionManagerExW': SimTypeFunction([SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeBottom(label="Guid"), offset=0), SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeBottom(label="Void"), offset=0), SimTypePointer(SimTypePointer(SimTypeBottom(label="Void"), offset=0), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["i_pwszHost", "i_pwszTmName", "i_riid", "i_grfOptions", "i_pvConfigParams", "o_ppvObject"]),
+    }
+
+lib.set_prototypes(prototypes)

angr/procedures/definitions/win32_xpsprint.py

@@ -0,0 +1,28 @@
+# pylint:disable=line-too-long
+from __future__ import annotations
+import logging
+from collections import OrderedDict
+
+from angr.sim_type import SimTypeFunction, SimTypeShort, SimTypeInt, SimTypeLong, SimTypeLongLong, SimTypeDouble, SimTypeFloat, SimTypePointer, SimTypeChar, SimStruct, SimTypeArray, SimTypeBottom, SimUnion, SimTypeBool, SimTypeRef
+from angr.calling_conventions import SimCCStdcall, SimCCMicrosoftAMD64
+from angr.procedures import SIM_PROCEDURES as P
+from . import SimLibrary
+
+
+_l = logging.getLogger(name=__name__)
+
+
+lib = SimLibrary()
+lib.type_collection_names = ["win32"]
+lib.set_default_cc("X86", SimCCStdcall)
+lib.set_default_cc("AMD64", SimCCMicrosoftAMD64)
+lib.set_library_names("xpsprint.dll")
+prototypes = \
+    {
+        #
+        'StartXpsPrintJob': SimTypeFunction([SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeInt(signed=True, label="Int"), label="IntPtr", offset=0), SimTypePointer(SimTypeInt(signed=True, label="Int"), label="IntPtr", offset=0), SimTypePointer(SimTypeChar(label="Byte"), label="LPArray", offset=0), SimTypeInt(signed=False, label="UInt32"), SimTypePointer(SimTypeBottom(label="IXpsPrintJob"), offset=0), SimTypePointer(SimTypeBottom(label="IXpsPrintJobStream"), offset=0), SimTypePointer(SimTypeBottom(label="IXpsPrintJobStream"), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["printerName", "jobName", "outputFileName", "progressEvent", "completionEvent", "printablePagesOn", "printablePagesOnCount", "xpsPrintJob", "documentStream", "printTicketStream"]),
+        #
+        'StartXpsPrintJob1': SimTypeFunction([SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeChar(label="Char"), offset=0), SimTypePointer(SimTypeInt(signed=True, label="Int"), label="IntPtr", offset=0), SimTypePointer(SimTypeInt(signed=True, label="Int"), label="IntPtr", offset=0), SimTypePointer(SimTypeBottom(label="IXpsPrintJob"), offset=0), SimTypePointer(SimTypeBottom(label="IXpsOMPackageTarget"), offset=0)], SimTypeInt(signed=True, label="Int32"), arg_names=["printerName", "jobName", "outputFileName", "progressEvent", "completionEvent", "xpsPrintJob", "printContentReceiver"]),
+    }
+
+lib.set_prototypes(prototypes)

angr/procedures/glibc/__ctype_b_loc.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+import angr
+
+
+class __ctype_b_loc(angr.SimProcedure):
+    """
+    Following is the description from linuxfoundation.org:
+
+    The __ctype_b_loc() function shall return a pointer into an array of
+    characters in the current locale that contains characteristics for each
+    character in the current character set. The array shall contain a total
+    of 384 characters, and can be indexed with any signed or unsigned char
+    (i.e. with an index value between -128 and 255). If the application is
+    multithreaded, the array shall be local to the current thread.
+
+    This interface is not in the source standard; it is only in the binary
+    standard.
+    """
+
+    def run(self):
+        return self.state.libc.ctype_b_loc_table_ptr

angr/procedures/glibc/__ctype_tolower_loc.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+import angr
+
+
+class __ctype_tolower_loc(angr.SimProcedure):
+    """
+    Following is the description from linuxfoundation.org:
+
+    The __ctype_tolower_loc() function shall return a pointer into an array
+    of characters in the current locale that contains lower case equivalents
+    for each character in the current character set. The array shall contain
+    a total of 384 characters, and can be indexed with any signed or unsigned
+    char (i.e. with an index value between -128 and 255). If the application
+    is multithreaded, the array shall be local to the current thread.
+
+    This interface is not in the source standard; it is only in the binary
+    standard.
+    """
+
+    def run(self):
+        return self.state.libc.ctype_tolower_loc_table_ptr

angr/procedures/glibc/__ctype_toupper_loc.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+import angr
+
+
+class __ctype_toupper_loc(angr.SimProcedure):
+    """
+    Following is the description from linuxfoundation.org:
+
+    The __ctype_toupper_loc() function shall return a pointer into an array
+    of characters in the current locale that contains upper case equivalents
+    for each character in the current character set. The array shall contain
+    a total of 384 characters, and can be indexed with any signed or unsigned
+    char (i.e. with an index value between -128 and 255). If the application
+    is multithreaded, the array shall be local to the current thread.
+
+    This interface is not in the source standard; it is only in the binary
+    standard.
+    """
+
+    def run(self):
+        return self.state.libc.ctype_toupper_loc_table_ptr

angr/procedures/glibc/__errno_location.py

@@ -0,0 +1,7 @@
+from __future__ import annotations
+import angr
+
+
+class __errno_location(angr.SimProcedure):
+    def run(self):  # pylint:disable=arguments-differ
+        return self.state.libc.errno_location

angr/procedures/glibc/__init__.py

@@ -0,0 +1,3 @@
+"""
+These procedures implement internal functions for the GNU libc that commonly appears on linux systems
+"""

angr/procedures/glibc/__libc_init.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+import angr
+
+
+# Refer to http://androidxref.com/5.1.1_r6/xref/bionic/libc/bionic/libc_init_dynamic.cpp
+# and http://androidxref.com/5.1.1_r6/xref/bionic/libc/private/KernelArgumentBlock.h
+# raw_args points to argc, *argv, and *envp located on the stack
+# unused is always zero
+# slingshot points to main()
+# structors points to PRE_INIT_ARRAY, INIT_ARRAY, and FINI_ARRAY
+
+
+class __libc_init(angr.SimProcedure):
+    # pylint:disable=arguments-differ,unused-argument,attribute-defined-outside-init,missing-class-docstring
+
+    NO_RET = True
+    local_vars = ("main", "argc", "argv", "envp")
+
+    def run(self, raw_args, unused, slingshot, structors):
+        offset = self.state.arch.bytes
+        readlen = self.state.arch.bytes
+        endness = self.state.arch.memory_endness
+        self.main = slingshot
+        self.argc = self.state.memory.load(raw_args + 0 * offset, readlen, endness=endness)
+        argc_val = self.state.solver.eval(self.argc)
+        self.argv = self.state.memory.load(raw_args + 1 * offset, readlen, endness=endness)
+        self.envp = self.state.memory.load(raw_args + (1 + argc_val + 1) * offset, readlen, endness=endness)
+        # TODO: __cxa_atexit calls for various at-exit needs
+        self.call(
+            self.main,
+            (self.argc, self.argv, self.envp),
+            "after_slingshot",
+            prototype="int main(int arch, char **argv, char **envp)",
+        )
+
+    def after_slingshot(self, raw_args, unused, slingshot, structors, exit_addr=0):
+        self.exit(0)

angr/procedures/glibc/__libc_start_main.py

@@ -0,0 +1,301 @@
+from __future__ import annotations
+import logging
+
+import claripy
+from cle import AT
+
+import angr
+
+l = logging.getLogger(name=__name__)
+
+
+class __libc_start_main(angr.SimProcedure):
+    # pylint:disable=arguments-differ,unused-argument,attribute-defined-outside-init,missing-class-docstring
+
+    ADDS_EXITS = True
+    NO_RET = True
+    local_vars = ("main", "argc", "argv", "init", "fini", "initializers")
+
+    def _initialize_b_loc_table(self):
+        """
+        Initialize ptable for ctype
+
+        See __ctype_b_loc.c in libc implementation
+        """
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        table = self.inline_call(malloc, 768).ret_expr
+        table_ptr = self.inline_call(malloc, self.state.arch.bytes).ret_expr
+
+        for pos, c in enumerate(self.state.libc.LOCALE_ARRAY):
+            # Each entry is 2 bytes
+            self.state.memory.store(
+                table + (pos * 2),
+                claripy.BVV(c, 16),
+                inspect=False,
+                disable_actions=True,
+            )
+        # Offset for negative chars
+        # 256 because 2 bytes each, -128 * 2
+        table += 256
+        self.state.memory.store(
+            table_ptr,
+            table,
+            size=self.state.arch.bytes,
+            endness=self.state.arch.memory_endness,
+            inspect=False,
+            disable_actions=True,
+        )
+
+        self.state.libc.ctype_b_loc_table_ptr = table_ptr
+
+    def _initialize_tolower_loc_table(self):
+        """
+        Initialize ptable for ctype
+
+        See __ctype_tolower_loc.c in libc implementation
+        """
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        # 384 entries, 4 bytes each
+        table = self.inline_call(malloc, 384 * 4).ret_expr
+        table_ptr = self.inline_call(malloc, self.state.arch.bytes).ret_expr
+
+        for pos, c in enumerate(self.state.libc.TOLOWER_LOC_ARRAY):
+            self.state.memory.store(
+                table + (pos * 4),
+                claripy.BVV(c, 32),
+                endness=self.state.arch.memory_endness,
+                inspect=False,
+                disable_actions=True,
+            )
+
+        # Offset for negative chars: -128 index (4 bytes per index)
+        table += 128 * 4
+        self.state.memory.store(
+            table_ptr,
+            table,
+            size=self.state.arch.bytes,
+            endness=self.state.arch.memory_endness,
+            inspect=False,
+            disable_actions=True,
+        )
+
+        self.state.libc.ctype_tolower_loc_table_ptr = table_ptr
+
+    def _initialize_toupper_loc_table(self):
+        """
+        Initialize ptable for ctype
+
+        See __ctype_toupper_loc.c in libc implementation
+        """
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        # 384 entries, 4 bytes each
+        table = self.inline_call(malloc, 384 * 4).ret_expr
+        table_ptr = self.inline_call(malloc, self.state.arch.bytes).ret_expr
+
+        for pos, c in enumerate(self.state.libc.TOUPPER_LOC_ARRAY):
+            self.state.memory.store(
+                table + (pos * 4),
+                claripy.BVV(c, 32),
+                endness=self.state.arch.memory_endness,
+                inspect=False,
+                disable_actions=True,
+            )
+
+        # Offset for negative chars: -128 index (4 bytes per index)
+        table += 128 * 4
+        self.state.memory.store(
+            table_ptr,
+            table,
+            size=self.state.arch.bytes,
+            endness=self.state.arch.memory_endness,
+            inspect=False,
+            disable_actions=True,
+        )
+
+        self.state.libc.ctype_toupper_loc_table_ptr = table_ptr
+
+    def _initialize_ctype_table(self):
+        self._initialize_b_loc_table()
+        self._initialize_tolower_loc_table()
+        self._initialize_toupper_loc_table()
+
+    def _initialize_errno(self):
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        errno_loc = self.inline_call(malloc, self.state.arch.bytes).ret_expr
+
+        self.state.libc.errno_location = errno_loc
+        self.state.memory.store(errno_loc, claripy.BVV(0, self.state.arch.bits))
+
+    @property
+    def envp(self):
+        return self.argv + (self.argc + 1) * self.state.arch.bytes
+
+    def run(self, main, argc, argv, init, fini):
+        # TODO: handle symbolic and static modes
+
+        self._initialize_ctype_table()
+        self._initialize_errno()
+
+        self.main, self.argc, self.argv, self.init, self.fini = self._extract_args(
+            self.state, main, argc, argv, init, fini
+        )
+
+        # TODO: __cxa_atexit calls for various at-exit needs
+
+        if not self.state.solver.is_true(self.init == 0):
+            self.initializers = None
+            self.call(
+                self.init,
+                (self.argc[31:0], self.argv, self.envp),
+                "after_init",
+                prototype="int main(int argc, char **argv, char **envp)",
+            )
+        else:
+            obj = self.project.loader.main_object
+            init_func = getattr(obj, "_init_func", None)
+            init_arr = getattr(obj, "_init_arr", None)
+            init_func = [init_func] if init_func else []
+            self.initializers = init_func + list(init_arr)
+            for i, x in enumerate(self.initializers):
+                self.initializers[i] = AT.from_lva(x, obj).to_mva()
+            self.inside_init(main, argc, argv, init, fini)
+
+    def inside_init(self, main, argc, argv, init, fini):
+        if len(self.initializers) == 0:
+            self.after_init(main, argc, argv, init, fini)
+        else:
+            addr = self.initializers.pop(0)
+            self.call(
+                addr,
+                (self.argc[31:0], self.argv, self.envp),
+                "inside_init",
+                prototype="int main(int argc, char **argv, char **envp)",
+            )
+
+    def after_init(self, main, argc, argv, init, fini, exit_addr=0):
+        self.call(
+            self.main,
+            (self.argc[31:0], self.argv, self.envp),
+            "after_main",
+            prototype="int main(int argc, char **argv, char **envp)",
+        )
+
+    def after_main(self, main, argc, argv, init, fini, exit_addr=0):
+        self.exit(0)
+
+    def static_exits(self, blocks, cfg=None, **kwargs):
+        # Execute those blocks with a blank state, and then dump the arguments
+        blank_state = angr.SimState(
+            project=self.project,
+            mode="fastpath",
+            cle_memory_backer=self.project.loader.memory,
+            add_options={
+                angr.options.SYMBOL_FILL_UNCONSTRAINED_MEMORY,
+                angr.options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS,
+            },
+        )
+        # set up the stack pointer
+        blank_state.regs.sp = 0x7FFFFFF0
+
+        # special handling for x86 PIE GCC binaries
+        #
+        # 08049C70 xor     ebp, ebp
+        # 08049C72 pop     esi
+        # 08049C73 mov     ecx, esp
+        # 08049C75 and     esp, 0FFFFFFF0h
+        # 08049C78 push    eax
+        # 08049C79 push    esp             ; stack_end
+        # 08049C7A push    edx             ; rtld_fini
+        # 08049C7B call    sub_8049CA3      // this is the get_pc function
+        #  // first block starts here
+        # 08049C80 add     ebx, (offset off_806B000 - $)
+        # 08049C86 lea     eax, (nullsub_2 - 806B000h)[ebx]
+        # 08049C8C push    eax             ; fini
+        # 08049C8D lea     eax, (sub_805F530 - 806B000h)[ebx]
+        # 08049C93 push    eax             ; init
+        # 08049C94 push    ecx             ; ubp_av
+        # 08049C95 push    esi             ; argc
+        # 08049C96 mov     eax, offset main
+        # 08049C9C push    eax             ; main
+        # 08049C9D call    ___libc_start_main
+        if cfg is not None and self.arch.name == "X86":
+            first_block = blocks[0]
+            first_node = cfg.model.get_any_node(first_block.addr)
+            if first_node is not None:
+                caller_nodes = cfg.model.get_predecessors(first_node, excluding_fakeret=False)
+                if len(caller_nodes) == 1:
+                    caller_node = caller_nodes[0]
+                    succ_and_jks = caller_node.successors_and_jumpkinds()
+                    if len(succ_and_jks) == 1 and succ_and_jks[0][1] == "Ijk_Call":
+                        # get_pc
+                        getpc_func = cfg.functions.get_by_addr(succ_and_jks[0][0].addr)
+                        if getpc_func is not None and "get_pc" in getpc_func.info:
+                            # GCC-generated x86-pie binary confirmed.
+                            # initialize the specified register with the block address
+                            get_pc_reg = getpc_func.info["get_pc"]
+                            setattr(blank_state.regs, "_" + get_pc_reg, first_block.addr)
+
+        # Execute each block
+        state = blank_state
+        for b in blocks:
+            irsb = self.project.factory.default_engine.process(state, irsb=b, force_addr=b.addr)
+            if irsb.successors:
+                state = irsb.successors[0]
+            else:
+                break
+
+        cc = angr.default_cc(
+            self.arch.name, platform=self.project.simos.name if self.project.simos is not None else None
+        )(self.arch)
+        ty = angr.sim_type.parse_signature("void x(void*, void*, void*, void*, void*)").with_arch(self.arch)
+        args = cc.get_args(state, ty)
+        main, _, _, init, fini = self._extract_args(blank_state, *args)
+
+        # skip invalid results
+        result = [
+            {"address": main, "jumpkind": "Ijk_Call", "namehint": "main"},
+        ]
+        if init.concrete and init.concrete_value != 0:
+            init_item = {"address": init, "jumpkind": "Ijk_Call", "namehint": "init"}
+            result.insert(0, init_item)
+        if fini.concrete and fini.concrete_value != 0:
+            fini_item = {"address": fini, "jumpkind": "Ijk_Call", "namehint": "fini"}
+            result.append(fini_item)
+
+        return result
+
+    @staticmethod
+    def _extract_args(state, main, argc, argv, init, fini):
+        """
+        Extract arguments and set them to
+
+        :param angr.sim_state.SimState state: The program state.
+        :param main: An argument to __libc_start_main.
+        :param argc: An argument to __libc_start_main.
+        :param argv: An argument to __libc_start_main.
+        :param init: An argument to __libc_start_main.
+        :param fini: An argument to __libc_start_main.
+        :return: A tuple of five elements: (main, argc, argv, init, fini)
+        :rtype: tuple
+        """
+
+        main_ = main
+        argc_ = argc
+        argv_ = argv
+        init_ = init
+        fini_ = fini
+
+        if state.arch.name == "PPC32":
+            # for some dumb reason, PPC passes arguments to libc_start_main in some completely absurd way
+            argv_ = argc_
+            argc_ = main_
+            main_ = state.mem[state.regs.r8 + 4 :].int.resolved
+            init_ = state.mem[state.regs.r8 + 8 :].int.resolved
+            fini_ = state.mem[state.regs.r8 + 12 :].int.resolved
+
+        elif state.arch.name == "PPC64":
+            main_ = state.mem[state.regs.r8 + 8 :].long.resolved
+            init_ = state.mem[state.regs.r8 + 16 :].long.resolved
+            fini_ = state.mem[state.regs.r8 + 24 :].long.resolved
+
+        return main_, argc_, argv_, init_, fini_

angr/procedures/glibc/dynamic_loading.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+import angr
+
+# pylint: disable=unused-argument,arguments-differ
+
+
+class _dl_vdso_vsym(angr.SimProcedure):
+    def run(self, name, vers):
+        return 0
+        # namestr = self.state.mem[name].string.concrete
+        # if namestr.startswith('_vdso_'):
+        #    realname = namestr[6:]
+        #    lib = angr.SIM_LIBRARIES['linux_kernel']
+        # else:
+        #    raise angr.SimProcedureError('_dl_vdso_vsym(%r): unsupported' % namestr)
+
+        # addr = self.project.loader.extern_object.get_pseudo_addr(realname)
+        # if not self.project.is_hooked(addr):
+        #    self.project.hook(addr, lib.get(realname, self.arch))
+        # return addr

angr/procedures/glibc/scanf.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+from angr.procedures.libc.scanf import scanf
+from angr.procedures.libc.fscanf import fscanf
+
+
+class __isoc99_scanf(scanf):
+    pass
+
+
+class __isoc99_fscanf(fscanf):
+    pass

angr/procedures/glibc/sscanf.py

@@ -0,0 +1,6 @@
+from __future__ import annotations
+from angr.procedures.libc.sscanf import sscanf
+
+
+class __isoc99_sscanf(sscanf):
+    pass

angr/procedures/gnulib/__init__.py

@@ -0,0 +1,3 @@
+"""
+These procedures implement functions described in the gnulib library: https://www.gnu.org/software/gnulib/
+"""