angr.ailment

class angr.ailment.AILBlockRewriter

Bases: AILBlockWalker[Expression, Statement, Block]

Walks all statements and expressions of an AIL node, and rebuilds expressions, statements, or blocks if needed.

If you need a pure walker without rebuilding, use AILBlockViewer instead.

Variables:

• update_block – True if the block should be updated in place, False if a new block should be created and returned as the result of walk().

• replace_phi_stmt – True if you want _handle_Phi be called and vvars potentially replaced; False otherwise. Default to False because in the most majority cases you do not want vvars in a Phi variable be replaced.

__init__(stmt_handlers=None, expr_handlers=None, update_block=True, replace_phi_stmt=False)

Parameters:

• update_block (bool)

• replace_phi_stmt (bool)

class angr.ailment.AILBlockViewer

Bases: AILBlockWalker[None, None, None]

Walks all statements and expressions of an AIL node and do nothing.

class angr.ailment.AILBlockWalker

Bases: Generic

Walks all statements and expressions of an AIL node and construct arbitrary values based on them.

__init__(stmt_handlers=None, expr_handlers=None)

walk(block)

Return type:

TypeVar(BlockType)

Parameters:

block (Block)

walk_statement(stmt, block=None, stmt_idx=0)

Return type:

TypeVar(StmtType)

Parameters:

• stmt (Statement)

• block (Block | None)

• stmt_idx (int)

walk_expression(expr, stmt_idx=None, stmt=None, block=None)

Return type:

TypeVar(ExprType)

Parameters:

• expr (Expression)

• stmt_idx (int | None)

• stmt (Statement | None)

• block (Block | None)

class angr.ailment.Assignment

Bases: Statement

Assignment statement: expr_a = expr_b

__init__(idx, dst, src, **kwargs)

Parameters:

• idx (int)

• dst (Atom)

• src (Expression)

dst

src

likes(other)

matches(other)

replace(old_expr, new_expr)

Parameters:

• old_expr (Expression)

• new_expr (Expression)

property depth

copy()

Return type:

Assignment

deep_copy(manager)

Return type:

Assignment

class angr.ailment.BinaryOp

Bases: Op

OPSTR_MAP = {'Add': '+', 'AddF': '+', 'AddV': '+', 'And': '&', 'Carry': 'CARRY', 'CmpEQ': '==', 'CmpF': 'CmpF', 'CmpGE': '>=', 'CmpGE (signed)': '>=s', 'CmpGT': '>', 'CmpGT (signed)': '>s', 'CmpLE': '<=', 'CmpLE (signed)': '<=s', 'CmpLT': '<', 'CmpLT (signed)': '<s', 'CmpNE': '!=', 'Concat': 'CONCAT', 'Div': '/', 'DivF': '/', 'LogicalAnd': '&&', 'LogicalOr': '||', 'Mod': '%', 'Mul': '*', 'MulF': '*', 'MulV': '*', 'Or': '|', 'Rol': 'ROL', 'Ror': 'ROR', 'SBorrow': 'SBORROW', 'SCarry': 'SCARRY', 'Sar': '>>a', 'Shl': '<<', 'Shr': '>>', 'Sub': '-', 'SubF': '-', 'Xor': '^'}

COMPARISON_NEGATION = {'CmpEQ': 'CmpNE', 'CmpGE': 'CmpLT', 'CmpGT': 'CmpLE', 'CmpLE': 'CmpGT', 'CmpLT': 'CmpGE', 'CmpNE': 'CmpEQ'}

__init__(idx, op, operands, signed=False, *, variable=None, variable_offset=None, bits=None, floating_point=False, rounding_mode=None, vector_count=None, vector_size=None, **kwargs)

Parameters:

• idx (int)

• op (str)

• operands (Sequence[Expression])

• signed (bool)

• vector_count (int | None)

• vector_size (int | None)

operands

signed

variable

variable_offset

floating_point

rounding_mode: str | None

vector_count

vector_size

likes(other)

matches(other)

has_atom(atom, identity=True)

replace(old_expr, new_expr)

Return type:

tuple[bool, BinaryOp]

Parameters:

• old_expr (Expression)

• new_expr (Expression)

property verbose_op

copy()

Return type:

BinaryOp

deep_copy(manager)

Return type:

BinaryOp

class angr.ailment.Block

Bases: object

Describes an AIL block.

__str__ should be fast because Phoenix uses networkx graph filters, and graph filters may print str(block) in some cases, e.g., https://github.com/networkx/networkx/blob/861718f8aadeed4f742a348f0c437396cacdf180/networkx/classes/coreviews.py#L305

__init__(addr, original_size, statements=None, idx=None)

Parameters:

• addr (int)

• statements (list[Statement] | None)

• idx (int | None)

addr

original_size

statements: list[Statement]

idx

copy(statements=None)

deep_copy(manager)

Parameters:

manager (Manager)

property sort_key: tuple[int, int, int]

dbg_repr(indent=0)

pp()

Return type:

None

likes(other)

clear_hash()

class angr.ailment.Const

Bases: Atom

__init__(idx, variable, value, bits, **kwargs)

Parameters:

• idx (int)

• value (int | float)

• bits (int)

value

property value_int: int

property value_float: float

likes(other)

matches(other)

property sign_bit

copy()

Return type:

Const

deep_copy(manager)

Return type:

Const

property is_int: bool

class angr.ailment.Expression

Bases: TaggedObject, ABC

The base class of all AIL expressions.

bits: int

__init__(idx, depth, **kwargs)

Parameters:

idx (int)

depth

property size

has_atom(atom, identity=True)

abstractmethod likes(other)

abstractmethod matches(other)

replace(old_expr, new_expr)

Return type:

tuple[bool, Self]

Parameters:

• old_expr (Expression)

• new_expr (Expression)

class angr.ailment.IRSBConverter

Bases: Converter

static convert(irsb, manager)

Convert the given IRSB to an AIL block

Parameters:

• irsb – The IRSB to convert

• manager – The manager to use

Returns:

Returns the converted block

class angr.ailment.Manager

Bases: object

__init__(name=None, arch=None)

Parameters:

name (str | None)

next_atom()

reset()

property ins_addr: int | None

class angr.ailment.PCodeIRSBConverter

Bases: Converter

Converts a p-code IRSB to an AIL block

static convert(irsb, manager)

Convert the given IRSB to an AIL block

Parameters:

• irsb (IRSB) – IRSB to convert

• manager (Manager) – Manager to use

Returns:

Converted block

__init__(irsb, manager)

Parameters:

• irsb (IRSB)

• manager (Manager)

class angr.ailment.Register

Bases: Atom

__init__(idx, variable, reg_offset, bits, **kwargs)

Parameters:

• idx (int)

• reg_offset (int)

• bits (int)

reg_offset

likes(other)

matches(other)

copy()

Return type:

Register

deep_copy(manager)

Return type:

Register

class angr.ailment.Statement

Bases: TaggedObject, ABC

The base class of all AIL statements.

abstractmethod replace(old_expr, new_expr)

Return type:

tuple[bool, Self]

Parameters:

• old_expr (Expression)

• new_expr (Expression)

eq(expr0, expr1)

abstractmethod likes(other)

Return type:

bool

abstractmethod matches(other)

Return type:

bool

abstract property depth: int

class angr.ailment.Tmp

Bases: Atom

__init__(idx, variable, tmp_idx, bits, **kwargs)

Parameters:

• idx (int)

• tmp_idx (int)

tmp_idx

likes(other)

matches(other)

copy()

Return type:

Tmp

deep_copy(manager)

Return type:

Tmp

class angr.ailment.UnaryOp

Bases: Op

__init__(idx, op, operand, variable=None, variable_offset=None, bits=None, **kwargs)

Parameters:

• idx (int)

• op (str)

• operand (Expression)

• variable_offset (int | None)

operand

variable

variable_offset

likes(other)

matches(other)

replace(old_expr, new_expr)

property operands

copy()

Return type:

UnaryOp

deep_copy(manager)

Return type:

UnaryOp

has_atom(atom, identity=True)

class angr.ailment.VEXIRSBConverter

Bases: Converter

static convert(irsb, manager)

Parameters:

• irsb

• manager

Returns:

Submodules

block
block_walker
constant
converter_common
converter_pcode
converter_vex
expression
manager
statement
tagged_object
utils