angr 9.2.96__py3-none-win_amd64.whl → 9.2.98__py3-none-win_amd64.whl

angr/knowledge_plugins/key_definitions/live_definitions.py

@@ -49,11 +49,12 @@ class DefinitionAnnotation(Annotation):
     An annotation that attaches a `Definition` to an AST.
     """
 
-    __slots__ = ("definition",)
+    __slots__ = ("definition", "_hash")
 
     def __init__(self, definition):
         super().__init__()
         self.definition = definition
+        self._hash = hash((DefinitionAnnotation, self.definition))
 
     @property
     def relocatable(self):
@@ -64,15 +65,11 @@ class DefinitionAnnotation(Annotation):
         return False
 
     def __hash__(self):
-        return hash((self.definition, self.relocatable, self.eliminatable))
+        return self._hash
 
     def __eq__(self, other: "object"):
-        if isinstance(other, DefinitionAnnotation):
-            return (
-                self.definition == other.definition
-                and self.relocatable == other.relocatable
-                and self.eliminatable == other.eliminatable
-            )
+        if type(other) is DefinitionAnnotation:
+            return self.definition == other.definition
         else:
             return False
 
@@ -129,6 +126,7 @@ class LiveDefinitions:
         memory_uses=None,
         tmp_uses=None,
         other_uses=None,
+        element_limit=5,
     ):
         self.project: Optional["Project"] = None
         self.arch = arch
@@ -139,9 +137,11 @@ class LiveDefinitions:
             MultiValuedMemory(
                 memory_id="reg",
                 top_func=self.top,
+                is_top_func=self.is_top,
                 skip_missing_values_during_merging=False,
                 page_kwargs={"mo_cmp": self._mo_cmp},
                 endness=self.arch.register_endness,
+                element_limit=element_limit,
             )
             if registers is None
             else registers
@@ -150,8 +150,10 @@ class LiveDefinitions:
             MultiValuedMemory(
                 memory_id="mem",
                 top_func=self.top,
+                is_top_func=self.is_top,
                 skip_missing_values_during_merging=False,
                 page_kwargs={"mo_cmp": self._mo_cmp},
+                element_limit=element_limit,
             )
             if stack is None
             else stack
@@ -160,8 +162,10 @@ class LiveDefinitions:
             MultiValuedMemory(
                 memory_id="mem",
                 top_func=self.top,
+                is_top_func=self.is_top,
                 skip_missing_values_during_merging=False,
                 page_kwargs={"mo_cmp": self._mo_cmp},
+                element_limit=element_limit,
             )
             if memory is None
             else memory
@@ -170,8 +174,10 @@ class LiveDefinitions:
             MultiValuedMemory(
                 memory_id="mem",
                 top_func=self.top,
+                is_top_func=self.is_top,
                 skip_missing_values_during_merging=False,
                 page_kwargs={"mo_cmp": self._mo_cmp},
+                element_limit=element_limit,
             )
             if heap is None
             else heap
@@ -464,6 +470,33 @@ class LiveDefinitions:
 
         return state, merge_occurred
 
+    def compare(self, other: "LiveDefinitions") -> bool:
+        r0 = self.registers.compare(other.registers)
+        if r0 is False:
+            return False
+        r1 = self.heap.compare(other.heap)
+        if r1 is False:
+            return False
+        r2 = self.memory.compare(other.memory)
+        if r2 is False:
+            return False
+        r3 = self.stack.compare(other.stack)
+        if r3 is False:
+            return False
+
+        r4 = True
+        for k in other.others:
+            if k in self.others:
+                thing = self.others[k].merge(other.others[k])
+                if thing != self.others[k]:
+                    r4 = False
+                    break
+            else:
+                r4 = False
+                break
+
+        return r0 and r1 and r2 and r3 and r4
+
     def kill_definitions(self, atom: Atom) -> None:
         """
         Overwrite existing definitions w.r.t 'atom' with a dummy definition instance. A dummy definition will not be

angr/knowledge_plugins/key_definitions/uses.py

@@ -21,10 +21,14 @@ class Uses:
         uses_by_location: Optional[DefaultChainMapCOW] = None,
     ):
         self._uses_by_definition: DefaultChainMapCOW["Definition", Set[Tuple[CodeLocation, Optional[Any]]]] = (
-            DefaultChainMapCOW(set, collapse_threshold=25) if uses_by_definition is None else uses_by_definition
+            DefaultChainMapCOW(default_factory=set, collapse_threshold=25)
+            if uses_by_definition is None
+            else uses_by_definition
         )
         self._uses_by_location: DefaultChainMapCOW[CodeLocation, Set[Tuple["Definition", Optional[Any]]]] = (
-            DefaultChainMapCOW(set, collapse_threshold=25) if uses_by_location is None else uses_by_location
+            DefaultChainMapCOW(default_factory=set, collapse_threshold=25)
+            if uses_by_location is None
+            else uses_by_location
         )
 
     def add_use(self, definition: "Definition", codeloc: CodeLocation, expr: Optional[Any] = None):
@@ -35,7 +39,9 @@ class Uses:
         :param codeloc:     The code location where the use occurs.
         :param expr:        The expression that uses the specified definition at this location.
         """
+        self._uses_by_definition = self._uses_by_definition.clean()
         self._uses_by_definition[definition].add((codeloc, expr))
+        self._uses_by_location = self._uses_by_location.clean()
         self._uses_by_location[codeloc].add((definition, expr))
 
     def get_uses(self, definition: "Definition") -> Set[CodeLocation]:
@@ -65,6 +71,7 @@ class Uses:
         """
         if definition in self._uses_by_definition:
             if codeloc in self._uses_by_definition[definition]:
+                self._uses_by_definition = self._uses_by_definition.clean()
                 if expr is None:
                     for codeloc_, expr_ in list(self._uses_by_definition[definition]):
                         if codeloc_ == codeloc:
@@ -73,6 +80,7 @@ class Uses:
                     self._uses_by_definition[definition].remove((codeloc, expr))
 
         if codeloc in self._uses_by_location:
+            self._uses_by_location = self._uses_by_location.clean()
             for item in list(self._uses_by_location[codeloc]):
                 if item[0] == definition:
                     self._uses_by_location[codeloc].remove(item)
@@ -85,9 +93,11 @@ class Uses:
         :return:            None
         """
         if definition in self._uses_by_definition:
+            self._uses_by_definition = self._uses_by_definition.clean()
             codeloc_and_ids = self._uses_by_definition[definition]
             del self._uses_by_definition[definition]
 
+            self._uses_by_location = self._uses_by_location.clean()
             for codeloc, _ in codeloc_and_ids:
                 for item in list(self._uses_by_location[codeloc]):
                     if item[0] == definition:
@@ -149,18 +159,22 @@ class Uses:
 
         for k, v in other._uses_by_definition.items():
             if k not in self._uses_by_definition:
+                self._uses_by_definition = self._uses_by_definition.clean()
                 self._uses_by_definition[k] = v
                 merge_occurred = True
             elif not v.issubset(self._uses_by_definition[k]):
                 merge_occurred = True
-                self._uses_by_definition[k] |= v
+                self._uses_by_definition = self._uses_by_definition.clean()
+                self._uses_by_definition[k] = self._uses_by_definition[k] | v
 
         for k, v in other._uses_by_location.items():
             if k not in self._uses_by_location:
+                self._uses_by_location = self._uses_by_location.clean()
                 self._uses_by_location[k] = v
                 merge_occurred = True
             elif not v.issubset(self._uses_by_location[k]):
                 merge_occurred = True
-                self._uses_by_location[k] |= v
+                self._uses_by_location = self._uses_by_location.clean()
+                self._uses_by_location[k] = self._uses_by_location[k] | v
 
         return merge_occurred

angr/knowledge_plugins/propagations/states.py

@@ -221,9 +221,10 @@ class PropagatorState:
                         merge_occurred = True
                     else:
                         if PropagatorState.is_top(repl) or PropagatorState.is_top(replacements_0[loc][var]):
-                            t = PropagatorState.top(_get_repl_size(repl))
-                            replacements_0[loc][var] = t
-                            merge_occurred = True
+                            if not PropagatorState.is_top(replacements_0[loc][var]):
+                                t = PropagatorState.top(_get_repl_size(repl))
+                                replacements_0[loc][var] = t
+                                merge_occurred = True
                         elif (
                             isinstance(replacements_0[loc][var], claripy.ast.Base) or isinstance(repl, claripy.ast.Base)
                         ) and replacements_0[loc][var] is not repl:
@@ -316,6 +317,12 @@ class RegisterAnnotation(claripy.Annotation):
     def relocatable(self) -> bool:
         return True
 
+    def __hash__(self):
+        return hash((RegisterAnnotation, self.offset, self.size))
+
+    def __eq__(self, other):
+        return type(other) is RegisterAnnotation and self.offset == other.offset and self.size == other.size
+
 
 class RegisterComparisonAnnotation(claripy.Annotation):
     """
@@ -336,6 +343,18 @@ class RegisterComparisonAnnotation(claripy.Annotation):
     def relocatable(self) -> bool:
         return True
 
+    def __hash__(self):
+        return hash((RegisterComparisonAnnotation, self.offset, self.size, self.cmp_op, self.value))
+
+    def __eq__(self, other):
+        return (
+            type(other) is RegisterAnnotation
+            and self.offset == other.offset
+            and self.size == other.size
+            and self.cmp_op == other.cmp_op
+            and self.value == other.value
+        )
+
 
 class PropagatorVEXState(PropagatorState):
     """

angr/knowledge_plugins/types.py

@@ -56,6 +56,12 @@ class TypesStore(KnowledgeBasePlugin, UserDict):
         yield from super().__iter__()
         yield from iter(ALL_TYPES)
 
+    def __getstate__(self):
+        return self.data  # do not pickle self.kb
+
+    def __setstate__(self, state):
+        self.data = state
+
     def iter_own(self):
         """
         Iterate over all the names which are stored in this object - i.e. ``values()`` without ``ALL_TYPES``

angr/knowledge_plugins/variables/variable_manager.py

@@ -122,7 +122,32 @@ class VariableManagerInternal(Serializable):
         self.__dict__.update(state)
 
     def __getstate__(self):
-        d = dict(self.__dict__)
+        attributes = [
+            "func_addr",
+            "_variables",
+            "_global_region",
+            "_stack_region",
+            "_register_region",
+            "_live_variables",
+            "_variable_accesses",
+            "_insn_to_variable",
+            "_stmt_to_variable",
+            "_variable_to_stmt",
+            "_atom_to_variable",
+            "_ident_to_variable",
+            "_variable_counters",
+            "_unified_variables",
+            "_variables_to_unified_variables",
+            "_phi_variables",
+            "_variables_to_phivars",
+            "_phi_variables_by_block",
+            "types",
+            "variable_to_types",
+            "variables_with_manual_types",
+            "_variables_without_writes",
+            "ret_val_size",
+        ]
+        d = {k: getattr(self, k) for k in attributes}
         d["manager"] = None
         d["types"].kb = None
         return d
@@ -759,10 +784,11 @@ class VariableManagerInternal(Serializable):
             if variable in self._phi_variables:
                 # a phi variable is definitely not an input variable
                 continue
-            accesses = self._variable_accesses[variable]
-            if has_read_access(accesses):
-                if not exclude_specials or not variable.category:
-                    input_variables.append(variable)
+            if variable in self._variable_accesses:
+                accesses = self._variable_accesses[variable]
+                if has_read_access(accesses):
+                    if not exclude_specials or not variable.category:
+                        input_variables.append(variable)
 
         return input_variables
 

angr/simos/simos.py

@@ -277,6 +277,8 @@ class SimOS:
 
         if state.arch.name == "PPC64" and toc is not None:
             state.regs.r2 = toc
+        elif state.arch.name in ("MIPS32", "MIPS64"):
+            state.regs.t9 = addr
 
         return state
 

angr/storage/memory_mixins/__init__.py

@@ -67,6 +67,9 @@ class MemoryMixin(SimStatePlugin):
     def merge(self, others, merge_conditions, common_ancestor=None) -> bool:
         pass
 
+    def compare(self, other) -> bool:
+        pass
+
     def widen(self, others):
         pass
 

angr/storage/memory_mixins/multi_value_merger_mixin.py

@@ -1,13 +1,17 @@
+# pylint:disable=missing-class-docstring
 from typing import Iterable, Tuple, Any, Callable, Optional
 
 from . import MemoryMixin
 
 
 class MultiValueMergerMixin(MemoryMixin):
-    def __init__(self, *args, element_limit=5, annotation_limit=256, top_func=None, phi_maker=None, **kwargs):
+    def __init__(
+        self, *args, element_limit=5, annotation_limit=256, top_func=None, is_top_func=None, phi_maker=None, **kwargs
+    ):
         self._element_limit = element_limit
         self._annotation_limit = annotation_limit
         self._top_func: Callable = top_func
+        self._is_top_func: Callable = is_top_func
         self._phi_maker: Optional[Callable] = phi_maker
 
         super().__init__(*args, **kwargs)
@@ -20,18 +24,23 @@ class MultiValueMergerMixin(MemoryMixin):
                 return {phi_var}
 
         # try to merge it in the traditional way
-        if len(values_set) > self._element_limit:
-            # strip annotations from each value and see how many raw values there are in total
-            # We have to use cache_key to determine uniqueness here, because if __hash__ collides,
-            # python implicitly calls __eq__ to determine if the two objects are actually the same
-            # and that just results in a new AST for a BV. Python then tries to convert that AST to a bool
-            # which fails with the safeguard in claripy.ast.bool.Bool.__bool__.
-            stripped_values_set = {v._apply_to_annotations(lambda alist: None).cache_key for v in values_set}
-            if len(stripped_values_set) > 1:
+        has_top = any(self._is_top_func(v) for v in values_set)
+        if has_top or len(values_set) > self._element_limit:
+            if has_top:
                 ret_val = self._top_func(merged_size * self.state.arch.byte_width)
             else:
-                # Get the AST back from the cache_key
-                ret_val = next(iter(stripped_values_set)).ast
+                # strip annotations from each value and see how many raw values there are in total
+                # We have to use cache_key to determine uniqueness here, because if __hash__ collides,
+                # python implicitly calls __eq__ to determine if the two objects are actually the same
+                # and that just results in a new AST for a BV. Python then tries to convert that AST to a bool
+                # which fails with the safeguard in claripy.ast.bool.Bool.__bool__.
+                stripped_values_set = {v._apply_to_annotations(lambda alist: None).cache_key for v in values_set}
+                if len(stripped_values_set) > 1:
+                    ret_val = self._top_func(merged_size * self.state.arch.byte_width)
+                else:
+                    # Get the AST back from the cache_key
+                    ret_val = next(iter(stripped_values_set)).ast
+
             # migrate annotations
             annotations = []
             annotations_set = set()
@@ -41,6 +50,7 @@ class MultiValueMergerMixin(MemoryMixin):
                         annotations.append(anno)
                         annotations_set.add(anno)
             if annotations:
+                annotations = sorted(annotations, key=str)
                 ret_val = ret_val.annotate(*annotations[: self._annotation_limit])
             merged_val = {ret_val}
         else:
@@ -52,5 +62,6 @@ class MultiValueMergerMixin(MemoryMixin):
         copied._element_limit = self._element_limit
         copied._annotation_limit = self._annotation_limit
         copied._top_func = self._top_func
+        copied._is_top_func = self._is_top_func
         copied._phi_maker = self._phi_maker
         return copied

angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py

@@ -294,6 +294,24 @@ class PagedMemoryMixin(MemoryMixin):
 
         return bool(merged_bytes)
 
+    def compare(self, other: "PagedMemoryMixin") -> bool:
+        changed_pages_and_offsets: Dict[int, Optional[Set[int]]] = dict(self.changed_pages(other))
+
+        for page_no in sorted(changed_pages_and_offsets):
+            page = self._get_page(page_no, False)
+            page_addr = page_no * self.page_size
+            if page_no in other._pages:
+                r = page.compare(
+                    other._pages[page_no],
+                    page_addr=page_addr,
+                    memory=self,
+                    changed_offsets=changed_pages_and_offsets[page_no],
+                )
+                if r is False:
+                    return False
+
+        return True
+
     def permissions(self, addr, permissions=None, **kwargs):
         if type(addr) is not int:
             raise TypeError("addr must be an int in paged memory")
@@ -643,10 +661,10 @@ class LabeledPagesMixin(PagedMemoryMixin):
         if endness is None:
             endness = self.endness
 
-        if type(size) is not int:
+        if not isinstance(size, int):
             raise TypeError("Need size to be resolved to an int by this point")
 
-        if type(addr) is not int:
+        if not isinstance(addr, int):
             raise TypeError("Need addr to be resolved to an int by this point")
 
         pageno, pageoff = self._divide_addr(addr)

angr/storage/memory_mixins/paged_memory/pages/list_page.py

@@ -2,6 +2,8 @@
 import logging
 from typing import Optional, List, Set, Tuple
 
+import claripy
+
 from angr.utils.dynamic_dictlist import DynamicDictList
 from angr.storage.memory_object import SimMemoryObject, SimLabeledMemoryObject
 from . import PageBase
@@ -192,9 +194,14 @@ class ListPage(MemoryObjectMixin, PageBase):
                 merged_offsets.add(b)
 
             else:
-                # get the size that we can merge easily. This is the minimum of
-                # the size of all memory objects and unallocated spaces.
-                min_size = min([mo.length - (b + page_addr - mo.base) for mo, _ in memory_objects])
+                # get the size that we can merge easily. This is the minimum of the size of all memory objects and
+                # unallocated spaces.
+                min_size = None
+                mask = (1 << memory.state.arch.bits) - 1
+                for mo, _ in memory_objects:
+                    mo_size = mo.length - ((b + page_addr - mo.base) & mask)
+                    if min_size is None or mo_size < min_size:
+                        min_size = mo_size
                 for um, _ in unconstrained_in:
                     for i in range(0, min_size):
                         if um._contains(b + i, page_addr):
@@ -263,15 +270,23 @@ class ListPage(MemoryObjectMixin, PageBase):
                 differences.add(c)
             else:
                 if self.content[c] is None:
+                    if self.sinkhole is None:
+                        v = claripy.BVV(0, 8)
+                    else:
+                        v = (self.sinkhole.bytes_at(page_addr + c, 1),)
                     self.content[c] = SimMemoryObject(
-                        self.sinkhole.bytes_at(page_addr + c, 1),
+                        v,
                         page_addr + c,
                         byte_width=byte_width,
                         endness="Iend_BE",
                     )
                 if other.content[c] is None:
+                    if other.sinkhole is None:
+                        v = claripy.BVV(0, 8)
+                    else:
+                        v = (other.sinkhole.bytes_at(page_addr + c, 1),)
                     other.content[c] = SimMemoryObject(
-                        other.sinkhole.bytes_at(page_addr + c, 1),
+                        v,
                         page_addr + c,
                         byte_width=byte_width,
                         endness="Iend_BE",