angr.exploration_techniques.directed_search

class angr.exploration_techniques.directed_search.DirectedSearch

Bases: ExplorationTechnique

Best-first search toward a target address, ranked by distance in a CFG.

After every step, the states in the stepped stash and in deferred_stash are ranked together by their distance to target_addr, and the beam_width closest stay in the stepped stash. The rest wait in deferred_stash, so a deferred state comes back as soon as it is among the closest. Ties keep the earlier-deferred state first. The technique keeps deferred_stash sorted by distance.

The distance of a state is the fewest CFG edges from the block holding its address to the block holding the target. It is a heuristic: every block counts as one hop, and it ignores calling context, so from inside a function the shortest return to any caller counts. States whose address is not in the CFG, or that cannot reach the target, rank last.

A state that loops close to the target stays ahead of farther ones indefinitely; pair this technique with LoopSeer or LengthLimiter when that can happen. Use one instance per stepped stash: states in deferred_stash can move into whichever stash is stepped, and successors sent elsewhere with target_stash are not ranked.

__init__(cfg, target_addr, beam_width=1, deferred_stash='directed_deferred')

Parameters:

• cfg – A CFG analysis (e.g. project.analyses.CFGFast()) or its CFGModel.

• target_addr (int) – The address to steer toward. It need not start a block.

• beam_width (int) – How many of the closest states to keep after each step (at least 1).

• deferred_stash (str) – The stash for states that are not among the closest.

Raises:

ValueError – If beam_width is below 1, or no CFG node contains target_addr.

distance(addr)

The CFG distance from addr to the target, or inf when addr is not in the CFG or cannot reach it.

Return type:

float

Parameters:

addr (int)