angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/analyses/decompiler/peephole_optimizations/inlined_strcpy_consolidation.py

@@ -0,0 +1,106 @@
+# pylint:disable=arguments-differ
+from __future__ import annotations
+
+from angr.ailment.expression import Expression, BinaryOp, Const, Register, StackBaseOffset, UnaryOp, VirtualVariable
+from angr.ailment.statement import Call, Store
+
+from angr import SIM_LIBRARIES
+from .base import PeepholeOptimizationMultiStmtBase
+from .inlined_strcpy import InlinedStrcpy
+
+
+class InlinedStrcpyConsolidation(PeepholeOptimizationMultiStmtBase):
+    """
+    Consolidate multiple inlined strcpy calls.
+    """
+
+    __slots__ = ()
+
+    NAME = "Consolidate multiple inlined strcpy calls"
+    stmt_classes = ((Call, Call), (Call, Store))
+
+    def optimize(self, stmts: list[Call], **kwargs):
+        last_stmt, stmt = stmts
+        if InlinedStrcpy.is_inlined_strcpy(last_stmt):
+            s_last: bytes = self.kb.custom_strings[last_stmt.args[1].value]
+            addr_last = last_stmt.args[0]
+            new_str = None  # will be set if consolidation should happen
+
+            if isinstance(stmt, Call) and InlinedStrcpy.is_inlined_strcpy(stmt):
+                # consolidating two calls
+                s_curr: bytes = self.kb.custom_strings[stmt.args[1].value]
+                addr_curr = stmt.args[0]
+                # determine if the two addresses are consecutive
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    # consolidate both calls!
+                    new_str = s_last + s_curr
+            elif isinstance(stmt, Store) and isinstance(stmt.data, Const):
+                # consolidating a call and a store, in case the store statement is storing the suffix of a string (but
+                # the suffix is too short to qualify an inlined strcpy optimization)
+                addr_curr = stmt.addr
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    if stmt.size == 1 and stmt.data.value == 0:
+                        # it's probably the terminating null byte
+                        r, s = True, "\x00"
+                    else:
+                        r, s = InlinedStrcpy.is_integer_likely_a_string(
+                            stmt.data.value, stmt.size, stmt.endness, min_length=1
+                        )
+                    if r:
+                        new_str = s_last + s.encode("ascii")
+
+            if new_str is not None:
+                if new_str.endswith(b"\x00"):
+                    call_name = "strcpy"
+                    new_str_idx = self.kb.custom_strings.allocate(new_str[:-1])
+                    args = [
+                        last_stmt.args[0],
+                        Const(None, None, new_str_idx, last_stmt.args[0].bits, custom_string=True),
+                    ]
+                    prototype = SIM_LIBRARIES["libc.so"][0].get_prototype("strcpy")
+                else:
+                    call_name = "strncpy"
+                    new_str_idx = self.kb.custom_strings.allocate(new_str)
+                    args = [
+                        last_stmt.args[0],
+                        Const(None, None, new_str_idx, last_stmt.args[0].bits, custom_string=True),
+                        Const(None, None, len(new_str), self.project.arch.bits),
+                    ]
+                    prototype = SIM_LIBRARIES["libc.so"][0].get_prototype("strncpy")
+
+                return [Call(stmt.idx, call_name, args=args, prototype=prototype, **stmt.tags)]
+
+        return None
+
+    @staticmethod
+    def _parse_addr(addr: Expression) -> tuple[Expression, int]:
+        if isinstance(addr, Register):
+            return addr, 0
+        if isinstance(addr, StackBaseOffset):
+            return StackBaseOffset(None, addr.bits, 0), addr.offset
+        if (
+            isinstance(addr, UnaryOp)
+            and addr.op == "Reference"
+            and isinstance(addr.operand, VirtualVariable)
+            and addr.operand.was_stack
+        ):
+            return StackBaseOffset(None, addr.bits, 0), addr.operand.stack_offset
+        if isinstance(addr, BinaryOp):
+            if addr.op == "Add" and isinstance(addr.operands[1], Const):
+                base_0, offset_0 = InlinedStrcpyConsolidation._parse_addr(addr.operands[0])
+                return base_0, offset_0 + addr.operands[1].value
+            if addr.op == "Sub" and isinstance(addr.operands[1], Const):
+                base_0, offset_0 = InlinedStrcpyConsolidation._parse_addr(addr.operands[0])
+                return base_0, offset_0 - addr.operands[1].value
+
+        return addr, 0
+
+    @staticmethod
+    def _get_delta(addr_0: Expression, addr_1: Expression) -> int | None:
+        base_0, offset_0 = InlinedStrcpyConsolidation._parse_addr(addr_0)
+        base_1, offset_1 = InlinedStrcpyConsolidation._parse_addr(addr_1)
+        if base_0.likes(base_1):
+            return offset_1 - offset_0
+        return None

angr/analyses/decompiler/peephole_optimizations/inlined_wcscpy.py

@@ -0,0 +1,256 @@
+# pylint:disable=arguments-differ
+from __future__ import annotations
+import string
+
+from archinfo import Endness
+
+from angr.ailment import BinaryOp
+from angr.ailment.expression import Const, StackBaseOffset, VirtualVariable
+from angr.ailment.statement import Call, Assignment, Statement, Store
+
+from angr.sim_type import SimTypePointer, SimTypeWideChar
+from angr.utils.endness import ail_const_to_be
+from .base import PeepholeOptimizationStmtBase
+
+
+ASCII_PRINTABLES = {ord(x) for x in string.printable}
+ASCII_DIGITS = {ord(x) for x in string.digits}
+
+
+class InlinedWcscpy(PeepholeOptimizationStmtBase):
+    """
+    Simplifies inlined wide string copying logic into calls to wcscpy.
+    """
+
+    __slots__ = ()
+
+    NAME = "Simplifying inlined wcscpy"
+    stmt_classes = (Assignment, Store)
+
+    def optimize(self, stmt: Assignment | Store, stmt_idx: int | None = None, block=None, **kwargs):
+        assert self.project is not None
+        assert self.kb is not None
+
+        if (
+            isinstance(stmt, Assignment)
+            and isinstance(stmt.dst, VirtualVariable)
+            and stmt.dst.was_stack
+            and isinstance(stmt.src, Const)
+            and isinstance(stmt.src.value, int)
+        ):
+            dst = StackBaseOffset(None, self.project.arch.bits, stmt.dst.stack_offset)
+            value_size = stmt.src.size
+            value = stmt.src.value
+        elif isinstance(stmt, Store) and isinstance(stmt.data, Const) and isinstance(stmt.data.value, int):
+            dst = stmt.addr
+            value_size = stmt.data.size
+            value = stmt.data.value
+        else:
+            return None
+
+        r, s = self.is_integer_likely_a_wide_string(value, value_size, self.project.arch.memory_endness)
+        if r:
+            # replace it with a call to strncpy
+            assert s is not None
+            str_id = self.kb.custom_strings.allocate(s)
+            wstr_type = SimTypePointer(SimTypeWideChar()).with_arch(self.project.arch)
+            return Call(
+                stmt.idx,
+                "wcsncpy",
+                args=[
+                    dst,
+                    Const(None, None, str_id, self.project.arch.bits, custom_string=True, type=wstr_type),
+                    Const(None, None, len(s) // 2, self.project.arch.bits),
+                ],
+                **stmt.tags,
+            )
+
+        # scan forward in the current block to find all consecutive constant stores
+        if block is not None and stmt_idx is not None:
+            all_constant_stores: dict[int, tuple[int, Const | None]] = self.collect_constant_stores(block, stmt_idx)
+            if all_constant_stores:
+                offsets = sorted(all_constant_stores.keys())
+                next_offset = min(offsets)
+                stride = []
+                for offset in offsets:
+                    if next_offset is not None and offset != next_offset:
+                        next_offset = None
+                        stride = []
+                    stmt_idx_, v = all_constant_stores[offset]
+                    if v is not None:
+                        stride.append((offset, stmt_idx_, v))
+                        next_offset = offset + v.size
+                    else:
+                        next_offset = None
+                        stride = []
+
+                integer, size = self.stride_to_int(stride)
+                r, s = self.is_integer_likely_a_wide_string(integer, size, Endness.BE, min_length=3)
+                if r:
+                    assert s is not None
+                    # we remove all involved statements whose statement IDs are greater than the current one
+                    for _, stmt_idx_, _ in reversed(stride):
+                        if stmt_idx_ <= stmt_idx:
+                            continue
+                        block.statements[stmt_idx_] = None
+                    block.statements = [ss for ss in block.statements if ss is not None]
+
+                    str_id = self.kb.custom_strings.allocate(s)
+                    wstr_type = SimTypePointer(SimTypeWideChar()).with_arch(self.project.arch)
+                    return Call(
+                        stmt.idx,
+                        "wcsncpy",
+                        args=[
+                            dst,
+                            Const(None, None, str_id, self.project.arch.bits, custom_string=True, type=wstr_type),
+                            Const(None, None, len(s) // 2, self.project.arch.bits),
+                        ],
+                        **stmt.tags,
+                    )
+
+        return None
+
+    @staticmethod
+    def stride_to_int(stride: list[tuple[int, int, Const]]) -> tuple[int, int]:
+        stride = sorted(stride, key=lambda x: x[0])
+        n = 0
+        size = 0
+        for _, _, v in stride:
+            size += v.size
+            assert isinstance(v.value, int)
+            n <<= v.bits
+            n |= v.value
+        return n, size
+
+    def collect_constant_stores(self, block, starting_stmt_idx: int) -> dict[int, tuple[int, Const | None]]:
+        assert self.project is not None
+
+        r = {}
+        expected_store_varid: int | None = None
+        starting_stmt = block.statements[starting_stmt_idx]
+        if (
+            isinstance(starting_stmt, Assignment)
+            and isinstance(starting_stmt.dst, VirtualVariable)
+            and starting_stmt.dst.was_stack
+            and isinstance(starting_stmt.dst.stack_offset, int)
+        ):
+            expected_type = "stack"
+        elif isinstance(starting_stmt, Store):
+            if isinstance(starting_stmt.addr, VirtualVariable):
+                expected_store_varid = starting_stmt.addr.varid
+            elif (
+                isinstance(starting_stmt.addr, BinaryOp)
+                and starting_stmt.addr.op == "Add"
+                and isinstance(starting_stmt.addr.operands[0], VirtualVariable)
+                and isinstance(starting_stmt.addr.operands[1], Const)
+            ):
+                expected_store_varid = starting_stmt.addr.operands[0].varid
+            else:
+                expected_store_varid = None
+            expected_type = "store"
+        else:
+            return r
+
+        for idx, stmt in enumerate(block.statements):
+            if idx < starting_stmt_idx:
+                continue
+            if (
+                expected_type == "stack"
+                and isinstance(stmt, Assignment)
+                and isinstance(stmt.dst, VirtualVariable)
+                and stmt.dst.was_stack
+                and isinstance(stmt.dst.stack_offset, int)
+            ):
+                offset = stmt.dst.stack_offset
+                value = (
+                    ail_const_to_be(stmt.src, self.project.arch.memory_endness) if isinstance(stmt.src, Const) else None
+                )
+            elif expected_type == "store" and isinstance(stmt, Store):
+                if isinstance(stmt.addr, VirtualVariable) and stmt.addr.varid == expected_store_varid:
+                    offset = 0
+                elif (
+                    isinstance(stmt.addr, BinaryOp)
+                    and stmt.addr.op == "Add"
+                    and isinstance(stmt.addr.operands[0], VirtualVariable)
+                    and isinstance(stmt.addr.operands[1], Const)
+                    and stmt.addr.operands[0].varid == expected_store_varid
+                ):
+                    offset = stmt.addr.operands[1].value
+                else:
+                    offset = None
+                value = (
+                    ail_const_to_be(stmt.data, self.project.arch.memory_endness)
+                    if isinstance(stmt.data, Const)
+                    else None
+                )
+            else:
+                continue
+
+            if offset is not None:
+                r[offset] = idx, value
+
+        return r
+
+    @staticmethod
+    def even_offsets_are_zero(lst: list[int]) -> bool:
+        if len(lst) >= 2 and lst[-1] == 0 and lst[-2] == 0:
+            lst = lst[:-2]
+        return all((ch == 0 if i % 2 == 0 else ch != 0) for i, ch in enumerate(lst))
+
+    @staticmethod
+    def odd_offsets_are_zero(lst: list[int]) -> bool:
+        if len(lst) >= 2 and lst[-1] == 0 and lst[-2] == 0:
+            lst = lst[:-2]
+        return all((ch == 0 if i % 2 == 1 else ch != 0) for i, ch in enumerate(lst))
+
+    @staticmethod
+    def is_integer_likely_a_wide_string(
+        v: int, size: int, endness: Endness, min_length: int = 4
+    ) -> tuple[bool, bytes | None]:
+        # we need at least four bytes of printable characters
+
+        chars: list[int] = []
+        if endness == Endness.LE:
+            while v != 0:
+                byt = v & 0xFF
+                if byt != 0 and byt not in ASCII_PRINTABLES:
+                    return False, None
+                chars.append(byt)
+                v >>= 8
+            if len(chars) % 2 == 1:
+                chars.append(0)
+
+        elif endness == Endness.BE:
+            for _ in range(size):
+                byt = v & 0xFF
+                v >>= 8
+                if byt != 0 and byt not in ASCII_PRINTABLES:
+                    return False, None
+                chars.append(byt)
+            chars.reverse()
+        else:
+            # unsupported endness
+            return False, None
+
+        if not (InlinedWcscpy.even_offsets_are_zero(chars) or InlinedWcscpy.odd_offsets_are_zero(chars)):
+            return False, None
+
+        if chars and len(chars) >= 2 and chars[-1] == 0 and chars[-2] == 0:
+            chars = chars[:-1]
+        if len(chars) >= min_length * 2 and all((ch == 0 or ch in ASCII_PRINTABLES) for ch in chars):
+            if len(chars) <= 4 * 2 and all((ch == 0 or ch in ASCII_DIGITS) for ch in chars):
+                return False, None
+            return True, bytes(chars)
+        return False, None
+
+    @staticmethod
+    def is_inlined_wcsncpy(stmt: Statement) -> bool:
+        return (
+            isinstance(stmt, Call)
+            and isinstance(stmt.target, str)
+            and stmt.target == "wcsncpy"
+            and stmt.args is not None
+            and len(stmt.args) == 3
+            and isinstance(stmt.args[1], Const)
+            and "custom_string" in stmt.args[1].tags
+        )

angr/analyses/decompiler/peephole_optimizations/inlined_wcscpy_consolidation.py

@@ -0,0 +1,296 @@
+# pylint:disable=arguments-differ
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+from angr.ailment.expression import Expression, BinaryOp, Const, Register, StackBaseOffset, UnaryOp, VirtualVariable
+from angr.ailment.statement import Call, Store, Assignment
+
+from angr.sim_type import SimTypePointer, SimTypeWideChar
+from .base import PeepholeOptimizationMultiStmtBase
+from .inlined_wcscpy import InlinedWcscpy
+
+if TYPE_CHECKING:
+    from angr.ailment.statement import Statement
+
+
+def match_statements(stmts: list[Statement], index: int) -> int:
+    ending = index
+    has_wcsncpy = False
+    for i in range(index, len(stmts)):
+        stmt = stmts[i]
+        if isinstance(stmt, Call):
+            if InlinedWcscpy.is_inlined_wcsncpy(stmt):
+                has_wcsncpy = True
+            else:
+                break
+        elif isinstance(stmt, Store):
+            if not isinstance(stmt.data, Const):
+                break
+            _, off = InlinedWcscpyConsolidation._parse_addr(stmt.addr)
+            if off is None:
+                # unsupported offset - bail
+                break
+        elif (
+            isinstance(stmt, Assignment)
+            and isinstance(stmt.dst, VirtualVariable)
+            and stmt.dst.was_stack
+            and isinstance(stmt.src, Const)
+        ):
+            pass
+        else:
+            break
+        ending = i + 1
+    return ending - index if has_wcsncpy and ending - index >= 2 else 0
+
+
+class InlinedWcscpyConsolidation(PeepholeOptimizationMultiStmtBase):
+    """
+    Consolidate multiple inlined wcscpy/wcsncpy calls.
+    """
+
+    __slots__ = ()
+
+    NAME = "Consolidate multiple inlined wcsncpy calls"
+    stmt_classes = (match_statements,)
+
+    def optimize(  # type:ignore
+        self, stmts: list[Call | Store | Assignment], stmt_idx: int | None = None, block=None, **kwargs
+    ):  # pylint:disable=unused-argument
+        reordered_stmts = self._reorder_stmts(stmts)
+        if not reordered_stmts or len(reordered_stmts) <= 1:
+            return None
+
+        new_stmts = []
+        optimized = False
+        stop = False
+        while not stop:
+            new_stmts = []
+            stop = True
+            for i, stmt0 in enumerate(reordered_stmts):
+                if i == len(reordered_stmts) - 1:
+                    new_stmts.append(reordered_stmts[i])
+                    break
+                stmt1 = reordered_stmts[i + 1]
+                opt_stmts = self._optimize_pair(stmt0, stmt1)
+                if opt_stmts is None:
+                    new_stmts.append(stmt0)
+                else:
+                    new_stmts += opt_stmts
+                    # start again from the beginning
+                    optimized = True
+                    stop = False
+                    reordered_stmts = new_stmts + reordered_stmts[i + 2 :]
+                    break
+
+        return new_stmts if optimized and new_stmts else None
+
+    def _reorder_stmts(self, stmts: list[Call | Store | Assignment]) -> list[Call | Store] | None:
+        """
+        Order a list of statements based on ascending addresses of their destination buffers.
+        """
+
+        if not all(
+            (
+                InlinedWcscpy.is_inlined_wcsncpy(s)
+                or (isinstance(s, Store) and isinstance(s.data, Const))
+                or (
+                    isinstance(s, Assignment)
+                    and isinstance(s.dst, VirtualVariable)
+                    and s.dst.was_stack
+                    and isinstance(s.src, Const)
+                )
+            )
+            for s in stmts
+        ):
+            return None
+        offset_to_stmt = {}
+        updated_offsets: set[int] = set()
+        known_base = None
+        for stmt in stmts:
+            if isinstance(stmt, Call):
+                assert (
+                    stmt.args is not None
+                    and len(stmt.args) == 3
+                    and stmt.args[0] is not None
+                    and stmt.args[2] is not None
+                )
+                base, off = self._parse_addr(stmt.args[0])
+                store_size = stmt.args[2].value * 2 if isinstance(stmt.args[2], Const) else None
+            elif isinstance(stmt, Store):
+                base, off = self._parse_addr(stmt.addr)
+                store_size = stmt.size
+            elif isinstance(stmt, Assignment):
+                base, off = self._parse_addr(stmt.dst)
+                store_size = stmt.dst.size
+            else:
+                # unexpected!
+                return None
+            if off is None or store_size is None:
+                # bad offset or size - bail
+                return None
+            if known_base is None:
+                known_base = base
+            elif not base.likes(known_base):
+                # bail
+                return None
+            if off in offset_to_stmt:
+                # duplicate offset - bail
+                return None
+            assert isinstance(store_size, int)
+            for i in range(store_size):
+                if off + i in updated_offsets:
+                    # overlapping store - bail
+                    return None
+                updated_offsets.add(off + i)
+
+            offset_to_stmt[off] = stmt
+
+        return [offset_to_stmt[k] for k in sorted(offset_to_stmt)]
+
+    def _optimize_pair(
+        self, last_stmt: Call | Store | Assignment, stmt: Call | Store | Assignment
+    ) -> list[Call] | None:
+        # convert (store, wcsncpy()) to (wcsncpy(), store) if they do not overlap
+        if (
+            isinstance(stmt, Call)
+            and InlinedWcscpy.is_inlined_wcsncpy(stmt)
+            and stmt.args is not None
+            and len(stmt.args) == 3
+            and isinstance(stmt.args[2], Const)
+            and isinstance(stmt.args[2].value, int)
+            and isinstance(last_stmt, (Store, Assignment))
+        ):
+            if isinstance(last_stmt, Store) and isinstance(last_stmt.data, Const):
+                store_addr = last_stmt.addr
+                store_size = last_stmt.size
+            elif isinstance(last_stmt, Assignment):
+                store_addr = last_stmt.dst
+                store_size = last_stmt.dst.size
+            else:
+                return None
+            # check if they overlap
+            wcsncpy_addr = stmt.args[0]
+            wcsncpy_size = stmt.args[2].value * 2
+            delta = self._get_delta(store_addr, wcsncpy_addr)
+            if delta is not None:
+                if (0 <= delta <= store_size) or (delta < 0 and -delta <= wcsncpy_size):
+                    # they overlap, do not switch
+                    pass
+                else:
+                    last_stmt, stmt = stmt, last_stmt
+
+        # swap two statements if they are out of order
+        if InlinedWcscpy.is_inlined_wcsncpy(last_stmt) and InlinedWcscpy.is_inlined_wcsncpy(stmt):
+            assert last_stmt.args is not None and stmt.args is not None
+            delta = self._get_delta(last_stmt.args[0], stmt.args[0])
+            if delta is not None and delta < 0:
+                last_stmt, stmt = stmt, last_stmt
+
+        if InlinedWcscpy.is_inlined_wcsncpy(last_stmt):
+            assert last_stmt.args is not None
+            assert self.kb is not None
+            s_last: bytes = self.kb.custom_strings[last_stmt.args[1].value]
+            addr_last = last_stmt.args[0]
+            new_str = None  # will be set if consolidation should happen
+
+            if isinstance(stmt, Call) and InlinedWcscpy.is_inlined_wcsncpy(stmt):
+                assert stmt.args is not None
+                # consolidating two calls
+                s_curr: bytes = self.kb.custom_strings[stmt.args[1].value]
+                addr_curr = stmt.args[0]
+                # determine if the two addresses are consecutive
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    # consolidate both calls!
+                    new_str = s_last + s_curr
+            elif isinstance(stmt, Store) and isinstance(stmt.data, Const) and isinstance(stmt.data.value, int):
+                # consolidating a call and a store, in case the store statement is storing the suffix of a string (but
+                # the suffix is too short to qualify an inlined strcpy optimization)
+                addr_curr = stmt.addr
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    if stmt.size == 2 and stmt.data.value == 0:
+                        # it's probably the terminating null byte
+                        r, s = True, b"\x00\x00"
+                    else:
+                        r, s = InlinedWcscpy.is_integer_likely_a_wide_string(
+                            stmt.data.value, stmt.size, stmt.endness, min_length=1  # type:ignore
+                        )
+                    if r and s is not None:
+                        new_str = s_last + s
+            elif (
+                isinstance(stmt, Assignment)
+                and isinstance(stmt.dst, VirtualVariable)
+                and isinstance(stmt.src, Const)
+                and isinstance(stmt.src.value, int)
+            ):
+                # consolidating a call and an assignment, in case the assignment statement is storing the suffix of a
+                # string (but the suffix is too short to qualify an inlined strcpy optimization)
+                addr_curr = stmt.dst
+                delta = self._get_delta(addr_last, addr_curr)
+                if delta is not None and delta == len(s_last):
+                    r, s = InlinedWcscpy.is_integer_likely_a_wide_string(
+                        stmt.src.value, stmt.dst.size, self.project.arch.memory_endness, min_length=1  # type:ignore
+                    )
+                    if r and s is not None:
+                        new_str = s_last + s
+
+            if new_str is not None:
+                assert self.project is not None
+                wstr_type = SimTypePointer(SimTypeWideChar()).with_arch(self.project.arch)
+                if new_str.endswith(b"\x00\x00"):
+                    call_name = "wcsncpy"
+                    new_str_idx = self.kb.custom_strings.allocate(new_str[:-2])
+                    args = [
+                        last_stmt.args[0],
+                        Const(None, None, new_str_idx, last_stmt.args[0].bits, custom_string=True, type=wstr_type),
+                    ]
+                    prototype = None
+                else:
+                    call_name = "wcsncpy"
+                    new_str_idx = self.kb.custom_strings.allocate(new_str)
+                    args = [
+                        last_stmt.args[0],
+                        Const(None, None, new_str_idx, last_stmt.args[0].bits, custom_string=True, type=wstr_type),
+                        Const(None, None, len(new_str) // 2, self.project.arch.bits),
+                    ]
+                    prototype = None
+
+                return [Call(stmt.idx, call_name, args=args, prototype=prototype, **stmt.tags)]
+
+        return None
+
+    @staticmethod
+    def _parse_addr(addr: Expression) -> tuple[Expression, int]:
+        # we force the base to 64-bit because it does not really matter when we use it
+
+        if isinstance(addr, VirtualVariable) and addr.was_stack:
+            return StackBaseOffset(None, 64, 0), addr.stack_offset
+        if isinstance(addr, Register):
+            return addr, 0
+        if isinstance(addr, StackBaseOffset):
+            return StackBaseOffset(None, 64, 0), addr.offset
+        if (
+            isinstance(addr, UnaryOp)
+            and addr.op == "Reference"
+            and isinstance(addr.operand, VirtualVariable)
+            and addr.operand.was_stack
+        ):
+            return StackBaseOffset(None, 64, 0), addr.operand.stack_offset
+        if isinstance(addr, BinaryOp):
+            if addr.op == "Add" and isinstance(addr.operands[1], Const) and isinstance(addr.operands[1].value, int):
+                base_0, offset_0 = InlinedWcscpyConsolidation._parse_addr(addr.operands[0])
+                return base_0, offset_0 + addr.operands[1].value
+            if addr.op == "Sub" and isinstance(addr.operands[1], Const) and isinstance(addr.operands[1].value, int):
+                base_0, offset_0 = InlinedWcscpyConsolidation._parse_addr(addr.operands[0])
+                return base_0, offset_0 - addr.operands[1].value
+
+        return addr, 0
+
+    @staticmethod
+    def _get_delta(addr_0: Expression, addr_1: Expression) -> int | None:
+        base_0, offset_0 = InlinedWcscpyConsolidation._parse_addr(addr_0)
+        base_1, offset_1 = InlinedWcscpyConsolidation._parse_addr(addr_1)
+        if base_0.likes(base_1):
+            return offset_1 - offset_0
+        return None