angr.analyses.s_reaching_definitions

class angr.analyses.s_reaching_definitions.SRDAModel

Bases: object

The model for SRDA.

__init__(func_graph, func_args, arch, platform=None, language=None, variable_map=None, functions=None, default_cc=None)
Parameters:
add_vvar_use(vvar_id, expr, loc)
Return type:

None

Parameters:
add_vvar_def(vvar_id, loc)

Record the definition of a vvar id, keeping all_vvar_definitions and vvar_defs_by_loc in sync.

Return type:

None

Parameters:
remove_vvar_def(vvar_id)

Drop the definition of a vvar id from both all_vvar_definitions and vvar_defs_by_loc.

Return type:

None

Parameters:

vvar_id (int)

update_after_block_edits(edited_blocks)

Incrementally update the model after the statements of edited_blocks were edited in place (statement indices preserved, e.g. by replacing removed statements with NoOp placeholders). vvar definitions and explicit vvar uses inside the edited blocks are recomputed from the edited blocks; implicit uses (expr is None, e.g. call-site argument registers) and all unedited blocks are left untouched.

This is designed to be equivalent to a full SRDA rebuild on the edited graph for the kind of edits performed by dead-assignment removal: statements are only removed (turned into NoOp) or rewritten in place, never inserted or reordered, and removed vvars are dead (so they are never used elsewhere, including by phi nodes or implicit call-site uses). Tmp tracking is not updated (AILSimplifier does not track tmps).

Return type:

None

canonical_form()

An order-insensitive snapshot of the model’s vvar-keyed data, for asserting equivalence between an incrementally-updated model and a freshly-rebuilt one (used by the incremental-update verification harness).

property all_definitions: Iterator[Definition[VirtualVariable, AILCodeLocation]]
get_definition_by_varid(varid)

The definition of a vvar id, or None if it has none.

Return type:

Optional[Definition[VirtualVariable, AILCodeLocation]]

Parameters:

varid (int)

is_phi_vvar_id(idx)
Return type:

bool

Parameters:

idx (int)

get_all_definitions(block_loc)
Return type:

set[Definition[VirtualVariable | Tmp, AILCodeLocation]]

Parameters:

block_loc (AILCodeLocation)

get_all_tmp_definitions(block_loc)
Return type:

set[Definition[Tmp, AILCodeLocation]]

Parameters:

block_loc (Address)

get_uses_by_location(loc, exprs=False)

Retrieve all definitions that are used at a given location.

Overloads:
Parameters:
Returns:

A set of definitions that are used at the given location.

Return type:

set[Definition[VirtualVariable, AILCodeLocation]] | set[tuple[Definition[VirtualVariable, AILCodeLocation], Any | None]]

get_defs_by_location(loc)

Retrieve all vvar definitions at a given location.

Parameters:

loc (AILCodeLocation) – The code location.

Return type:

set[Definition[VirtualVariable, AILCodeLocation]]

Returns:

A set of definitions that are defined at the given location.

get_vvar_uses(obj)
Return type:

set[AILCodeLocation]

Parameters:

obj (VirtualVariable | VirtualVariable)

get_vvar_uses_with_expr(obj)
Return type:

set[tuple[VirtualVariable | None, AILCodeLocation]]

Parameters:

obj (VirtualVariable | VirtualVariable)

get_tmp_uses(obj, block_loc)
Return type:

set[AILCodeLocation]

Parameters:

  • obj (Tmp)

  • block_loc (Address)

get_uses_by_def(def_)
Return type:

set[AILCodeLocation]

Parameters:

def_ (Definition[VirtualVariable | Tmp, AILCodeLocation])

class angr.analyses.s_reaching_definitions.SRDAView

Bases: object

A view of SRDA model that provides various functionalities for querying the model.

__init__(model)
Parameters:

model (SRDAModel)

get_reg_vvar_by_stmt(reg_offset, min_size, block_addr, block_idx, stmt_idx, op_type)
Return type:

VirtualVariable | None

Parameters:
get_stack_vvar_by_stmt(stack_offset, size, block_addr, block_idx, stmt_idx, op_type)
Return type:

VirtualVariable | None

Parameters:
get_reg_vvar_by_insn(reg_offset, min_size, addr, op_type, block_idx=0)
Return type:

VirtualVariable | None

Parameters:
get_stack_vvar_by_insn(stack_offset, size, addr, op_type, block_idx=0)
Return type:

VirtualVariable | None

Parameters:
get_vvar_value(vvar)
Return type:

Expression | None

Parameters:

vvar (VirtualVariable)

observe(observation_points, entry=None)
Parameters:

  • observation_points (list[tuple[Literal['insn', 'node', 'stmt', 'exit'], int | tuple[int, int] | tuple[int, int, int], ~angr.knowledge_plugins.key_definitions.constants.ObservationPointType]])

  • entry (Block | None)

class angr.analyses.s_reaching_definitions.SReachingDefinitions

Bases: object

Constant and expression propagation that only supports SSA AIL graphs.

Deliberately not an Analysis: it is instantiated hundreds of times per decompilation (often once per block), so it skips the analysis-factory ceremony. Instantiate it directly with the project as the first argument; exceptions always propagate.

__init__(project, subject, func_addr=None, func_graph=None, func_args=None, use_callee_saved_regs_at_return=False, track_tmps=False, variable_map=None)
Parameters:
class angr.analyses.s_reaching_definitions.SReachingDefinitionsAnalysis

Bases: Analysis, SReachingDefinitions

A wrapper around SReachingDefinitions to make it usable as an Analysis and registered in the analysis hub.

__init__(subject, func_addr=None, func_graph=None, func_args=None, use_callee_saved_regs_at_return=False, track_tmps=False, variable_map=None)
Parameters:
angr.analyses.s_reaching_definitions.populate_model(model, blocks, func_args, *, fix_undefined_vvars=True, track_tmps=False)

Populate the scan-derived part of an SRDAModel (vvar/tmp definitions and uses, phi bookkeeping) with a linear scan over blocks. An SRDAModel is never serialized; it is always rebuilt from an AIL graph through this function (via SReachingDefinitions or directly).

Return type:

None

Parameters:

Submodules

s_rda_model

s_rda_view

s_reaching_definitions