angr 9.2.92__py3-none-manylinux2014_x86_64.whl → 9.2.94__py3-none-manylinux2014_x86_64.whl

angr/__init__.py

@@ -1,7 +1,7 @@
 # pylint: disable=wildcard-import
 # pylint: disable=wrong-import-position
 
-__version__ = "9.2.92"
+__version__ = "9.2.94"
 
 if bytes is str:
     raise Exception(

angr/analyses/cfg/cfg_base.py

@@ -8,7 +8,7 @@ from sortedcontainers import SortedDict
 
 import pyvex
 from claripy.utils.orderedset import OrderedSet
-from cle import ELF, PE, Blob, TLSObject, MachO, ExternObject, KernelObject, FunctionHintSource, Hex, Coff
+from cle import ELF, PE, Blob, TLSObject, MachO, ExternObject, KernelObject, FunctionHintSource, Hex, Coff, SRec
 from cle.backends import NamedRegion
 import archinfo
 from archinfo.arch_soot import SootAddressDescriptor
@@ -748,19 +748,29 @@ class CFGBase(Analysis):
         for b in binaries:
             if isinstance(b, ELF):
                 # If we have sections, we get result from sections
+                sections = []
                 if not force_segment and b.sections:
                     # Get all executable sections
                     for section in b.sections:
                         if section.is_executable:
                             tpl = (section.min_addr, section.max_addr + 1)
-                            memory_regions.append(tpl)
-
-                else:
-                    # Get all executable segments
-                    for segment in b.segments:
-                        if segment.is_executable:
-                            tpl = (segment.min_addr, segment.max_addr + 1)
-                            memory_regions.append(tpl)
+                            sections.append(tpl)
+                    memory_regions += sections
+
+                segments = []
+                # Get all executable segments
+                for segment in b.segments:
+                    if segment.is_executable:
+                        tpl = (segment.min_addr, segment.max_addr + 1)
+                        segments.append(tpl)
+                if sections and segments:
+                    # are there executable segments with no sections inside?
+                    for segment in segments:
+                        for section in sections:
+                            if segment[0] <= section[0] < segment[1]:
+                                break
+                        else:
+                            memory_regions.append(segment)
 
             elif isinstance(b, (Coff, PE)):
                 for section in b.sections:
@@ -778,7 +788,7 @@ class CFGBase(Analysis):
                                 tpl = (section.min_addr, section.max_addr + 1)
                                 memory_regions.append(tpl)
 
-            elif isinstance(b, Hex):
+            elif isinstance(b, (Hex, SRec)):
                 if b.regions:
                     for region_addr, region_size in b.regions:
                         memory_regions.append((region_addr, region_addr + region_size))

angr/analyses/cfg/indirect_jump_resolvers/amd64_elf_got.py

@@ -18,7 +18,7 @@ class AMD64ElfGotResolver(IndirectJumpResolver):
         super().__init__(project, timeless=True)
 
     def filter(self, cfg, addr, func_addr, block, jumpkind):
-        if jumpkind != "Ijk_Call":
+        if not (jumpkind == "Ijk_Call" or (jumpkind == "Ijk_Boring" and addr == func_addr)):
             return False
         return True
 

angr/analyses/cfg/indirect_jump_resolvers/arm_elf_fast.py

@@ -12,11 +12,7 @@ _l = logging.getLogger(name=__name__)
 
 class ArmElfFastResolver(IndirectJumpResolver):
     """
-    Resolves the indirect jump in ARM ELF binaries where all internal function calls are performed in the following
-    manner::
-
-        ldr r3, [pc+#0x124]  ; load a constant from the constant_pool
-        blx r3
+    Resolves indirect jumps in ARM ELF binaries
     """
 
     def __init__(self, project):
@@ -29,6 +25,89 @@ class ArmElfFastResolver(IndirectJumpResolver):
             return False
         return True
 
+    def _resolve_default(self, stmt, block, source, cfg, blade):
+        """
+        Resolves the indirect jump in ARM ELF binaries where all internal function calls are performed in the following
+        manner::
+
+        ldr r3, [pc+#0x124]  ; load a constant from the constant_pool
+        blx r3
+        """
+
+        if not isinstance(stmt.data, pyvex.IRExpr.Load):
+            return False, []
+        if not isinstance(stmt.data.addr, pyvex.IRExpr.Const):
+            return False, []
+        load_addr = stmt.data.addr.con.value
+        load_size = stmt.data.result_size(block.tyenv) // 8
+        endness = archinfo.Endness.BE if stmt.data.endness == "Iend_BE" else archinfo.Endness.LE
+
+        # the next statement should be the default exit
+        next_target = next(iter(blade.slice.successors(source)))
+
+        if not (next_target[0] == block.addr and next_target[1] == DEFAULT_STATEMENT):
+            return False, []
+        next_tmp = block.next
+        if next_tmp.tmp != stmt.tmp:
+            return False, []
+
+        # load the address to jump to
+        try:
+            target_addr = self.project.loader.memory.unpack_word(load_addr, size=load_size, endness=endness)
+            if cfg.tag == "CFGFast":
+                cfg._seg_list.occupy(load_addr, load_size, "pointer-array")
+        except KeyError:
+            return False, []
+
+        return True, [target_addr]
+
+    def _resolve_put(self, stmt, block, source, cfg, blade):
+        """
+        Resolves the indirect jump in ARM ELF binaries where all internal function calls are performed in the following
+        manner::
+
+        add     ip, pc, #0x100000
+        add     ip, ip, #0x1e000
+        ldr     pc, [ip,#0x884]!
+        """
+
+        # Get the value of r12 register
+        if not isinstance(stmt.data, pyvex.IRExpr.Const):
+            return False, []
+        if not self.project.arch.register_names[stmt.offset] == "r12":
+            return False, []
+        load_addr = stmt.data.con.value
+        load_size = stmt.data.result_size(block.tyenv) // 8
+        endness = self.project.arch.default_endness
+
+        count = 0
+        for next_stmt in block.statements:
+            if (
+                isinstance(next_stmt, pyvex.IRStmt.WrTmp)
+                and isinstance(next_stmt.data, pyvex.IRExpr.Binop)
+                and "Add" in next_stmt.data.op
+            ):
+                load_addr += next_stmt.constants[0].value
+                count += 1
+
+        if count != 2:
+            return False, []
+
+        next_target = next(iter(blade.slice.successors(source)))
+
+        if not next_target[0] == block.addr:
+            return False, []
+
+        # load the address to jump to
+        try:
+            target_addr = self.project.loader.memory.unpack_word(load_addr, size=load_size, endness=endness)
+            if cfg.tag == "CFGFast":
+                cfg._seg_list.occupy(load_addr, load_size, "pointer-array")
+        except KeyError:
+            return False, []
+
+        return True, [target_addr]
+
     def resolve(  # pylint:disable=unused-argument
         self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs
     ):
@@ -64,31 +143,9 @@ class ArmElfFastResolver(IndirectJumpResolver):
             return False, []
 
         stmt = block.statements[stmt_idx]
-        if not isinstance(stmt, pyvex.IRStmt.WrTmp):
+        if isinstance(stmt, pyvex.IRStmt.WrTmp):
+            return self._resolve_default(stmt, block, source, cfg, b)
+        elif isinstance(stmt, pyvex.IRStmt.Put):
+            return self._resolve_put(stmt, block, source, cfg, b)
+        else:
             return False, []
-        if not isinstance(stmt.data, pyvex.IRExpr.Load):
-            return False, []
-        if not isinstance(stmt.data.addr, pyvex.IRExpr.Const):
-            return False, []
-        load_addr = stmt.data.addr.con.value
-        load_size = stmt.data.result_size(block.tyenv) // 8
-        endness = archinfo.Endness.BE if stmt.data.endness == "Iend_BE" else archinfo.Endness.LE
-
-        # the next statement should be the default exit
-        next_target = next(iter(b.slice.successors(source)))
-
-        if not (next_target[0] == block.addr and next_target[1] == DEFAULT_STATEMENT):
-            return False, []
-        next_tmp = block.next
-        if next_tmp.tmp != stmt.tmp:
-            return False, []
-
-        # load the address to jump to
-        try:
-            target_addr = self.project.loader.memory.unpack_word(load_addr, size=load_size, endness=endness)
-            if cfg.tag == "CFGFast":
-                cfg._seg_list.occupy(load_addr, load_size, "pointer-array")
-        except KeyError:
-            return False, []
-
-        return True, [target_addr]