angr 9.2.88__tar.gz → 9.2.89__tar.gz

{angr-9.2.88/angr.egg-info → angr-9.2.89}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: angr
-Version: 9.2.88
+Version: 9.2.89
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 Home-page: https://github.com/angr/angr
 License: BSD-2-Clause
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: CppHeaderParser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.88
-Requires-Dist: archinfo==9.2.88
+Requires-Dist: ailment==9.2.89
+Requires-Dist: archinfo==9.2.89
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.0.post1
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.88
-Requires-Dist: cle==9.2.88
+Requires-Dist: claripy==9.2.89
+Requires-Dist: cle==9.2.89
 Requires-Dist: dpkt
 Requires-Dist: itanium-demangler
 Requires-Dist: mulpyplexer
@@ -33,7 +33,7 @@ Requires-Dist: protobuf>=3.19.0
 Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.88
+Requires-Dist: pyvex==9.2.89
 Requires-Dist: rich>=13.1.0
 Requires-Dist: rpyc
 Requires-Dist: sortedcontainers

{angr-9.2.88 → angr-9.2.89}/angr/__init__.py

@@ -1,7 +1,7 @@
 # pylint: disable=wildcard-import
 # pylint: disable=wrong-import-position
 
-__version__ = "9.2.88"
+__version__ = "9.2.89"
 
 if bytes is str:
     raise Exception(

{angr-9.2.88 → angr-9.2.89}/angr/analyses/decompiler/decompiler.py

@@ -349,6 +349,9 @@ class Decompiler(Analysis):
             # only for post region id opts
             if pass_.STAGE != OptimizationPassStage.DURING_REGION_IDENTIFICATION:
                 continue
+            if pass_.STRUCTURING:
+                if self._recursive_structurer_params["structurer_cls"].NAME not in pass_.STRUCTURING:
+                    continue
 
             a = pass_(
                 self.func,

{angr-9.2.88 → angr-9.2.89}/angr/analyses/decompiler/optimization_passes/__init__.py

@@ -45,6 +45,9 @@ _all_optimization_passes = [
     (FlipBooleanCmp, True),
 ]
 
+# these passes may duplicate code to remove gotos or improve the structure of the graph
+DUPLICATING_OPTS = [ReturnDuplicator, CrossJumpReverter]
+
 
 def get_optimization_passes(arch, platform):
     if isinstance(arch, Arch):

{angr-9.2.88 → angr-9.2.89}/angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py

@@ -1,3 +1,4 @@
+from collections import defaultdict
 from itertools import count
 import copy
 import logging
@@ -24,6 +25,7 @@ class CrossJumpReverter(StructuringOptimizationPass):
     PLATFORMS = None
     STAGE = OptimizationPassStage.DURING_REGION_IDENTIFICATION
     NAME = "Duplicate linear blocks with gotos"
+    STRUCTURING = ["phoenix"]
     DESCRIPTION = inspect.cleandoc(__doc__).strip()
 
     def __init__(
@@ -36,7 +38,7 @@ class CrossJumpReverter(StructuringOptimizationPass):
         max_call_duplications: int = 2,
         **kwargs,
     ):
-        super().__init__(func, max_opt_iters=max_opt_iters, **kwargs)
+        super().__init__(func, max_opt_iters=max_opt_iters, strictly_less_gotos=True, **kwargs)
 
         self.node_idx = count(start=node_idx_start)
         self._max_call_dup = max_call_duplications
@@ -46,14 +48,15 @@ class CrossJumpReverter(StructuringOptimizationPass):
         return True, None
 
     def _analyze(self, cache=None):
-        to_update = {}
+        to_update = defaultdict(list)
         for node in self.out_graph.nodes:
             gotos = self._goto_manager.gotos_in_block(node)
             # TODO: support if-stmts
             if not gotos or len(gotos) >= 2:
                 continue
 
-            # only single reaching gotos
+            # only blocks that have a single outgoing goto are candidates
+            # for duplicates
             goto = list(gotos)[0]
             for goto_target in self.out_graph.successors(node):
                 if goto_target.addr == goto.dst_addr:
@@ -61,46 +64,45 @@ class CrossJumpReverter(StructuringOptimizationPass):
             else:
                 goto_target = None
 
-            if goto_target is None:
-                continue
-
-            if self.out_graph.out_degree(goto_target) != 1:
+            # the target goto block should only have a single outgoing edge
+            # this prevents duplication of conditions
+            if goto_target is None or self.out_graph.out_degree(goto_target) != 1:
                 continue
 
+            # minimize the number of calls in the target block that can be duplicated
+            # to prevent duplication of big blocks
             counter = AILBlockCallCounter()
             counter.walk(goto_target)
             if counter.calls > self._max_call_dup:
                 continue
 
-            # og_block -> suc_block (goto target)
-            to_update[node] = goto_target
+            # [goto_target] = (pred1, pred2, ...)
+            to_update[goto_target].append(node)
 
         if not to_update:
             return False
 
         updates = False
-        for target_node, goto_node in to_update.items():
-            if (target_node, goto_node) not in self.out_graph.edges:
+        sorted_targets = sorted(to_update.items(), key=lambda x: x[0].addr)
+        for goto_target, pred_to_update in sorted_targets:
+            pred_to_update = sorted(pred_to_update, key=lambda x: x.addr)
+            # do some sanity checks
+            update_edges = [(pred, goto_target) for pred in pred_to_update]
+            if not all(self.out_graph.has_edge(*edge) for edge in update_edges):
                 continue
 
-            # always make a copy if there is a goto edge
-            cp = copy.deepcopy(goto_node)
-            cp.idx = next(self.node_idx)
-
-            # remove this goto edge from original
-            self.out_graph.remove_edge(target_node, goto_node)
-
-            # add a new edge to the copy
-            self.out_graph.add_edge(target_node, cp)
-
-            # make sure the copy has the same successor as before!
-            suc = list(self.out_graph.successors(goto_node))[0]
-            self.out_graph.add_edge(cp, suc)
+            current_preds = list(self.out_graph.predecessors(goto_target))
+            delete_original = len(current_preds) == len(pred_to_update)
 
-            # kill the original if we made enough copies to drain in-degree
-            if self.out_graph.in_degree(goto_node) == 0:
-                self.out_graph.remove_node(goto_node)
+            # update the edges
+            for src, goto_blk in update_edges:
+                cp = copy.deepcopy(goto_blk)
+                cp.idx = next(self.node_idx)
+                self.out_graph.remove_edge(src, goto_blk)
+                self.out_graph.add_edge(src, cp)
 
             updates = True
+            if delete_original:
+                self.out_graph.remove_node(goto_target)
 
         return updates

{angr-9.2.88 → angr-9.2.89}/angr/analyses/decompiler/optimization_passes/optimization_pass.py

@@ -249,10 +249,18 @@ class StructuringOptimizationPass(OptimizationPass):
     STAGE = OptimizationPassStage.DURING_REGION_IDENTIFICATION
 
     def __init__(
-        self, func, prevent_new_gotos=True, recover_structure_fails=True, max_opt_iters=1, simplify_ail=True, **kwargs
+        self,
+        func,
+        prevent_new_gotos=True,
+        strictly_less_gotos=False,
+        recover_structure_fails=True,
+        max_opt_iters=1,
+        simplify_ail=True,
+        **kwargs,
     ):
         super().__init__(func, **kwargs)
         self._prevent_new_gotos = prevent_new_gotos
+        self._strictly_less_gotos = strictly_less_gotos
         self._recover_structure_fails = recover_structure_fails
         self._max_opt_iters = max_opt_iters
         self._simplify_ail = simplify_ail
@@ -298,9 +306,14 @@ class StructuringOptimizationPass(OptimizationPass):
             # this should not (TM) change the structure of the graph but is needed for later optimizations
             self.out_graph = self._simplify_ail_graph(self.out_graph)
 
-        if self._prevent_new_gotos and (len(self._goto_manager.gotos) > len(initial_gotos)):
-            self.out_graph = None
-            return
+        if self._prevent_new_gotos:
+            prev_gotos = len(initial_gotos)
+            new_gotos = len(self._goto_manager.gotos)
+            if (self._strictly_less_gotos and (new_gotos >= prev_gotos)) or (
+                not self._strictly_less_gotos and (new_gotos > prev_gotos)
+            ):
+                self.out_graph = None
+                return
 
     def _fixed_point_analyze(self, cache=None):
         for _ in range(self._max_opt_iters):

{angr-9.2.88 → angr-9.2.89}/angr/analyses/typehoon/lifter.py

@@ -9,8 +9,9 @@ from ...sim_type import (
     SimTypeLongLong,
     SimTypePointer,
     SimStruct,
+    SimTypeArray,
 )
-from .typeconsts import BottomType, Int8, Int16, Int32, Int64, Pointer32, Pointer64, Struct
+from .typeconsts import BottomType, Int8, Int16, Int32, Int64, Pointer32, Pointer64, Struct, Array
 
 if TYPE_CHECKING:
     from .typeconsts import TypeConstant
@@ -56,11 +57,18 @@ class TypeLifter:
 
     def _lift_SimStruct(self, ty: SimStruct) -> Union["TypeConstant", BottomType]:
         converted_fields = {}
+        field_names = {}
+        ty_offsets = ty.offsets
         for field_name, simtype in ty.fields.items():
-            if field_name not in ty.offsets:
+            if field_name not in ty_offsets:
                 return BottomType()
-            converted_fields[ty.offsets[field_name]] = self.lift(simtype)
-        return Struct(fields=converted_fields, name=ty.name)
+            converted_fields[ty_offsets[field_name]] = self.lift(simtype)
+            field_names[ty_offsets[field_name]] = field_name
+        return Struct(fields=converted_fields, name=ty.name, field_names=field_names)
+
+    def _lift_SimTypeArray(self, ty: SimTypeArray) -> Array:
+        elem_type = self.lift(ty.elem_type)
+        return Array(elem_type, count=ty.length)
 
 
 _mapping = {
@@ -71,4 +79,5 @@ _mapping = {
     SimTypeLongLong: TypeLifter._lift_SimTypeLongLong,
     SimTypePointer: TypeLifter._lift_SimTypePointer,
     SimStruct: TypeLifter._lift_SimStruct,
+    SimTypeArray: TypeLifter._lift_SimTypeArray,
 }

{angr-9.2.88 → angr-9.2.89}/angr/analyses/typehoon/simple_solver.py

@@ -37,6 +37,7 @@ from .typeconsts import (
     Pointer32,
     Pointer64,
     Struct,
+    Array,
     Function,
     int_type,
 )
@@ -57,6 +58,7 @@ PRIMITIVE_TYPES = {
     Pointer64(),
     BottomType(),
     Struct(),
+    Array(),
 }
 
 Top_ = TopType()
@@ -69,6 +71,7 @@ Bottom_ = BottomType()
 Pointer64_ = Pointer64()
 Pointer32_ = Pointer32()
 Struct_ = Struct()
+Array_ = Array()
 
 # lattice for 64-bit binaries
 BASE_LATTICE_64 = networkx.DiGraph()
@@ -869,6 +872,8 @@ class SimpleSolver:
                 SimpleSolver._typevar_inside_set(field_typevar, typevar_set)
                 for field_typevar in typevar.fields.values()
             )
+        if isinstance(typevar, Array) and Array_ in typevar_set:
+            return SimpleSolver._typevar_inside_set(typevar.element, typevar_set)
         if isinstance(typevar, Pointer) and (Pointer32_ in typevar_set or Pointer64_ in typevar_set):
             return SimpleSolver._typevar_inside_set(typevar.basetype, typevar_set)
         return False

{angr-9.2.88 → angr-9.2.89}/angr/analyses/typehoon/translator.py

@@ -91,11 +91,11 @@ class TypeTranslator:
             internal = self._tc2simtype(tc.basetype)
         return sim_type.SimTypePointer(internal).with_arch(self.arch)
 
-    def _translate_Array(self, tc: typeconsts.Array):
+    def _translate_Array(self, tc: typeconsts.Array) -> sim_type.SimTypeArray:
         elem_type = self._tc2simtype(tc.element)
         return sim_type.SimTypeArray(elem_type, length=tc.count).with_arch(self.arch)
 
-    def _translate_Struct(self, tc):
+    def _translate_Struct(self, tc: typeconsts.Struct):
         if tc in self.structs:
             return self.structs[tc]
 
@@ -122,7 +122,11 @@ class TypeTranslator:
                 # for now, we replace it with an unsigned char
                 translated_type = sim_type.SimTypeChar(signed=False).with_arch(self.arch)
 
-            s.fields["field_%x" % offset] = translated_type
+            if tc.field_names and offset in tc.field_names:
+                field_name = tc.field_names[offset]
+            else:
+                field_name = f"field_{offset:x}"
+            s.fields[field_name] = translated_type
 
             if isinstance(translated_type, SimTypeTempRef):
                 next_offset = self.arch.bytes + offset

{angr-9.2.88 → angr-9.2.89}/angr/analyses/typehoon/typeconsts.py

@@ -170,8 +170,8 @@ class Pointer64(Pointer, Int64):
 
 
 class Array(TypeConstant):
-    def __init__(self, element, count=None):
-        self.element: TypeConstant = element
+    def __init__(self, element=None, count=None):
+        self.element: Optional[TypeConstant] = element
         self.count: Optional[int] = count
 
     @memoize
@@ -195,9 +195,10 @@ class Array(TypeConstant):
 
 
 class Struct(TypeConstant):
-    def __init__(self, fields=None, name=None):
+    def __init__(self, fields=None, name=None, field_names=None):
         self.fields = {} if fields is None else fields  # offset to type
         self.name = name
+        self.field_names = field_names
 
     def _hash(self, visited: Set[int]):
         if id(self) in visited:

{angr-9.2.88 → angr-9.2.89}/angr/exploration_techniques/tracer.py

@@ -1041,6 +1041,8 @@ class Tracer(ExplorationTechnique):
 
         # now remove our breakpoints since other people might not want them
         for s in [last_state, crash_state]:
+            if s is None:
+                continue
             s.inspect.remove_breakpoint("address_concretization", bp1)
             s.inspect.remove_breakpoint("address_concretization", bp2)
 

{angr-9.2.88 → angr-9.2.89}/angr/procedures/definitions/__init__.py

@@ -647,6 +647,10 @@ def load_external_definitions():
                 l.warning("External library definitions directory %s does not exist or is not a directory.", d)
 
     if _EXTERNAL_DEFINITIONS_DIRS:
+        # we must load all definitions prior to any external definitions are loaded. otherwise external definitions may
+        # be overwritten by embedded definitions in angr, which is undesirable
+        load_all_definitions()
+
         for d in _EXTERNAL_DEFINITIONS_DIRS:
             for _ in autoimport.auto_import_source_files(d):
                 pass

{angr-9.2.88 → angr-9.2.89}/angr/utils/graph.py

@@ -683,8 +683,27 @@ class GraphUtils:
         # find all strongly connected components in the graph
         sccs = [scc for scc in networkx.strongly_connected_components(graph) if len(scc) > 1]
 
+        def _sort_edge(edge):
+            """
+            A sorter to make a deterministic order of edges.
+            """
+            _src, _dst = edge
+            src_addr, dst_addr = 0, 0
+            if hasattr(_src, "addr"):
+                src_addr = _src.addr
+            elif isinstance(_src, int):
+                src_addr = _src
+
+            if hasattr(_dst, "addr"):
+                dst_addr = _dst.addr
+            elif isinstance(_dst, int):
+                dst_addr = _dst
+
+            return src_addr + dst_addr
+
         # collapse all strongly connected components
-        for src, dst in graph.edges():
+        edges = sorted(list(graph.edges()), key=_sort_edge)
+        for src, dst in edges:
             scc_index = GraphUtils._components_index_node(sccs, src)
             if scc_index is not None:
                 src = SCCPlaceholder(scc_index)

{angr-9.2.88 → angr-9.2.89/angr.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: angr
-Version: 9.2.88
+Version: 9.2.89
 Summary: A multi-architecture binary analysis toolkit, with the ability to perform dynamic symbolic execution and various static analyses on binaries
 Home-page: https://github.com/angr/angr
 License: BSD-2-Clause
@@ -17,13 +17,13 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: CppHeaderParser
 Requires-Dist: GitPython
-Requires-Dist: ailment==9.2.88
-Requires-Dist: archinfo==9.2.88
+Requires-Dist: ailment==9.2.89
+Requires-Dist: archinfo==9.2.89
 Requires-Dist: cachetools
 Requires-Dist: capstone==5.0.0.post1
 Requires-Dist: cffi>=1.14.0
-Requires-Dist: claripy==9.2.88
-Requires-Dist: cle==9.2.88
+Requires-Dist: claripy==9.2.89
+Requires-Dist: cle==9.2.89
 Requires-Dist: dpkt
 Requires-Dist: itanium-demangler
 Requires-Dist: mulpyplexer
@@ -33,7 +33,7 @@ Requires-Dist: protobuf>=3.19.0
 Requires-Dist: psutil
 Requires-Dist: pycparser>=2.18
 Requires-Dist: pyformlang
-Requires-Dist: pyvex==9.2.88
+Requires-Dist: pyvex==9.2.89
 Requires-Dist: rich>=13.1.0
 Requires-Dist: rpyc
 Requires-Dist: sortedcontainers

{angr-9.2.88 → angr-9.2.89}/angr.egg-info/requires.txt

@@ -1,12 +1,12 @@
 CppHeaderParser
 GitPython
-ailment==9.2.88
-archinfo==9.2.88
+ailment==9.2.89
+archinfo==9.2.89
 cachetools
 capstone==5.0.0.post1
 cffi>=1.14.0
-claripy==9.2.88
-cle==9.2.88
+claripy==9.2.89
+cle==9.2.89
 dpkt
 itanium-demangler
 mulpyplexer
@@ -16,7 +16,7 @@ protobuf>=3.19.0
 psutil
 pycparser>=2.18
 pyformlang
-pyvex==9.2.88
+pyvex==9.2.89
 rich>=13.1.0
 rpyc
 sortedcontainers

{angr-9.2.88 → angr-9.2.89}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=59", "wheel", "pyvex==9.2.88", "unicorn==2.0.1.post1"]
+requires = ["setuptools>=59", "wheel", "pyvex==9.2.89", "unicorn==2.0.1.post1"]
 build-backend = "setuptools.build_meta"
 
 [tool.black]

{angr-9.2.88 → angr-9.2.89}/setup.cfg

@@ -22,13 +22,13 @@ packages = find:
 install_requires = 
 	CppHeaderParser
 	GitPython
-	ailment==9.2.88
-	archinfo==9.2.88
+	ailment==9.2.89
+	archinfo==9.2.89
 	cachetools
 	capstone==5.0.0.post1
 	cffi>=1.14.0
-	claripy==9.2.88
-	cle==9.2.88
+	claripy==9.2.89
+	cle==9.2.89
 	dpkt
 	itanium-demangler
 	mulpyplexer
@@ -38,7 +38,7 @@ install_requires =
 	psutil
 	pycparser>=2.18
 	pyformlang
-	pyvex==9.2.88
+	pyvex==9.2.89
 	rich>=13.1.0
 	rpyc
 	sortedcontainers