angr.analyses.reaching_definitions.dep_graph

class angr.analyses.reaching_definitions.dep_graph.DepGraph

Bases: object

The representation of a dependency graph: a directed graph, where nodes are definitions, and edges represent uses.

Mostly a wrapper around a <networkx.DiGraph>.

__init__(graph=None)
Parameters:

graph – A graph where nodes are definitions, and edges represent uses.

property graph: networkx.DiGraph[Definition]
add_node(node)
Parameters:

node (Definition) – The definition to add to the definition-use graph.

Return type:

None

add_edge(source, destination, **labels)

The edge to add to the definition-use graph. Will create nodes that are not yet present.

Parameters:

  • source (Definition) – The “source” definition, used by the “destination”.

  • destination (Definition) – The “destination” definition, using the variable defined by “source”.

  • labels – Optional keyword arguments to represent edge labels.

Return type:

None

nodes()
Return type:

Iterator[Definition]

predecessors(node)
Parameters:

node (Definition) – The definition to get the predecessors of.

Return type:

Iterator[Definition]

transitive_closure(definition)

Compute the “transitive closure” of a given definition. Obtained by transitively aggregating the ancestors of this definition in the graph.

Note: Each definition is memoized to avoid any kind of recomputation across the lifetime of this object.

Parameters:

definition – The Definition to get transitive closure for.

Returns:

A graph of the transitive closure of the given definition.

Return type:

networkx.DiGraph[Definition[Atom]]

contains_atom(atom)
Return type:

bool

Parameters:

atom (Atom)

add_dependencies_for_concrete_pointers_of(values, definition, cfg, loader)

When a given definition holds concrete pointers, make sure the <MemoryLocation>s they point to are present in the dependency graph; Adds them if necessary.

Parameters:

  • values (Iterable[Base | int])

  • definition (Definition) – The definition which has data that can contain concrete pointers.

  • cfg (CFGModel | None) – The CFG, containing information about memory data.

  • loader (Loader)

find_definitions(**kwargs)
Overloads:

  • self, kind (type[A]), kwargs (Any) → list[Definition[A]]

  • self, kind (Literal[AtomKind.REGISTER]), kwargs (Any) → list[Definition[Register]]

  • self, kind (Literal[AtomKind.MEMORY]), kwargs (Any) → list[Definition[MemoryLocation]]

  • self, kind (Literal[AtomKind.TMP]), kwargs (Any) → list[Definition[Tmp]]

  • self, kind (Literal[AtomKind.CONSTANT]), kwargs (Any) → list[Definition[ConstantSrc]]

  • self, kind (Literal[AtomKind.GUARD]), kwargs (Any) → list[Definition[GuardUse]]

  • self, reg_name (int | str), kwargs (Any) → list[Definition[Register]]

  • self, stack_offset (int), kwargs (Any) → list[Definition[MemoryLocation]]

  • self, const_val (int), kwargs (Any) → list[Definition[ConstantSrc]]

Return type:

list[Definition]

Filter the definitions present in the graph based on various criteria. Parameters can be any valid keyword args to DefinitionMatchPredicate

find_all_predecessors(starts, **kwargs)
Overloads:

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), kind (type[A]), kwargs (Any) → list[Definition[A]]

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), kind (Literal[AtomKind.REGISTER]), kwargs (Any) → list[Definition[Register]]

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), kind (Literal[AtomKind.MEMORY]), kwargs (Any) → list[Definition[MemoryLocation]]

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), kind (Literal[AtomKind.TMP]), kwargs (Any) → list[Definition[Tmp]]

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), kind (Literal[AtomKind.CONSTANT]), kwargs (Any) → list[Definition[ConstantSrc]]

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), kind (Literal[AtomKind.GUARD]), kwargs (Any) → list[Definition[GuardUse]]

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), reg_name (int | str), kwargs (Any) → list[Definition[Register]]

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), stack_offset (int), kwargs (Any) → list[Definition[MemoryLocation]]

  • self, starts (Definition[Atom] | Iterable[Definition[Atom]]), const_val (int), kwargs (Any) → list[Definition[ConstantSrc]]

Filter the ancestors of the given start node or nodes that match various criteria. Parameters can be any valid keyword args to DefinitionMatchPredicate

find_all_successors(starts, **kwargs)

Filter the descendents of the given start node or nodes that match various criteria. Parameters can be any valid keyword args to DefinitionMatchPredicate

Return type:

list[Definition]

Parameters:

starts (Definition | Iterable[Definition])

find_path(starts, ends, **kwargs)

Find a path between the given start node or nodes and the given end node or nodes. All the intermediate steps in the path must match the criteria given in kwargs. The kwargs can be any valid parameters to DefinitionMatchPredicate.

This algorithm has exponential time and space complexity. Use at your own risk. Want to do better? Do it yourself or use networkx and eat the cost of indirection and/or cloning.

Return type:

tuple[Definition, ...] | None

Parameters:
find_paths(starts, ends, **kwargs)

Find all non-overlapping simple paths between the given start node or nodes and the given end node or nodes. All the intermediate steps in the path must match the criteria given in kwargs. The kwargs can be any valid parameters to DefinitionMatchPredicate.

This algorithm has exponential time and space complexity. Use at your own risk. Want to do better? Do it yourself or use networkx and eat the cost of indirection and/or cloning.

Return type:

Iterator[tuple[Definition, ...]]

Parameters: