angr.ailment.expression¶

class angr.ailment.expression.Expression¶

Bases: TaggedObject, ABC

The base class of all AIL expressions.

bits: int

__init__(idx, depth, **kwargs)¶

Parameters:: idx (int)

depth

property size¶

has_atom(atom, identity=True)¶

abstractmethod likes(other)¶

abstractmethod matches(other)¶

replace(old_expr, new_expr)¶

Return type:

tuple[bool, Self]

Parameters:

old_expr (Expression)
new_expr (Expression)

class angr.ailment.expression.Atom¶

Bases: Expression

__init__(idx, variable=None, variable_offset=0, **kwargs)¶

Parameters:: idx (int)

variable

variable_offset

class angr.ailment.expression.Const¶

Bases: Atom

__init__(idx, variable, value, bits, **kwargs)¶

Parameters:

idx (int)
value (int | float)
bits (int)

value

property value_int: int¶

property value_float: float¶

likes(other)¶

matches(other)¶

property sign_bit¶

copy()¶

Return type:: Const

deep_copy(manager)¶

Return type:: Const

property is_int: bool¶

class angr.ailment.expression.Tmp¶

Bases: Atom

__init__(idx, variable, tmp_idx, bits, **kwargs)¶

Parameters:

idx (int)
tmp_idx (int)

tmp_idx

likes(other)¶

matches(other)¶

copy()¶

Return type:: Tmp

deep_copy(manager)¶

Return type:: Tmp

class angr.ailment.expression.Register¶

Bases: Atom

__init__(idx, variable, reg_offset, bits, **kwargs)¶

Parameters:

idx (int)
reg_offset (int)
bits (int)

reg_offset

likes(other)¶

matches(other)¶

copy()¶

Return type:: Register

deep_copy(manager)¶

Return type:: Register

class angr.ailment.expression.ComboRegister¶

Bases: Atom

__init__(idx, variable, registers, **kwargs)¶

Parameters:: registers (list[Register | VirtualVariable])

property size¶

likes(other)¶

matches(other)¶

copy()¶

Return type:: ComboRegister

variable

variable_offset

class angr.ailment.expression.VirtualVariableCategory¶

Bases: IntEnum

REGISTER = 0¶

STACK = 1¶

MEMORY = 2¶

PARAMETER = 3¶

TMP = 4¶

COMBO_REGISTER = 5¶

UNKNOWN = 6¶

__new__(value)

class angr.ailment.expression.VirtualVariable¶

Bases: Atom

__init__(idx, varid, bits, category, oident=None, **kwargs)¶

Parameters:

varid (int)
category (VirtualVariableCategory)
oident (int | str | tuple | None)

varid

category

oident

reg_vvars

property was_reg: bool¶

property was_stack: bool¶

property was_parameter: bool¶

property was_tmp: bool¶

property was_combo_reg: bool¶

property reg_offset: int¶

property reg_offsets: tuple¶

property stack_offset: int¶

property tmp_idx: int | None¶

property parameter_category: VirtualVariableCategory | None¶

property parameter_reg_offset: int | None¶

property parameter_stack_offset: int | None¶

likes(other)¶

matches(other)¶

copy()¶

Return type:: VirtualVariable

deep_copy(manager)¶

Return type:: VirtualVariable

class angr.ailment.expression.Phi¶

Bases: Atom

__init__(idx, bits, src_and_vvars, **kwargs)¶

Parameters:: src_and_vvars (list[tuple[tuple[int, int | None], VirtualVariable | None]])

src_and_vvars

property op: str¶

property verbose_op: str¶

likes(other)¶

Return type:: bool

matches(other)¶

Return type:: bool

copy()¶

Return type:: Phi

deep_copy(manager)¶

Return type:: Phi

replace(old_expr, new_expr)¶

class angr.ailment.expression.Op¶

Bases: Expression

__init__(idx, depth, op, **kwargs)¶

Parameters:: op (str)

op

property verbose_op¶

class angr.ailment.expression.UnaryOp¶

Bases: Op

__init__(idx, op, operand, variable=None, variable_offset=None, bits=None, **kwargs)¶

Parameters:

idx (int)
op (str)
operand (Expression)
variable_offset (int | None)

operand

variable

variable_offset

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

property operands¶

copy()¶

Return type:: UnaryOp

deep_copy(manager)¶

Return type:: UnaryOp

has_atom(atom, identity=True)¶

class angr.ailment.expression.ConvertType¶

Bases: Enum

TYPE_INT = 0¶

TYPE_FP = 1¶

class angr.ailment.expression.Convert¶

Bases: UnaryOp

TYPE_INT = 0¶

TYPE_FP = 1¶

__init__(idx, from_bits, to_bits, is_signed, operand, from_type=ConvertType.TYPE_INT, to_type=ConvertType.TYPE_INT, rounding_mode=None, **kwargs)¶

Parameters:

idx (int)
from_bits (int)
to_bits (int)
is_signed (bool)
operand (Expression)
from_type (ConvertType)
to_type (ConvertType)

from_bits

to_bits

is_signed

from_type

to_type

rounding_mode

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

copy()¶

Return type:: Convert

deep_copy(manager)¶

Return type:: Convert

class angr.ailment.expression.Reinterpret¶

Bases: UnaryOp

__init__(idx, from_bits, from_type, to_bits, to_type, operand, **kwargs)¶

Parameters:

from_bits (int)
from_type (str)
to_bits (int)
to_type (str)

from_bits

from_type

to_bits

to_type

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

copy()¶

Return type:: Reinterpret

deep_copy(manager)¶

Return type:: Reinterpret

class angr.ailment.expression.BinaryOp¶

Bases: Op

OPSTR_MAP = {'Add': '+', 'AddF': '+', 'AddV': '+', 'And': '&', 'Carry': 'CARRY', 'CmpEQ': '==', 'CmpF': 'CmpF', 'CmpGE': '>=', 'CmpGE (signed)': '>=s', 'CmpGT': '>', 'CmpGT (signed)': '>s', 'CmpLE': '<=', 'CmpLE (signed)': '<=s', 'CmpLT': '<', 'CmpLT (signed)': '<s', 'CmpNE': '!=', 'Concat': 'CONCAT', 'Div': '/', 'DivF': '/', 'LogicalAnd': '&&', 'LogicalOr': '||', 'Mod': '%', 'Mul': '*', 'MulF': '*', 'MulV': '*', 'Or': '|', 'Rol': 'ROL', 'Ror': 'ROR', 'SBorrow': 'SBORROW', 'SCarry': 'SCARRY', 'Sar': '>>a', 'Shl': '<<', 'Shr': '>>', 'Sub': '-', 'SubF': '-', 'Xor': '^'}¶

COMPARISON_NEGATION = {'CmpEQ': 'CmpNE', 'CmpGE': 'CmpLT', 'CmpGT': 'CmpLE', 'CmpLE': 'CmpGT', 'CmpLT': 'CmpGE', 'CmpNE': 'CmpEQ'}¶

__init__(idx, op, operands, signed=False, *, variable=None, variable_offset=None, bits=None, floating_point=False, rounding_mode=None, vector_count=None, vector_size=None, **kwargs)¶

Parameters:

idx (int)
op (str)
operands (Sequence[Expression])
signed (bool)
vector_count (int | None)
vector_size (int | None)

operands

signed

variable

variable_offset

floating_point

rounding_mode: str | None

vector_count

vector_size

likes(other)¶

matches(other)¶

has_atom(atom, identity=True)¶

replace(old_expr, new_expr)¶

Return type:

tuple[bool, BinaryOp]

Parameters:

old_expr (Expression)
new_expr (Expression)

property verbose_op¶

copy()¶

Return type:: BinaryOp

deep_copy(manager)¶

Return type:: BinaryOp

class angr.ailment.expression.Load¶

Bases: Expression

__init__(idx, addr, size, endness, variable=None, variable_offset=None, guard=None, alt=None, **kwargs)¶

Parameters:

idx (int)
addr (Expression)
size (int)
endness (str)

addr

endness

guard

alt

variable

variable_offset

has_atom(atom, identity=True)¶

replace(old_expr, new_expr)¶

likes(other)¶

matches(other)¶

copy()¶

Return type:: Load

deep_copy(manager)¶

Return type:: Load

class angr.ailment.expression.ITE¶

Bases: Expression

__init__(idx, cond, iffalse, iftrue, variable=None, variable_offset=None, **kwargs)¶

Parameters:

idx (int)
cond (Expression)
iffalse (Expression)
iftrue (Expression)

cond

iffalse

iftrue

variable

variable_offset

likes(other)¶

matches(other)¶

has_atom(atom, identity=True)¶

replace(old_expr, new_expr)¶

copy()¶

Return type:: ITE

deep_copy(manager)¶

Return type:: ITE

class angr.ailment.expression.DirtyExpression¶

Bases: Expression

__init__(idx, callee, operands, *, guard=None, mfx=None, maddr=None, msize=None, bits, **kwargs)¶

Parameters:

callee (str)
operands (list[Expression])
guard (Expression | None)
mfx (str | None)
maddr (Expression | None)
msize (int | None)
bits (int)

callee

guard

operands

mfx

maddr

msize

property op: str¶

property verbose_op: str¶

likes(other)¶

matches(other)¶

copy()¶

Return type:: DirtyExpression

deep_copy(manager)¶

Return type:: DirtyExpression

replace(old_expr, new_expr)¶

Parameters:

old_expr (Expression)
new_expr (Expression)

class angr.ailment.expression.VEXCCallExpression¶

Bases: Expression

__init__(idx, callee, operands, bits, **kwargs)¶

Parameters:

idx (int)
callee (str)
operands (tuple[Expression, ...])
bits (int)

callee

operands

property op: str¶

property verbose_op: str¶

likes(other)¶

matches(other)¶

copy()¶

Return type:: VEXCCallExpression

deep_copy(manager)¶

Return type:: VEXCCallExpression

replace(old_expr, new_expr)¶

class angr.ailment.expression.MultiStatementExpression¶

Bases: Expression

For representing comma-separated statements and expression in C.

__init__(idx, stmts, expr, **kwargs)¶

Parameters:

idx (int)
stmts (list[Statement])
expr (Expression)

stmts

expr

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

copy()¶

Return type:: MultiStatementExpression

deep_copy(manager)¶

Return type:: MultiStatementExpression

class angr.ailment.expression.BasePointerOffset¶

Bases: Expression

__init__(idx, bits, base, offset, variable=None, variable_offset=None, **kwargs)¶

Parameters:

idx (int)
bits (int)
base (Expression | str)
offset (int)

base

offset

variable

variable_offset

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

copy()¶

Return type:: BasePointerOffset

deep_copy(manager)¶

Return type:: BasePointerOffset

class angr.ailment.expression.StackBaseOffset¶

Bases: BasePointerOffset

__init__(idx, bits, offset, **kwargs)¶

Parameters:

idx (int)
bits (int)
offset (int)

copy()¶

Return type:: StackBaseOffset

deep_copy(manager)¶

Return type:: StackBaseOffset

angr.ailment.expression.negate(expr, manager)¶

Return type:

Expression

Parameters:

expr (Expression)
manager (Manager)

class angr.ailment.expression.Extract¶

Bases: Expression

__init__(idx, bits, base, offset, endness, **kwargs)¶

Parameters:

idx (int)
bits (int)
base (Expression)
offset (Expression)
endness (str)

base

offset

endness

is_lsb_extract()¶

Return type:: bool

copy()¶

Return type:: Extract

deep_copy(manager)¶

Return type:: Extract

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

class angr.ailment.expression.Insert¶

Bases: Expression

__init__(idx, base, offset, value, endness, **kwargs)¶

Parameters:

idx (int)
base (Expression)
offset (Expression)
value (Expression)
endness (str)

base

offset

value

endness

is_lsb_overwrite()¶

Return type:: bool

copy()¶

Return type:: Insert

deep_copy(manager)¶

Return type:: Insert

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

class angr.ailment.expression.Call¶

Bases: Expression

Call expression. Represents a function call that produces a value.

When used as a standalone statement (not part of an assignment), wrap it in a SideEffectStatement.

__init__(idx, target, calling_convention=None, prototype=None, args=None, bits=None, **kwargs)¶

Parameters:

idx (int)
target (Expression | str)
calling_convention (SimCC | None)
prototype (SimTypeFunction | None)
args (Sequence[Expression] | None)
bits (int | None)

target

calling_convention

prototype

args

likes(other)¶

matches(other)¶

property verbose_op: str¶

property op: str¶

has_atom(atom, identity=True)¶

replace(old_expr, new_expr)¶

Parameters:

old_expr (Expression)
new_expr (Expression)

copy()¶

deep_copy(manager)¶

class angr.ailment.expression.StringLiteral¶

Bases: Expression

__init__(idx, data, bits, **kwargs)¶

data

property size¶

likes(other)¶

copy()¶

deep_copy(manager)¶

replace(old_expr, new_expr)¶

Return type:

tuple[bool, Self]

Parameters:

old_expr (Expression)
new_expr (Expression)

matches(other)¶

class angr.ailment.expression.Struct¶

Bases: Expression

__init__(idx, name, fields, field_offsets, bits, **kwargs)¶

name

fields

field_offsets

field_names

get_field(name)¶

property size¶

likes(other)¶

copy()¶

deep_copy(manager)¶

replace(old_expr, new_expr)¶

matches(other)¶

class angr.ailment.expression.RustEnum¶

Bases: Expression

__init__(idx, name, fields, bits, **kwargs)¶

bits: int

property size¶

likes(other)¶

copy()¶

deep_copy(manager)¶

replace(old_expr, new_expr)¶

matches(other)¶

depth

class angr.ailment.expression.Array¶

Bases: Expression

__init__(idx, elements, bits, **kwargs)¶

bits: int

property size¶

property length¶

likes(other)¶

copy()¶

deep_copy(manager)¶

replace(old_expr, new_expr)¶

matches(other)¶

depth

class angr.ailment.expression.Let¶

Bases: Op

__init__(idx, variant, defs, src, **kwargs)¶

variant

defs

src

likes(other)¶

matches(other)¶

copy()¶

deep_copy(manager)¶

class angr.ailment.expression.Macro¶

Bases: Call, ABC

__init__(idx, name, delimiter='()', returnty=None, **kwargs)¶

Parameters:: name (str)

name

delimiter

returnty

class angr.ailment.expression.FunctionLikeMacro¶

Bases: Macro

__init__(idx, name, args, bits=None, delimiter='()', returnty=None, **kwargs)¶

Parameters:: name (str)

property size: int¶

likes(other)¶

matches(other)¶

copy()¶

deep_copy(manager)¶

property verbose_op¶

property op¶