angr.analyses.decompiler.pattern_match.finder

FuzzyPatternFinder: discover fuzzy repeated code in a decompiled function.

class angr.analyses.decompiler.pattern_match.finder.PatternOccurrence

Bases: object

One occurrence of a discovered pattern, with its outlining verdict.

interval: Interval
region: Region
property outlinable: bool
property block_locs: list[tuple[int, int]]
__init__(interval, region)
Parameters:
Return type:

None

angr.analyses.decompiler.pattern_match.finder.STATEMENTS_ANY = 'any'

statements of an occurrence may come from anywhere in the function’s block order

angr.analyses.decompiler.pattern_match.finder.STATEMENTS_FOLLOW = 'follow'

an occurrence continues only into a block that follows in the control flow

angr.analyses.decompiler.pattern_match.finder.STATEMENTS_CONSECUTIVE = 'consecutive'

consecutive lines of the pseudocode

Type:

an occurrence is one straight run of code

class angr.analyses.decompiler.pattern_match.finder.FuzzyPattern

Bases: object

A family of near-duplicate regions, plus the sub-ranges they share exactly.

cluster: PatternCluster
occurrences: list[PatternOccurrence]
cores: list[ExactCore]
core_occurrences: list[list[PatternOccurrence]]
property identity: float
property size: int
property savings: float
property sound_savings: int

Tokens removable without changing semantics, i.e. via the exact cores.

property outlinable_occurrences: list[PatternOccurrence]
__init__(cluster, occurrences, cores=<factory>, core_occurrences=<factory>)
Parameters:
Return type:

None

class angr.analyses.decompiler.pattern_match.finder.FuzzyPatternFinder

Bases: Analysis

Find fuzzy repeated code in an AIL graph.

Duplicated inlined code (obfuscator-generated decryption stubs, expanded macros, copies of an inlined helper) is rarely byte-identical: constants differ per site and optimizers reorder and reassociate. Exact matching finds nothing, so this analysis linearizes the graph into a canonical token stream and runs a sparse local self-alignment over it (see align).

Two tiers of result are produced. patterns holds the fuzzy families, which is what you want to understand a function. Each family also carries cores: the sub-ranges its members agree on exactly, which is what you can soundly merge into a single shared function.

Parameters:

  • func (Function) – The function being analyzed.

  • ail_graph (networkx.DiGraph[Block]) – Its AIL graph, e.g. Decompiler.ail_graph.

  • params (AlignParams | None) – Alignment knobs; see AlignParams.

  • disjoint (bool) – Keep only a non-overlapping subset of families (what outlining needs). all_patterns always has the full list.

  • min_core_len (int) – Shortest exact core worth reporting.

  • resolve_calls (bool) – Render call targets by callee name, which makes calls strong anchors for the aligner.

__init__(func, ail_graph, *, params=None, disjoint=True, min_core_len=4, min_core_support=2, max_depth=5, const_mode='abstract', skip_labels=True, skip_phis=True, skip_dephi=True, resolve_calls=True, entry=None, low_priority=False, checkpoint=None, statements='any')
Parameters:
statements

how the statements of one occurrence may follow each other; see STATEMENTS_MODES

stream: TokenStream
all_patterns: list[FuzzyPattern]
patterns: list[FuzzyPattern]
summary(limit=20)

A human-readable report of what was found.

Return type:

str

Parameters:

limit (int)