angr.analyses.typehoon.simple_solver

class angr.analyses.typehoon.simple_solver.SketchNodeBase

Bases: object

The base class for nodes in a sketch.

class angr.analyses.typehoon.simple_solver.SketchNode

Bases: SketchNodeBase

Represents a node in a sketch graph.

__init__(typevar)
Parameters:

typevar (TypeVariable | DerivedTypeVariable)

typevar: TypeVariable | DerivedTypeVariable
upper_bound: TypeConstant
lower_bound: TypeConstant
property size: int | None

Best-effort estimation of the size of the typevar (in bits). Returns None if we cannot determine.

class angr.analyses.typehoon.simple_solver.RecursiveRefNode

Bases: SketchNodeBase

Represents a cycle in a sketch graph.

This is equivalent to sketches.LabelNode in the reference implementation of retypd.

__init__(target)
Parameters:

target (TypeVariable | DerivedTypeVariable)

target: TypeVariable | DerivedTypeVariable
class angr.analyses.typehoon.simple_solver.Sketch

Bases: object

Describes the sketch of a type variable.

__init__(solver, root)
Parameters:
root: SketchNode
graph
node_mapping: dict[TypeVariable | DerivedTypeVariable, SketchNodeBase]
solver
lookup(typevar)
Return type:

SketchNodeBase | None

Parameters:

typevar (TypeVariable | DerivedTypeVariable)

add_edge(src, dst, label)
Return type:

None

Parameters:
add_constraint(constraint)
Return type:

None

Parameters:

constraint (TypeConstraint)

static flatten_typevar(derived_typevar)
Return type:

tuple[DerivedTypeVariable | TypeVariable | TypeConstant, bool]

Parameters:

derived_typevar (TypeVariable | TypeConstant | DerivedTypeVariable)

class angr.analyses.typehoon.simple_solver.ConstraintGraphTag

Bases: Enum

LEFT = 0
RIGHT = 1
UNKNOWN = 2
class angr.analyses.typehoon.simple_solver.FORGOTTEN

Bases: Enum

PRE_FORGOTTEN = 0
POST_FORGOTTEN = 1
class angr.analyses.typehoon.simple_solver.ConstraintGraphNode

Bases: object

__init__(typevar, variance, tag, forgotten)
Parameters:
typevar
variance
tag
forgotten
forget_last_label()
Return type:

tuple[ConstraintGraphNode, BaseLabel] | None

recall(label)
Return type:

ConstraintGraphNode

Parameters:

label (BaseLabel)

inverse()
Return type:

ConstraintGraphNode

inverse_wo_tag()

Invert the variance only.

Return type:

ConstraintGraphNode

class angr.analyses.typehoon.simple_solver.SimpleSolver

Bases: object

SimpleSolver is, by its name, a simple solver. Most of this solver is based on the (complex) simplification logic that the retypd paper describes and the retypd re-implementation (https://github.com/GrammaTech/retypd) implements. Additionally, we add some improvements to allow type propagation of known struct names, among a few other improvements.

__init__(bits, constraints, typevars, constraint_set_degradation_threshold=150, stackvar_max_sizes=None, tv_manager=None)
Parameters:
processed_constraints_count: int
simplified_constraints_count: int
eqclass_constraints_count: list[int]
get_tv_max_stack_size(tv)

Get the potential maximum stack variable size of a given type variable, if any. Also considers other type variables that are equivalent to the given type variable.

Return type:

int | None

Parameters:

tv (TypeVariable)

preprocess(func_tv)
Parameters:

func_tv (TypeVariable)

solve()

Steps:

For each type variable, - Infer the shape in its sketch - Build the constraint graph - Collect all constraints - Apply constraints to derive the lower and upper bounds - Determine a solution for type variables with constraints - Rewrite the constraint graph by replacing determined type variables with their solutions - Solve repeatedly until all interesting type variables have solutions

By repeatedly solving until exhausting interesting type variables, we ensure the S-Trans rule is applied.

infer_shapes(typevars, constraints)

Computing sketches from constraint sets. Implements Algorithm E.1 in the retypd paper.

Return type:

tuple[dict, dict[TypeVariable, Sketch]]

Parameters:
compute_quotient_graph(constraints)

Compute the quotient graph (the constraint graph modulo ~ in Algorithm E.1 in the retypd paper) with respect to a given set of type constraints.

Parameters:

constraints (set[TypeConstraint])

join(t1, t2)
Return type:

TypeConstant

Parameters:
meet(t1, t2)
Return type:

TypeConstant

Parameters:
classmethod join_simtypes(t1, t2, arch)

Compute the join (the least general common supertype) of two SimTypes on the type lattice.

The two types are lifted to internal type constants, joined on the base lattice for arch.bits, and the result is translated back into a SimType. When the two types have no meaningful common supertype, the result is a SimTypeBottom.

Parameters:
  • t1 (SimType) – The first SimType.

  • t2 (SimType) – The second SimType.

  • arch (Arch) – The architecture, used to determine the pointer size and to build the resulting SimType.

Return type:

SimType

Returns:

The join of t1 and t2 as a SimType.

classmethod meet_simtypes(t1, t2, arch)

Compute the meet (the greatest common subtype) of two SimTypes on the type lattice.

See join_simtypes() for details. When the two types have no meaningful common subtype, the result is a SimTypeBottom.

Return type:

SimType

Parameters:
static abstract(t)
Return type:

TypeConstant | TypeVariable

Parameters:

t (TypeConstant | TypeVariable)

determine(sketches, tvs, equivalence_classes, solution, nodes=None)

Determine C-like types from sketches.

Parameters:
  • sketches – A dictionary storing sketches for each type variable.

  • solution (dict) – The dictionary storing C-like types for each type variable. Output.

  • nodes (set[SketchNode] | None) – Optional. Nodes that should be considered in the sketch.

  • equivalence_classes (dict[TypeVariable, TypeVariable])

Return type:

None

Returns:

None

static dump_constraint_graph(graph, filename)

Dump the constraint graph to a file.

Return type:

None

Parameters:
  • graph (DiGraph)

  • filename (str)