angr.ailment¶

class angr.ailment.AILBlockRewriter

Bases: AILBlockWalker[Expression, Statement, Block]

Walks all statements and expressions of an AIL node, and rebuilds expressions, statements, or blocks if needed.

If you need a pure walker without rebuilding, use AILBlockViewer instead.

Variables:

update_block – True if the block should be updated in place, False if a new block should be created and returned as the result of walk().
replace_phi_stmt – True if you want _handle_Phi be called and vvars potentially replaced; False otherwise. Default to False because in the most majority cases you do not want vvars in a Phi variable be replaced.

__init__(stmt_handlers=None, expr_handlers=None, update_block=True, replace_phi_stmt=False)

Parameters:

update_block (bool)
replace_phi_stmt (bool)

class angr.ailment.AILBlockViewer

Bases: AILBlockWalker[None, None, None]

Walks all statements and expressions of an AIL node and do nothing.

class angr.ailment.AILBlockWalker

Bases: Generic

Walks all statements and expressions of an AIL node and construct arbitrary values based on them.

Note that we lazily initialize self._stmt_handlers and self._expr_handlers when they are accessed. This is to support the existing pattern of updating stmt/expr handlers in-place after creating a block walker, and is slightly slower. Overridding handler methods in a new class is the fastest approach.

__init__(stmt_handlers=None, expr_handlers=None)

classmethod rebuild_default_handler_funcs()

Return type:: None

property stmt_handlers: dict[type, Callable[[int, Any, Block | None], StmtType]]

property expr_handlers: dict[type, Callable[[int, Any, int, Statement | None, Block | None], ExprType]]

reset()

Reset per-walk state variables so that this walker can be reused for another walk. Subclasses that updates state across a walk must override this to clear that state.

Return type:: None

walk(block)

Return type:: TypeVar(BlockType)
Parameters:: block (Block)

walk_statement(stmt, block=None, stmt_idx=0)

Return type:

TypeVar(StmtType)

Parameters:

stmt (Statement)
block (Block | None)
stmt_idx (int)

walk_expression(expr, stmt_idx=None, stmt=None, block=None)

Return type:

TypeVar(ExprType)

Parameters:

expr (Expression)
stmt_idx (int | None)
stmt (Statement | None)
block (Block | None)

class angr.ailment.Assignment

Bases: object

Marker for Statement instances whose variant is Assignment.

static __new__(cls, idx, dst, src, **tags)

Return type:: Statement

class angr.ailment.BinaryOp

Bases: object

Marker for Expression instances whose variant is BinaryOp.

COMPARISON_NEGATION = {'CmpEQ': 'CmpNE', 'CmpGE': 'CmpLT', 'CmpGT': 'CmpLE', 'CmpLE': 'CmpGT', 'CmpLT': 'CmpGE', 'CmpNE': 'CmpEQ'}¶

static __new__(cls, idx, op, operands, signed=False, *, bits=None, floating_point=False, rounding_mode=None, vector_count=None, vector_size=None, **tags)

Return type:: Expression

class angr.ailment.Block

Bases: object

classmethod __new__(*args, **kwargs)¶

addr¶

clear_hash()¶

copy(statements=None)¶

dbg_repr(indent=0)¶

deep_copy(manager)¶

idx¶

likes(other)¶

original_size¶

pp()¶

sort_key¶

statements¶

class angr.ailment.Const

Bases: object

Marker for Expression instances whose variant is Const.

Const(idx, value, bits, **tags) returns an Expression – the marker class is not in the instance’s MRO.

static __new__(cls, idx, value, bits, **tags)

Return type:: Expression

class angr.ailment.Expression

Bases: object

Marker for isinstance(x, Expression) checks.

Real AIL expression instances are angr.rustylib.ailment.Expression (a single fat-enum pyclass). The per-variant markers (Const, BinaryOp, …) dispatch on the variant tag via metaclass __instancecheck__.

__init__(idx=None, *_extra, **tags)

static from_bytes(data)

Deserialize an Expression from bytes.

Parameters:: data (bytes)

class angr.ailment.IRSBConverter¶

Bases: Converter

static convert(irsb, manager)¶

Convert the given IRSB to an AIL block

Parameters:

irsb – The IRSB to convert
manager – The manager to use

Returns:

Returns the converted block

class angr.ailment.Manager

Bases: object

classmethod __new__(*args, **kwargs)¶

arch¶

atom_ctr¶: Exposed for parity/debugging; the original stored an itertools.count.

block_addr¶

ins_addr¶

name¶

next_atom()¶

reset()¶

tyenv¶

variable_map¶

vex_stmt_idx¶

class angr.ailment.NoOp

Bases: object

Marker for Statement instances whose variant is NoOp.

Placeholder for a removed statement; defines and uses no atoms. Primarily used by the AIL simplifier’s dead-assignment removal so the indices of surrounding statements stay stable until the block is compacted.

static __new__(cls, idx, **tags)

Return type:: Statement

class angr.ailment.PCodeIRSBConverter

Bases: Converter

Converts a p-code IRSB to an AIL block

static convert(irsb, manager)

Convert the given IRSB to an AIL block

Parameters:

irsb (IRSB) – IRSB to convert
manager (Manager) – Manager to use

Returns:

Converted block

__init__(irsb, manager)

Parameters:

irsb (IRSB)
manager (Manager)

class angr.ailment.Register

Bases: object

Marker for Expression instances whose variant is Register.

static __new__(cls, idx, reg_offset, bits, **tags)

Return type:: Expression

class angr.ailment.Statement

Bases: object

Marker for isinstance(x, Statement) checks.

__init__(idx=None, *_extra, **tags)

static from_bytes(data)

Deserialize a Statement from bytes.

Parameters:: data (bytes)

class angr.ailment.Tmp

Bases: object

Marker for Expression instances whose variant is Tmp.

static __new__(cls, idx, tmp_idx, bits, **tags)

Return type:: Expression

class angr.ailment.UnaryOp

Bases: object

Marker for Expression instances whose variant is UnaryOp.

static __new__(cls, idx, op, operand, bits=None, **tags)

Return type:: Expression

class angr.ailment.VEXIRSBConverter

Bases: object

static convert(irsb, manager)¶: Fallback: convert a cached pyvex Python IRSB object.

static convert_from_lift(arch, addr, data, manager, *, opt_level=1, traceflags=0, strict_block_end=False, collect_data_refs=False, load_from_ro_regions=False, const_prop=False, cross_insn_opt=True, max_inst=99, max_bytes=None, bytes_offset=0)¶: Default fast path: lift data at addr directly into libVEX and convert the resulting C IRSB to an AIL block without materializing a pyvex Python IRSB.

Submodules

`block`	Shim for `from angr.ailment.block import Block`.
`block_walker`
`constant`
`converter_common`
`converter_pcode`
`converter_vex`
`expression`	AIL Expression classes.
`manager`
`statement`	AIL Statement classes.
`tagged_object`	Python-side marker for the legacy `isinstance(x, TaggedObject)` checks.
`utils`