angr 9.2.64__py3-none-win_amd64.whl → 9.2.66__py3-none-win_amd64.whl

angr/__init__.py

@@ -1,7 +1,7 @@
 # pylint: disable=wildcard-import
 # pylint: disable=wrong-import-position
 
-__version__ = "9.2.64"
+__version__ = "9.2.66"
 
 if bytes is str:
     raise Exception(
@@ -57,7 +57,7 @@ from .state_plugins.inspect import BP_BEFORE, BP_AFTER, BP_BOTH, BP_IPDB, BP_IPY
 from .state_plugins.inspect import BP
 from .state_plugins import SimStatePlugin
 
-from .project import *
+from .project import Project, load_shellcode
 from .errors import *
 from .blade import Blade
 from .simos import SimOS
@@ -87,9 +87,62 @@ from .state_plugins.filesystem import SimMount, SimHostFilesystem
 from .state_plugins.heap import SimHeapBrk, SimHeapPTMalloc, PTChunk
 from . import concretization_strategies
 from .distributed import Server
+from .knowledge_base import KnowledgeBase
 
 # for compatibility reasons
 from . import sim_manager as manager
 
 # now that we have everything loaded, re-grab the list of loggers
 loggers.load_all_loggers()
+
+__all__ = (
+    "SimProcedure",
+    "SIM_PROCEDURES",
+    "SIM_LIBRARIES",
+    "sim_options",
+    "options",
+    "BP_BEFORE",
+    "BP_AFTER",
+    "BP_BOTH",
+    "BP_IPDB",
+    "BP_IPYTHON",
+    "BP",
+    "SimStatePlugin",
+    "Project",
+    "load_shellcode",
+    "Blade",
+    "SimOS",
+    "Block",
+    "SimulationManager",
+    "Analysis",
+    "register_analysis",
+    "analyses",
+    "knowledge_plugins",
+    "exploration_techniques",
+    "ExplorationTechnique",
+    "types",
+    "StateHierarchy",
+    "SimState",
+    "engines",
+    "DEFAULT_CC",
+    "SYSCALL_CC",
+    "PointerWrapper",
+    "SimCC",
+    "SimFileBase",
+    "SimFile",
+    "SimPackets",
+    "SimFileStream",
+    "SimPacketsStream",
+    "SimFileDescriptor",
+    "SimFileDescriptorDuplex",
+    "SimMount",
+    "SimHostFilesystem",
+    "SimHeapBrk",
+    "SimHeapPTMalloc",
+    "PTChunk",
+    "concretization_strategies",
+    "Server",
+    "manager",
+    "SimProcedures",
+    "KnowledgeBase",
+)

angr/analyses/calling_convention.py

@@ -10,6 +10,8 @@ from pyvex.expr import RdTmp
 from archinfo.arch_arm import is_arm_arch, ArchARMHF
 import ailment
 
+from angr.code_location import ExternalCodeLocation
+
 from ..calling_conventions import SimFunctionArgument, SimRegArg, SimStackArg, SimCC, default_cc
 from ..sim_type import (
     SimTypeInt,
@@ -32,7 +34,6 @@ from ..knowledge_plugins.functions import Function
 from ..utils.constants import DEFAULT_STATEMENT
 from .. import SIM_PROCEDURES
 from .reaching_definitions import get_all_definitions
-from .reaching_definitions.external_codeloc import ExternalCodeLocation
 from . import Analysis, register_analysis, ReachingDefinitionsAnalysis
 
 if TYPE_CHECKING:
@@ -526,8 +527,8 @@ class CallingConventionAnalysis(Analysis):
         # determine if potential register and stack arguments are set
         state = rda.observed_results[("insn", call_insn_addr, OP_BEFORE)]
         defs_by_reg_offset: Dict[int, List["Definition"]] = defaultdict(list)
-        all_reg_defs: Set["Definition"] = get_all_definitions(state.register_definitions)
-        all_stack_defs: Set["Definition"] = get_all_definitions(state.stack_definitions)
+        all_reg_defs: Set["Definition"] = get_all_definitions(state.registers)
+        all_stack_defs: Set["Definition"] = get_all_definitions(state.stack)
         for d in all_reg_defs:
             if (
                 isinstance(d.atom, Register)

angr/analyses/cfg/cfg_base.py

@@ -8,7 +8,7 @@ from sortedcontainers import SortedDict
 
 import pyvex
 from claripy.utils.orderedset import OrderedSet
-from cle import ELF, PE, Blob, TLSObject, MachO, ExternObject, KernelObject, FunctionHintSource, Hex
+from cle import ELF, PE, Blob, TLSObject, MachO, ExternObject, KernelObject, FunctionHintSource, Hex, Coff
 from cle.backends import NamedRegion
 import archinfo
 from archinfo.arch_soot import SootAddressDescriptor
@@ -759,7 +759,7 @@ class CFGBase(Analysis):
                             tpl = (segment.min_addr, segment.max_addr + 1)
                             memory_regions.append(tpl)
 
-            elif isinstance(b, PE):
+            elif isinstance(b, (Coff, PE)):
                 for section in b.sections:
                     if section.is_executable:
                         tpl = (section.min_addr, section.max_addr + 1)

angr/analyses/cfg/cfg_fast.py

@@ -4,12 +4,13 @@ import logging
 import math
 import re
 import string
-from typing import DefaultDict, List, Set, Dict, Optional
+from typing import DefaultDict, List, Set, Dict, Optional, Tuple
 from collections import defaultdict, OrderedDict
 from enum import Enum, unique
 
 import networkx
 from sortedcontainers import SortedDict
+import capstone
 
 import claripy
 import cle
@@ -3845,6 +3846,84 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         pyvex.pvc.deregister_all_readonly_regions()
         self._ro_region_cdata_cache = None
 
+    #
+    # Initial registers
+    #
+
+    def _get_initial_registers(self, addr, cfg_job, current_function_addr) -> Optional[List[Tuple[int, int, int]]]:
+        initial_regs = None
+        if self.project.arch.name in {"MIPS64", "MIPS32"}:
+            initial_regs = [
+                (
+                    self.project.arch.registers["t9"][0],
+                    self.project.arch.registers["t9"][1],
+                    current_function_addr,
+                )
+            ]
+            if self.kb.functions.contains_addr(current_function_addr):
+                func = self.kb.functions.get_by_addr(current_function_addr)
+                if "gp" in func.info:
+                    initial_regs.append(
+                        (
+                            self.project.arch.registers["gp"][0],
+                            self.project.arch.registers["gp"][1],
+                            func.info["gp"],
+                        )
+                    )
+        elif self.project.arch.name == "X86":
+            # for x86 GCC-generated PIE binaries, detect calls to __x86.get_pc_thunk
+            if (
+                cfg_job.jumpkind == "Ijk_FakeRet"
+                and cfg_job.returning_source is not None
+                and self.kb.functions.contains_addr(cfg_job.returning_source)
+            ):
+                return_from_func = self.kb.functions.get_by_addr(cfg_job.returning_source)
+                if "get_pc" in return_from_func.info:
+                    func = self.kb.functions.get_by_addr(current_function_addr)
+                    pc_reg = return_from_func.info["get_pc"]
+                    # the crazy thing is that GCC-generated code may adjust the register value accordingly after
+                    # returning! we must take into account the added offset (in the followin example, 0x8d36)
+                    #
+                    # e.g.
+                    #  000011A1 call    __x86_get_pc_thunk_bx
+                    #  000011A6 add     ebx, 8D36h
+                    #
+                    # this means, for the current block, the initial value of ebx is whatever __x86_get_pc_thunk_bx
+                    # returns. for future blocks in this function, the initial value of ebx must be the returning
+                    # value plus 0x8d36.
+                    pc_reg_offset, pc_reg_size = self.project.arch.registers[pc_reg]
+                    initial_regs = [(pc_reg_offset, pc_reg_size, addr)]
+                    # find adjustment
+                    adjustment = self._x86_gcc_pie_find_pc_register_adjustment(addr, pc_reg_offset)
+                    if adjustment is not None:
+                        func.info["pc_reg"] = (pc_reg, addr + adjustment)
+                    else:
+                        func.info["pc_reg"] = (pc_reg, addr)
+            if self.kb.functions.contains_addr(current_function_addr):
+                func = self.kb.functions.get_by_addr(current_function_addr)
+                if not initial_regs and "pc_reg" in func.info:
+                    pc_reg, pc_reg_value = func.info["pc_reg"]
+                    initial_regs = [
+                        (
+                            self.project.arch.registers[pc_reg][0],
+                            self.project.arch.registers[pc_reg][1],
+                            pc_reg_value,
+                        )
+                    ]
+        elif is_arm_arch(self.project.arch):
+            if addr != current_function_addr and self.kb.functions.contains_addr(current_function_addr):
+                func = self.kb.functions.get_by_addr(current_function_addr)
+                if "constant_r4" in func.info:
+                    initial_regs = [
+                        (
+                            self.project.arch.registers["r4"][0],
+                            self.project.arch.registers["r4"][1],
+                            func.info["constant_r4"],
+                        )
+                    ]
+
+        return initial_regs
+
     #
     # Other methods
     #
@@ -4001,65 +4080,7 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                                 self._cascading_remove_lifted_blocks(cfg_job.src_node.addr & 0xFFFF_FFFE)
                             return None, None, None, None
 
-            initial_regs = None
-            if self.project.arch.name in {"MIPS64", "MIPS32"}:
-                initial_regs = [
-                    (
-                        self.project.arch.registers["t9"][0],
-                        self.project.arch.registers["t9"][1],
-                        current_function_addr,
-                    )
-                ]
-                if self.kb.functions.contains_addr(current_function_addr):
-                    func = self.kb.functions.get_by_addr(current_function_addr)
-                    if "gp" in func.info:
-                        initial_regs.append(
-                            (
-                                self.project.arch.registers["gp"][0],
-                                self.project.arch.registers["gp"][1],
-                                func.info["gp"],
-                            )
-                        )
-            elif self.project.arch.name == "X86":
-                # for x86 GCC-generated PIE binaries, detect calls to __x86.get_pc_thunk
-                if (
-                    cfg_job.jumpkind == "Ijk_FakeRet"
-                    and cfg_job.returning_source is not None
-                    and self.kb.functions.contains_addr(cfg_job.returning_source)
-                ):
-                    return_from_func = self.kb.functions.get_by_addr(cfg_job.returning_source)
-                    if "get_pc" in return_from_func.info:
-                        func = self.kb.functions.get_by_addr(current_function_addr)
-                        pc_reg = return_from_func.info["get_pc"]
-                        # the crazy thing is that GCC-generated code may adjust the register value accordingly after
-                        # returning! we must take into account the added offset (in the followin example, 0x8d36)
-                        #
-                        # e.g.
-                        #  000011A1 call    __x86_get_pc_thunk_bx
-                        #  000011A6 add     ebx, 8D36h
-                        #
-                        # this means, for the current block, the initial value of ebx is whatever __x86_get_pc_thunk_bx
-                        # returns. for future blocks in this function, the initial value of ebx must be the returning
-                        # value plus 0x8d36.
-                        pc_reg_offset, pc_reg_size = self.project.arch.registers[pc_reg]
-                        initial_regs = [(pc_reg_offset, pc_reg_size, addr)]
-                        # find adjustment
-                        adjustment = self._x86_gcc_pie_find_pc_register_adjustment(addr, pc_reg_offset)
-                        if adjustment is not None:
-                            func.info["pc_reg"] = (pc_reg, addr + adjustment)
-                        else:
-                            func.info["pc_reg"] = (pc_reg, addr)
-                if self.kb.functions.contains_addr(current_function_addr):
-                    func = self.kb.functions.get_by_addr(current_function_addr)
-                    if not initial_regs and "pc_reg" in func.info:
-                        pc_reg, pc_reg_value = func.info["pc_reg"]
-                        initial_regs = [
-                            (
-                                self.project.arch.registers[pc_reg][0],
-                                self.project.arch.registers[pc_reg][1],
-                                pc_reg_value,
-                            )
-                        ]
+            initial_regs = self._get_initial_registers(addr, cfg_job, current_function_addr)
 
             # Let's try to create the pyvex IRSB directly, since it's much faster
             nodecode = False
@@ -4367,6 +4388,53 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                                     self._insert_job(job)
                                     added_addrs.add(ref.data_addr)
 
+            # detect if there are instructions that set r4 as a constant value
+            if (addr & 1) == 0 and addr == func_addr and irsb.size > 0:
+                # re-lift the block to get capstone access
+                lifted_block = self._lift(irsb.addr, size=irsb.size, collect_data_refs=False, strict_block_end=True)
+                for i in range(len(lifted_block.capstone.insns) - 1):
+                    insn0 = lifted_block.capstone.insns[i]
+                    insn1 = lifted_block.capstone.insns[i + 1]
+                    matched_0 = False
+                    matched_1 = False
+                    reg_dst = None
+                    pc_offset = None
+                    if insn0.mnemonic == "ldr" and len(insn0.operands) == 2:
+                        op0, op1 = insn0.operands
+                        if (
+                            op0.type == capstone.arm.ARM_OP_REG
+                            and op0.value.reg == capstone.arm.ARM_REG_R4
+                            and op1.type == capstone.arm.ARM_OP_MEM
+                            and op1.mem.base == capstone.arm.ARM_REG_PC
+                            and op1.mem.disp > 0
+                            and op1.mem.index == 0
+                        ):
+                            # ldr r4, [pc, #N]
+                            matched_0 = True
+                            reg_dst = op0.value.reg
+                            pc_offset = op1.value.mem.disp
+                    if matched_0 and insn1.mnemonic == "add" and len(insn1.operands) == 3:
+                        op0, op1, op2 = insn1.operands
+                        if (
+                            op0.type == capstone.arm.ARM_OP_REG
+                            and op0.value.reg == reg_dst
+                            and op1.type == capstone.arm.ARM_OP_REG
+                            and op1.value.reg == capstone.arm.ARM_REG_PC
+                            and op2.type == capstone.arm.ARM_OP_REG
+                            and op2.value.reg == reg_dst
+                        ):
+                            # add r4, pc, r4
+                            matched_1 = True
+
+                    if matched_1:
+                        r4 = self.project.loader.fast_memory_load_pointer(insn0.address + 4 * 2 + pc_offset, 4)
+                        if r4 is not None:
+                            r4 += insn1.address + 4 * 2
+                            r4 &= 0xFFFF_FFFF
+                            func = self.kb.functions.get_by_addr(func_addr)
+                            func.info["constant_r4"] = r4
+                            break
+
         elif self.project.arch.name in {"MIPS32", "MIPS64"}:
             func = self.kb.functions.get_by_addr(func_addr)
             if "gp" not in func.info and addr >= func_addr and addr - func_addr < 15 * 4:

angr/analyses/decompiler/ail_simplifier.py

@@ -19,8 +19,7 @@ from ailment.expression import (
 )
 
 from ...engines.light import SpOffset
-from ...code_location import CodeLocation
-from ...analyses.reaching_definitions.external_codeloc import ExternalCodeLocation
+from ...code_location import CodeLocation, ExternalCodeLocation
 from ...sim_variable import SimStackVariable, SimMemoryVariable
 from ...knowledge_plugins.propagations.states import Equivalence
 from ...knowledge_plugins.key_definitions import atoms

angr/analyses/decompiler/block_simplifier.py

@@ -6,10 +6,11 @@ from ailment.statement import Statement, Assignment, Call, Store, Jump
 from ailment.expression import Expression, Tmp, Load, Const, Register, Convert
 from ailment import AILBlockWalker
 
+from angr.code_location import ExternalCodeLocation
+
 from ...engines.light.data import SpOffset
 from ...knowledge_plugins.key_definitions.constants import OP_AFTER
 from ...knowledge_plugins.key_definitions import atoms
-from ...analyses.reaching_definitions.external_codeloc import ExternalCodeLocation
 from ...analyses.propagator import PropagatorAnalysis
 from ...analyses.reaching_definitions import ReachingDefinitionsAnalysis
 from ...errors import SimMemoryMissingError
@@ -300,13 +301,13 @@ class BlockSimplifier(Analysis):
                     defs_ = set()
                     if isinstance(d.atom, atoms.Register):
                         try:
-                            vs: "MultiValues" = live_defs.register_definitions.load(d.atom.reg_offset, size=d.atom.size)
+                            vs: "MultiValues" = live_defs.registers.load(d.atom.reg_offset, size=d.atom.size)
                         except SimMemoryMissingError:
                             vs = None
                     elif isinstance(d.atom, atoms.MemoryLocation) and isinstance(d.atom.addr, SpOffset):
                         stack_addr = live_defs.stack_offset_to_stack_addr(d.atom.addr.offset)
                         try:
-                            vs: "MultiValues" = live_defs.stack_definitions.load(
+                            vs: "MultiValues" = live_defs.stack.load(
                                 stack_addr, size=d.atom.size, endness=d.atom.endness
                             )
                         except SimMemoryMissingError:

angr/analyses/decompiler/callsite_maker.py

@@ -243,7 +243,7 @@ class CallSiteMaker(Analysis):
                 return set()
 
             try:
-                vs: "MultiValues" = rd.register_definitions.load(offset, size=size)
+                vs: "MultiValues" = rd.registers.load(offset, size=size)
             except SimMemoryMissingError:
                 return set()
             values_and_defs_ = set()

angr/analyses/decompiler/condition_processor.py

@@ -68,8 +68,8 @@ def _op_with_unified_size(op, conv, operand0, operand1):
     return op(conv(operand0, nobool=True), conv(operand1, nobool=True))
 
 
-def _dummy_bvs(condition, condition_mapping):
-    var = claripy.BVS("ailexpr_%s" % repr(condition), condition.bits, explicit_name=True)
+def _dummy_bvs(condition, condition_mapping, name_suffix=""):
+    var = claripy.BVS(f"ailexpr_{repr(condition)}{name_suffix}", condition.bits, explicit_name=True)
     condition_mapping[var.args[0]] = condition
     return var
 
@@ -698,9 +698,11 @@ class ConditionProcessor:
 
         if isinstance(
             condition,
-            (ailment.Expr.DirtyExpression, ailment.Expr.BasePointerOffset, ailment.Expr.ITE, ailment.Stmt.Call),
+            (ailment.Expr.DirtyExpression, ailment.Expr.BasePointerOffset, ailment.Expr.ITE),
         ):
             return _dummy_bvs(condition, self._condition_mapping)
+        elif isinstance(condition, ailment.Stmt.Call):
+            return _dummy_bvs(condition, self._condition_mapping, name_suffix=hex(condition.tags.get("ins_addr", 0)))
         elif isinstance(condition, (ailment.Expr.Load, ailment.Expr.Register)):
             # does it have a variable associated?
             if condition.variable is not None:

angr/analyses/decompiler/optimization_passes/flip_boolean_cmp.py

@@ -1,13 +1,59 @@
-from typing import List
+# pylint:disable=arguments-renamed,too-many-boolean-expressions
+from typing import List, Tuple, Any
 
 import ailment
 from ailment.expression import Op
 
 from ..structuring.structurer_nodes import ConditionNode
 from ..utils import structured_node_is_simple_return
+from ..sequence_walker import SequenceWalker
 from .optimization_pass import SequenceOptimizationPass, OptimizationPassStage
 
 
+class FlipBooleanWalker(SequenceWalker):
+    """
+    Walks a SequenceNode and handles every sequence.
+    """
+
+    def __init__(self, graph):
+        super().__init__()
+        self._graph = graph
+
+    def _handle_Sequence(self, seq_node, **kwargs):
+        # Type 1:
+        # if (cond) { ... }  else  { return; }   -->   if (!cond) { return; } else { ... }
+        #
+        # Type 2:
+        # if (cond) { ... } return;    -->    if (!cond) return; ...
+        type1_condition_nodes = [node for node in seq_node.nodes if isinstance(node, ConditionNode) and node.false_node]
+        type2_condition_nodes: List[Tuple[int, ConditionNode, Any]] = []
+
+        if len(seq_node.nodes) >= 2:
+            idx = len(seq_node.nodes) - 2
+            node = seq_node.nodes[idx]
+            if (
+                isinstance(node, ConditionNode)
+                and node.true_node is not None
+                and node.false_node is None
+                and idx < len(seq_node.nodes) - 1
+                and structured_node_is_simple_return(seq_node.nodes[idx + 1], self._graph)
+                and node not in type1_condition_nodes
+            ):
+                type2_condition_nodes.append((idx, node, seq_node.nodes[idx + 1]))
+
+        for node in type1_condition_nodes:
+            if isinstance(node.condition, Op) and structured_node_is_simple_return(node.false_node, self._graph):
+                node.condition = ailment.expression.negate(node.condition)
+                node.true_node, node.false_node = node.false_node, node.true_node
+
+        for idx, cond_node, successor in type2_condition_nodes:
+            cond_node.condition = ailment.expression.negate(cond_node.condition)
+            seq_node.nodes[idx + 1] = cond_node.true_node
+            cond_node.true_node = successor
+
+        return super()._handle_Sequence(seq_node, **kwargs)
+
+
 class FlipBooleanCmp(SequenceOptimizationPass):
     """
     In the scenario in which a false node has no apparent successors, flip the condition on that if-stmt.
@@ -27,12 +73,9 @@ class FlipBooleanCmp(SequenceOptimizationPass):
         self.analyze()
 
     def _check(self):
-        condition_nodes = [node for node in self.seq.nodes if isinstance(node, ConditionNode) and node.false_node]
-        return len(condition_nodes) > 0, condition_nodes
+        return bool(self.seq.nodes), None
 
     def _analyze(self, cache=None):
-        condition_nodes: List[ConditionNode] = cache or []
-        for node in condition_nodes:
-            if isinstance(node.condition, Op) and structured_node_is_simple_return(node.false_node, self._graph):
-                node.condition = ailment.expression.negate(node.condition)
-                node.true_node, node.false_node = node.false_node, node.true_node
+        walker = FlipBooleanWalker(self._graph)
+        walker.walk(self.seq)
+        self.out_seq = self.seq

angr/analyses/decompiler/peephole_optimizations/__init__.py

@@ -9,7 +9,7 @@ from .arm_cmpf import ARMCmpF
 from .bswap import Bswap
 from .coalesce_same_cascading_ifs import CoalesceSameCascadingIfs
 from .constant_derefs import ConstantDereferences
-from .conv_const_mull_a_shift import ConvConstMullAShift
+from .const_mull_a_shift import ConstMullAShift
 from .extended_byte_and_mask import ExtendedByteAndMask
 from .remove_empty_if_body import RemoveEmptyIfBody
 from .remove_redundant_ite_branch import RemoveRedundantITEBranches

angr/analyses/decompiler/peephole_optimizations/const_mull_a_shift.py

@@ -0,0 +1,92 @@
+# pylint:disable=too-many-boolean-expressions
+from typing import Union
+
+from ailment.expression import Convert, BinaryOp, Const
+
+from .base import PeepholeOptimizationExprBase
+
+
+class ConstMullAShift(PeepholeOptimizationExprBase):
+    """
+    Convert expressions with right shifts into expressions with divisions.
+    """
+
+    __slots__ = ()
+
+    NAME = "Conv(64->32, (N * a) >> M) => a / N1"
+    expr_classes = (Convert, BinaryOp)
+
+    def optimize(self, expr: Union[Convert, BinaryOp]):
+        r = None
+
+        if isinstance(expr, Convert):
+            if expr.from_bits == 64 and expr.to_bits == 32:
+                r = self.optimize_binaryop(expr)
+
+        elif isinstance(expr, BinaryOp):
+            r = self.optimize_binaryop(expr)
+
+        # keep size
+        if r is not None and r.bits < expr.bits:
+            r = Convert(expr.idx, r.bits, expr.bits, False, r, **expr.tags)
+
+        return r
+
+    def optimize_binaryop(self, expr: BinaryOp):
+        if isinstance(expr, BinaryOp) and expr.op == "Shr" and isinstance(expr.operands[1], Const):
+            # (N * a) >> M  ==>  a / N1
+            inner = expr.operands[0]
+            if isinstance(inner, BinaryOp) and inner.op == "Mull" and isinstance(inner.operands[0], Const):
+                C = inner.operands[0].value
+                X = inner.operands[1]
+                V = expr.operands[1].value
+                ndigits = 5 if V == 32 else 6
+                divisor = self._check_divisor(pow(2, V), C, ndigits)
+                if divisor is not None:
+                    new_const = Const(None, None, divisor, X.bits)
+                    new_div = BinaryOp(inner.idx, "Div", [X, new_const], inner.signed, **inner.tags)
+                    return new_div
+
+        elif isinstance(expr, BinaryOp) and expr.op in {"Add", "Sub"}:
+            expr0, expr1 = expr.operands
+            if (
+                isinstance(expr0, BinaryOp)
+                and expr0.op in {"Shr", "Sar"}
+                and isinstance(expr0.operands[1], Const)
+                and isinstance(expr1, BinaryOp)
+                and expr1.op in {"Shr", "Sar"}
+                and isinstance(expr1.operands[1], Const)
+            ):
+                if (
+                    isinstance(expr0.operands[0], BinaryOp)
+                    and expr0.operands[0].op in {"Mull", "Mul"}
+                    and isinstance(expr0.operands[0].operands[1], Const)
+                ):
+                    a0 = expr0.operands[0].operands[0]
+                    a1 = expr1.operands[0]
+                    if a0 == a1:
+                        # (a * x >> M1) +/- (a >> M2)  ==>  a / N
+                        C = expr0.operands[0].operands[1].value
+                        X = a0
+                        V = expr0.operands[1].value
+                        ndigits = 5 if V == 32 else 6
+                        divisor = self._check_divisor(pow(2, V), C, ndigits)
+                        if divisor is not None:
+                            new_const = Const(None, None, divisor, X.bits)
+                            new_div = BinaryOp(
+                                expr0.operands[0].idx,
+                                "Div",
+                                [X, new_const],
+                                expr0.operands[0].signed,
+                                **expr0.operands[0].tags,
+                            )
+                            # we cannot drop the convert in this case
+                            return new_div
+
+        return None
+
+    @staticmethod
+    def _check_divisor(a, b, ndigits=6):
+        divisor_1 = 1 + (a // b)
+        divisor_2 = int(round(a / float(b), ndigits))
+        return divisor_1 if divisor_1 == divisor_2 else None