angr.analyses.typehoon.simple_solver¶
- class angr.analyses.typehoon.simple_solver.SketchNodeBase¶
Bases:
objectThe base class for nodes in a sketch.
- class angr.analyses.typehoon.simple_solver.SketchNode¶
Bases:
SketchNodeBaseRepresents a node in a sketch graph.
- __init__(typevar)¶
- Parameters:
typevar (TypeVariable | DerivedTypeVariable)
- typevar: TypeVariable | DerivedTypeVariable
- upper_bound: TypeConstant
- lower_bound: TypeConstant
- class angr.analyses.typehoon.simple_solver.RecursiveRefNode¶
Bases:
SketchNodeBaseRepresents a cycle in a sketch graph.
This is equivalent to sketches.LabelNode in the reference implementation of retypd.
- __init__(target)¶
- Parameters:
target (TypeVariable | DerivedTypeVariable)
- target: TypeVariable | DerivedTypeVariable
- class angr.analyses.typehoon.simple_solver.Sketch¶
Bases:
objectDescribes the sketch of a type variable.
- __init__(solver, root)¶
- Parameters:
solver (SimpleSolver)
root (TypeVariable)
- root: SketchNode
- graph
- node_mapping: dict[TypeVariable | DerivedTypeVariable, SketchNodeBase]
- solver
- lookup(typevar)¶
- Return type:
- Parameters:
typevar (TypeVariable | DerivedTypeVariable)
- add_edge(src, dst, label)¶
- Return type:
- Parameters:
src (SketchNodeBase)
dst (SketchNodeBase)
- add_constraint(constraint)¶
- Return type:
- Parameters:
constraint (TypeConstraint)
- static flatten_typevar(derived_typevar)¶
- Return type:
tuple[DerivedTypeVariable|TypeVariable|TypeConstant,bool]- Parameters:
derived_typevar (TypeVariable | TypeConstant | DerivedTypeVariable)
- class angr.analyses.typehoon.simple_solver.ConstraintGraphTag¶
Bases:
Enum- LEFT = 0¶
- RIGHT = 1¶
- UNKNOWN = 2¶
- class angr.analyses.typehoon.simple_solver.FORGOTTEN¶
Bases:
Enum- PRE_FORGOTTEN = 0¶
- POST_FORGOTTEN = 1¶
- class angr.analyses.typehoon.simple_solver.ConstraintGraphNode¶
Bases:
object- __init__(typevar, variance, tag, forgotten)¶
- Parameters:
typevar (TypeVariable | DerivedTypeVariable | TypeConstant)
variance (Variance)
tag (ConstraintGraphTag)
forgotten (FORGOTTEN)
- typevar
- variance
- tag
- forgotten
- forget_last_label()¶
- Return type:
- inverse()¶
- Return type:
- inverse_wo_tag()¶
Invert the variance only.
- Return type:
- class angr.analyses.typehoon.simple_solver.SimpleSolver¶
Bases:
objectSimpleSolver is, by its name, a simple solver. Most of this solver is based on the (complex) simplification logic that the retypd paper describes and the retypd re-implementation (https://github.com/GrammaTech/retypd) implements. Additionally, we add some improvements to allow type propagation of known struct names, among a few other improvements.
- __init__(bits, constraints, typevars, constraint_set_degradation_threshold=150, stackvar_max_sizes=None, tv_manager=None)¶
- Parameters:
bits (int)
typevars (dict[TypeVariable, set[TypeVariable]])
constraint_set_degradation_threshold (int)
stackvar_max_sizes (dict[TypeVariable, int] | None)
tv_manager (TypeVariableManager | None)
- processed_constraints_count: int
- simplified_constraints_count: int
- get_tv_max_stack_size(tv)¶
Get the potential maximum stack variable size of a given type variable, if any. Also considers other type variables that are equivalent to the given type variable.
- Return type:
- Parameters:
tv (TypeVariable)
- preprocess(func_tv)¶
- Parameters:
func_tv (TypeVariable)
- solve()¶
Steps:
For each type variable, - Infer the shape in its sketch - Build the constraint graph - Collect all constraints - Apply constraints to derive the lower and upper bounds - Determine a solution for type variables with constraints - Rewrite the constraint graph by replacing determined type variables with their solutions - Solve repeatedly until all interesting type variables have solutions
By repeatedly solving until exhausting interesting type variables, we ensure the S-Trans rule is applied.
- infer_shapes(typevars, constraints)¶
Computing sketches from constraint sets. Implements Algorithm E.1 in the retypd paper.
- Return type:
tuple[dict,dict[TypeVariable,Sketch]]- Parameters:
typevars (set[TypeVariable])
constraints (set[TypeConstraint])
- compute_quotient_graph(constraints)¶
Compute the quotient graph (the constraint graph modulo ~ in Algorithm E.1 in the retypd paper) with respect to a given set of type constraints.
- Parameters:
constraints (set[TypeConstraint])
- join(t1, t2)¶
- Return type:
- Parameters:
t1 (TypeConstant)
t2 (TypeConstant)
- meet(t1, t2)¶
- Return type:
- Parameters:
t1 (TypeConstant)
t2 (TypeConstant)
- classmethod join_simtypes(t1, t2, arch)¶
Compute the join (the least general common supertype) of two SimTypes on the type lattice.
The two types are lifted to internal type constants, joined on the base lattice for
arch.bits, and the result is translated back into a SimType. When the two types have no meaningful common supertype, the result is aSimTypeBottom.
- classmethod meet_simtypes(t1, t2, arch)¶
Compute the meet (the greatest common subtype) of two SimTypes on the type lattice.
See
join_simtypes()for details. When the two types have no meaningful common subtype, the result is aSimTypeBottom.
- static abstract(t)¶
- Return type:
- Parameters:
t (TypeConstant | TypeVariable)
- determine(sketches, tvs, equivalence_classes, solution, nodes=None)¶
Determine C-like types from sketches.
- Parameters:
sketches – A dictionary storing sketches for each type variable.
solution (
dict) – The dictionary storing C-like types for each type variable. Output.nodes (
set[SketchNode] |None) – Optional. Nodes that should be considered in the sketch.equivalence_classes (dict[TypeVariable, TypeVariable])
- Return type:
- Returns:
None