angr 9.2.176__cp310-abi3-win_amd64.whl → 9.2.178__cp310-abi3-win_amd64.whl

angr/analyses/decompiler/peephole_optimizations/inlined_wcscpy_consolidation.py

@@ -1,13 +1,47 @@
 # pylint:disable=arguments-differ
 from __future__ import annotations
+from typing import TYPE_CHECKING
 
 from angr.ailment.expression import Expression, BinaryOp, Const, Register, StackBaseOffset, UnaryOp, VirtualVariable
-from angr.ailment.statement import Call, Store
+from angr.ailment.statement import Call, Store, Assignment
 
 from angr.sim_type import SimTypePointer, SimTypeWideChar
 from .base import PeepholeOptimizationMultiStmtBase
 from .inlined_wcscpy import InlinedWcscpy
 
+if TYPE_CHECKING:
+    from angr.ailment.statement import Statement
+
+
+def match_statements(stmts: list[Statement], index: int) -> int:
+    ending = index
+    has_wcsncpy = False
+    for i in range(index, len(stmts)):
+        stmt = stmts[i]
+        if isinstance(stmt, Call):
+            if InlinedWcscpy.is_inlined_wcsncpy(stmt):
+                has_wcsncpy = True
+            else:
+                break
+        elif isinstance(stmt, Store):
+            if not isinstance(stmt.data, Const):
+                break
+            _, off = InlinedWcscpyConsolidation._parse_addr(stmt.addr)
+            if off is None:
+                # unsupported offset - bail
+                break
+        elif (
+            isinstance(stmt, Assignment)
+            and isinstance(stmt.dst, VirtualVariable)
+            and stmt.dst.was_stack
+            and isinstance(stmt.src, Const)
+        ):
+            pass
+        else:
+            break
+        ending = i + 1
+    return ending - index if has_wcsncpy and ending - index >= 2 else 0
+
 
 class InlinedWcscpyConsolidation(PeepholeOptimizationMultiStmtBase):
     """
@@ -17,12 +51,141 @@ class InlinedWcscpyConsolidation(PeepholeOptimizationMultiStmtBase):
     __slots__ = ()
 
     NAME = "Consolidate multiple inlined wcsncpy calls"
-    stmt_classes = ((Call, Call), (Call, Store))
+    stmt_classes = (match_statements,)
 
     def optimize(  # type:ignore
-        self, stmts: list[Call], stmt_idx: int | None = None, block=None, **kwargs
+        self, stmts: list[Call | Store | Assignment], stmt_idx: int | None = None, block=None, **kwargs
     ):  # pylint:disable=unused-argument
-        last_stmt, stmt = stmts
+        reordered_stmts = self._reorder_stmts(stmts)
+        if not reordered_stmts or len(reordered_stmts) <= 1:
+            return None
+
+        new_stmts = []
+        optimized = False
+        stop = False
+        while not stop:
+            new_stmts = []
+            stop = True
+            for i, stmt0 in enumerate(reordered_stmts):
+                if i == len(reordered_stmts) - 1:
+                    new_stmts.append(reordered_stmts[i])
+                    break
+                stmt1 = reordered_stmts[i + 1]
+                opt_stmts = self._optimize_pair(stmt0, stmt1)
+                if opt_stmts is None:
+                    new_stmts.append(stmt0)
+                else:
+                    new_stmts += opt_stmts
+                    # start again from the beginning
+                    optimized = True
+                    stop = False
+                    reordered_stmts = new_stmts + reordered_stmts[i + 2 :]
+                    break
+
+        return new_stmts if optimized and new_stmts else None
+
+    def _reorder_stmts(self, stmts: list[Call | Store | Assignment]) -> list[Call | Store] | None:
+        """
+        Order a list of statements based on ascending addresses of their destination buffers.
+        """
+
+        if not all(
+            (
+                InlinedWcscpy.is_inlined_wcsncpy(s)
+                or (isinstance(s, Store) and isinstance(s.data, Const))
+                or (
+                    isinstance(s, Assignment)
+                    and isinstance(s.dst, VirtualVariable)
+                    and s.dst.was_stack
+                    and isinstance(s.src, Const)
+                )
+            )
+            for s in stmts
+        ):
+            return None
+        offset_to_stmt = {}
+        updated_offsets: set[int] = set()
+        known_base = None
+        for stmt in stmts:
+            if isinstance(stmt, Call):
+                assert (
+                    stmt.args is not None
+                    and len(stmt.args) == 3
+                    and stmt.args[0] is not None
+                    and stmt.args[2] is not None
+                )
+                base, off = self._parse_addr(stmt.args[0])
+                store_size = stmt.args[2].value * 2 if isinstance(stmt.args[2], Const) else None
+            elif isinstance(stmt, Store):
+                base, off = self._parse_addr(stmt.addr)
+                store_size = stmt.size
+            elif isinstance(stmt, Assignment):
+                base, off = self._parse_addr(stmt.dst)
+                store_size = stmt.dst.size
+            else:
+                # unexpected!
+                return None
+            if off is None or store_size is None:
+                # bad offset or size - bail
+                return None
+            if known_base is None:
+                known_base = base
+            elif not base.likes(known_base):
+                # bail
+                return None
+            if off in offset_to_stmt:
+                # duplicate offset - bail
+                return None
+            assert isinstance(store_size, int)
+            for i in range(store_size):
+                if off + i in updated_offsets:
+                    # overlapping store - bail
+                    return None
+                updated_offsets.add(off + i)
+
+            offset_to_stmt[off] = stmt
+
+        return [offset_to_stmt[k] for k in sorted(offset_to_stmt)]
+
+    def _optimize_pair(
+        self, last_stmt: Call | Store | Assignment, stmt: Call | Store | Assignment
+    ) -> list[Call] | None:
+        # convert (store, wcsncpy()) to (wcsncpy(), store) if they do not overlap
+        if (
+            isinstance(stmt, Call)
+            and InlinedWcscpy.is_inlined_wcsncpy(stmt)
+            and stmt.args is not None
+            and len(stmt.args) == 3
+            and isinstance(stmt.args[2], Const)
+            and isinstance(stmt.args[2].value, int)
+            and isinstance(last_stmt, (Store, Assignment))
+        ):
+            if isinstance(last_stmt, Store) and isinstance(last_stmt.data, Const):
+                store_addr = last_stmt.addr
+                store_size = last_stmt.size
+            elif isinstance(last_stmt, Assignment):
+                store_addr = last_stmt.dst
+                store_size = last_stmt.dst.size
+            else:
+                return None
+            # check if they overlap
+            wcsncpy_addr = stmt.args[0]
+            wcsncpy_size = stmt.args[2].value * 2
+            delta = self._get_delta(store_addr, wcsncpy_addr)
+            if delta is not None:
+                if (0 <= delta <= store_size) or (delta < 0 and -delta <= wcsncpy_size):
+                    # they overlap, do not switch
+                    pass
+                else:
+                    last_stmt, stmt = stmt, last_stmt
+
+        # swap two statements if they are out of order
+        if InlinedWcscpy.is_inlined_wcsncpy(last_stmt) and InlinedWcscpy.is_inlined_wcsncpy(stmt):
+            assert last_stmt.args is not None and stmt.args is not None
+            delta = self._get_delta(last_stmt.args[0], stmt.args[0])
+            if delta is not None and delta < 0:
+                last_stmt, stmt = stmt, last_stmt
+
         if InlinedWcscpy.is_inlined_wcsncpy(last_stmt):
             assert last_stmt.args is not None
             assert self.kb is not None
@@ -55,6 +218,22 @@ class InlinedWcscpyConsolidation(PeepholeOptimizationMultiStmtBase):
                         )
                     if r and s is not None:
                         new_str = s_last + s
+            elif (
+                isinstance(stmt, Assignment)
+                and isinstance(stmt.dst, VirtualVariable)
+                and isinstance(stmt.src, Const)
+                and isinstance(stmt.src.value, int)
+            ):
+                # consolidating a call and an assignment, in case the assignment statement is storing the suffix of a
+                # string (but the suffix is too short to qualify an inlined strcpy optimization)
+                addr_curr = stmt.dst
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    r, s = InlinedWcscpy.is_integer_likely_a_wide_string(
+                        stmt.src.value, stmt.dst.size, self.project.arch.memory_endness, min_length=1  # type:ignore
+                    )
+                    if r and s is not None:
+                        new_str = s_last + s
 
             if new_str is not None:
                 assert self.project is not None
@@ -83,17 +262,21 @@ class InlinedWcscpyConsolidation(PeepholeOptimizationMultiStmtBase):
 
     @staticmethod
     def _parse_addr(addr: Expression) -> tuple[Expression, int]:
+        # we force the base to 64-bit because it does not really matter when we use it
+
+        if isinstance(addr, VirtualVariable) and addr.was_stack:
+            return StackBaseOffset(None, 64, 0), addr.stack_offset
         if isinstance(addr, Register):
             return addr, 0
         if isinstance(addr, StackBaseOffset):
-            return StackBaseOffset(None, addr.bits, 0), addr.offset
+            return StackBaseOffset(None, 64, 0), addr.offset
         if (
             isinstance(addr, UnaryOp)
             and addr.op == "Reference"
             and isinstance(addr.operand, VirtualVariable)
             and addr.operand.was_stack
         ):
-            return StackBaseOffset(None, addr.bits, 0), addr.operand.stack_offset
+            return StackBaseOffset(None, 64, 0), addr.operand.stack_offset
         if isinstance(addr, BinaryOp):
             if addr.op == "Add" and isinstance(addr.operands[1], Const) and isinstance(addr.operands[1].value, int):
                 base_0, offset_0 = InlinedWcscpyConsolidation._parse_addr(addr.operands[0])

angr/analyses/decompiler/peephole_optimizations/remove_redundant_shifts_around_comparators.py

@@ -16,7 +16,9 @@ class RemoveRedundantShiftsAroundComparators(PeepholeOptimizationExprBase):
     NAME = "Remove redundant bitshifts for operands around a comparator"
     expr_classes = (BinaryOp,)  # all expressions are allowed
 
-    def optimize(self, expr: BinaryOp, **kwargs):
+    def optimize(
+        self, expr: BinaryOp, stmt_idx: int | None = None, block=None, **kwargs
+    ):  # pylint:disable=unused-argument
         # (expr_0 << N) < (expr_1 << N)  ==> expr_0 << expr_1
         # FIXME: This optimization is unsafe but seems to work for all existing case
         if expr.op in {"CmpLE", "CmpLT", "CmpEQ", "CmpNE", "CmpGE", "CmpGT"}:
@@ -41,4 +43,73 @@ class RemoveRedundantShiftsAroundComparators(PeepholeOptimizationExprBase):
                     **expr.tags,
                 )
 
+            # might have been rewritten to multiplications
+            if (
+                isinstance(op0, BinaryOp)
+                and op0.op == "Mul"
+                and isinstance(op0.operands[1], Const)
+                and op0.operands[1].is_int
+            ):
+                op0_op = op0.operands[0]
+                mul_0 = op0.operands[1].value_int
+                mul_1 = None
+                op1_op = None
+                if (
+                    isinstance(op1, BinaryOp)
+                    and op1.op == "Mul"
+                    and isinstance(op1.operands[1], Const)
+                    and op1.operands[1].is_int
+                ):
+                    op1_op = op1.operands[0]
+                    mul_1 = op1.operands[1].value_int
+                elif isinstance(op1, Const):
+                    op1_op = None
+                    mul_1 = op1.value_int
+
+                if mul_1 is not None:
+                    common_shift_amount = self._get_common_shift_amount(mul_0, mul_1)
+                    if common_shift_amount > 0:
+                        new_mul_0 = Const(None, None, mul_0 >> common_shift_amount, expr.bits)
+                        new_mul_1 = Const(None, None, mul_1 >> common_shift_amount, expr.bits)
+                        new_cmp_0 = BinaryOp(op0.idx, "Mul", [op0_op, new_mul_0], op0.signed, bits=op0.bits, **op0.tags)
+                        new_cmp_1 = (
+                            BinaryOp(op1.idx, "Mul", [op1_op, new_mul_1], op1.signed, bits=op1.bits, **op1.tags)
+                            if op1_op is not None
+                            else new_mul_1
+                        )
+                        return BinaryOp(
+                            expr.idx,
+                            expr.op,
+                            [new_cmp_0, new_cmp_1],
+                            expr.signed,
+                            bits=expr.bits,
+                            floating_point=expr.floating_point,
+                            rounding_mode=expr.rounding_mode,
+                            **expr.tags,
+                        )
+
         return None
+
+    @staticmethod
+    def _get_common_shift_amount(v0: int, v1: int) -> int:
+        if v0 == 0 or v1 == 0:
+            return 0
+        shift_amount = 0
+        while (v0 & 1) == 0 and (v1 & 1) == 0:
+            if v0 & 0xFFFF == 0 and v1 & 0xFFFF == 0:
+                v0 >>= 16
+                v1 >>= 16
+                shift_amount += 16
+            elif v0 & 0xFF == 0 and v1 & 0xFF == 0:
+                v0 >>= 8
+                v1 >>= 8
+                shift_amount += 8
+            elif v0 & 0xF == 0 and v1 & 0xF == 0:
+                v0 >>= 4
+                v1 >>= 4
+                shift_amount += 4
+            else:
+                v0 >>= 1
+                v1 >>= 1
+                shift_amount += 1
+        return shift_amount

angr/analyses/decompiler/presets/basic.py

@@ -7,6 +7,7 @@ from angr.analyses.decompiler.optimization_passes import (
     BasePointerSaveSimplifier,
     ConstantDereferencesSimplifier,
     RetAddrSaveSimplifier,
+    RegisterSaveAreaSimplifierAdvanced,
     X86GccGetPcSimplifier,
     CallStatementRewriter,
     SwitchReusedEntryRewriter,
@@ -23,6 +24,7 @@ preset_basic = DecompilationPreset(
         BasePointerSaveSimplifier,
         ConstantDereferencesSimplifier,
         RetAddrSaveSimplifier,
+        RegisterSaveAreaSimplifierAdvanced,
         X86GccGetPcSimplifier,
         CallStatementRewriter,
         SwitchReusedEntryRewriter,

angr/analyses/decompiler/presets/fast.py

@@ -22,6 +22,7 @@ from angr.analyses.decompiler.optimization_passes import (
     DeadblockRemover,
     SwitchReusedEntryRewriter,
     ConditionConstantPropagation,
+    RegisterSaveAreaSimplifierAdvanced,
     DetermineLoadSizes,
     PostStructuringPeepholeOptimizationPass,
 )
@@ -33,6 +34,7 @@ preset_fast = DecompilationPreset(
         RegisterSaveAreaSimplifier,
         StackCanarySimplifier,
         WinStackCanarySimplifier,
+        RegisterSaveAreaSimplifierAdvanced,
         BasePointerSaveSimplifier,
         ConstantDereferencesSimplifier,
         RetAddrSaveSimplifier,

angr/analyses/decompiler/presets/full.py

@@ -4,6 +4,7 @@ from angr.analyses.decompiler.optimization_passes import (
     RegisterSaveAreaSimplifier,
     StackCanarySimplifier,
     WinStackCanarySimplifier,
+    RegisterSaveAreaSimplifierAdvanced,
     BasePointerSaveSimplifier,
     DivSimplifier,
     ModSimplifier,
@@ -38,6 +39,7 @@ preset_full = DecompilationPreset(
         RegisterSaveAreaSimplifier,
         StackCanarySimplifier,
         WinStackCanarySimplifier,
+        RegisterSaveAreaSimplifierAdvanced,
         BasePointerSaveSimplifier,
         DivSimplifier,
         ModSimplifier,

angr/analyses/decompiler/utils.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 import pathlib
 import copy
+from types import FunctionType
 from typing import Any
 from collections.abc import Iterable
 import logging
@@ -958,9 +959,15 @@ def peephole_optimize_multistmts(block, stmt_opts):
             for opt in stmt_opts:
                 matched = False
                 stmt_seq_len = None
-                for stmt_class_seq in opt.stmt_classes:
-                    if match_stmt_classes(statements, stmt_idx, stmt_class_seq):
-                        stmt_seq_len = len(stmt_class_seq)
+                for stmt_class_seq_or_method in opt.stmt_classes:
+                    if isinstance(stmt_class_seq_or_method, FunctionType):
+                        r = stmt_class_seq_or_method(statements, stmt_idx)
+                        if r > 0:
+                            stmt_seq_len = r
+                            matched = True
+                            break
+                    elif match_stmt_classes(statements, stmt_idx, stmt_class_seq_or_method):
+                        stmt_seq_len = len(stmt_class_seq_or_method)
                         matched = True
                         break
 

angr/analyses/flirt/flirt.py

@@ -35,7 +35,7 @@ class FlirtAnalysis(Analysis):
       current binary, and then match all possible signatures for the architecture.
     """
 
-    def __init__(self, sig: FlirtSignature | str | None = None, max_mismatched_bytes: int = 0):
+    def __init__(self, sig: FlirtSignature | str | None = None, max_mismatched_bytes: int = 0, dry_run: bool = False):
 
         from angr.flirt import FLIRT_SIGNATURES_BY_ARCH  # pylint:disable=import-outside-toplevel
 
@@ -94,9 +94,10 @@ class FlirtAnalysis(Analysis):
                 sig_ = path_to_sig.get(max_suggestion_sig_path)
                 assert sig_ is not None
                 _l.info("Applying FLIRT signature %s for library %s.", sig_, lib)
-                self._apply_changes(
-                    sig_.sig_name if not self._temporary_sig else None, sig_to_suggestions[max_suggestion_sig_path]
-                )
+                if not dry_run:
+                    self._apply_changes(
+                        sig_.sig_name if not self._temporary_sig else None, sig_to_suggestions[max_suggestion_sig_path]
+                    )
                 self.matched_suggestions[lib] = (sig_, sig_to_suggestions[max_suggestion_sig_path])
 
     def _find_hits_by_strings(self, regions: list[bytes]) -> Generator[FlirtSignature]:

angr/analyses/s_propagator.py

@@ -15,6 +15,7 @@ from angr.ailment.expression import (
     Load,
     Convert,
     Expression,
+    Tmp,
 )
 from angr.ailment.statement import Assignment, Store, Return, Jump, ConditionalJump
 
@@ -164,7 +165,7 @@ class SPropagatorAnalysis(Analysis):
                 assert v is not None
                 const_vvars[vvar_id] = v
                 for vvar_at_use, useloc in vvar_uselocs[vvar_id]:
-                    replacements[useloc][vvar_at_use] = v
+                    self.replace(replacements, useloc, vvar_at_use, v)
                 continue
 
             v = phi_assignment_get_src(stmt)
@@ -185,7 +186,7 @@ class SPropagatorAnalysis(Analysis):
                         const_value = const_vvars[next(iter(all_int_src_varids))]
                         const_vvars[vvar.varid] = const_value
                         for vvar_at_use, useloc in vvar_uselocs[vvar.varid]:
-                            replacements[useloc][vvar_at_use] = const_value
+                            self.replace(replacements, useloc, vvar_at_use, const_value)
 
         # function mode only
         if self.mode == "function":
@@ -226,7 +227,7 @@ class SPropagatorAnalysis(Analysis):
                     if can_replace:
                         # we can propagate this load because there is no store between its def and use
                         for vvar_used, vvar_useloc in vvar_uselocs_set:
-                            replacements[vvar_useloc][vvar_used] = stmt.src
+                            self.replace(replacements, vvar_useloc, vvar_used, stmt.src)
                         continue
 
                 if (
@@ -241,7 +242,7 @@ class SPropagatorAnalysis(Analysis):
                     uselocs = {loc for _, loc in vvar_uselocs_set}
                     if self.is_vvar_used_for_addr_loading_switch_case(uselocs, blocks) and not has_tmp_expr(stmt.src):
                         for vvar_used, vvar_useloc in vvar_uselocs_set:
-                            replacements[vvar_useloc][vvar_used] = stmt.src
+                            self.replace(replacements, vvar_useloc, vvar_used, stmt.src)
                         # mark the vvar as dead and should be removed
                         self.model.dead_vvar_ids.add(vvar.varid)
                         continue
@@ -255,7 +256,7 @@ class SPropagatorAnalysis(Analysis):
                             and not has_tmp_expr(stmt.src)
                         ):
                             # we can propagate this load because there is no store between its def and use
-                            replacements[vvar_useloc][vvar_used] = stmt.src
+                            self.replace(replacements, vvar_useloc, vvar_used, stmt.src)
                             continue
 
                         if is_const_and_vvar_assignment(stmt) and not has_tmp_expr(stmt.src):
@@ -272,9 +273,9 @@ class SPropagatorAnalysis(Analysis):
                                     and stmt.src.oident == useloc_stmt.dst.oident
                                     and stmt.src.category == useloc_stmt.dst.category
                                 ):
-                                    replacements[vvar_useloc][vvar_used] = stmt.src
+                                    self.replace(replacements, vvar_useloc, vvar_used, stmt.src)
                             else:
-                                replacements[vvar_useloc][vvar_used] = stmt.src
+                                self.replace(replacements, vvar_useloc, vvar_used, stmt.src)
                             continue
 
                     else:
@@ -288,7 +289,7 @@ class SPropagatorAnalysis(Analysis):
                                 # this vvar is used once if we exclude its uses at ret sites or jump sites. we can
                                 # propagate it
                                 for vvar_used, vvar_useloc in vvar_uselocs_set:
-                                    replacements[vvar_useloc][vvar_used] = stmt.src
+                                    self.replace(replacements, vvar_useloc, vvar_used, stmt.src)
                                 continue
 
                             if (
@@ -304,7 +305,7 @@ class SPropagatorAnalysis(Analysis):
                                     # remove duplicate use locs (e.g., if the variable is used multiple times by the
                                     # same statement) - but ensure stmt is simple enough
                                     for vvar_used, vvar_useloc in vvar_uselocs_set:
-                                        replacements[vvar_useloc][vvar_used] = stmt.src
+                                        self.replace(replacements, vvar_useloc, vvar_used, stmt.src)
                                     continue
 
                 # special logic for global variables: if it's used once or multiple times, and the variable is never
@@ -332,7 +333,7 @@ class SPropagatorAnalysis(Analysis):
                             )
                         if not gv_updated:
                             for vvar_used, vvar_useloc in vvar_uselocs_set:
-                                replacements[vvar_useloc][vvar_used] = stmt.src
+                                self.replace(replacements, vvar_useloc, vvar_used, stmt.src)
                             continue
 
         for vvar_id, uselocs in vvar_uselocs.items():
@@ -353,7 +354,7 @@ class SPropagatorAnalysis(Analysis):
                             if sp_bits is not None and vvar.bits < sp_bits:
                                 # truncation needed
                                 v = Convert(None, sp_bits, vvar.bits, False, v)
-                            replacements[useloc][vvar_at_use] = v
+                            self.replace(replacements, useloc, vvar_at_use, v)
                     continue
                 if not self._bp_as_gpr and vvar.oident == self.project.arch.bp_offset:
                     bp_bits = (
@@ -368,7 +369,7 @@ class SPropagatorAnalysis(Analysis):
                             if bp_bits is not None and vvar.bits < bp_bits:
                                 # truncation needed
                                 v = Convert(None, bp_bits, vvar.bits, False, v)
-                            replacements[useloc][vvar_at_use] = v
+                            self.replace(replacements, useloc, vvar_at_use, v)
                     continue
 
         # find all tmp definitions
@@ -390,9 +391,8 @@ class SPropagatorAnalysis(Analysis):
                     if r:
                         # we can propagate it!
                         for tmp_used, tmp_use_stmtidx in tmp_uses:
-                            replacements[
-                                CodeLocation(block_loc.block_addr, tmp_use_stmtidx, block_idx=block_loc.block_idx)
-                            ][tmp_used] = stmt.src
+                            loc = CodeLocation(block_loc.block_addr, tmp_use_stmtidx, block_idx=block_loc.block_idx)
+                            self.replace(replacements, loc, tmp_used, stmt.src)
                         continue
 
                     r = is_const_vvar_tmp_assignment(stmt)
@@ -404,9 +404,8 @@ class SPropagatorAnalysis(Analysis):
                             v = stmt.src
 
                         for tmp_used, tmp_use_stmtidx in tmp_uses:
-                            replacements[
-                                CodeLocation(block_loc.block_addr, tmp_use_stmtidx, block_idx=block_loc.block_idx)
-                            ][tmp_used] = v
+                            loc = CodeLocation(block_loc.block_addr, tmp_use_stmtidx, block_idx=block_loc.block_idx)
+                            self.replace(replacements, loc, tmp_used, v)
                         continue
 
                     if len(tmp_uses) <= 2 and is_const_vvar_load_dirty_assignment(stmt):
@@ -422,9 +421,8 @@ class SPropagatorAnalysis(Analysis):
                                 # we can propagate this load because either we do not consider memory aliasing problem
                                 # within the same instruction (blocks must be originally lifted with
                                 # CROSS_INSN_OPT=False), or there is no store between its def and use.
-                                replacements[
-                                    CodeLocation(block_loc.block_addr, tmp_use_stmtidx, block_idx=block_loc.block_idx)
-                                ][tmp_used] = stmt.src
+                                loc = CodeLocation(block_loc.block_addr, tmp_use_stmtidx, block_idx=block_loc.block_idx)
+                                self.replace(replacements, loc, tmp_used, stmt.src)
 
         self.model.replacements = replacements
 
@@ -538,5 +536,9 @@ class SPropagatorAnalysis(Analysis):
 
         return g
 
+    @staticmethod
+    def replace(replacements: dict, loc, expr: VirtualVariable | Tmp, value: Expression) -> None:
+        replacements[loc][expr] = value
+
 
 register_analysis(SPropagatorAnalysis, "SPropagator")

angr/analyses/smc.py

@@ -112,9 +112,8 @@ class SelfModifyingCodeAnalysis(Analysis):
         if subject is None:
             subject = self.project.entry
         if isinstance(subject, str):
-            try:
-                addr = self.project.kb.labels.lookup(subject)
-            except KeyError:
+            addr = self.project.kb.labels.lookup(subject)
+            if addr is None:
                 addr = self.project.kb.functions[subject].addr
         elif isinstance(subject, Function):
             addr = subject.addr

angr/analyses/variable_recovery/engine_ail.py

@@ -171,6 +171,45 @@ class SimEngineVRAIL(
             if isinstance(funcaddr_typevar, typevars.TypeVariable):
                 load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
                 self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
+        elif isinstance(target, str):
+            # special handling for some intrinsics
+            match target:
+                case (
+                    "InterlockedExchange8"
+                    | "InterlockedExchange16"
+                    | "InterlockedExchange"
+                    | "InterlockedExchange64"
+                    | "InterlockedCompareExchange16"
+                    | "InterlockedCompareExchange"
+                    | "InterlockedCompareExchange64"
+                    | "InterlockedCompareExchange128"
+                    | "InterlockedExchangeAdd"
+                    | "InterlockedExchangeAdd64"
+                ):
+                    arg_tv = (
+                        args[0].typevar
+                        if args[0].typevar is not None
+                        else args[1].typevar if args[1].typevar is not None else None
+                    )
+                    if arg_tv is not None:
+                        ret_ty = self._create_access_typevar(
+                            arg_tv, False, args[0].data.size() // self.arch.byte_width, 0
+                        )
+                        return RichR(self.state.top(ret_expr_bits), typevar=ret_ty)
+                case (
+                    "InterlockedIncrement"
+                    | "InterlockedIncrement16"
+                    | "InterlockedIncrement64"
+                    | "InterlockedDecrement"
+                    | "InterlockedDecrement16"
+                    | "InterlockedDecrement64"
+                ):
+                    arg_tv = args[0].typevar if args[0].typevar is not None else None
+                    if arg_tv is not None:
+                        ret_ty = self._create_access_typevar(
+                            arg_tv, False, args[0].data.size() // self.arch.byte_width, 0
+                        )
+                        return RichR(self.state.top(ret_expr_bits), typevar=ret_ty)
 
         # discover the prototype
         prototype: SimTypeFunction | None = None

angr/emulator.py

@@ -95,7 +95,8 @@ class Emulator:
         num_inst_executed: int = 0
         while self._state.history.jumpkind != "Ijk_Exit":
             # Check if there is a breakpoint at the current address
-            if completed_engine_execs > 0 and self._state.addr in self._engine.get_breakpoints():
+            addr_with_lower_bit_cleared = self._state.addr & ~1
+            if completed_engine_execs > 0 and addr_with_lower_bit_cleared in self._engine.get_breakpoints():
                 return EmulatorStopReason.BREAKPOINT
 
             # Check if we've already executed the requested number of instructions

angr/engines/hook.py

@@ -54,7 +54,7 @@ class HooksMixin(SuccessorsEngine, ProcedureMixin):
         if procedure is None:
             procedure = self._lookup_hook(state, procedure)
         if procedure is None:
-            return super().process_successors(successors, procedure=procedure, **kwargs)
+            return super().process_successors(successors, **kwargs)
 
         if isinstance(procedure.addr, SootAddressDescriptor):
             l.debug("Running %s (originally at %r)", repr(procedure), procedure.addr)