angr.ailment.statement¶

class angr.ailment.statement.Statement¶

Bases: TaggedObject, ABC

The base class of all AIL statements.

abstractmethod replace(old_expr, new_expr)¶

Return type:

tuple[bool, Self]

Parameters:

old_expr (Expression)
new_expr (Expression)

eq(expr0, expr1)¶

abstractmethod likes(other)¶

Return type:: bool

abstractmethod matches(other)¶

Return type:: bool

abstract property depth: int¶

class angr.ailment.statement.Assignment¶

Bases: Statement

Assignment statement: expr_a = expr_b

__init__(idx, dst, src, **kwargs)¶

Parameters:

idx (int)
dst (Atom)
src (Expression)

dst

src

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

Parameters:

old_expr (Expression)
new_expr (Expression)

property depth¶

copy()¶

Return type:: Assignment

deep_copy(manager)¶

Return type:: Assignment

class angr.ailment.statement.WeakAssignment¶

Bases: Statement

An assignment statement that does not create a new variable at its destination; It should be seen as operator=(&dst, &src) in C++-like syntax.

__init__(idx, dst, src, **kwargs)¶

Parameters:

idx (int)
dst (Atom)
src (Expression)

dst

src

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

Parameters:

old_expr (Expression)
new_expr (Expression)

property depth¶

copy()¶

Return type:: WeakAssignment

deep_copy(manager)¶

Return type:: WeakAssignment

class angr.ailment.statement.Store¶

Bases: Statement

Store statement: *addr = data

__init__(idx, addr, data, size, endness, guard=None, variable=None, offset=None, **kwargs)¶

Parameters:

idx (int)
addr (Expression)
data (Expression)
size (int)
endness (str)
guard (Expression | None)

addr

data

size

endness

variable

guard

offset

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

property depth¶

copy()¶

Return type:: Store

deep_copy(manager)¶

Return type:: Store

class angr.ailment.statement.Jump¶

Bases: Statement

Jump statement: goto target

__init__(idx, target, target_idx=None, **kwargs)¶

Parameters:

idx (int)
target (Expression)
target_idx (int | None)

target

target_idx

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

property depth¶

copy()¶

deep_copy(manager)¶

class angr.ailment.statement.ConditionalJump¶

Bases: Statement

if (cond) {true_target} else {false_target}

__init__(idx, condition, true_target, false_target, true_target_idx=None, false_target_idx=None, **kwargs)¶

Parameters:

idx (int)
condition (Expression)
true_target (Expression | None)
false_target (Expression | None)
true_target_idx (int | None)
false_target_idx (int | None)

condition

true_target

false_target

true_target_idx

false_target_idx

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

property depth¶

copy()¶

Return type:: ConditionalJump

deep_copy(manager)¶

Return type:: ConditionalJump

class angr.ailment.statement.SideEffectStatement¶

Bases: Statement

A statement wrapping an expression that has side effects (e.g., a function call).

When wrapping a Call expression, ret_expr and fp_ret_expr hold the return value destinations.

__init__(idx, expr, ret_expr=None, fp_ret_expr=None, **kwargs)¶

Parameters:

idx (int)
expr (Call)
ret_expr (Expression | None)
fp_ret_expr (Expression | None)

expr

ret_expr

fp_ret_expr

property bits¶

property size¶

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

Parameters:

old_expr (Expression)
new_expr (Expression)

property depth¶

copy()¶

Return type:: SideEffectStatement

deep_copy(manager)¶

Return type:: SideEffectStatement

class angr.ailment.statement.Return¶

Bases: Statement

Return statement: (return expr_a), (return)

__init__(idx, ret_exprs, **kwargs)¶

Parameters:

idx (int)
ret_exprs (Iterable[Expression])

ret_exprs

likes(other)¶

matches(other)¶

replace(old_expr, new_expr)¶

property depth¶

copy()¶

deep_copy(manager)¶

class angr.ailment.statement.CAS¶

Bases: Statement

Atomic compare-and-swap.

*_lo and *_hi are used to represent the low and high parts of a 128-bit CAS operation; *_hi is None if the CAS operation works on values that are less than or equal to 64 bits.

addr: The address to be compared and swapped. data: The value to be written if the comparison is successful. expd: The expected value to be compared against. old: The value that is currently stored at addr before compare-and-swap; it will be returned after compare-and-swap.

__init__(idx, addr, data_lo, data_hi, expd_lo, expd_hi, old_lo, old_hi, endness, **kwargs)¶

Parameters:

idx (int)
addr (Expression)
data_lo (Expression)
data_hi (Expression | None)
expd_lo (Expression)
expd_hi (Expression | None)
old_lo (Atom)
old_hi (Atom | None)
endness (str)

addr

data_lo

data_hi

expd_lo

expd_hi

old_lo

old_hi

endness

replace(old_expr, new_expr)¶

Return type:

tuple[bool, CAS]

Parameters:

old_expr (Expression)
new_expr (Expression)

property depth: int¶

copy()¶

Return type:: CAS

deep_copy(manager)¶

Return type:: CAS

likes(other)¶

Return type:: bool

matches(other)¶

Return type:: bool

property bits: int¶

property size: int¶

class angr.ailment.statement.DirtyStatement¶

Bases: Statement

Wrapper around the original statement, which is usually not convertible (temporarily).

__init__(idx, dirty, **kwargs)¶

Parameters:

idx (int)
dirty (DirtyExpression)

dirty

replace(old_expr, new_expr)¶

property depth: int¶

copy()¶

Return type:: DirtyStatement

deep_copy(manager)¶

Return type:: DirtyStatement

likes(other)¶

matches(other)¶

class angr.ailment.statement.Label¶

Bases: Statement

A dummy statement that indicates a label with a name.

__init__(idx, name, **kwargs)¶

Parameters:

idx (int)
name (str)

name

likes(other)¶

Parameters:: other (Label)

replace(old_expr, new_expr)¶

property depth: int¶

matches(other)¶

Parameters:: other (Label)

copy()¶

Return type:: Label

deep_copy(manager)¶

Return type:: Label