angr 9.2.92__py3-none-manylinux2014_x86_64.whl → 9.2.94__py3-none-manylinux2014_x86_64.whl

angr/analyses/decompiler/peephole_optimizations/bswap.py

@@ -9,8 +9,8 @@ from .base import PeepholeOptimizationExprBase
 class Bswap(PeepholeOptimizationExprBase):
     __slots__ = ()
 
-    NAME = "Simplifying bswap_16()"
-    expr_classes = (BinaryOp,)  # all expressions are allowed
+    NAME = "Simplifying bswap_16() and bswap_32()"
+    expr_classes = (BinaryOp, Convert)
 
     def optimize(self, expr: BinaryOp, **kwargs):
         # bswap_16
@@ -48,6 +48,57 @@ class Bswap(PeepholeOptimizationExprBase):
 
                     return None
 
+        # bswap_32
+        #   (Conv(64->32, rax<8>) << 0x18<8>) |
+        #   (((Conv(64->32, rax<8>) << 0x8<8>) & 0xff0000<32>) |
+        #   (((Conv(64->32, rax<8>) >> 0x8<8>) & 0xff00<32>) |
+        #   ((Conv(64->32, rax<8>) >> 0x18<8>) & 0xff<32>))))
+        if expr.op == "Or":
+            # fully flatten the expression
+            or_pieces = []
+            queue = [expr]
+            while queue:
+                operand = queue.pop(0)
+                if isinstance(operand, BinaryOp) and operand.op == "Or":
+                    queue.append(operand.operands[0])
+                    queue.append(operand.operands[1])
+                else:
+                    or_pieces.append(operand)
+            if len(or_pieces) == 4:
+                # parse pieces
+                shifts = set()
+                cores = set()
+                for piece in or_pieces:
+                    if isinstance(piece, BinaryOp):
+                        if piece.op == "Shl" and isinstance(piece.operands[1], Const):
+                            cores.add(piece.operands[0])
+                            shifts.add(("<<", piece.operands[1].value, 0xFFFFFFFF))
+                        elif piece.op == "And" and isinstance(piece.operands[1], Const):
+                            and_amount = piece.operands[1].value
+                            and_core = piece.operands[0]
+                            if (
+                                isinstance(and_core, BinaryOp)
+                                and and_core.op == "Shl"
+                                and isinstance(and_core.operands[1], Const)
+                            ):
+                                cores.add(and_core.operands[0])
+                                shifts.add(("<<", and_core.operands[1].value, and_amount))
+                            elif (
+                                isinstance(and_core, BinaryOp)
+                                and and_core.op == "Shr"
+                                and isinstance(and_core.operands[1], Const)
+                            ):
+                                cores.add(and_core.operands[0])
+                                shifts.add((">>", and_core.operands[1].value, and_amount))
+                if len(cores) == 1 and shifts == {
+                    ("<<", 0x18, 0xFFFFFFFF),
+                    ("<<", 8, 0xFF0000),
+                    (">>", 0x18, 0xFF),
+                    (">>", 8, 0xFF00),
+                }:
+                    core_expr = next(iter(cores))
+                    return Call(expr.idx, "__buildin_bswap32", args=[core_expr], bits=expr.bits, **expr.tags)
+
         return None
 
     def _match_inner(self, or_first: BinaryOp, or_second: BinaryOp) -> Tuple[bool, Optional[Expression]]:

angr/analyses/decompiler/peephole_optimizations/eager_eval.py

@@ -1,6 +1,6 @@
 from math import gcd
 
-from ailment.expression import BinaryOp, UnaryOp, Const, Convert
+from ailment.expression import BinaryOp, UnaryOp, Const, Convert, StackBaseOffset
 
 from .base import PeepholeOptimizationExprBase
 
@@ -59,6 +59,22 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
                         expr.signed,
                         **expr.tags,
                     )
+            if (
+                isinstance(expr.operands[0], BinaryOp)
+                and expr.operands[0].op == "Mul"
+                and isinstance(expr.operands[0].operands[1], Const)
+                and expr.operands[0].operands[0].likes(expr.operands[1])
+            ):
+                # A * x + x => (A + 1) * x
+                coeff_expr = expr.operands[0].operands[1]
+                new_coeff = coeff_expr.value + 1
+                return BinaryOp(
+                    expr.idx,
+                    "Mul",
+                    [Const(coeff_expr.idx, None, new_coeff, coeff_expr.bits), expr.operands[1]],
+                    expr.signed,
+                    **expr.tags,
+                )
         elif expr.op == "Sub":
             if isinstance(expr.operands[0], Const) and isinstance(expr.operands[1], Const):
                 mask = (1 << expr.bits) - 1
@@ -93,6 +109,9 @@ class EagerEvaluation(PeepholeOptimizationExprBase):
             if isinstance(expr.operands[0], Const) and expr.operands[0].value == 0:
                 return UnaryOp(expr.idx, "Neg", expr.operands[1], **expr.tags)
 
+            if isinstance(expr.operands[0], StackBaseOffset) and isinstance(expr.operands[1], StackBaseOffset):
+                return Const(expr.idx, None, expr.operands[0].offset - expr.operands[1].offset, expr.bits, **expr.tags)
+
         elif expr.op == "And":
             if isinstance(expr.operands[0], Const) and isinstance(expr.operands[1], Const):
                 new_expr = Const(

angr/analyses/decompiler/structured_codegen/c.py

@@ -3,12 +3,12 @@ from typing import Optional, Dict, List, Tuple, Set, Any, Union, TYPE_CHECKING,
 from collections import defaultdict
 import logging
 import struct
-from functools import reduce
 
 from ailment import Block, Expr, Stmt, Tmp
 from ailment.expression import StackBaseOffset, BinaryOp
 from unique_log_filter import UniqueLogFilter
 
+from ....procedures import SIM_LIBRARIES, SIM_TYPE_COLLECTIONS
 from ....sim_type import (
     SimTypeLongLong,
     SimTypeInt,
@@ -28,6 +28,7 @@ from ....sim_type import (
     SimTypeFixedSizeArray,
     SimTypeLength,
     SimTypeReg,
+    dereference_simtype,
 )
 from ....knowledge_plugins.functions import Function
 from ....sim_variable import SimVariable, SimTemporaryVariable, SimStackVariable, SimMemoryVariable
@@ -537,8 +538,10 @@ class CFunction(CConstruct):  # pylint:disable=abstract-method
         indent_str = self.indent_str(indent)
         if self.codegen.show_local_types:
             local_types = [unpack_typeref(ty) for ty in self.variable_manager.types.iter_own()]
+            name_to_structtypes = {}
             for ty in local_types:
                 if isinstance(ty, SimStruct):
+                    name_to_structtypes[ty.name] = ty
                     for field in ty.fields.values():
                         if isinstance(field, SimTypePointer):
                             if isinstance(field.pts_to, (SimTypeArray, SimTypeFixedSizeArray)):
@@ -546,6 +549,12 @@ class CFunction(CConstruct):  # pylint:disable=abstract-method
                             else:
                                 field = field.pts_to
                         if isinstance(field, SimStruct) and field not in local_types:
+                            if field.name and not field.fields and field.name in name_to_structtypes:
+                                # we use SimStruct types with empty fields to refer to already defined struct types
+                                # for example, see how struct _IO_marker is defined in sim_type.py
+                                continue
+                            if field.name:
+                                name_to_structtypes[field.name] = field
                             local_types.append(field)
 
                 yield from type_to_c_repr_chunks(ty, full=True, indent_str=indent_str)
@@ -577,7 +586,7 @@ class CFunction(CConstruct):  # pylint:disable=abstract-method
         yield " ", None
         # function name
         if self.demangled_name and self.show_demangled_name:
-            normalized_name = get_cpp_function_name(self.demangled_name, specialized=False, qualified=False)
+            normalized_name = get_cpp_function_name(self.demangled_name, specialized=False, qualified=True)
         else:
             normalized_name = self.name
         yield normalized_name, self
@@ -1234,7 +1243,16 @@ class CFunctionCall(CStatement, CExpression):
     @property
     def prototype(self) -> Optional[SimTypeFunction]:  # TODO there should be a prototype for each callsite!
         if self.callee_func is not None and self.callee_func.prototype is not None:
-            return self.callee_func.prototype
+            proto = self.callee_func.prototype
+            if self.callee_func.prototype_libname is not None:
+                # we need to deref the prototype in case it uses SimTypeRef internally
+                type_collections = []
+                prototype_lib = SIM_LIBRARIES[self.callee_func.prototype_libname]
+                if prototype_lib.type_collection_names:
+                    for typelib_name in prototype_lib.type_collection_names:
+                        type_collections.append(SIM_TYPE_COLLECTIONS[typelib_name])
+                    proto = dereference_simtype(proto, type_collections)
+            return proto
         returnty = SimTypeInt(signed=False)
         return SimTypeFunction([arg.type for arg in self.args], returnty).with_arch(self.codegen.project.arch)
 
@@ -2165,29 +2183,24 @@ class CConstant(CExpression):
 
         if self.fmt_float:
             if 0 < value <= 0xFFFF_FFFF:
-                str_value = str(struct.unpack("f", struct.pack("I", value))[0])
-                return str_value
+                return str(struct.unpack("f", struct.pack("I", value))[0])
+
+        if self.fmt_char:
+            if value < 0:
+                value += 2**self._type.size
+            value &= 0xFF
+            return repr(chr(value)) if value < 0x80 else f"'\\x{value:x}'"
 
         if self.fmt_neg:
             if value > 0:
-                value = value - 2**self._type.size
+                value -= 2**self._type.size
             elif value < 0:
-                value = value + 2**self._type.size
-
-        str_value = None
-        if self.fmt_char:
-            try:
-                str_value = f"'{chr(value)}'"
-            except ValueError:
-                str_value = None
+                value += 2**self._type.size
 
-        if str_value is None:
-            if self.fmt_hex:
-                str_value = hex(value)
-            else:
-                str_value = str(value)
+        if self.fmt_hex:
+            return hex(value)
 
-        return str_value
+        return str(value)
 
 
 class CRegister(CExpression):
@@ -2590,6 +2603,15 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
             if isinstance(var, CVariable):
                 var.variable_type = self._get_variable_type(var.variable, is_global=True)
 
+        for cvar in self.cfunc.arg_list:
+            vartype = self._get_variable_type(
+                cvar.variable,
+                is_global=isinstance(cvar.variable, SimMemoryVariable)
+                and not isinstance(cvar.variable, SimStackVariable),
+            )
+            if vartype is not None:
+                cvar.variable_type = vartype.with_arch(self.project.arch)
+
     #
     # Util methods
     #
@@ -2823,30 +2845,40 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
             if len(o_terms) == 0:
                 # probably a plain integer, return as is
                 return expr
-            result = reduce(
-                lambda a1, a2: CBinaryOp("Add", a1, a2, codegen=self),
-                (
-                    (
-                        CBinaryOp(
-                            "Mul",
-                            CConstant(c, t.type, codegen=self),
-                            (
-                                t
-                                if not isinstance(t.type, SimTypePointer)
-                                else CTypeCast(t.type, SimTypePointer(SimTypeChar()), t, codegen=self)
-                            ),
-                            codegen=self,
-                        )
-                        if c != 1
-                        else (
+            result = None
+            pointer_length_int_type = (
+                SimTypeLongLong(signed=False) if self.project.arch.bits == 64 else SimTypeInt(signed=False)
+            )
+            for c, t in o_terms:
+                op = "Add"
+                if c == -1 and result is not None:
+                    op = "Sub"
+                    piece = (
+                        t
+                        if not isinstance(t.type, SimTypePointer)
+                        else CTypeCast(t.type, SimTypePointer(SimTypeChar()), t, codegen=self)
+                    )
+                elif c == 1:
+                    piece = (
+                        t
+                        if not isinstance(t.type, SimTypePointer)
+                        else CTypeCast(t.type, SimTypePointer(SimTypeChar()), t, codegen=self)
+                    )
+                else:
+                    piece = CBinaryOp(
+                        "Mul",
+                        CConstant(c, t.type, codegen=self),
+                        (
                             t
                             if not isinstance(t.type, SimTypePointer)
-                            else CTypeCast(t.type, SimTypePointer(SimTypeChar()), t, codegen=self)
-                        )
+                            else CTypeCast(t.type, pointer_length_int_type, t, codegen=self)
+                        ),
+                        codegen=self,
                     )
-                    for c, t in o_terms
-                ),
-            )
+                if result is None:
+                    result = piece
+                else:
+                    result = CBinaryOp(op, result, piece, codegen=self)
             if o_constant != 0:
                 result = CBinaryOp("Add", CConstant(o_constant, SimTypeInt(), codegen=self), result, codegen=self)
 
@@ -2869,6 +2901,9 @@ class CStructuredCodeGenerator(BaseStructuredCodeGenerator, Analysis):
                 if kernel is not None:
                     l.warning("Summing two different pointers together. Uh oh!")
                     return bail_out()
+                if c == -1:
+                    # legit case: you can deduct a pointer from another pointer and get an integer as result in C
+                    return bail_out()
                 if c != 1:
                     l.warning("Multiplying a pointer by a constant??")
                     return bail_out()

angr/analyses/decompiler/structuring/phoenix.py

@@ -14,7 +14,7 @@ from ailment.expression import Const, UnaryOp, MultiStatementExpression
 from angr.utils.graph import GraphUtils
 from ....knowledge_plugins.cfg import IndirectJumpType
 from ....utils.constants import SWITCH_MISSING_DEFAULT_NODE_ADDR
-from ....utils.graph import dominates, to_acyclic_graph
+from ....utils.graph import dominates, to_acyclic_graph, dfs_back_edges
 from ..sequence_walker import SequenceWalker
 from ..utils import (
     remove_last_statement,
@@ -140,6 +140,10 @@ class PhoenixStructurer(StructurerBase):
         if len(self._region.graph.nodes) == 1 and has_cycle:
             self._analyze_cyclic()
 
+        # backup the region prior to conducting a cyclic refinement because we may not be able to structure a cycle out
+        # of the refined graph. in that case, we restore the original region and return.
+        pre_refinement_region = None
+
         while len(self._region.graph.nodes) > 1:
             progressed = self._analyze_acyclic()
             if progressed and self._region.head not in self._region.graph:
@@ -151,12 +155,14 @@ class PhoenixStructurer(StructurerBase):
             if has_cycle:
                 progressed |= self._analyze_cyclic()
                 if progressed:
+                    pre_refinement_region = None
                     if self._region.head not in self._region.graph:
                         # update the loop head
                         self._region.head = next(
                             iter(node for node in self._region.graph.nodes if node.addr == self._region.head.addr)
                         )
-                else:
+                elif pre_refinement_region is None:
+                    pre_refinement_region = self._region.copy()
                     refined = self._refine_cyclic()
                     if refined:
                         if self._region.head not in self._region.graph:
@@ -194,6 +200,10 @@ class PhoenixStructurer(StructurerBase):
             # successfully structured
             self.result = next(iter(self._region.graph.nodes))
         else:
+            if pre_refinement_region is not None:
+                # we could not make a loop after the last cycle refinement. restore the graph
+                self._region = pre_refinement_region
+
             self.result = None  # the actual result is in self._region.graph and self._region.graph_with_successors
 
     def _analyze_cyclic(self) -> bool:
@@ -572,7 +582,16 @@ class PhoenixStructurer(StructurerBase):
         return True, loop_node
 
     def _refine_cyclic(self) -> bool:
-        return self._refine_cyclic_core(self._region.head)
+        loop_heads = {t for _, t in dfs_back_edges(self._region.graph, self._region.head)}
+        sorted_loop_heads = GraphUtils.quasi_topological_sort_nodes(self._region.graph, nodes=list(loop_heads))
+
+        for head in sorted_loop_heads:
+            l.debug("... refining cyclic at %r", head)
+            refined = self._refine_cyclic_core(head)
+            l.debug("... refined: %s", refined)
+            if refined:
+                return True
+        return False
 
     def _refine_cyclic_core(self, loop_head) -> bool:
         graph: networkx.DiGraph = self._region.graph
@@ -621,7 +640,7 @@ class PhoenixStructurer(StructurerBase):
             # natural loop. select *any* exit edge to determine the successor
             # well actually, to maintain determinism, we select the successor with the highest address
             successor_candidates = set()
-            for node in graph.nodes:
+            for node in networkx.descendants(graph, loop_head):
                 for succ in fullgraph.successors(node):
                     if succ not in graph:
                         successor_candidates.add(succ)
@@ -637,8 +656,15 @@ class PhoenixStructurer(StructurerBase):
                             outgoing_edges.append((pred, succ))
 
         if outgoing_edges:
-            # convert all out-going edges into breaks (if there is a single successor) or gotos (if there are multiple
-            # successors)
+            # if there is a single successor, we convert all out-going edges into breaks;
+            # if there are multiple successors, and if the current region does not have a parent region, then we
+            # convert all out-going edges into gotos;
+            # otherwise we give up.
+
+            if self._parent_region is not None and len({dst for _, dst in outgoing_edges}) > 1:
+                # give up because there is a parent region
+                return False
+
             if successor is None:
                 successor_and_edgecounts = defaultdict(int)
                 for _, dst in outgoing_edges:
@@ -794,7 +820,7 @@ class PhoenixStructurer(StructurerBase):
                     # case being the loop head. in such cases, we can just remove the edge.
                     if src.addr not in self.kb.cfgs["CFGFast"].jump_tables:
                         l.warning(
-                            "_refine_cyclic_core: Cannot find the block going to loop head for edge %r -> %r."
+                            "_refine_cyclic_core: Cannot find the block going to loop head for edge %r -> %r. "
                             "Remove the edge anyway.",
                             src,
                             continue_node,
@@ -847,6 +873,7 @@ class PhoenixStructurer(StructurerBase):
     def _refine_cyclic_is_while_loop(
         self, graph, fullgraph, loop_head, head_succs
     ) -> Tuple[bool, Optional[Tuple[List, List, BaseNode, BaseNode]]]:
+
         if len(head_succs) == 2 and any(head_succ not in graph for head_succ in head_succs):
             # make sure the head_pred is not already structured
             _, _, head_block_0 = self._find_node_going_to_dst(loop_head, head_succs[0])
@@ -857,7 +884,7 @@ class PhoenixStructurer(StructurerBase):
                 continue_edges: List[Tuple[BaseNode, BaseNode]] = []
                 outgoing_edges = []
                 successor = next(iter(head_succ for head_succ in head_succs if head_succ not in graph))
-                for node in graph.nodes:
+                for node in networkx.descendants(graph, loop_head):
                     succs = list(fullgraph.successors(node))
                     if loop_head in succs:
                         continue_edges.append((node, loop_head))
@@ -888,7 +915,7 @@ class PhoenixStructurer(StructurerBase):
                     # virtualize all other edges
                     successor = next(iter(nn for nn in head_pred_succs if nn not in graph))
                     continue_node = head_pred
-                    for node in graph.nodes:
+                    for node in networkx.descendants(graph, loop_head):
                         if node is head_pred:
                             continue
                         succs = list(fullgraph.successors(node))
@@ -2243,6 +2270,11 @@ class PhoenixStructurer(StructurerBase):
                     last_stmt = block.statements[-1]
                     if _check(last_stmt):
                         walker.parent_and_block.append((walker.block_id, parent, block))
+                    elif (
+                        not isinstance(last_stmt, (Jump, ConditionalJump))
+                        and block.addr + block.original_size == dst_addr
+                    ):
+                        walker.parent_and_block.append((walker.block_id, parent, block))
 
         def _handle_MultiNode(block: MultiNode, parent=None, **kwargs):  # pylint:disable=unused-argument
             if block.nodes and isinstance(block.nodes[-1], Block) and block.nodes[-1].statements:

angr/analyses/decompiler/utils.py

@@ -1,11 +1,10 @@
-# pylint:disable=wrong-import-position
+# pylint:disable=wrong-import-position,broad-exception-caught,ungrouped-imports
 import pathlib
 import copy
 from typing import Optional, Tuple, Any, Union, List, Iterable
 import logging
 
 import networkx
-
 import ailment
 
 import angr
@@ -251,6 +250,8 @@ def _merge_ail_nodes(graph, node_a: ailment.Block, node_b: ailment.Block) -> ail
     in_edges = list(graph.in_edges(node_a, data=True))
     out_edges = list(graph.out_edges(node_b, data=True))
 
+    a_ogs = graph.nodes[node_a].get("original_nodes", set())
+    b_ogs = graph.nodes[node_b].get("original_nodes", set())
     new_node = node_a.copy() if node_a.addr <= node_b.addr else node_b.copy()
     old_node = node_b if new_node == node_a else node_a
     # remove jumps in the middle of nodes when merging
@@ -263,8 +264,7 @@ def _merge_ail_nodes(graph, node_a: ailment.Block, node_b: ailment.Block) -> ail
     graph.remove_node(node_b)
 
     if new_node is not None:
-        graph.add_node(new_node)
-
+        graph.add_node(new_node, original_nodes=a_ogs.union(b_ogs))
         for src, _, data in in_edges:
             if src is node_b:
                 src = new_node
@@ -289,6 +289,7 @@ def to_ail_supergraph(transition_graph: networkx.DiGraph) -> networkx.DiGraph:
     """
     # make a copy of the graph
     transition_graph = networkx.DiGraph(transition_graph)
+    networkx.set_node_attributes(transition_graph, {node: {node} for node in transition_graph.nodes}, "original_nodes")
 
     while True:
         for src, dst, data in transition_graph.edges(data=True):
@@ -725,6 +726,14 @@ def calls_in_graph(graph: networkx.DiGraph) -> int:
     return counter.calls
 
 
+def find_block_by_addr(graph: networkx.DiGraph, addr: int):
+    for block in graph.nodes():
+        if block.addr == addr:
+            return block
+
+    raise KeyError("The block is not in the graph!")
+
+
 # delayed import
 from .structuring.structurer_nodes import (
     MultiNode,

angr/analyses/propagator/engine_ail.py

@@ -1148,6 +1148,9 @@ class SimEnginePropagatorAIL(
             )
         return PropValue.from_value_and_details(value, expr.size, new_expr, self._codeloc())
 
+    _ail_handle_AddV = _ail_handle_Add
+    _ail_handle_MulV = _ail_handle_Mul
+
     def _ail_handle_Mull(self, expr):
         o0_value = self._expr(expr.operands[0])
         o1_value = self._expr(expr.operands[1])

angr/analyses/reaching_definitions/engine_ail.py

@@ -728,6 +728,9 @@ class SimEngineRDAIL(
         r = MultiValues(self.state.top(bits))
         return r
 
+    _ail_handle_AddV = _ail_handle_Add
+    _ail_handle_MulV = _ail_handle_Mul
+
     def _ail_handle_Mull(self, expr):
         arg0, arg1 = expr.operands
 

angr/analyses/reaching_definitions/reaching_definitions.py

@@ -539,6 +539,13 @@ class ReachingDefinitionsAnalysis(
         for use in [state.stack_uses, state.heap_uses, state.register_uses, state.memory_uses]:
             self.all_uses.merge(use)
 
+        if self._track_tmps:
+            # merge tmp uses to all_uses
+            for tmp_idx, locs in state.tmp_uses.items():
+                tmp_def = next(iter(state.tmps[tmp_idx]))
+                for loc in locs:
+                    self.all_uses.add_use(tmp_def, loc)
+
         # drop definitions and uses because we will not need them anymore
         state.downsize()
 

angr/analyses/stack_pointer_tracker.py

@@ -3,6 +3,7 @@
 from typing import Set, List, Optional, TYPE_CHECKING
 import re
 import logging
+from collections import defaultdict
 
 import pyvex
 
@@ -148,6 +149,21 @@ class OffsetVal:
         return f"reg({self.reg}){(self.offset - 2**self.reg.bitlen) if self.offset != 0 else 0:+}"
 
 
+class Eq:
+    """
+    Represent an equivalence condition.
+    """
+
+    __slots__ = ("val0", "val1")
+
+    def __init__(self, val0, val1):
+        self.val0 = val0
+        self.val1 = val1
+
+    def __hash__(self):
+        return hash((type(self), self.val0, self.val1))
+
+
 class FrozenStackPointerTrackerState:
     """
     Abstract state for StackPointerTracker analysis with registers and memory values being in frozensets.
@@ -296,7 +312,12 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
     """
 
     def __init__(
-        self, func: Optional[Function], reg_offsets: Set[int], block: Optional["Block"] = None, track_memory=True
+        self,
+        func: Optional[Function],
+        reg_offsets: Set[int],
+        block: Optional["Block"] = None,
+        track_memory=True,
+        cross_insn_opt=True,
     ):
         if func is not None:
             if not func.normalized:
@@ -316,6 +337,8 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
         self.reg_offsets = reg_offsets
         self.states = {}
         self._blocks = {}
+        self._reg_value_at_block_start = defaultdict(dict)
+        self.cross_insn_opt = cross_insn_opt
 
         _l.debug("Running on function %r", self._func)
         self._analyze()
@@ -468,7 +491,7 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
         self._set_state(addr, new_val, "pre")
 
     def _run_on_node(self, node: BlockNode, state):
-        block = self.project.factory.block(node.addr, size=node.size)
+        block = self.project.factory.block(node.addr, size=node.size, cross_insn_opt=self.cross_insn_opt)
         self._blocks[node.addr] = block
 
         state = state.unfreeze()
@@ -483,6 +506,10 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
         except SimTranslationError:
             pass
 
+        if node.addr in self._reg_value_at_block_start:
+            for reg, val in self._reg_value_at_block_start[node.addr].items():
+                state.put(reg, val)
+
         if vex_block is not None:
             if isinstance(vex_block, pyvex.IRSB):
                 curr_stmt_start_addr = self._process_vex_irsb(node, vex_block, state)
@@ -548,7 +575,12 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
                         and is_alignment_mask(arg1_expr.val)
                     ):
                         return arg0_expr
-                    raise CouldNotResolveException()
+                elif expr.op.startswith("Iop_CmpEQ"):
+                    arg0_expr = _resolve_expr(arg0)
+                    arg1_expr = _resolve_expr(arg1)
+                    if isinstance(arg0_expr, (Register, OffsetVal)) and isinstance(arg1_expr, (Register, OffsetVal)):
+                        return Eq(arg0_expr, arg1_expr)
+                raise CouldNotResolveException()
             elif type(expr) is pyvex.IRExpr.RdTmp and expr.tmp in tmps and tmps[expr.tmp] is not None:
                 return tmps[expr.tmp]
             elif type(expr) is pyvex.IRExpr.Const:
@@ -563,13 +595,15 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
                     to_bits = int(m.group(3))
                     # to_unsigned = m.group(4) == "U"
                     v = resolve_expr(expr.args[0])
-                    if not isinstance(v, Constant):
-                        return TOP
-                    if from_bits > to_bits:
-                        # truncation
-                        mask = (1 << to_bits) - 1
-                        return Constant(v.val & mask)
-                    return v
+                    if isinstance(v, Constant):
+                        if from_bits > to_bits:
+                            # truncation
+                            mask = (1 << to_bits) - 1
+                            return Constant(v.val & mask)
+                        return v
+                    elif isinstance(v, Eq):
+                        return v
+                    return TOP
             elif self.track_mem and type(expr) is pyvex.IRExpr.Load:
                 return state.load(_resolve_expr(expr.addr))
             raise CouldNotResolveException()
@@ -606,6 +640,22 @@ class StackPointerTracker(Analysis, ForwardAnalysis):
                 and vex_block.instruction_addresses.index(curr_stmt_start_addr) == vex_block.instructions - 1
             ):
                 exit_observed = True
+                if (
+                    type(stmt.guard) is pyvex.IRExpr.RdTmp
+                    and stmt.guard.tmp in tmps
+                    and isinstance(stmt.dst, pyvex.IRConst.IRConst)
+                ):
+                    guard = tmps[stmt.guard.tmp]
+                    if isinstance(guard, Eq):
+                        for reg, val in state.regs.items():
+                            if reg in {self.project.arch.sp_offset, self.project.arch.bp_offset}:
+                                cond = None
+                                if val == guard.val0:
+                                    cond = guard.val1
+                                elif val == guard.val1:
+                                    cond = guard.val0
+                                if cond is not None:
+                                    self._reg_value_at_block_start[stmt.dst.value][reg] = cond
             else:
                 try:
                     resolve_stmt(stmt)