angr.state_plugins.edge_hitmap

class angr.state_plugins.edge_hitmap.SimStateEdgeHitmap

Bases: SimStatePlugin

A state plugin that stores AFL-style edge hitmap coverage data.

This plugin is used by the Icicle engine to track edge coverage during concrete execution. It stores the hitmap as raw bytes, which can be efficiently passed to and from the Icicle emulator.

This plugin is NOT registered as a default plugin - it must be explicitly added to states that need edge coverage tracking.

HITMAP_SIZE = 65536
__init__(edge_hitmap=None)

Initialize the edge hitmap plugin.

Parameters:

edge_hitmap (bytes | None) – Initial edge hitmap bytes, or None to start with a zeroed hitmap.

edge_hitmap: bytes | None
copy(memo)

Create a copy of the plugin.

Parameters:

memo – Memoization dictionary to avoid duplicate copies.

Returns:

A new SimStateEdgeHitmap instance with a copy of the hitmap.

merge(others, merge_conditions, common_ancestor=None)

Merge multiple hitmap plugins.

For coverage tracking, we OR the hitmaps together to preserve all observed edges.

Parameters:

  • others – Other plugin instances to merge with.

  • merge_conditions – Symbolic conditions for each merge branch.

  • common_ancestor – Common ancestor plugin instance.

Returns:

True if merge was successful.

widen(others)

Widening operation for static analysis.

Parameters:

others – Other plugin instances.

Returns:

False, widening is not meaningful for hitmaps.