angr.analyses.decompiler.stl_field_accessors

Named accessors for fields of the C++ STL classes registered in the cpp::std SimTypeCollection.

The KnownPattern machinery (see angr.analyses.decompiler.known_patterns) recognizes inlined STL idioms structurally, before variable recovery, and outlines them into calls such as std::string::length(s). That approach has a hard floor: the smallest accessors compile to a single word-sized load at a fixed offset. std::string::c_str() on libstdc++ is exactly mov (%rcx), %rcx, byte-identical to std::vector<T>::data(), unique_ptr::get(), and every other pointer-field dereference in the program. No structural pattern can tell them apart, and one that tried would fire on unrelated code constantly.

The information that does distinguish them only exists later: once an anchor pattern (length/capacity/empty/…) has fired anywhere in the function, Typehoon types the container pointer as the corresponding cpp::std class, and every other access to it is resolved to a named field. Naming those accesses after their accessors adds no guess of its own. It inherits exactly the confidence of the recovered type, so it can never fire on a pointer that type inference did not already call an STL container, and it does inherit a wrong type: where an anchor pattern mistyped the container, the accessor name is wrong in the same way the field name was.

This module holds the field -> accessor table used to name those already-typed accesses. Only fields whose value is the accessor’s return value are listed:

  • m_capacity is libstdc++’s _M_allocated_capacity, which is the active member of a union only for heap-allocated strings, so a raw read of it is not capacity().

  • m_end_of_storage has no accessor of its own (capacity() is a subtraction), so it is not listed either.

angr.analyses.decompiler.stl_field_accessors.stl_accessor_name(ty, field_name)

Return the fully qualified accessor name for reading field_name out of ty, e.g. "std::string::c_str" for the m_data field of std::string, or None when ty is not a registered cpp::std class or the field has no equivalent accessor.

The lookup is keyed on SimCppClass.unique_name and additionally requires that name to be registered in the cpp::std type collection, so a user-defined struct that happens to have a field called m_data can never match.

Return type:

str | None

Parameters: