angr.utils.ssa

class angr.utils.ssa.AILWhitelistExprTypeWalker

Bases: AILBlockViewer

Walks an AIL expression or statement and determines if it is built only out of a whitelisted set of expression types. has_nonwhitelisted_exprs is set to True as soon as any expression whose type is not in the whitelist is encountered.

Note that the whitelist must include the operator/container types that the walker recurses through (e.g. BinaryOp, UnaryOp), otherwise those nodes would be flagged as non-whitelisted.

__init__(whitelist_expr_types)

Parameters:

whitelist_expr_types (tuple[type, ...])

class angr.utils.ssa.VVarUsesCollector

Bases: AILBlockViewer

Collect all uses of virtual variables and their use locations in an AIL block. Skip collecting use locations if block is not specified.

__init__()

vvar_and_uselocs: dict[int, list[tuple[VirtualVariable, AILCodeLocation]]]

vvars: set[int]

angr.utils.ssa.check_in_between_stmts(graph, blocks, defloc, useloc, predicate)

Parameters:

• graph (DiGraph)

• blocks (dict[tuple[int, int | None], Block])

• defloc (AILCodeLocation)

• useloc (AILCodeLocation)

• predicate (Callable)

angr.utils.ssa.get_tmp_deflocs(blocks)

Return type:

dict[tuple[int, int | None], dict[Tmp, int]]

Parameters:

blocks (Iterable[Block])

angr.utils.ssa.get_tmp_uselocs(blocks)

Return type:

dict[tuple[int, int | None], dict[Tmp, set[tuple[Tmp, int]]]]

Parameters:

blocks (Iterable[Block])

angr.utils.ssa.get_vvar_deflocs(blocks, phi_vvars=None, check_extra_defs=True)

Return type:

dict[int, tuple[VirtualVariable, AILCodeLocation]]

Parameters:

• phi_vvars (dict[int, set[int | None]] | None)

• check_extra_defs (bool)

angr.utils.ssa.get_vvar_uselocs(blocks)

Return type:

dict[int, list[tuple[VirtualVariable, AILCodeLocation]]]

angr.utils.ssa.has_call_in_between_stmts(graph, blocks, defloc, useloc, skip_if_contains_vvar=None)

Return type:

bool

Parameters:

• graph (DiGraph)

• blocks (dict[tuple[int, int | None], Block])

• defloc (AILCodeLocation)

• useloc (AILCodeLocation)

• skip_if_contains_vvar (int | None)

angr.utils.ssa.has_ite_expr(expr)

Return type:

bool

Parameters:

expr (Expression)

angr.utils.ssa.has_load_expr_in_between_stmts(graph, blocks, defloc, useloc, skip_if_contains_vvar=None)

Return type:

bool

Parameters:

• graph (DiGraph)

• blocks (dict[tuple[int, int | None], Block])

• defloc (AILCodeLocation)

• useloc (AILCodeLocation)

• skip_if_contains_vvar (int | None)

angr.utils.ssa.has_store_stmt_in_between_stmts(graph, blocks, defloc, useloc)

Return type:

bool

Parameters:

• graph (DiGraph)

• blocks (dict[tuple[int, int | None], Block])

• defloc (AILCodeLocation)

• useloc (AILCodeLocation)

angr.utils.ssa.is_const_and_vvar_assignment(stmt, walker_cached=None)

Return type:

bool

Parameters:

• stmt (Statement)

• walker_cached (AILWhitelistExprTypeWalker | None)

angr.utils.ssa.is_const_assignment(stmt, only_consts=False)

Return type:

tuple[bool, Const | StackBaseOffset | None]

Parameters:

• stmt (Statement)

• only_consts (bool)

angr.utils.ssa.is_const_vvar_load_assignment(stmt, walker_cached=None)

Return type:

bool

Parameters:

• stmt (Statement)

• walker_cached (AILWhitelistExprTypeWalker | None)

angr.utils.ssa.is_const_vvar_load_dirty_assignment(stmt, walker_cached=None)

Return type:

bool

Parameters:

• stmt (Statement)

• walker_cached (AILWhitelistExprTypeWalker | None)

angr.utils.ssa.is_phi_assignment(stmt)

Return type:

bool

Parameters:

stmt (Statement)

angr.utils.ssa.is_vvar_eliminatable(vvar, def_stmt)

Return type:

bool

Parameters:

• vvar (VirtualVariable)

• def_stmt (Statement | None)

angr.utils.ssa.phi_assignment_get_src(stmt)

Return type:

Phi | None

Parameters:

stmt (Statement)

Submodules

combined_uses_collector	Combined walker that collects VVar uses + Tmp uses in a single pass.
tmp_uses_collector
vvar_extra_defs_collector
vvar_uses_collector