angr.knowledge_plugins.patterns

User-authored fuzzy patterns, kept with the knowledge base so they outlive a session.

A stored pattern is a KnownPattern plus how it is to be applied: whether it is switched on, and the similarity an occurrence must reach before it is outlined. Patterns are keyed by name; call names are unique too, since an outlined call is looked up by its target.

class angr.knowledge_plugins.patterns.PatternStats

Bases: object

What the outliner pass saw of one pattern in one function when it last ran there.

matches: int = 0

verified occurrences found before anything was outlined

outlined: int = 0

occurrences outlined into calls

call_addrs: list[int]

the instruction address each outlined call carries, which is where it renders

match_addrs: list[frozenset[int]]

for each verified occurrence, the instruction addresses its statements carry

__init__(matches=0, outlined=0, call_addrs=<factory>, match_addrs=<factory>)
Parameters:
Return type:

None

class angr.knowledge_plugins.patterns.StoredPattern

Bases: object

One fuzzy pattern and its application settings.

pattern: KnownPattern
enabled: bool = True
min_similarity: float = 0.8

an occurrence is outlined only at this similarity or above (see search.TemplateMatch)

origin_func: int | None = None

address of the function the pattern was lifted from, if any

require_verified: bool = True

outline only occurrences that pass the pattern’s structural match (constants, captures); off, similarity alone decides, as it does for discovered patterns

created_at: float
property name: str
to_dict()
Return type:

dict[str, Any]

classmethod from_dict(data)
Return type:

StoredPattern

Parameters:

data (dict[str, Any])

__init__(pattern, enabled=True, min_similarity=0.8, origin_func=None, require_verified=True, created_at=<factory>)
Parameters:
Return type:

None

class angr.knowledge_plugins.patterns.Patterns

Bases: KnowledgeBasePlugin

The fuzzy patterns of a knowledge base, by pattern name.

__init__(kb)
Parameters:

kb (KnowledgeBase)

copy()
Return type:

Patterns

record_stats(func_addr, stats)

Replace what is known about func_addr: the outliner pass saw exactly these patterns.

Return type:

None

Parameters:
stats(func_addr, name)

The outliner pass’s numbers for a pattern in a function, or None if it did not search for that pattern there when it last ran.

Return type:

PatternStats | None

Parameters:
get(name)
Return type:

StoredPattern | None

Parameters:

name (str)

add(pattern, *, enabled=True, min_similarity=0.8, origin_func=None, require_verified=True, replace=False)

Store pattern. Refuses a name or call name already taken unless replace.

Return type:

StoredPattern

Parameters:
store(stored)

Put a StoredPattern back, keeping its settings (a loader’s entry point).

Return type:

None

Parameters:

stored (StoredPattern)

remove(name)
Return type:

bool

Parameters:

name (str)

set_enabled(name, enabled)
Return type:

None

Parameters:
enabled_patterns()
Return type:

list[StoredPattern]

by_call_name(call_name)
Return type:

StoredPattern | None

Parameters:

call_name (str)

to_records()
Return type:

list[dict[str, Any]]

load_records(records)
Return type:

None

Parameters:

records (list[dict[str, Any]])