angr.analyses.decompiler.condition_processor

class angr.analyses.decompiler.condition_processor.AILExprIdAnnotation

Bases: Annotation

An annotation that we use to annotate BVVs so that they are differentiable between other BVVs with the same value and size.

eliminatable = True
relocatable = False
class angr.analyses.decompiler.condition_processor.ConditionProcessor

Bases: object

Convert between claripy AST and AIL expressions. Also calculates reaching conditions of all nodes on a graph.

__init__(arch, ail_manager, condition_mapping=None)
Parameters:

ail_manager (Manager)

jump_table_conds: dict[int, set]
edge_conditions: dict[tuple[Any, Any], Bool]
clear()
have_opposite_edge_conditions(graph, src, dst0, dst1)

Check if the edge conditions of two edges (src, dst0) and (src, dst1) are opposite to each other. Try to avoid condition translation if possible.

Return type:

bool

Parameters:

graph (DiGraph)

recover_edge_condition(graph, src, dst)
Parameters:

graph (DiGraph)

recover_edge_conditions(region, graph=None)
Return type:

dict

recover_reaching_conditions(region, graph=None, with_successors=False, case_entry_to_switch_head=None, simplify_conditions=True, with_guarding_conditions=True)

Recover the reaching conditions for each block in an acyclic graph. Note that we assume the graph that’s passed in is acyclic.

Edge conditions are stored in self.edge_conditions. Guarding conditions are only needed by structurers that consume them (Dream, DuplicationReverter); pass with_guarding_conditions=False to skip computing them.

Parameters:

  • case_entry_to_switch_head (dict[int, int] | None)

  • simplify_conditions (bool)

  • with_guarding_conditions (bool)

remove_claripy_bool_asts(node)
classmethod get_last_statement(block)

This is the buggy version of get_last_statements, because, you know, there can always be more than one last statement due to the existence of branching statements (like, If-then-else). All methods using get_last_statement() should switch to get_last_statements() and properly handle multiple last statements.

classmethod get_last_statements(block)
Return type:

list[Statement | ConditionalBreakNode | BreakNode | ContinueNode | None]

EXC_COUNTER = 1000
convert_claripy_bool_ast(cond)

Convert recovered reaching conditions from claripy ASTs to ailment Expressions.

Within one outermost conversion (or one remove_claripy_bool_asts() traversal) subtrees are memoized by claripy hash, so a shared subtree is converted once. The memo does not outlive the call: a leaf converts to whatever AIL expression _condition_mapping currently holds, and later translations may replace that entry with an equivalent expression of a different idx, which codegen types differently.

Peephole rules are applied bottom-up as nodes are built: children are already optimized when their parent is converted, so only the new node needs checking, and the subtree is re-walked only when a rule rewrites it.

convert_claripy_bool_ast_core(cond)
claripy_ast_from_ail_condition(condition, *, nobool=False, must_bool=False, ins_addr=0)
Return type:

Bool | Bits

Parameters:
static simplify_condition(cond, depth_limit=8, variables_limit=8)
create_jump_target_var(jumptable_head_addr)
Parameters:

jumptable_head_addr (int)