angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of angr might be problematic. Click here for more details.

Files changed (248) hide show
  1. angr/__init__.py +4 -1
  2. angr/analyses/decompiler/clinic.py +16 -0
  3. angr/analyses/decompiler/decompiler.py +3 -0
  4. angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
  5. angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
  6. angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
  7. angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
  8. angr/analyses/decompiler/structured_codegen/c.py +12 -2
  9. angr/analyses/decompiler/utils.py +13 -0
  10. angr/analyses/typehoon/dfa.py +108 -0
  11. angr/analyses/typehoon/lifter.py +34 -2
  12. angr/analyses/typehoon/simple_solver.py +1043 -503
  13. angr/analyses/typehoon/translator.py +13 -4
  14. angr/analyses/typehoon/typeconsts.py +117 -36
  15. angr/analyses/typehoon/typehoon.py +31 -11
  16. angr/analyses/typehoon/typevars.py +88 -21
  17. angr/analyses/typehoon/variance.py +10 -0
  18. angr/analyses/variable_recovery/engine_ail.py +28 -9
  19. angr/analyses/variable_recovery/engine_base.py +50 -43
  20. angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
  21. angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
  22. angr/exploration_techniques/tracer.py +2 -0
  23. angr/misc/autoimport.py +26 -0
  24. angr/procedures/definitions/__init__.py +32 -3
  25. angr/utils/constants.py +1 -0
  26. angr/utils/graph.py +20 -1
  27. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
  28. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
  29. angr-9.2.89.dist-info/top_level.txt +1 -0
  30. angr/procedures/definitions/ntdll.py +0 -12
  31. angr-9.2.87.dist-info/top_level.txt +0 -2
  32. tests/__init__.py +0 -0
  33. tests/analyses/__init__.py +0 -0
  34. tests/analyses/cfg/__init__.py +0 -0
  35. tests/analyses/cfg/test_cfg_clflush.py +0 -43
  36. tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
  37. tests/analyses/cfg/test_cfg_manager.py +0 -32
  38. tests/analyses/cfg/test_cfg_model.py +0 -55
  39. tests/analyses/cfg/test_cfg_patching.py +0 -378
  40. tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
  41. tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
  42. tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
  43. tests/analyses/cfg/test_cfgemulated.py +0 -634
  44. tests/analyses/cfg/test_cfgfast.py +0 -1123
  45. tests/analyses/cfg/test_cfgfast_soot.py +0 -38
  46. tests/analyses/cfg/test_const_resolver.py +0 -38
  47. tests/analyses/cfg/test_iat_resolver.py +0 -37
  48. tests/analyses/cfg/test_jumptables.py +0 -3008
  49. tests/analyses/cfg/test_noop_blocks.py +0 -54
  50. tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
  51. tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
  52. tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
  53. tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
  54. tests/analyses/decompiler/__init__.py +0 -0
  55. tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
  56. tests/analyses/decompiler/test_decompiler.py +0 -3336
  57. tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
  58. tests/analyses/decompiler/test_propagator_loops.py +0 -101
  59. tests/analyses/decompiler/test_structurer.py +0 -275
  60. tests/analyses/reaching_definitions/__init__.py +0 -0
  61. tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
  62. tests/analyses/reaching_definitions/test_function_handler.py +0 -131
  63. tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
  64. tests/analyses/reaching_definitions/test_rd_state.py +0 -78
  65. tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
  66. tests/analyses/reaching_definitions/test_subject.py +0 -76
  67. tests/analyses/test_bindiff.py +0 -52
  68. tests/analyses/test_block_simplifier.py +0 -112
  69. tests/analyses/test_boyscout.py +0 -104
  70. tests/analyses/test_calling_convention_analysis.py +0 -352
  71. tests/analyses/test_callsite_maker.py +0 -60
  72. tests/analyses/test_cdg.py +0 -165
  73. tests/analyses/test_cfb.py +0 -37
  74. tests/analyses/test_class_identifier.py +0 -46
  75. tests/analyses/test_clinic.py +0 -30
  76. tests/analyses/test_codetagging.py +0 -32
  77. tests/analyses/test_constantpropagation.py +0 -88
  78. tests/analyses/test_ddg.py +0 -95
  79. tests/analyses/test_ddg_global_var_dependencies.py +0 -83
  80. tests/analyses/test_ddg_memvar_addresses.py +0 -40
  81. tests/analyses/test_disassembly.py +0 -121
  82. tests/analyses/test_find_objects_static.py +0 -35
  83. tests/analyses/test_flirt.py +0 -49
  84. tests/analyses/test_identifier.py +0 -33
  85. tests/analyses/test_init_finder.py +0 -38
  86. tests/analyses/test_proximitygraph.py +0 -31
  87. tests/analyses/test_reassembler.py +0 -295
  88. tests/analyses/test_regionidentifier.py +0 -27
  89. tests/analyses/test_slicing.py +0 -164
  90. tests/analyses/test_stack_pointer_tracker.py +0 -74
  91. tests/analyses/test_static_hooker.py +0 -28
  92. tests/analyses/test_typehoon.py +0 -55
  93. tests/analyses/test_variablerecovery.py +0 -464
  94. tests/analyses/test_vfg.py +0 -221
  95. tests/analyses/test_vtable.py +0 -31
  96. tests/analyses/test_xrefs.py +0 -77
  97. tests/common.py +0 -128
  98. tests/engines/__init__.py +0 -0
  99. tests/engines/light/__init__.py +0 -0
  100. tests/engines/light/test_data.py +0 -17
  101. tests/engines/pcode/__init__.py +0 -0
  102. tests/engines/pcode/test_emulate.py +0 -607
  103. tests/engines/pcode/test_pcode.py +0 -84
  104. tests/engines/test_actions.py +0 -27
  105. tests/engines/test_hook.py +0 -112
  106. tests/engines/test_java.py +0 -697
  107. tests/engines/test_unicorn.py +0 -518
  108. tests/engines/vex/__init__.py +0 -0
  109. tests/engines/vex/test_lifter.py +0 -124
  110. tests/engines/vex/test_vex.py +0 -574
  111. tests/exploration_techniques/__init__.py +0 -0
  112. tests/exploration_techniques/test_cacher.py +0 -45
  113. tests/exploration_techniques/test_director.py +0 -67
  114. tests/exploration_techniques/test_driller_core.py +0 -48
  115. tests/exploration_techniques/test_loop_seer.py +0 -158
  116. tests/exploration_techniques/test_memory_watcher.py +0 -46
  117. tests/exploration_techniques/test_oppologist.py +0 -65
  118. tests/exploration_techniques/test_spiller.py +0 -82
  119. tests/exploration_techniques/test_stochastic.py +0 -40
  120. tests/exploration_techniques/test_tech_builder.py +0 -61
  121. tests/exploration_techniques/test_tracer.py +0 -856
  122. tests/exploration_techniques/test_unique.py +0 -40
  123. tests/exploration_techniques/test_veritesting.py +0 -120
  124. tests/factory/__init__.py +0 -0
  125. tests/factory/block/__init__.py +0 -0
  126. tests/factory/block/test_block_cache.py +0 -33
  127. tests/factory/block/test_keystone.py +0 -106
  128. tests/factory/test_argc.py +0 -101
  129. tests/factory/test_argc_sym.py +0 -110
  130. tests/factory/test_argv.py +0 -158
  131. tests/factory/test_callable.py +0 -266
  132. tests/factory/test_windows_args.py +0 -36
  133. tests/knowledge_plugins/__init__.py +0 -0
  134. tests/knowledge_plugins/cfg/__init__.py +0 -0
  135. tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
  136. tests/knowledge_plugins/functions/__init__.py +0 -0
  137. tests/knowledge_plugins/functions/test_function.py +0 -91
  138. tests/knowledge_plugins/functions/test_function2.py +0 -79
  139. tests/knowledge_plugins/functions/test_function_manager.py +0 -139
  140. tests/knowledge_plugins/functions/test_prototypes.py +0 -53
  141. tests/knowledge_plugins/key_definitions/__init__.py +0 -0
  142. tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
  143. tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
  144. tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
  145. tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
  146. tests/knowledge_plugins/test_dwarf_variables.py +0 -240
  147. tests/knowledge_plugins/test_kb_plugins.py +0 -91
  148. tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
  149. tests/knowledge_plugins/test_patches.py +0 -48
  150. tests/misc/__init__.py +0 -0
  151. tests/misc/test_hookset.py +0 -57
  152. tests/perf/__init__.py +0 -0
  153. tests/perf/perf_cfgemulated.py +0 -19
  154. tests/perf/perf_cfgfast.py +0 -18
  155. tests/perf/perf_concrete_execution.py +0 -41
  156. tests/perf/perf_siminspect_nop.py +0 -36
  157. tests/perf/perf_state_copy.py +0 -33
  158. tests/perf/perf_unicorn_0.py +0 -27
  159. tests/perf/perf_unicorn_1.py +0 -23
  160. tests/procedures/__init__.py +0 -0
  161. tests/procedures/glibc/__init__.py +0 -0
  162. tests/procedures/glibc/test_ctype_locale.py +0 -164
  163. tests/procedures/libc/__init__.py +0 -0
  164. tests/procedures/libc/test_fgets.py +0 -53
  165. tests/procedures/libc/test_scanf.py +0 -205
  166. tests/procedures/libc/test_sprintf.py +0 -44
  167. tests/procedures/libc/test_sscanf.py +0 -63
  168. tests/procedures/libc/test_strcasecmp.py +0 -37
  169. tests/procedures/libc/test_string.py +0 -1102
  170. tests/procedures/libc/test_strtol.py +0 -78
  171. tests/procedures/linux_kernel/__init__.py +0 -0
  172. tests/procedures/linux_kernel/test_lseek.py +0 -174
  173. tests/procedures/posix/__init__.py +0 -0
  174. tests/procedures/posix/test_chroot.py +0 -33
  175. tests/procedures/posix/test_getenv.py +0 -78
  176. tests/procedures/posix/test_pwrite_pread.py +0 -57
  177. tests/procedures/posix/test_sim_time.py +0 -46
  178. tests/procedures/posix/test_unlink.py +0 -46
  179. tests/procedures/test_project_resolve_simproc.py +0 -43
  180. tests/procedures/test_sim_procedure.py +0 -117
  181. tests/procedures/test_stub_procedure_args.py +0 -53
  182. tests/serialization/__init__.py +0 -0
  183. tests/serialization/test_db.py +0 -197
  184. tests/serialization/test_pickle.py +0 -95
  185. tests/serialization/test_serialization.py +0 -132
  186. tests/serialization/test_vault.py +0 -169
  187. tests/sim/__init__.py +0 -3
  188. tests/sim/exec_func/__init__.py +0 -0
  189. tests/sim/exec_func/test_mem_funcs.py +0 -55
  190. tests/sim/exec_func/test_str_funcs.py +0 -93
  191. tests/sim/exec_func/test_syscall_result.py +0 -39
  192. tests/sim/exec_insn/__init__.py +0 -0
  193. tests/sim/exec_insn/test_adc.py +0 -44
  194. tests/sim/exec_insn/test_ops.py +0 -83
  195. tests/sim/exec_insn/test_rcr.py +0 -26
  196. tests/sim/exec_insn/test_rol.py +0 -51
  197. tests/sim/exec_insn/test_signed_div.py +0 -34
  198. tests/sim/exec_insn/test_sqrt.py +0 -56
  199. tests/sim/options/__init__.py +0 -0
  200. tests/sim/options/test_0div.py +0 -54
  201. tests/sim/options/test_symbolic_fd.py +0 -59
  202. tests/sim/options/test_unsupported.py +0 -34
  203. tests/sim/test_accuracy.py +0 -137
  204. tests/sim/test_checkbyte.py +0 -53
  205. tests/sim/test_echo.py +0 -36
  206. tests/sim/test_fauxware.py +0 -202
  207. tests/sim/test_self_modifying_code.py +0 -65
  208. tests/sim/test_simple_api.py +0 -36
  209. tests/sim/test_simulation_manager.py +0 -147
  210. tests/sim/test_stack_alignment.py +0 -65
  211. tests/sim/test_state.py +0 -303
  212. tests/sim/test_state_customization.py +0 -54
  213. tests/sim/test_symbol_hooked_by.py +0 -49
  214. tests/simos/__init__.py +0 -0
  215. tests/simos/windows/__init__.py +0 -0
  216. tests/simos/windows/test_windows_stack_cookie.py +0 -58
  217. tests/state_plugins/__init__.py +0 -0
  218. tests/state_plugins/inspect/__init__.py +0 -0
  219. tests/state_plugins/inspect/test_inspect.py +0 -310
  220. tests/state_plugins/inspect/test_syscall_override.py +0 -90
  221. tests/state_plugins/posix/__init__.py +0 -0
  222. tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
  223. tests/state_plugins/posix/test_files.py +0 -69
  224. tests/state_plugins/posix/test_posix.py +0 -72
  225. tests/state_plugins/solver/__init__.py +0 -0
  226. tests/state_plugins/solver/test_simsolver.py +0 -58
  227. tests/state_plugins/solver/test_symbolic.py +0 -153
  228. tests/state_plugins/solver/test_variable_registration.py +0 -46
  229. tests/state_plugins/test_callstack.py +0 -54
  230. tests/state_plugins/test_gdb_plugin.py +0 -35
  231. tests/state_plugins/test_multi_open_file.py +0 -47
  232. tests/state_plugins/test_symbolization.py +0 -38
  233. tests/storage/__init__.py +0 -0
  234. tests/storage/test_memory.py +0 -960
  235. tests/storage/test_memory_merge.py +0 -114
  236. tests/storage/test_memview.py +0 -205
  237. tests/storage/test_mmap.py +0 -26
  238. tests/storage/test_multivalues.py +0 -44
  239. tests/storage/test_permissions.py +0 -32
  240. tests/storage/test_ptmalloc.py +0 -291
  241. tests/storage/test_relro_perm.py +0 -49
  242. tests/test_calling_conventions.py +0 -86
  243. tests/test_types.py +0 -329
  244. tests/utils/__init__.py +0 -0
  245. tests/utils/test_graph.py +0 -41
  246. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
  247. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
  248. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
@@ -6,6 +6,7 @@ import ailment
6
6
  import claripy
7
7
  from unique_log_filter import UniqueLogFilter
8
8
 
9
+ from angr.utils.constants import MAX_POINTSTO_BITS
9
10
  from ...calling_conventions import SimRegArg
10
11
  from ...sim_type import SimTypeFunction
11
12
  from ...engines.light import SimEngineLightAILMixin
@@ -120,6 +121,13 @@ class SimEngineVRAIL(
120
121
  if stmt.ret_expr is not None:
121
122
  ret_expr_bits = stmt.ret_expr.bits
122
123
 
124
+ if isinstance(target, ailment.Expr.Expression) and not isinstance(target, ailment.Expr.Const):
125
+ # this is a dynamically calculated call target
126
+ target_expr = self._expr(target)
127
+ funcaddr_typevar = target_expr.typevar
128
+ load_typevar = self._create_access_typevar(target_expr.typevar, False, self.arch.bytes, 0)
129
+ self.state.add_type_constraint(typevars.Subtype(funcaddr_typevar, load_typevar))
130
+
123
131
  # discover the prototype
124
132
  prototype: Optional[SimTypeFunction] = None
125
133
  if stmt.prototype is not None:
@@ -249,7 +257,9 @@ class SimEngineVRAIL(
249
257
  r = self._expr(expr.operand)
250
258
  typevar = None
251
259
  if r.typevar is not None:
252
- if isinstance(r.typevar, typevars.DerivedTypeVariable) and isinstance(r.typevar.label, typevars.ConvertTo):
260
+ if isinstance(r.typevar, typevars.DerivedTypeVariable) and isinstance(
261
+ r.typevar.one_label, typevars.ConvertTo
262
+ ):
253
263
  # there is already a conversion - overwrite it
254
264
  if not isinstance(r.typevar.type_var, typeconsts.TypeConstant):
255
265
  typevar = typevars.DerivedTypeVariable(r.typevar.type_var, typevars.ConvertTo(expr.to_bits))
@@ -264,7 +274,7 @@ class SimEngineVRAIL(
264
274
  typevar = None
265
275
  if r.typevar is not None:
266
276
  if isinstance(r.typevar, typevars.DerivedTypeVariable) and isinstance(
267
- r.typevar.label, typevars.ReinterpretAs
277
+ r.typevar.one_label, typevars.ReinterpretAs
268
278
  ):
269
279
  # there is already a reinterpretas - overwrite it
270
280
  typevar = typevars.DerivedTypeVariable(
@@ -276,18 +286,27 @@ class SimEngineVRAIL(
276
286
  return RichR(self.state.top(expr.to_bits), typevar=typevar)
277
287
 
278
288
  def _ail_handle_StackBaseOffset(self, expr: ailment.Expr.StackBaseOffset):
279
- typevar = self.state.stack_offset_typevars.get(expr.offset, None)
289
+ ref_typevar = self.state.stack_offset_typevars.get(expr.offset, None)
280
290
 
281
- if typevar is None:
291
+ if ref_typevar is None:
282
292
  # allocate a new type variable
283
- typevar = typevars.TypeVariable()
284
- self.state.stack_offset_typevars[expr.offset] = typevar
293
+ ref_typevar = typevars.TypeVariable()
294
+ self.state.stack_offset_typevars[expr.offset] = ref_typevar
285
295
 
286
296
  value_v = self.state.stack_address(expr.offset)
287
- richr = RichR(value_v, typevar=typevar)
288
- self._ensure_variable_existence(richr, self._codeloc(), src_expr=expr)
297
+ richr = RichR(value_v, typevar=ref_typevar)
298
+ codeloc = self._codeloc()
299
+ var_and_offsets = self._ensure_variable_existence(richr, codeloc, src_expr=expr)
289
300
  if self._reference_spoffset:
290
- self._reference(richr, self._codeloc(), src=expr)
301
+ self._reference(richr, codeloc, src=expr)
302
+ for var, off_in_var in var_and_offsets:
303
+ if self.state.typevars.has_type_variable_for(var, codeloc):
304
+ var_typevar = self.state.typevars.get_type_variable(var, codeloc)
305
+ load_typevar = self._create_access_typevar(
306
+ ref_typevar, False, MAX_POINTSTO_BITS // 8, 0 if off_in_var is None else off_in_var
307
+ )
308
+ type_constraint = typevars.Subtype(var_typevar, load_typevar)
309
+ self.state.add_type_constraint(type_constraint)
291
310
 
292
311
  return richr
293
312
 
@@ -1,4 +1,4 @@
1
- from typing import Optional, Set, List, Tuple, TYPE_CHECKING
1
+ from typing import Optional, Set, List, Tuple, Union, TYPE_CHECKING
2
2
  import logging
3
3
 
4
4
  import claripy
@@ -9,6 +9,7 @@ from ...errors import SimEngineError, SimMemoryMissingError
9
9
  from ...sim_variable import SimVariable, SimStackVariable, SimRegisterVariable, SimMemoryVariable
10
10
  from ...code_location import CodeLocation
11
11
  from ..typehoon import typevars, typeconsts
12
+ from ..typehoon.typevars import TypeVariable, DerivedTypeVariable, AddN, SubN, Load, Store
12
13
 
13
14
  if TYPE_CHECKING:
14
15
  from .variable_recovery_base import VariableRecoveryStateBase
@@ -139,11 +140,13 @@ class SimEngineVRBase(SimEngineLight):
139
140
  # Logic
140
141
  #
141
142
 
142
- def _ensure_variable_existence(self, richr_addr: RichR, codeloc: CodeLocation, src_expr=None):
143
+ def _ensure_variable_existence(
144
+ self, richr_addr: RichR, codeloc: CodeLocation, src_expr=None
145
+ ) -> Optional[List[Tuple[SimVariable, int]]]:
143
146
  data: claripy.ast.Base = richr_addr.data
144
147
 
145
148
  if data is None:
146
- return
149
+ return None
147
150
 
148
151
  if self.state.is_stack_address(data):
149
152
  # this is a stack address
@@ -226,7 +229,7 @@ class SimEngineVRBase(SimEngineLight):
226
229
  existing_vars = [(variable, 0)]
227
230
 
228
231
  else:
229
- return
232
+ return None
230
233
 
231
234
  # record all variables
232
235
  for var, offset in existing_vars:
@@ -234,6 +237,8 @@ class SimEngineVRBase(SimEngineLight):
234
237
  offset = None
235
238
  variable_manager.record_variable(codeloc, var, offset, atom=src_expr)
236
239
 
240
+ return existing_vars
241
+
237
242
  def _reference(self, richr: RichR, codeloc: CodeLocation, src=None):
238
243
  data: claripy.ast.Base = richr.data
239
244
 
@@ -534,17 +539,11 @@ class SimEngineVRBase(SimEngineLight):
534
539
  # it's an array!
535
540
  if offset.concrete and elem_size.concrete:
536
541
  concrete_offset = offset.concrete_value * elem_size.concrete_value
537
- store_typevar = typevars.DerivedTypeVariable(
538
- typevars.DerivedTypeVariable(typevar, typevars.Store()),
539
- typevars.HasField(size * self.state.arch.byte_width, concrete_offset),
540
- )
541
- self.state.add_type_constraint(typevars.Existence(store_typevar))
542
+ store_typevar = self._create_access_typevar(typevar, True, size, concrete_offset)
543
+ self.state.add_type_constraint(typevars.Subtype(store_typevar, typeconsts.TopType()))
542
544
  else:
543
- store_typevar = typevars.DerivedTypeVariable(
544
- typevars.DerivedTypeVariable(typevar, typevars.Store()),
545
- typevars.HasField(size * self.state.arch.byte_width, 0),
546
- )
547
- self.state.add_type_constraint(typevars.Existence(store_typevar))
545
+ store_typevar = self._create_access_typevar(typevar, True, size, 0)
546
+ self.state.add_type_constraint(typevars.Subtype(store_typevar, typeconsts.TopType()))
548
547
  # FIXME: This is a hack so that we can interpret the target as an array
549
548
  is_array = typevars.DerivedTypeVariable(typevar, typevars.IsArray())
550
549
  self.state.add_type_constraint(typevars.Existence(is_array))
@@ -556,11 +555,8 @@ class SimEngineVRBase(SimEngineLight):
556
555
  # it's just a variable
557
556
  # however, since it's a global address, we still treat it as writing to a location
558
557
  if data.typevar is not None:
559
- store_typevar = typevars.DerivedTypeVariable(
560
- typevars.DerivedTypeVariable(typevar, typevars.Store()),
561
- typevars.HasField(size * self.state.arch.byte_width, 0),
562
- )
563
- self.state.add_type_constraint(typevars.Existence(store_typevar))
558
+ store_typevar = self._create_access_typevar(typevar, True, size, 0)
559
+ self.state.add_type_constraint(typevars.Subtype(store_typevar, typeconsts.TopType()))
564
560
  self.state.add_type_constraint(typevars.Subtype(data.typevar, store_typevar))
565
561
 
566
562
  def _store_to_variable(self, richr_addr: RichR, size: int, stmt=None): # pylint:disable=unused-argument
@@ -578,9 +574,9 @@ class SimEngineVRBase(SimEngineLight):
578
574
  typevar = richr_addr.typevar
579
575
 
580
576
  if typevar is not None:
581
- if isinstance(typevar, typevars.DerivedTypeVariable) and isinstance(typevar.label, typevars.AddN):
577
+ if isinstance(typevar, typevars.DerivedTypeVariable) and isinstance(typevar.one_label, typevars.AddN):
582
578
  base_typevar = typevar.type_var
583
- field_offset = typevar.label.n
579
+ field_offset = typevar.one_label.n
584
580
  else:
585
581
  base_typevar = typevar
586
582
  field_offset = 0
@@ -588,13 +584,10 @@ class SimEngineVRBase(SimEngineLight):
588
584
  # if addr_variable is not None:
589
585
  # self.variable_manager[self.func_addr].reference_at(addr_variable, field_offset, codeloc, atom=stmt)
590
586
 
591
- store_typevar = typevars.DerivedTypeVariable(
592
- typevars.DerivedTypeVariable(base_typevar, typevars.Store()),
593
- typevars.HasField(size * self.state.arch.byte_width, field_offset),
594
- )
587
+ store_typevar = self._create_access_typevar(base_typevar, True, size, field_offset)
595
588
  if addr_variable is not None:
596
589
  self.state.typevars.add_type_variable(addr_variable, codeloc, typevar)
597
- self.state.add_type_constraint(typevars.Existence(store_typevar))
590
+ self.state.add_type_constraint(typevars.Subtype(store_typevar, typeconsts.TopType()))
598
591
 
599
592
  def _load(self, richr_addr: RichR, size: int, expr=None):
600
593
  """
@@ -758,20 +751,17 @@ class SimEngineVRBase(SimEngineLight):
758
751
  # parse the loading offset
759
752
  offset = 0
760
753
  if isinstance(richr_addr.typevar, typevars.DerivedTypeVariable) and isinstance(
761
- richr_addr.typevar.label, typevars.AddN
754
+ richr_addr.typevar.one_label, typevars.AddN
762
755
  ):
763
- offset = richr_addr.typevar.label.n
756
+ offset = richr_addr.typevar.one_label.n
764
757
  richr_addr_typevar = richr_addr.typevar.type_var # unpack
765
758
  else:
766
759
  richr_addr_typevar = richr_addr.typevar
767
760
 
768
761
  if richr_addr_typevar is not None:
769
762
  # create a type constraint
770
- typevar = typevars.DerivedTypeVariable(
771
- typevars.DerivedTypeVariable(richr_addr_typevar, typevars.Load()),
772
- typevars.HasField(size * self.state.arch.byte_width, offset),
773
- )
774
- self.state.add_type_constraint(typevars.Existence(typevar))
763
+ typevar = self._create_access_typevar(richr_addr_typevar, False, size, offset)
764
+ self.state.add_type_constraint(typevars.Subtype(typevar, typeconsts.TopType()))
775
765
 
776
766
  return RichR(self.state.top(size * self.state.arch.byte_width), typevar=typevar)
777
767
 
@@ -832,20 +822,14 @@ class SimEngineVRBase(SimEngineLight):
832
822
  # it's an array!
833
823
  if offset.concrete and elem_size.concrete:
834
824
  concrete_offset = offset.concrete_value * elem_size.concrete_value
835
- load_typevar = typevars.DerivedTypeVariable(
836
- typevars.DerivedTypeVariable(typevar, typevars.Store()),
837
- typevars.HasField(size * self.state.arch.byte_width, concrete_offset),
838
- )
839
- self.state.add_type_constraint(typevars.Existence(load_typevar))
825
+ load_typevar = self._create_access_typevar(typevar, True, size, concrete_offset)
826
+ self.state.add_type_constraint(typevars.Subtype(load_typevar, typeconsts.TopType()))
840
827
  else:
841
828
  # FIXME: This is a hack
842
829
  for i in range(0, 4):
843
830
  concrete_offset = size * i
844
- load_typevar = typevars.DerivedTypeVariable(
845
- typevars.DerivedTypeVariable(typevar, typevars.Store()),
846
- typevars.HasField(size * self.state.arch.byte_width, concrete_offset),
847
- )
848
- self.state.add_type_constraint(typevars.Existence(load_typevar))
831
+ load_typevar = self._create_access_typevar(typevar, True, size, concrete_offset)
832
+ self.state.add_type_constraint(typevars.Subtype(load_typevar, typeconsts.TopType()))
849
833
 
850
834
  return RichR(self.state.top(size * self.state.arch.byte_width), typevar=typevar)
851
835
 
@@ -931,3 +915,26 @@ class SimEngineVRBase(SimEngineLight):
931
915
  # ignore the variable and the associated type if we are only reading part of the variable
932
916
  return RichR(r_value, variable=var)
933
917
  return RichR(r_value, variable=var, typevar=typevar)
918
+
919
+ def _create_access_typevar(
920
+ self, typevar: Union[TypeVariable, DerivedTypeVariable], is_store: bool, size: int, offset: int
921
+ ) -> DerivedTypeVariable:
922
+ if isinstance(typevar, DerivedTypeVariable):
923
+ if isinstance(typevar.labels[-1], AddN):
924
+ offset += typevar.labels[-1].n
925
+ if len(typevar.labels) == 1:
926
+ typevar = typevar.type_var
927
+ else:
928
+ typevar = DerivedTypeVariable(typevar.type_var, None, labels=typevar.labels[:-1])
929
+ elif isinstance(typevar.labels[-1], SubN):
930
+ offset -= typevar.labels[-1].n
931
+ if len(typevar.labels) == 1:
932
+ typevar = typevar.type_var
933
+ else:
934
+ typevar = DerivedTypeVariable(typevar.type_var, None, labels=typevar.labels[:-1])
935
+ lbl = Store() if is_store else Load()
936
+ return DerivedTypeVariable(
937
+ typevar,
938
+ None,
939
+ labels=(lbl, typevars.HasField(size * self.state.arch.byte_width, offset)),
940
+ )
@@ -157,6 +157,7 @@ class VariableRecoveryStateBase:
157
157
  global_region=None,
158
158
  typevars=None,
159
159
  type_constraints=None,
160
+ func_typevar=None,
160
161
  delayed_type_constraints=None,
161
162
  stack_offset_typevars=None,
162
163
  project=None,
@@ -211,7 +212,8 @@ class VariableRecoveryStateBase:
211
212
  self.phi_variables: Dict[SimVariable, SimVariable] = {}
212
213
 
213
214
  self.typevars = TypeVariables() if typevars is None else typevars
214
- self.type_constraints = set() if type_constraints is None else type_constraints
215
+ self.type_constraints = defaultdict(set) if type_constraints is None else type_constraints
216
+ self.func_typevar = func_typevar
215
217
  self.delayed_type_constraints = (
216
218
  DefaultChainMapCOW(set, collapse_threshold=25)
217
219
  if delayed_type_constraints is None
@@ -362,7 +364,18 @@ class VariableRecoveryStateBase:
362
364
  :return:
363
365
  """
364
366
 
365
- self.type_constraints.add(constraint)
367
+ self.type_constraints[self.func_typevar].add(constraint)
368
+
369
+ def add_type_constraint_for_function(self, func_typevar, constraint):
370
+ """
371
+ Add a new type constraint for a specified function.
372
+
373
+ :param func_typevar:
374
+ :param constraint:
375
+ :return:
376
+ """
377
+
378
+ self.type_constraints[func_typevar].add(constraint)
366
379
 
367
380
  def downsize(self) -> None:
368
381
  """
@@ -370,7 +383,7 @@ class VariableRecoveryStateBase:
370
383
 
371
384
  :return: None
372
385
  """
373
- self.type_constraints = set()
386
+ self.type_constraints = defaultdict(set)
374
387
 
375
388
  @staticmethod
376
389
  def downsize_region(region: MultiValuedMemory) -> MultiValuedMemory:
@@ -1,5 +1,5 @@
1
1
  # pylint:disable=wrong-import-position,wrong-import-order
2
- from typing import Optional, List, Tuple, Union, DefaultDict, Set
2
+ from typing import Optional, List, Tuple, Union, DefaultDict, Set, Dict, TYPE_CHECKING
3
3
  import logging
4
4
  from collections import defaultdict
5
5
 
@@ -22,6 +22,9 @@ from .variable_recovery_base import VariableRecoveryBase, VariableRecoveryStateB
22
22
  from .engine_vex import SimEngineVRVEX
23
23
  from .engine_ail import SimEngineVRAIL
24
24
 
25
+ if TYPE_CHECKING:
26
+ from angr.analyses.typehoon.typevars import TypeConstraint
27
+
25
28
  l = logging.getLogger(name=__name__)
26
29
 
27
30
 
@@ -44,6 +47,7 @@ class VariableRecoveryFastState(VariableRecoveryStateBase):
44
47
  global_region=None,
45
48
  typevars=None,
46
49
  type_constraints=None,
50
+ func_typevar=None,
47
51
  delayed_type_constraints=None,
48
52
  stack_offset_typevars=None,
49
53
  project=None,
@@ -59,6 +63,7 @@ class VariableRecoveryFastState(VariableRecoveryStateBase):
59
63
  global_region=global_region,
60
64
  typevars=typevars,
61
65
  type_constraints=type_constraints,
66
+ func_typevar=func_typevar,
62
67
  delayed_type_constraints=delayed_type_constraints,
63
68
  stack_offset_typevars=stack_offset_typevars,
64
69
  project=project,
@@ -88,6 +93,7 @@ class VariableRecoveryFastState(VariableRecoveryStateBase):
88
93
  global_region=self.global_region.copy(),
89
94
  typevars=self.typevars,
90
95
  type_constraints=self.type_constraints,
96
+ func_typevar=self.func_typevar,
91
97
  delayed_type_constraints=self.delayed_type_constraints,
92
98
  stack_offset_typevars=dict(self.stack_offset_typevars),
93
99
  project=self.project,
@@ -162,7 +168,7 @@ class VariableRecoveryFastState(VariableRecoveryStateBase):
162
168
  else:
163
169
  typevar = TypeVariable()
164
170
  for orig_typevar in all_typevars:
165
- type_constraints.add(Equivalence(orig_typevar, typevar))
171
+ type_constraints[self.func_typevar].add(Equivalence(orig_typevar, typevar))
166
172
  stack_offset_typevars[offset] = typevar
167
173
 
168
174
  ret_val_size = self.ret_val_size
@@ -186,6 +192,7 @@ class VariableRecoveryFastState(VariableRecoveryStateBase):
186
192
  global_region=merged_global_region,
187
193
  typevars=typevars,
188
194
  type_constraints=type_constraints,
195
+ func_typevar=self.func_typevar,
189
196
  delayed_type_constraints=delayed_typeconstraints,
190
197
  stack_offset_typevars=stack_offset_typevars,
191
198
  project=self.project,
@@ -271,7 +278,8 @@ class VariableRecoveryFast(ForwardAnalysis, VariableRecoveryBase): # pylint:dis
271
278
  self._node_to_cc = {}
272
279
  self.var_to_typevars: DefaultDict[SimVariable, Set[TypeVariable]] = defaultdict(set)
273
280
  self.typevars = None
274
- self.type_constraints = None
281
+ self.type_constraints: Optional[Dict["TypeVariable", Set["TypeConstraint"]]] = None
282
+ self.func_typevar = TypeVariable(name=func.name)
275
283
  self.delayed_type_constraints = None
276
284
  self.ret_val_size = None
277
285
 
@@ -288,7 +296,7 @@ class VariableRecoveryFast(ForwardAnalysis, VariableRecoveryBase): # pylint:dis
288
296
 
289
297
  def _pre_analysis(self):
290
298
  self.typevars = TypeVariables()
291
- self.type_constraints = set()
299
+ self.type_constraints = defaultdict(set)
292
300
  self.delayed_type_constraints = defaultdict(set)
293
301
 
294
302
  self.initialize_dominance_frontiers()
@@ -319,6 +327,7 @@ class VariableRecoveryFast(ForwardAnalysis, VariableRecoveryBase): # pylint:dis
319
327
  project=self.project,
320
328
  typevars=self.typevars,
321
329
  type_constraints=self.type_constraints,
330
+ func_typevar=self.func_typevar,
322
331
  delayed_type_constraints=self.delayed_type_constraints,
323
332
  )
324
333
  initial_sp = state.stack_address(self.project.arch.bytes if self.project.arch.call_pushes_ret else 0)
@@ -472,7 +481,7 @@ class VariableRecoveryFast(ForwardAnalysis, VariableRecoveryBase): # pylint:dis
472
481
  if len(typevars) > 1 and isinstance(var, SimMemoryVariable) and not isinstance(var, SimStackVariable):
473
482
  sorted_typevars = list(sorted(typevars, key=lambda x: str(x))) # pylint:disable=unnecessary-lambda
474
483
  for tv in sorted_typevars[1:]:
475
- self.type_constraints.add(Equivalence(sorted_typevars[0], tv))
484
+ self.type_constraints[self.func_typevar].add(Equivalence(sorted_typevars[0], tv))
476
485
 
477
486
  self.variable_manager[self.function.addr].ret_val_size = self.ret_val_size
478
487
 
@@ -1041,6 +1041,8 @@ class Tracer(ExplorationTechnique):
1041
1041
 
1042
1042
  # now remove our breakpoints since other people might not want them
1043
1043
  for s in [last_state, crash_state]:
1044
+ if s is None:
1045
+ continue
1044
1046
  s.inspect.remove_breakpoint("address_concretization", bp1)
1045
1047
  s.inspect.remove_breakpoint("address_concretization", bp2)
1046
1048
 
angr/misc/autoimport.py CHANGED
@@ -1,5 +1,7 @@
1
1
  import os
2
2
  import importlib
3
+ import importlib.machinery
4
+ import importlib.util
3
5
  import logging
4
6
  from typing import Optional, Callable
5
7
 
@@ -61,3 +63,27 @@ def filter_module(mod, type_req=None, subclass_req=None):
61
63
  if subclass_req is not None and not issubclass(val, subclass_req):
62
64
  continue
63
65
  yield name, val
66
+
67
+
68
+ def auto_import_source_files(base_path, ignore_files=(), filter_func: Optional[Callable] = None):
69
+ for proc_file_name in os.listdir(base_path):
70
+ if not proc_file_name.endswith(".py"):
71
+ continue
72
+ if proc_file_name in ignore_files or proc_file_name == "__init__.py":
73
+ continue
74
+
75
+ proc_module_name = proc_file_name[:-3]
76
+ if filter_func is not None and not filter_func(proc_file_name):
77
+ continue
78
+
79
+ proc_path = os.path.join(base_path, proc_file_name)
80
+ try:
81
+ loader = importlib.machinery.SourceFileLoader(proc_module_name, proc_path)
82
+ spec = importlib.util.spec_from_loader(proc_module_name, loader)
83
+ proc_module = importlib.util.module_from_spec(spec)
84
+ loader.exec_module(proc_module)
85
+ except ImportError:
86
+ l.warning("Unable to autoimport module from file %s", proc_path, exc_info=True)
87
+ continue
88
+ else:
89
+ yield proc_module_name, proc_module
@@ -1,13 +1,15 @@
1
+ # pylint:disable=arguments-renamed,global-statement
1
2
  import copy
2
3
  import os
3
- import archinfo
4
- from collections import defaultdict
5
4
  import logging
6
5
  import inspect
7
- from typing import Optional, Dict, Type, TYPE_CHECKING
6
+ from collections import defaultdict
7
+ from typing import Optional, Dict, Type, List, TYPE_CHECKING
8
8
 
9
9
  import itanium_demangler
10
10
 
11
+ import archinfo
12
+
11
13
  from ...sim_type import parse_cpp_file, SimTypeFunction
12
14
  from ...calling_conventions import DEFAULT_CC
13
15
  from ...misc import autoimport
@@ -625,6 +627,33 @@ class SimSyscallLibrary(SimLibrary):
625
627
  # - We will load all APIs when load_all_definitions() is called.
626
628
 
627
629
  _DEFINITIONS_BASEDIR = os.path.dirname(os.path.realpath(__file__))
630
+ _EXTERNAL_DEFINITIONS_DIRS: Optional[List[str]] = None
631
+
632
+
633
+ def load_external_definitions():
634
+ """
635
+ Load library definitions from specific directories. By default it parses ANGR_EXTERNAL_DEFINITIONS_DIRS as a
636
+ semi-colon separated list of directory paths. Then it loads all .py files in each directory. These .py files should
637
+ declare SimLibrary() objects and call .set_library_names() to register themselves in angr.SIM_LIBRARIES.
638
+ """
639
+
640
+ global _EXTERNAL_DEFINITIONS_DIRS
641
+
642
+ if _EXTERNAL_DEFINITIONS_DIRS is None and "ANGR_EXTERNAL_DEFINITIONS_DIRS" in os.environ:
643
+ _EXTERNAL_DEFINITIONS_DIRS = os.environ["ANGR_EXTERNAL_DEFINITIONS_DIRS"].strip('"').split(";")
644
+ l.debug("Using external library definitions from %s", _EXTERNAL_DEFINITIONS_DIRS)
645
+ for d in _EXTERNAL_DEFINITIONS_DIRS:
646
+ if not os.path.isdir(d):
647
+ l.warning("External library definitions directory %s does not exist or is not a directory.", d)
648
+
649
+ if _EXTERNAL_DEFINITIONS_DIRS:
650
+ # we must load all definitions prior to any external definitions are loaded. otherwise external definitions may
651
+ # be overwritten by embedded definitions in angr, which is undesirable
652
+ load_all_definitions()
653
+
654
+ for d in _EXTERNAL_DEFINITIONS_DIRS:
655
+ for _ in autoimport.auto_import_source_files(d):
656
+ pass
628
657
 
629
658
 
630
659
  def load_win32api_definitions():
angr/utils/constants.py CHANGED
@@ -1,5 +1,6 @@
1
1
  DEFAULT_STATEMENT = -2
2
2
  SWITCH_MISSING_DEFAULT_NODE_ADDR = 0xFFFF_FFFE
3
+ MAX_POINTSTO_BITS = -1330 * 8
3
4
 
4
5
 
5
6
  def is_alignment_mask(n):
angr/utils/graph.py CHANGED
@@ -683,8 +683,27 @@ class GraphUtils:
683
683
  # find all strongly connected components in the graph
684
684
  sccs = [scc for scc in networkx.strongly_connected_components(graph) if len(scc) > 1]
685
685
 
686
+ def _sort_edge(edge):
687
+ """
688
+ A sorter to make a deterministic order of edges.
689
+ """
690
+ _src, _dst = edge
691
+ src_addr, dst_addr = 0, 0
692
+ if hasattr(_src, "addr"):
693
+ src_addr = _src.addr
694
+ elif isinstance(_src, int):
695
+ src_addr = _src
696
+
697
+ if hasattr(_dst, "addr"):
698
+ dst_addr = _dst.addr
699
+ elif isinstance(_dst, int):
700
+ dst_addr = _dst
701
+
702
+ return src_addr + dst_addr
703
+
686
704
  # collapse all strongly connected components
687
- for src, dst in graph.edges():
705
+ edges = sorted(list(graph.edges()), key=_sort_edge)
706
+ for src, dst in edges:
688
707
  scc_index = GraphUtils._components_index_node(sccs, src)
689
708
  if scc_index is not None:
690
709
  src = SCCPlaceholder(scc_index)
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.1
2
2
  Name: angr
3
- Version: 9.2.87
3
+ Version: 9.2.89
4
4
  Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
5
5
  Home-page: https://github.com/angr/angr
6
6
  License: BSD-2-Clause
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
17
17
  License-File: LICENSE
18
18
  Requires-Dist: CppHeaderParser
19
19
  Requires-Dist: GitPython
20
- Requires-Dist: ailment ==9.2.87
21
- Requires-Dist: archinfo ==9.2.87
20
+ Requires-Dist: ailment ==9.2.89
21
+ Requires-Dist: archinfo ==9.2.89
22
22
  Requires-Dist: cachetools
23
23
  Requires-Dist: capstone ==5.0.0.post1
24
24
  Requires-Dist: cffi >=1.14.0
25
- Requires-Dist: claripy ==9.2.87
26
- Requires-Dist: cle ==9.2.87
25
+ Requires-Dist: claripy ==9.2.89
26
+ Requires-Dist: cle ==9.2.89
27
27
  Requires-Dist: dpkt
28
28
  Requires-Dist: itanium-demangler
29
29
  Requires-Dist: mulpyplexer
@@ -32,7 +32,8 @@ Requires-Dist: networkx !=2.8.1,>=2.0
32
32
  Requires-Dist: protobuf >=3.19.0
33
33
  Requires-Dist: psutil
34
34
  Requires-Dist: pycparser >=2.18
35
- Requires-Dist: pyvex ==9.2.87
35
+ Requires-Dist: pyformlang
36
+ Requires-Dist: pyvex ==9.2.89
36
37
  Requires-Dist: rich >=13.1.0
37
38
  Requires-Dist: rpyc
38
39
  Requires-Dist: sortedcontainers