angr 9.2.95__py3-none-macosx_10_9_x86_64.whl → 9.2.97__py3-none-macosx_10_9_x86_64.whl

angr/__init__.py

@@ -1,7 +1,7 @@
 # pylint: disable=wildcard-import
 # pylint: disable=wrong-import-position
 
-__version__ = "9.2.95"
+__version__ = "9.2.97"
 
 if bytes is str:
     raise Exception(

angr/analyses/cfg/cfg_fast.py

@@ -1948,7 +1948,8 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
         entries: List[CFGJob] = []
 
         if (
-            self.functions.contains_addr(cfg_job.src_node.addr)
+            cfg_job.src_node is not None
+            and self.functions.contains_addr(cfg_job.src_node.addr)
             and self.functions[cfg_job.src_node.addr].is_default_name
             and cfg_job.src_node.addr not in self.kb.labels
             and cfg_job.jumpkind == "Ijk_Boring"
@@ -3561,14 +3562,16 @@ class CFGFast(ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase):  # pylin
     # Graph utils
     #
 
-    def _graph_add_edge(self, cfg_node, src_node, src_jumpkind, src_ins_addr, src_stmt_idx):
+    def _graph_add_edge(
+        self, cfg_node: CFGNode, src_node: Optional[CFGNode], src_jumpkind: str, src_ins_addr: int, src_stmt_idx: int
+    ):
         """
         Add edge between nodes, or add node if entry point
 
-        :param CFGNode cfg_node: node which is jumped to
-        :param CFGNode src_node: node which is jumped from none if entry point
-        :param str src_jumpkind: what type of jump the edge takes
-        :param int or str src_stmt_idx: source statements ID
+        :param cfg_node: node which is jumped to
+        :param src_node: node which is jumped from none if entry point
+        :param src_jumpkind: what type of jump the edge takes
+        :param src_stmt_idx: source statements ID
         :return: None
         """
 

angr/analyses/cfg/indirect_jump_resolvers/const_resolver.py

@@ -69,6 +69,12 @@ class ConstantResolver(IndirectJumpResolver):
         :param jumpkind:    VEX jumpkind (Ijk_Boring or Ijk_Call)
         :return:            Bool tuple with replacement address
         """
+        if not cfg.functions.contains_addr(func_addr):
+            #  the function does not exist
+            return False, []
+
+        func = cfg.functions.get_by_addr(func_addr)
+
         vex_block = block.vex
         if isinstance(vex_block.next, pyvex.expr.RdTmp):
             # what does the jump rely on? slice it back and see
@@ -105,7 +111,6 @@ class ConstantResolver(IndirectJumpResolver):
                             return False, []
                 break
 
-            func = cfg.functions[func_addr]
             _l.debug("ConstantResolver: Propagating for %r at %#x.", func, addr)
             prop = self.project.analyses.Propagator(
                 func=func,

angr/analyses/complete_calling_conventions.py

@@ -1,3 +1,4 @@
+# pylint:disable=import-outside-toplevel
 from typing import Tuple, Optional, Callable, Iterable, Dict, Set, TYPE_CHECKING
 import queue
 import threading
@@ -10,6 +11,7 @@ import networkx
 import claripy
 
 from angr.utils.graph import GraphUtils
+from angr.simos import SimWindows
 from ..utils.mp import mp_context, Initializer
 from ..knowledge_plugins.cfg import CFGModel
 from . import Analysis, register_analysis, VariableRecoveryFast, CallingConventionAnalysis
@@ -88,11 +90,13 @@ class CompleteCallingConventionsAnalysis(Analysis):
         self._results = []
         if workers > 0:
             self._remaining_funcs = _mp_context.Value("i", 0)
-            self._func_queue = _mp_context.Queue()
             self._results = _mp_context.Queue()
+            self._results_lock = _mp_context.Lock()
+            self._func_queue = _mp_context.Queue()
             self._func_queue_lock = _mp_context.Lock()
         else:
             self._remaining_funcs = None  # not needed
+            self._results_lock = None  # not needed
             self._func_queue = None  # not needed
             self._func_queue_lock = threading.Lock()
 
@@ -205,9 +209,7 @@ class CompleteCallingConventionsAnalysis(Analysis):
                         dependents[callee].add(func_addr)
 
             # enqueue all leaf functions
-            for func_addr in list(
-                k for k in depends_on if not depends_on[k]
-            ):  # pylint:disable=consider-using-dict-items
+            for func_addr in [k for k in depends_on if not depends_on[k]]:  # pylint:disable=consider-using-dict-items
                 self._func_queue.put((func_addr, None))
                 del depends_on[func_addr]
 
@@ -215,11 +217,17 @@ class CompleteCallingConventionsAnalysis(Analysis):
             cc_callback = self._cc_callback
             self._cc_callback = None
 
+            if self.project.simos is not None and isinstance(self.project.simos, SimWindows):
+                # delayed import
+                from angr.procedures.definitions import load_win32api_definitions
+
+                Initializer.get().register(load_win32api_definitions)
+
             # spawn workers to perform the analysis
             with self._func_queue_lock:
                 procs = [
-                    _mp_context.Process(target=self._worker_routine, args=(Initializer.get(),), daemon=True)
-                    for _ in range(self._workers)
+                    _mp_context.Process(target=self._worker_routine, args=(worker_id, Initializer.get()), daemon=True)
+                    for worker_id in range(self._workers)
                 ]
                 for proc_idx, proc in enumerate(procs):
                     self._update_progress(0, text=f"Spawning worker {proc_idx}...")
@@ -231,7 +239,13 @@ class CompleteCallingConventionsAnalysis(Analysis):
             self._update_progress(0)
             idx = 0
             while idx < total_funcs:
-                func_addr, cc, proto, proto_libname, varman = self._results.get(True)
+                try:
+                    with self._results_lock:
+                        func_addr, cc, proto, proto_libname, varman = self._results.get(True, timeout=0.01)
+                except queue.Empty:
+                    time.sleep(0.1)
+                    continue
+
                 func = self.kb.functions.get_by_addr(func_addr)
                 if cc is not None or proto is not None:
                     func.calling_convention = cc
@@ -260,13 +274,14 @@ class CompleteCallingConventionsAnalysis(Analysis):
                         depends_on[dependent].discard(func_addr)
                         if not depends_on[dependent]:
                             callee_prototypes = self._get_callees_cc_prototypes(dependent)
-                            self._func_queue.put((dependent, callee_prototypes))
+                            with self._func_queue_lock:
+                                self._func_queue.put((dependent, callee_prototypes))
                             del depends_on[dependent]
 
             for proc in procs:
                 proc.join()
 
-    def _worker_routine(self, initializer: Initializer):
+    def _worker_routine(self, worker_id: int, initializer: Initializer):
         initializer.initialize()
         idx = 0
         while self._remaining_funcs.value > 0:
@@ -293,9 +308,10 @@ class CompleteCallingConventionsAnalysis(Analysis):
             try:
                 cc, proto, proto_libname, varman = self._analyze_core(func_addr)
             except Exception:  # pylint:disable=broad-except
-                _l.error("Exception occurred during _analyze_core().", exc_info=True)
+                _l.error("Worker %d: Exception occurred during _analyze_core().", worker_id, exc_info=True)
                 cc, proto, proto_libname, varman = None, None, None, None
-            self._results.put((func_addr, cc, proto, proto_libname, varman))
+            with self._results_lock:
+                self._results.put((func_addr, cc, proto, proto_libname, varman))
 
     def _analyze_core(
         self, func_addr: int

angr/analyses/decompiler/ail_simplifier.py

@@ -1,3 +1,4 @@
+# pylint:disable=too-many-boolean-expressions
 from typing import Set, Dict, List, Tuple, Any, Optional, TYPE_CHECKING
 from collections import defaultdict
 import logging
@@ -183,6 +184,7 @@ class AILSimplifier(Analysis):
             observe_all=False,
             use_callee_saved_regs_at_return=self._use_callee_saved_regs_at_return,
             track_tmps=True,
+            element_limit=1,
         ).model
         self._reaching_definitions = rd
         return rd
@@ -233,6 +235,16 @@ class AILSimplifier(Analysis):
         sorted_defs = sorted(rd.all_definitions, key=lambda d: d.codeloc, reverse=True)
         for def_ in (d_ for d_ in sorted_defs if d_.codeloc.context is None):
             if isinstance(def_.atom, atoms.Register):
+                # only do this for general purpose register
+                skip_def = False
+                for reg in self.project.arch.register_list:
+                    if not reg.artificial and reg.vex_offset == def_.atom.reg_offset and not reg.general_purpose:
+                        skip_def = True
+                        break
+
+                if skip_def:
+                    continue
+
                 needs_narrowing, to_size, use_exprs = self._narrowing_needed(def_, rd, addr_and_idx_to_block)
                 if needs_narrowing:
                     # replace the definition
@@ -494,7 +506,9 @@ class AILSimplifier(Analysis):
 
         first_op = walker.operations[0]
         if isinstance(first_op, Convert):
-            return first_op.to_bits // self.project.arch.byte_width, ("convert", (first_op,))
+            if first_op.to_bits >= self.project.arch.byte_width:
+                # we need at least one byte!
+                return first_op.to_bits // self.project.arch.byte_width, ("convert", (first_op,))
         if isinstance(first_op, BinaryOp):
             second_op = None
             if len(walker.operations) >= 2:
@@ -516,6 +530,7 @@ class AILSimplifier(Analysis):
                 and first_op.op not in {"Shr", "Sar"}
                 and isinstance(second_op, Convert)
                 and second_op.from_bits == expr.bits
+                and second_op.to_bits >= self.project.arch.byte_width  # we need at least one byte!
             ):
                 return min(expr.bits, second_op.to_bits) // self.project.arch.byte_width, (
                     "binop-convert",
@@ -711,13 +726,13 @@ class AILSimplifier(Analysis):
                             ):
                                 continue
 
-                            # Make sure the register is never updated across this function
-                            if any(
-                                (def_ != the_def and def_.atom == the_def.atom)
-                                for def_ in rd.all_definitions
-                                if isinstance(def_.atom, atoms.Register) and rd.all_uses.get_uses(def_)
-                            ):
-                                continue
+                        # Make sure the register is never updated across this function
+                        if any(
+                            (def_ != the_def and def_.atom == the_def.atom)
+                            for def_ in rd.all_definitions
+                            if isinstance(def_.atom, atoms.Register) and rd.all_uses.get_uses(def_)
+                        ):
+                            continue
 
                         # find all its uses
                         all_arg_copy_var_uses: Set[Tuple[CodeLocation, Any]] = set(
@@ -1204,6 +1219,13 @@ class AILSimplifier(Analysis):
                         continue
 
             uses = rd.all_uses.get_uses(def_)
+            if (
+                isinstance(def_.atom, atoms.Register)
+                and def_.atom.reg_offset in self.project.arch.artificial_registers_offsets
+            ):
+                if len(uses) == 1 and next(iter(uses)) == def_.codeloc:
+                    # cc_ndep = amd64g_calculate_condition(..., cc_ndep)
+                    uses = set()
 
             if not uses:
                 if not isinstance(def_.codeloc, ExternalCodeLocation):

angr/analyses/decompiler/ccall_rewriters/amd64_ccalls.py

@@ -151,14 +151,14 @@ class AMD64CCallRewriter(CCallRewriterBase):
                                 **ccall.tags,
                             )
                             return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
-                elif cond_v == AMD64_CondTypes["CondZ"]:
+                elif cond_v in {AMD64_CondTypes["CondZ"], AMD64_CondTypes["CondNZ"]}:
                     if op_v in {
                         AMD64_OpTypes["G_CC_OP_SUBB"],
                         AMD64_OpTypes["G_CC_OP_SUBW"],
                         AMD64_OpTypes["G_CC_OP_SUBL"],
                         AMD64_OpTypes["G_CC_OP_SUBQ"],
                     }:
-                        # dep_1 - dep_2 == 0
+                        # dep_1 - dep_2 == 0 or dep_1 - dep_2 != 0
 
                         dep_1 = self._fix_size(
                             dep_1,
@@ -176,8 +176,9 @@ class AMD64CCallRewriter(CCallRewriterBase):
                             AMD64_OpTypes["G_CC_OP_SUBL"],
                             ccall.tags,
                         )
+                        expr_op = "CmpEQ" if cond_v == AMD64_CondTypes["CondZ"] else "CmpNE"
 
-                        r = Expr.BinaryOp(ccall.idx, "CmpEQ", (dep_1, dep_2), False, **ccall.tags)
+                        r = Expr.BinaryOp(ccall.idx, expr_op, (dep_1, dep_2), False, **ccall.tags)
                         return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
                     elif op_v in {
                         AMD64_OpTypes["G_CC_OP_LOGICB"],
@@ -185,7 +186,7 @@ class AMD64CCallRewriter(CCallRewriterBase):
                         AMD64_OpTypes["G_CC_OP_LOGICL"],
                         AMD64_OpTypes["G_CC_OP_LOGICQ"],
                     }:
-                        # dep_1 == 0
+                        # dep_1 == 0 or dep_1 != 0
 
                         dep_1 = self._fix_size(
                             dep_1,
@@ -195,9 +196,10 @@ class AMD64CCallRewriter(CCallRewriterBase):
                             AMD64_OpTypes["G_CC_OP_LOGICL"],
                             ccall.tags,
                         )
+                        expr_op = "CmpEQ" if cond_v == AMD64_CondTypes["CondZ"] else "CmpNE"
 
                         r = Expr.BinaryOp(
-                            ccall.idx, "CmpEQ", (dep_1, Expr.Const(None, None, 0, dep_1.bits)), False, **ccall.tags
+                            ccall.idx, expr_op, (dep_1, Expr.Const(None, None, 0, dep_1.bits)), False, **ccall.tags
                         )
                         return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
                     elif op_v in {
@@ -206,7 +208,7 @@ class AMD64CCallRewriter(CCallRewriterBase):
                         AMD64_OpTypes["G_CC_OP_SHRL"],
                         AMD64_OpTypes["G_CC_OP_SHRQ"],
                     }:
-                        # dep_1 == 0
+                        # dep_1 == 0 or dep_1 != 0
 
                         dep_1 = self._fix_size(
                             dep_1,
@@ -216,9 +218,20 @@ class AMD64CCallRewriter(CCallRewriterBase):
                             AMD64_OpTypes["G_CC_OP_SHRL"],
                             ccall.tags,
                         )
+                        expr_op = "CmpEQ" if cond_v == AMD64_CondTypes["CondZ"] else "CmpNE"
 
                         zero = Expr.Const(None, None, 0, dep_1.bits)
-                        r = Expr.BinaryOp(ccall.idx, "CmpEQ", (dep_1, zero), False, **ccall.tags)
+                        r = Expr.BinaryOp(ccall.idx, expr_op, (dep_1, zero), False, **ccall.tags)
+                        return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
+                    elif op_v == AMD64_OpTypes["G_CC_OP_COPY"]:
+                        # dep_1 & G_CC_MASK_Z == 0 or dep_1 & G_CC_MASK_Z != 0
+
+                        flag = Expr.Const(None, None, AMD64_CondBitMasks["G_CC_MASK_Z"], dep_1.bits)
+                        masked_dep = Expr.BinaryOp(None, "And", [dep_1, flag], False, **ccall.tags)
+                        zero = Expr.Const(None, None, 0, dep_1.bits)
+                        expr_op = "CmpEQ" if cond_v == AMD64_CondTypes["CondZ"] else "CmpNE"
+
+                        r = Expr.BinaryOp(ccall.idx, expr_op, (masked_dep, zero), False, **ccall.tags)
                         return Expr.Convert(None, r.bits, ccall.bits, False, r, **ccall.tags)
                 elif cond_v == AMD64_CondTypes["CondL"]:
                     if op_v in {

angr/analyses/decompiler/clinic.py

@@ -34,7 +34,13 @@ from .. import Analysis, register_analysis
 from ..cfg.cfg_base import CFGBase
 from ..reaching_definitions import ReachingDefinitionsAnalysis
 from .ailgraph_walker import AILGraphWalker, RemoveNodeNotice
-from .optimization_passes import get_default_optimization_passes, OptimizationPassStage, RegisterSaveAreaSimplifier
+from .optimization_passes import (
+    get_default_optimization_passes,
+    OptimizationPassStage,
+    RegisterSaveAreaSimplifier,
+    DUPLICATING_OPTS,
+    CONDENSING_OPTS,
+)
 
 if TYPE_CHECKING:
     from angr.knowledge_plugins.cfg import CFGModel
@@ -102,6 +108,7 @@ class Clinic(Analysis):
 
         self.graph = None
         self.cc_graph: Optional[networkx.DiGraph] = None
+        self.unoptimized_graph: Optional[networkx.DiGraph] = None
         self.arg_list = None
         self.variable_kb = variable_kb
         self.externs: Set[SimMemoryVariable] = set()
@@ -297,7 +304,7 @@ class Clinic(Analysis):
         _, stackarg_offsets = self._make_callsites(ail_graph, stack_pointer_tracker=spt)
 
         # Run simplification passes
-        self._update_progress(65.0, text="Running simplifications 2")
+        self._update_progress(53.0, text="Running simplifications 2")
         ail_graph = self._run_simplification_passes(ail_graph, stage=OptimizationPassStage.AFTER_MAKING_CALLSITES)
 
         # Simplify the entire function for the second time
@@ -443,7 +450,8 @@ class Clinic(Analysis):
         self.externs = None
         self.data_refs: Dict[int, List[DataRefDesc]] = self._collect_data_refs(ail_graph)
 
-    def copy_graph(self) -> networkx.DiGraph:
+    @staticmethod
+    def _copy_graph(graph: networkx.DiGraph) -> networkx.DiGraph:
         """
         Copy AIL Graph.
 
@@ -452,7 +460,7 @@ class Clinic(Analysis):
         graph_copy = networkx.DiGraph()
         block_mapping = {}
         # copy all blocks
-        for block in self.graph.nodes():
+        for block in graph.nodes():
             new_block = copy.copy(block)
             new_stmts = copy.copy(block.statements)
             new_block.statements = new_stmts
@@ -460,12 +468,15 @@ class Clinic(Analysis):
             graph_copy.add_node(new_block)
 
         # copy all edges
-        for src, dst, data in self.graph.edges(data=True):
+        for src, dst, data in graph.edges(data=True):
             new_src = block_mapping[src]
             new_dst = block_mapping[dst]
             graph_copy.add_edge(new_src, new_dst, **data)
         return graph_copy
 
+    def copy_graph(self) -> networkx.DiGraph:
+        return self._copy_graph(self.graph)
+
     @timethis
     def _set_function_graph(self):
         self._func_graph = self.function.graph_ex(exception_edges=self._exception_edges)
@@ -926,6 +937,11 @@ class Clinic(Analysis):
             if pass_.STAGE != stage:
                 continue
 
+            if pass_ in DUPLICATING_OPTS + CONDENSING_OPTS and self.unoptimized_graph is None:
+                # we should save a copy at the first time any optimization that could alter the structure
+                # of the graph is applied
+                self.unoptimized_graph = self._copy_graph(ail_graph)
+
             a = pass_(
                 self.function,
                 blocks_by_addr=addr_to_blocks,

angr/analyses/decompiler/condition_processor.py

@@ -77,6 +77,12 @@ def _dummy_bvs(condition, condition_mapping, name_suffix=""):
     return var
 
 
+def _dummy_bools(condition, condition_mapping, name_suffix=""):
+    var = claripy.BoolS(f"ailexpr_{repr(condition)}{name_suffix}", explicit_name=True)
+    condition_mapping[var.args[0]] = condition
+    return var
+
+
 _ail2claripy_op_mapping = {
     "LogicalAnd": lambda expr, conv, _: claripy.And(conv(expr.operands[0]), conv(expr.operands[1])),
     "LogicalOr": lambda expr, conv, _: claripy.Or(conv(expr.operands[0]), conv(expr.operands[1])),
@@ -117,6 +123,7 @@ _ail2claripy_op_mapping = {
     "Carry": lambda expr, _, m: _dummy_bvs(expr, m),
     "SCarry": lambda expr, _, m: _dummy_bvs(expr, m),
     "SBorrow": lambda expr, _, m: _dummy_bvs(expr, m),
+    "ExpCmpNE": lambda expr, _, m: _dummy_bools(expr, m),
 }
 
 #
@@ -482,6 +489,8 @@ class ConditionProcessor:
                     continue
             raise EmptyBlockNotice()
         if type(block) is LoopNode:
+            if block.sequence_node is None:
+                raise EmptyBlockNotice()
             return cls.get_last_statements(block.sequence_node)
         if type(block) is ConditionalBreakNode:
             return [block]
@@ -757,6 +766,8 @@ class ConditionProcessor:
                 var = claripy.BoolV(condition.value)
             else:
                 var = claripy.BVV(condition.value, condition.bits)
+            if isinstance(var, claripy.Bits) and var.size() == 1:
+                var = claripy.true if var.concrete_value == 1 else claripy.false
             return var
         elif isinstance(condition, ailment.Expr.Tmp):
             l.warning("Left-over ailment.Tmp variable %s.", condition)

angr/analyses/decompiler/decompiler.py

@@ -63,6 +63,7 @@ class Decompiler(Analysis):
         decompile=True,
         regen_clinic=True,
         update_memory_data: bool = True,
+        generate_code: bool = True,
     ):
         if not isinstance(func, Function):
             func = self.kb.functions[func]
@@ -85,13 +86,15 @@ class Decompiler(Analysis):
         self._binop_operators = binop_operators
         self._regen_clinic = regen_clinic
         self._update_memory_data = update_memory_data
+        self._generate_code = generate_code
 
         self.clinic = None  # mostly for debugging purposes
         self.codegen: Optional["CStructuredCodeGenerator"] = None
         self.cache: Optional[DecompilationCache] = None
         self.options_by_class = None
-        self.seq_node = None
-        self.unmodified_clinic_graph = None
+        self.seq_node: Optional["SequenceNode"] = None
+        self.unoptimized_ail_graph: Optional[networkx.DiGraph] = None
+        self.ail_graph: Optional[networkx.DiGraph] = None
 
         if decompile:
             self._decompile()
@@ -185,9 +188,11 @@ class Decompiler(Analysis):
             # the function is empty
             return
 
-        # expose a copy of the graph before structuring optimizations happen
+        # expose a copy of the graph before any optimizations that may change the graph occur;
         # use this graph if you need a reference of exact mapping of instructions to AIL statements
-        self.unmodified_clinic_graph = clinic.copy_graph()
+        self.unoptimized_ail_graph = (
+            clinic.unoptimized_graph if clinic.unoptimized_graph is not None else clinic.copy_graph()
+        )
         cond_proc = ConditionProcessor(self.project.arch)
 
         clinic.graph = self._run_graph_simplification_passes(
@@ -212,54 +217,61 @@ class Decompiler(Analysis):
 
         # save the graph before structuring happens (for AIL view)
         clinic.cc_graph = remove_labels(clinic.copy_graph())
-        self._update_progress(75.0, text="Structuring code")
-
-        # structure it
-        rs = self.project.analyses[RecursiveStructurer].prep(kb=self.kb)(
-            ri.region,
-            cond_proc=cond_proc,
-            func=self.func,
-            **self._recursive_structurer_params,
-        )
-        self._update_progress(80.0, text="Simplifying regions")
 
-        # simplify it
-        s = self.project.analyses.RegionSimplifier(
-            self.func,
-            rs.result,
-            kb=self.kb,
-            variable_kb=clinic.variable_kb,
-            **self.options_to_params(self.options_by_class["region_simplifier"]),
-        )
-        seq_node = s.result
-        seq_node = self._run_post_structuring_simplification_passes(
-            seq_node, binop_operators=cache.binop_operators, goto_manager=s.goto_manager, graph=clinic.graph
-        )
-        self._update_progress(85.0, text="Generating code")
+        codegen = None
+        seq_node = None
+        # in the event that the decompiler is used without code generation as the target, we should avoid all
+        # heavy analysis that is used only for the purpose of code generation
+        if self._generate_code:
+            self._update_progress(75.0, text="Structuring code")
+
+            # structure it
+            rs = self.project.analyses[RecursiveStructurer].prep(kb=self.kb)(
+                ri.region,
+                cond_proc=cond_proc,
+                func=self.func,
+                **self._recursive_structurer_params,
+            )
+            self._update_progress(80.0, text="Simplifying regions")
+
+            # simplify it
+            s = self.project.analyses.RegionSimplifier(
+                self.func,
+                rs.result,
+                kb=self.kb,
+                variable_kb=clinic.variable_kb,
+                **self.options_to_params(self.options_by_class["region_simplifier"]),
+            )
+            seq_node = s.result
+            seq_node = self._run_post_structuring_simplification_passes(
+                seq_node, binop_operators=cache.binop_operators, goto_manager=s.goto_manager, graph=clinic.graph
+            )
+            # update memory data
+            if self._cfg is not None and self._update_memory_data:
+                self.find_data_references_and_update_memory_data(seq_node)
 
-        # update memory data
-        if self._cfg is not None and self._update_memory_data:
-            self.find_data_references_and_update_memory_data(seq_node)
+            self._update_progress(85.0, text="Generating code")
+            codegen = self.project.analyses.StructuredCodeGenerator(
+                self.func,
+                seq_node,
+                cfg=self._cfg,
+                ail_graph=clinic.graph,
+                flavor=self._flavor,
+                func_args=clinic.arg_list,
+                kb=self.kb,
+                variable_kb=clinic.variable_kb,
+                expr_comments=old_codegen.expr_comments if old_codegen is not None else None,
+                stmt_comments=old_codegen.stmt_comments if old_codegen is not None else None,
+                const_formats=old_codegen.const_formats if old_codegen is not None else None,
+                externs=clinic.externs,
+                **self.options_to_params(self.options_by_class["codegen"]),
+            )
 
-        codegen = self.project.analyses.StructuredCodeGenerator(
-            self.func,
-            seq_node,
-            cfg=self._cfg,
-            ail_graph=clinic.graph,
-            flavor=self._flavor,
-            func_args=clinic.arg_list,
-            kb=self.kb,
-            variable_kb=clinic.variable_kb,
-            expr_comments=old_codegen.expr_comments if old_codegen is not None else None,
-            stmt_comments=old_codegen.stmt_comments if old_codegen is not None else None,
-            const_formats=old_codegen.const_formats if old_codegen is not None else None,
-            externs=clinic.externs,
-            **self.options_to_params(self.options_by_class["codegen"]),
-        )
         self._update_progress(90.0, text="Finishing up")
-
         self.seq_node = seq_node
         self.codegen = codegen
+        # save a copy of the AIL graph that is optimized but not modified by region identification
+        self.ail_graph = clinic.cc_graph
         self.cache.codegen = codegen
         self.cache.clinic = self.clinic
 

angr/analyses/decompiler/optimization_passes/__init__.py

@@ -13,7 +13,8 @@ from .lowered_switch_simplifier import LoweredSwitchSimplifier
 from .multi_simplifier import MultiSimplifier
 from .div_simplifier import DivSimplifier
 from .mod_simplifier import ModSimplifier
-from .return_duplicator import ReturnDuplicator
+from .return_duplicator_low import ReturnDuplicatorLow
+from .return_duplicator_high import ReturnDuplicatorHigh
 from .const_derefs import ConstantDereferencesSimplifier
 from .register_save_area_simplifier import RegisterSaveAreaSimplifier
 from .ret_addr_save_simplifier import RetAddrSaveSimplifier
@@ -40,9 +41,10 @@ _all_optimization_passes = [
     (ITERegionConverter, True),
     (ITEExprConverter, True),
     (ExprOpSwapper, True),
+    (ReturnDuplicatorHigh, True),
     (SwitchDefaultCaseDuplicator, True),
-    (ReturnDuplicator, True),
     (LoweredSwitchSimplifier, False),
+    (ReturnDuplicatorLow, True),
     (ReturnDeduplicator, True),
     (CodeMotionOptimization, True),
     (CrossJumpReverter, True),
@@ -50,7 +52,7 @@ _all_optimization_passes = [
 ]
 
 # these passes may duplicate code to remove gotos or improve the structure of the graph
-DUPLICATING_OPTS = [ReturnDuplicator, CrossJumpReverter]
+DUPLICATING_OPTS = [ReturnDuplicatorLow, ReturnDuplicatorHigh, CrossJumpReverter]
 # these passes may destroy blocks by merging them into semantically equivalent blocks
 CONDENSING_OPTS = [CodeMotionOptimization, ReturnDeduplicator]
 
@@ -74,7 +76,9 @@ def get_optimization_passes(arch, platform):
     return passes
 
 
-def get_default_optimization_passes(arch: Union[Arch, str], platform: Optional[str]):
+def get_default_optimization_passes(
+    arch: Union[Arch, str], platform: Optional[str], enable_opts=None, disable_opts=None
+):
     if isinstance(arch, Arch):
         arch = arch.name
 
@@ -84,8 +88,10 @@ def get_default_optimization_passes(arch: Union[Arch, str], platform: Optional[s
         platform = "windows"  # sigh
 
     passes = []
+    enable_opts = enable_opts or []
+    disable_opts = disable_opts or []
     for pass_, default in _all_optimization_passes:
-        if not default:
+        if (not default and pass_ not in enable_opts) or pass_ in disable_opts:
             continue
         if (pass_.ARCHES is None or arch in pass_.ARCHES) and (
             pass_.PLATFORMS is None or platform is None or platform in pass_.PLATFORMS