angr 9.2.77__py3-none-win_amd64.whl → 9.2.79__py3-none-win_amd64.whl

angr/__init__.py

@@ -1,7 +1,7 @@
 # pylint: disable=wildcard-import
 # pylint: disable=wrong-import-position
 
-__version__ = "9.2.77"
+__version__ = "9.2.79"
 
 if bytes is str:
     raise Exception(

angr/__main__.py

@@ -0,0 +1,34 @@
+import argparse
+
+from angr.analyses.decompiler.structuring import STRUCTURER_CLASSES
+from angr.analyses.decompiler.utils import decompile_functions
+
+
+class COMMANDS:
+    """
+    The commands that the angr CLI supports.
+    """
+
+    DECOMPILE = "decompile"
+    ALL_COMMANDS = [DECOMPILE]
+
+
+def main():
+    parser = argparse.ArgumentParser(description="The angr CLI allows you to decompile and analyze binaries.")
+    parser.add_argument("command", help="The command to run", choices=COMMANDS.ALL_COMMANDS)
+    parser.add_argument("binary", help="The path to the binary to analyze")
+    parser.add_argument("--functions", help="The functions to analyze", nargs="+")
+    parser.add_argument(
+        "--structurer", help="The structurer to use", choices=STRUCTURER_CLASSES.keys(), default="phoenix"
+    )
+
+    args = parser.parse_args()
+    if args.command == COMMANDS.DECOMPILE:
+        decompilation = decompile_functions(args.binary, functions=args.functions, structurer=args.structurer)
+        print(decompilation)
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()

angr/analyses/calling_convention.py

@@ -568,20 +568,23 @@ class CallingConventionAnalysis(Analysis):
                     continue
                 defs_by_reg_offset[d.offset].append(d)
         defined_reg_offsets = set(defs_by_reg_offset.keys())
+        sp_offset = 0
         if self.project.arch.bits in {32, 64}:
-            # Calculate the relative distances between the stack pointer at the callsite and the stack definitions
+            # Calculate the offsets between sp and stack defs
             sp_offset = state.get_sp_offset()
-            defs_by_stack_offset = {
-                d.atom.addr.offset - sp_offset: d
-                for d in all_stack_defs
-                if isinstance(d.atom, MemoryLocation) and isinstance(d.atom.addr, SpOffset)
-            }
-        else:
-            defs_by_stack_offset = {
-                -d.atom.addr.offset: d
-                for d in all_stack_defs
-                if isinstance(d.atom, MemoryLocation) and isinstance(d.atom.addr, SpOffset)
-            }
+            if sp_offset is None:
+                # We can not find the sp_offset when sp is concrete
+                # e.g.,
+                # LDR     R2, =0x20070000
+                # STR     R1, [R3,#0x38]
+                # MOV     SP, R2
+                # In this case, just assume sp_offset = 0
+                sp_offset = 0
+        defs_by_stack_offset = {
+            d.atom.addr.offset - sp_offset: d
+            for d in all_stack_defs
+            if isinstance(d.atom, MemoryLocation) and isinstance(d.atom.addr, SpOffset)
+        }
 
         default_type_cls = SimTypeInt if self.project.arch.bits == 32 else SimTypeLongLong
         arg_session = cc.arg_session(default_type_cls().with_arch(self.project.arch))

angr/analyses/cfg/cfg_fast.py

@@ -4586,6 +4586,18 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
                         ):
                             rbp_as_gpr = False
                             break
+                    elif (
+                        insn.mnemonic == "lea"
+                        and len(insn.operands) == 2
+                        and insn.operands[0].type == capstone.x86.X86_OP_REG
+                        and insn.operands[1].type == capstone.x86.X86_OP_MEM
+                    ):
+                        if (
+                            insn.operands[0].reg == capstone.x86.X86_REG_RBP
+                            and insn.operands[1].mem.base == capstone.x86.X86_REG_RSP
+                        ):
+                            rbp_as_gpr = False
+                            break
                 func = self.kb.functions.get_by_addr(func_addr)
                 func.info["bp_as_gpr"] = rbp_as_gpr
 

angr/analyses/complete_calling_conventions.py

@@ -5,6 +5,8 @@ import time
 import logging
 from collections import defaultdict
 
+import networkx
+
 import claripy
 
 from angr.utils.graph import GraphUtils
@@ -13,7 +15,6 @@ from ..knowledge_plugins.cfg import CFGModel
 from . import Analysis, register_analysis, VariableRecoveryFast, CallingConventionAnalysis
 
 if TYPE_CHECKING:
-    import networkx
     from angr.calling_conventions import SimCC
     from angr.sim_type import SimTypeFunction
     from angr.knowledge_plugins.variables.variable_manager import VariableManagerInternal
@@ -104,7 +105,9 @@ class CompleteCallingConventionsAnalysis(Analysis):
         """
 
         # get an ordering of functions based on the call graph
-        sorted_funcs = GraphUtils.quasi_topological_sort_nodes(self.kb.functions.callgraph)
+        # note that the call graph is a multi-digraph. we convert it to a digraph to speed up topological sort
+        directed_callgraph = networkx.DiGraph(self.kb.functions.callgraph)
+        sorted_funcs = GraphUtils.quasi_topological_sort_nodes(directed_callgraph)
 
         total_funcs = 0
         for func_addr in reversed(sorted_funcs):

angr/analyses/decompiler/ail_simplifier.py

@@ -4,7 +4,7 @@ import logging
 
 from ailment import AILBlockWalker
 from ailment.block import Block
-from ailment.statement import Statement, Assignment, Store, Call, ConditionalJump
+from ailment.statement import Statement, Assignment, Store, Call, ConditionalJump, DirtyStatement
 from ailment.expression import (
     Register,
     Convert,
@@ -1207,7 +1207,7 @@ class AILSimplifier(Analysis):
                 continue
 
             for idx, stmt in enumerate(block.statements):
-                if idx in stmts_to_remove:
+                if idx in stmts_to_remove and not isinstance(stmt, DirtyStatement):
                     if isinstance(stmt, (Assignment, Store)):
                         # Skip Assignment and Store statements
                         # if this statement triggers a call, it should only be removed if it's in self._calls_to_remove

angr/analyses/decompiler/block_simplifier.py

@@ -15,8 +15,15 @@ from ...analyses.propagator import PropagatorAnalysis
 from ...analyses.reaching_definitions import ReachingDefinitionsAnalysis
 from ...errors import SimMemoryMissingError
 from .. import Analysis, register_analysis
-from .peephole_optimizations import STMT_OPTS, EXPR_OPTS, PeepholeOptimizationStmtBase, PeepholeOptimizationExprBase
-from .utils import peephole_optimize_exprs, peephole_optimize_stmts
+from .peephole_optimizations import (
+    MULTI_STMT_OPTS,
+    STMT_OPTS,
+    EXPR_OPTS,
+    PeepholeOptimizationStmtBase,
+    PeepholeOptimizationExprBase,
+    PeepholeOptimizationMultiStmtBase,
+)
+from .utils import peephole_optimize_exprs, peephole_optimize_stmts, peephole_optimize_multistmts
 
 if TYPE_CHECKING:
     from angr.storage.memory_mixins.paged_memory.pages.multi_values import MultiValues
@@ -78,6 +85,7 @@ class BlockSimplifier(Analysis):
         if peephole_optimizations is None:
             self._expr_peephole_opts = [cls(self.project, self.kb, self.func_addr) for cls in EXPR_OPTS]
             self._stmt_peephole_opts = [cls(self.project, self.kb, self.func_addr) for cls in STMT_OPTS]
+            self._multistmt_peephole_opts = [cls(self.project, self.kb, self.func_addr) for cls in MULTI_STMT_OPTS]
         else:
             self._expr_peephole_opts = [
                 cls(self.project, self.kb, self.func_addr)
@@ -89,6 +97,11 @@ class BlockSimplifier(Analysis):
                 for cls in peephole_optimizations
                 if issubclass(cls, PeepholeOptimizationStmtBase)
             ]
+            self._multistmt_peephole_opts = [
+                cls(self.project, self.kb, self.func_addr)
+                for cls in peephole_optimizations
+                if issubclass(cls, PeepholeOptimizationMultiStmtBase)
+            ]
 
         self.result_block = None
 
@@ -404,9 +417,16 @@ class BlockSimplifier(Analysis):
         # run statement-level optimizations
         statements, stmts_updated = peephole_optimize_stmts(block, self._stmt_peephole_opts)
 
-        if not stmts_updated:
-            return block
-        new_block = block.copy(statements=statements)
+        if stmts_updated:
+            new_block = block.copy(statements=statements)
+        else:
+            new_block = block
+
+        statements, multi_stmts_updated = peephole_optimize_multistmts(new_block, self._multistmt_peephole_opts)
+
+        if not multi_stmts_updated:
+            return new_block
+        new_block = new_block.copy(statements=statements)
         return new_block
 
 

angr/analyses/decompiler/clinic.py

@@ -20,6 +20,7 @@ from ...sim_type import (
     SimTypeFunction,
     SimTypeBottom,
     SimTypeFloat,
+    SimTypePointer,
 )
 from ...sim_variable import SimVariable, SimStackVariable, SimRegisterVariable, SimMemoryVariable
 from ...knowledge_plugins.key_definitions.constants import OP_BEFORE
@@ -1247,23 +1248,32 @@ class Clinic(Analysis):
                 expr.variable_offset = offset
 
         elif isinstance(expr, ailment.Expr.Const):
-            # global variable?
-            global_vars = global_variables.get_global_variables(expr.value)
-            if not global_vars:
-                # detect if there is a related symbol
-                if self.project.loader.find_object_containing(expr.value):
-                    symbol = self.project.loader.find_symbol(expr.value)
-                    if symbol is not None:
-                        # Create a new global variable if there isn't one already
-                        global_vars = global_variables.get_global_variables(symbol.rebased_addr)
-                        if not global_vars:
-                            global_var = SimMemoryVariable(symbol.rebased_addr, symbol.size, name=symbol.name)
-                            global_variables.add_variable("global", global_var.addr, global_var)
-                            global_vars = {global_var}
-            if global_vars:
-                global_var = next(iter(global_vars))
-                expr.tags["reference_variable"] = global_var
-                expr.tags["reference_variable_offset"] = 0
+            # custom string?
+            if hasattr(expr, "custom_string") and expr.custom_string is True:
+                s = self.kb.custom_strings[expr.value]
+                expr.tags["reference_values"] = {
+                    SimTypePointer(SimTypeChar().with_arch(self.project.arch)).with_arch(self.project.arch): s.decode(
+                        "ascii"
+                    ),
+                }
+            else:
+                # global variable?
+                global_vars = global_variables.get_global_variables(expr.value)
+                if not global_vars:
+                    # detect if there is a related symbol
+                    if self.project.loader.find_object_containing(expr.value):
+                        symbol = self.project.loader.find_symbol(expr.value)
+                        if symbol is not None:
+                            # Create a new global variable if there isn't one already
+                            global_vars = global_variables.get_global_variables(symbol.rebased_addr)
+                            if not global_vars:
+                                global_var = SimMemoryVariable(symbol.rebased_addr, symbol.size, name=symbol.name)
+                                global_variables.add_variable("global", global_var.addr, global_var)
+                                global_vars = {global_var}
+                if global_vars:
+                    global_var = next(iter(global_vars))
+                    expr.tags["reference_variable"] = global_var
+                    expr.tags["reference_variable_offset"] = 0
 
         elif isinstance(expr, ailment.Stmt.Call):
             self._link_variables_on_call(variable_manager, global_variables, block, stmt_idx, expr, is_expr=True)

angr/analyses/decompiler/optimization_passes/__init__.py

@@ -50,6 +50,8 @@ def get_optimization_passes(arch, platform):
 
     if platform is not None:
         platform = platform.lower()
+    if platform == "win32":
+        platform = "windows"  # sigh
 
     passes = []
     for pass_, _ in _all_optimization_passes:

angr/analyses/decompiler/optimization_passes/engine_base.py

@@ -89,7 +89,7 @@ class SimplifierAILEngine(
         if hasattr(self, handler):
             return getattr(self, handler)(stmt)
         else:
-            _l.warning("Unsupported statement type %s.", type(stmt).__name__)
+            _l.debug("Unsupported statement type %s.", type(stmt).__name__)
             return stmt
 
     def _ail_handle_Assignment(self, stmt):
@@ -176,7 +176,7 @@ class SimplifierAILEngine(
             if v is None:
                 return expr
             return v
-        _l.warning("Unsupported expression type %s.", type(expr).__name__)
+        _l.debug("Unsupported expression type %s.", type(expr).__name__)
         return expr
 
     def _ail_handle_StackBaseOffset(self, expr):  # pylint:disable=no-self-use

angr/analyses/decompiler/optimization_passes/ite_region_converter.py

@@ -84,9 +84,9 @@ class ITERegionConverter(OptimizationPass):
 
             true_child, false_child = None, None
             for child in children:
-                if child.addr == if_stmt.true_target.value:
+                if if_stmt.true_target is not None and child.addr == if_stmt.true_target.value:
                     true_child = child
-                elif child.addr == if_stmt.false_target.value:
+                elif if_stmt.false_target is not None and child.addr == if_stmt.false_target.value:
                     false_child = child
 
             if (

angr/analyses/decompiler/optimization_passes/win_stack_canary_simplifier.py

@@ -3,6 +3,7 @@ from typing import Set, Dict
 from collections import defaultdict
 import logging
 
+import capstone
 import ailment
 import cle
 
@@ -48,24 +49,24 @@ class WinStackCanarySimplifier(OptimizationPass):
             return False, None
 
         # Check the first block and see if there is any statement reading data from _security_cookie
-        init_stmt = self._find_canary_init_stmt()
+        init_stmts = self._find_canary_init_stmt()
 
-        return init_stmt is not None, {"init_stmt": init_stmt}
+        return init_stmts is not None, {"init_stmts": init_stmts}
 
     def _analyze(self, cache=None):
-        init_stmt = None
+        init_stmts = None
         if cache is not None:
-            init_stmt = cache.get("init_stmt", None)
+            init_stmts = cache.get("init_stmts", None)
 
-        if init_stmt is None:
-            init_stmt = self._find_canary_init_stmt()
+        if init_stmts is None:
+            init_stmts = self._find_canary_init_stmt()
 
-        if init_stmt is None:
+        if init_stmts is None:
             return
 
         # Look for the statement that loads back canary value from the stack
-        first_block, canary_init_stmt_idx = init_stmt
-        canary_init_stmt = first_block.statements[canary_init_stmt_idx]
+        first_block, canary_init_stmt_ids = init_stmts
+        canary_init_stmt = first_block.statements[canary_init_stmt_ids[-1]]
         # where is the stack canary stored?
         if not isinstance(canary_init_stmt.addr, ailment.Expr.StackBaseOffset):
             _l.debug(
@@ -142,7 +143,8 @@ class WinStackCanarySimplifier(OptimizationPass):
         if found_endpoints:
             # Remove the statement that loads the stack canary from fs
             first_block_copy = first_block.copy()
-            first_block_copy.statements.pop(canary_init_stmt_idx)
+            for stmt_idx in sorted(canary_init_stmt_ids, reverse=True):
+                first_block_copy.statements.pop(stmt_idx)
             self._update_block(first_block, first_block_copy)
 
     def _find_canary_init_stmt(self):
@@ -150,7 +152,13 @@ class WinStackCanarySimplifier(OptimizationPass):
         if first_block is None:
             return None
 
+        load_stmt_idx = None
+        load_reg = None
+        xor_stmt_idx = None
+        xored_reg = None
+
         for idx, stmt in enumerate(first_block.statements):
+            # if we are lucky and things get folded into one statement:
             if (
                 isinstance(stmt, ailment.Stmt.Store)
                 and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
@@ -163,13 +171,51 @@ class WinStackCanarySimplifier(OptimizationPass):
                 # Check addr: must be __security_cookie
                 load_addr = stmt.data.operands[0].addr.value
                 if load_addr == self._security_cookie_addr:
-                    return first_block, idx
+                    return first_block, [idx]
+            # or if we are unlucky and the load and the xor are two different statements
+            if (
+                isinstance(stmt, ailment.Stmt.Assignment)
+                and isinstance(stmt.dst, ailment.Expr.Register)
+                and isinstance(stmt.src, ailment.Expr.Load)
+                and isinstance(stmt.src.addr, ailment.Expr.Const)
+            ):
+                load_addr = stmt.src.addr.value
+                if load_addr == self._security_cookie_addr:
+                    load_stmt_idx = idx
+                    load_reg = stmt.dst.reg_offset
+            if load_stmt_idx is not None and idx == load_stmt_idx + 1:
+                if (
+                    isinstance(stmt, ailment.Stmt.Assignment)
+                    and isinstance(stmt.dst, ailment.Expr.Register)
+                    and isinstance(stmt.src, ailment.Expr.BinaryOp)
+                    and stmt.src.op == "Xor"
+                    and isinstance(stmt.src.operands[0], ailment.Expr.Register)
+                    and stmt.src.operands[0].reg_offset == load_reg
+                    and isinstance(stmt.src.operands[1], ailment.Expr.StackBaseOffset)
+                ):
+                    xor_stmt_idx = idx
+                    xored_reg = stmt.dst.reg_offset
+                else:
+                    break
+            if xor_stmt_idx is not None and idx == xor_stmt_idx + 1:
+                if (
+                    isinstance(stmt, ailment.Stmt.Store)
+                    and isinstance(stmt.addr, ailment.Expr.StackBaseOffset)
+                    and isinstance(stmt.data, ailment.Expr.Register)
+                    and stmt.data.reg_offset == xored_reg
+                ):
+                    return first_block, [load_stmt_idx, xor_stmt_idx, idx]
+                else:
+                    break
 
         return None
 
     @staticmethod
     def _find_amd64_canary_storing_stmt(block, canary_value_stack_offset):
+        load_stmt_idx = None
+
         for idx, stmt in enumerate(block.statements):
+            # when we are lucky, we have one instruction
             if (
                 isinstance(stmt, ailment.Stmt.Assignment)
                 and isinstance(stmt.dst, ailment.Expr.Register)
@@ -185,7 +231,29 @@ class WinStackCanarySimplifier(OptimizationPass):
                         if isinstance(op1, ailment.Expr.StackBaseOffset):
                             # found it
                             return idx
-
+            # or when we are unlucky, we have two instructions...
+            if (
+                isinstance(stmt, ailment.Stmt.Assignment)
+                and isinstance(stmt.dst, ailment.Expr.Register)
+                and stmt.dst.reg_name == "rcx"
+                and isinstance(stmt.src, ailment.Expr.Load)
+                and isinstance(stmt.src.addr, ailment.Expr.StackBaseOffset)
+                and stmt.src.addr.offset == canary_value_stack_offset
+            ):
+                load_stmt_idx = idx
+            if load_stmt_idx is not None and idx == load_stmt_idx + 1:
+                if (
+                    isinstance(stmt, ailment.Stmt.Assignment)
+                    and isinstance(stmt.dst, ailment.Expr.Register)
+                    and isinstance(stmt.src, ailment.Expr.BinaryOp)
+                    and stmt.src.op == "Xor"
+                ):
+                    if (
+                        isinstance(stmt.src.operands[0], ailment.Expr.Register)
+                        and stmt.src.operands[0].reg_name == "rcx"
+                        and isinstance(stmt.src.operands[1], ailment.Expr.StackBaseOffset)
+                    ):
+                        return idx
         return None
 
     @staticmethod
@@ -200,6 +268,29 @@ class WinStackCanarySimplifier(OptimizationPass):
                 return idx
         return None
 
+    def _is_function_likely_security_check_cookie(self, func) -> bool:
+        # disassemble the first instruction
+        if func.is_plt or func.is_syscall or func.is_simprocedure:
+            return False
+        block = self.project.factory.block(func.addr)
+        if block.instructions != 2:
+            return False
+        ins0 = block.capstone.insns[0]
+        if (
+            ins0.mnemonic == "cmp"
+            and len(ins0.operands) == 2
+            and ins0.operands[0].type == capstone.x86.X86_OP_REG
+            and ins0.operands[0].reg == capstone.x86.X86_REG_RCX
+            and ins0.operands[1].type == capstone.x86.X86_OP_MEM
+            and ins0.operands[1].mem.base == capstone.x86.X86_REG_RIP
+            and ins0.operands[1].mem.index == 0
+            and ins0.operands[1].mem.disp + ins0.address + ins0.size == self._security_cookie_addr
+        ):
+            ins1 = block.capstone.insns[1]
+            if ins1.mnemonic == "jne":
+                return True
+        return False
+
     def _find_stmt_calling_security_check_cookie(self, node):
         for idx, stmt in enumerate(node.statements):
             if isinstance(stmt, ailment.Stmt.Call) and isinstance(stmt.target, ailment.Expr.Const):
@@ -208,5 +299,7 @@ class WinStackCanarySimplifier(OptimizationPass):
                     func = self.kb.functions.function(addr=const_target)
                     if func.name == "_security_check_cookie":
                         return idx
+                    elif self._is_function_likely_security_check_cookie(func):
+                        return idx
 
         return None

angr/analyses/decompiler/peephole_optimizations/__init__.py

@@ -40,10 +40,12 @@ from .sar_to_signed_div import SarToSignedDiv
 from .tidy_stack_addr import TidyStackAddr
 from .invert_negated_logical_conjuction_disjunction import InvertNegatedLogicalConjunctionsAndDisjunctions
 from .rol_ror import RolRorRewriter
+from .inlined_strcpy import InlinedStrcpy
+from .inlined_strcpy_consolidation import InlinedStrcpyConsolidation
 
-from .base import PeepholeOptimizationExprBase, PeepholeOptimizationStmtBase
-
+from .base import PeepholeOptimizationExprBase, PeepholeOptimizationStmtBase, PeepholeOptimizationMultiStmtBase
 
+MULTI_STMT_OPTS: List[Type[PeepholeOptimizationMultiStmtBase]] = []
 STMT_OPTS: List[Type[PeepholeOptimizationStmtBase]] = []
 EXPR_OPTS: List[Type[PeepholeOptimizationExprBase]] = []
 
@@ -55,4 +57,11 @@ for v in _g.values():
     if isinstance(v, type) and issubclass(v, PeepholeOptimizationStmtBase) and v is not PeepholeOptimizationStmtBase:
         STMT_OPTS.append(v)
 
+    if (
+        isinstance(v, type)
+        and issubclass(v, PeepholeOptimizationMultiStmtBase)
+        and v is not PeepholeOptimizationMultiStmtBase
+    ):
+        MULTI_STMT_OPTS.append(v)
+
 _g = None

angr/analyses/decompiler/peephole_optimizations/base.py

@@ -1,7 +1,7 @@
-from typing import Optional
+from typing import List, Optional
 
 from ailment.expression import BinaryOp, UnaryOp, Expression
-from ailment.statement import Assignment
+from ailment.statement import Statement, Assignment
 from ailment import Block
 from angr.project import Project
 from angr.knowledge_base import KnowledgeBase
@@ -34,6 +34,33 @@ class PeepholeOptimizationStmtBase:
         raise NotImplementedError("_optimize() is not implemented.")
 
 
+class PeepholeOptimizationMultiStmtBase:
+    """
+    The base class for all peephole optimizations that are applied on multiple AIL statements at once.
+    """
+
+    __slots__ = (
+        "project",
+        "kb",
+        "func_addr",
+    )
+    project: Optional[Project]
+    kb: Optional[KnowledgeBase]
+    func_addr: Optional[int]
+
+    NAME = "Peephole Optimization - Multi-statement"
+    DESCRIPTION = "Peephole Optimization - Multi-statement"
+    stmt_classes = None
+
+    def __init__(self, project: Optional[Project], kb: Optional[KnowledgeBase], func_addr: Optional[int] = None):
+        self.project = project
+        self.kb = kb
+        self.func_addr = func_addr
+
+    def optimize(self, stmts: List[Statement], stmt_idx: Optional[int] = None, block=None, **kwargs):
+        raise NotImplementedError("_optimize() is not implemented.")
+
+
 class PeepholeOptimizationExprBase:
     """
     The base class for all peephole optimizations that are applied on AIL expressions.

angr/analyses/decompiler/peephole_optimizations/constant_derefs.py

@@ -20,7 +20,7 @@ class ConstantDereferences(PeepholeOptimizationExprBase):
             if sec is not None and sec.is_readable and (not sec.is_writable or "got" in sec.name):
                 # do we know the value that it's reading?
                 try:
-                    val = self.project.loader.memory.unpack_word(expr.addr.value, size=self.project.arch.bytes)
+                    val = self.project.loader.memory.unpack_word(expr.addr.value, size=expr.size)
                 except KeyError:
                     return expr
 

angr/analyses/decompiler/peephole_optimizations/inlined_strcpy.py

@@ -0,0 +1,83 @@
+# pylint:disable=arguments-differ
+from typing import Tuple, Optional
+import string
+
+from archinfo import Endness
+
+from ailment.expression import Const
+from ailment.statement import Call, Store
+
+from .base import PeepholeOptimizationStmtBase
+
+
+ASCII_PRINTABLES = set(string.printable)
+ASCII_DIGITS = set(string.digits)
+
+
+class InlinedStrcpy(PeepholeOptimizationStmtBase):
+    """
+    Simplifies inlined string copying logic into calls to strcpy.
+    """
+
+    __slots__ = ()
+
+    NAME = "Simplifying inlined strcpy"
+    stmt_classes = (Store,)
+
+    def optimize(self, stmt: Store, **kwargs):
+        if isinstance(stmt.data, Const):
+            r, s = self.is_integer_likely_a_string(stmt.data.value, stmt.data.size, stmt.endness)
+            if r:
+                # replace it with a call to strncpy
+                str_id = self.kb.custom_strings.allocate(s.encode("ascii"))
+                return Call(
+                    stmt.idx,
+                    "strncpy",
+                    args=[
+                        stmt.addr,
+                        Const(None, None, str_id, stmt.addr.bits, custom_string=True),
+                        Const(None, None, len(s), self.project.arch.bits),
+                    ],
+                    **stmt.tags,
+                )
+
+        return None
+
+    @staticmethod
+    def is_integer_likely_a_string(
+        v: int, size: int, endness: Endness, min_length: int = 4
+    ) -> Tuple[bool, Optional[str]]:
+        # we need at least four bytes of printable characters
+
+        chars = []
+        if endness == Endness.LE:
+            while v != 0:
+                byt = v & 0xFF
+                if chr(byt) not in ASCII_PRINTABLES:
+                    return False, None
+                chars.append(chr(byt))
+                v >>= 8
+
+        elif endness == Endness.BE:
+            first_non_zero = False
+            for _ in range(size):
+                byt = v & 0xFF
+                v >>= 8
+                if byt == 0:
+                    if first_non_zero:
+                        return False, None
+                    continue
+                first_non_zero = True  # this is the first non-zero byte
+                if chr(byt) not in ASCII_PRINTABLES:
+                    return False, None
+                chars.append(chr(byt))
+            chars = chars[::-1]
+        else:
+            # unsupported endness
+            return False, None
+
+        if len(chars) >= min_length:
+            if len(chars) <= 4 and all(ch in ASCII_DIGITS for ch in chars):
+                return False, None
+            return True, "".join(chars)
+        return False, None