angr.knowledge_plugins.functions.soot_function

class angr.knowledge_plugins.functions.soot_function.SootFunction

Bases: Function

A representation of a Soot function.

__init__(function_manager, addr, name=None, syscall=None)

Function constructor for Soot

Parameters:

  • addr – The address of the function.

  • name – (Optional) The name of the function.

  • syscall – (Optional) Whether this function is a syscall or not.

register_node(is_local, node, update_func_block_count=True)
Parameters:

  • is_local (bool)

  • update_func_block_count (bool)

property blocks

An iterator of all local blocks in the current function.

property code_nodes: dict[int, CodeNode]
property cyclomatic_complexity

The cyclomatic complexity of the function.

Cyclomatic complexity is a software metric used to indicate the complexity of a program. It is a quantitative measure of the number of linearly independent paths through a program’s source code. It is computed using the formula: M = E - N + 2P, where E = the number of edges in the graph, N = the number of nodes in the graph, P = the number of connected components.

The cyclomatic complexity value is lazily computed and cached for future use. Initially this value is None until it is computed for the first time

Returns:

The cyclomatic complexity of the function.

Return type:

int

property block_addrs

An iterator of all local block addresses in the current function.

Returns:

block addresses.

property block_addrs_set

Return a set of block addresses for a better performance of inclusion tests.

Returns:

A set of block addresses.

Return type:

set

get_block(addr, size=None, byte_string=None)

Getting a block out of the current function.

Parameters:

  • addr (int) – The address of the block.

  • size (int | None) – The size of the block. This is optional. If not provided, angr will load

  • byte_string (bytes | None)

Returns:

get_block_size(addr)
Return type:

int | None

Parameters:

addr (int)

property nodes: Iterable[CodeNode]
get_node(addr)
Return type:

BlockNode | None

property endpoints
property endpoints_with_type
property ret_sites
property jumpout_sites
property retout_sites
property callout_sites
property size
add_jumpout_site(node)

Add a custom jumpout site.

Parameters:

node (CodeNode) – The address of the basic block that control flow leaves during this transition.

Returns:

None

add_retout_site(node)

Add a custom retout site.

Parameters:

node (CodeNode)

property transition_graph: DiGraph

A read-only networkx view of the transition graph, created on-demand and kept in sync with the Function’s updates.

property startpoint: CodeNode | None
clear_transition_graph()
confirm_fakeret(src, dst)
transit_to(from_node, to_node, outside=False, ins_addr=None, stmt_idx=None, is_exception=False, update_func_block_count=True)

Registers an edge between basic blocks in this function’s transition graph.

:param from_node The address of the basic block that begins this transition. :param to_node The address of the basic block that ends this transition. :type outside: bool :param outside: If this is a transition to another function. :return: None

Parameters:
call_to(from_node, to_func, ret_node, stmt_idx=None, ins_addr=None, return_to_outside=False, syscall=False, update_func_block_count=True)

Registers an edge between the caller basic block and callee function.

Parameters:

  • from_node – The basic block that control flow leaves during the transition.

  • to_func (FuncNode | HookNode) – The function that we are calling, represented as a FuncNode.

  • ret_node – The basic block that control flow should return to after the function call.

  • stmt_idx – Statement ID of this call.

  • ins_addr – Instruction address of this call.

  • syscall (bool)

  • update_func_block_count (bool)

fakeret_to(from_node, to_node, confirmed=None, to_outside=False, update_func_block_count=True)
Parameters:

update_func_block_count (bool)

remove_fakeret(from_node, to_node)
return_from_call(from_func, to_node, to_outside=False, confirm_fakeret=True)
Parameters:
update_func_block_count()

Update the cached block count of this function in the function manager.

Return type:

None

add_return_site(return_site)

Registers a basic block as a site for control flow to return from this function.

Parameters:

return_site (CodeNode) – The block node that ends with a return.

add_call_site(call_site_addr, call_target_addr, retn_addr)

Registers a basic block as calling a function and returning somewhere.

Parameters:

  • call_site_addr – The address of a basic block that ends in a call.

  • call_target_addr – The address of the target of said call.

  • retn_addr – The address that said call will return to.

add_endpoint(endpoint_node, sort)

Registers an endpoint with a type of sort. The type can be one of the following: - call: calling a function that does not return - return: returning from the current function - transition: a jump/branch targeting a different function

Parameters:

  • endpoint_node – The endpoint node.

  • sort – Type of the endpoint.

Returns:

None

mark_nonreturning_calls_endpoints()

Iterate through all call edges in transition graph. For each call a non-returning function, mark the source basic block as an endpoint.

This method should only be executed once all functions are recovered and analyzed by CFG recovery, so we know whether each function returns or not.

Returns:

None

property call_sites
get_call_sites()

Gets a list of all the basic blocks that end in calls.

Return type:

Iterable[int]

Returns:

A view of the addresses of the blocks that end in calls.

get_call_target(callsite_addr)

Get the target of a call.

Parameters:

callsite_addr – The address of a basic block that ends in a call.

Returns:

The target of said call, or None if callsite_addr is not a callsite.

get_call_return(callsite_addr)

Get the hypothetical return address of a call.

Parameters:

callsite_addr – The address of the basic block that ends in a call.

Returns:

The likely return target of said call, or None if callsite_addr is not a callsite.

property graph: networkx.DiGraph[CodeNode]

Get a local transition graph. A local transition graph is a transition graph that only contains nodes that belong to the current function. All edges, except for the edges going out from the current function or coming from outside the current function, are included.

The generated graph is cached in self._local_transition_graph.

Returns:

A local transition graph.

Return type:

networkx.DiGraph

subgraph(ins_addrs)

Generate a sub control flow graph of instruction addresses based on self.graph

Parameters:

ins_addrs (iterable) – A collection of instruction addresses that should be included in the subgraph.

Return networkx.DiGraph:

A subgraph.

dbg_print()

Returns a representation of the list of basic blocks in this function.

property has_return
copy()
remove_edge(from_node, to_node)
Return type:

None