angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink

class angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceToSink

Bases: object

The representation of a slice of a CFG.

__init__(target, transitions=None)
Parameters:

  • target (angr.knowledge_plugins.functions.function.Function) – The targeted sink, to which every path in the slice leads.

  • transitions (Dict[int,List[int]]) – A mapping representing transitions in the graph. Indexes are source addresses and values a list of destination addresses, for which there exists a transition in the slice from source to destination.

property transitions

The transitions in the slice.

Type:

return Dict[int,List[int]]

property transitions_as_tuples

The list of transitions as pairs of (source, destination).

Type:

return List[Tuple[int,int]]

property target

return angr.knowledge_plugins.functions.function.Function: The targeted sink function, from which the slice is constructed.

property nodes: list[int]

The complete list of addresses present in the slice.

Type:

return

property entrypoints

Entrypoints are all source addresses that are not the destination address of any transition.

Return List[int]:

The list of entrypoints addresses.

add_transitions(transitions)

Add the given transitions to the current slice.

Parameters:

transitions (Dict[int,List[int]]) – The list of transitions to be added to self.transitions.

Return Dict[int,List[int]]:

Return the updated list of transitions.

is_empty()

Test if a given slice does not contain any transition.

Return bool:

True if the <CFGSliceToSink> instance does not contain any transitions. False otherwise.

path_between(source, destination, visited=None)

Check the existence of a path in the slice between two given node addresses.

Parameters:

  • source (int) – The source address.

  • destination (int) – The destination address.

  • visited (set[Any] | None) – Used to avoid infinite recursion if loops are present in the slice.

Return type:

bool

Returns:

True if there is a path between the source and the destination in the CFG, False if not, or if we have been unable to decide (because of loops).