angr 9.2.176__tar.gz → 9.2.177__tar.gz

{angr-9.2.176 → angr-9.2.177}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.176
+Version: 9.2.177
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -16,12 +16,12 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: archinfo==9.2.176
+Requires-Dist: archinfo==9.2.177
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.176
-Requires-Dist: cle==9.2.176
+Requires-Dist: claripy==9.2.177
+Requires-Dist: cle==9.2.177
 Requires-Dist: msgspec
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
@@ -31,7 +31,7 @@ Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
 Requires-Dist: pypcode<4.0,>=3.2.1
-Requires-Dist: pyvex==9.2.176
+Requires-Dist: pyvex==9.2.177
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy

{angr-9.2.176 → angr-9.2.177}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.176"
+__version__ = "9.2.177"
 
 if bytes is str:
     raise Exception(

{angr-9.2.176 → angr-9.2.177}/angr/analyses/decompiler/ail_simplifier.py

@@ -1426,7 +1426,7 @@ class AILSimplifier(Analysis):
 
         for eq in equivalence:
             # register variable == Call
-            if isinstance(eq.atom0, VirtualVariable) and eq.atom0.was_reg:
+            if isinstance(eq.atom0, VirtualVariable) and (eq.atom0.was_reg or eq.atom0.was_tmp):
                 if isinstance(eq.atom1, Call):
                     # register variable = Call
                     call: Expression = eq.atom1

angr-9.2.177/angr/analyses/decompiler/peephole_optimizations/cas_intrinsics.py

@@ -0,0 +1,182 @@
+# pylint:disable=arguments-differ,too-many-boolean-expressions
+from __future__ import annotations
+
+from angr.ailment import Const
+from angr.ailment.expression import BinaryOp, Load, Expression, Tmp
+from angr.ailment.statement import CAS, ConditionalJump, Statement, Assignment, Call
+
+from .base import PeepholeOptimizationMultiStmtBase
+
+
+_INTRINSICS_NAMES = {
+    "xchg8": {"Win32": "InterlockedExchange8", "Linux": "atomic_exchange"},
+    "xchg16": {"Win32": "InterlockedExchange16", "Linux": "atomic_exchange"},
+    "xchg32": {"Win32": "InterlockedExchange", "Linux": "atomic_exchange"},
+    "xchg64": {"Win32": "InterlockedExchange64", "Linux": "atomic_exchange"},
+    "cmpxchg16": {"Win32": "InterlockedCompareExchange16", "Linux": "atomic_compare_exchange"},
+    "cmpxchg32": {"Win32": "InterlockedCompareExchange", "Linux": "atomic_compare_exchange"},
+    "cmpxchg64": {"Win32": "InterlockedCompareExchange64", "Linux": "atomic_compare_exchange"},
+    "cmpxchg128": {"Win32": "InterlockedCompareExchange128", "Linux": "atomic_compare_exchange"},
+    "lock_inc16": {"Win32": "InterlockedIncrement16", "Linux": "atomic_fetch_add"},
+    "lock_inc32": {"Win32": "InterlockedIncrement", "Linux": "atomic_fetch_add"},
+    "lock_inc64": {"Win32": "InterlockedIncrement64", "Linux": "atomic_fetch_add"},
+    "lock_dec16": {"Win32": "InterlockedDecrement16", "Linux": "atomic_fetch_dec"},
+    "lock_dec32": {"Win32": "InterlockedDecrement", "Linux": "atomic_fetch_dec"},
+    "lock_dec64": {"Win32": "InterlockedDecrement64", "Linux": "atomic_fetch_dec"},
+    "lock_xadd32": {"Win32": "InterlockedExchangeAdd", "Linux": "atomic_exchange_add"},
+    "lock_xadd64": {"Win32": "InterlockedExchangeAdd64", "Linux": "atomic_exchange_add"},
+}
+
+
+class CASIntrinsics(PeepholeOptimizationMultiStmtBase):
+    """
+    Rewrite lock-prefixed instructions (or rather, their VEX/AIL forms) into intrinsic calls.
+
+    Case 1.
+
+                 mov eax, r12d
+    0x140014b57: xchg eax, [0x14000365f8]
+
+    LABEL_0x140014b57:
+    CAS(0x1400365f8<64>, Conv(64->32, vvar_365{reg 112}), Load(addr=0x1400365f8<64>, size=4, endness=Iend_LE),
+        vvar_27756)
+    if (CasCmpNE(vvar_27756, g_1400365f8))
+        goto LABEL_0x140014b57;
+
+    => vvar_27756 = _InterlockedExchange(0x1400365f8, vvar_365{reg 112})
+
+
+    Case 2.
+
+    lock cmpxchg cs:g_WarbirdSecureFunctionsLock, r14d
+
+    CAS(0x1400365f8<64>, 0x1<32>, 0x0<32>, vvar_27751)
+
+    => var_27751 = _InterlockedCompareExchange(0x1400365f8, 0x1<32>, 0x0<32>)
+    """
+
+    __slots__ = ()
+
+    NAME = "Rewrite compare-and-swap instructions into intrinsics."
+    stmt_classes = ((CAS, ConditionalJump), (CAS, Statement))
+
+    def optimize(self, stmts: list[Statement], stmt_idx: int | None = None, block=None, **kwargs):
+        assert len(stmts) == 2
+        cas_stmt = stmts[0]
+        next_stmt = stmts[1]
+        assert isinstance(cas_stmt, CAS)
+
+        # TODO: We ignored endianness. Are there cases where the endianness is different from the host's?
+
+        if (
+            isinstance(next_stmt, ConditionalJump)
+            and isinstance(next_stmt.condition, BinaryOp)
+            and next_stmt.condition.op == "CasCmpNE"
+            and next_stmt.ins_addr == cas_stmt.ins_addr
+        ):
+            addr = cas_stmt.addr
+            expd_lo = self._resolve_tmp_expr(cas_stmt.expd_lo, block)
+            next_stmt_cond_op1 = self._resolve_tmp_expr(next_stmt.condition.operands[1], block)
+            if (
+                isinstance(expd_lo, Load)
+                and expd_lo.addr.likes(addr)
+                and isinstance(next_stmt_cond_op1, Load)
+                and next_stmt_cond_op1.addr.likes(addr)
+                and cas_stmt.old_lo.likes(next_stmt.condition.operands[0])
+                and cas_stmt.old_hi is None
+            ):
+                # TODO: Support cases where cas_stmt.old_hi is not None
+                # Case 1
+
+                call_expr = None
+                if isinstance(cas_stmt.data_lo, BinaryOp):
+                    if cas_stmt.data_lo.op == "Add" and cas_stmt.data_lo.operands[0].likes(cas_stmt.expd_lo):
+                        if isinstance(cas_stmt.data_lo.operands[1], Const) and cas_stmt.data_lo.operands[1].value == 1:
+                            # lock inc
+                            call_expr = Call(
+                                cas_stmt.idx,
+                                self._get_instrincs_name(f"lock_inc{cas_stmt.bits}"),
+                                args=[cas_stmt.addr],
+                                bits=cas_stmt.bits,
+                                ins_addr=cas_stmt.ins_addr,
+                            )
+                        else:
+                            # lock xadd
+                            call_expr = Call(
+                                cas_stmt.idx,
+                                self._get_instrincs_name(f"lock_xadd{cas_stmt.bits}"),
+                                args=[cas_stmt.addr, cas_stmt.data_lo.operands[1]],
+                                bits=cas_stmt.bits,
+                                ins_addr=cas_stmt.ins_addr,
+                            )
+                    elif (
+                        cas_stmt.data_lo.op == "Sub"
+                        and cas_stmt.data_lo.operands[0].likes(cas_stmt.expd_lo)
+                        and isinstance(cas_stmt.data_lo.operands[1], Const)
+                        and cas_stmt.data_lo.operands[1].value == 1
+                    ):
+                        # lock dec
+                        call_expr = Call(
+                            cas_stmt.idx,
+                            self._get_instrincs_name(f"lock_dec{cas_stmt.bits}"),
+                            args=[cas_stmt.addr],
+                            bits=cas_stmt.bits,
+                            ins_addr=cas_stmt.ins_addr,
+                        )
+
+                if call_expr is None:
+                    call_expr = Call(
+                        cas_stmt.idx,
+                        self._get_instrincs_name(f"xchg{cas_stmt.bits}"),
+                        args=[addr, cas_stmt.data_lo],
+                        bits=cas_stmt.bits,
+                        ins_addr=cas_stmt.ins_addr,
+                    )
+
+                assignment_dst = cas_stmt.expd_lo
+                stmt = Assignment(cas_stmt.idx, assignment_dst, call_expr, **cas_stmt.tags)  # type:ignore
+                return [stmt]
+
+        if next_stmt.ins_addr <= cas_stmt.ins_addr:
+            # avoid matching against statements prematurely
+            return None
+
+        if cas_stmt.old_hi is None:
+            # TODO: Support cases where cas_stmt.old_hi is not None
+            # Case 2
+            call_expr = Call(
+                cas_stmt.idx,
+                self._get_instrincs_name(f"cmpxchg{cas_stmt.bits}"),
+                args=[
+                    cas_stmt.addr,
+                    cas_stmt.data_lo,
+                    cas_stmt.expd_lo,
+                ],
+                bits=cas_stmt.bits,
+                ins_addr=cas_stmt.ins_addr,
+            )
+            assignment_dst = cas_stmt.expd_lo
+            stmt = Assignment(cas_stmt.idx, assignment_dst, call_expr, **cas_stmt.tags)  # type:ignore
+            return [stmt, next_stmt]
+
+        return None
+
+    def _get_instrincs_name(self, mnemonic: str) -> str:
+        if mnemonic in _INTRINSICS_NAMES:
+            os = (
+                self.project.simos.name
+                if self.project is not None and self.project.simos is not None and self.project.simos.name is not None
+                else "Linux"
+            )
+            if os not in _INTRINSICS_NAMES[mnemonic]:
+                os = "Linux"
+            return _INTRINSICS_NAMES[mnemonic][os]
+        return mnemonic
+
+    @staticmethod
+    def _resolve_tmp_expr(expr: Expression, block) -> Expression:
+        if isinstance(expr, Tmp):
+            for stmt in block.statements:
+                if isinstance(stmt, Assignment) and stmt.dst.likes(expr):
+                    return stmt.src
+        return expr

angr-9.2.177/angr/analyses/decompiler/peephole_optimizations/inlined_wcscpy_consolidation.py

@@ -0,0 +1,296 @@
+# pylint:disable=arguments-differ
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+from angr.ailment.expression import Expression, BinaryOp, Const, Register, StackBaseOffset, UnaryOp, VirtualVariable
+from angr.ailment.statement import Call, Store, Assignment
+
+from angr.sim_type import SimTypePointer, SimTypeWideChar
+from .base import PeepholeOptimizationMultiStmtBase
+from .inlined_wcscpy import InlinedWcscpy
+
+if TYPE_CHECKING:
+    from angr.ailment.statement import Statement
+
+
+def match_statements(stmts: list[Statement], index: int) -> int:
+    ending = index
+    has_wcsncpy = False
+    for i in range(index, len(stmts)):
+        stmt = stmts[i]
+        if isinstance(stmt, Call):
+            if InlinedWcscpy.is_inlined_wcsncpy(stmt):
+                has_wcsncpy = True
+            else:
+                break
+        elif isinstance(stmt, Store):
+            if not isinstance(stmt.data, Const):
+                break
+            _, off = InlinedWcscpyConsolidation._parse_addr(stmt.addr)
+            if off is None:
+                # unsupported offset - bail
+                break
+        elif (
+            isinstance(stmt, Assignment)
+            and isinstance(stmt.dst, VirtualVariable)
+            and stmt.dst.was_stack
+            and isinstance(stmt.src, Const)
+        ):
+            pass
+        else:
+            break
+        ending = i + 1
+    return ending - index if has_wcsncpy and ending - index >= 2 else 0
+
+
+class InlinedWcscpyConsolidation(PeepholeOptimizationMultiStmtBase):
+    """
+    Consolidate multiple inlined wcscpy/wcsncpy calls.
+    """
+
+    __slots__ = ()
+
+    NAME = "Consolidate multiple inlined wcsncpy calls"
+    stmt_classes = (match_statements,)
+
+    def optimize(  # type:ignore
+        self, stmts: list[Call | Store | Assignment], stmt_idx: int | None = None, block=None, **kwargs
+    ):  # pylint:disable=unused-argument
+        reordered_stmts = self._reorder_stmts(stmts)
+        if not reordered_stmts or len(reordered_stmts) <= 1:
+            return None
+
+        new_stmts = []
+        optimized = False
+        stop = False
+        while not stop:
+            new_stmts = []
+            stop = True
+            for i, stmt0 in enumerate(reordered_stmts):
+                if i == len(reordered_stmts) - 1:
+                    new_stmts.append(reordered_stmts[i])
+                    break
+                stmt1 = reordered_stmts[i + 1]
+                opt_stmts = self._optimize_pair(stmt0, stmt1)
+                if opt_stmts is None:
+                    new_stmts.append(stmt0)
+                else:
+                    new_stmts += opt_stmts
+                    # start again from the beginning
+                    optimized = True
+                    stop = False
+                    reordered_stmts = new_stmts + reordered_stmts[i + 2 :]
+                    break
+
+        return new_stmts if optimized and new_stmts else None
+
+    def _reorder_stmts(self, stmts: list[Call | Store | Assignment]) -> list[Call | Store] | None:
+        """
+        Order a list of statements based on ascending addresses of their destination buffers.
+        """
+
+        if not all(
+            (
+                InlinedWcscpy.is_inlined_wcsncpy(s)
+                or (isinstance(s, Store) and isinstance(s.data, Const))
+                or (
+                    isinstance(s, Assignment)
+                    and isinstance(s.dst, VirtualVariable)
+                    and s.dst.was_stack
+                    and isinstance(s.src, Const)
+                )
+            )
+            for s in stmts
+        ):
+            return None
+        offset_to_stmt = {}
+        updated_offsets: set[int] = set()
+        known_base = None
+        for stmt in stmts:
+            if isinstance(stmt, Call):
+                assert (
+                    stmt.args is not None
+                    and len(stmt.args) == 3
+                    and stmt.args[0] is not None
+                    and stmt.args[2] is not None
+                )
+                base, off = self._parse_addr(stmt.args[0])
+                store_size = stmt.args[2].value * 2 if isinstance(stmt.args[2], Const) else None
+            elif isinstance(stmt, Store):
+                base, off = self._parse_addr(stmt.addr)
+                store_size = stmt.size
+            elif isinstance(stmt, Assignment):
+                base, off = self._parse_addr(stmt.dst)
+                store_size = stmt.dst.size
+            else:
+                # unexpected!
+                return None
+            if off is None or store_size is None:
+                # bad offset or size - bail
+                return None
+            if known_base is None:
+                known_base = base
+            elif not base.likes(known_base):
+                # bail
+                return None
+            if off in offset_to_stmt:
+                # duplicate offset - bail
+                return None
+            assert isinstance(store_size, int)
+            for i in range(store_size):
+                if off + i in updated_offsets:
+                    # overlapping store - bail
+                    return None
+                updated_offsets.add(off + i)
+
+            offset_to_stmt[off] = stmt
+
+        return [offset_to_stmt[k] for k in sorted(offset_to_stmt)]
+
+    def _optimize_pair(
+        self, last_stmt: Call | Store | Assignment, stmt: Call | Store | Assignment
+    ) -> list[Call] | None:
+        # convert (store, wcsncpy()) to (wcsncpy(), store) if they do not overlap
+        if (
+            isinstance(stmt, Call)
+            and InlinedWcscpy.is_inlined_wcsncpy(stmt)
+            and stmt.args is not None
+            and len(stmt.args) == 3
+            and isinstance(stmt.args[2], Const)
+            and isinstance(stmt.args[2].value, int)
+            and isinstance(last_stmt, (Store, Assignment))
+        ):
+            if isinstance(last_stmt, Store) and isinstance(last_stmt.data, Const):
+                store_addr = last_stmt.addr
+                store_size = last_stmt.size
+            elif isinstance(last_stmt, Assignment):
+                store_addr = last_stmt.dst
+                store_size = last_stmt.dst.size
+            else:
+                return None
+            # check if they overlap
+            wcsncpy_addr = stmt.args[0]
+            wcsncpy_size = stmt.args[2].value * 2
+            delta = self._get_delta(store_addr, wcsncpy_addr)
+            if delta is not None:
+                if (0 <= delta <= store_size) or (delta < 0 and -delta <= wcsncpy_size):
+                    # they overlap, do not switch
+                    pass
+                else:
+                    last_stmt, stmt = stmt, last_stmt
+
+        # swap two statements if they are out of order
+        if InlinedWcscpy.is_inlined_wcsncpy(last_stmt) and InlinedWcscpy.is_inlined_wcsncpy(stmt):
+            assert last_stmt.args is not None and stmt.args is not None
+            delta = self._get_delta(last_stmt.args[0], stmt.args[0])
+            if delta is not None and delta < 0:
+                last_stmt, stmt = stmt, last_stmt
+
+        if InlinedWcscpy.is_inlined_wcsncpy(last_stmt):
+            assert last_stmt.args is not None
+            assert self.kb is not None
+            s_last: bytes = self.kb.custom_strings[last_stmt.args[1].value]
+            addr_last = last_stmt.args[0]
+            new_str = None  # will be set if consolidation should happen
+
+            if isinstance(stmt, Call) and InlinedWcscpy.is_inlined_wcsncpy(stmt):
+                assert stmt.args is not None
+                # consolidating two calls
+                s_curr: bytes = self.kb.custom_strings[stmt.args[1].value]
+                addr_curr = stmt.args[0]
+                # determine if the two addresses are consecutive
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    # consolidate both calls!
+                    new_str = s_last + s_curr
+            elif isinstance(stmt, Store) and isinstance(stmt.data, Const) and isinstance(stmt.data.value, int):
+                # consolidating a call and a store, in case the store statement is storing the suffix of a string (but
+                # the suffix is too short to qualify an inlined strcpy optimization)
+                addr_curr = stmt.addr
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    if stmt.size == 2 and stmt.data.value == 0:
+                        # it's probably the terminating null byte
+                        r, s = True, b"\x00\x00"
+                    else:
+                        r, s = InlinedWcscpy.is_integer_likely_a_wide_string(
+                            stmt.data.value, stmt.size, stmt.endness, min_length=1  # type:ignore
+                        )
+                    if r and s is not None:
+                        new_str = s_last + s
+            elif (
+                isinstance(stmt, Assignment)
+                and isinstance(stmt.dst, VirtualVariable)
+                and isinstance(stmt.src, Const)
+                and isinstance(stmt.src.value, int)
+            ):
+                # consolidating a call and an assignment, in case the assignment statement is storing the suffix of a
+                # string (but the suffix is too short to qualify an inlined strcpy optimization)
+                addr_curr = stmt.dst
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    r, s = InlinedWcscpy.is_integer_likely_a_wide_string(
+                        stmt.src.value, stmt.dst.size, self.project.arch.memory_endness, min_length=1  # type:ignore
+                    )
+                    if r and s is not None:
+                        new_str = s_last + s
+
+            if new_str is not None:
+                assert self.project is not None
+                wstr_type = SimTypePointer(SimTypeWideChar()).with_arch(self.project.arch)
+                if new_str.endswith(b"\x00\x00"):
+                    call_name = "wcsncpy"
+                    new_str_idx = self.kb.custom_strings.allocate(new_str[:-2])
+                    args = [
+                        last_stmt.args[0],
+                        Const(None, None, new_str_idx, last_stmt.args[0].bits, custom_string=True, type=wstr_type),
+                    ]
+                    prototype = None
+                else:
+                    call_name = "wcsncpy"
+                    new_str_idx = self.kb.custom_strings.allocate(new_str)
+                    args = [
+                        last_stmt.args[0],
+                        Const(None, None, new_str_idx, last_stmt.args[0].bits, custom_string=True, type=wstr_type),
+                        Const(None, None, len(new_str) // 2, self.project.arch.bits),
+                    ]
+                    prototype = None
+
+                return [Call(stmt.idx, call_name, args=args, prototype=prototype, **stmt.tags)]
+
+        return None
+
+    @staticmethod
+    def _parse_addr(addr: Expression) -> tuple[Expression, int]:
+        # we force the base to 64-bit because it does not really matter when we use it
+
+        if isinstance(addr, VirtualVariable) and addr.was_stack:
+            return StackBaseOffset(None, 64, 0), addr.stack_offset
+        if isinstance(addr, Register):
+            return addr, 0
+        if isinstance(addr, StackBaseOffset):
+            return StackBaseOffset(None, 64, 0), addr.offset
+        if (
+            isinstance(addr, UnaryOp)
+            and addr.op == "Reference"
+            and isinstance(addr.operand, VirtualVariable)
+            and addr.operand.was_stack
+        ):
+            return StackBaseOffset(None, 64, 0), addr.operand.stack_offset
+        if isinstance(addr, BinaryOp):
+            if addr.op == "Add" and isinstance(addr.operands[1], Const) and isinstance(addr.operands[1].value, int):
+                base_0, offset_0 = InlinedWcscpyConsolidation._parse_addr(addr.operands[0])
+                return base_0, offset_0 + addr.operands[1].value
+            if addr.op == "Sub" and isinstance(addr.operands[1], Const) and isinstance(addr.operands[1].value, int):
+                base_0, offset_0 = InlinedWcscpyConsolidation._parse_addr(addr.operands[0])
+                return base_0, offset_0 - addr.operands[1].value
+
+        return addr, 0
+
+    @staticmethod
+    def _get_delta(addr_0: Expression, addr_1: Expression) -> int | None:
+        base_0, offset_0 = InlinedWcscpyConsolidation._parse_addr(addr_0)
+        base_1, offset_1 = InlinedWcscpyConsolidation._parse_addr(addr_1)
+        if base_0.likes(base_1):
+            return offset_1 - offset_0
+        return None

{angr-9.2.176 → angr-9.2.177}/angr/analyses/decompiler/utils.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 import pathlib
 import copy
+from types import FunctionType
 from typing import Any
 from collections.abc import Iterable
 import logging
@@ -958,9 +959,15 @@ def peephole_optimize_multistmts(block, stmt_opts):
             for opt in stmt_opts:
                 matched = False
                 stmt_seq_len = None
-                for stmt_class_seq in opt.stmt_classes:
-                    if match_stmt_classes(statements, stmt_idx, stmt_class_seq):
-                        stmt_seq_len = len(stmt_class_seq)
+                for stmt_class_seq_or_method in opt.stmt_classes:
+                    if isinstance(stmt_class_seq_or_method, FunctionType):
+                        r = stmt_class_seq_or_method(statements, stmt_idx)
+                        if r > 0:
+                            stmt_seq_len = r
+                            matched = True
+                            break
+                    elif match_stmt_classes(statements, stmt_idx, stmt_class_seq_or_method):
+                        stmt_seq_len = len(stmt_class_seq_or_method)
                         matched = True
                         break
 

{angr-9.2.176 → angr-9.2.177}/angr/analyses/flirt/flirt.py

@@ -35,7 +35,7 @@ class FlirtAnalysis(Analysis):
       current binary, and then match all possible signatures for the architecture.
     """
 
-    def __init__(self, sig: FlirtSignature | str | None = None, max_mismatched_bytes: int = 0):
+    def __init__(self, sig: FlirtSignature | str | None = None, max_mismatched_bytes: int = 0, dry_run: bool = False):
 
         from angr.flirt import FLIRT_SIGNATURES_BY_ARCH  # pylint:disable=import-outside-toplevel
 
@@ -94,9 +94,10 @@ class FlirtAnalysis(Analysis):
                 sig_ = path_to_sig.get(max_suggestion_sig_path)
                 assert sig_ is not None
                 _l.info("Applying FLIRT signature %s for library %s.", sig_, lib)
-                self._apply_changes(
-                    sig_.sig_name if not self._temporary_sig else None, sig_to_suggestions[max_suggestion_sig_path]
-                )
+                if not dry_run:
+                    self._apply_changes(
+                        sig_.sig_name if not self._temporary_sig else None, sig_to_suggestions[max_suggestion_sig_path]
+                    )
                 self.matched_suggestions[lib] = (sig_, sig_to_suggestions[max_suggestion_sig_path])
 
     def _find_hits_by_strings(self, regions: list[bytes]) -> Generator[FlirtSignature]:

{angr-9.2.176 → angr-9.2.177}/angr/analyses/variable_recovery/engine_ail.py

@@ -171,6 +171,45 @@ class SimEngineVRAIL(
             if isinstance(funcaddr_typevar, typevars.TypeVariable):
                 load_typevar = self._create_access_typevar(funcaddr_typevar, False, self.arch.bytes, 0)
                 self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
+        elif isinstance(target, str):
+            # special handling for some intrinsics
+            match target:
+                case (
+                    "InterlockedExchange8"
+                    | "InterlockedExchange16"
+                    | "InterlockedExchange"
+                    | "InterlockedExchange64"
+                    | "InterlockedCompareExchange16"
+                    | "InterlockedCompareExchange"
+                    | "InterlockedCompareExchange64"
+                    | "InterlockedCompareExchange128"
+                    | "InterlockedExchangeAdd"
+                    | "InterlockedExchangeAdd64"
+                ):
+                    arg_tv = (
+                        args[0].typevar
+                        if args[0].typevar is not None
+                        else args[1].typevar if args[1].typevar is not None else None
+                    )
+                    if arg_tv is not None:
+                        ret_ty = self._create_access_typevar(
+                            arg_tv, False, args[0].data.size() // self.arch.byte_width, 0
+                        )
+                        return RichR(self.state.top(ret_expr_bits), typevar=ret_ty)
+                case (
+                    "InterlockedIncrement"
+                    | "InterlockedIncrement16"
+                    | "InterlockedIncrement64"
+                    | "InterlockedDecrement"
+                    | "InterlockedDecrement16"
+                    | "InterlockedDecrement64"
+                ):
+                    arg_tv = args[0].typevar if args[0].typevar is not None else None
+                    if arg_tv is not None:
+                        ret_ty = self._create_access_typevar(
+                            arg_tv, False, args[0].data.size() // self.arch.byte_width, 0
+                        )
+                        return RichR(self.state.top(ret_expr_bits), typevar=ret_ty)
 
         # discover the prototype
         prototype: SimTypeFunction | None = None

{angr-9.2.176 → angr-9.2.177}/angr/emulator.py

@@ -95,7 +95,8 @@ class Emulator:
         num_inst_executed: int = 0
         while self._state.history.jumpkind != "Ijk_Exit":
             # Check if there is a breakpoint at the current address
-            if completed_engine_execs > 0 and self._state.addr in self._engine.get_breakpoints():
+            addr_with_lower_bit_cleared = self._state.addr & ~1
+            if completed_engine_execs > 0 and addr_with_lower_bit_cleared in self._engine.get_breakpoints():
                 return EmulatorStopReason.BREAKPOINT
 
             # Check if we've already executed the requested number of instructions

{angr-9.2.176 → angr-9.2.177}/angr/engines/hook.py

@@ -54,7 +54,7 @@ class HooksMixin(SuccessorsEngine, ProcedureMixin):
         if procedure is None:
             procedure = self._lookup_hook(state, procedure)
         if procedure is None:
-            return super().process_successors(successors, procedure=procedure, **kwargs)
+            return super().process_successors(successors, **kwargs)
 
         if isinstance(procedure.addr, SootAddressDescriptor):
             l.debug("Running %s (originally at %r)", repr(procedure), procedure.addr)