angr.go.knowledge_plugins¶

class angr.go.knowledge_plugins.GoGlobals

Bases: KnowledgeBasePlugin

Package-level variables recovered without data symbols: the runtime’s own globals located by shape (angr.go.analyses.runtime_globals) and the variables typed from their initializers (angr.go.analyses.package_variables). Computed once per project by angr.go.analyses.go_globals_recovery.GoGlobalsRecovery, lazily on first use unless it was run ahead of time; kb.go_signatures.variable_at consults it after the symbol-backed sources.

__init__(kb)

load()

Run GoGlobalsRecovery once; later calls are no-ops.

Return type:: None

mark_loaded()

Return type:: None

property loaded: bool

property variables: dict[int, GoVariable]

note(var, replace=False)

Record a variable; an address already known keeps its first record unless replace.

Return type:

None

Parameters:

var (GoVariable)
replace (bool)

variable_at(addr)

Return type:: GoVariable | None
Parameters:: addr (int)

addr_of(name)

Return type:: int | None
Parameters:: name (str)

copy()

class angr.go.knowledge_plugins.GoSignatures

Bases: KnowledgeBasePlugin

Go function signatures and named types known for this binary, merged from every source (external tools, DWARF, the binary’s runtime type descriptors, the stdlib database, in that priority) and turned into Go SimTypes on demand.

__init__(kb)

record_version(key)

The counter value when the record key (a function name, callsite:0x.. or closure:0x..) last changed; 0 when it was never written.

Return type:: int
Parameters:: key (str)

record_fingerprint(key)

A process-independent spelling of the record key as it is now (None when absent), for comparing what a decompilation consulted with what another process knows.

Return type:: str | None
Parameters:: key (str)

track()

Record which inference records are consulted while the block runs, each with the version it had when first consulted (deps). Nested scopes report to the enclosing one.

Return type:: Iterator[dict[str, int]]

untracked()

Suspend dependency tracking: for one-off whole-binary scans that are nobody’s dependency.

Return type:: Iterator[None]

note(name)

Count the inferred record of name as consulted by the decompilation in progress.

Return type:: None
Parameters:: name (str)

deps_current(deps, version)

Whether a decompilation that started from version and consulted deps (key -> version seen) reflects the current records: none of them changed since. Without a dependency list only the global counter decides.

Return type:

bool

Parameters:

deps (dict[str, int] | None)
version (int | None)

is_current(cache)

Whether the decompilation in cache (a DecompilationCache) reflects the current inference records.

Return type:: bool

stale_decompilations(kb=None)

The (addr, flavor) keys of the Go decompilations in kb.decompilations that are out of date.

Return type:: list[tuple[int, str]]

add_source(sigs, priority=None)

Return type:

None

Parameters:

sigs (GoSignatureSet)
priority (int | None)

load_sources(go_version=None)

Load the binary’s own DWARF signatures (when present), its runtime type descriptors and the stdlib database for its Go version. Runs once.

Return type:: bool
Parameters:: go_version (str | None)

load_stdlib(go_version=None)

Load the binary’s own DWARF signatures (when present), its runtime type descriptors and the stdlib database for its Go version. Runs once.

Return type:: bool
Parameters:: go_version (str | None)

signature(name)

Return type:: GoFuncSignature | None
Parameters:: name (str)

variable_at(addr)

Return type:: GoVariable | None
Parameters:: addr (int)

named_type(name)

Return type:: GoNamedType | None
Parameters:: name (str)

type_name_at(addr)

The name of the type whose runtime descriptor is at addr, when a source (DWARF) recorded it.

Return type:: str | None
Parameters:: addr (int)

property parser: GoTypeParser

type(type_str)

Return type:: SimType
Parameters:: type_str (str)

prototype(name)

The function type of name (receiver first), or None when the signature is unknown.

Return type:: GoSimTypeFunction | None
Parameters:: name (str)

set_inferred(name, param_types=None, results=None, caller_results=None, result_words=0, groups=None, return_words=0, fp_results=None)

Record what was inferred for name (kept until a real signature appears): parameter types, callee-side result types, caller-side result types and word groups, how many result registers its returns write, or a whole record (as inferred_record returns it, possibly after a round trip through JSON) in place of the parameter types.

Return type:

GoInferredSignature

Parameters:

name (str)
param_types (list[str] | dict | None)
results (dict[int, tuple[str, int]] | None)
caller_results (dict[int, tuple[str, int]] | None)
result_words (int)
groups (dict[int, tuple[int, str | None]] | None)
return_words (int)
fp_results (dict[int, str] | None)

set_callsite_inferred(addr, caller_results=None, result_words=0, groups=None, fp_results=None)

Record what the caller’s reads say about the results of the indirect call at addr (an interface method or closure without a known signature); the next decompilation types the call-site prototype from it.

Return type:

GoInferredSignature

Parameters:

addr (int)
caller_results (dict[int, tuple[str, int]] | None)
result_words (int)
groups (dict[int, tuple[int, str | None]] | None)
fp_results (dict[int, str] | None)

callsite_record(addr)

Return type:: GoInferredSignature | None
Parameters:: addr (int)

inferred(name)

The inferred parameter types of name.

Return type:: list[str] | None
Parameters:: name (str)

inferred_record(name)

Return type:: GoInferredSignature | None
Parameters:: name (str)

results_guessed(func)

True when nothing but the calling-convention guess describes the results of func: its prototype is guessed, or it was rebuilt (a promoted receiver, inferred parameters) around the guessed result type.

Return type:: bool
Parameters:: func (Function)

fp_results_open(func)

True when callers may still add floating-point results to func: no real signature and no user prototype describe it. Its integer results may already be typed (inferred), which says nothing about the float ones.

Return type:: bool
Parameters:: func (Function)

untyped_params(func)

Indices of the parameters of func that only the calling-convention guess describes: a prototype rebuilt around a promoted receiver or inferred results keeps the guessed words (non-Go types, or the uintptr an inferred record spells for words it could not type). Type inference may know better about those, so they are no ground truth. Parameters of a real signature always are.

Return type:: frozenset[int]
Parameters:: func (Function)

inferred_prototype(name, guessed)

The inferred signature of name as a function type: inferred parameter types (else the guessed ones) and inferred result types (else the guessed result type guessed.returnty).

Return type:: GoSimTypeFunction | None
Parameters:: name (str)

set_closure_context(addr, type_str)

Record the closure record type a parent function builds for the closure body at addr.

Return type:

None

Parameters:

addr (int)
type_str (str)

closure_context(addr)

The closure record type of the body at addr (captures are its fields after F), if known.

Return type:: str | None
Parameters:: addr (int)

arg_size_at(addr)

The byte size of the parameters of the function at addr from the pclntab (results excluded).

Return type:: int | None
Parameters:: addr (int)

prototype_at(addr)

The function type of the method whose code starts at addr, from the runtime type descriptors’ method tables (receiver first). Covers methods of named types in stripped binaries, which no signature source names.

Return type:: GoSimTypeFunction | None
Parameters:: addr (int)

copy()

class angr.go.knowledge_plugins.GoTypes

Bases: KnowledgeBasePlugin

The runtime type descriptors of this binary (angr.go.analyses.type_descriptors), parsed once on first use: descriptor address <-> canonical Go type string, itabs, and the named-type records that back kb.go_signatures.

__init__(kb)

property descriptors: GoTypeDescriptors

property loaded: bool

property go_version: str | None

property types: GoSignatureSet

name_at(addr)

The canonical Go type string of the descriptor at addr.

Return type:: str | None
Parameters:: addr (int)

addr_of(name)

The descriptor address of the type spelled name.

Return type:: int | None
Parameters:: name (str)

itab_at(addr)

(interface type, concrete type) of the itab at addr.

Return type:: tuple[str, str] | None
Parameters:: addr (int)

method_at(addr)

(receiver type, method name, func type) of the method whose code starts at addr.

Return type:: tuple[str, str, str] | None
Parameters:: addr (int)

type_at(addr)

The SimType of the descriptor at addr, built by kb.go_signatures.

Return type:: SimType | None
Parameters:: addr (int)

copy()

Submodules

`go_globals`
`go_signatures`
`go_types`