angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/analyses/decompiler/semantic_naming/pointer_naming.py

@@ -0,0 +1,334 @@
+# pylint:disable=missing-class-docstring,missing-function-docstring
+"""
+Semantic variable naming for pointer variables.
+
+This module detects variables used as pointers and names them appropriately
+(e.g., ptr, p, cur, next, prev).
+"""
+from __future__ import annotations
+from typing import TYPE_CHECKING
+import logging
+from collections import defaultdict
+
+from angr import ailment
+from angr.ailment.expression import BinaryOp, UnaryOp, Const, Load
+from angr.ailment.statement import Assignment, Store, Call
+from angr.sim_variable import SimVariable
+
+from .naming_base import ClinicNamingBase
+
+if TYPE_CHECKING:
+    from angr.ailment import Expression
+
+l = logging.getLogger(name=__name__)
+
+# Names for pointer variables based on usage pattern
+POINTER_NAMES = {
+    "generic": ["ptr", "p", "addr"],
+    "iterator": ["cur", "iter", "node"],
+    "linked_list": ["next", "prev", "head", "tail"],
+    "string": ["str", "s", "buf"],
+    "array": ["arr", "data", "base"],
+}
+
+# Functions that return pointers
+POINTER_RETURNING_FUNCTIONS = {
+    "malloc",
+    "calloc",
+    "realloc",
+    "alloca",
+    "strdup",
+    "strndup",
+    "strchr",
+    "strrchr",
+    "strstr",
+    "strpbrk",
+    "memchr",
+    "memmem",
+    "fopen",
+    "fdopen",
+    "tmpfile",
+    "opendir",
+    "dlopen",
+    "dlsym",
+    "mmap",
+    "fgets",
+    "gets",
+}
+
+# Functions that take pointer parameters (param_index -> is_output)
+POINTER_PARAM_FUNCTIONS = {
+    "memcpy": {0: True, 1: False},  # dst, src
+    "memmove": {0: True, 1: False},
+    "memset": {0: True},
+    "strcpy": {0: True, 1: False},
+    "strncpy": {0: True, 1: False},
+    "strcat": {0: True, 1: False},
+    "strcmp": {0: False, 1: False},
+    "strncmp": {0: False, 1: False},
+    "strlen": {0: False},
+    "free": {0: False},
+    "fread": {0: True},
+    "fwrite": {0: False},
+    "fprintf": {0: False},
+    "sprintf": {0: True},
+    "snprintf": {0: True},
+}
+
+
+class PointerNaming(ClinicNamingBase):
+    """
+    Detects variables used as pointers and renames them.
+
+    Pointer patterns detected:
+    - Variables used as addresses in Load/Store operations
+    - Variables involved in pointer arithmetic
+    - Variables passed to functions expecting pointers
+    - Variables receiving pointer-returning function results
+    - Variables used in linked-list patterns (next/prev access)
+    """
+
+    PRIORITY = 45  # After loop counters, before array indices
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self._pointer_candidates: dict[SimVariable, dict] = {}
+        self._name_counter = defaultdict(int)  # category -> count
+
+    def analyze(self) -> dict[SimVariable, str]:
+        """
+        Analyze the graph for pointer variable patterns.
+
+        :return: Dictionary mapping SimVariable to new name
+        """
+        if not self._graph:
+            return {}
+
+        # Find variables used as pointers in various patterns
+        self._find_dereference_pointers()
+        self._find_pointer_arithmetic()
+        self._find_function_pointer_params()
+        self._find_linked_list_patterns()
+
+        # Score and assign names
+        self._assign_pointer_names()
+
+        return self._var_to_new_name
+
+    def _find_dereference_pointers(self) -> None:
+        """Find variables used as addresses in Load/Store operations."""
+        for node in self._graph:
+            if not isinstance(node, ailment.Block):
+                continue
+
+            for stmt in node.statements:
+                # Check Store statements
+                if isinstance(stmt, Store):
+                    self._check_address_expr(stmt.addr, "store")
+
+                # Check assignments with Load on the right side
+                if isinstance(stmt, Assignment):
+                    self._check_expr_for_loads(stmt.src)
+                    # Also check if dst is a dereference
+                    if isinstance(stmt.dst, Load):
+                        self._check_address_expr(stmt.dst.addr, "store")
+
+    def _check_expr_for_loads(self, expr) -> None:
+        """Recursively check expression for Load operations."""
+        if expr is None:
+            return
+
+        if isinstance(expr, Load):
+            self._check_address_expr(expr.addr, "load")
+            return
+
+        if isinstance(expr, BinaryOp):
+            for operand in expr.operands:
+                self._check_expr_for_loads(operand)
+        elif isinstance(expr, UnaryOp):
+            self._check_expr_for_loads(expr.operand)
+
+    def _check_address_expr(self, addr_expr: Expression, access_type: str) -> None:
+        """Check an address expression for pointer variables."""
+        # Direct variable as address
+        var = self._get_linked_variable(addr_expr)
+        if var is not None:
+            self._record_pointer(var, "dereference", access_type)
+            return
+
+        # Pointer arithmetic: ptr + offset or ptr - offset
+        if isinstance(addr_expr, BinaryOp) and addr_expr.op in ("Add", "Sub"):
+            op0, op1 = addr_expr.operands
+
+            # Check if one operand is a variable (the pointer)
+            var0 = self._get_linked_variable(op0)
+            var1 = self._get_linked_variable(op1)
+
+            if var0 is not None and (isinstance(op1, Const) or self._is_index_like(op1)):
+                self._record_pointer(var0, "arithmetic", access_type)
+            elif var1 is not None and isinstance(op0, Const):
+                self._record_pointer(var1, "arithmetic", access_type)
+
+    @staticmethod
+    def _is_index_like(expr: Expression) -> bool:
+        """
+        Check if expression looks like an index (e.g., i * 4).
+        """
+        if isinstance(expr, BinaryOp) and expr.op == "Mul":
+            op0, op1 = expr.operands
+            return isinstance(op0, Const) or isinstance(op1, Const)
+        return False
+
+    def _find_pointer_arithmetic(self) -> None:
+        """
+        Find variables involved in pointer arithmetic patterns.
+        """
+        for node in self._graph:
+            if not isinstance(node, ailment.Block):
+                continue
+
+            for stmt in node.statements:
+                if not isinstance(stmt, Assignment):
+                    continue
+
+                dst_var = self._get_linked_variable(stmt.dst)
+                if dst_var is None:
+                    continue
+
+                src = stmt.src
+
+                # Pattern: ptr = ptr + offset (pointer increment)
+                if isinstance(src, BinaryOp) and src.op in ("Add", "Sub"):
+                    op0, _ = src.operands
+                    src_var = self._get_linked_variable(op0)
+
+                    if src_var == dst_var:
+                        # Self-increment: ptr = ptr + something
+                        self._record_pointer(dst_var, "increment", "write")
+
+                # Pattern: ptr = other_ptr (pointer copy/assignment)
+                src_var = self._get_linked_variable(src)
+                if src_var is not None and src_var in self._pointer_candidates:
+                    # Copying from a known pointer
+                    self._record_pointer(dst_var, "copy", "write")
+
+    def _find_function_pointer_params(self) -> None:
+        """Find variables passed as pointer parameters to functions."""
+        for node in self._graph:
+            if not isinstance(node, ailment.Block):
+                continue
+
+            for stmt in node.statements:
+                if isinstance(stmt, Call):
+                    self._analyze_call_for_pointers(stmt)
+                elif isinstance(stmt, Assignment) and isinstance(stmt.src, Call):
+                    self._analyze_call_for_pointers(stmt.src)
+
+    def _analyze_call_for_pointers(self, call: Call) -> None:
+        """Analyze a function call for pointer parameters and return values."""
+        func_name = self._get_function_name(call)
+
+        # Check return value
+        if call.ret_expr is not None:
+            ret_var = self._get_linked_variable(call.ret_expr)
+            if ret_var is not None and func_name and self._normalize_name(func_name) in POINTER_RETURNING_FUNCTIONS:
+                self._record_pointer(ret_var, "return_value", "write")
+
+        # Check parameters
+        if call.args is None:
+            return
+
+        if func_name:
+            normalized = self._normalize_name(func_name)
+            if normalized in POINTER_PARAM_FUNCTIONS:
+                param_info = POINTER_PARAM_FUNCTIONS[normalized]
+                for idx, is_output in param_info.items():
+                    if idx < len(call.args):
+                        var = self._get_linked_variable(call.args[idx])
+                        if var is not None:
+                            access = "write" if is_output else "read"
+                            self._record_pointer(var, "func_param", access)
+
+    def _find_linked_list_patterns(self) -> None:
+        """Find variables used in linked-list traversal patterns."""
+        for node in self._graph:
+            if not isinstance(node, ailment.Block):
+                continue
+
+            for stmt in node.statements:
+                if not isinstance(stmt, Assignment):
+                    continue
+
+                dst_var = self._get_linked_variable(stmt.dst)
+                if dst_var is None:
+                    continue
+
+                # Pattern: cur = cur->next (or similar field access)
+                # This shows up as: cur = *(cur + offset)
+                if isinstance(stmt.src, Load):
+                    addr = stmt.src.addr
+                    if isinstance(addr, BinaryOp) and addr.op == "Add":
+                        op0, op1 = addr.operands
+                        src_var = self._get_linked_variable(op0)
+
+                        if src_var == dst_var and isinstance(op1, Const):
+                            # Self-referential: cur = *(cur + offset)
+                            # This is a classic linked-list traversal pattern
+                            self._record_pointer(dst_var, "linked_list", "iterator")
+
+    def _record_pointer(self, var: SimVariable, pattern: str, access: str) -> None:
+        """Record a variable as being used as a pointer."""
+        if var not in self._pointer_candidates:
+            self._pointer_candidates[var] = {
+                "score": 0,
+                "patterns": set(),
+                "accesses": set(),
+                "is_iterator": False,
+                "is_linked_list": False,
+            }
+
+        info = self._pointer_candidates[var]
+        info["patterns"].add(pattern)
+        info["accesses"].add(access)
+
+        # Score based on pattern
+        pattern_scores = {
+            "dereference": 25,
+            "arithmetic": 20,
+            "increment": 15,
+            "func_param": 15,
+            "return_value": 20,
+            "copy": 10,
+            "linked_list": 30,
+        }
+        info["score"] += pattern_scores.get(pattern, 10)
+
+        # Mark special types
+        if pattern == "linked_list":
+            info["is_linked_list"] = True
+        if pattern == "increment" or access == "iterator":
+            info["is_iterator"] = True
+
+    def _assign_pointer_names(self) -> None:
+        """Assign names to pointer variables."""
+        # Sort by score (highest first)
+        sorted_candidates = sorted(self._pointer_candidates.items(), key=lambda x: -x[1]["score"])
+
+        # Threshold for considering a variable as a pointer
+        SCORE_THRESHOLD = 20
+
+        for var, info in sorted_candidates:
+            if info["score"] < SCORE_THRESHOLD:
+                continue
+
+            # Choose name based on usage pattern
+            category = "iterator" if info["is_linked_list"] or info["is_iterator"] else "generic"
+
+            names = POINTER_NAMES[category]
+            idx = self._name_counter[category]
+
+            new_name = names[idx] if idx < len(names) else f"ptr{sum(self._name_counter.values())}"
+            self._var_to_new_name[var] = new_name
+            self._name_counter[category] += 1
+
+            l.debug("Identified pointer %s (score=%d, patterns=%s)", var.name, info["score"], info["patterns"])

angr/analyses/decompiler/semantic_naming/region_loop_counter_naming.py

@@ -0,0 +1,246 @@
+# pylint:disable=missing-class-docstring,missing-function-docstring
+"""
+Semantic variable naming for loop counters using structured regions.
+
+This module implements detection and renaming of loop counter variables
+using the LoopNode structure from the region simplifier. It operates on
+structured regions after the structuring phase, allowing it to reuse
+existing loop analysis results instead of re-analyzing the graph.
+"""
+from __future__ import annotations
+from typing import TYPE_CHECKING
+import logging
+
+from angr.ailment.statement import Statement, Assignment
+from angr.ailment.expression import Expression, BinaryOp
+from angr.sim_variable import SimVariable
+from angr.analyses.decompiler.structuring.structurer_nodes import (
+    LoopNode,
+    SequenceNode,
+    CodeNode,
+    ConditionNode,
+    CascadingConditionNode,
+    BaseNode,
+)
+
+from .naming_base import RegionNamingBase
+
+if TYPE_CHECKING:
+    from angr.knowledge_plugins.functions.function_manager import FunctionManager
+    from angr.knowledge_plugins.variables.variable_manager import VariableManagerInternal
+
+l = logging.getLogger(name=__name__)
+
+# Standard loop counter names in order of nesting depth
+LOOP_COUNTER_NAMES = ["i", "j", "k", "l", "m", "n"]
+
+
+class RegionLoopCounterNaming(RegionNamingBase):
+    """
+    Detects loop counter variables from structured LoopNodes and renames them
+    to standard names like i, j, k based on nesting depth.
+
+    This pass operates after structuring and uses the iterator information
+    already extracted by LoopSimplifier (stored in LoopNode.iterator).
+    """
+
+    PRIORITY = 10  # Highest priority - loop counters are named first
+
+    def __init__(
+        self,
+        region: BaseNode,
+        variable_manager: VariableManagerInternal,
+        functions: FunctionManager,
+    ):
+        super().__init__(region, variable_manager, functions)
+
+        # Track loops and their nesting
+        self._loop_nodes: list[LoopNode] = []
+        self._loop_info: dict[LoopNode, dict] = {}  # loop_node -> {counter_var, nesting_depth}
+        self._name_index = 0
+
+    def analyze(self) -> dict[SimVariable, str]:
+        """
+        Analyze the structured region for loop counters and return a mapping
+        of variables to their new names.
+
+        :return: Dictionary mapping SimVariable to new name (e.g., "i", "j", "k")
+        """
+        if self._region is None:
+            return {}
+
+        # Step 1: Collect all LoopNodes from the region
+        self._collect_loop_nodes(self._region, nesting_depth=0)
+
+        # Step 2: For each loop, identify the counter variable from iterator
+        self._identify_loop_counters()
+
+        # Step 3: Assign names based on nesting depth
+        self._assign_counter_names()
+
+        return self._var_to_new_name
+
+    def _collect_loop_nodes(self, node: BaseNode, nesting_depth: int) -> None:
+        """
+        Recursively collect all LoopNodes from the region structure.
+
+        :param node: The current node to process
+        :param nesting_depth: The current loop nesting depth
+        """
+        if node is None:
+            return
+
+        if isinstance(node, LoopNode):
+            self._loop_nodes.append(node)
+            self._loop_info[node] = {
+                "counter_var": None,
+                "nesting_depth": nesting_depth,
+            }
+            self._collect_loop_nodes(node.sequence_node, nesting_depth + 1)
+
+        elif isinstance(node, SequenceNode):
+            for child in node.nodes:
+                self._collect_loop_nodes(child, nesting_depth)
+
+        elif isinstance(node, CodeNode):
+            self._collect_loop_nodes(node.node, nesting_depth)
+
+        elif isinstance(node, ConditionNode):
+            if node.true_node is not None:
+                self._collect_loop_nodes(node.true_node, nesting_depth)
+            if node.false_node is not None:
+                self._collect_loop_nodes(node.false_node, nesting_depth)
+
+        elif isinstance(node, CascadingConditionNode):
+            for _, child_node in node.condition_and_nodes:
+                if isinstance(child_node, BaseNode):
+                    self._collect_loop_nodes(child_node, nesting_depth)
+            if node.else_node is not None and isinstance(node.else_node, BaseNode):
+                self._collect_loop_nodes(node.else_node, nesting_depth)
+
+    def _identify_loop_counters(self) -> None:
+        """
+        For each loop, identify the counter variable from the iterator.
+
+        The iterator is already extracted by LoopSimplifier and stored in
+        LoopNode.iterator. For 'for' loops, this is the increment statement
+        (e.g., i += 1).
+        """
+        for loop_node in self._loop_nodes:
+            loop_info = self._loop_info[loop_node]
+
+            # Check if this is a for-loop with an iterator
+            if loop_node.sort == "for" and loop_node.iterator is not None:
+                # The iterator is typically an Assignment like: i = i + 1
+                counter_var = self._extract_counter_from_iterator(loop_node.iterator)
+                if counter_var is not None:
+                    loop_info["counter_var"] = counter_var
+                    continue
+
+            # For while loops or for loops without iterators, try to extract from initializer
+            if loop_node.initializer is not None:
+                counter_var = self._extract_counter_from_initializer(loop_node.initializer)
+                if counter_var is not None:
+                    loop_info["counter_var"] = counter_var
+                    continue
+
+            # Fall back to extracting from condition
+            if loop_node.condition is not None:
+                counter_var = self._extract_counter_from_condition(loop_node.condition)
+                if counter_var is not None:
+                    loop_info["counter_var"] = counter_var
+
+    def _extract_counter_from_iterator(self, iterator) -> SimVariable | None:
+        """
+        Extract the counter variable from a loop iterator statement.
+
+        Patterns:
+        - i = i + 1 (Assignment with Add)
+        - i = i - 1 (Assignment with Sub)
+        - i++ (equivalent to i = i + 1)
+        """
+        if not isinstance(iterator, Assignment):
+            return None
+
+        dst_var = self._get_linked_variable(iterator.dst)
+        if dst_var is None:
+            return None
+
+        # The iterator modifies the counter variable
+        # We just need to extract the variable from the destination
+        return dst_var
+
+    def _extract_counter_from_initializer(self, initializer: Statement) -> SimVariable | None:
+        """
+        Extract the counter variable from a loop initializer statement.
+
+        Pattern: i = 0 (Assignment with Const)
+        """
+        if not isinstance(initializer, Assignment):
+            return None
+        return self._get_linked_variable(initializer.dst)
+
+    def _extract_counter_from_condition(self, condition: Expression) -> SimVariable | None:
+        """
+        Extract a potential counter variable from the loop condition.
+
+        Patterns:
+        - i < n (comparison with variable)
+        - i != 0 (comparison with constant)
+        """
+        if not isinstance(condition, BinaryOp):
+            return None
+
+        # Check for comparison operations
+        comparison_ops = {"CmpLT", "CmpLE", "CmpGT", "CmpGE", "CmpNE", "CmpEQ"}
+        if condition.op not in comparison_ops:
+            return None
+
+        # Try to extract variables from the comparison
+        op0, op1 = condition.operands
+
+        # Prefer the variable on the left side (common pattern: i < n)
+        var0 = self._get_linked_variable(op0)
+        if var0 is not None:
+            return var0
+        return self._get_linked_variable(op1)
+
+    def _assign_counter_names(self) -> None:
+        """
+        Assign standard names (i, j, k, ...) to counter variables based on nesting depth.
+        """
+        # Sort loops by nesting depth (outermost first), then by address for stability
+        sorted_loops = sorted(
+            self._loop_nodes, key=lambda ln: (self._loop_info[ln]["nesting_depth"], ln.addr if ln.addr else 0)
+        )
+
+        for loop_node in sorted_loops:
+            counter_var = self._loop_info[loop_node]["counter_var"]
+            if counter_var is None:
+                continue
+
+            # Skip if already named
+            if counter_var in self._var_to_new_name:
+                continue
+
+            # Check if the unified variable is already named
+            unified_var = self._variable_manager.unified_variable(counter_var)
+            if unified_var is not None and unified_var in self._var_to_new_name:
+                continue
+
+            # Assign next available name
+            if self._name_index < len(LOOP_COUNTER_NAMES):
+                new_name = LOOP_COUNTER_NAMES[self._name_index]
+            else:
+                # If we run out of standard names, use i0, i1, etc.
+                new_name = f"i{self._name_index - len(LOOP_COUNTER_NAMES)}"
+
+            self._var_to_new_name[counter_var] = new_name
+            self._name_index += 1
+
+            l.debug(
+                "Identified loop counter %s -> %s at depth %d",
+                counter_var.name,
+                new_name,
+                self._loop_info[loop_node]["nesting_depth"],
+            )