angr.analyses.forward_analysis

class angr.analyses.forward_analysis.CallGraphVisitor

Bases: GraphVisitor

Parameters:

callgraph (networkx.DiGraph)

__init__(callgraph)
class angr.analyses.forward_analysis.ForwardAnalysis

Bases: Generic

This is my very first attempt to build a static forward analysis framework that can serve as the base of multiple static analyses in angr, including CFG analysis, VFG analysis, DDG, etc.

In short, ForwardAnalysis performs a forward data-flow analysis by traversing a graph, compute on abstract values, and store results in abstract states. The user can specify what graph to traverse, how a graph should be traversed, how abstract values and abstract states are defined, etc.

ForwardAnalysis has a few options to toggle, making it suitable to be the base class of several different styles of forward data-flow analysis implementations.

ForwardAnalysis supports a special mode when no graph is available for traversal (for example, when a CFG is being initialized and constructed, no other graph can be used). In that case, the graph traversal functionality is disabled, and the optimal graph traversal order is not guaranteed. The user can provide a job sorting method to sort the jobs in queue and optimize traversal order.

Feel free to discuss with me (Fish) if you have any suggestions or complaints.

__init__(order_jobs=False, allow_merging=False, allow_widening=False, status_callback=None, graph_visitor=None)

Constructor

Parameters:

  • order_jobs (bool) – If all jobs should be ordered or not.

  • allow_merging (bool) – If job merging is allowed.

  • allow_widening (bool) – If job widening is allowed.

  • graph_visitor (Optional[GraphVisitor[TypeVar(NodeType)]]) – A graph visitor to provide successors.

  • status_callback (Callable[[ForwardAnalysis], Any] | None)

Returns:

None

property should_abort

Should the analysis be terminated. :return: True/False

property graph: DiGraph
property jobs
abort()

Abort the analysis :return: None

has_job(job)

Checks whether there exists another job which has the same job key. :type job: TypeVar(JobType) :param job: The job to check.

Return type:

bool

Returns:

True if there exists another job with the same key, False otherwise.

Parameters:

job (JobType)

downsize()
class angr.analyses.forward_analysis.FunctionGraphVisitor

Bases: GraphVisitor

Parameters:

func (knowledge.Function)

__init__(func, graph=None)
resume_with_new_graph(graph)

We can only reasonably reuse existing results if the node index of the already traversed nodes are the same as the ones from the new graph. Otherwise, we always restart.

Return type:

bool

Returns:

True if we are resuming, False if reset() is called.

Parameters:

graph (DiGraph)

class angr.analyses.forward_analysis.LoopVisitor

Bases: GraphVisitor

Parameters:

loop (angr.analyses.loopfinder.Loop) – The loop to visit.

__init__(loop)
class angr.analyses.forward_analysis.SingleNodeGraphVisitor

Bases: GraphVisitor

Parameters:

node – The single node that should be in the graph.

__init__(node)
node
node_returned

Submodules

forward_analysis

job_info

visitors