angr.analyses.decompiler.variable_map

angr.analyses.decompiler.variable_map.variable_map_of(manager)

Return the VariableMap attached to an ailment Manager, lazily creating and attaching an empty one if the manager does not have a map yet (e.g. Managers constructed outside of Clinic in tests). This keeps consumers that reach the map through manager.variable_map from having to special-case None.

Return type:

VariableMap

Parameters:

manager (Manager)

class angr.analyses.decompiler.variable_map.VariableMap

Bases: object

A side container that maps the .idx of AIL Statement and Expression objects to variable-related information.

The following pieces of information are tracked:

  • variable (a SimVariable) and variable_offset (an int): the variable that an AIL atom resolves to, and the offset into that variable.

  • custom_string (a bool): whether a Const expression refers to a custom string.

  • reference_values (a dict mapping SimType to a value): reference values associated with a Const expression (e.g., custom strings).

  • reference_variable (a SimVariable) and reference_variable_offset (an int): the variable that a constant expression references, and the offset into it. These are siblings of variable / variable_offset that are specifically used for constants that reference global/extern variables.

  • prototype (a SimTypeFunction) and calling_convention (a SimCC): the call-site prototype and calling convention associated with an AIL Call expression. These used to live directly on the Call object; they are heavy, non-serializable Python references, so they are tracked here instead.

  • variant (an EnumVariant): the enum variant that a Rust Let expression binds.

  • returnty (a SimType): the return type of a Rust FunctionLikeMacro call.

Keys are the integer .idx values of AIL Statement/Expression objects. Because Clinic builds one ailment.Manager per invocation, .idx values are unique within a single Clinic. So a VariableMap is scoped to one Clinic instance and is stored in the corresponding DecompilationCache.

__init__()
variable(obj)
Return type:

SimVariable | None

Parameters:

obj (TaggedObject | int)

variable_offset(obj)
Return type:

int

Parameters:

obj (TaggedObject | int)

custom_string(obj)
Return type:

bool

Parameters:

obj (TaggedObject | int)

reference_values(obj)
Return type:

dict[SimType, Any] | None

Parameters:

obj (TaggedObject | int)

reference_variable(obj)
Return type:

SimVariable | None

Parameters:

obj (TaggedObject | int)

reference_variable_offset(obj)
Return type:

int

Parameters:

obj (TaggedObject | int)

has_variable(obj)
Return type:

bool

Parameters:

obj (TaggedObject | int)

prototype(obj)
Return type:

SimTypeFunction | None

Parameters:

obj (TaggedObject | int)

calling_convention(obj)
Return type:

SimCC | None

Parameters:

obj (TaggedObject | int)

variant(obj)
Return type:

Any

Parameters:

obj (TaggedObject | int)

returnty(obj)
Return type:

SimType | None

Parameters:

obj (TaggedObject | int)

set_variable(obj, variable, offset=0)

Set the variable information for an AIL atom. If variable is None, the variable information for this atom is cleared.

Return type:

None

Parameters:
set_variable_offset(obj, offset)
Return type:

None

Parameters:
set_custom_string(obj, value=True)
Return type:

None

Parameters:
set_reference_values(obj, reference_values)
Return type:

None

Parameters:
set_reference_variable(obj, variable, offset=0)

Set the reference variable information for an AIL atom. If variable is None, the reference variable information for this atom is cleared.

Return type:

None

Parameters:
set_prototype(obj, prototype)

Set the call-site prototype for an AIL Call. If prototype is None, the prototype information for this atom is cleared.

Return type:

None

Parameters:
set_calling_convention(obj, cc)

Set the calling convention for an AIL Call. If cc is None, the calling-convention information for this atom is cleared.

Return type:

None

Parameters:
set_variant(obj, variant)

Set the enum variant for a Rust Let expression. If variant is None, the variant information for this atom is cleared.

Return type:

None

Parameters:
set_returnty(obj, returnty)

Set the return type for a Rust FunctionLikeMacro call. If returnty is None, the return-type information for this atom is cleared.

Return type:

None

Parameters:
transfer(src, dst)

Copy all variable information associated with src to dst. Used when an AIL atom is deep-copied to a new .idx (e.g. during structuring/duplication) so that the new atom keeps the same variable association.

Return type:

None

Parameters:
to_json()

Serialize this VariableMap to a JSON-compatible object.

Variables are referenced by their .ident (reference-by-ident); they must be resolved back to SimVariable objects via a resolver in from_json().

Return type:

dict[str, Any]

classmethod from_json(data, resolve_variable)

Deserialize a VariableMap from a JSON-compatible object produced by to_json().

Parameters:

  • data (dict[str, Any]) – The JSON object.

  • resolve_variable (Callable[[str], SimVariable | None]) – A callable that maps a variable ident (str) to a SimVariable (or None if it cannot be resolved).

Return type:

VariableMap