angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/analyses/find_objects_static.py

@@ -0,0 +1,205 @@
+from __future__ import annotations
+from typing import TYPE_CHECKING
+from collections import defaultdict
+
+import claripy
+
+from angr.analyses import AnalysesHub
+from angr.analyses.reaching_definitions.function_handler import FunctionHandler
+from angr.knowledge_plugins.key_definitions.atoms import Register, MemoryLocation
+from angr.storage.memory_mixins.paged_memory.pages.multi_values import MultiValues
+from angr.knowledge_plugins.key_definitions.constants import OP_BEFORE, OP_AFTER
+from angr.utils.cpp import is_cpp_funcname_ctor
+from . import Analysis, VtableFinder, CFGFast, ReachingDefinitionsAnalysis
+
+if TYPE_CHECKING:
+    from angr.analyses.reaching_definitions.function_handler import FunctionCallData
+    from angr.analyses.reaching_definitions.rd_state import ReachingDefinitionsState
+
+
+class PossibleObject:
+    """
+    This holds the address and class name of possible class instances.
+    The address that it holds in mapped outside the binary so it is only valid in this analysis.
+    TO DO: map the address to its uses in the registers/memory locations in the instructions
+    """
+
+    def __init__(self, size, addr, class_name=None):
+        self.size = size
+        # This address is only valid during RDA as we map new objects outside the already mapped region
+        self.addr = addr
+        self.class_name = class_name
+
+    def __hash__(self):
+        return hash((self.addr, self.size, self.class_name))
+
+    def __eq__(self, other):
+        return self.size == other.size and self.addr == other.size and self.class_name == other.class_name
+
+
+class NewFunctionHandler(FunctionHandler):
+    """
+    This handles calls to the function new(), by recording the size parameter passed to it and also assigns a new
+     address outside the mapped binary to the newly created space(possible object).
+
+     It also tracks if the function called right after new() is passed the same 'this' pointer and is a constructor,
+     if so we mark it as an instance of the class the constructor belongs to.(only for non stripped binaries)
+    """
+
+    def __init__(self, max_addr=None, new_func_addr=None, project=None):
+        super().__init__()
+        self.max_addr = max_addr
+
+        # this is a map between an object addr outside the mapped binary and PossibleObject instance
+        self.possible_objects_dict = {}
+
+        # address of the new() function
+        self.new_func_addr = new_func_addr
+        self.project = project
+
+    def hook(self, analysis):
+        return self
+
+    def handle_local_function(
+        self,
+        state: ReachingDefinitionsState,
+        data: FunctionCallData,
+    ):
+        function_address = data.address
+        if function_address == self.new_func_addr:
+            word_size = self.project.arch.bits // self.project.arch.byte_width
+            # check if this is a call to new()
+            # reading from rdi for the size argument passed to new()
+            cc = self.project.kb.functions[function_address].calling_convention
+            if cc is not None:
+                size_arg_reg_offset = self.project.arch.registers[cc.args[0].reg_name][0]
+                size_arg_reg_size = cc.args[0].size
+            else:
+                size_arg_reg_offset = self.project.arch.registers["rdi"][0]
+                size_arg_reg_size = word_size
+            v0 = state.registers.load(size_arg_reg_offset, size_arg_reg_size).one_value()
+            size = v0.concrete_value if v0 is not None and v0.concrete else None
+
+            if size is not None:
+                # None since we do not know it's class yet, it is a possible this pointer
+                self.possible_objects_dict[self.max_addr] = PossibleObject(size, self.max_addr)
+
+            # assigning eax a concrete address to track the possible this pointer
+            if cc is not None:
+                ret_val_reg_offset = self.project.arch.registers[cc.return_val.reg_name][0]
+                ret_val_reg_size = cc.return_val.size
+            else:
+                ret_val_reg_offset = self.project.arch.registers["rax"][0]
+                ret_val_reg_size = word_size
+            atom = Register(ret_val_reg_offset, ret_val_reg_size)
+            data.depends(
+                atom,
+                value=MultiValues(
+                    offset_to_values={0: {claripy.BVV(self.max_addr, word_size * state.arch.byte_width)}}
+                ),
+            )
+            # setting the values pointed by rax to zero
+            memory_location = MemoryLocation(self.max_addr, size)
+            offset_to_values = {}
+
+            for offset in range(0, size, word_size):
+                offset_to_values[offset] = {claripy.BVV(0, word_size * state.arch.byte_width)}
+            data.depends(memory_location, value=MultiValues(offset_to_values=offset_to_values))
+            self.max_addr += size
+
+        else:
+            if self.project.kb.functions.contains_addr(function_address):
+                func = self.project.kb.functions.get_by_addr(function_address)
+                if func is not None and is_cpp_funcname_ctor(func.demangled_name):
+                    # check if rdi has a possible this pointer/ object address, if so then we can assign this object
+                    # this class
+                    # also if the func is a constructor(not stripped binaries)
+                    for addr, possible_object in self.possible_objects_dict.items():
+                        v1 = state.registers.load(72, state.arch.bits // state.arch.byte_width).one_value()
+                        obj_addr = v1.concrete_value if v1 is not None and v1.concrete else None
+                        if obj_addr is not None and addr == obj_addr:
+                            col_ind = self.project.kb.functions[function_address].demangled_name.rfind("::")
+                            class_name = self.project.kb.functions[function_address].demangled_name[:col_ind]
+                            possible_object.class_name = class_name
+
+
+class StaticObjectFinder(Analysis):
+    """
+    This analysis tries to find objects on the heap based on calls to new(), and subsequent calls to constructors with
+     the 'this' pointer
+    """
+
+    def __init__(self):
+        vtable_analysis = self.project.analyses[VtableFinder].prep()()
+        self.vtables_list = vtable_analysis.vtables_list
+        self.possible_objects = {}
+
+        # for stripped binaries
+        # This is a mapping between the constructors and the objects that use them
+        self.possible_constructors = defaultdict(list)
+
+        self._analyze()
+
+    def _analyze(self):
+        if "CFGFast" not in self.project.kb.cfgs:
+            self.project.analyses[CFGFast].prep()(cross_references=True)
+        all_functions = self.project.kb.functions
+        # this is the addr where all the this pointers returned by new() will be pointing to
+        max_addr = self.project.loader.main_object.max_addr + 8
+        new_func_addr = self.project.kb.functions["_Znwm"].addr
+        for func in all_functions.values():
+            if func.is_simprocedure:
+                continue
+
+            cc = func.calling_convention
+            word_size = self.project.arch.bits // self.project.arch.byte_width
+            # the map fo this ptrs
+            newhandler = NewFunctionHandler(max_addr=max_addr, new_func_addr=new_func_addr, project=self.project)
+            max_addr = newhandler.max_addr
+            # this performs RDA as well as mark possible object instances for non stripped binaries
+            rd = self.project.analyses[ReachingDefinitionsAnalysis].prep()(
+                func, observe_all=True, function_handler=newhandler
+            )
+            for addr, pos_obj in newhandler.possible_objects_dict.items():
+                self.possible_objects[addr] = pos_obj
+
+            # for stripped binary we check if the first function called after new(),
+            # is passed the this pointer(returned by new)...
+            # if so then we say that it is possibly a constructor
+            for node in func.graph.nodes():
+                if func.get_call_target(node.addr) == new_func_addr:
+                    ret_node_addr = func.get_call_return(node.addr)
+                    ret_node = self.project.factory.block(ret_node_addr)
+                    call_after_new_addr = func.get_call_target(ret_node_addr)
+                    rd_before_node = rd.get_reaching_definitions_by_node(ret_node_addr, OP_BEFORE)
+
+                    if cc is not None:
+                        ret_val_reg_offset = self.project.arch.registers[cc.return_val.reg_name][0]
+                        ret_val_reg_size = cc.return_val.size
+                    else:
+                        ret_val_reg_offset = self.project.arch.registers["rax"][0]
+                        ret_val_reg_size = word_size
+                    v0 = rd_before_node.registers.load(ret_val_reg_offset, ret_val_reg_size).one_value()
+                    addr_of_new_obj = v0.concrete_value if v0 is not None and v0.concrete else None
+
+                    # we need the state right before the call
+                    if ret_node.vex.jumpkind == "Ijk_Call" and ret_node.vex.instruction_addresses:
+                        last_ins_addr = ret_node.instruction_addrs[-1]
+                        rd_after_node = rd.get_reaching_definitions_by_insn(last_ins_addr, OP_BEFORE)
+                    else:
+                        rd_after_node = rd.get_reaching_definitions_by_insn(ret_node_addr, OP_AFTER)
+
+                    if cc is not None:
+                        this_ptr_reg_offset = self.project.arch.registers[cc.args[0].reg_name][0]
+                        this_ptr_reg_size = cc.args[0].size
+                    else:
+                        this_ptr_reg_offset = self.project.arch.registers["rdi"][0]
+                        this_ptr_reg_size = word_size
+                    v1 = rd_after_node.registers.load(this_ptr_reg_offset, this_ptr_reg_size).one_value()
+                    addr_in_rdi = v1.concrete_value if v1 is not None and v1.concrete else None
+
+                    if addr_of_new_obj is not None and addr_of_new_obj == addr_in_rdi:
+                        self.possible_constructors[call_after_new_addr].append(self.possible_objects[addr_of_new_obj])
+
+
+AnalysesHub.register_default("StaticObjectFinder", StaticObjectFinder)

angr/analyses/flirt/__init__.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+from .flirt import FlirtAnalysis
+from .flirt_sig import FlirtSignature, FlirtSignatureParsed, FlirtSignatureError
+from .consts import FLIRT_ARCH_TO_ARCHNAME, FLIRT_OS_TO_OSNAME, FlirtAppType, FlirtOSType
+
+
+def flirt_arch_to_arch_name(flirt_arch: int, app_types: int) -> str:
+    """
+    Convert FLIRT architecture ID to architecture name.
+
+    :param flirt_arch: FLIRT architecture ID.
+    :param app_types: FLIRT application types.
+    :return: Architecture name.
+    """
+    try:
+        arches = FLIRT_ARCH_TO_ARCHNAME[flirt_arch]
+    except KeyError:
+        return "Unknown"
+    if app_types & FlirtAppType.APP_32_BIT and 32 in arches:
+        return arches[32]
+    if app_types & FlirtAppType.APP_64_BIT and 64 in arches:
+        return arches[64]
+    return "Unknown"
+
+
+def flirt_os_type_to_os_name(os_type: int) -> str:
+    """
+    Convert FLIRT OS type to OS name.
+
+    :param os_type: FLIRT OS type.
+    :return: OS name.
+    """
+    try:
+        v = FlirtOSType(os_type)
+        return FLIRT_OS_TO_OSNAME.get(v, v.name)
+    except ValueError:
+        return "UnknownOS"
+
+
+__all__ = [
+    "FlirtAnalysis",
+    "FlirtSignature",
+    "FlirtSignatureError",
+    "FlirtSignatureParsed",
+    "flirt_arch_to_arch_name",
+    "flirt_os_type_to_os_name",
+]

angr/analyses/flirt/consts.py

@@ -0,0 +1,160 @@
+# pylint:disable=missing-class-docstring
+from __future__ import annotations
+from enum import Enum
+
+
+class FlirtArch(int, Enum):
+    ARCH_386 = 0  # Intel 80x86
+    ARCH_Z80 = 1  # 8085, Z80
+    ARCH_I860 = 2  # Intel 860
+    ARCH_8051 = 3  # 8051
+    ARCH_TMS = 4  # Texas Instruments TMS320C5x
+    ARCH_6502 = 5  # 6502
+    ARCH_PDP = 6  # PDP11
+    ARCH_68K = 7  # Motorola 680x0
+    ARCH_JAVA = 8  # Java
+    ARCH_6800 = 9  # Motorola 68xx
+    ARCH_ST7 = 10  # SGS-Thomson ST7
+    ARCH_MC6812 = 11  # Motorola 68HC12
+    ARCH_MIPS = 12  # MIPS
+    ARCH_ARM = 13  # Advanced RISC Machines
+    ARCH_TMSC6 = 14  # Texas Instruments TMS320C6x
+    ARCH_PPC = 15  # PowerPC
+    ARCH_80196 = 16  # Intel 80196
+    ARCH_Z8 = 17  # Z8
+    ARCH_SH = 18  # Renesas (formerly Hitachi) SuperH
+    ARCH_NET = 19  # Microsoft Visual Studio.Net
+    ARCH_AVR = 20  # Atmel 8-bit RISC processor(s)
+    ARCH_H8 = 21  # Hitachi H8/300, H8/2000
+    ARCH_PIC = 22  # Microchip's PIC
+    ARCH_SPARC = 23  # SPARC
+    ARCH_ALPHA = 24  # DEC Alpha
+    ARCH_HPPA = 25  # Hewlett-Packard PA-RISC
+    ARCH_H8500 = 26  # Hitachi H8/500
+    ARCH_TRICORE = 27  # Tasking Tricore
+    ARCH_DSP56K = 28  # Motorola DSP5600x
+    ARCH_C166 = 29  # Siemens C166 family
+    ARCH_ST20 = 30  # SGS-Thomson ST20
+    ARCH_IA64 = 31  # Intel Itanium IA64
+    ARCH_I960 = 32  # Intel 960
+    ARCH_F2MC = 33  # Fujitsu F2MC-16
+    ARCH_TMS320C54 = 34  # Texas Instruments TMS320C54xx
+    ARCH_TMS320C55 = 35  # Texas Instruments TMS320C55xx
+    ARCH_TRIMEDIA = 36  # Trimedia
+    ARCH_M32R = 37  # Mitsubishi 32bit RISC
+    ARCH_NEC_78K0 = 38  # NEC 78K0
+    ARCH_NEC_78K0S = 39  # NEC 78K0S
+    ARCH_M740 = 40  # Mitsubishi 8bit
+    ARCH_M7700 = 41  # Mitsubishi 16bit
+    ARCH_ST9 = 42  # ST9+
+    ARCH_FR = 43  # Fujitsu FR Family
+    ARCH_MC6816 = 44  # Motorola 68HC16
+    ARCH_M7900 = 45  # Mitsubishi 7900
+    ARCH_TMS320C3 = 46  # Texas Instruments TMS320C3
+    ARCH_KR1878 = 47  # Angstrem KR1878
+    ARCH_AD218X = 48  # Analog Devices ADSP 218X
+    ARCH_OAKDSP = 49  # Atmel OAK DSP
+    ARCH_TLCS900 = 50  # Toshiba TLCS-900
+    ARCH_C39 = 51  # Rockwell C39
+    ARCH_CR16 = 52  # NSC CR16
+    ARCH_MN102L00 = 53  # Panasonic MN10200
+    ARCH_TMS320C1X = 54  # Texas Instruments TMS320C1x
+    ARCH_NEC_V850X = 55  # NEC V850 and V850ES/E1/E2
+    ARCH_SCR_ADPT = 56  # Processor module adapter for processor modules written in scripting languages
+    ARCH_EBC = 57  # EFI Bytecode
+    ARCH_MSP430 = 58  # Texas Instruments MSP430
+    ARCH_SPU = 59  # Cell Broadband Engine Synergistic Processor Unit
+    ARCH_DALVIK = 60  # Android Dalvik Virtual Machine
+
+
+FLIRT_ARCH_TO_ARCHNAME: dict[int, dict[int, str]] = {
+    FlirtArch.ARCH_386: {32: "X86", 64: "AMD64"},
+    FlirtArch.ARCH_MIPS: {32: "MIPS32", 64: "MIPS64"},
+    FlirtArch.ARCH_ARM: {32: "ARM", 64: "AARCH64"},
+    FlirtArch.ARCH_PPC: {32: "PPC32", 64: "PPC64"},
+    FlirtArch.ARCH_SPARC: {32: "SPARC32", 64: "SPARC64"},
+}
+
+
+class FlirtFileType(int, Enum):
+    FILE_DOS_EXE_OLD = 0x00000001
+    FILE_DOS_COM_OLD = 0x00000002
+    FILE_BIN = 0x00000004
+    FILE_DOSDRV = 0x00000008
+    FILE_NE = 0x00000010
+    FILE_INTELHEX = 0x00000020
+    FILE_MOSHEX = 0x00000040
+    FILE_LX = 0x00000080
+    FILE_LE = 0x00000100
+    FILE_NLM = 0x00000200
+    FILE_COFF = 0x00000400
+    FILE_PE = 0x00000800
+    FILE_OMF = 0x00001000
+    FILE_SREC = 0x00002000
+    FILE_ZIP = 0x00004000
+    FILE_OMFLIB = 0x00008000
+    FILE_AR = 0x00010000
+    FILE_LOADER = 0x00020000
+    FILE_ELF = 0x00040000
+    FILE_W32RUN = 0x00080000
+    FILE_AOUT = 0x00100000
+    FILE_PILOT = 0x00200000
+    FILE_DOS_EXE = 0x00400000
+    FILE_DOS_COM = 0x00800000
+    FILE_AIXAR = 0x01000000
+
+
+class FlirtOSType(int, Enum):
+    """
+    Actually no longer used in IDA.
+    """
+
+    OS_MSDOS = 0x01
+    OS_WIN = 0x02
+    OS_OS2 = 0x04
+    OS_NETWARE = 0x08
+    OS_UNIX = 0x10
+    OS_OTHER = 0x20
+
+
+FLIRT_OS_TO_OSNAME = {
+    FlirtOSType.OS_MSDOS: "MSDOS",
+    FlirtOSType.OS_WIN: "Win32",
+    FlirtOSType.OS_OS2: "OS/2",
+    FlirtOSType.OS_UNIX: "Linux",
+    FlirtOSType.OS_OTHER: "Other",
+}
+
+
+class FlirtAppType(int, Enum):
+    APP_CONSOLE = 0x0001
+    APP_GRAPHICS = 0x0002
+    APP_EXE = 0x0004
+    APP_DLL = 0x0008
+    APP_DRV = 0x0010
+    APP_SINGLE_THREADED = 0x0020
+    APP_MULTI_THREADED = 0x0040
+    APP_16_BIT = 0x0080
+    APP_32_BIT = 0x0100
+    APP_64_BIT = 0x0200
+
+
+class FlirtFeatureFlag(int, Enum):
+    FEATURE_STARTUP = 0x1
+    FEATURE_CTYPE_CRC = 0x2
+    FEATURE_2BYTE_CTYPE = 0x4
+    FEATURE_ALT_CTYPE_CRC = 0x8
+    FEATURE_COMPRESSED = 0x10
+
+
+class FlirtParseFlag(int, Enum):
+    PARSE_MORE_PUBLIC_NAMES = 0x1
+    PARSE_READ_TAIL_BYTES = 0x2
+    PARSE_READ_REFERENCED_FUNCTIONS = 0x4
+    PARSE_MORE_MODULES_WITH_SAME_CRC = 0x8
+    PARSE_MORE_MODULES = 0x10
+
+
+class FlirtFunctionFlag(int, Enum):
+    FUNCTION_LOCAL = 0x2
+    FUNCTION_UNRESOLVED_COLLISION = 0x8

angr/analyses/flirt/flirt.py

@@ -0,0 +1,249 @@
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+from collections.abc import Generator
+from collections import defaultdict
+import contextlib
+import logging
+
+from archinfo.arch_arm import is_arm_arch
+
+from angr.analyses import AnalysesHub
+from angr.analyses.analysis import Analysis
+from angr.errors import AngrRuntimeError
+from .flirt_sig import FlirtSignature, FlirtSignatureParsed
+from .flirt_function import FlirtFunction
+from .flirt_matcher import FlirtMatcher
+
+if TYPE_CHECKING:
+    from angr.knowledge_plugins.functions import Function
+
+
+_l = logging.getLogger(name=__name__)
+
+
+MAX_UNIQUE_STRING_LEN = 70
+
+
+class FlirtAnalysis(Analysis):
+    """
+    FlirtAnalysis accomplishes two purposes:
+
+    - If a FLIRT signature file is specified, it will match the given signature file against the current binary and
+      rename recognized functions accordingly.
+    - If no FLIRT signature file is specified, it will use strings to determine possible libraries embedded in the
+      current binary, and then match all possible signatures for the architecture.
+    """
+
+    def __init__(self, sig: FlirtSignature | str | None = None, max_mismatched_bytes: int = 0, dry_run: bool = False):
+
+        from angr.flirt import FLIRT_SIGNATURES_BY_ARCH  # pylint:disable=import-outside-toplevel
+
+        self._is_arm = is_arm_arch(self.project.arch)
+        self._all_suggestions: dict[str, dict[str, dict[int, str]]] = {}
+        self._suggestions: dict[int, str] = {}
+        self.matched_suggestions: dict[str, tuple[FlirtSignature, dict[int, str]]] = {}
+        self._temporary_sig = False
+        self._max_mismatched_bytes = max_mismatched_bytes
+
+        if sig:
+            if isinstance(sig, str):
+                # this is a file path
+                simos_name = self.project.arch.name if self.project.simos.name is not None else "UnknownOS"
+                sig = FlirtSignature(simos_name.lower(), simos_name.lower(), "Temporary", sig, None)
+
+                self.signatures = [sig]
+                self._temporary_sig = True
+
+        else:
+            if not FLIRT_SIGNATURES_BY_ARCH:
+                raise AngrRuntimeError(
+                    "No FLIRT signatures exist. Please load FLIRT signatures by calling "
+                    "load_signatures() before running FlirtAnalysis."
+                )
+
+            # determine all signatures to match against strings in mapped memory regions
+            mem_regions = [
+                self.project.loader.memory.load(seg.vaddr, seg.memsize)
+                for seg in self.project.loader.main_object.segments
+                if seg.filesize > 0 and seg.memsize > 0
+            ]
+
+            self.signatures = list(self._find_hits_by_strings(mem_regions))
+            _l.debug("Identified %d signatures to apply.", len(self.signatures))
+
+        path_to_sig: dict[str, FlirtSignature] = {}
+        for sig_ in self.signatures:
+            self._match_all_against_one_signature(sig_)
+            if sig_.sig_name not in self._all_suggestions:
+                self._all_suggestions[sig_.sig_name] = {}
+            path_to_sig[sig_.sig_path] = sig_
+            self._all_suggestions[sig_.sig_name][sig_.sig_path] = self._suggestions
+            self._suggestions = {}
+
+        for lib, sig_to_suggestions in self._all_suggestions.items():
+            max_suggestions = None
+            max_suggestion_sig_path = None
+            for sig_, suggestion in sig_to_suggestions.items():
+                _l.debug("Signature %s has %d function name suggestions.", sig_, len(suggestion))
+                if max_suggestions is None or len(suggestion) > max_suggestions:
+                    max_suggestion_sig_path = sig_
+                    max_suggestions = len(suggestion)
+
+            if max_suggestion_sig_path is not None:
+                sig_ = path_to_sig.get(max_suggestion_sig_path)
+                assert sig_ is not None
+                _l.info("Applying FLIRT signature %s for library %s.", sig_, lib)
+                if not dry_run:
+                    self._apply_changes(
+                        sig_.sig_name if not self._temporary_sig else None, sig_to_suggestions[max_suggestion_sig_path]
+                    )
+                self.matched_suggestions[lib] = (sig_, sig_to_suggestions[max_suggestion_sig_path])
+
+    def _find_hits_by_strings(self, regions: list[bytes]) -> Generator[FlirtSignature]:
+
+        from angr.flirt import STRING_TO_LIBRARIES, LIBRARY_TO_SIGNATURES  # pylint:disable=import-outside-toplevel
+
+        library_hits: dict[str, int] = defaultdict(int)
+        for s, libs in STRING_TO_LIBRARIES.items():
+            for region in regions:
+                if s.encode("ascii") in region:
+                    for lib in libs:
+                        library_hits[lib] += 1
+
+        # sort libraries based on the number of hits
+        sorted_libraries = sorted(library_hits.keys(), key=lambda lib: library_hits[lib], reverse=True)
+        arch_lowercase = self.project.arch.name.lower()
+
+        for lib in sorted_libraries:
+            for sig in LIBRARY_TO_SIGNATURES[lib]:
+                if sig.arch == arch_lowercase:
+                    yield sig
+                elif sig.arch == "armel" and self._is_arm:
+                    # ARMHF may use ARMEL libraries
+                    yield sig
+
+    def _match_all_against_one_signature(self, sig: FlirtSignature):
+        # match each function
+        self._suggestions = {}
+        with open(sig.sig_path, "rb") as sigfile:
+            flirt = FlirtSignatureParsed.parse(sigfile)
+            tolerances = range(self._max_mismatched_bytes + 1)
+            for tolerance in tolerances:
+                # we iteratively match until we find no new matches
+                updated_funcs = set()
+                while True:
+                    matched = False
+
+                    funcs = (
+                        self.project.kb.functions.values()
+                        if not updated_funcs
+                        else {self.project.kb.functions.get_by_addr(a) for a in self._get_caller_funcs(updated_funcs)}
+                    )
+                    updated_funcs = set()
+
+                    for func in funcs:
+                        func: Function
+                        if func.is_simprocedure or func.is_plt:
+                            continue
+                        if func.addr in self._suggestions:
+                            # we already have a suggestion for this function
+                            continue
+                        if not func.is_default_name:
+                            # it already has a name. skip
+                            continue
+
+                        # print(tolerance, repr(func))
+                        start = func.addr
+                        if self._is_arm:
+                            start = start & 0xFFFF_FFFE
+
+                        max_block_addr = max(func.block_addrs_set)
+                        end_block = func.get_block(max_block_addr)
+                        end = max_block_addr + end_block.size
+
+                        if self._is_arm:
+                            end = end & 0xFFFF_FFFE
+
+                        # load all bytes
+                        func_bytes = self.project.loader.memory.load(start, end - start + 0x100)
+                        matcher = FlirtMatcher(
+                            flirt,
+                            func,
+                            self._get_callee_name,
+                            self._on_func_matched,
+                            mismatch_bytes_tolerance=tolerance,
+                        )
+                        func_matched = matcher.match_function(func_bytes, start)
+                        if func_matched:
+                            updated_funcs.add(func.addr)
+                        matched |= func_matched
+
+                    if not matched:
+                        break
+
+    def _get_caller_funcs(self, update_func_addrs: set[int]) -> set[int]:
+        caller_funcs = set()
+        for func_addr in update_func_addrs:
+            for pred in self.kb.functions.callgraph.predecessors(func_addr):
+                if pred != func_addr:
+                    caller_funcs.add(pred)
+        return caller_funcs
+
+    def _get_callee_name(
+        self, func, func_addr: int, call_addr: int, expected_name: str  # pylint:disable=unused-argument
+    ) -> str | None:
+        for block_addr, (call_target, _) in func._call_sites.items():
+            block = func.get_block(block_addr)
+            call_ins_addr = (
+                block.instruction_addrs[-2] if self.project.arch.branch_delay_slot else block.instruction_addrs[-1]
+            )
+            if block_addr <= call_addr < block_addr + block.size and call_ins_addr <= call_addr:
+                if call_target is None or not self.kb.functions.contains_addr(call_target):
+                    return None
+                callee = self.kb.functions.get_by_addr(call_target)
+                return callee.name
+        return None
+
+    def _get_func_for_addr(self, func_addr) -> Function | None:
+        try:
+            return self.kb.functions.get_by_addr(func_addr)
+        except KeyError:
+            # the function is not found. Try the THUMB version
+            if self._is_arm:
+                with contextlib.suppress(KeyError):
+                    return self.kb.functions.get_by_addr(func_addr + 1)
+        return None
+
+    def _on_func_matched(self, func: Function, base_addr: int, flirt_func: FlirtFunction):
+        func_addr = base_addr + flirt_func.offset
+        _l.debug(
+            "_on_func_matched() is called with func_addr %#x with a suggested name %s.", func_addr, flirt_func.name
+        )
+        if func_addr != base_addr or (self._is_arm and func_addr != base_addr + 1):
+            # get the correct function
+            matched_func = self._get_func_for_addr(func_addr)
+            if matched_func is None:
+                _l.debug(
+                    "FlirtAnalysis identified a function at %#x but it does not exist in function manager.", func_addr
+                )
+                return
+            func = matched_func
+
+        if func.is_default_name:
+            # set the function name
+            # TODO: Make sure function names do not conflict with existing ones
+            _l.debug("Identified %s @ %#x (%#x-%#x)", flirt_func.name, func_addr, base_addr, flirt_func.offset)
+            func_name = flirt_func.name if flirt_func.name != "?" else f"unknown_function_{func.addr:x}"
+            self._suggestions[func.addr] = func_name
+
+    def _apply_changes(self, library_name: str | None, suggestion: dict[int, str]) -> None:
+        for func_addr, suggested_name in suggestion.items():
+            func = self.kb.functions.get_by_addr(func_addr)
+            func.name = suggested_name
+            func.is_default_name = False
+            func.from_signature = "flirt"
+            func.find_declaration(ignore_binary_name=True, binary_name_hint=library_name)
+
+
+AnalysesHub.register_default("Flirt", FlirtAnalysis)

angr/analyses/flirt/flirt_function.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+
+class FlirtFunction:
+    """
+    Describes a function object in a FLIRT signature.
+    """
+
+    __slots__ = (
+        "collision",
+        "local",
+        "name",
+        "offset",
+    )
+
+    def __init__(self, name: str, offset: int, local: bool, collision: bool):
+        self.name = name
+        self.offset = offset
+        self.local = local
+        self.collision = collision