angr.analyses.decompiler.stl_field_accessors¶
Named accessors for fields of the C++ STL classes registered in the
cpp::std SimTypeCollection.
The KnownPattern machinery (see angr.analyses.decompiler.known_patterns)
recognizes inlined STL idioms structurally, before variable recovery, and
outlines them into calls such as std::string::length(s). That approach has a
hard floor: the smallest accessors compile to a single word-sized load at a
fixed offset. std::string::c_str() on libstdc++ is exactly mov (%rcx),
%rcx, byte-identical to std::vector<T>::data(), unique_ptr::get(),
and every other pointer-field dereference in the program. No structural pattern
can tell them apart, and one that tried would fire on unrelated code constantly.
The information that does distinguish them only exists later: once an anchor
pattern (length/capacity/empty/…) has fired anywhere in the
function, Typehoon types the container pointer as the corresponding cpp::std
class, and every other access to it is resolved to a named field. Naming those
accesses after their accessors adds no guess of its own. It inherits exactly
the confidence of the recovered type, so it can never fire on a pointer that
type inference did not already call an STL container, and it does inherit a
wrong type: where an anchor pattern mistyped the container, the accessor name
is wrong in the same way the field name was.
This module holds the field -> accessor table used to name those already-typed accesses. Only fields whose value is the accessor’s return value are listed:
m_capacityis libstdc++’s_M_allocated_capacity, which is the active member of a union only for heap-allocated strings, so a raw read of it is notcapacity().m_end_of_storagehas no accessor of its own (capacity()is a subtraction), so it is not listed either.
- angr.analyses.decompiler.stl_field_accessors.stl_accessor_name(ty, field_name)¶
Return the fully qualified accessor name for reading
field_nameout ofty, e.g."std::string::c_str"for them_datafield ofstd::string, orNonewhentyis not a registeredcpp::stdclass or the field has no equivalent accessor.The lookup is keyed on
SimCppClass.unique_nameand additionally requires that name to be registered in thecpp::stdtype collection, so a user-defined struct that happens to have a field calledm_datacan never match.