angr.analyses.cfg.cfb

class angr.analyses.cfg.cfb.CFBlanketView

Bases: object

A view into the control-flow blanket.

__init__(cfb)
class angr.analyses.cfg.cfb.MemoryRegion

Bases: object

__init__(addr, size, type_, object_, cle_region)
class angr.analyses.cfg.cfb.Unknown

Bases: object

An unknown byte region in a control-flow blanket.

MAX_BYTES = 1616
__init__(addr, size, bytes_=None, object_=None, segment=None, section=None, loader=None)
property bytes

The bytes of this region, for display purposes. Lazily loaded on first access (and capped at MAX_BYTES) when a loader is available.

trimmed(new_start, new_size)

Create a copy of this region covering [new_start, new_start + new_size). Bytes that were already loaded are sliced instead of being loaded again.

Return type:

Unknown

Parameters:

  • new_start (int)

  • new_size (int)

class angr.analyses.cfg.cfb.CFBlanket

Bases: Analysis

A Control-Flow Blanket is a representation for storing all instructions, data entries, and bytes of a full program.

Region types: - section - segment - extern - tls - kernel

__init__(exclude_region_types=None, on_object_added=None, on_object_removed=None)
Parameters:

  • on_object_added (Callable[[int, Any], None] | None) – Callable with parameters (addr, obj) called after an object is added to the blanket.

  • on_object_removed (Callable[[int, Any], None] | None) – Callable with parameters (addr, obj) called after an object is removed from the blanket.

  • exclude_region_types (set[str] | None)

property regions

Return all memory regions.

floor_addr(addr)
Return type:

int

Parameters:

addr (int)

floor_item(addr)
Return type:

tuple[int, Any]

Parameters:

addr (int)

floor_items(addr=None, reverse=False)
ceiling_addr(addr)
Return type:

int

Parameters:

addr (int)

ceiling_item(addr)
Return type:

tuple[int, Any]

Parameters:

addr (int)

ceiling_items(addr=None, reverse=False, include_first=True)
add_obj(addr, obj)

Add an object obj to the blanket at the specified address addr, keeping the blanket non-overlapping: existing objects that overlap [addr, addr + obj.size) are removed or trimmed, and the trimmed-off remainders are re-inserted. Objects without an integer size are stored as zero-span entries and never cause trimming.

remove_obj(addr, fill=True)

Remove the object at addr from the blanket. When fill is set (the default), the removed object’s span is re-filled with an Unknown region so that the blanket remains a total cover of the mapped address space. Removing a missing address is a no-op.

Returns:

The removed object, or None if no object exists at addr.

Parameters:

fill (bool)

add_function(func)

Add a function func and all blocks of this function to the blanket.

dbg_repr()

The debugging representation of this CFBlanket.

Returns:

The debugging representation of this CFBlanket.

Return type:

str