angr.utils.x87

class angr.utils.x87.X87Tracker

Bases: object

Forward-tracks the x87 stack pointer ftop through the statements of one VEX block, together with the tmps derived from it. Values are 32-bit masked; ftop becomes None once it cannot be determined.

__init__(irsb, ftop, ftop_off, ftop_size, array_bases=())
Parameters:
eval(expr)
Return type:

int | None

step(stmt)

Process one statement; False once ftop is unknown.

Return type:

bool

class angr.utils.x87.X87StackModel

Bases: object

Net effects of functions and calls on the x87 stack pointer ftop (0 at a function entry), obtained by forward-tracking ftop through VEX blocks. A callee’s effect comes from its prototype (an x87 FP return pushes one value) or, failing that, from its own code.

Variables:

assume_balanced – Treat a callee whose effect cannot be determined as leaving the stack balanced.

__init__(project, kb, callee_deltas=None, max_blocks=256, max_callee_blocks=256, assume_balanced=False)
Parameters:
static prototype_returns_x87(func)
Return type:

bool

Parameters:

func (Function)

static prototype_delta(func)

The net effect on ftop declared by the function’s prototype (x87 arguments popped, x87 return pushed).

Return type:

int | None

Parameters:

func (Function)

callee_delta(callee_addr)

The callee’s net effect on ftop (-1: returns a value on the x87 stack; +1: pops its x87 argument), or None when it cannot be determined.

Return type:

int | None

Parameters:

callee_addr (int)

function_delta(func, max_blocks=None)

The function’s net effect on ftop, or None if unknown or path-dependent.

Return type:

int | None

Parameters:
static classify_x87_args(ret_ftops, depth)

Values the function takes on the x87 stack (MSVC _CI* helpers take st(0); _ftol takes and pops st(0)), under the convention that the callee pops all of them, from the result of scan.

Return type:

tuple[int, bool] | None

Returns:

The number of x87 arguments and whether the function returns a value in st(0) (in place of its popped arguments), or None when it takes no x87 arguments or its stack effect is inconsistent.

Parameters:
ret_ftops(func, max_blocks=None)

ftop at each return site of the function (keyed by block address; None where unknown), or None when the function is too large to scan.

Return type:

dict[int, int | None] | None

Parameters:
scan(func, max_blocks=None)
Return type:

tuple[dict[int, int | None] | None, int]

Returns:

ftop at each return site (see ret_ftops), and how many x87 slots the function reads that it did not push (values passed on the x87 stack, as by MSVC’s _CI* and _ftol helpers).

Parameters: