angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl

angr/analyses/typehoon/translator.py

@@ -91,15 +91,20 @@ class TypeTranslator:
             internal = self._tc2simtype(tc.basetype)
         return sim_type.SimTypePointer(internal).with_arch(self.arch)
 
-    def _translate_Array(self, tc: typeconsts.Array):
+    def _translate_Array(self, tc: typeconsts.Array) -> sim_type.SimTypeArray:
         elem_type = self._tc2simtype(tc.element)
         return sim_type.SimTypeArray(elem_type, length=tc.count).with_arch(self.arch)
 
-    def _translate_Struct(self, tc):
+    def _translate_Struct(self, tc: typeconsts.Struct):
         if tc in self.structs:
             return self.structs[tc]
 
-        s = sim_type.SimStruct({}, name=self.struct_name()).with_arch(self.arch)
+        if tc.name:
+            name = tc.name
+        else:
+            name = self.struct_name()
+
+        s = sim_type.SimStruct({}, name=name).with_arch(self.arch)
         self.structs[tc] = s
 
         next_offset = 0
@@ -117,7 +122,11 @@ class TypeTranslator:
                 # for now, we replace it with an unsigned char
                 translated_type = sim_type.SimTypeChar(signed=False).with_arch(self.arch)
 
-            s.fields["field_%x" % offset] = translated_type
+            if tc.field_names and offset in tc.field_names:
+                field_name = tc.field_names[offset]
+            else:
+                field_name = f"field_{offset:x}"
+            s.fields[field_name] = translated_type
 
             if isinstance(translated_type, SimTypeTempRef):
                 next_offset = self.arch.bytes + offset

angr/analyses/typehoon/typeconsts.py

@@ -3,7 +3,25 @@
 All type constants used in type inference. They can be mapped, translated, or rewritten to C-style types.
 """
 
-from typing import Optional
+from typing import List, Optional, Set
+import functools
+
+
+def memoize(f):
+    @functools.wraps(f)
+    def wrapped_repr(self, *args, **kwargs):
+        if not kwargs or "memo" not in kwargs:
+            memo = set()
+        else:
+            memo = kwargs.pop("memo")
+        if self in memo:
+            return "..."
+        memo.add(self)
+        r = f(self, *args, memo=memo, **kwargs)
+        memo.remove(self)
+        return r
+
+    return wrapped_repr
 
 
 class TypeConstant:
@@ -12,11 +30,14 @@ class TypeConstant:
     def pp_str(self, mapping) -> str:  # pylint:disable=unused-argument
         return repr(self)
 
+    def _hash(self, visited: Set[int]):  # pylint:disable=unused-argument
+        return hash(type(self))
+
     def __eq__(self, other):
-        return type(self) == type(other)
+        return type(self) is type(other)
 
     def __hash__(self):
-        return hash(type(self))
+        return self._hash(set())
 
     @property
     def size(self) -> int:
@@ -24,19 +45,22 @@ class TypeConstant:
             raise NotImplementedError()
         return self.SIZE
 
+    def __repr__(self, memo=None):
+        raise NotImplementedError()
+
 
 class TopType(TypeConstant):
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "TOP"
 
 
 class BottomType(TypeConstant):
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "BOT"
 
 
 class Int(TypeConstant):
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "intbase"
 
 
@@ -47,81 +71,88 @@ class Int1(Int):
 class Int8(Int):
     SIZE = 1
 
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "int8"
 
 
 class Int16(Int):
     SIZE = 2
 
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "int16"
 
 
 class Int32(Int):
     SIZE = 4
 
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "int32"
 
 
 class Int64(Int):
     SIZE = 8
 
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "int64"
 
 
 class Int128(Int):
     SIZE = 16
 
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "int128"
 
 
 class FloatBase(TypeConstant):
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "floatbase"
 
 
 class Float(FloatBase):
     SIZE = 4
 
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "float"
 
 
 class Double(FloatBase):
     SIZE = 8
 
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "double"
 
 
 class Pointer(TypeConstant):
-    def __init__(self, basetype):
-        self.basetype = basetype
+    def __init__(self, basetype: Optional[TypeConstant]):
+        self.basetype: Optional[TypeConstant] = basetype
 
     def __eq__(self, other):
         return type(self) is type(other) and self.basetype == other.basetype
 
-    def __hash__(self):
-        return hash((type(self), hash(self.basetype)))
+    def _hash(self, visited: Set[int]):
+        if self.basetype is None:
+            return hash(type(self))
+        return hash((type(self), self.basetype._hash(visited)))
 
     def new(self, basetype):
         return self.__class__(basetype)
 
+    def __hash__(self):
+        return self._hash(set())
+
 
 class Pointer32(Pointer, Int32):
     """
     32-bit pointers.
     """
 
-    def __init__(self, basetype):
+    def __init__(self, basetype=None):
         Pointer.__init__(self, basetype)
 
-    def __repr__(self):
-        return "ptr32(%r)" % self.basetype
+    @memoize
+    def __repr__(self, memo=None):
+        bt = self.basetype.__repr__(memo=memo) if isinstance(self.basetype, TypeConstant) else repr(self.basetype)
+        return f"ptr32({bt})"
 
 
 class Pointer64(Pointer, Int64):
@@ -129,19 +160,22 @@ class Pointer64(Pointer, Int64):
     64-bit pointers.
     """
 
-    def __init__(self, basetype):
+    def __init__(self, basetype=None):
         Pointer.__init__(self, basetype)
 
-    def __repr__(self):
-        return "ptr64(%r)" % self.basetype
+    @memoize
+    def __repr__(self, memo=None):
+        bt = self.basetype.__repr__(memo=memo) if isinstance(self.basetype, TypeConstant) else repr(self.basetype)
+        return f"ptr64({bt})"
 
 
 class Array(TypeConstant):
-    def __init__(self, element, count=None):
-        self.element: TypeConstant = element
+    def __init__(self, element=None, count=None):
+        self.element: Optional[TypeConstant] = element
         self.count: Optional[int] = count
 
-    def __repr__(self):
+    @memoize
+    def __repr__(self, memo=None):
         if self.count is None:
             return "%r[?]" % self.element
         else:
@@ -150,34 +184,81 @@ class Array(TypeConstant):
     def __eq__(self, other):
         return type(other) is type(self) and self.element == other.element and self.count == other.count
 
-    def __hash__(self):
+    def _hash(self, visited: Set[int]):
+        if id(self) in visited:
+            return 0
+        visited.add(id(self))
         return hash((type(self), self.element, self.count))
 
+    def __hash__(self):
+        return self._hash(set())
+
 
 class Struct(TypeConstant):
-    def __init__(self, fields=None):
+    def __init__(self, fields=None, name=None, field_names=None):
         self.fields = {} if fields is None else fields  # offset to type
+        self.name = name
+        self.field_names = field_names
+
+    def _hash(self, visited: Set[int]):
+        if id(self) in visited:
+            return 0
+        visited.add(id(self))
+        return hash((type(self), self._hash_fields(visited)))
 
-    def _hash_fields(self):
+    def _hash_fields(self, visited: Set[int]):
         keys = sorted(self.fields.keys())
-        tpl = tuple((k, self.fields[k]) for k in keys)
+        tpl = tuple((k, self.fields[k]._hash(visited)) for k in keys)
         return hash(tpl)
 
-    def __repr__(self):
-        return "struct%r" % self.fields
+    @memoize
+    def __repr__(self, memo=None):
+        prefix = "struct"
+        if self.name:
+            prefix = f"struct {self.name}"
+        return prefix + "{" + ", ".join(f"{k}:{v.__repr__(memo=memo)}" for k, v in self.fields.items()) + "}"
+
+    def __eq__(self, other):
+        return type(other) is type(self) and hash(self) == hash(other)
+
+    def __hash__(self):
+        return self._hash(set())
+
+
+class Function(TypeConstant):
+    def __init__(self, params: List, outputs: List):
+        self.params = params
+        self.outputs = outputs
+
+    @memoize
+    def __repr__(self, memo=None):
+        param_str = ", ".join(repr(param) for param in self.params)
+        outputs_str = ", ".join(repr(output) for output in self.outputs)
+        return f"func({param_str}) -> {outputs_str}"
 
     def __eq__(self, other):
-        return type(other) is type(self) and self.fields == other.fields
+        if not isinstance(other, Function):
+            return False
+        return self.params == other.params and self.outputs == other.outputs
+
+    def _hash(self, visited: Set[int]):
+        if id(self) in visited:
+            return 0
+        visited.add(id(self))
+
+        params_hash = tuple(param._hash(visited) for param in self.params)
+        outputs_hash = tuple(out._hash(visited) for out in self.outputs)
+        return hash((Function, params_hash, outputs_hash))
 
     def __hash__(self):
-        return hash((type(self), self._hash_fields()))
+        return self._hash(set())
 
 
 class TypeVariableReference(TypeConstant):
     def __init__(self, typevar):
         self.typevar = typevar
 
-    def __repr__(self):
+    def __repr__(self, memo=None):
         return "ref(%s)" % self.typevar
 
     def __eq__(self, other):

angr/analyses/typehoon/typehoon.py

@@ -1,16 +1,17 @@
+# pylint:disable=bad-builtin
 from typing import List, Set, Optional, Dict, Union, TYPE_CHECKING
 
 from ...sim_type import SimStruct, SimTypePointer, SimTypeArray
 from ..analysis import Analysis, AnalysesHub
 from .simple_solver import SimpleSolver
 from .translator import TypeTranslator
-from .typeconsts import Struct, Pointer, TypeConstant, Array
-from .typevars import Equivalence
+from .typeconsts import Struct, Pointer, TypeConstant, Array, TopType
+from .typevars import Equivalence, Subtype, TypeVariable
 
 if TYPE_CHECKING:
     from angr.sim_variable import SimVariable
     from angr.sim_type import SimType
-    from .typevars import TypeVariable, TypeConstraint
+    from .typevars import TypeConstraint
 
 
 class Typehoon(Analysis):
@@ -30,6 +31,7 @@ class Typehoon(Analysis):
     def __init__(
         self,
         constraints,
+        func_var,
         ground_truth=None,
         var_mapping: Optional[Dict["SimVariable", Set["TypeVariable"]]] = None,
         must_struct: Optional[Set["TypeVariable"]] = None,
@@ -43,9 +45,10 @@ class Typehoon(Analysis):
         :param must_struct:
         """
 
-        self._constraints: Set["TypeConstraint"] = constraints
+        self.func_var: "TypeVariable" = func_var
+        self._constraints: Dict["TypeVariable", Set["TypeConstraint"]] = constraints
         self._ground_truth: Optional[Dict["TypeVariable", "SimType"]] = ground_truth
-        self._var_mapping = var_mapping  # variable mapping is only used for debugging purposes
+        self._var_mapping = var_mapping
         self._must_struct = must_struct
 
         self.bits = self.project.arch.bits
@@ -95,9 +98,11 @@ class Typehoon(Analysis):
             for tv in typevars:
                 typevar_to_var[tv] = k
 
-        print(f"### {len(self._constraints)} constraints")
-        for constraint in self._constraints:
-            print("    " + constraint.pp_str(typevar_to_var))
+        print(f"### {sum(map(len, self._constraints.values()))} constraints")
+        for func_var in self._constraints:
+            print(f"{func_var}:")
+            for constraint in self._constraints[func_var]:
+                print("    " + constraint.pp_str(typevar_to_var))
         print("### end of constraints ###")
 
     def pp_solution(self) -> None:
@@ -133,7 +138,7 @@ class Typehoon(Analysis):
         if self._ground_truth:
             translator = TypeTranslator(arch=self.project.arch)
             for tv, sim_type in self._ground_truth.items():
-                self._constraints.add(Equivalence(tv, translator.simtype2tc(sim_type)))
+                self._constraints[self.func_var].add(Equivalence(tv, translator.simtype2tc(sim_type)))
 
         self._solve()
         self._specialize()
@@ -144,7 +149,19 @@ class Typehoon(Analysis):
             self.simtypes_solution.update(self._ground_truth)
 
     def _solve(self):
-        solver = SimpleSolver(self.bits, self._constraints)
+        typevars = set()
+        if self._var_mapping:
+            for variable_typevars in self._var_mapping.values():
+                typevars |= variable_typevars
+        else:
+            # collect type variables from constraints
+            for constraint in self._constraints[self.func_var]:
+                if isinstance(constraint, Subtype):
+                    if isinstance(constraint.sub_type, TypeVariable):
+                        typevars.add(constraint.sub_type)
+                    if isinstance(constraint.super_type, TypeVariable):
+                        typevars.add(constraint.super_type)
+        solver = SimpleSolver(self.bits, self._constraints, typevars)
         self.solution = solver.solution
 
     def _specialize(self):
@@ -189,7 +206,10 @@ class Typehoon(Analysis):
                 if all(off % alignment == 0 for off in offsets):
                     # yeah!
                     max_offset = offsets[-1]
-                    count = (max_offset + field0.size) // alignment
+                    field0_size = 1
+                    if not isinstance(field0, TopType):
+                        field0_size = field0.size
+                    count = (max_offset + field0_size) // alignment
                     return Array(field0, count=count)
 
         return None

angr/analyses/typehoon/typevars.py

@@ -1,13 +1,19 @@
 # pylint:disable=missing-class-docstring
-from typing import Dict, Any, Optional, Set, TYPE_CHECKING
+from typing import Dict, Any, Optional, Set, Iterable, Tuple, Union, TYPE_CHECKING
 from itertools import count
 
+from angr.utils.constants import MAX_POINTSTO_BITS
+from .variance import Variance
+
 if TYPE_CHECKING:
     from angr.sim_variable import SimVariable
+    from .typeconsts import TypeConstant
 
 
 # Type variables and constraints
 
+TypeType = Union["TypeConstant", "TypeVariable", "DerivedTypeVariable"]
+
 
 class TypeConstraint:
     __slots__ = ()
@@ -79,7 +85,7 @@ class Subtype(TypeConstraint):
         "sub_type",
     )
 
-    def __init__(self, sub_type, super_type):
+    def __init__(self, sub_type: TypeType, super_type: TypeType):
         self.super_type = super_type
         self.sub_type = sub_type
 
@@ -272,52 +278,103 @@ _typevariable_counter = count()
 
 
 class TypeVariable:
-    __slots__ = ("idx",)
+    __slots__ = ("idx", "name")
 
-    def __init__(self, idx: Optional[int] = None):
+    def __init__(self, idx: Optional[int] = None, name: Optional[str] = None):
         if idx is None:
             self.idx: int = next(_typevariable_counter)
         else:
             self.idx: int = idx
+        self.name = name
 
     def pp_str(self, mapping: Dict["TypeVariable", Any]) -> str:
-        varname = mapping.get(self, None)
+        varname = mapping.get(self, self.name)
         if varname is None:
             return repr(self)
         return f"{varname} ({repr(self)})"
 
     def __eq__(self, other):
-        return type(other) is TypeVariable and other.idx == self.idx
+        if type(other) is not TypeVariable:
+            return False
+        if self.name or other.name:
+            return self.name == other.name
+        return self.idx == other.idx
+
+    def _hash(self, visited=None):  # pylint:disable=unused-argument
+        if self.name:
+            return hash((TypeVariable, self.name))
+        return hash((TypeVariable, self.idx))
 
     def __hash__(self):
-        return hash((TypeVariable, self.idx))
+        return self._hash()
 
     def __repr__(self):
+        if self.name:
+            return f"{self.name}|tv_{self.idx:02d}"
         return "tv_%02d" % self.idx
 
 
 class DerivedTypeVariable(TypeVariable):
-    __slots__ = (
-        "type_var",
-        "label",
-    )
+    __slots__ = ("type_var", "labels")
+
+    type_var: Union[TypeVariable, "TypeConstant"]
 
-    def __init__(self, type_var, label, idx=None):
+    def __init__(
+        self,
+        type_var: Optional[Union[TypeVariable, "DerivedTypeVariable"]],
+        label,
+        labels: Optional[Iterable["BaseLabel"]] = None,
+        idx=None,
+    ):
         super().__init__(idx=idx)
-        self.type_var = type_var
-        self.label = label
+        if isinstance(type_var, DerivedTypeVariable):
+            existing_labels = type_var.labels
+            self.type_var = type_var.type_var
+            assert not isinstance(self.type_var, DerivedTypeVariable)
+        else:
+            existing_labels = ()
+            self.type_var = type_var
+
+        if label is not None and labels:
+            raise TypeError("You cannot specify both label and labels at the same time")
+
+        if label is not None:
+            self.labels = existing_labels + (label,)
+        else:
+            self.labels: Tuple["BaseLabel"] = existing_labels + tuple(labels)
+
+        if not self.labels:
+            raise ValueError("A DerivedTypeVariable must have at least one label")
+
+    def one_label(self) -> Optional["BaseLabel"]:
+        return self.labels[0] if len(self.labels) == 1 else None
+
+    def path(self) -> Tuple["BaseLabel"]:
+        return self.labels
+
+    def longest_prefix(self) -> Optional[Union[TypeVariable, "DerivedTypeVariable"]]:
+        if not self.labels:
+            return None
+        if len(self.labels) == 1:
+            return self.type_var
+        return DerivedTypeVariable(self.type_var, None, labels=self.labels[:-1])
 
     def pp_str(self, mapping: Dict["TypeVariable", Any]) -> str:
-        return f"{self.type_var.pp_str(mapping)}.{self.label}"
+        return ".".join([self.type_var.pp_str(mapping)] + [repr(lbl) for lbl in self.labels])
 
     def __eq__(self, other):
-        return isinstance(other, DerivedTypeVariable) and self.type_var == other.type_var and self.label == other.label
+        return (
+            isinstance(other, DerivedTypeVariable) and self.type_var == other.type_var and self.labels == other.labels
+        )
+
+    def _hash(self, visited=None):
+        return hash((DerivedTypeVariable, self.type_var, self.labels))
 
     def __hash__(self):
-        return hash((DerivedTypeVariable, self.type_var, self.label))
+        return self._hash()
 
     def __repr__(self):
-        return f"{self.type_var!r}.{self.label!r}"
+        return ".".join([repr(self.type_var)] + [repr(lbl) for lbl in self.labels])
 
     def replace(self, replacements):
         typevar = None
@@ -332,7 +389,7 @@ class DerivedTypeVariable(TypeVariable):
 
         if typevar is not None:
             # replacement has happened
-            return True, DerivedTypeVariable(typevar, self.label, idx=self.idx)
+            return True, DerivedTypeVariable(typevar, None, labels=self.labels, idx=self.idx)
         else:
             return False, self
 
@@ -397,7 +454,11 @@ class BaseLabel:
         return type(self) is type(other) and hash(self) == hash(other)
 
     def __hash__(self):
-        return hash(tuple(getattr(self, k) for k in self.__slots__))
+        return hash((type(self),) + tuple(getattr(self, k) for k in self.__slots__))
+
+    @property
+    def variance(self) -> Variance:
+        return Variance.COVARIANT
 
 
 class FuncIn(BaseLabel):
@@ -433,6 +494,10 @@ class Store(BaseLabel):
     def __repr__(self):
         return "store"
 
+    @property
+    def variance(self) -> Variance:
+        return Variance.CONTRAVARIANT
+
 
 class AddN(BaseLabel):
     __slots__ = ("n",)
@@ -489,7 +554,9 @@ class HasField(BaseLabel):
         self.offset = offset
 
     def __repr__(self):
-        return "<%d>@%d" % (self.bits, self.offset)
+        if self.bits == MAX_POINTSTO_BITS:
+            return f"<MAX_POINTSTO_BITS>@{self.offset}"
+        return f"<{self.bits} bits>@{self.offset}"
 
 
 class IsArray(BaseLabel):

angr/analyses/typehoon/variance.py

@@ -0,0 +1,10 @@
+import enum
+
+
+class Variance(enum.Enum):
+    """
+    Enum class describing the variance of type constraints.
+    """
+
+    COVARIANT = 0
+    CONTRAVARIANT = 1