angr.knowledge_plugins.variables.variable_manager¶

class angr.knowledge_plugins.variables.variable_manager.VariableType¶

Bases: object

Describes variable types.

REGISTER = 0¶

MEMORY = 1¶

class angr.knowledge_plugins.variables.variable_manager.LiveVariables¶

Bases: object

A collection of live variables at a program point.

__init__(register_region, stack_region)¶

register_region

stack_region

class angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal¶

Bases: Serializable

Manage variables for a function. It is meant to be used internally by VariableManager, but it’s common to be given a reference to one in response to a query for “the variables for a given function”. Maybe a better name would be “VariableManagerScope”.

__init__(manager, func_addr=None)¶

manager: VariableManager

flavor: str | None

variable_to_types: dict[SimVariable, SimType]

array_length_exprs: dict[SimVariable, Expression]

copy(manager)¶

Clone this manager for manager. Every SimVariable is copied, so renaming or retyping a variable in one manager does not affect the other; types, variable accesses’ code locations and AIL expressions are shared.

Return type:: VariableManagerInternal
Parameters:: manager (VariableManager)

set_manager(manager)¶

Parameters:: manager (VariableManager)

next_variable_ident(sort)¶

add_variable(sort, start, variable)¶

Parameters:: variable (SimVariable)

set_variable(sort, start, variable)¶

Parameters:: variable (SimVariable)

write_to(variable, offset, location, overwrite=False, atom=None)¶

read_from(variable, offset, location, overwrite=False, atom=None)¶

reference_at(variable, offset, location, overwrite=False, atom=None)¶

record_variable(location, variable, offset, overwrite=False, atom=None)¶

Parameters:

location (CodeLocation)
offset (int | None)
atom (ailment.expression.Atom | None)

remove_variable_by_atom(location, variable, atom)¶

Parameters:

location (CodeLocation)
variable (SimVariable)

rebind_variable_records(old, new)¶

Re-point every instruction, statement and atom record of old to new.

Return type:

None

Parameters:

old (SimVariable)
new (SimVariable)

make_phi_node(block_addr, *variables)¶

Create a phi variable for variables at block block_addr.

Parameters:

block_addr (int) – The address of the current block.
variables – Variables that the phi variable represents.

Returns:

The created phi variable.

set_live_variables(addr, register_region, stack_region)¶

find_variables_by_insn(ins_addr, sort)¶

is_variable_used_at(variable, loc)¶

Return type:

bool

Parameters:

variable (SimVariable)
loc (tuple[int, int])

find_variable_by_stmt(block_addr, stmt_idx, sort, block_idx=None)¶

Parameters:: block_idx (int | None)

find_variables_by_stmt(block_addr, stmt_idx, sort, block_idx=None)¶

Return type:

list[tuple[SimVariable, int | None]]

Parameters:

block_addr (int)
stmt_idx (int)
sort (str)
block_idx (int | None)

find_variable_by_atom(block_addr, stmt_idx, atom, block_idx=None)¶

Parameters:: block_idx (int | None)

variable_by_vvar_id(varid)¶

The variable that was assigned to the virtual variable with the given id, if any.

Return type:: SimVariable | None
Parameters:: varid (int)

find_variables_by_atom(block_addr, stmt_idx, atom, block_idx=None)¶

Return type:

set[tuple[SimVariable, int | None]]

Parameters:

atom (Expression)
block_idx (int | None)

find_variables_by_stack_offset(offset)¶

Return type:: set[SimVariable]
Parameters:: offset (int)

find_variables_by_register(reg)¶

Return type:: set[SimVariable]
Parameters:: reg (str | int)

get_variable_accesses(variable, same_name=False)¶

Return type:

list[VariableAccess]

Parameters:

variable (SimVariable)
same_name (bool)

get_variables(sort=None, collapse_same_ident=False)¶

Get a list of variables.

Overloads:

sort (Literal['stack']), collapse_same_ident (bool) = False → list[SimStackVariable]
sort (Literal['reg']), collapse_same_ident (bool) = False → list[SimRegisterVariable]
sort (None) = None, collapse_same_ident (bool) = False → list[SimRegisterVariable]

Parameters:

sort – Sort of the variable to get.
collapse_same_ident – Whether variables of the same identifier should be collapsed or not.

Returns:

A list of variables.

get_unified_variables(sort=None)¶

Get a list of unified variables.

Overloads:

sort (Literal['stack']) → list[SimStackVariable]
sort (Literal['reg']) → list[SimRegisterVariable]
sort (None) → list[SimRegisterVariable]

Parameters:

sort – Sort of the variable to get.

Returns:

A list of variables.

get_global_variables(addr)¶

Get global variable by the address of the variable.

Parameters:: addr (int) – Address of the variable.
Returns:: A set of variables or an empty set if no variable exists.

is_phi_variable(var)¶

Test if var is a phi variable.

Parameters:: var (SimVariable) – The variable instance.
Returns:: True if var is a phi variable, False otherwise.
Return type:: bool

get_phi_subvariables(var)¶

Get sub-variables that phi variable var represents.

Parameters:: var (SimVariable) – The variable instance.
Returns:: A set of sub-variables, or an empty set if var is not a phi variable.
Return type:: set

get_phi_variables(block_addr)¶

Get a dict of phi variables and their corresponding variables.

Parameters:: block_addr (int) – Address of the block.
Returns:: A dict of phi variables of an empty dict if there are no phi variables at the block.
Return type:: dict

get_variables_without_writes()¶

Get all variables that have never been written to.

Return type:: list[SimVariable]
Returns:: A list of variables that are never written to.

input_variables(exclude_specials=True)¶

Get all variables that have never been written to.

Returns:: A list of variables that are never written to.
Parameters:: exclude_specials (bool)

assign_variable_names(labels=None, types=None)¶

Assign default names to all SSA variables.

Parameters:: labels – Known labels in the binary.
Returns:: None

assign_unified_variable_names(labels=None, arg_names=None, reset=False, func_blocks=None)¶

Assign default names to all unified variables. If func_blocks is provided, we will find out variables that are only ever written to in Phi assignments and never used elsewhere, and put these variables at the end of the sorted list. These variables are likely completely removed during the dephication process.

Parameters:

labels – Known labels in the binary.
arg_names (list[str] | None) – Known argument names.
reset (bool) – Reset all variable names or not.
func_blocks (list[Block] | None) – A list of function blocks of the function where these variables are accessed.

Return type:

None

set_variable_type(var, ty, name=None, override_bot=True, all_unified=False, mark_manual=False)¶

Return type:

None

Parameters:

var (SimVariable)
ty (SimType)
name (str | None)
override_bot (bool)
all_unified (bool)
mark_manual (bool)

get_variable_type(var)¶

Return type:: SimType | None

remove_types()¶

same_offset_stack_vvarids()¶

Return the IDs of vvars backing stack variables that share their offset with another stack variable. These are the only vvars whose interference unify_variables() consults.

Return type:: set[int]

unify_variables(interference=None)¶

Map SSA variables to a unified variable. Fill in self._unified_variables.

Return type:: None
Parameters:: interference (networkx.Graph[int] | None)

set_unified_variable(variable, unified)¶

Set the unified variable for a given SSA variable.

Parameters:

variable (SimVariable) – The SSA variable.
unified (SimVariable) – The unified variable.

Return type:

None

Returns:

None

unified_variable(variable)¶

Return the unified variable for a given SSA variable,

Parameters:: variable (SimVariable) – The SSA variable.
Return type:: SimVariable | None
Returns:: The unified variable, or None if there is no such SSA variable.

get_stackvar_max_sizes(stack_items)¶

Get the maximum size of each stack variable regardless of the type of each stack variable, under the assumption that stack variables do not overlap.

Return type:: dict[SimStackVariable, int]
Returns:: A dictionary from SimStackVariable to its maximum size.
Parameters:: stack_items (dict[int, StackItem])

class angr.knowledge_plugins.variables.variable_manager.VariableManager¶

Bases: KnowledgeBasePlugin

Manage variables.

__init__(kb)¶

global_managers: dict[str, VariableManagerInternal]

function_managers: dict[int, VariableManagerInternal] | SpillingVariableInternalDict

property global_manager: VariableManagerInternal¶: The global manager of the default flavor. Code with no decompilation flavor (CFG, DWARF, SimProcedures) uses it.

get_global_manager(flavor)¶

The global manager that a decompilation of the given flavor (None means the default flavor) reads and writes. A new flavor starts empty: global names are re-derived from labels, types are re-inferred.

Return type:: VariableManagerInternal
Parameters:: flavor (str | None)

set_global_manager(flavor, manager)¶

Return type:

None

Parameters:

flavor (str | None)
manager (VariableManagerInternal)

has_function_manager(key)¶

Return type:: bool
Parameters:: key (int)

has_function_manager_for_flavor(key, flavor)¶

Whether a function manager exists and can be reused by a decompilation of the given flavor. A manager of unknown flavor (None) is compatible with any flavor.

Return type:

bool

Parameters:

key (int)
flavor (str)

get_function_manager(func_addr)¶

Return type:: VariableManagerInternal

initialize_variable_names()¶

Return type:: None

get_variable_accesses(variable, same_name=False)¶

Get a list of all references to the given variable.

Parameters:

variable (SimVariable) – The variable.
same_name (bool) – Whether to include all variables with the same variable name, or just based on the variable identifier.

Return type:

list[VariableAccess]

Returns:

All references to the variable.

copy()¶

Return type:: VariableManager

static convert_variable_list(vlist, manager)¶

Parameters:

vlist (list[Variable])
manager (VariableManagerInternal)

load_from_dwarf(cu_list=None)¶

Parameters:: cu_list (list[CompilationUnit] | None)

class angr.knowledge_plugins.variables.variable_manager.DecompilationVariableManager¶

Bases: VariableManager

Holds variables discovered during decompilation, kept separate from the disassembly-level kb.variables. Exposed as kb.dec_variables. Per-function managers are held in a SpillingVariableInternalDict, which spills least-recently-used entries to the RuntimeDb LMDB store (disable via USE_SPILLING_DVARS).

__init__(kb)¶