angr 9.2.178__tar.gz → 9.2.180__tar.gz

{angr-9.2.178 → angr-9.2.180}/Cargo.lock

@@ -679,11 +679,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5203598f366b11a02b13aa20cab591229ff0a89fd121a308a5df751d5fc9219"
+version = "0.26.0"
+source = "git+https://github.com/pyo3/pyo3#254b29f0c63597a9ae6ba73ede79edb49d61a50c"
 dependencies = [
- "cfg-if",
  "indoc",
  "libc",
  "memoffset",
@@ -697,19 +695,16 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99636d423fa2ca130fa5acde3059308006d46f98caac629418e53f7ebb1e9999"
+version = "0.26.0"
+source = "git+https://github.com/pyo3/pyo3#254b29f0c63597a9ae6ba73ede79edb49d61a50c"
 dependencies = [
- "once_cell",
  "target-lexicon 0.13.2",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78f9cf92ba9c409279bc3305b5409d90db2d2c22392d443a87df3a1adad59e33"
+version = "0.26.0"
+source = "git+https://github.com/pyo3/pyo3#254b29f0c63597a9ae6ba73ede79edb49d61a50c"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -717,9 +712,8 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b999cb1a6ce21f9a6b147dcf1be9ffedf02e0043aec74dc390f3007047cecd9"
+version = "0.26.0"
+source = "git+https://github.com/pyo3/pyo3#254b29f0c63597a9ae6ba73ede79edb49d61a50c"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -729,9 +723,8 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "822ece1c7e1012745607d5cf0bcb2874769f0f7cb34c4cde03b9358eb9ef911a"
+version = "0.26.0"
+source = "git+https://github.com/pyo3/pyo3#254b29f0c63597a9ae6ba73ede79edb49d61a50c"
 dependencies = [
  "heck",
  "proc-macro2",

{angr-9.2.178 → angr-9.2.180}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: angr
-Version: 9.2.178
+Version: 9.2.180
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 License: BSD-2-Clause
 Project-URL: Homepage, https://angr.io/
@@ -16,12 +16,12 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cxxheaderparser
 Requires-Dist: GitPython
-Requires-Dist: archinfo==9.2.178
+Requires-Dist: archinfo==9.2.180
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.3
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.178
-Requires-Dist: cle==9.2.178
+Requires-Dist: claripy==9.2.180
+Requires-Dist: cle==9.2.180
 Requires-Dist: msgspec
 Requires-Dist: mulpyplexer
 Requires-Dist: networkx!=2.8.1,>=2.0
@@ -31,7 +31,7 @@ Requires-Dist: pycparser>=2.18
 Requires-Dist: pydemumble
 Requires-Dist: pyformlang
 Requires-Dist: pypcode<4.0,>=3.2.1
-Requires-Dist: pyvex==9.2.178
+Requires-Dist: pyvex==9.2.180
 Requires-Dist: rich>=13.1.0
 Requires-Dist: sortedcontainers
 Requires-Dist: sympy
@@ -66,7 +66,7 @@ Project repository: https://github.com/angr/angr
 
 Documentation: https://docs.angr.io
 
-API Documentation: https://api.angr.io/en/latest/
+API Documentation: https://docs.angr.io/en/latest/api.html
 
 ## What is angr?
 
@@ -80,7 +80,7 @@ angr is a suite of Python 3 libraries that let you load a binary and do a lot of
 - Value-set analysis (VSA)
 - Decompilation
 
-The most common angr operation is loading a binary: `p = angr.Project('/bin/bash')` If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the [top-level-accessible methods](https://docs.angr.io/docs/toplevel) and their docstrings.
+The most common angr operation is loading a binary: `p = angr.Project('/bin/bash')` If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the [top-level-accessible methods](https://docs.angr.io/core-concepts/toplevel) and their docstrings.
 
 The short version of "how to install angr" is `mkvirtualenv --python=$(which python3) angr && python -m pip install angr`.
 
@@ -108,5 +108,5 @@ project.execute()
 - Documentation as [HTML](https://docs.angr.io/) and sources in the angr [Github repository](https://github.com/angr/angr/tree/master/docs)
 - Dive right in: [top-level-accessible methods](https://docs.angr.io/core-concepts/toplevel)
 - [Examples using angr to solve CTF challenges](https://docs.angr.io/examples).
-- [API Reference](https://angr.io/api-doc/)
+- [API Reference](https://docs.angr.io/en/latest/api.html)
 - [awesome-angr repo](https://github.com/degrigis/awesome-angr)

{angr-9.2.178 → angr-9.2.180}/README.md

@@ -15,7 +15,7 @@ Project repository: https://github.com/angr/angr
 
 Documentation: https://docs.angr.io
 
-API Documentation: https://api.angr.io/en/latest/
+API Documentation: https://docs.angr.io/en/latest/api.html
 
 ## What is angr?
 
@@ -29,7 +29,7 @@ angr is a suite of Python 3 libraries that let you load a binary and do a lot of
 - Value-set analysis (VSA)
 - Decompilation
 
-The most common angr operation is loading a binary: `p = angr.Project('/bin/bash')` If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the [top-level-accessible methods](https://docs.angr.io/docs/toplevel) and their docstrings.
+The most common angr operation is loading a binary: `p = angr.Project('/bin/bash')` If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the [top-level-accessible methods](https://docs.angr.io/core-concepts/toplevel) and their docstrings.
 
 The short version of "how to install angr" is `mkvirtualenv --python=$(which python3) angr && python -m pip install angr`.
 
@@ -57,5 +57,5 @@ project.execute()
 - Documentation as [HTML](https://docs.angr.io/) and sources in the angr [Github repository](https://github.com/angr/angr/tree/master/docs)
 - Dive right in: [top-level-accessible methods](https://docs.angr.io/core-concepts/toplevel)
 - [Examples using angr to solve CTF challenges](https://docs.angr.io/examples).
-- [API Reference](https://angr.io/api-doc/)
+- [API Reference](https://docs.angr.io/en/latest/api.html)
 - [awesome-angr repo](https://github.com/degrigis/awesome-angr)

{angr-9.2.178 → angr-9.2.180}/angr/__init__.py

@@ -2,7 +2,7 @@
 # pylint: disable=wrong-import-position
 from __future__ import annotations
 
-__version__ = "9.2.178"
+__version__ = "9.2.180"
 
 if bytes is str:
     raise Exception(

{angr-9.2.178 → angr-9.2.180}/angr/ailment/converter_vex.py

@@ -55,7 +55,13 @@ class VEXExprConverter(Converter):
             except UnsupportedIROpError:
                 log.warning("VEXExprConverter: Unsupported IROp %s.", expr.op)
                 return DirtyExpression(
-                    manager.next_atom(), f"unsupported_{expr.op}", [], bits=expr.result_size(manager.tyenv)
+                    manager.next_atom(),
+                    f"unsupported_{expr.op}",
+                    [],
+                    bits=expr.result_size(manager.tyenv),
+                    ins_addr=manager.ins_addr,
+                    vex_block_addr=manager.block_addr,
+                    vex_stmt_idx=manager.vex_stmt_idx,
                 )
 
         log.warning("VEXExprConverter: Unsupported VEX expression of type %s.", type(expr))
@@ -64,7 +70,15 @@ class VEXExprConverter(Converter):
         except ValueError:
             # e.g., "ValueError: Type Ity_INVALID does not have size"
             bits = 0
-        return DirtyExpression(manager.next_atom(), f"unsupported_{type(expr)!s}", [], bits=bits)
+        return DirtyExpression(
+            manager.next_atom(),
+            f"unsupported_{type(expr)!s}",
+            [],
+            bits=bits,
+            ins_addr=manager.ins_addr,
+            vex_block_addr=manager.block_addr,
+            vex_stmt_idx=manager.vex_stmt_idx,
+        )
 
     @staticmethod
     def convert_list(exprs, manager):
@@ -479,8 +493,22 @@ class VEXStmtConverter(Converter):
         try:
             func = STATEMENT_MAPPINGS[type(stmt)]
         except KeyError:
-            dirty = DirtyExpression(manager.next_atom(), str(stmt), [], bits=0)
-            return DirtyStatement(idx, dirty, ins_addr=manager.ins_addr)
+            dirty = DirtyExpression(
+                manager.next_atom(),
+                str(stmt),
+                [],
+                bits=0,
+                ins_addr=manager.ins_addr,
+                vex_block_addr=manager.block_addr,
+                vex_stmt_idx=manager.vex_stmt_idx,
+            )
+            return DirtyStatement(
+                idx,
+                dirty,
+                ins_addr=manager.ins_addr,
+                vex_block_addr=manager.block_addr,
+                vex_stmt_idx=manager.vex_stmt_idx,
+            )
 
         return func(idx, stmt, manager)
 
@@ -631,6 +659,9 @@ class VEXStmtConverter(Converter):
             maddr=maddr,
             msize=stmt.mSize,
             bits=bits,
+            ins_addr=manager.ins_addr,
+            vex_block_addr=manager.block_addr,
+            vex_stmt_idx=manager.vex_stmt_idx,
         )
 
         if stmt.tmp == 0xFFFFFFFF:

{angr-9.2.178 → angr-9.2.180}/angr/analyses/cfg/cfb.py

@@ -6,6 +6,7 @@ from collections.abc import Callable
 import cle
 from cle.backends.externs import KernelObject, ExternObject
 from cle.backends.tls.elf_tls import ELFTLSObject
+from cle.backends.ihex import Hex
 from sortedcontainers import SortedDict
 
 from angr.analyses import AnalysesHub
@@ -163,6 +164,16 @@ class CFBlanket(Analysis):
                     size = obj.max_addr - obj.min_addr
                     mr = MemoryRegion(obj.min_addr, size, "tls", obj, None)
                     self._regions.append(mr)
+            elif isinstance(obj, Hex):
+                if obj.segments:
+                    for segment in obj.segments:
+                        mr = MemoryRegion(segment.vaddr, segment.memsize, "segment", obj, segment)
+                        self._regions.append(mr)
+                else:
+                    base_addr = obj.min_addr  # but it's always 0
+                    size = obj.max_addr - base_addr
+                    mr = MemoryRegion(base_addr, size, "segment", obj, None)
+                    self._regions.append(mr)
             else:
                 size = obj.size if hasattr(obj, "size") else obj.max_addr - obj.min_addr
                 type_ = "TODO"

{angr-9.2.178 → angr-9.2.180}/angr/analyses/decompiler/ail_simplifier.py

@@ -1248,7 +1248,7 @@ class AILSimplifier(Analysis):
             if to_replace_used_in_refs:
                 continue
 
-            if any(not isinstance(expr_and_use[0], VirtualVariable) for _, expr_and_use in all_uses_with_def):
+            if any(isinstance(expr_and_use[0], VirtualVariable) for _, expr_and_use in all_uses_with_def):
                 # if any of the uses are phi assignments, we skip
                 used_in_phi_assignment = False
                 for _, expr_and_use in all_uses_with_def:

{angr-9.2.178 → angr-9.2.180}/angr/analyses/decompiler/clinic.py

@@ -2545,6 +2545,11 @@ class Clinic(Analysis):
             intended_head = preds[0]
             other_heads = preds[1:]
 
+            # I've seen cases where there is one more block between the actual intended head and the candidate.
+            # binary 7995a0325b446c462bdb6ae10b692eee2ecadd8e888e9d7729befe4412007afb, block 0x140032760
+            while ail_graph.out_degree[intended_head] == 1 and ail_graph.in_degree[intended_head] == 1:
+                intended_head = next(iter(ail_graph.predecessors(intended_head)))
+
             # now here is the tricky part. there are two cases:
             # Case 1: the intended head and the other heads share the same suffix (of instructions)
             #    Example:
@@ -2649,8 +2654,6 @@ class Clinic(Analysis):
     def _get_overlapping_suffix_instructions_compare_conditional_jumps(
         ailblock_0: ailment.Block, ailblock_1: ailment.Block
     ) -> bool:
-        # TODO: The logic here is naive and highly customized to the only example I can access. Expand this method
-        #  later to handle more cases if needed.
         if len(ailblock_0.statements) == 0 or len(ailblock_1.statements) == 0:
             return False
 
@@ -2663,7 +2666,10 @@ class Clinic(Analysis):
 
         last_stmt_0 = ailblock_0.statements[-1]
         last_stmt_1 = ailblock_1.statements[-1]
-        if not (isinstance(last_stmt_0, ailment.Stmt.ConditionalJump) and last_stmt_0.likes(last_stmt_1)):
+        if not (
+            isinstance(last_stmt_0, ailment.Stmt.ConditionalJump)
+            and isinstance(last_stmt_1, ailment.Stmt.ConditionalJump)
+        ):
             return False
 
         last_cmp_stmt_0 = next(

{angr-9.2.178 → angr-9.2.180}/angr/analyses/decompiler/peephole_optimizations/cas_intrinsics.py

@@ -133,7 +133,7 @@ class CASIntrinsics(PeepholeOptimizationMultiStmtBase):
                         ins_addr=cas_stmt.ins_addr,
                     )
 
-                assignment_dst = cas_stmt.expd_lo
+                assignment_dst = cas_stmt.old_lo
                 stmt = Assignment(cas_stmt.idx, assignment_dst, call_expr, **cas_stmt.tags)  # type:ignore
                 return [stmt]
 
@@ -155,7 +155,7 @@ class CASIntrinsics(PeepholeOptimizationMultiStmtBase):
                 bits=cas_stmt.bits,
                 ins_addr=cas_stmt.ins_addr,
             )
-            assignment_dst = cas_stmt.expd_lo
+            assignment_dst = cas_stmt.old_lo
             stmt = Assignment(cas_stmt.idx, assignment_dst, call_expr, **cas_stmt.tags)  # type:ignore
             return [stmt, next_stmt]
 

{angr-9.2.178 → angr-9.2.180}/angr/analyses/decompiler/region_simplifiers/expr_folding.py

@@ -271,12 +271,19 @@ class ExpressionCounter(SequenceWalker):
         # the current assignment depends on, StatementLocation of the assignment statement, a Boolean variable that
         # indicates if ExpressionUseFinder has succeeded or not)
         self.assignments: defaultdict[Any, set[tuple]] = defaultdict(set)
-        self.uses: dict[int, set[tuple[Expression, LocationBase | None]]] = {}
+        self.outerscope_uses: dict[int, set[tuple[Expression, LocationBase | None]]] = {}
+        self.all_uses: dict[int, set[tuple[Expression, LocationBase | None]]] = {}
+        # inner_scope indicates if we are currently within one of the inner scopes (e.g., a loop). we only collect
+        # assignments in the outermost level and stop collecting assignments when we enter inner scopes.
+        # we always collect uses, but uses in the outmost scope will be recorded in self.outerscope_uses
+        self._outer_scope: bool = True
 
         super().__init__(handlers)
         self.walk(node)
 
     def _handle_Statement(self, idx: int, stmt: Statement, node: ailment.Block | LoopNode):
+        if not self._outer_scope:
+            return
         if isinstance(stmt, ailment.Stmt.Assignment):
             if is_phi_assignment(stmt):
                 return
@@ -312,32 +319,40 @@ class ExpressionCounter(SequenceWalker):
 
     def _handle_Block(self, node: ailment.Block, **kwargs):
         # find assignments and uses of variables
-        use_finder = ExpressionUseFinder()
-        for idx, stmt in enumerate(node.statements):
-            self._handle_Statement(idx, stmt, node)
-            use_finder.walk_statement(stmt, block=node)
-
-        for varid, content in use_finder.uses.items():
-            if varid not in self.uses:
-                self.uses[varid] = set()
-            self.uses[varid] |= content
+        self._collect_uses(node, None)
 
     def _collect_assignments(self, expr: Expression, node) -> None:
+        if not self._outer_scope:
+            return
         finder = MultiStatementExpressionAssignmentFinder(self._handle_Statement)
         finder.walk_expression(expr, None, None, node)
 
-    def _collect_uses(self, expr: Expression | Statement, loc: LocationBase):
+    def _collect_uses(self, thing: Expression | Statement | ailment.Block, loc: LocationBase | None):
         use_finder = ExpressionUseFinder()
-        if isinstance(expr, Statement):
-            use_finder.walk_statement(expr)
+        if isinstance(thing, ailment.Block):
+            for idx, stmt in enumerate(thing.statements):
+                self._handle_Statement(idx, stmt, thing)
+                use_finder.walk_statement(stmt, block=thing)
+        elif isinstance(thing, Statement):
+            use_finder.walk_statement(thing)
         else:
-            use_finder.walk_expression(expr, stmt_idx=-1)
+            use_finder.walk_expression(thing, stmt_idx=-1)
 
         for varid, uses in use_finder.uses.items():
             for use in uses:
-                if varid not in self.uses:
-                    self.uses[varid] = set()
-                self.uses[varid].add((use[0], loc))
+                # overwrite the location if loc is specified
+                content = (use[0], loc) if loc is not None else use
+
+                # update all_uses
+                if varid not in self.all_uses:
+                    self.all_uses[varid] = set()
+                self.all_uses[varid].add(content)
+
+                # update outerscope_uses if we are in the outer scope
+                if self._outer_scope:
+                    if varid not in self.outerscope_uses:
+                        self.outerscope_uses[varid] = set()
+                    self.outerscope_uses[varid].add(content)
 
     def _handle_ConditionalBreak(self, node: ConditionalBreakNode, **kwargs):
         # collect uses on the condition expression
@@ -366,7 +381,12 @@ class ExpressionCounter(SequenceWalker):
         if node.condition is not None:
             self._collect_assignments(node.condition, node)
             self._collect_uses(node.condition, ConditionLocation(node.addr))
-        # we do not go ahead and collect into the loop body
+
+        outer_scope = self._outer_scope
+        self._outer_scope = False
+        super()._handle_Loop(node, **kwargs)
+        self._outer_scope = outer_scope
+
         return None
 
     def _handle_SwitchCase(self, node: SwitchCaseNode, **kwargs):

{angr-9.2.178 → angr-9.2.180}/angr/analyses/decompiler/region_simplifiers/region_simplifier.py

@@ -125,10 +125,16 @@ class RegionSimplifier(Analysis):
         # before the definition site and the use site.
         var_with_loads = {}
         single_use_variables = []
-        for var, uses in expr_counter.uses.items():
-            if len(uses) == 1 and var in expr_counter.assignments and len(expr_counter.assignments[var]) == 1:
+        for var, outerscope_uses in expr_counter.outerscope_uses.items():
+            all_uses = expr_counter.all_uses[var]
+            if (
+                len(outerscope_uses) == 1
+                and len(all_uses) == 1
+                and var in expr_counter.assignments
+                and len(expr_counter.assignments[var]) == 1
+            ):
                 definition, deps, loc, has_loads = next(iter(expr_counter.assignments[var]))
-                _, use_expr_loc = next(iter(uses))
+                _, use_expr_loc = next(iter(outerscope_uses))
                 if isinstance(use_expr_loc, ExpressionLocation) and use_expr_loc.phi_stmt:
                     # we cannot fold expressions that are used in phi statements
                     continue
@@ -169,7 +175,7 @@ class RegionSimplifier(Analysis):
                     definition.ret_expr = definition.ret_expr.copy()
                     definition.ret_expr.variable = None
             variable_assignments[var] = definition, loc
-            variable_uses[var] = next(iter(expr_counter.uses[var]))
+            variable_uses[var] = next(iter(expr_counter.outerscope_uses[var]))
             variable_assignment_dependencies[var] = deps
 
         # any variable definition that uses an existing to-be-removed variable cannot be folded

{angr-9.2.178 → angr-9.2.180}/angr/analyses/decompiler/ssailification/rewriting.py

@@ -188,7 +188,7 @@ class RewritingAnalysis(ForwardAnalysis[RewritingState, ailment.Block, object, o
     def _reg_predicate(self, node_: Block, *, reg_offset: int, reg_size: int) -> tuple[bool, Any]:
         out_state: RewritingState = (
             self.head_controlled_loop_outstates[(node_.addr, node_.idx)]
-            if is_head_controlled_loop_block(node_)
+            if is_head_controlled_loop_block(node_) and (node_.addr, node_.idx) in self.head_controlled_loop_outstates
             else self.out_states[(node_.addr, node_.idx)]
         )
         if reg_offset in out_state.registers and reg_size in out_state.registers[reg_offset]:

{angr-9.2.178 → angr-9.2.180}/angr/analyses/decompiler/structured_codegen/c.py

@@ -561,7 +561,10 @@ class CFunction(CConstruct):  # pylint:disable=abstract-method
                     continue
                 varname = v.c_repr() if v.type is None else v.variable.name
                 yield "extern ", None
-                yield from type_to_c_repr_chunks(v.type, name=varname, name_type=v, full=False)
+                if v.type is None:
+                    yield "<unknown-type>", None
+                else:
+                    yield from type_to_c_repr_chunks(v.type, name=varname, name_type=v, full=False)
                 yield ";\n", None
             yield "\n", None
 
@@ -1327,9 +1330,10 @@ class CFunctionCall(CStatement, CExpression):
                 return True
 
         # FIXME: Handle name mangle
-        for func in self.codegen.kb.functions.get_by_name(callee.name):
-            if func is not callee and (caller.binary is not callee.binary or func.binary is callee.binary):
-                return True
+        if callee is not None:
+            for func in self.codegen.kb.functions.get_by_name(callee.name):
+                if func is not callee and (caller.binary is not callee.binary or func.binary is callee.binary):
+                    return True
 
         return False
 
@@ -3194,7 +3198,9 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
     # Handlers
     #
 
-    def _handle(self, node, is_expr: bool = True, lvalue: bool = False, likely_signed=False):
+    def _handle(
+        self, node, is_expr: bool = True, lvalue: bool = False, likely_signed=False, type_: SimType | None = None
+    ):
         if (node, is_expr) in self.ailexpr2cnode:
             return self.ailexpr2cnode[(node, is_expr)]
 
@@ -3204,7 +3210,7 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
             converted = (
                 handler(node, is_expr=is_expr)
                 if isinstance(node, Stmt.Call)
-                else handler(node, lvalue=lvalue, likely_signed=likely_signed)
+                else handler(node, lvalue=lvalue, likely_signed=likely_signed, type_=type_)
             )
             self.ailexpr2cnode[(node, is_expr)] = converted
             return converted
@@ -3483,6 +3489,8 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
                     and i < len(target_func.prototype.args)
                 ):
                     type_ = target_func.prototype.args[i].with_arch(self.project.arch)
+                    if target_func.prototype_libname is not None:
+                        type_ = dereference_simtype_by_lib(type_, target_func.prototype_libname)
 
                 if isinstance(arg, Expr.Const):
                     if type_ is None or is_machine_word_size_type(type_, self.project.arch):
@@ -3490,7 +3498,7 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
 
                     new_arg = self._handle_Expr_Const(arg, type_=type_)
                 else:
-                    new_arg = self._handle(arg)
+                    new_arg = self._handle(arg, type_=type_)
                 args.append(new_arg)
 
         ret_expr = None
@@ -3737,10 +3745,19 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
             reference_values["offset"] = var_access
         return CConstant(expr.value, type_, reference_values=reference_values, tags=expr.tags, codegen=self)
 
-    def _handle_Expr_UnaryOp(self, expr, **kwargs):
+    def _handle_Expr_UnaryOp(self, expr, type_: SimType | None = None, **kwargs):
+        data_type = None
+        if expr.op == "Reference" and isinstance(type_, SimTypePointer) and not isinstance(type_.pts_to, SimTypeBottom):
+            data_type = type_.pts_to
+
+        operand = self._handle(expr.operand, lvalue=expr.op == "Reference", type_=data_type)
+
+        if expr.op == "Reference" and isinstance(operand, CUnaryOp) and operand.op == "Dereference":
+            # cancel out
+            return operand.operand
         return CUnaryOp(
             expr.op,
-            self._handle(expr.operand),
+            operand,
             tags=expr.tags,
             codegen=self,
         )
@@ -3847,7 +3864,9 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
         cexpr = self._handle(expr.expr)
         return CMultiStatementExpression(cstmts, cexpr, tags=expr.tags, codegen=self)
 
-    def _handle_VirtualVariable(self, expr: Expr.VirtualVariable, **kwargs):
+    def _handle_VirtualVariable(
+        self, expr: Expr.VirtualVariable, lvalue: bool = False, type_: SimType | None = None, **kwargs
+    ):
         def negotiate(old_ty: SimType, proposed_ty: SimType) -> SimType:
             # we do not allow returning a struct for a primitive type
             if old_ty.size == proposed_ty.size and (
@@ -3860,13 +3879,29 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
             if "struct_member_info" in expr.tags:
                 offset, var, _ = expr.struct_member_info
                 cbasevar = self._variable(var, expr.size, vvar_id=expr.varid)
+                data_type = type_
+                if data_type is None:
+                    # try to determine the type of this variable read
+                    data_type = cbasevar.type
+                    if data_type.size // self.project.arch.byte_width > expr.size:
+                        # fallback to a more suitable type
+                        data_type = (
+                            {
+                                64: SimTypeLongLong(signed=False),
+                                32: SimTypeInt(signed=False),
+                                16: SimTypeShort(signed=False),
+                                8: SimTypeChar(signed=False),
+                            }
+                            .get(expr.bits, data_type)
+                            .with_arch(self.project.arch)
+                        )
                 cvar = self._access_constant_offset(
-                    self._get_variable_reference(cbasevar), offset, cbasevar.type, False, negotiate
+                    self._get_variable_reference(cbasevar), offset, data_type, lvalue, negotiate
                 )
             else:
                 cvar = self._variable(expr.variable, None, vvar_id=expr.varid)
 
-            if expr.variable.size != expr.size:
+            if not lvalue and expr.variable.size != expr.size:
                 l.warning(
                     "VirtualVariable size (%d) and variable size (%d) do not match. Force a type cast.",
                     expr.size,
@@ -4097,6 +4132,13 @@ class PointerArithmeticFixer(CStructuredCodeWalker):
     a_ptr = a_ptr + 1.
     """
 
+    def handle_CAssignment(self, obj: CAssignment):
+        if "type" in obj.tags and "dst" in obj.tags["type"] and "src" in obj.tags["type"]:
+            # HACK: do not attempt to fix pointer arithmetic if dst and src types are explicitly given
+            # FIXME: Properly propagate dst and src types to lhs and rhs
+            return obj
+        return super().handle_CAssignment(obj)
+
     def handle_CBinaryOp(self, obj: CBinaryOp):  # type: ignore
         obj: CBinaryOp = super().handle_CBinaryOp(obj)
         if (