angr 9.2.174__cp310-abi3-macosx_11_0_arm64.whl → 9.2.176__cp310-abi3-macosx_11_0_arm64.whl

angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.174"
+__version__ = "9.2.176"
 
 if bytes is str:
     raise Exception(

angr/__main__.py

@@ -6,11 +6,14 @@ import re
 from typing import TYPE_CHECKING
 from collections.abc import Generator
 
+from rich.syntax import Syntax
+from rich.console import Console
+
 import angr
 from angr.analyses.decompiler import DECOMPILATION_PRESETS
 from angr.analyses.decompiler.structuring import STRUCTURER_CLASSES, DEFAULT_STRUCTURER
 from angr.analyses.decompiler.utils import decompile_functions
-
+from angr.utils.formatting import ansi_color_enabled
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.functions import Function
@@ -82,11 +85,27 @@ def decompile(args):
         base_address=args.base_addr,
         preset=args.preset,
     )
-    print(decompilation)
+
+    # Determine if we should use syntax highlighting
+    should_highlight = ansi_color_enabled and not args.no_colors
+
+    if should_highlight:
+        try:
+            console = Console()
+            syntax = Syntax(decompilation, "c", theme=args.theme, line_numbers=False)
+            console.print(syntax)
+        # pylint: disable=broad-exception-caught
+        except Exception as e:
+            log.warning("Syntax highlighting failed: %s", e)
+            # Fall back to plain text if syntax highlighting fails
+            print(decompilation)
+    else:
+        print(decompilation)
 
 
 def main():
     parser = argparse.ArgumentParser(description="The angr CLI allows you to decompile and analyze binaries.")
+    parser.add_argument("--version", action="version", version=angr.__version__)
     parser.add_argument("binary", help="The path to the binary to analyze.")
     parser.add_argument(
         "--catch-exceptions",
@@ -133,6 +152,17 @@ def main():
         symbols of the binary or as addresses like: 0x401000.""",
         nargs="+",
     )
+    decompile_cmd_parser.add_argument(
+        "--no-colors",
+        help="Disable syntax highlighting in the decompiled output.",
+        action="store_true",
+        default=False,
+    )
+    decompile_cmd_parser.add_argument(
+        "--theme",
+        help="The syntax highlighting theme to use (only if rich is installed and colors are enabled).",
+        default="dracula",
+    )
 
     disassemble_cmd_parser = subparsers.add_parser("disassemble", aliases=["dis"], help=disassemble.__doc__)
     disassemble_cmd_parser.set_defaults(func=disassemble)

angr/analyses/calling_convention/calling_convention.py

@@ -95,6 +95,8 @@ class CallingConventionAnalysis(Analysis):
                                 calling convention and arguments. This can be time-consuming if there are many call
                                 sites to analyze.
     :ivar cc:           The recovered calling convention for the function.
+    :ivar _collect_facts:       True if we should run FunctionFactCollector to collect input arguments and return
+                                value size. False if input arguments and return value size are provided by the user.
     """
 
     def __init__(
@@ -108,6 +110,7 @@ class CallingConventionAnalysis(Analysis):
         func_graph: networkx.DiGraph | None = None,
         input_args: list[SimRegArg | SimStackArg] | None = None,
         retval_size: int | None = None,
+        collect_facts: bool = False,
     ):
         if func is not None and not isinstance(func, Function):
             func = self.kb.functions[func]
@@ -121,6 +124,7 @@ class CallingConventionAnalysis(Analysis):
         self._func_graph = func_graph
         self._input_args = input_args
         self._retval_size = retval_size
+        self._collect_facts = collect_facts
 
         if self._retval_size is not None and self._input_args is None:
             # retval size will be ignored if input_args is not specified - user error?
@@ -132,6 +136,7 @@ class CallingConventionAnalysis(Analysis):
         self.cc: SimCC | None = None
         self.prototype: SimTypeFunction | None = None
         self.prototype_libname: str | None = None
+        self.proto_from_symbol: bool = False
 
         if self._cfg is None and "CFGFast" in self.kb.cfgs:
             self._cfg = self.kb.cfgs["CFGFast"]
@@ -168,6 +173,7 @@ class CallingConventionAnalysis(Analysis):
             r_demangled = self._analyze_demangled_name(demangled_name)
             if r_demangled is not None:
                 self.cc, self.prototype, self.prototype_libname = r_demangled
+                self.proto_from_symbol = True
                 return
 
         if self._function.is_simprocedure:
@@ -242,6 +248,12 @@ class CallingConventionAnalysis(Analysis):
                 self.cc, self.prototype, self.prototype_libname = r_plt
             return
 
+        # we gotta analyze the function properly
+        if self._collect_facts and self._input_args is None and self._retval_size is None:
+            facts = self.project.analyses.FunctionFactCollector(self._function, kb=self.kb)
+            self._input_args = facts.input_args
+            self._retval_size = facts.retval_size
+
         r = self._analyze_function()
         if r is None:
             l.warning("Cannot determine calling convention for %r.", self._function)

angr/analyses/cfg/cfg_base.py

@@ -937,7 +937,7 @@ class CFGBase(Analysis):
         """
 
         addrs = set()
-        if isinstance(self._binary, ELF) and self._binary.has_dwarf_info:
+        if (isinstance(self._binary, ELF) and self._binary.has_dwarf_info) or isinstance(self._binary, PE):
             for function_hint in self._binary.function_hints:
                 if function_hint.source == FunctionHintSource.EH_FRAME:
                     addrs.add(function_hint.addr)

angr/analyses/cfg/cfg_fast.py

@@ -435,6 +435,7 @@ class CFGJobType(Enum):
     COMPLETE_SCANNING = 2
     IFUNC_HINTS = 3
     DATAREF_HINTS = 4
+    EH_FRAME_HINTS = 5
 
 
 class CFGJob:
@@ -612,7 +613,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         low_priority=False,
         cfb=None,
         model=None,
-        elf_eh_frame=True,
+        eh_frame=True,
         exceptions=True,
         skip_unmapped_addrs=True,
         nodecode_window_size=512,
@@ -625,6 +626,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         end=None,  # deprecated
         collect_data_references=None,  # deprecated
         extra_cross_references=None,  # deprecated
+        elf_eh_frame=None,  # deprecated
         **extra_arch_options,
     ):
         """
@@ -664,8 +666,8 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                                              types will be loaded.
         :param base_state:              A state to use as a backer for all memory loads
         :param bool detect_tail_calls:  Enable aggressive tail-call optimization detection.
-        :param bool elf_eh_frame:       Retrieve function starts (and maybe sizes later) from the .eh_frame of ELF
-                                        binaries.
+        :param bool eh_frame:           Retrieve function starts (and maybe sizes later) from the .eh_frame of ELF
+                                        binaries or exception records of PE binaries.
         :param skip_unmapped_addrs:     Ignore all branches into unmapped regions. True by default. You may want to set
                                         it to False if you are analyzing manually patched binaries or malware samples.
         :param indirect_calls_always_return:    Should CFG assume indirect calls must return or not. Assuming indirect
@@ -778,13 +780,17 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
             )
             force_complete_scan = False
 
+        if elf_eh_frame is not None:
+            l.warning('"elf_eh_frame" is deprecated and will be removed soon. Please use "eh_frame" instead.')
+            eh_frame = eh_frame or elf_eh_frame
+
         self._pickle_intermediate_results = pickle_intermediate_results
 
         self._use_symbols = symbols
         self._use_function_prologues = function_prologues
         self._force_smart_scan = force_smart_scan
         self._force_complete_scan = force_complete_scan
-        self._use_elf_eh_frame = elf_eh_frame
+        self._use_eh_frame = eh_frame
         self._use_exceptions = exceptions
         self._check_funcret_max_job = check_funcret_max_job
 
@@ -841,7 +847,8 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         self._read_addr_to_run = defaultdict(list)
         self._write_addr_to_run = defaultdict(list)
 
-        self._remaining_function_prologue_addrs = None
+        self._remaining_eh_frame_addrs: list[int] | None = None
+        self._remaining_function_prologue_addrs: list[int] | None = None
 
         # exception handling
         self._exception_handling_by_endaddr = SortedDict()
@@ -1440,9 +1447,6 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         if self._use_symbols:
             starting_points |= self._function_addresses_from_symbols
 
-        if self._use_elf_eh_frame:
-            starting_points |= self._function_addresses_from_eh_frame
-
         if self._extra_function_starts:
             starting_points |= set(self._extra_function_starts)
 
@@ -1467,6 +1471,9 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
 
         self._updated_nonreturning_functions = set()
 
+        if self._use_eh_frame:
+            self._remaining_eh_frame_addrs = sorted(self._function_addresses_from_eh_frame)
+
         if self._use_function_prologues and self.project.concrete_target is None:
             self._remaining_function_prologue_addrs = sorted(self._func_addrs_from_prologues())
 
@@ -1742,6 +1749,18 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                 self._insert_job(job)
                 return
 
+        if self._use_eh_frame and self._remaining_eh_frame_addrs:
+            while self._remaining_eh_frame_addrs:
+                eh_addr = self._remaining_eh_frame_addrs[0]
+                self._remaining_eh_frame_addrs = self._remaining_eh_frame_addrs[1:]
+                if self._seg_list.is_occupied(eh_addr):
+                    continue
+
+                job = CFGJob(eh_addr, eh_addr, "Ijk_Boring", job_type=CFGJobType.EH_FRAME_HINTS)
+                self._insert_job(job)
+                self._register_analysis_job(eh_addr, job)
+                return
+
         if self._use_function_prologues and self._remaining_function_prologue_addrs:
             while self._remaining_function_prologue_addrs:
                 prolog_addr = self._remaining_function_prologue_addrs[0]

angr/analyses/complete_calling_conventions.py

@@ -17,7 +17,7 @@ from angr.utils.graph import GraphUtils
 from angr.simos import SimWindows
 from angr.utils.mp import mp_context, Initializer
 from angr.knowledge_plugins.cfg import CFGModel
-from . import Analysis, register_analysis, VariableRecoveryFast, CallingConventionAnalysis, FactCollector, CFGFast
+from . import Analysis, register_analysis, VariableRecoveryFast, CallingConventionAnalysis, CFGFast
 
 if TYPE_CHECKING:
     from angr.calling_conventions import SimCC
@@ -191,10 +191,15 @@ class CompleteCallingConventionsAnalysis(Analysis):
         self._prioritize_func_addrs = None  # no longer useful
 
     def _set_function_prototype(
-        self, func: Function, prototype: SimTypeFunction | None, prototype_libname: str | None
+        self,
+        func: Function,
+        prototype: SimTypeFunction | None,
+        prototype_libname: str | None,
+        prototype_guessed: bool | None,
     ) -> None:
         if func.prototype is None or func.is_prototype_guessed or self._force:
-            func.is_prototype_guessed = True
+            if prototype_guessed is not None:
+                func.is_prototype_guessed = prototype_guessed
             func.prototype = prototype
             func.prototype_libname = prototype_libname
 
@@ -204,12 +209,12 @@ class CompleteCallingConventionsAnalysis(Analysis):
         if self._workers == 0:
             self._update_progress(0)
             for idx, func_addr in enumerate(self._func_addrs):
-                cc, proto, proto_libname, _ = self._analyze_core(func_addr)
+                cc, proto, proto_libname, proto_guessed, _ = self._analyze_core(func_addr)
 
                 func = self.kb.functions.get_by_addr(func_addr)
                 if cc is not None or proto is not None:
                     func.calling_convention = cc
-                    self._set_function_prototype(func, proto, proto_libname)
+                    self._set_function_prototype(func, proto, proto_libname, proto_guessed)
                     if proto_libname is not None:
                         self.prototype_libnames.add(proto_libname)
 
@@ -269,10 +274,13 @@ class CompleteCallingConventionsAnalysis(Analysis):
             # update progress
             self._update_progress(0)
             idx = 0
+            assert self._results_lock is not None
             while idx < total_funcs:
                 try:
                     with self._results_lock:
-                        func_addr, cc, proto, proto_libname, varman = self._results.get(True, timeout=0.01)
+                        func_addr, cc, proto, proto_libname, proto_guessed, varman = self._results.get(
+                            True, timeout=0.01
+                        )
                 except queue.Empty:
                     time.sleep(0.1)
                     continue
@@ -280,7 +288,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
                 func = self.kb.functions.get_by_addr(func_addr)
                 if cc is not None or proto is not None:
                     func.calling_convention = cc
-                    self._set_function_prototype(func, proto, proto_libname)
+                    self._set_function_prototype(func, proto, proto_libname, proto_guessed)
                     if proto_libname is not None:
                         self.prototype_libnames.add(proto_libname)
 
@@ -317,6 +325,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
     def _worker_routine(self, worker_id: int, initializer: Initializer):
         initializer.initialize()
         idx = 0
+        assert self._remaining_funcs is not None and self._func_queue is not None and self._results_lock is not None
         while self._remaining_funcs.value > 0:
             try:
                 with self._func_queue_lock:
@@ -327,33 +336,39 @@ class CompleteCallingConventionsAnalysis(Analysis):
                 continue
 
             if callee_info is not None:
-                callee_info: dict[int, tuple[SimCC | None, SimTypeFunction | None, str | None]]
-                for callee, (callee_cc, callee_proto, callee_proto_libname) in callee_info.items():
+                callee_info: dict[int, tuple[SimCC | None, SimTypeFunction | None, str | None, bool | None]]
+                for callee, (
+                    callee_cc,
+                    callee_proto,
+                    callee_proto_libname,
+                    callee_proto_guessed,
+                ) in callee_info.items():
                     callee_func = self.kb.functions.get_by_addr(callee)
                     callee_func.calling_convention = callee_cc
-                    self._set_function_prototype(callee_func, callee_proto, callee_proto_libname)
+                    self._set_function_prototype(callee_func, callee_proto, callee_proto_libname, callee_proto_guessed)
 
             idx += 1
             if self._low_priority and idx % 3 == 0:
                 time.sleep(0.1)
 
             try:
-                cc, proto, proto_libname, varman = self._analyze_core(func_addr)
+                cc, proto, proto_libname, proto_guessed, varman = self._analyze_core(func_addr)
             except Exception:  # pylint:disable=broad-except
                 _l.error("Worker %d: Exception occurred during _analyze_core().", worker_id, exc_info=True)
-                cc, proto, proto_libname, varman = None, None, None, None
+                cc, proto, proto_libname, proto_guessed, varman = None, None, None, None, None
             with self._results_lock:
-                self._results.put((func_addr, cc, proto, proto_libname, varman))
+                self._results.put((func_addr, cc, proto, proto_libname, proto_guessed, varman))
 
     def _analyze_core(
         self, func_addr: int
-    ) -> tuple[SimCC | None, SimTypeFunction | None, str | None, VariableManagerInternal | None]:
+    ) -> tuple[SimCC | None, SimTypeFunction | None, str | None, bool | None, VariableManagerInternal | None]:
         func = self.kb.functions.get_by_addr(func_addr)
         if func.ran_cca:
             return (
                 func.calling_convention,
                 func.prototype,
                 func.prototype_libname,
+                func.is_prototype_guessed,
                 self.kb.variables.get_function_manager(func_addr),
             )
 
@@ -365,7 +380,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
             # special case: we don't have a PCode-engine variable recovery analysis for PCode architectures!
             if ":" in self.project.arch.name and self._func_graphs and func.addr in self._func_graphs:
                 # this is a pcode architecture
-                return None, None, None, None
+                return None, None, None, None, None
 
             _l.info("Performing variable recovery on %r...", func)
             try:
@@ -378,17 +393,14 @@ class CompleteCallingConventionsAnalysis(Analysis):
                     func.addr,
                     exc_info=True,
                 )
-                return None, None, None, None
-
-        kwargs = {}
-        if self.mode == CallingConventionAnalysisMode.FAST:
-            facts = self.project.analyses[FactCollector].prep(kb=self.kb)(func)
-            kwargs["input_args"] = facts.input_args
-            kwargs["retval_size"] = facts.retval_size
+                return None, None, None, None, None
 
         # determine the calling convention of each function
         cc_analysis = self.project.analyses[CallingConventionAnalysis].prep(kb=self.kb)(
-            func, cfg=self._cfg, analyze_callsites=self._analyze_callsites, **kwargs
+            func,
+            cfg=self._cfg,
+            analyze_callsites=self._analyze_callsites,
+            collect_facts=self.mode == CallingConventionAnalysisMode.FAST,
         )
 
         if cc_analysis.cc is not None:
@@ -397,10 +409,11 @@ class CompleteCallingConventionsAnalysis(Analysis):
                 cc_analysis.cc,
                 cc_analysis.prototype,
                 cc_analysis.prototype_libname if cc_analysis.prototype_libname is not None else func.prototype_libname,
+                not cc_analysis.proto_from_symbol,
                 self.kb.variables.get_function_manager(func_addr),
             )
         _l.info("Cannot determine calling convention for %r.", func)
-        return None, None, None, self.kb.variables.get_function_manager(func_addr)
+        return None, None, None, None, self.kb.variables.get_function_manager(func_addr)
 
     def prioritize_functions(self, func_addrs_to_prioritize: Iterable[int]):
         """
@@ -424,12 +437,12 @@ class CompleteCallingConventionsAnalysis(Analysis):
 
     def _get_callees_cc_prototypes(
         self, caller_func_addr: int
-    ) -> dict[int, tuple[SimCC | None, SimTypeFunction | None, str | None]]:
+    ) -> dict[int, tuple[SimCC | None, SimTypeFunction | None, str | None, bool | None]]:
         d = {}
         for callee in self.kb.functions.callgraph.successors(caller_func_addr):
             if callee != caller_func_addr and callee not in d:
                 func = self.kb.functions.get_by_addr(callee)
-                tpl = func.calling_convention, func.prototype, func.prototype_libname
+                tpl = func.calling_convention, func.prototype, func.prototype_libname, func.is_prototype_guessed
                 d[callee] = tpl
         return d
 

angr/analyses/decompiler/ail_simplifier.py

@@ -168,6 +168,7 @@ class AILSimplifier(Analysis):
         fold_callexprs_into_conditions=False,
         use_callee_saved_regs_at_return=True,
         rewrite_ccalls=True,
+        rename_ccalls=True,
         removed_vvar_ids: set[int] | None = None,
         arg_vvars: dict[int, tuple[VirtualVariable, SimVariable]] | None = None,
         avoid_vvar_ids: set[int] | None = None,
@@ -188,6 +189,7 @@ class AILSimplifier(Analysis):
         self._fold_callexprs_into_conditions = fold_callexprs_into_conditions
         self._use_callee_saved_regs_at_return = use_callee_saved_regs_at_return
         self._should_rewrite_ccalls = rewrite_ccalls
+        self._should_rename_ccalls = rename_ccalls
         self._removed_vvar_ids = removed_vvar_ids if removed_vvar_ids is not None else set()
         self._arg_vvars = arg_vvars
         self._avoid_vvar_ids = avoid_vvar_ids if avoid_vvar_ids is not None else set()
@@ -1992,20 +1994,20 @@ class AILSimplifier(Analysis):
 
             v = False
 
-        def _handle_expr(
-            expr_idx: int, expr: Expression, stmt_idx: int, stmt: Statement | None, block: Block | None
+        def _handle_VEXCCallExpression(
+            expr_idx: int, expr: VEXCCallExpression, stmt_idx: int, stmt: Statement, block: Block | None
         ) -> Expression | None:
-            if isinstance(expr, VEXCCallExpression):
-                rewriter = rewriter_cls(expr, self.project.arch)
-                if rewriter.result is not None:
-                    _any_update.v = True
-                    return rewriter.result
-                return None
-
-            return AILBlockWalker._handle_expr(walker, expr_idx, expr, stmt_idx, stmt, block)
+            r_expr = AILBlockWalker._handle_VEXCCallExpression(walker, expr_idx, expr, stmt_idx, stmt, block)
+            if r_expr is None:
+                r_expr = expr
+            rewriter = rewriter_cls(r_expr, self.project.arch, rename_ccalls=self._should_rename_ccalls)
+            if rewriter.result is not None:
+                _any_update.v = True
+                return rewriter.result
+            return r_expr if r_expr is not expr else None
 
         blocks_by_addr_and_idx = {(node.addr, node.idx): node for node in self.func_graph.nodes()}
-        walker._handle_expr = _handle_expr
+        walker.expr_handlers[VEXCCallExpression] = _handle_VEXCCallExpression
 
         updated = False
         for block in blocks_by_addr_and_idx.values():

angr/analyses/decompiler/ccall_rewriters/rewriter_base.py

@@ -12,9 +12,13 @@ class CCallRewriterBase:
         "result",
     )
 
-    def __init__(self, ccall: ailment.Expr.VEXCCallExpression, arch):
+    def __init__(self, ccall: ailment.Expr.VEXCCallExpression, arch, rename_ccalls: bool = False):
         self.arch = arch
         self.result: ailment.Expr.Expression | None = self._rewrite(ccall)
+        if rename_ccalls and self.result is None and ccall.callee != "_ccall":
+            renamed = ccall.copy()
+            renamed.callee = "_ccall"
+            self.result = renamed
 
     def _rewrite(self, ccall: ailment.Expr.VEXCCallExpression) -> ailment.Expr.Expression | None:
         raise NotImplementedError

angr/analyses/decompiler/clinic.py

@@ -1231,52 +1231,62 @@ class Clinic(Analysis):
     @timethis
     def _replace_tail_jumps_with_calls(self, ail_graph: networkx.DiGraph) -> networkx.DiGraph:
         """
-        Replace tail jumps them with a return statement and a call expression.
+        Rewrite tail jumps to functions as call statements.
         """
         for block in list(ail_graph.nodes()):
-            out_degree = ail_graph.out_degree[block]
-
-            if out_degree != 0:
+            if ail_graph.out_degree[block] > 1:
                 continue
 
             last_stmt = block.statements[-1]
             if isinstance(last_stmt, ailment.Stmt.Jump):
-                # jumping to somewhere outside the current function
-                # rewrite it as a call *if and only if* the target is identified as a function
-                target = last_stmt.target
-                if isinstance(target, ailment.Const):
-                    target_addr = target.value
-                    if self.kb.functions.contains_addr(target_addr):
-                        # replace the statement
-                        target_func = self.kb.functions.get_by_addr(target_addr)
-                        if target_func.returning and self.project.arch.ret_offset is not None:
-                            ret_reg_offset = self.project.arch.ret_offset
-                            ret_expr = ailment.Expr.Register(
-                                None,
-                                None,
-                                ret_reg_offset,
-                                self.project.arch.bits,
-                                reg_name=self.project.arch.translate_register_name(
-                                    ret_reg_offset, size=self.project.arch.bits
-                                ),
-                                **target.tags,
-                            )
-                            call_stmt = ailment.Stmt.Call(
-                                None,
-                                target,
-                                calling_convention=None,  # target_func.calling_convention,
-                                prototype=None,  # target_func.prototype,
-                                ret_expr=ret_expr,
-                                **last_stmt.tags,
-                            )
-                            block.statements[-1] = call_stmt
-
-                            ret_stmt = ailment.Stmt.Return(None, [], **last_stmt.tags)
-                            ret_block = ailment.Block(self.new_block_addr(), 1, statements=[ret_stmt])
-                            ail_graph.add_edge(block, ret_block, type="fake_return")
-                        else:
-                            stmt = ailment.Stmt.Call(None, target, **last_stmt.tags)
-                            block.statements[-1] = stmt
+                targets = [last_stmt.target]
+                replace_last_stmt = True
+            elif isinstance(last_stmt, ailment.Stmt.ConditionalJump):
+                targets = [last_stmt.true_target, last_stmt.false_target]
+                replace_last_stmt = False
+            else:
+                continue
+
+            for target in targets:
+                if not isinstance(target, ailment.Const) or not self.kb.functions.contains_addr(target.value):
+                    continue
+
+                target_func = self.kb.functions.get_by_addr(target.value)
+
+                ret_reg_offset = self.project.arch.ret_offset
+                if target_func.returning and ret_reg_offset is not None:
+                    ret_expr = ailment.Expr.Register(
+                        None,
+                        None,
+                        ret_reg_offset,
+                        self.project.arch.bits,
+                        reg_name=self.project.arch.translate_register_name(ret_reg_offset, size=self.project.arch.bits),
+                        **target.tags,
+                    )
+                else:
+                    ret_expr = None
+
+                call_stmt = ailment.Stmt.Call(
+                    None,
+                    target.copy(),
+                    calling_convention=None,  # target_func.calling_convention,
+                    prototype=None,  # target_func.prototype,
+                    ret_expr=ret_expr,
+                    **last_stmt.tags,
+                )
+
+                if replace_last_stmt:
+                    call_block = block
+                    block.statements[-1] = call_stmt
+                else:
+                    call_block = ailment.Block(self.new_block_addr(), 1, statements=[call_stmt])
+                    ail_graph.add_edge(block, call_block)
+                    target.value = call_block.addr
+
+                if target_func.returning:
+                    ret_stmt = ailment.Stmt.Return(None, [], **last_stmt.tags)
+                    ret_block = ailment.Block(self.new_block_addr(), 1, statements=[ret_stmt])
+                    ail_graph.add_edge(call_block, ret_block, type="fake_return")
 
         return ail_graph
 
@@ -1443,6 +1453,7 @@ class Clinic(Analysis):
         only_consts=False,
         fold_callexprs_into_conditions=False,
         rewrite_ccalls=True,
+        rename_ccalls=True,
         removed_vvar_ids: set[int] | None = None,
         arg_vvars: dict[int, tuple[ailment.Expr.VirtualVariable, SimVariable]] | None = None,
         preserve_vvar_ids: set[int] | None = None,
@@ -1462,6 +1473,7 @@ class Clinic(Analysis):
                 only_consts=only_consts,
                 fold_callexprs_into_conditions=fold_callexprs_into_conditions,
                 rewrite_ccalls=rewrite_ccalls,
+                rename_ccalls=rename_ccalls,
                 removed_vvar_ids=removed_vvar_ids,
                 arg_vvars=arg_vvars,
                 preserve_vvar_ids=preserve_vvar_ids,
@@ -1480,6 +1492,7 @@ class Clinic(Analysis):
         only_consts=False,
         fold_callexprs_into_conditions=False,
         rewrite_ccalls=True,
+        rename_ccalls=True,
         removed_vvar_ids: set[int] | None = None,
         arg_vvars: dict[int, tuple[ailment.Expr.VirtualVariable, SimVariable]] | None = None,
         preserve_vvar_ids: set[int] | None = None,
@@ -1504,6 +1517,7 @@ class Clinic(Analysis):
             fold_callexprs_into_conditions=fold_callexprs_into_conditions,
             use_callee_saved_regs_at_return=not self._register_save_areas_removed,
             rewrite_ccalls=rewrite_ccalls,
+            rename_ccalls=rename_ccalls,
             removed_vvar_ids=removed_vvar_ids,
             arg_vvars=arg_vvars,
             secondary_stackvars=self.secondary_stackvars,

angr/analyses/decompiler/optimization_passes/ite_region_converter.py

@@ -296,7 +296,7 @@ class ITERegionConverter(OptimizationPass):
                 )
 
             if len(new_src_and_vvars) == 1:
-                new_assignment = Assignment(
+                new_stmt = Assignment(
                     stmt.idx,
                     stmt.dst,
                     new_src_and_vvars[0][1],
@@ -309,13 +309,13 @@ class ITERegionConverter(OptimizationPass):
                     new_src_and_vvars,
                     **stmt.src.tags,
                 )
-                new_assignment = Assignment(
+                new_stmt = Assignment(
                     stmt.idx,
                     stmt.dst,
                     new_phi,
                     **stmt.tags,
                 )
-            stmts.append(new_assignment)
+            stmts.append(new_stmt)
         new_region_tail = Block(region_tail.addr, region_tail.original_size, statements=stmts, idx=region_tail.idx)
 
         #

angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py

@@ -864,7 +864,7 @@ class LoweredSwitchSimplifier(StructuringOptimizationPass):
         next_node_addr = last_block.addr
 
         while next_node_addr is not None and next_node_addr in ca_others:
-            onode, value, target, target_idx, next_node_addr = ca_others[next_node_addr]
+            onode, _value, target, target_idx, next_node_addr = ca_others[next_node_addr]
             onode: Block
 
             if first_nonlabel_nonphi_statement(onode) is not onode.statements[-1]:
@@ -893,7 +893,7 @@ class LoweredSwitchSimplifier(StructuringOptimizationPass):
 
         # default nodes
         if ca_default:
-            onode, value, target, target_idx, _ = ca_default[0]
+            onode, _value, target, target_idx, _ = ca_default[0]
             default_target = next(
                 iter(
                     nn