angr.calling_conventions

class angr.calling_conventions.PointerWrapper

Bases: object

__init__(value, buffer=False)
class angr.calling_conventions.AllocHelper

Bases: object

__init__(ptrsize)
alloc(size)
dump(val, state, loc=None)
translate(val, base)
apply(state, base)
size()
classmethod calc_size(val, arch)
classmethod stack_loc(val, arch, offset=0)
angr.calling_conventions.opaque_cpp_class(ty)

Whether ty is a C++ class whose definition angr never saw.

sim_type builds one of these from a demangled name it cannot resolve: no members, and a size forced to one word. There is no layout to lay out.

Return type:

bool

Parameters:

ty (SimType)

angr.calling_conventions.refine_locs_with_struct_type(arch, locs, arg_type, offset=0, treat_bot_as_int=True, treat_unsupported_as_int=True)
Parameters:
class angr.calling_conventions.SerializableIterator

Bases: object

getstate()
setstate(state)
class angr.calling_conventions.SerializableListIterator

Bases: SerializableIterator

__init__(lst)
getstate()
setstate(state)
class angr.calling_conventions.SerializableCounter

Bases: SerializableIterator

__init__(start, stride, mapping=<function SerializableCounter.<lambda>>)
getstate()
setstate(state)
class angr.calling_conventions.SimFunctionArgument

Bases: object

Represent a generic function argument.

Variables:

  • size (int) – The size of the argument, in number of bytes.

  • is_fp (bool) – Whether loads from this location should return a floating point bitvector

__init__(size, is_fp=False)
Parameters:
check_value_set(value, arch)
check_value_get(value)
set_value(state, value, **kwargs)
get_value(state, **kwargs)
refine(size, arch=None, offset=None, is_fp=None)
get_footprint()

Return a list of SimRegArg and SimStackArgs that are the base components used for this location

Return type:

Iterable[SimRegArg | SimStackArg]

class angr.calling_conventions.SimRegArg

Bases: SimFunctionArgument

Represents a function argument that has been passed in a register.

Variables:

  • reg_name (string) – The name of the represented register.

  • size (int) – The size of the data to store, in number of bytes.

  • reg_offset – The offset into the register to start storing data.

  • clear_entire_reg – Whether a store to this register should zero the unused parts of the register.

  • is_fp (bool) – Whether loads from this location should return a floating point bitvector

__init__(reg_name, size, reg_offset=0, is_fp=False, clear_entire_reg=False)
Parameters:
check_offset(arch)
Return type:

int

set_value(state, value, **kwargs)
get_value(state, **kwargs)
refine(size, arch=None, offset=None, is_fp=None)
sse_extend()
class angr.calling_conventions.SimStackArg

Bases: SimFunctionArgument

Represents a function argument that has been passed on the stack.

Variables:

  • stack_offset (int) – The position of the argument relative to the stack pointer after the function prelude.

  • size (int) – The size of the argument, in number of bytes.

  • is_fp (bool) – Whether loads from this location should return a floating point bitvector

__init__(stack_offset, size, is_fp=False)
Parameters:
stack_offset: int
set_value(state, value, stack_base=None, **kwargs)
get_value(state, stack_base=None, **kwargs)
refine(size, arch=None, offset=None, is_fp=None)
class angr.calling_conventions.SimComboArg

Bases: SimFunctionArgument, Generic

An argument which spans multiple storage locations. Locations should be given least-significant first.

__init__(locations, is_fp=False)
Parameters:

locations (list[T])

set_value(state, value, **kwargs)
get_value(state, **kwargs)
class angr.calling_conventions.SimStructArg

Bases: SimFunctionArgument

An argument which de/serializes a struct from a list of storage locations

Variables:

  • struct – The simtype describing the structure

  • locs – The storage locations to use

__init__(struct, locs)
Parameters:
get_single_footprint()
Return type:

SimStackArg | SimRegArg | SimComboArg

get_value(state, **kwargs)
set_value(state, value, **kwargs)
class angr.calling_conventions.SimArrayArg

Bases: SimFunctionArgument

__init__(locs)
get_value(state, **kwargs)
set_value(state, value, **kwargs)
class angr.calling_conventions.SimReferenceArgument

Bases: SimFunctionArgument

A function argument which is passed by reference.

Variables:

  • ptr_loc – The location the reference’s pointer is stored

  • main_loc – A SimStackArgument describing how to load the argument’s value as if it were stored at offset zero on the stack. It will be passed stack_base=ptr_loc.get_value(state)

__init__(ptr_loc, main_loc)
Parameters:
get_value(state, **kwargs)
set_value(state, value, **kwargs)
class angr.calling_conventions.ArgSession

Bases: object

A class to keep track of the state accumulated in laying parameters out into memory

__init__(cc)
cc
fp_iter
int_iter
both_iter
getstate()
setstate(state)
class angr.calling_conventions.UsercallArgSession

Bases: object

An argsession for use with SimCCUsercall

__init__(cc)
cc
real_args
getstate()
setstate(state)
class angr.calling_conventions.SimCC

Bases: object

A calling convention allows you to extract from a state the data passed from function to function by calls and returns. Most of the methods provided by SimCC that operate on a state assume that the program is just after a call but just before stack frame allocation, though this may be overridden with the stack_base parameter to each individual method.

This is the base class for all calling conventions.

__init__(arch, x87_args=0)
Parameters:

  • arch (Arch) – The Archinfo arch for this CC

  • x87_args (int) – How many leading arguments are passed on the x87 stack (st(0), st(1), …) and popped by the callee, as by MSVC’s _CI* and _ftol helpers.

ARG_REGS: list[str] = []
FP_ARG_REGS: list[str] = []
x87_args: int = 0
FP_RET_WHOLE_FUNCTION_SCAN: bool = False
STACKARG_SP_BUFF = 0
STACKARG_SP_DIFF = 0
CALLER_SAVED_REGS: list[str] = []
RETURN_ADDR: SimFunctionArgument | None = None
RETURN_VAL: SimFunctionArgument | None = None
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = None
FP_RETURN_VAL: SimFunctionArgument | None = None
ARCH: type[Arch] | None = None
EXTRA_ARCHES: tuple[type[Arch], ...] = ()
CALLEE_CLEANUP = False
STACK_ALIGNMENT = 1
ARG_SLOT_SIZE: int | None = None
ARG_REG_SANITY_FILTER = False
STRICT_CALLER_SAVED_MATCH = True
SHARED_ARG_SLOTS = False
classmethod arg_reg_offsets(arch)

Every register file offset covered by this convention’s argument registers.

Return type:

frozenset[int]

Parameters:

arch (Arch)

property arg_slot_size: int

The width in bytes of one argument slot. See ARG_SLOT_SIZE.

property int_args

Iterate through all the possible arg positions that can only be used to store integer or pointer values.

Returns an iterator of SimFunctionArguments

property memory_args

Iterate through all the possible arg positions that can be used to store any kind of argument.

Returns an iterator of SimFunctionArguments

property fp_args

Iterate through all the possible arg positions that can only be used to store floating point values.

Returns an iterator of SimFunctionArguments

is_fp_arg(arg)

This should take a SimFunctionArgument instance and return whether or not that argument is a floating-point argument.

Returns True for MUST be a floating point arg,

False for MUST NOT be a floating point arg, None for when it can be either.

class ArgSession

Bases: object

A class to keep track of the state accumulated in laying parameters out into memory

both_iter
cc
fp_iter
int_iter
__init__(cc)
getstate()
setstate(state)
arg_session(ret_ty)

Return an arg session.

A session provides the control interface necessary to describe how integral and floating-point arguments are laid out into memory. The default behavior is that there are a finite list of int-only and fp-only argument slots, and an infinite number of generic slots, and when an argument of a given type is requested, the most slot available is used. If you need different behavior, subclass ArgSession.

You need to provide the return type of the function in order to kick off an arg layout session.

Return type:

ArgSession

Parameters:

ret_ty (SimType | None)

return_in_implicit_outparam(ty)
Return type:

bool

stack_space(args)
Parameters:

args – A list of SimFunctionArguments

Returns:

The number of bytes that should be allocated on the stack to store all these args, NOT INCLUDING the return address.

return_val(ty, perspective_returned=False)

The location the return value is stored, based on its type.

property return_addr

The location the return address is stored.

next_arg(session, arg_type)
Return type:

SimFunctionArgument

Parameters:
static is_fp_value(val)
static guess_prototype(args, prototype=None)

Come up with a plausible SimTypeFunction for the given args (as would be passed to e.g. setup_callsite).

You can pass a variadic function prototype in the base_type parameter and all its arguments will be used, only guessing types for the variadic arguments.

arg_locs(prototype)
Return type:

list[SimFunctionArgument]

x87_arg_locs(prototype)

Locations of the leading arguments passed on the x87 stack.

Return type:

list[SimFunctionArgument]

get_args(state, prototype, stack_base=None)
set_return_val(state, val, ty, stack_base=None, perspective_returned=False)
setup_callsite(state, ret_addr, args, prototype, stack_base=None, alloc_base=None, grow_like_stack=True)

This function performs the actions of the caller getting ready to jump into a function.

Parameters:

  • state – The SimState to operate on

  • ret_addr – The address to return to when the called function finishes

  • args – The list of arguments that that the called function will see

  • prototype – The signature of the call you’re making. Should include variadic args concretely.

  • stack_base – An optional pointer to use as the top of the stack, circa the function entry point

  • alloc_base – An optional pointer to use as the place to put excess argument data

  • grow_like_stack – When allocating data at alloc_base, whether to allocate at decreasing addresses

The idea here is that you can provide almost any kind of python type in args and it’ll be translated to a binary format to be placed into simulated memory. Lists (representing arrays) must be entirely elements of the same type and size, while tuples (representing structs) can be elements of any type and size. If you’d like there to be a pointer to a given value, wrap the value in a PointerWrapper.

If stack_base is not provided, the current stack pointer will be used, and it will be updated. If alloc_base is not provided, the stack base will be used and grow_like_stack will implicitly be True.

grow_like_stack controls the behavior of allocating data at alloc_base. When data from args needs to be wrapped in a pointer, the pointer needs to point somewhere, so that data is dumped into memory at alloc_base. If you set alloc_base to point to somewhere other than the stack, set grow_like_stack to False so that sequential allocations happen at increasing addresses.

teardown_callsite(state, return_val=None, prototype=None, force_callee_cleanup=False)

This function performs the actions of the callee as it’s getting ready to return. It returns the address to return to.

Parameters:

  • state – The state to mutate

  • return_val – The value to return

  • prototype – The prototype of the given function

  • force_callee_cleanup – If we should clean up the stack allocation for the arguments even if it’s not the callee’s job to do so

TODO: support the stack_base parameter from setup_callsite…? Does that make sense in this context? Maybe it could make sense by saying that you pass it in as something like the “saved base pointer” value?

static find_cc(arch, args, sp_delta, platform='Linux', unused_hint=None, extra_pop=None, language=None, candidates=None)

Pinpoint the best-fit calling convention and return the corresponding SimCC instance, or None if no fit is found.

Parameters:

  • arch (Arch) – An ArchX instance. Can be obtained from archinfo.

  • args (list[SimRegArg | SimStackArg]) – A list of arguments. It may be updated by the first matched calling convention to remove non-argument arguments.

  • sp_delta (int) – The change of stack pointer before and after the call is made.

  • extra_pop (int | None) – The number of bytes that are popped by the callee. This is used to distinguish between callee-cleanup and caller-cleanup conventions. None means unknown, in which case callee-cleanup conventions with stack arguments are only matched if no other convention fits the arguments.

  • language (str | None) – The source language of the binary (e.g. “go”), if known. Languages with their own ABI are matched against that ABI alone.

  • candidates (list[type[SimCC]] | None) – The conventions to consider, overriding the lookup by architecture, platform and language (e.g. the one Go convention a binary’s Go release uses).

  • platform (str | None)

  • unused_hint (list[SimRegArg] | None)

Return type:

SimCC | None

Returns:

A calling convention instance, or None if none of the SimCC subclasses seems to fit the arguments provided.

classmethod arches()
Return type:

tuple[type[Arch], ...]

get_arg_info(state, prototype)

This is just a simple wrapper that collects the information from various locations prototype is as passed to self.arg_locs and self.get_args :type angr.SimState state: :param angr.SimState state: The state to evaluate and extract the values from :return: A list of tuples, where the nth tuple is (type, name, location, value) of the nth argument

class angr.calling_conventions.SimLyingRegArg

Bases: SimRegArg

A register that LIES about the types it holds

__init__(name, size=8)
get_value(state, **kwargs)
set_value(state, value, **kwargs)
refine(size, arch=None, offset=None, is_fp=None)
property x87_index: int | None

i for an x87 stack slot st(i), None for any other register.

angr.calling_conventions.is_x87_stack_arg(loc)

Whether the argument location is an x87 stack slot, whose register depends on the caller’s x87 stack top.

Return type:

bool

Parameters:

loc (SimFunctionArgument)

class angr.calling_conventions.SimCCUsercall

Bases: SimCC

ArgSession

alias of UsercallArgSession

next_arg(session, arg_type)
Parameters:

session (UsercallArgSession)

class angr.calling_conventions.SimCCCdecl

Bases: SimCC

FP_RET_WHOLE_FUNCTION_SCAN: bool = True
ARG_REGS: list[str] = []
FP_ARG_REGS: list[str] = []
STACKARG_SP_DIFF = 4
CALLER_SAVED_REGS: list[str] = ['eax', 'ecx', 'edx']
RETURN_VAL: SimFunctionArgument | None = <eax>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <edx>
FP_RETURN_VAL: SimFunctionArgument | None = <st0>
RETURN_ADDR: SimFunctionArgument | None = [0x0]
ARCH

alias of ArchX86

next_arg(session, arg_type)
STRUCT_RETURN_THRESHOLD = 32
return_in_implicit_outparam(ty)
class angr.calling_conventions.SimCCMicrosoftCdecl

Bases: SimCCCdecl

STRUCT_RETURN_THRESHOLD = 64
class angr.calling_conventions.SimCCMicrosoftThiscall

Bases: SimCCCdecl

CALLEE_CLEANUP = True
ARG_REGS: list[str] = ['ecx']
CALLER_SAVED_REGS: list[str] = ['eax', 'ecx', 'edx']
STRUCT_RETURN_THRESHOLD = 64
arg_locs(prototype)
Return type:

list[SimFunctionArgument]

class angr.calling_conventions.SimCCStdcall

Bases: SimCCMicrosoftCdecl

CALLEE_CLEANUP = True
class angr.calling_conventions.SimCCMicrosoftFastcall

Bases: SimCC

CALLEE_CLEANUP = True
ARG_REGS: list[str] = ['ecx', 'edx']
CALLER_SAVED_REGS: list[str] = ['eax', 'ecx', 'edx']
STACKARG_SP_DIFF = 4
RETURN_VAL: SimFunctionArgument | None = <eax>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <edx>
FP_RETURN_VAL: SimFunctionArgument | None = <st0>
RETURN_ADDR: SimFunctionArgument | None = [0x0]
ARCH

alias of ArchX86

next_arg(session, arg_type)
STRUCT_RETURN_THRESHOLD = 64
return_in_implicit_outparam(ty)
class angr.calling_conventions.MicrosoftAMD64ArgSession

Bases: ArgSession

both_iter
cc
fp_iter
int_iter
class angr.calling_conventions.SimCCMicrosoftAMD64

Bases: SimCC

FP_RET_WHOLE_FUNCTION_SCAN: bool = True
ARG_REGS: list[str] = ['rcx', 'rdx', 'r8', 'r9']
FP_ARG_REGS: list[str] = ['xmm0', 'xmm1', 'xmm2', 'xmm3']
CALLER_SAVED_REGS: list[str] = ['rax', 'rcx', 'rdx', 'r8', 'r9', 'r10', 'r11']
STACKARG_SP_DIFF = 8
STACKARG_SP_BUFF = 32
RETURN_VAL: SimFunctionArgument | None = <rax>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <rdx>
FP_RETURN_VAL: SimFunctionArgument | None = <xmm0>
RETURN_ADDR: SimFunctionArgument | None = [0x0]
ARCH

alias of ArchAMD64

STACK_ALIGNMENT = 16
SHARED_ARG_SLOTS = True
ArgSession

alias of MicrosoftAMD64ArgSession

STRUCT_RETURN_THRESHOLD = 64
next_arg(session, arg_type)
return_in_implicit_outparam(ty)
class angr.calling_conventions.SimCCSyscall

Bases: SimCC

The base class of all syscall CCs.

ERROR_REG: SimRegArg = None
SYSCALL_ERRNO_START = None
static syscall_num(state)
Return type:

int

linux_syscall_update_error_reg(state, expr)
set_return_val(state, val, ty, **kwargs)
class angr.calling_conventions.SimCCX86LinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <eax>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchX86

next_arg(session, arg_type)
Return type:

SimFunctionArgument

Parameters:
static syscall_num(state)
class angr.calling_conventions.SimCCX86FreeBSDSyscall

Bases: SimCCSyscall

FreeBSD’s i386 syscall ABI, which passes its arguments on the stack rather than in registers: the kernel reads them from tf_esp + sizeof(uint32_t), past the slot a call to a libc stub would have left the return address in, so the first argument sits at [esp+4].

ARG_REGS: list[str] = []
FP_ARG_REGS: list[str] = []
STACKARG_SP_DIFF = 4
RETURN_VAL: SimFunctionArgument | None = <eax>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchX86

static syscall_num(state)
class angr.calling_conventions.SimCCX86WindowsSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['ecx']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <eax>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchX86

static syscall_num(state)
class angr.calling_conventions.SimCCSystemVAMD64

Bases: SimCC

FP_RET_WHOLE_FUNCTION_SCAN: bool = True
ARG_REGS: list[str] = ['rdi', 'rsi', 'rdx', 'rcx', 'r8', 'r9']
FP_ARG_REGS: list[str] = ['xmm0', 'xmm1', 'xmm2', 'xmm3', 'xmm4', 'xmm5', 'xmm6', 'xmm7']
STACKARG_SP_DIFF = 8
CALLER_SAVED_REGS: list[str] = ['rdi', 'rsi', 'rdx', 'rcx', 'r8', 'r9', 'r10', 'r11', 'rax']
RETURN_ADDR: SimFunctionArgument | None = [0x0]
RETURN_VAL: SimFunctionArgument | None = <rax>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <rdx>
FP_RETURN_VAL: SimFunctionArgument | None = <xmm0>
OVERFLOW_FP_RETURN_VAL = <xmm1>
ARCH

alias of ArchAMD64

STACK_ALIGNMENT = 16
next_arg(session, arg_type)
return_in_implicit_outparam(ty)
class angr.calling_conventions.SimCCGoAMD64

Bases: SimCC

Go’s register-based internal ABI (ABIInternal), used by the gc toolchain on amd64 since go1.17.

Integer arguments and results are assigned to RAX, RBX, RCX, RDI, RSI, R8, R9, R10, R11 and floating-point ones to X0-X14. Results restart at the beginning of the same two sequences, so a multi-value return comes back in RAX, RBX, … – model it as a struct return type.

RDX carries the closure context pointer, R12/R13 are scratch, R14 pins the current goroutine (g) and X15 is a zero register; none of them are arguments. Unlike the System V ABI, Go assigns registers per scalar leaf rather than per eightbyte, and an aggregate that does not fit entirely in registers is passed wholly on the stack with the register counters rolled back.

ARG_REGS: list[str] = ['rax', 'rbx', 'rcx', 'rdi', 'rsi', 'r8', 'r9', 'r10', 'r11']
FP_ARG_REGS: list[str] = ['xmm0', 'xmm1', 'xmm2', 'xmm3', 'xmm4', 'xmm5', 'xmm6', 'xmm7', 'xmm8', 'xmm9', 'xmm10', 'xmm11', 'xmm12', 'xmm13', 'xmm14']
STACKARG_SP_DIFF = 8
CALLER_SAVED_REGS: list[str] = ['rax', 'rbx', 'rcx', 'rdx', 'rdi', 'rsi', 'r8', 'r9', 'r10', 'r11', 'r12', 'r13', 'r15', 'xmm0', 'xmm1', 'xmm2', 'xmm3', 'xmm4', 'xmm5', 'xmm6', 'xmm7', 'xmm8', 'xmm9', 'xmm10', 'xmm11', 'xmm12', 'xmm13', 'xmm14']
RETURN_ADDR: SimFunctionArgument | None = [0x0]
RETURN_VAL: SimFunctionArgument | None = <rax>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <rbx>
FP_RETURN_VAL: SimFunctionArgument | None = <xmm0>
OVERFLOW_FP_RETURN_VAL = <xmm1>
ARCH

alias of ArchAMD64

STACK_ALIGNMENT = 8
ARG_REG_SANITY_FILTER = True
STRICT_CALLER_SAVED_MATCH = False
next_arg(session, arg_type)
Return type:

SimFunctionArgument

Parameters:
class angr.calling_conventions.SimCCGoStackABI0

Bases: SimCCGoAMD64

Go’s all-stack ABI0: arguments start right above the return address (amd64, 386) or the reserved saved-LR slot (arm64, arm) in declaration order, and results follow them at the next word boundary. Where the results start depends on the argument sizes, which return_val does not see: for_prototype() builds an instance that knows them; a bare instance assumes no arguments.

ARG_REGS: list[str] = []
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = None
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = None
FP_RETURN_VAL: SimFunctionArgument | None = None
OVERFLOW_FP_RETURN_VAL = None
ARCH: type[Arch] | None = None
STACK_ALIGNMENT = 4
classmethod for_prototype(arch, prototype)
Return type:

Self

Parameters:
class angr.calling_conventions.SimCCGoAMD64ABI0

Bases: SimCCGoStackABI0

Go’s original all-stack ABI0 on amd64: every Go function before go1.17, and the runtime’s hand-written assembly since (the gc linker names those symbols “<name>.abi0”).

STACKARG_SP_DIFF = 8
CALLER_SAVED_REGS: list[str] = ['rax', 'rbx', 'rcx', 'rdx', 'rdi', 'rsi', 'r8', 'r9', 'r10', 'r11', 'r12', 'r13', 'r15', 'xmm0', 'xmm1', 'xmm2', 'xmm3', 'xmm4', 'xmm5', 'xmm6', 'xmm7', 'xmm8', 'xmm9', 'xmm10', 'xmm11', 'xmm12', 'xmm13', 'xmm14']
ARCH

alias of ArchAMD64

STACK_ALIGNMENT = 8
class angr.calling_conventions.SimCCGoAArch64

Bases: SimCCGoAMD64

Go’s register-based internal ABI on arm64 (go1.18+): integer arguments and results in R0-R15, floating-point ones in F0-F15, results restarting at the first register. R26 carries the closure context, R27 is the assembler temporary, R28 pins the current goroutine (g), R29 is the frame pointer and R30 the link register; none of them are arguments. Stack-assigned values start at 8(RSP) of the caller’s frame.

ARG_REGS: list[str] = ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7', 'x8', 'x9', 'x10', 'x11', 'x12', 'x13', 'x14', 'x15']
FP_ARG_REGS: list[str] = ['d0', 'd1', 'd2', 'd3', 'd4', 'd5', 'd6', 'd7', 'd8', 'd9', 'd10', 'd11', 'd12', 'd13', 'd14', 'd15']
STACKARG_SP_DIFF = 8
CALLER_SAVED_REGS: list[str] = ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7', 'x8', 'x9', 'x10', 'x11', 'x12', 'x13', 'x14', 'x15', 'x16', 'x17', 'x18', 'x19', 'x20', 'x21', 'x22', 'x23', 'x24', 'x25', 'x26', 'x27', 'x30', 'd0', 'd1', 'd2', 'd3', 'd4', 'd5', 'd6', 'd7', 'd8', 'd9', 'd10', 'd11', 'd12', 'd13', 'd14', 'd15', 'd16', 'd17', 'd18', 'd19', 'd20', 'd21', 'd22', 'd23', 'd24', 'd25', 'd26', 'd27', 'd28', 'd29', 'd30', 'd31']
RETURN_ADDR: SimFunctionArgument | None = <lr>
RETURN_VAL: SimFunctionArgument | None = <x0>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <x1>
FP_RETURN_VAL: SimFunctionArgument | None = <d0>
OVERFLOW_FP_RETURN_VAL = <d1>
ARCH

alias of ArchAArch64

STACK_ALIGNMENT = 16
ARG_REG_SANITY_FILTER = True
STRICT_CALLER_SAVED_MATCH = False
class angr.calling_conventions.SimCCGoAArch64ABI0

Bases: SimCCGoStackABI0, SimCCGoAArch64

Go’s all-stack ABI0 on arm64: every Go function before go1.18, and the runtime’s assembly since (symbols suffixed with “.abi0”). Arguments start at 8(RSP), above the reserved saved-LR slot.

CALLER_SAVED_REGS: list[str] = ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7', 'x8', 'x9', 'x10', 'x11', 'x12', 'x13', 'x14', 'x15', 'x16', 'x17', 'x18', 'x19', 'x20', 'x21', 'x22', 'x23', 'x24', 'x25', 'x26', 'x27', 'x30', 'd0', 'd1', 'd2', 'd3', 'd4', 'd5', 'd6', 'd7', 'd8', 'd9', 'd10', 'd11', 'd12', 'd13', 'd14', 'd15', 'd16', 'd17', 'd18', 'd19', 'd20', 'd21', 'd22', 'd23', 'd24', 'd25', 'd26', 'd27', 'd28', 'd29', 'd30', 'd31']
ARCH

alias of ArchAArch64

STACK_ALIGNMENT = 16
class angr.calling_conventions.SimCCGoX86

Bases: SimCCGoStackABI0

Go on 386 only ever had the all-stack ABI0: arguments start at 4(SP), above the return address.

STACKARG_SP_DIFF = 4
CALLER_SAVED_REGS: list[str] = ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'xmm0', 'xmm1', 'xmm2', 'xmm3', 'xmm4', 'xmm5', 'xmm6', 'xmm7']
RETURN_ADDR: SimFunctionArgument | None = [0x0]
ARCH

alias of ArchX86

class angr.calling_conventions.SimCCGoARM

Bases: SimCCGoStackABI0

Go on 32-bit arm only ever had the all-stack ABI0. BL leaves the return address in LR and pushes nothing, but 0(R13) at entry is reserved for the callee’s saved LR (the prologue’s MOVW.W R14, -framesize(R13) stores it at the bottom of the new frame), so arguments start at 4(R13). R7 carries the closure context, R10 pins the current goroutine (g) and R11 is the linker temporary; a call clobbers every other register.

STACKARG_SP_DIFF = 4
CALLER_SAVED_REGS: list[str] = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r11', 'r12', 'lr', 'd0', 'd1', 'd2', 'd3', 'd4', 'd5', 'd6', 'd7', 'd8', 'd9', 'd10', 'd11', 'd12', 'd13', 'd14', 'd15']
RETURN_ADDR: SimFunctionArgument | None = <lr>
ARCH

alias of ArchARM

angr.calling_conventions.go_cc_class(arch, versions=None, goos=None, abi0=False)

The calling convention the gc toolchain uses for Go functions on arch.

Go functions were compiled with the all-stack ABI0 until the register-based ABIInternal was turned on, per GOARCH (internal/buildcfg/exp.go and the release notes):

  • amd64: go1.17, but only for linux, android, darwin and windows; go1.18 on every GOOS.

  • arm64, ppc64, ppc64le: go1.18. riscv64: go1.19. loong64: go1.22. s390x: go1.27.

  • 386 and 32-bit arm: never.

angr models the register ABI on amd64 and arm64 only. Without the exact release (runtime.buildVersion or the build-info blob), the pclntab layout bounds it: layouts older than go1.16 mean ABI0 on both, the go1.16 layout (go1.16-go1.17) means ABI0 on arm64 but either ABI on amd64, and the go1.18 layout or newer means the register ABI. When the release cannot be pinned down, the register ABI is assumed.

Parameters:
Return type:

type[SimCC] | None

Returns:

The convention class, or None if angr has no Go convention for arch.

angr.calling_conventions.go_cc_class_for_project(project, abi0=False)

go_cc_class() for the project’s architecture, Go release and GOOS. The release is identified once per project.

Return type:

type[SimCC] | None

Parameters:

abi0 (bool)

class angr.calling_conventions.SimCCAMD64LinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9']
RETURN_VAL: SimFunctionArgument | None = <rax>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchAMD64

CALLER_SAVED_REGS: list[str] = ['rax', 'rcx', 'r11']
static syscall_num(state)
class angr.calling_conventions.SimCCAMD64WindowsSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['rcx']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <rax>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchAMD64

static syscall_num(state)
class angr.calling_conventions.SimCCARM

Bases: SimCC

ARG_REGS: list[str] = ['r0', 'r1', 'r2', 'r3']
FP_ARG_REGS: list[str] = []
CALLER_SAVED_REGS: list[str] = ['r0', 'r1', 'r2', 'r3']
RETURN_ADDR: SimFunctionArgument | None = <lr>
RETURN_VAL: SimFunctionArgument | None = <r0>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <r1>
ARCH

alias of ArchARM

next_arg(session, arg_type)
class angr.calling_conventions.SimCCARMHF

Bases: SimCCARM

ARG_REGS: list[str] = ['r0', 'r1', 'r2', 'r3']
FP_ARG_REGS: list[str] = ['s0', 's1', 's2', 's3', 's4', 's5', 's6', 's7', 's8', 's9', 's10', 's11', 's12', 's13', 's14', 's15']
FP_RETURN_VAL: SimFunctionArgument | None = <s0>
CALLER_SAVED_REGS: list[str] = []
RETURN_ADDR: SimFunctionArgument | None = <lr>
RETURN_VAL: SimFunctionArgument | None = <r0>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <r1>
ARCH

alias of ArchARMHF

EXTRA_ARCHES: tuple[type[Arch], ...] = (<class 'archinfo.arch_arm.ArchARMCortexM'>,)
next_arg(session, arg_type)
Parameters:

session (ArgSession)

class angr.calling_conventions.SimCCARMLinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6']
FP_ARG_REGS: list[str] = []
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
RETURN_VAL: SimFunctionArgument | None = <r0>
ARCH

alias of ArchARM

next_arg(session, arg_type)
Return type:

SimFunctionArgument

Parameters:
static syscall_num(state)
class angr.calling_conventions.SimCCARMWindowsSyscall

Bases: SimCCSyscall

The system call convention of Windows on 32-bit ARM.

An ntdll stub loads the service index into r12 and traps with svc #1; arguments follow the ordinary ARM convention. See https://codemachine.com/articles/arm_assembler_primer.html.

ARG_REGS: list[str] = ['r0', 'r1', 'r2', 'r3']
FP_ARG_REGS: list[str] = []
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
RETURN_VAL: SimFunctionArgument | None = <r0>
ARCH

alias of ArchARM

static syscall_num(state)
class angr.calling_conventions.SimCCAArch64

Bases: SimCC

ARG_REGS: list[str] = ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7']
FP_ARG_REGS: list[str] = ['d0', 'd1', 'd2', 'd3', 'd4', 'd5', 'd6', 'd7']
RETURN_ADDR: SimFunctionArgument | None = <lr>
RETURN_VAL: SimFunctionArgument | None = <x0>
FP_RETURN_VAL: SimFunctionArgument | None = <d0>
ARCH

alias of ArchAArch64

class angr.calling_conventions.SimCCAArch64LinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <x0>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchAArch64

static syscall_num(state)
class angr.calling_conventions.SimCCAArch64WindowsSyscall

Bases: SimCCSyscall

The system call convention of Windows on AArch64.

An ntdll stub is a bare “svc #index; ret”: Windows encodes the service index in the SVC immediate rather than in a register, and the kernel recovers it from ESR_EL1 as the low 12 bits. Arguments follow the ordinary AArch64 convention. See https://gracefulbits.wordpress.com/2018/07/26/system-call-dispatching-for-windows-on-arm64/.

ARG_REGS: list[str] = ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <x0>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchAArch64

static syscall_num(state)
class angr.calling_conventions.SimCCRISCV64

Bases: SimCC

ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7']
FP_ARG_REGS: list[str] = ['fa0', 'fa1', 'fa2', 'fa3', 'fa4', 'fa5', 'fa6', 'fa7']
FP_RETURN_VAL: SimFunctionArgument | None = <fa0>
RETURN_VAL: SimFunctionArgument | None = <a0>
RETURN_ADDR: SimFunctionArgument | None = <ra>
CALLER_SAVED_REGS: list[str] = ['ra', 'a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7', 't0', 't1', 't2', 't3', 't4', 't5', 't6']
STACK_ALIGNMENT = 16
ARCH

alias of ArchRISCV64

next_arg(session, arg_type)
class angr.calling_conventions.SimCCRISCV64LinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3', 'a4', 'a5']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <a0>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchRISCV64

static syscall_num(state)
class angr.calling_conventions.SimCCO32

Bases: SimCC

ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3']
FP_ARG_REGS: list[str] = ['f12', 'f13', 'f14', 'f15']
STACKARG_SP_BUFF = 16
CALLER_SAVED_REGS: list[str] = ['t9', 'gp']
RETURN_ADDR: SimFunctionArgument | None = <ra>
RETURN_VAL: SimFunctionArgument | None = <v0>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <v1>
ARCH

alias of ArchMIPS32

next_arg(session, arg_type)
class angr.calling_conventions.SimCCO32LinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <v0>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchMIPS32

ERROR_REG: SimRegArg = <a3>
SYSCALL_ERRNO_START = -1133
static syscall_num(state)
class angr.calling_conventions.SimCCN64

Bases: SimCC

ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7']
CALLER_SAVED_REGS: list[str] = ['t9', 'gp']
FP_ARG_REGS: list[str] = []
STACKARG_SP_BUFF = 32
RETURN_ADDR: SimFunctionArgument | None = <ra>
RETURN_VAL: SimFunctionArgument | None = <v0>
ARCH

alias of ArchMIPS64

angr.calling_conventions.SimCCO64

alias of SimCCN64

class angr.calling_conventions.SimCCN32

Bases: SimCCN64

n32 passes its arguments like n64 does and differs only in the width of a pointer.

ARCH

alias of ArchMIPSN32

ARG_SLOT_SIZE: int | None = 8
class angr.calling_conventions.SimCCN64LinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <v0>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchMIPS64

ERROR_REG: SimRegArg = <a3>
SYSCALL_ERRNO_START = -1133
static syscall_num(state)
class angr.calling_conventions.SimCCN32LinuxSyscall

Bases: SimCCN64LinuxSyscall

ARCH

alias of ArchMIPSN32

ARG_SLOT_SIZE: int | None = 8
class angr.calling_conventions.SimCCPowerPC

Bases: SimCC

ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = ['fpr1', 'fpr2', 'fpr3', 'fpr4', 'fpr5', 'fpr6', 'fpr7', 'fpr8']
STACKARG_SP_BUFF = 8
RETURN_ADDR: SimFunctionArgument | None = <lr>
RETURN_VAL: SimFunctionArgument | None = <r3>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <r4>
FP_RETURN_VAL: SimFunctionArgument | None = <fpr1>
ARCH

alias of ArchPPC32

class angr.calling_conventions.SimCCPowerPCLinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <r3>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchPPC32

ERROR_REG: SimRegArg = <cr0_0>
SYSCALL_ERRNO_START = -515
static syscall_num(state)
class angr.calling_conventions.SimCCPowerPC64

Bases: SimCC

ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = ['fpr1', 'fpr2', 'fpr3', 'fpr4', 'fpr5', 'fpr6', 'fpr7', 'fpr8', 'fpr9', 'fpr10', 'fpr11', 'fpr12', 'fpr13']
STACKARG_SP_BUFF = 112
RETURN_ADDR: SimFunctionArgument | None = <lr>
RETURN_VAL: SimFunctionArgument | None = <r3>
FP_RETURN_VAL: SimFunctionArgument | None = <fpr1>
ARCH

alias of ArchPPC64

class angr.calling_conventions.SimCCPowerPC64LinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <r3>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchPPC64

ERROR_REG: SimRegArg = <cr0_0>
SYSCALL_ERRNO_START = -515
static syscall_num(state)
class angr.calling_conventions.SimCCSoot

Bases: SimCC

ARCH

alias of ArchSoot

ARG_REGS: list[str] = []
class angr.calling_conventions.SimCCUnknown

Bases: SimCC

Represent an unknown calling convention.

class angr.calling_conventions.SimCCS390X

Bases: SimCC

ARG_REGS: list[str] = ['r2', 'r3', 'r4', 'r5', 'r6']
FP_ARG_REGS: list[str] = ['f0', 'f2', 'f4', 'f6']
STACKARG_SP_BUFF = 160
RETURN_ADDR: SimFunctionArgument | None = <r14>
RETURN_VAL: SimFunctionArgument | None = <r2>
FP_RETURN_VAL: SimFunctionArgument | None = <f0>
ARCH

alias of ArchS390X

next_arg(session, arg_type)
class angr.calling_conventions.SimCCS390XLinuxSyscall

Bases: SimCCSyscall

ARG_REGS: list[str] = ['r2', 'r3', 'r4', 'r5', 'r6', 'r7']
FP_ARG_REGS: list[str] = []
RETURN_VAL: SimFunctionArgument | None = <r2>
RETURN_ADDR: SimFunctionArgument | None = <ip_at_syscall>
ARCH

alias of ArchS390X

static syscall_num(state)
angr.calling_conventions.register_default_cc_by_language(language, arch, cc, platform='Linux')
Parameters:
angr.calling_conventions.register_default_cc(arch, cc, platform='Linux')
Parameters:
angr.calling_conventions.default_cc(arch, platform='Linux', language=None, syscall=False, default=None)

Return the default calling convention for a given architecture, platform, and language combination.

Parameters:

  • arch (str) – The architecture name.

  • platform (str | None) – The platform name (e.g., “Linux” or “Win32”).

  • language (str | None) – The programming language name (e.g., “go”).

  • syscall (bool) – Return syscall convention (True), or normal calling convention (False, default).

  • default (type[SimCC] | None) – The default calling convention to return if nothing fits.

Return type:

type[SimCC] | None

Returns:

A default calling convention class if we can find one for the architecture, platform, and language combination, or the default if nothing fits.

angr.calling_conventions.project_language(project)

The source language to pick a calling convention for, or None when there is no confident answer.

A language-specific ABI reinterprets every argument and return value in the binary, so a detection that rests on something as thin as a single matching symbol name is not acted upon.

Return type:

str | None

angr.calling_conventions.default_cc_for_project(project, syscall=False, default=None)

Return the default calling convention for a project, taking its architecture, platform and detected source language into account.

Return type:

type[SimCC] | None

Parameters:
angr.calling_conventions.unify_arch_name(arch)

Return the unified architecture name.

Parameters:

arch (str) – The architecture name.

Return type:

str

Returns:

A unified architecture name.

angr.calling_conventions.register_syscall_cc(arch, os, cc)
angr.calling_conventions.cls_

alias of SimCCUsercall

angr.calling_conventions.is_stack_probe(func)

Return True if func is a Windows stack-probe / alloca-probe helper (__chkstk / __alloca_probe).

Return type:

bool

Parameters:

func (Function)

angr.calling_conventions.call_clobbered_regs(cc, target, arch)

Return the caller-saved (clobbered) register names for a call to target under calling convention cc.

This function is aware of special behaviors of functions, such as stack-probe callees (__chkstk / __alloca_probe). Future logic for other special functions may be added to this function as needed.

Return type:

list[str]

Parameters: