angr.knowledge_plugins.variables.variable_manager

class angr.knowledge_plugins.variables.variable_manager.SortedDict

Bases: dict[K, T], Generic

irange(*args, **kwargs)
Return type:

Iterator[TypeVar(K)]

class angr.knowledge_plugins.variables.variable_manager.VariableType

Bases: object

Describes variable types.

REGISTER = 0
MEMORY = 1
class angr.knowledge_plugins.variables.variable_manager.LiveVariables

Bases: object

A collection of live variables at a program point.

__init__(register_region, stack_region)
register_region
stack_region
class angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal

Bases: Serializable

Manage variables for a function. It is meant to be used internally by VariableManager, but it’s common to be given a reference to one in response to a query for “the variables for a given function”. Maybe a better name would be “VariableManagerScope”.

__init__(manager, func_addr=None)
manager: VariableManager
variable_to_types: dict[SimVariable, SimType]
set_manager(manager)
Parameters:

manager (VariableManager)

next_variable_ident(sort)
add_variable(sort, start, variable)
Parameters:

variable (SimVariable)

set_variable(sort, start, variable)
Parameters:

variable (SimVariable)

write_to(variable, offset, location, overwrite=False, atom=None)
read_from(variable, offset, location, overwrite=False, atom=None)
reference_at(variable, offset, location, overwrite=False, atom=None)
record_variable(location, variable, offset, overwrite=False, atom=None)
Parameters:
remove_variable_by_atom(location, variable, atom)
Parameters:
make_phi_node(block_addr, *variables)

Create a phi variable for variables at block block_addr.

Parameters:

  • block_addr (int) – The address of the current block.

  • variables – Variables that the phi variable represents.

Returns:

The created phi variable.

set_live_variables(addr, register_region, stack_region)
find_variables_by_insn(ins_addr, sort)
is_variable_used_at(variable, loc)
Return type:

bool

Parameters:
find_variable_by_stmt(block_addr, stmt_idx, sort, block_idx=None)
Parameters:

block_idx (int | None)

find_variables_by_stmt(block_addr, stmt_idx, sort, block_idx=None)
Return type:

list[tuple[SimVariable, int | None]]

Parameters:

  • block_addr (int)

  • stmt_idx (int)

  • sort (str)

  • block_idx (int | None)

find_variable_by_atom(block_addr, stmt_idx, atom, block_idx=None)
Parameters:

block_idx (int | None)

find_variables_by_atom(block_addr, stmt_idx, atom, block_idx=None)
Return type:

set[tuple[SimVariable, int | None]]

Parameters:
find_variables_by_stack_offset(offset)
Return type:

set[SimVariable]

Parameters:

offset (int)

find_variables_by_register(reg)
Return type:

set[SimVariable]

Parameters:

reg (str | int)

get_variable_accesses(variable, same_name=False)
Return type:

list[VariableAccess]

Parameters:
get_variables(sort=None, collapse_same_ident=False)
Overloads:

  • self, sort (Literal[‘stack’]), collapse_same_ident (bool) → list[SimStackVariable]

  • self, sort (Literal[‘reg’]), collapse_same_ident (bool) → list[SimRegisterVariable]

  • self, sort (None), collapse_same_ident (bool) → list[SimRegisterVariable | SimRegisterVariable]

Get a list of variables.

Parameters:

  • sort – Sort of the variable to get.

  • collapse_same_ident – Whether variables of the same identifier should be collapsed or not.

Returns:

A list of variables.

get_unified_variables(sort=None)
Overloads:

  • self, sort (Literal[‘stack’]) → list[SimStackVariable]

  • self, sort (Literal[‘reg’]) → list[SimRegisterVariable]

  • self, sort (None) → list[SimRegisterVariable | SimRegisterVariable]

Get a list of unified variables.

Parameters:

sort – Sort of the variable to get.

Returns:

A list of variables.

get_global_variables(addr)

Get global variable by the address of the variable.

Parameters:

addr (int) – Address of the variable.

Returns:

A set of variables or an empty set if no variable exists.

is_phi_variable(var)

Test if var is a phi variable.

Parameters:

var (SimVariable) – The variable instance.

Returns:

True if var is a phi variable, False otherwise.

Return type:

bool

get_phi_subvariables(var)

Get sub-variables that phi variable var represents.

Parameters:

var (SimVariable) – The variable instance.

Returns:

A set of sub-variables, or an empty set if var is not a phi variable.

Return type:

set

get_phi_variables(block_addr)

Get a dict of phi variables and their corresponding variables.

Parameters:

block_addr (int) – Address of the block.

Returns:

A dict of phi variables of an empty dict if there are no phi variables at the block.

Return type:

dict

get_variables_without_writes()

Get all variables that have never been written to.

Return type:

list[SimVariable]

Returns:

A list of variables that are never written to.

input_variables(exclude_specials=True)

Get all variables that have never been written to.

Returns:

A list of variables that are never written to.

Parameters:

exclude_specials (bool)

assign_variable_names(labels=None, types=None)

Assign default names to all SSA variables.

Parameters:

labels – Known labels in the binary.

Returns:

None

assign_unified_variable_names(labels=None, arg_names=None, reset=False, func_blocks=None)

Assign default names to all unified variables. If func_blocks is provided, we will find out variables that are only ever written to in Phi assignments and never used elsewhere, and put these variables at the end of the sorted list. These variables are likely completely removed during the dephication process.

Parameters:

  • labels – Known labels in the binary.

  • arg_names (list[str] | None) – Known argument names.

  • reset (bool) – Reset all variable names or not.

  • func_blocks (list[Block] | None) – A list of function blocks of the function where these variables are accessed.

Return type:

None

set_variable_type(var, ty, name=None, override_bot=True, all_unified=False, mark_manual=False)
Return type:

None

Parameters:
get_variable_type(var)
Return type:

SimType | None

remove_types()
unify_variables(interference=None)

Map SSA variables to a unified variable. Fill in self._unified_variables.

Parameters:

interference (networkx.Graph[int] | None)

Return type:

None

set_unified_variable(variable, unified)

Set the unified variable for a given SSA variable.

Parameters:
Return type:

None

Returns:

None

unified_variable(variable)

Return the unified variable for a given SSA variable,

Parameters:

variable (SimVariable) – The SSA variable.

Return type:

SimVariable | None

Returns:

The unified variable, or None if there is no such SSA variable.

get_stackvar_max_sizes(stack_items)

Get the maximum size of each stack variable regardless of the type of each stack variable, under the assumption that stack variables do not overlap.

Return type:

dict[SimStackVariable, int]

Returns:

A dictionary from SimStackVariable to its maximum size.

Parameters:

stack_items (dict[int, StackItem])

class angr.knowledge_plugins.variables.variable_manager.VariableManager

Bases: KnowledgeBasePlugin

Manage variables.

__init__(kb)
function_managers: dict[int, VariableManagerInternal]
has_function_manager(key)
Return type:

bool

Parameters:

key (int)

get_function_manager(func_addr)
Return type:

VariableManagerInternal

initialize_variable_names()
Return type:

None

get_variable_accesses(variable, same_name=False)

Get a list of all references to the given variable.

Parameters:

  • variable (SimVariable) – The variable.

  • same_name (bool) – Whether to include all variables with the same variable name, or just based on the variable identifier.

Return type:

list[VariableAccess]

Returns:

All references to the variable.

copy()
static convert_variable_list(vlist, manager)
Parameters:
load_from_dwarf(cu_list=None)
Parameters:

cu_list (list[CompilationUnit] | None)