angr.go.optimization_passes.builtin_rewriter¶

class angr.go.optimization_passes.builtin_rewriter.GoBuiltinRewriter¶

Bases: OptimizationPass, CFGTransformationMixin

Turn calls into the Go runtime back into the builtins and operators the compiler lowered them from: new, make, append, copy, panic, string concatenation/comparison and the string/slice conversions.

growslice is special: the compiler only calls it when the slice must grow, so the call sits under an if newLen > cap diamond whose join block stores the appended elements (go1.25+ nests a stack-buffer choice under the check). The diamond is folded into one unconditional append(s, elems...) (append grows on demand itself) and the element stores are dropped; a memmove/typedslicecopy of the new elements is append(s, t...). The slice may be a tracked value, a field of a struct in memory, a header the compiler keeps in three scalars, or an array (arr[:n]). When the elements cannot be matched the call still becomes append(s) with a comment giving the element count.

ARCHES = None¶

PLATFORMS = None¶

STAGE: OptimizationPassStage = 7¶

NAME = 'Rewrite Go runtime calls into builtins'¶

values: _Values

__init__(func, manager, **kwargs)¶

static block_use_counts(block)¶

Return type:: Counter
Parameters:: block (Block)

callee_name(call)¶

Return type:: str | None
Parameters:: call (Call)

type_name(expr)¶

Return type:: str | None
Parameters:: expr (Expression)

type_size(expr)¶

Return type:: int | None
Parameters:: expr (Expression)

builtin(call, name, args, bits=None, arg_types=None, **extra)¶

Return type:

Call

Parameters:

call (Call)
name (str)
args (list)
bits (int | None)
arg_types (list[str] | None)

length_facts()¶

Return type:: LengthFacts

cond_targets(block)¶

The (true, false) target blocks of the conditional jump ending block.

Return type:: tuple[Block, Block] | None
Parameters:: block (Block)

string_length(facts, ptr, n, prefix=False)¶

The length word that goes with the string bytes at ptr when the guards pin it to n (or, with prefix, bound it below by n), and whether it is pinned. The tracked string’s own length when there is one; else the value of the nearest such guard.

Return type:

tuple[Expression, bool] | None

Parameters:

facts (list)
ptr (Expression)
n (int)
prefix (bool)

string_value(ptr, length)¶

The string with the given pointer and length words: the tracked value, else spelled field by field.

Return type:

Expression

Parameters:

ptr (Expression)
length (Expression)

to_bits(expr, bits)¶

Return type:

Expression

Parameters:

expr (Expression)
bits (int | None)

compare(op, lhs, rhs, bits, tags)¶

Return type:

Expression

Parameters:

op (str)
lhs (Expression)
rhs (Expression)
bits (int | None)

rewrite_call(call, block=None, stmt=None)¶

Return type:

Expression | None

Parameters:

call (Call)
block (Block | None)
stmt (Statement | None)

rewrite_call_stmt(stmt)¶

Return type:: Statement | None
Parameters:: stmt (SideEffectStatement)

rewrite_binop(expr)¶

Return type:: Expression | None
Parameters:: expr (BinaryOp)

rewrite_ite(expr)¶

Return type:: Expression | None
Parameters:: expr (ITE)

rewrite_struct(expr)¶

Return type:: Expression | None
Parameters:: expr (Struct)