angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/analyses/decompiler/optimization_passes/static_vvar_rewriter.py

@@ -0,0 +1,336 @@
+from __future__ import annotations
+import logging
+
+from angr.ailment import Statement, Block, Assignment, BinaryOp
+from angr.ailment.expression import Const, VirtualVariable, Load
+from angr.ailment.block_walker import AILBlockViewer, AILBlockRewriter
+from angr.ailment.statement import Call
+from angr.sim_type import SimTypeWideChar, SimTypeChar, SimTypePointer
+from angr.utils.graph import GraphUtils
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(__name__)
+
+
+#
+# Data types
+#
+
+
+class FixedBuffer:
+    def __init__(self, ident: str | None, size: int, content: bytes):
+        self.ident = ident or "<unnamed>"
+        self.size = size
+        self.content = content
+
+    def __repr__(self):
+        return f"<FixedBuffer {self.ident} size={self.size}>"
+
+
+class FixedBufferPtr:
+    def __init__(self, buffer_ident: str, offset: int = 0):
+        self.buffer_ident = buffer_ident
+        self.offset = offset
+
+    def __repr__(self):
+        return f"<FixedBufferPtr {self.buffer_ident} + {self.offset}>"
+
+
+class Offset:
+    def __init__(self, value: int, bits: int):
+        self.value = value
+        self.bits = bits
+
+    def __repr__(self):
+        return f"<Offset {self.value} ({self.bits} bits)>"
+
+
+#
+# Visitors
+#
+
+
+class VVarRewritingVisitor(AILBlockRewriter):
+    """
+    The visitor that rewrites vvars and their reads.
+    """
+
+    def __init__(self, static_buffers: dict[str, FixedBuffer], static_vvars: dict[int, FixedBufferPtr | Const], kb):
+        super().__init__(update_block=False)
+        self._static_buffers = static_buffers
+        self._static_vvars = static_vvars
+        self.kb = kb
+
+    def _handle_VirtualVariable(
+        self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt: Statement, block: Block | None
+    ):
+        if expr.varid in self._static_vvars:
+            v = self._static_vvars[expr.varid]
+            if isinstance(v, Const):
+                return v
+        return None
+
+    def _handle_Load(self, expr_idx: int, expr: Load, stmt_idx: int, stmt: Statement, block: Block | None):
+        if isinstance(expr.addr, VirtualVariable) and expr.addr.varid in self._static_vvars:
+            v = self._static_vvars[expr.addr.varid]
+            if isinstance(v, FixedBufferPtr):
+                buffer = self._static_buffers.get(v.buffer_ident, None)
+                if buffer is None:
+                    _l.warning("Cannot find static buffer %s", v.buffer_ident)
+                    return None
+                if v.offset < 0 or v.offset + expr.size > buffer.size:
+                    _l.warning(
+                        "Static buffer %s access out of bounds: offset=%d, size=%d, buffer_size=%d",
+                        v.buffer_ident,
+                        v.offset,
+                        expr.size,
+                        buffer.size,
+                    )
+                    return None
+                data = buffer.content[v.offset : v.offset + expr.size]
+                value = int.from_bytes(data, byteorder="little" if expr.endness == "Iend_LE" else "big")
+                return Const(None, None, value, expr.bits, **expr.tags)
+
+        return super()._handle_Load(expr_idx, expr, stmt_idx, stmt, block)
+
+    def _handle_CallExpr(self, expr_idx: int, expr: Call, stmt_idx: int, stmt: Statement, block: Block | None):
+        if expr.target in {"strlen", "wcslen"} and expr.args:
+            arg = expr.args[0]
+            if isinstance(arg, VirtualVariable) and arg.varid in self._static_vvars:
+                v = self._static_vvars[arg.varid]
+                if isinstance(v, FixedBufferPtr):
+                    buffer = self._static_buffers.get(v.buffer_ident, None)
+                    if buffer is None:
+                        _l.warning("Cannot find static buffer %s", v.buffer_ident)
+                        return None
+                    # compute the length of the string in the buffer
+                    data = buffer.content[v.offset :]
+                    str_len = 0
+                    word_size = 2 if expr.target == "wcslen" else 1
+                    while (
+                        str_len < len(data)
+                        and data[str_len * word_size : str_len * word_size + word_size] != b"\x00" * word_size
+                    ):
+                        str_len += 1
+                    return Const(None, None, str_len, expr.bits, **expr.tags)
+
+        elif expr.args and expr.prototype is not None:
+            new_args: list | None = None
+            for arg_idx, (arg_type, arg) in enumerate(zip(expr.prototype.args, expr.args)):
+                if (  # noqa:SIM102
+                    isinstance(arg, VirtualVariable)
+                    and arg.varid in self._static_vvars
+                    and isinstance(self._static_vvars[arg.varid], FixedBufferPtr)
+                ):
+                    if isinstance(arg_type, SimTypePointer):
+                        if isinstance(arg_type.pts_to, SimTypeChar):
+                            # char*
+                            data = self._static_buffers[self._static_vvars[arg.varid].buffer_ident].content
+                            offset = self._static_vvars[arg.varid].offset
+                            str_bytes = bytearray()
+                            idx = offset
+                            while idx < len(data):
+                                byte = data[idx : idx + 1]
+                                if byte == b"\x00":
+                                    break
+                                str_bytes += byte
+                                idx += 1
+                            str_id = self.kb.custom_strings.allocate(bytes(str_bytes))
+                            str_id_arg = Const(
+                                None,
+                                None,
+                                str_id,
+                                arg.bits,
+                                custom_string=True,
+                                **arg.tags,
+                            )
+                            if new_args is None:
+                                new_args = expr.args[:arg_idx]
+                            new_args.append(str_id_arg)
+                            continue
+
+                        if isinstance(arg_type.pts_to, SimTypeWideChar):
+                            # wchar*
+                            data = self._static_buffers[self._static_vvars[arg.varid].buffer_ident].content
+                            offset = self._static_vvars[arg.varid].offset
+                            str_bytes = bytearray()
+                            idx = offset
+                            while idx + 2 <= len(data):
+                                wchar_bytes = data[idx : idx + 2]
+                                if wchar_bytes == b"\x00\x00":
+                                    break
+                                str_bytes += wchar_bytes
+                                idx += 2
+                            str_id = self.kb.custom_strings.allocate(bytes(str_bytes))
+                            str_id_arg = Const(
+                                None,
+                                None,
+                                str_id,
+                                arg.bits,
+                                custom_string=True,
+                                **arg.tags,
+                            )
+                            if new_args is None:
+                                new_args = expr.args[:arg_idx]
+                            new_args.append(str_id_arg)
+                            continue
+
+                if new_args is not None:
+                    new_args.append(arg)
+
+            if new_args is not None:
+                return Call(
+                    expr.idx,
+                    expr.target,
+                    calling_convention=expr.calling_convention,
+                    prototype=expr.prototype,
+                    args=new_args,
+                    ret_expr=expr.ret_expr,
+                    fp_ret_expr=expr.fp_ret_expr,
+                    bits=expr.bits,
+                    **expr.tags,
+                )
+
+        return None
+
+
+class VVarAliasVisitor(AILBlockViewer):
+    """
+    The visitor that discovers const assignments and aliases of existing static vvars.
+    """
+
+    def __init__(self, static_buffers: dict[str, FixedBuffer], static_vvars: dict[int, FixedBufferPtr | Const], kb):
+        super().__init__()
+        self._static_buffers = static_buffers
+        self._static_vvars = static_vvars
+        self.kb = kb
+
+    def _handle_Assignment(self, stmt_idx: int, stmt: Assignment, block: Block | None):
+        src = self._handle_expr(1, stmt.src, stmt_idx, stmt, block)
+        dst = stmt.dst
+        if (
+            isinstance(dst, VirtualVariable)
+            and dst.varid not in self._static_vvars
+            and src is not None
+            and isinstance(src, FixedBufferPtr)
+        ):
+            self._static_vvars[dst.varid] = src
+
+    def _handle_VirtualVariable(
+        self, expr_idx: int, expr: VirtualVariable, stmt_idx: int, stmt: Statement, block: Block | None
+    ):
+        return self._static_vvars.get(expr.varid, None)
+
+    def _handle_Const(self, expr_idx: int, expr: Const, stmt_idx: int, stmt: Statement, block: Block | None):
+        return Offset(expr.value, expr.bits)
+
+    def _handle_Call(self, stmt_idx: int, stmt: Call, block: Block | None):
+        if (
+            stmt.target == "memcpy"
+            and isinstance(stmt.args[0], VirtualVariable)
+            and isinstance(stmt.args[1], Const)
+            and isinstance(stmt.args[2], Const)
+        ):
+            # got a new memcpy call that we can handle
+            dst, src, size = stmt.args
+            if dst.varid not in self._static_vvars:
+                if src.tags.get("custom_string", False):
+                    ident = f"static_buf_{stmt.tags['ins_addr']}"
+                    buf = self.kb.custom_strings[src.value_int]
+                    fixed_buffer = FixedBuffer(ident, size.value_int, buf)
+                else:
+                    # TODO: Support other cases
+                    return super()._handle_Call(stmt_idx, stmt, block)
+                if ident not in self._static_buffers:
+                    self._static_buffers[ident] = fixed_buffer
+                self._static_vvars[dst.varid] = FixedBufferPtr(ident, 0)
+
+        return super()._handle_Call(stmt_idx, stmt, block)
+
+    def _handle_BinaryOp(self, expr_idx: int, expr: BinaryOp, stmt_idx: int, stmt: Statement, block: Block | None):
+        op0 = self._handle_expr(0, expr.operands[0], stmt_idx, stmt, block)
+        op1 = self._handle_expr(1, expr.operands[1], stmt_idx, stmt, block)
+        if op0 is None or op1 is None:
+            return None
+        if expr.op == "Add":
+            if isinstance(op0, FixedBufferPtr) and isinstance(op1, Offset):
+                return FixedBufferPtr(op0.buffer_ident, op0.offset + op1.value)
+            if isinstance(op1, FixedBufferPtr) and isinstance(op0, Offset):
+                return FixedBufferPtr(op1.buffer_ident, op1.offset + op0.value)
+        elif expr.op == "Sub":
+            if isinstance(op0, FixedBufferPtr) and isinstance(op1, Offset):
+                return FixedBufferPtr(op0.buffer_ident, op0.offset - op1.value)
+        elif expr.op == "Mul":
+            if isinstance(op0, Offset) and isinstance(op1, Offset):
+                return Offset(op0.value * op1.value, expr.bits)
+        return None
+
+
+#
+# The main class
+#
+
+
+class StaticVVarRewriter(OptimizationPass):
+    """
+    Rewrite user-specified vvars as static values or fix-sized buffers. Also rewrites reads from pointers derived off
+    of such vvars.
+    """
+
+    ARCHES = None
+    PLATFORMS = None
+    STAGE = OptimizationPassStage.BEFORE_VARIABLE_RECOVERY
+    NAME = "Static virtual variable rewriter"
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(
+        self,
+        func,
+        static_buffers: dict[str, FixedBuffer] | None = None,
+        static_vvars: dict[int, FixedBufferPtr | Const] | None = None,
+        **kwargs,
+    ):
+        super().__init__(func, **kwargs)
+        self._static_buffers = static_buffers
+        self._static_vvars = static_vvars
+        self.analyze()
+
+    def _check(self):
+        # discover aliases
+        alias_visitor = VVarAliasVisitor(self._static_buffers, self._static_vvars, self.kb)
+        head = {(node.addr, node.idx): node for node in self._graph}[self.entry_node_addr]
+        for block in reversed(list(GraphUtils.dfs_postorder_nodes_deterministic(self._graph, head))):
+            alias_visitor.walk(block)
+        if not self._static_buffers or not self._static_vvars:
+            return False, None
+        return True, None
+
+    def _analyze(self, cache=None):
+        # rewrite vvars
+        g = self._graph
+
+        rewritten = False
+        while True:
+            rewriter = VVarRewritingVisitor(self._static_buffers, self._static_vvars, self.kb)
+            for block in list(g):
+                new_block = rewriter.walk(block)
+                if new_block is not None:
+                    rewritten = True
+                    self._update_block(block, new_block)
+
+            if not rewritten:
+                break
+
+            g = self.out_graph
+            # discover more aliases
+            old_static_buffers = dict(self._static_buffers)
+            old_static_vvars = dict(self._static_vvars)
+            alias_visitor = VVarAliasVisitor(self._static_buffers, self._static_vvars, self.kb)
+            head = {(node.addr, node.idx): node for node in g}[self.entry_node_addr]
+            for block in reversed(list(GraphUtils.dfs_postorder_nodes_deterministic(g, head))):
+                alias_visitor.walk(block)
+
+            if old_static_buffers == self._static_buffers and old_static_vvars == self._static_vvars:
+                # no new aliases found
+                break

angr/analyses/decompiler/optimization_passes/switch_default_case_duplicator.py

@@ -0,0 +1,166 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
+from itertools import count
+from collections import defaultdict
+import logging
+
+import networkx
+
+from angr.ailment.block import Block
+from angr.ailment.statement import Jump
+from angr.ailment.expression import Const
+
+from angr.knowledge_plugins.cfg import IndirectJumpType
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(name=__name__)
+
+
+class SwitchDefaultCaseDuplicator(OptimizationPass):
+    """
+    For each switch-case construct (identified by jump tables), duplicate the default-case node when we detect
+    situations where the default-case node is seemingly reused by edges outside the switch-case construct. This code
+    reuse is usually caused by compiler code deduplication.
+
+    Ideally this pass should be implemented as an ISC optimization reversion.
+    """
+
+    ARCHES = None
+    PLATFORMS = None
+    STAGE = OptimizationPassStage.AFTER_AIL_GRAPH_CREATION
+    NAME = "Duplicate default-case nodes to undo default-case node reuse caused by compiler code deduplication"
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+
+        self.node_idx = count(start=self._scratch.get("node_idx", 0))
+
+        self.analyze()
+
+        self._scratch["node_idx"] = next(self.node_idx)
+
+    def _check(self):
+        jumptables = self.kb.cfgs.get_most_accurate().jump_tables
+        switch_jump_block_addrs = {
+            jumptable.addr
+            for jumptable in jumptables.values()
+            if jumptable.type
+            in {IndirectJumpType.Jumptable_AddressComputed, IndirectJumpType.Jumptable_AddressLoadedFromMemory}
+        }
+        jump_node_addrs = self._func.block_addrs_set.intersection(switch_jump_block_addrs)
+        if not jump_node_addrs:
+            return False, None
+
+        default_case_node_addrs = set()
+        for node_addr in jump_node_addrs:
+            node = self._func.get_node(node_addr)
+            if self._func.graph.in_degree[node] == 1:
+                pred = next(iter(self._func.graph.predecessors(node)))
+                if self._func.graph.out_degree[pred] == 2:
+                    default_case_node = next(
+                        iter(nn for nn in self._func.graph.successors(pred) if nn.addr != node_addr)
+                    )
+                    if self._func.graph.out_degree[default_case_node] == 1:
+                        default_case_node_addrs.add((pred.addr, node_addr, default_case_node.addr))
+
+        if not default_case_node_addrs:
+            return False, None
+
+        cache = {"default_case_node_addrs": default_case_node_addrs}
+        return True, cache
+
+    def _analyze(self, cache=None):
+
+        default_case_node_addrs = cache["default_case_node_addrs"]
+
+        out_graph = None
+        duplicated_default_addrs: set[int] = set()
+
+        default_addr_count = defaultdict(int)
+        goto_rewritten_default_addrs = set()
+        for _, _, default_addr in default_case_node_addrs:
+            default_addr_count[default_addr] += 1
+        for default_addr, cnt in default_addr_count.items():
+            if cnt > 1:
+                # rewrite all of them into gotos
+                default_node = self._get_block(default_addr)
+                for switch_head_addr in sorted((sa for sa, _, da in default_case_node_addrs if da == default_addr)):
+                    # there is a case where the switch head node is broken into multiple nodes in clinic (e.g., at
+                    # cmov). we may need to traverse down to find the actual node that jumps to the default case
+                    switch_head_node = self._get_block(switch_head_addr)
+                    goto_stmt = Jump(
+                        None,
+                        Const(None, None, default_addr, self.project.arch.bits, ins_addr=default_addr),
+                        target_idx=None,  # I'm assuming the ID of the default node is None here
+                        ins_addr=default_addr,
+                    )
+                    goto_node = Block(
+                        default_addr,
+                        0,
+                        statements=[goto_stmt],
+                        idx=next(self.node_idx),
+                    )
+
+                    if out_graph is None:
+                        out_graph = self._graph
+                    if not out_graph.has_edge(switch_head_node, default_node):
+                        # find the real switch-case head node
+                        switch_head_node = None
+                        switch_head_block = self._func.get_node(switch_head_addr)
+                        if switch_head_block is not None:
+                            default_node_preds = list(out_graph.predecessors(default_node))
+                            for pred in default_node_preds:
+                                if pred.addr + pred.original_size == switch_head_block.addr + switch_head_block.size:
+                                    switch_head_node = pred
+                                    break
+                        if switch_head_node is None:
+                            _l.warning(
+                                "Cannot find the actual switch-case head node for default case at %#x", default_addr
+                            )
+                            continue
+                    out_graph.remove_edge(switch_head_node, default_node)
+                    out_graph.add_edge(switch_head_node, goto_node)
+                    out_graph.add_edge(goto_node, default_node)
+
+                goto_rewritten_default_addrs.add(default_addr)
+
+        for switch_head_addr, jump_node_addr, default_addr in default_case_node_addrs:
+            if default_addr in duplicated_default_addrs or default_addr in goto_rewritten_default_addrs:
+                continue
+
+            default_case_node = self._func.get_node(default_addr)
+            unexpected_pred_addrs = {
+                pred.addr
+                for pred in self._func.graph.predecessors(default_case_node)
+                if pred.addr not in {switch_head_addr, jump_node_addr}
+            }
+            if unexpected_pred_addrs:
+                default_case_block = self._get_block(default_addr)
+                default_case_succ_block = next(iter(self._graph.successors(default_case_block)))
+
+                jump_nodes = self._get_blocks(jump_node_addr)
+                jump_node_descedents = set()
+                for jump_node in jump_nodes:
+                    jump_node_descedents |= networkx.descendants(self._graph, jump_node)
+
+                duplicated_default_addrs.add(default_addr)
+
+                # duplicate default_case_node for each unexpected predecessor
+                for unexpected_pred_addr in unexpected_pred_addrs:
+                    for unexpected_pred in self._get_blocks(unexpected_pred_addr):
+                        # is this predecessor reachable from the jump node? if so, we believe this is a legitimate edge
+                        # and do not duplicate it.
+                        if unexpected_pred in jump_node_descedents:
+                            continue
+
+                        default_case_block_copy = default_case_block.copy()
+                        default_case_block_copy.idx = next(self.node_idx)
+                        if out_graph is None:
+                            out_graph = self._graph
+                        out_graph.remove_edge(unexpected_pred, default_case_block)
+                        out_graph.add_edge(unexpected_pred, default_case_block_copy)
+                        out_graph.add_edge(default_case_block_copy, default_case_succ_block)
+
+        self.out_graph = out_graph

angr/analyses/decompiler/optimization_passes/switch_reused_entry_rewriter.py

@@ -0,0 +1,102 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
+from itertools import count
+import logging
+
+from angr.ailment.block import Block
+from angr.ailment.statement import Jump
+from angr.ailment.expression import Const
+
+from angr.knowledge_plugins.cfg import IndirectJumpType
+
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(name=__name__)
+
+
+class SwitchReusedEntryRewriter(OptimizationPass):
+    """
+    For each switch-case construct (identified by jump tables), rewrite the entry into a goto block when we detect
+    situations where an entry node is reused by edges in switch-case constructs that are not the current one. This code
+    reuse is usually caused by compiler code deduplication.
+    """
+
+    ARCHES = None
+    PLATFORMS = None
+    STAGE = OptimizationPassStage.AFTER_AIL_GRAPH_CREATION
+    NAME = "Rewrite switch-case entry nodes with multiple predecessors into goto statements."
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+
+        self.node_idx = count(start=self._scratch.get("node_idx", 0))
+
+        self.analyze()
+
+        self._scratch["node_idx"] = next(self.node_idx)
+
+    def _check(self):
+        jumptables = self.kb.cfgs.get_most_accurate().jump_tables
+        switch_jump_block_addrs = {
+            jumptable.addr
+            for jumptable in jumptables.values()
+            if jumptable.type
+            in {IndirectJumpType.Jumptable_AddressComputed, IndirectJumpType.Jumptable_AddressLoadedFromMemory}
+        }
+        jump_node_addrs = self._func.block_addrs_set.intersection(switch_jump_block_addrs)
+        if not jump_node_addrs:
+            return False, None
+
+        # ensure each jump table entry node has only one predecessor
+        reused_entries: dict[Block, set[Block]] = {}
+        for jumptable in jumptables.values():
+            for entry_addr in sorted(set(jumptable.jumptable_entries)):
+                entry_nodes = self._get_blocks(entry_addr)
+                for entry_node in entry_nodes:
+                    preds = list(self._graph.predecessors(entry_node))
+                    if len(preds) > 1:
+                        non_current_jumptable_preds = [pred for pred in preds if pred.addr != jumptable.addr]
+                        if any(p.addr in switch_jump_block_addrs for p in non_current_jumptable_preds):
+                            reused_entries[entry_node] = {
+                                pred for pred in preds if pred.addr in switch_jump_block_addrs
+                            }
+
+        if not reused_entries:
+            return False, None
+        cache = {"reused_entries": reused_entries}
+        return True, cache
+
+    def _analyze(self, cache=None):
+
+        reused_entries: dict[Block, set[Block]] = cache["reused_entries"]
+        out_graph = None
+
+        for entry_node, pred_nodes in reused_entries.items():
+            # we assign the entry node to the predecessor with the lowest address
+            sorted_pred_nodes = sorted(pred_nodes, key=lambda x: (x.addr, x.idx))
+
+            for head_node in sorted_pred_nodes[1:]:
+
+                # create the new goto node
+                goto_stmt = Jump(
+                    None,
+                    Const(None, None, entry_node.addr, self.project.arch.bits, ins_addr=entry_node.addr),
+                    target_idx=entry_node.idx,
+                    ins_addr=entry_node.addr,
+                )
+                goto_node = Block(
+                    entry_node.addr,
+                    0,
+                    statements=[goto_stmt],
+                    idx=next(self.node_idx),
+                )
+
+                if out_graph is None:
+                    out_graph = self._graph
+                out_graph.remove_edge(head_node, entry_node)
+                out_graph.add_edge(head_node, goto_node)
+                # we are virtualizing these edges, so we don't need to add the edge from goto_node to the entry_node
+
+        self.out_graph = out_graph

angr/analyses/decompiler/optimization_passes/tag_slicer.py

@@ -0,0 +1,41 @@
+# pylint:disable=too-many-boolean-expressions
+from __future__ import annotations
+import logging
+
+from angr.ailment.statement import ConditionalJump, Jump, Label
+from .optimization_pass import OptimizationPass, OptimizationPassStage
+
+
+_l = logging.getLogger(name=__name__)
+
+
+class TagSlicer(OptimizationPass):
+    """
+    Removes unmarked statements from the graph.
+    """
+
+    ARCHES = None
+    PLATFORMS = None
+    STAGE = OptimizationPassStage.AFTER_VARIABLE_RECOVERY
+    NAME = "Remove unmarked statements from the graph."
+    DESCRIPTION = __doc__.strip()
+
+    def __init__(self, func, **kwargs):
+        super().__init__(func, **kwargs)
+        self.analyze()
+
+    def _check(self):
+        return True, {}
+
+    def _analyze(self, cache=None):
+        for n in self._graph.nodes():
+            for i, s in enumerate(n.statements):
+                if isinstance(s, (ConditionalJump, Jump, Label)):
+                    continue
+                if not s.tags.get("keep_in_slice", False):
+                    n.statements[i] = None
+
+        for n in self._graph.nodes():
+            n.statements = [s for s in n.statements if s is not None]
+
+        self.out_graph = self._graph