Migrating to angr 9.1#
angr 9.1 is here!
Calling Conventions and Prototypes#
The main change motivating angr 9.1 is this large refactor of SimCC. Here are the breaking changes:
SimCCs can no longer be customized#
If you were using the
ret_val parameters to SimCC, you should use the new class
SimCCUsercall, which lets (requires) you to be explicit about the locations of each argument.
Passing SimTypes is now mandatory#
Every method call on SimCC which interacts with typed data now requires a SimType to be passed in.
Previously, the use of
size was optional, but now these parameters will no longer be accepted and a
SimType will be required.
This has some fairly non-intuitive consequences - in order to accommodate more esoteric calling conventions (think: passing large structs by value via an “invisible reference”) you have to specify a function’s return type before you can extract any of its arguments.
Additionally, some non-cc interfaces, such as
SimProcedure.call(), now require a prototype to be passed to them.
You’d be surprised how many bugs we found in our own code from enforcing this requirement!
PointerWrapper has a new parameter#
Imagine you’re passing something into a function which has a parameter of type
Is this a pointer to a single char or a pointer to an array of chars?
The answer changes how we typecheck the values you pass in.
If you’re passing a PointerWrapper wrapping a large value which should be treated as an array of chars, you should construct your pointerwrapper as
The buffer argument to PointerWrapper now instructs SimCC to treat the data to be serialized as an array of the child type instead of as a scalar.
Every usage of the name func_ty has been replaced with the name prototype. This was done for consistency between the static analysis code and the dynamic FFI.