angr.go.analyses.block_scan

Raw-AIL block scanning shared by the project-level Go analyses: lift blocks straight from VEX (no SSA, no simplification) and track which constants and call results the machine registers hold.

class angr.go.analyses.block_scan.RegisterEnv

Bases: object

What the machine registers (and VEX temporaries) hold inside one block: constants, typed call results and closure-context offsets. Keys are ("r", offset) / ("t", index).

__init__(arch, values=None)
Parameters:

values (dict | None)

arch
values: dict[tuple, tuple]
copy()
Return type:

RegisterEnv

merge(other)

Meet of two environments: only agreeing register values survive (temporaries are block-local).

Return type:

RegisterEnv

Parameters:

other (RegisterEnv)

registers()
Return type:

dict[int, tuple]

eval(expr)

The value of expr, or None.

store(addr_expr, data_expr, size)

Remember a word stored into a stack slot.

Return type:

None

Parameters:

size (int)

assign(stmt)
Return type:

None

Parameters:

stmt (Assignment)

clear_call_clobbers(keep=())

Forget every register except the stack pointer and keep (offsets), and every temporary.

Return type:

None

Parameters:

keep (Iterable[int])

angr.go.analyses.block_scan.allocator(name)

(type prefix, descriptor argument index) for a runtime allocator, else None.

Return type:

tuple[str, int | None] | None

Parameters:

name (str | None)

angr.go.analyses.block_scan.block_successors(project, addr, size=None)

Direct successors of a block: its exits and, after a call, the return address.

Return type:

list[int]

Parameters:
angr.go.analyses.block_scan.call_target(stmt)
Return type:

int | None

angr.go.analyses.block_scan.callee_name(project, addr)
Return type:

str | None

Parameters:
angr.go.analyses.block_scan.function_blocks(project, addr, limit=4096)

Block addresses of the function at addr with their successor lists: the CFG’s function graph when the function is known, else a bounded walk over direct jumps from the entry.

Return type:

tuple[list[int], dict[int, list[int]]]

Parameters:
angr.go.analyses.block_scan.is_function_addr(project, addr)

addr starts a function known to the CFG or to the (pclntab-derived) symbol table.

Return type:

bool

Parameters:
angr.go.analyses.block_scan.is_return(stmt)
Return type:

bool

angr.go.analyses.block_scan.lift_ail(project, addr, size=None, manager=None)

The raw AIL statements of the block at addr, or [] when it cannot be lifted.

Return type:

list

Parameters:
angr.go.analyses.block_scan.loads_in(expr, out)

Collect every Load below expr (depth first).

Return type:

None

Parameters:

out (list)