angr 9.2.166__cp310-abi3-manylinux_2_28_x86_64.whl

angr/analyses/loop_analysis.py

@@ -0,0 +1,349 @@
+# pylint:disable=missing-class-docstring,no-self-use
+from __future__ import annotations
+import logging
+
+from angr.analyses import ForwardAnalysis, visitors
+from angr.block import SootBlockNode
+from angr.errors import AngrLoopAnalysisError
+from . import register_analysis
+from .analysis import Analysis
+
+
+l = logging.getLogger(name=__name__)
+
+
+class VariableTypes:
+    Iterator = "Iterator"
+    HasNext = "HasNext"
+    Next = "Next"
+
+
+class AnnotatedVariable:
+    __slots__ = ["type", "variable"]
+
+    def __init__(self, variable, type_):
+        self.variable = variable
+        self.type = type_
+
+    def __repr__(self):
+        return f"{self.variable}//{self.type}"
+
+    def __eq__(self, other):
+        return type(other) is AnnotatedVariable and other.type == self.type and other.variable == self.variable
+
+
+class Condition:
+    Equal = "=="
+    NotEqual = "!="
+
+    def __init__(self, op, val0, val1):
+        self.op = op
+        self.val0 = val0
+        self.val1 = val1
+
+    def __repr__(self):
+        return f"{self.val0} {self.op} {self.val1}"
+
+    @classmethod
+    def from_opstr(cls, opstr):
+        mapping = {
+            "eq": cls.Equal,
+            "==": cls.Equal,
+            "ne": cls.NotEqual,
+            "!=": cls.NotEqual,
+        }
+
+        return mapping.get(opstr)
+
+
+class SootBlockProcessor:
+    def __init__(self, state, block, loop, defuse):
+        self.state = state
+        self.block = block
+        self.loop = loop
+        self.defuse = defuse
+
+    def process(self):
+        if not isinstance(self.block, SootBlockNode):
+            raise AngrLoopAnalysisError(f"Got an unexpected type of block {type(self.block)}.")
+
+        if not self.block.stmts:
+            return None
+
+        for stmt in self.block.stmts:
+            func_name = f"_handle_{stmt.__class__.__name__}"
+
+            if hasattr(self, func_name):
+                getattr(self, func_name)(stmt)
+
+        return self.state
+
+    def _stmt_inside_loop(self, stmt_idx):
+        """
+        Test whether a statement is inside the loop body or not.
+
+        :param stmt_idx:
+        :return:
+        """
+
+        # TODO: This is slow. Fix the performance issue
+
+        return any(node.addr.stmt_idx <= stmt_idx < node.addr.stmt_idx + node.size for node in self.loop.body_nodes)
+
+    def _expr(self, expr):
+        func_name = f"_handle_{expr.__class__.__name__}"
+
+        if hasattr(self, func_name):
+            return getattr(self, func_name)(expr)
+
+        return expr
+
+    #
+    # Statement handlers
+    #
+
+    def _handle_AssignStmt(self, stmt):
+        left_op, right_op = stmt.left_op, stmt.right_op
+
+        expr = self._expr(right_op)
+        if expr is not None:
+            try:
+                from pysoot.sootir.soot_value import SootLocal
+            except ImportError:
+                l.error("Please install PySoot before analyzing Java byte code.")
+                raise
+            if isinstance(left_op, SootLocal):
+                # Log a def for the local variable
+                self.state.locals[left_op.name] = expr
+
+    def _handle_IfStmt(self, stmt):
+        target = stmt.target
+
+        # is it jumping outside the loop?
+        if not self._stmt_inside_loop(target):
+            cond = Condition(
+                Condition.from_opstr(stmt.condition.op),
+                self._expr(stmt.condition.value1),
+                self._expr(stmt.condition.value2),
+            )
+
+            self.state.add_loop_exit_stmt(stmt.label, condition=cond)
+
+    #
+    # Expression handlers
+    #
+
+    def _handle_SootLocal(self, expr):
+        local_name = expr.name
+
+        # First try state.locals
+        try:
+            return self.state.locals[local_name]
+        except KeyError:
+            pass
+
+        # Then try defuse graph
+        try:
+            def_ = self.defuse.defs[local_name]
+            expr = def_.evaluated
+        except KeyError:
+            pass
+
+        return expr
+
+    def _handle_SootIntConstant(self, expr):
+        return expr.value
+
+    def _handle_SootInterfaceInvokeExpr(self, expr):
+        full_method = expr.class_name + "." + expr.method_name
+
+        mapping = {
+            "java.util.Set.iterator": VariableTypes.Iterator,
+            "java.util.Iterator.hasNext": VariableTypes.HasNext,
+            "java.util.Iterator.next": VariableTypes.Next,
+        }
+
+        base_var = self._expr(expr.base)
+
+        if base_var is None:
+            return None
+
+        # Try to annotate the variable when applicable
+        try:
+            try:
+                from pysoot.sootir.soot_value import SootValue
+            except ImportError:
+                l.error("Please install PySoot before analyzing Java byte code.")
+                raise
+
+            var_type = mapping[full_method]
+
+            if isinstance(base_var, (SootValue, AnnotatedVariable)):
+                return AnnotatedVariable(base_var, var_type)
+
+        except KeyError:
+            pass
+
+        return None
+
+
+class LoopAnalysisState:
+    def __init__(self, block):
+        self.block = block
+
+        self.induction_variables = {}
+        self.locals = {}
+
+        self.loop_exit_stmts = set()
+
+    def __repr__(self):
+        return f"<LoopAnalysisState {self.block.addr}>"
+
+    def copy(self):
+        state = LoopAnalysisState(block=self.block)
+
+        state.induction_variables = self.induction_variables.copy()
+        state.locals = self.locals.copy()
+        state.loop_exit_stmts = self.loop_exit_stmts.copy()
+
+        return state
+
+    def merge(self, state):
+        s = self.copy()
+
+        # TODO: Induction variables
+
+        s.locals.update(state.locals)
+        s.loop_exit_stmts |= state.loop_exit_stmts
+
+        return s
+
+    def add_loop_exit_stmt(self, stmt_idx, condition=None):
+        self.loop_exit_stmts.add((condition, stmt_idx))
+
+
+class LoopAnalysis(ForwardAnalysis, Analysis):
+    """
+    Analyze a loop and recover important information about the loop (e.g., invariants, induction variables) in a static
+    manner.
+    """
+
+    def __init__(self, loop, defuse):
+        visitor = visitors.LoopVisitor(loop)
+        ForwardAnalysis.__init__(self, order_jobs=True, allow_merging=True, allow_widening=False, graph_visitor=visitor)
+
+        self.loop = loop
+        self.defuse = defuse
+        self._traversed = set()
+        self._last_state = None
+
+        self.loop_exit_stmts = None
+        self.locals = None
+        self.bounded = None  # Whether this loop is bounded
+
+        self._analyze()
+
+    #
+    # Main analysis routines
+    #
+
+    def _pre_analysis(self):
+        pass
+
+    def _pre_job_handling(self, job):
+        pass
+
+    def _initial_abstract_state(self, node):
+        return LoopAnalysisState(node)
+
+    def _merge_states(self, node, *states):
+        merged = states[0]
+        for other in states[1:]:
+            if other is not None:
+                merged = merged.merge(other)
+        return merged
+
+    def _run_on_node(self, node, state):
+        if node in self._traversed:
+            return False, state
+
+        self._traversed.add(node)
+
+        state = state.copy()
+
+        processor = SootBlockProcessor(state, node, self.loop, self.defuse)
+        state = processor.process()
+
+        self._last_state = state
+
+        return True, state
+
+    def _intra_analysis(self):
+        pass
+
+    def _post_analysis(self):
+        self.loop_exit_stmts = self._last_state.loop_exit_stmts
+        self.locals = self._last_state.locals
+
+        self._last_state = None
+
+        # Is it bounded?
+        self.bounded = self._is_bounded()
+
+    def _is_bounded(self):
+        """
+        Checks whether this loop is bounded. We basically does a bunch of pattern matching.
+
+        :return: True if this loop is bounded, False is this loop is not bounded, None otherwise (undetermined).
+        :rtype: bool or None
+        """
+
+        b = self._is_bounded_iterator_based()
+        if b is not None:
+            return b
+
+        # Cannot determine
+        return None
+
+    def _is_bounded_iterator_based(self):
+        """
+        Iterator based check.
+
+        With respect to a certain variable/value A,
+        - there must be at least one exit condition being A//Iterator//HasNext == 0
+        - there must be at least one local that ticks the iterator next: A//Iterator//Next
+        """
+
+        # Condition 0
+        def check_0(cond):
+            return (
+                isinstance(cond, Condition)
+                and cond.op == Condition.Equal
+                and cond.val1 == 0
+                and isinstance(cond.val0, AnnotatedVariable)
+                and cond.val0.type == VariableTypes.HasNext
+            )
+
+        check_0_results = [(check_0(stmt[0]), stmt[0]) for stmt in self.loop_exit_stmts]
+        check_0_conds = [cond for r, cond in check_0_results if r]  # remove all False ones
+
+        if not check_0_conds:
+            return None
+
+        the_iterator = check_0_conds[0].val0.variable
+
+        # Condition 1
+        def check_1(local):
+            return (
+                isinstance(local, AnnotatedVariable)
+                and local.type == VariableTypes.Next
+                and local.variable == the_iterator
+            )
+
+        if not any(check_1(local) for local in self.locals.values()):
+            return None
+
+        return True
+
+
+register_analysis(LoopAnalysis, "LoopAnalysis")

angr/analyses/loopfinder.py

@@ -0,0 +1,171 @@
+from __future__ import annotations
+
+import contextlib
+import logging
+
+import networkx
+
+from angr.analyses import AnalysesHub
+from . import Analysis
+
+l = logging.getLogger(name=__name__)
+
+
+class Loop:
+    def __init__(self, entry, entry_edges, break_edges, continue_edges, body_nodes, graph, subloops):
+        self.entry = entry
+        self.entry_edges = entry_edges
+        self.break_edges = break_edges
+        self.continue_edges = continue_edges
+        self.body_nodes = body_nodes
+        self.graph = graph
+        self.subloops = subloops
+
+        self.has_calls = any(loop.has_calls for loop in subloops)
+
+        if not self.has_calls:
+            for _, _, data in self.graph.edges(data=True):
+                if "type" in data and data["type"] == "fake_return":
+                    # this is a function call.
+                    self.has_calls = True
+                    break
+
+    def __repr__(self):
+        return f"<Loop @ {self.entry.addr}, {len(self.body_nodes)} blocks>"
+
+
+class LoopFinder(Analysis):
+    """
+    Extracts all the loops from all the functions in a binary.
+    """
+
+    def __init__(self, functions=None, normalize=True):
+        if functions is None:
+            functions = self.kb.functions.values()
+
+        found_any = False
+        self.loops = []
+        self.loops_hierarchy = {}
+        for function in functions:
+            if self.project.is_hooked(function.addr) or self.project.simos.is_syscall_addr(function.addr):
+                # skip SimProcedures and syscalls
+                continue
+
+            found_any = True
+            with self._resilience():
+                if normalize:
+                    function.normalize()
+                tops, alls = self._parse_loops_from_graph(function.graph)
+                self.loops += alls
+                self.loops_hierarchy[function.addr] = tops
+
+        if not found_any:
+            l.error("No knowledge of functions is present. Did you forget to construct a CFG?")
+
+    def _parse_loop_graph(self, subg: networkx.DiGraph, bigg: networkx.DiGraph):
+        """
+        Create a Loop object for a strongly connected graph, and any strongly
+        connected subgraphs, if possible.
+
+        :param subg:    A strongly connected subgraph.
+        :param bigg:    The graph which subg is a subgraph of.
+
+        :return:        A list of Loop objects, some of which may be inside others,
+                        but all need to be documented.
+        """
+        loop_body_nodes = list(subg.nodes())[:]
+        entry_edges = []
+        break_edges = []
+        continue_edges = []
+        entry_node = None
+        for node in loop_body_nodes:
+            for pred_node in bigg.predecessors(node):
+                if pred_node not in loop_body_nodes:
+                    if entry_node is not None and entry_node != node:
+                        l.warning("Bad loop: more than one entry point (%s, %s)", entry_node, node)
+                        return None, []
+                    entry_node = node
+                    entry_edges.append((pred_node, node))
+                    subg.add_edge(pred_node, node)
+            for succ_node in bigg.successors(node):
+                if succ_node not in loop_body_nodes:
+                    break_edges.append((node, succ_node))
+                    subg.add_edge(node, succ_node)
+        if entry_node is None:
+            entry_node = min(loop_body_nodes, key=lambda n: n.addr)
+            l.info("Couldn't find entry point, assuming it's the first by address (%s)", entry_node)
+
+        acyclic_subg = subg.copy()
+        for pred_node in subg.predecessors(entry_node):
+            if pred_node in loop_body_nodes:
+                continue_edge = (pred_node, entry_node)
+                acyclic_subg.remove_edge(*continue_edge)
+                continue_edges.append(continue_edge)
+
+        removed_exits = {}
+        removed_entries = {}
+        tops, alls = self._parse_loops_from_graph(acyclic_subg)
+        for subloop in tops:
+            if subloop.entry in loop_body_nodes:
+                # break existing entry edges, exit edges
+                # re-link in loop object
+                # the exception logic is to handle when you have two loops adjacent to each other
+                # you gotta link the two loops together and remove the dangling edge
+                for entry_edge in subloop.entry_edges:
+                    try:
+                        subg.remove_edge(*entry_edge)
+                    except networkx.NetworkXError:
+                        if entry_edge in removed_entries:
+                            subg.add_edge(removed_entries[entry_edge], subloop)
+                            with contextlib.suppress(networkx.NetworkXError):
+                                subg.remove_edge(removed_entries[entry_edge], entry_edge[1])
+                        else:
+                            raise
+                    else:
+                        subg.add_edge(entry_edge[0], subloop)
+                        removed_entries[entry_edge] = subloop
+                for exit_edge in subloop.break_edges:
+                    try:
+                        subg.remove_edge(*exit_edge)
+                    except networkx.NetworkXError:
+                        if exit_edge in removed_entries:
+                            subg.add_edge(subloop, removed_entries[exit_edge])
+                            with contextlib.suppress(networkx.NetworkXError):
+                                subg.remove_edge(exit_edge[0], removed_entries[exit_edge])
+                        else:
+                            raise
+                    else:
+                        subg.add_edge(subloop, exit_edge[1])
+                        removed_exits[exit_edge] = subloop
+                _subgraphs = (
+                    networkx.induced_subgraph(subg, nodes).copy()
+                    for nodes in networkx.weakly_connected_components(subg)
+                )
+                subg = next(filter(lambda g: entry_node in g.nodes(), _subgraphs))
+        me = Loop(entry_node, entry_edges, break_edges, continue_edges, loop_body_nodes, subg, tops[:])
+        return me, [me, *alls]
+
+    def _parse_loops_from_graph(self, graph: networkx.DiGraph):
+        """
+        Return all Loop instances that can be extracted from a graph.
+
+        :param graph:   The graph to analyze.
+
+        :return:        A list of all the Loop instances that were found in the graph.
+        """
+        outtop = []
+        outall = []
+        subg: networkx.DiGraph
+        for subg in (
+            networkx.induced_subgraph(graph, nodes).copy() for nodes in networkx.strongly_connected_components(graph)
+        ):
+            if len(subg.nodes()) == 1 and len(list(subg.successors(next(iter(subg.nodes()))))) == 0:
+                continue
+            thisloop, allloops = self._parse_loop_graph(subg, graph)
+            if thisloop is not None:
+                outall += allloops
+                outtop.append(thisloop)
+        return outtop, outall
+
+
+AnalysesHub.register_default("LoopFinder", LoopFinder)

angr/analyses/patchfinder.py

@@ -0,0 +1,137 @@
+# pylint:disable=missing-class-docstring
+from __future__ import annotations
+import logging
+from typing import TYPE_CHECKING
+from collections import defaultdict
+from dataclasses import dataclass
+
+from sortedcontainers import SortedDict
+
+from angr.analyses import Analysis, AnalysesHub
+from angr.utils.bits import ffs
+
+if TYPE_CHECKING:
+    from angr.knowledge_plugins import Function
+
+
+log = logging.getLogger(__name__)
+
+
+class OverlappingFunctionsAnalysis(Analysis):
+    """
+    Identify functions with interleaved blocks.
+    """
+
+    overlapping_functions: dict[int, list[int]]
+
+    def __init__(self):
+        self.overlapping_functions = defaultdict(list)
+        addr_to_func_max_addr = SortedDict()
+
+        for func in self.project.kb.functions.values():
+            if func.is_alignment:
+                continue
+            func_max_addr = max((block.addr + block.size) for block in func.blocks)
+            addr_to_func_max_addr[func.addr] = (func, func_max_addr)
+
+        for idx, (addr, (_func, max_addr)) in enumerate(addr_to_func_max_addr.items()):
+            for other_addr in addr_to_func_max_addr.islice(idx + 1):
+                if other_addr >= max_addr:
+                    break
+
+                self.overlapping_functions[addr].append(other_addr)
+
+
+class FunctionAlignmentAnalysis(Analysis):
+    """
+    Determine typical function alignment
+    """
+
+    alignment: int | None
+
+    def __init__(self):
+        self.alignment = None
+
+        if len(self.project.kb.functions) == 0:
+            if self.project.kb.cfgs.get_most_accurate() is None:
+                log.warning("Please run CFGFast analysis first, to identify functions")
+            return
+
+        alignment_bins = defaultdict(int)
+        count = 0
+        for func in self.project.kb.functions.values():
+            if not (func.is_alignment or func.is_plt or func.is_simprocedure):
+                alignment_bins[ffs(func.addr)] += 1
+                count += 1
+
+        # FIXME: Higher alignment values will be naturally aligned
+
+        typical_alignment = max(alignment_bins, key=lambda k: alignment_bins[k])
+        if count > 10 and alignment_bins[typical_alignment] >= count / 4:  # XXX: cutoff
+            self.alignment = 1 << max(typical_alignment, 0)
+            log.debug("Function alignment appears to be %d bytes", self.alignment)
+
+
+@dataclass
+class AtypicallyAlignedFunction:
+    function: Function
+    expected_alignment: int
+
+
+@dataclass
+class PatchedOutFunctionality:
+    patched_function: Function
+    patched_out_function: Function
+
+
+class PatchFinderAnalysis(Analysis):
+    """
+    Looks for binary patches using some basic heuristics:
+    - Looking for interleaved functions
+    - Looking for unaligned functions
+    """
+
+    # FIXME: Possible additional heuristics:
+    # - Jumps out to end of function, then back
+    # - Looking for patch jumps, e.g. push <addr>; ret
+    # - Looking for instruction partials broken by a patch (nodecode)
+    # - Unusual stack manipulation
+
+    atypical_alignments: list[AtypicallyAlignedFunction]
+    possibly_patched_out: list[PatchedOutFunctionality]
+
+    def __init__(self):
+        self.atypical_alignments = []
+        self.possibly_patched_out = []
+
+        if len(self.project.kb.functions) == 0:
+            if self.project.kb.cfgs.get_most_accurate() is None:
+                log.warning("Please run CFGFast analysis first, to identify functions")
+            return
+
+        # In CFGFast with scanning enabled, a function may be created from unreachable blocks within another function.
+        # Search for interleaved/overlapping functions to identify possible patches.
+        overlapping_functions = self.project.analyses.OverlappingFunctions().overlapping_functions
+        for addr, overlapping_func_addrs in overlapping_functions.items():
+            func = self.project.kb.functions[addr]
+
+            # Are the overlapping functions reachable?
+            for overlapping_addr in overlapping_func_addrs:
+                overlapping_func = self.project.kb.functions[overlapping_addr]
+                if self.project.kb.callgraph.in_degree(overlapping_addr) == 0:
+                    self.possibly_patched_out.append(PatchedOutFunctionality(func, overlapping_func))
+                    # FIXME: What does the patch do?
+
+        # Look for unaligned functions
+        expected_alignment = self.project.analyses.FunctionAlignment().alignment
+        if expected_alignment is not None and expected_alignment > self.project.arch.instruction_alignment:
+            for func in self.project.kb.functions.values():
+                if not (func.is_alignment or func.is_plt or func.is_simprocedure) and func.addr & (
+                    expected_alignment - 1
+                ):
+                    self.atypical_alignments.append(AtypicallyAlignedFunction(func, expected_alignment))
+
+
+AnalysesHub.register_default("OverlappingFunctions", OverlappingFunctionsAnalysis)
+AnalysesHub.register_default("FunctionAlignment", FunctionAlignmentAnalysis)
+AnalysesHub.register_default("PatchFinder", PatchFinderAnalysis)