`ailment` — angr Intermediate Language¶

class ailment.Block(addr, original_size, statements=None, idx=None)[source]¶

Bases: object

Describes an AIL block.

Parameters:: addr (int)

__init__(addr, original_size, statements=None, idx=None)[source]¶

Parameters:: addr (int)

addr¶

original_size¶

statements: list[Statement]¶

idx¶

copy(statements=None)[source]¶

dbg_repr(indent=0)[source]¶

likes(other)[source]¶

clear_hash()[source]¶

class ailment.Statement(idx, **kwargs)[source]¶

Bases: TaggedObject, ABC

The base class of all AIL statements.

abstract replace(old_expr, new_expr)[source]¶

Return type:

tuple[bool, Self]

Parameters:

old_expr (Expression)
new_expr (Expression)

eq(expr0, expr1)[source]¶

abstract likes(other)[source]¶

Return type:: bool

abstract matches(other)[source]¶

Return type:: bool

class ailment.Assignment(idx, dst, src, **kwargs)[source]¶

Bases: Statement

Assignment statement: expr_a = expr_b

Parameters:

idx (int | None)
dst (Atom)
src (Expression)

__init__(idx, dst, src, **kwargs)[source]¶

Parameters:

idx (int | None)
dst (Atom)
src (Expression)

dst¶

src¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

Parameters:

old_expr (Expression)
new_expr (Expression)

copy()[source]¶

Return type:: Assignment

class ailment.Expression(*args, **kwargs)[source]¶

Bases: TaggedObject

The base class of all AIL expressions.

bits: int¶

__init__(idx, depth, **kwargs)[source]¶

depth¶

has_atom(atom, identity=True)[source]¶

abstract likes(other)[source]¶

abstract matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

Return type:

tuple[bool, Self]

Parameters:

old_expr (Expression)
new_expr (Expression)

class ailment.Const(idx, variable, value, bits, **kwargs)[source]¶

Bases: Atom

Parameters:

idx (int | None)
value (int | float)
bits (int)

__init__(idx, variable, value, bits, **kwargs)[source]¶

Parameters:

idx (int | None)
value (int | float)
bits (int)

value¶

property size¶

likes(other)[source]¶

matches(other)¶

property sign_bit¶

copy()[source]¶

Return type:: Const

property is_int: bool¶

class ailment.Tmp(idx, variable, tmp_idx, bits, **kwargs)[source]¶

Bases: Atom

Parameters:

idx (int | None)
tmp_idx (int)
bits (int)

__init__(idx, variable, tmp_idx, bits, **kwargs)[source]¶

Parameters:

idx (int | None)
tmp_idx (int)

tmp_idx¶

property size¶

likes(other)[source]¶

matches(other)¶

copy()[source]¶

Return type:: Tmp

class ailment.Register(idx, variable, reg_offset, bits, **kwargs)[source]¶

Bases: Atom

Parameters:

idx (int | None)
reg_offset (int)
bits (int)

__init__(idx, variable, reg_offset, bits, **kwargs)[source]¶

Parameters:

idx (int | None)
reg_offset (int)
bits (int)

reg_offset¶

property size¶

likes(other)[source]¶

matches(other)¶

copy()[source]¶

Return type:: Register

class ailment.UnaryOp(idx, op, operand, variable=None, variable_offset=None, bits=None, **kwargs)[source]¶

Bases: Op

Parameters:

idx (int | None)
op (str)
operand (Expression)
variable_offset (int | None)
bits (int)

__init__(idx, op, operand, variable=None, variable_offset=None, bits=None, **kwargs)[source]¶

Parameters:

idx (int | None)
op (str)
operand (Expression)
variable_offset (int | None)

operand¶

variable¶

variable_offset¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

property operands¶

property size¶

copy()[source]¶

Return type:: UnaryOp

has_atom(atom, identity=True)[source]¶

class ailment.BinaryOp(idx, op, operands, signed=False, *, variable=None, variable_offset=None, bits=None, floating_point=False, rounding_mode=None, vector_count=None, vector_size=None, **kwargs)[source]¶

Bases: Op

Parameters:

idx (int | None)
op (str)
operands (Sequence[Expression])
signed (bool)
bits (int)
vector_count (int | None)
vector_size (int | None)

OPSTR_MAP = {'Add': '+', 'AddF': '+', 'AddV': '+', 'And': '&', 'Carry': 'CARRY', 'CmpEQ': '==', 'CmpF': 'CmpF', 'CmpGE': '>=', 'CmpGE (signed)': '>=s', 'CmpGT': '>', 'CmpGT (signed)': '>s', 'CmpLE': '<=', 'CmpLE (signed)': '<=s', 'CmpLT': '<', 'CmpLT (signed)': '<s', 'CmpNE': '!=', 'Concat': 'CONCAT', 'Div': '/', 'DivF': '/', 'LogicalAnd': '&&', 'LogicalOr': '||', 'Mod': '%', 'Mul': '*', 'MulF': '*', 'MulV': '*', 'Or': '|', 'Rol': 'ROL', 'Ror': 'ROR', 'SBorrow': 'SBORROW', 'SCarry': 'SCARRY', 'Sar': '>>a', 'Shl': '<<', 'Shr': '>>', 'Sub': '-', 'SubF': '-', 'Xor': '^'}¶

COMPARISON_NEGATION = {'CmpEQ': 'CmpNE', 'CmpGE': 'CmpLT', 'CmpGT': 'CmpLE', 'CmpLE': 'CmpGT', 'CmpLT': 'CmpGE', 'CmpNE': 'CmpEQ'}¶

__init__(idx, op, operands, signed=False, *, variable=None, variable_offset=None, bits=None, floating_point=False, rounding_mode=None, vector_count=None, vector_size=None, **kwargs)[source]¶

Parameters:

idx (int | None)
op (str)
operands (Sequence[Expression])
signed (bool)
vector_count (int | None)
vector_size (int | None)

operands¶

signed¶

variable¶

variable_offset¶

floating_point¶

rounding_mode: str | None¶

vector_count¶

vector_size¶

likes(other)[source]¶

matches(other)[source]¶

has_atom(atom, identity=True)[source]¶

replace(old_expr, new_expr)[source]¶

Return type:

tuple[bool, BinaryOp]

Parameters:

old_expr (Expression)
new_expr (Expression)

property verbose_op¶

property size¶

copy()[source]¶

Return type:: BinaryOp

class ailment.Manager(name=None, arch=None)[source]¶

Bases: object

Parameters:: name (str | None)

__init__(name=None, arch=None)[source]¶

Parameters:: name (str | None)

next_atom()[source]¶

reset()[source]¶

property ins_addr: int | None¶

class ailment.IRSBConverter[source]¶

Bases: Converter

static convert(irsb, manager)[source]¶

Convert the given IRSB to an AIL block

Parameters:

irsb – The IRSB to convert
manager – The manager to use

Returns:

Returns the converted block

class ailment.AILBlockWalkerBase(stmt_handlers=None, expr_handlers=None)[source]¶

Bases: object

Walks all statements and expressions of an AIL node and do nothing.

__init__(stmt_handlers=None, expr_handlers=None)[source]¶

walk(block)[source]¶

Return type:: None
Parameters:: block (Block)

walk_statement(stmt, block=None)[source]¶

Parameters:

stmt (Statement)
block (Block | None)

walk_expression(expr, stmt_idx=None, stmt=None, block=None)[source]¶

Parameters:

expr (Expression)
stmt_idx (int | None)
stmt (Statement | None)
block (Block | None)

class ailment.AILBlockWalker(stmt_handlers=None, expr_handlers=None, update_block=True, replace_phi_stmt=False)[source]¶

Bases: AILBlockWalkerBase

Walks all statements and expressions of an AIL node, and rebuilds expressions, statements, or blocks if needed.

If you need a pure walker without rebuilding, use AILBlockWalkerBase instead.

Variables:

update_block – True if the block should be updated in place, False if a new block should be created and returned as the result of walk().
replace_phi_stmt – True if you want _handle_Phi be called and vvars potentially replaced; False otherwise. Default to False because in the most majority cases you do not want vvars in a Phi variable be replaced.

Parameters:

update_block (bool)
replace_phi_stmt (bool)

__init__(stmt_handlers=None, expr_handlers=None, update_block=True, replace_phi_stmt=False)[source]¶

Parameters:

update_block (bool)
replace_phi_stmt (bool)

walk(block)[source]¶

Walk the block and rebuild it if necessary. The block will be rebuilt in-place (by updating statements in the original block when self._update_block is set to True), or a new block will be created and returned.

Parameters:: block (Block) – The block to walk.
Return type:: Block | None
Returns:: The new block that is rebuilt, or None if the block is not changed or when self._update_block is set to True.

Converter¶

exception ailment.converter_common.SkipConversionNotice[source]¶: Bases: Exception

class ailment.converter_common.Converter[source]¶

Bases: object

static convert(thing)[source]¶

Expressions¶

class ailment.expression.Expression(*args, **kwargs)[source]¶

Bases: TaggedObject

The base class of all AIL expressions.

bits: int¶

__init__(idx, depth, **kwargs)[source]¶

depth¶

has_atom(atom, identity=True)[source]¶

abstract likes(other)[source]¶

abstract matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

Return type:

tuple[bool, Self]

Parameters:

old_expr (Expression)
new_expr (Expression)

class ailment.expression.Atom(idx, variable=None, variable_offset=0, **kwargs)[source]¶

Bases: Expression

Parameters:: idx (int | None)

__init__(idx, variable=None, variable_offset=0, **kwargs)[source]¶

Parameters:: idx (int | None)

variable¶

variable_offset¶

copy()[source]¶

Return type:: Self

class ailment.expression.Const(idx, variable, value, bits, **kwargs)[source]¶

Bases: Atom

Parameters:

idx (int | None)
value (int | float)
bits (int)

__init__(idx, variable, value, bits, **kwargs)[source]¶

Parameters:

idx (int | None)
value (int | float)
bits (int)

value¶

property size¶

likes(other)[source]¶

matches(other)¶

property sign_bit¶

copy()[source]¶

Return type:: Const

property is_int: bool¶

class ailment.expression.Tmp(idx, variable, tmp_idx, bits, **kwargs)[source]¶

Bases: Atom

Parameters:

idx (int | None)
tmp_idx (int)
bits (int)

__init__(idx, variable, tmp_idx, bits, **kwargs)[source]¶

Parameters:

idx (int | None)
tmp_idx (int)

tmp_idx¶

property size¶

likes(other)[source]¶

matches(other)¶

copy()[source]¶

Return type:: Tmp

class ailment.expression.Register(idx, variable, reg_offset, bits, **kwargs)[source]¶

Bases: Atom

Parameters:

idx (int | None)
reg_offset (int)
bits (int)

__init__(idx, variable, reg_offset, bits, **kwargs)[source]¶

Parameters:

idx (int | None)
reg_offset (int)
bits (int)

reg_offset¶

property size¶

likes(other)[source]¶

matches(other)¶

copy()[source]¶

Return type:: Register

class ailment.expression.VirtualVariableCategory(value)[source]¶

Bases: IntEnum

An enumeration.

REGISTER = 0¶

STACK = 1¶

MEMORY = 2¶

PARAMETER = 3¶

TMP = 4¶

UNKNOWN = 5¶

class ailment.expression.VirtualVariable(idx, varid, bits, category, oident=None, **kwargs)[source]¶

Bases: Atom

Parameters:

varid (int)
bits (int)
category (VirtualVariableCategory)
oident (int | str | tuple | None)

__init__(idx, varid, bits, category, oident=None, **kwargs)[source]¶

Parameters:

varid (int)
category (VirtualVariableCategory)
oident (int | str | tuple | None)

varid¶

category¶

oident¶

property size¶

property was_reg: bool¶

property was_stack: bool¶

property was_parameter: bool¶

property was_tmp: bool¶

property reg_offset: int¶

property stack_offset: int¶

property tmp_idx: int | None¶

property parameter_category: VirtualVariableCategory | None¶

property parameter_reg_offset: int | None¶

property parameter_stack_offset: int | None¶

likes(other)[source]¶

matches(other)[source]¶

copy()[source]¶

Return type:: VirtualVariable

class ailment.expression.Phi(idx, bits, src_and_vvars, **kwargs)[source]¶

Bases: Atom

Parameters:

bits (int)
src_and_vvars (list[tuple[tuple[int, int | None], VirtualVariable | None]])

__init__(idx, bits, src_and_vvars, **kwargs)[source]¶

Parameters:: src_and_vvars (list[tuple[tuple[int, int | None], VirtualVariable | None]])

src_and_vvars¶

property size: int¶

property op: str¶

property verbose_op: str¶

likes(other)[source]¶

Return type:: bool

matches(other)[source]¶

Return type:: bool

copy()[source]¶

Return type:: Phi

replace(old_expr, new_expr)[source]¶

class ailment.expression.Op(*args, **kwargs)[source]¶

Bases: Expression

__init__(idx, depth, op, **kwargs)[source]¶

op¶

property verbose_op¶

class ailment.expression.UnaryOp(idx, op, operand, variable=None, variable_offset=None, bits=None, **kwargs)[source]¶

Bases: Op

Parameters:

idx (int | None)
op (str)
operand (Expression)
variable_offset (int | None)
bits (int)

__init__(idx, op, operand, variable=None, variable_offset=None, bits=None, **kwargs)[source]¶

Parameters:

idx (int | None)
op (str)
operand (Expression)
variable_offset (int | None)

operand¶

variable¶

variable_offset¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

property operands¶

property size¶

copy()[source]¶

Return type:: UnaryOp

has_atom(atom, identity=True)[source]¶

class ailment.expression.ConvertType(value)[source]¶

Bases: Enum

An enumeration.

TYPE_INT = 0¶

TYPE_FP = 1¶

class ailment.expression.Convert(idx, from_bits, to_bits, is_signed, operand, from_type=ConvertType.TYPE_INT, to_type=ConvertType.TYPE_INT, rounding_mode=None, **kwargs)[source]¶

Bases: UnaryOp

Parameters:

idx (int | None)
from_bits (int)
to_bits (int)
is_signed (bool)
operand (Expression)
from_type (ConvertType)
to_type (ConvertType)

TYPE_INT = 0¶

TYPE_FP = 1¶

__init__(idx, from_bits, to_bits, is_signed, operand, from_type=ConvertType.TYPE_INT, to_type=ConvertType.TYPE_INT, rounding_mode=None, **kwargs)[source]¶

Parameters:

idx (int | None)
from_bits (int)
to_bits (int)
is_signed (bool)
operand (Expression)
from_type (ConvertType)
to_type (ConvertType)

from_bits¶

to_bits¶

is_signed¶

from_type¶

to_type¶

rounding_mode¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

Return type:: Convert

class ailment.expression.Reinterpret(idx, from_bits, from_type, to_bits, to_type, operand, **kwargs)[source]¶

Bases: UnaryOp

Parameters:

from_bits (int)
from_type (str)
to_bits (int)
to_type (str)

__init__(idx, from_bits, from_type, to_bits, to_type, operand, **kwargs)[source]¶

Parameters:

from_bits (int)
from_type (str)
to_bits (int)
to_type (str)

from_bits¶

from_type¶

to_bits¶

to_type¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

Return type:: Reinterpret

class ailment.expression.BinaryOp(idx, op, operands, signed=False, *, variable=None, variable_offset=None, bits=None, floating_point=False, rounding_mode=None, vector_count=None, vector_size=None, **kwargs)[source]¶

Bases: Op

Parameters:

idx (int | None)
op (str)
operands (Sequence[Expression])
signed (bool)
bits (int)
rounding_mode (str | None)
vector_count (int | None)
vector_size (int | None)

OPSTR_MAP = {'Add': '+', 'AddF': '+', 'AddV': '+', 'And': '&', 'Carry': 'CARRY', 'CmpEQ': '==', 'CmpF': 'CmpF', 'CmpGE': '>=', 'CmpGE (signed)': '>=s', 'CmpGT': '>', 'CmpGT (signed)': '>s', 'CmpLE': '<=', 'CmpLE (signed)': '<=s', 'CmpLT': '<', 'CmpLT (signed)': '<s', 'CmpNE': '!=', 'Concat': 'CONCAT', 'Div': '/', 'DivF': '/', 'LogicalAnd': '&&', 'LogicalOr': '||', 'Mod': '%', 'Mul': '*', 'MulF': '*', 'MulV': '*', 'Or': '|', 'Rol': 'ROL', 'Ror': 'ROR', 'SBorrow': 'SBORROW', 'SCarry': 'SCARRY', 'Sar': '>>a', 'Shl': '<<', 'Shr': '>>', 'Sub': '-', 'SubF': '-', 'Xor': '^'}¶

COMPARISON_NEGATION = {'CmpEQ': 'CmpNE', 'CmpGE': 'CmpLT', 'CmpGT': 'CmpLE', 'CmpLE': 'CmpGT', 'CmpLT': 'CmpGE', 'CmpNE': 'CmpEQ'}¶

Parameters:

idx (int | None)
op (str)
operands (Sequence[Expression])
signed (bool)
vector_count (int | None)
vector_size (int | None)

operands¶

signed¶

variable¶

variable_offset¶

floating_point¶

rounding_mode: str | None¶

vector_count¶

vector_size¶

likes(other)[source]¶

matches(other)[source]¶

has_atom(atom, identity=True)[source]¶

replace(old_expr, new_expr)[source]¶

Return type:

tuple[bool, BinaryOp]

Parameters:

old_expr (Expression)
new_expr (Expression)

property verbose_op¶

property size¶

copy()[source]¶

Return type:: BinaryOp

class ailment.expression.Load(idx, addr, size, endness, variable=None, variable_offset=None, guard=None, alt=None, **kwargs)[source]¶

Bases: Expression

Parameters:

idx (int | None)
addr (Expression)
size (int)
endness (str)

__init__(idx, addr, size, endness, variable=None, variable_offset=None, guard=None, alt=None, **kwargs)[source]¶

Parameters:

idx (int | None)
addr (Expression)
size (int)
endness (str)

addr¶

size¶

endness¶

guard¶

alt¶

variable¶

variable_offset¶

has_atom(atom, identity=True)[source]¶

replace(old_expr, new_expr)[source]¶

likes(other)[source]¶

matches(other)[source]¶

copy()[source]¶

Return type:: Load

class ailment.expression.ITE(idx, cond, iffalse, iftrue, variable=None, variable_offset=None, **kwargs)[source]¶

Bases: Expression

Parameters:

idx (int | None)
cond (Expression)
iffalse (Expression)
iftrue (Expression)

__init__(idx, cond, iffalse, iftrue, variable=None, variable_offset=None, **kwargs)[source]¶

Parameters:

idx (int | None)
cond (Expression)
iffalse (Expression)
iftrue (Expression)

cond¶

iffalse¶

iftrue¶

variable¶

variable_offset¶

likes(other)[source]¶

matches(other)[source]¶

has_atom(atom, identity=True)[source]¶

replace(old_expr, new_expr)[source]¶

property size¶

copy()[source]¶

Return type:: ITE

class ailment.expression.DirtyExpression(idx, callee, operands, *, guard=None, mfx=None, maddr=None, msize=None, bits, **kwargs)[source]¶

Bases: Expression

Parameters:

callee (str)
operands (list[Expression])
guard (Expression | None)
mfx (str | None)
maddr (Expression | None)
msize (int | None)
bits (int)

__init__(idx, callee, operands, *, guard=None, mfx=None, maddr=None, msize=None, bits, **kwargs)[source]¶

Parameters:

callee (str)
operands (list[Expression])
guard (Expression | None)
mfx (str | None)
maddr (Expression | None)
msize (int | None)
bits (int)

callee¶

guard¶

operands¶

mfx¶

maddr¶

msize¶

property op: str¶

property verbose_op: str¶

likes(other)[source]¶

matches(other)[source]¶

copy()[source]¶

Return type:: DirtyExpression

replace(old_expr, new_expr)[source]¶

Parameters:

old_expr (Expression)
new_expr (Expression)

property size¶

class ailment.expression.VEXCCallExpression(idx, callee, operands, bits, **kwargs)[source]¶

Bases: Expression

Parameters:

idx (int | None)
callee (str)
operands (tuple[Expression, ...])
bits (int)

__init__(idx, callee, operands, bits, **kwargs)[source]¶

Parameters:

idx (int | None)
callee (str)
operands (tuple[Expression, ...])
bits (int)

callee¶

operands¶

property op: str¶

property verbose_op: str¶

likes(other)[source]¶

matches(other)[source]¶

copy()[source]¶

Return type:: VEXCCallExpression

replace(old_expr, new_expr)[source]¶

property size¶

class ailment.expression.MultiStatementExpression(idx, stmts, expr, **kwargs)[source]¶

Bases: Expression

For representing comma-separated statements and expression in C.

Parameters:

idx (int | None)
stmts (list[Statement])
expr (Expression)

__init__(idx, stmts, expr, **kwargs)[source]¶

Parameters:

idx (int | None)
stmts (list[Statement])
expr (Expression)

stmts¶

expr¶

likes(other)[source]¶

matches(other)[source]¶

property size¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

Return type:: MultiStatementExpression

class ailment.expression.BasePointerOffset(idx, bits, base, offset, variable=None, variable_offset=None, **kwargs)[source]¶

Bases: Expression

Parameters:

idx (int | None)
bits (int)
base (Expression | str)
offset (int)

__init__(idx, bits, base, offset, variable=None, variable_offset=None, **kwargs)[source]¶

Parameters:

idx (int | None)
bits (int)
base (Expression | str)
offset (int)

base¶

offset¶

variable¶

variable_offset¶

property size¶

likes(other)[source]¶

matches(other)¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

Return type:: BasePointerOffset

class ailment.expression.StackBaseOffset(idx, bits, offset, **kwargs)[source]¶

Bases: BasePointerOffset

Parameters:

idx (int | None)
bits (int)
offset (int)

__init__(idx, bits, offset, **kwargs)[source]¶

Parameters:

idx (int | None)
bits (int)
offset (int)

copy()[source]¶

Return type:: StackBaseOffset

ailment.expression.negate(expr)[source]¶

Return type:: Expression
Parameters:: expr (Expression)

Statement¶

class ailment.statement.Statement(idx, **kwargs)[source]¶

Bases: TaggedObject, ABC

The base class of all AIL statements.

abstract replace(old_expr, new_expr)[source]¶

Return type:

tuple[bool, Self]

Parameters:

old_expr (Expression)
new_expr (Expression)

eq(expr0, expr1)[source]¶

abstract likes(other)[source]¶

Return type:: bool

abstract matches(other)[source]¶

Return type:: bool

class ailment.statement.Assignment(idx, dst, src, **kwargs)[source]¶

Bases: Statement

Assignment statement: expr_a = expr_b

Parameters:

idx (int | None)
dst (Atom)
src (Expression)

__init__(idx, dst, src, **kwargs)[source]¶

Parameters:

idx (int | None)
dst (Atom)
src (Expression)

dst¶

src¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

Parameters:

old_expr (Expression)
new_expr (Expression)

copy()[source]¶

Return type:: Assignment

class ailment.statement.WeakAssignment(idx, dst, src, **kwargs)[source]¶

Bases: Statement

An assignment statement that does not create a new variable at its destination; It should be seen as operator=(&dst, &src) in C++-like syntax.

Parameters:

idx (int | None)
dst (Atom)
src (Expression)

__init__(idx, dst, src, **kwargs)[source]¶

Parameters:

idx (int | None)
dst (Atom)
src (Expression)

dst¶

src¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

Parameters:

old_expr (Expression)
new_expr (Expression)

copy()[source]¶

Return type:: WeakAssignment

class ailment.statement.Store(idx, addr, data, size, endness, guard=None, variable=None, offset=None, **kwargs)[source]¶

Bases: Statement

Store statement: *addr = data

Parameters:

idx (int | None)
addr (Expression)
data (Expression)
size (int)
endness (str)
guard (Expression | None)

__init__(idx, addr, data, size, endness, guard=None, variable=None, offset=None, **kwargs)[source]¶

Parameters:

idx (int | None)
addr (Expression)
data (Expression)
size (int)
endness (str)
guard (Expression | None)

addr¶

data¶

size¶

endness¶

variable¶

guard¶

offset¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

Return type:: Store

class ailment.statement.Jump(idx, target, target_idx=None, **kwargs)[source]¶

Bases: Statement

Jump statement: goto target

Parameters:

idx (int | None)
target (Expression)
target_idx (int | None)

__init__(idx, target, target_idx=None, **kwargs)[source]¶

Parameters:

idx (int | None)
target (Expression)
target_idx (int | None)

target¶

target_idx¶

likes(other)[source]¶

matches(other)[source]¶

property depth¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

class ailment.statement.ConditionalJump(idx, condition, true_target, false_target, true_target_idx=None, false_target_idx=None, **kwargs)[source]¶

Bases: Statement

if (cond) {true_target} else {false_target}

Parameters:

idx (int | None)
condition (Expression)
true_target (Expression | None)
false_target (Expression | None)
true_target_idx (int | None)
false_target_idx (int | None)

__init__(idx, condition, true_target, false_target, true_target_idx=None, false_target_idx=None, **kwargs)[source]¶

Parameters:

idx (int | None)
condition (Expression)
true_target (Expression | None)
false_target (Expression | None)
true_target_idx (int | None)
false_target_idx (int | None)

condition¶

true_target¶

false_target¶

true_target_idx¶

false_target_idx¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

Return type:: ConditionalJump

class ailment.statement.Call(idx, target, calling_convention=None, prototype=None, args=None, ret_expr=None, fp_ret_expr=None, bits=None, **kwargs)[source]¶

Bases: Expression, Statement

Call is both an expression and a statement.

When used as a statement, it will set ret_expr, fp_ret_expr, or both if both of them should hold return values. When used as an expression, both ret_expr and fp_ret_expr should be None (and should be ignored). The size of the call expression is stored in the bits attribute.

Parameters:

idx (int | None)
target (Expression | str)
calling_convention (SimCC | None)
args (Sequence[Expression] | None)
ret_expr (Expression | None)
fp_ret_expr (Expression | None)
bits (int)

__init__(idx, target, calling_convention=None, prototype=None, args=None, ret_expr=None, fp_ret_expr=None, bits=None, **kwargs)[source]¶

Parameters:

idx (int | None)
target (Expression | str)
calling_convention (SimCC | None)
args (Sequence[Expression] | None)
ret_expr (Expression | None)
fp_ret_expr (Expression | None)
bits (int | None)

target¶

calling_convention¶

prototype¶

args¶

ret_expr¶

fp_ret_expr¶

likes(other)[source]¶

matches(other)[source]¶

property size¶

property verbose_op¶

property op¶

replace(old_expr, new_expr)[source]¶

Parameters:

old_expr (Expression)
new_expr (Expression)

copy()[source]¶

class ailment.statement.Return(idx, ret_exprs, **kwargs)[source]¶

Bases: Statement

Return statement: (return expr_a), (return)

Parameters:: idx (int | None)

__init__(idx, ret_exprs, **kwargs)[source]¶

Parameters:: idx (int | None)

ret_exprs¶

likes(other)[source]¶

matches(other)[source]¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

class ailment.statement.CAS(idx, addr, data_lo, data_hi, expd_lo, expd_hi, old_lo, old_hi, endness, **kwargs)[source]¶

Bases: Statement

Atomic compare-and-swap.

*_lo and *_hi are used to represent the low and high parts of a 128-bit CAS operation; *_hi is None if the CAS operation works on values that are less than or equal to 64 bits.

addr: The address to be compared and swapped. data: The value to be written if the comparison is successful. expd: The expected value to be compared against. old: The value that is currently stored at addr before compare-and-swap; it will be returned after compare-and-swap.

Parameters:

idx (int | None)
addr (Expression)
data_lo (Expression)
data_hi (Expression | None)
expd_lo (Expression)
expd_hi (Expression | None)
old_lo (Atom)
old_hi (Atom | None)
endness (str)

__init__(idx, addr, data_lo, data_hi, expd_lo, expd_hi, old_lo, old_hi, endness, **kwargs)[source]¶

Parameters:

idx (int | None)
addr (Expression)
data_lo (Expression)
data_hi (Expression | None)
expd_lo (Expression)
expd_hi (Expression | None)
old_lo (Atom)
old_hi (Atom | None)
endness (str)

addr¶

data_lo¶

data_hi¶

expd_lo¶

expd_hi¶

old_lo¶

old_hi¶

endness¶

replace(old_expr, new_expr)[source]¶

Return type:

tuple[bool, CAS]

Parameters:

old_expr (Expression)
new_expr (Expression)

copy()[source]¶

Return type:: CAS

likes(other)[source]¶

Return type:: bool

matches(other)[source]¶

Return type:: bool

property bits: int¶

property size: int¶

class ailment.statement.DirtyStatement(idx, dirty, **kwargs)[source]¶

Bases: Statement

Wrapper around the original statement, which is usually not convertible (temporarily).

Parameters:

idx (int | None)
dirty (DirtyExpression)

__init__(idx, dirty, **kwargs)[source]¶

Parameters:

idx (int | None)
dirty (DirtyExpression)

dirty¶

replace(old_expr, new_expr)[source]¶

copy()[source]¶

Return type:: DirtyStatement

likes(other)[source]¶

matches(other)[source]¶

class ailment.statement.Label(idx, name, ins_addr, block_idx=None, **kwargs)[source]¶

Bases: Statement

A dummy statement that indicates a label with a name.

Parameters:

idx (int | None)
name (str)
ins_addr (int)
block_idx (int | None)

__init__(idx, name, ins_addr, block_idx=None, **kwargs)[source]¶

Parameters:

idx (int | None)
name (str)
ins_addr (int)
block_idx (int | None)

name¶

ins_addr¶

block_idx¶

likes(other)[source]¶

Parameters:: other (Label)

replace(old_expr, new_expr)[source]¶

matches(other)¶

Parameters:: other (Label)

copy()[source]¶

Return type:: Label

Misc. Things¶

class ailment.block.Block(addr, original_size, statements=None, idx=None)[source]¶

Bases: object

Describes an AIL block.

Parameters:

addr (int)
statements (list[Statement])

__init__(addr, original_size, statements=None, idx=None)[source]¶

Parameters:: addr (int)

addr¶

original_size¶

statements: list[Statement]¶

idx¶

copy(statements=None)[source]¶

dbg_repr(indent=0)[source]¶

likes(other)[source]¶

clear_hash()[source]¶

class ailment.manager.Manager(name=None, arch=None)[source]¶

Bases: object

Parameters:: name (str | None)

__init__(name=None, arch=None)[source]¶

Parameters:: name (str | None)

next_atom()[source]¶

reset()[source]¶

property ins_addr: int | None¶

class ailment.tagged_object.TaggedObject(idx, **kwargs)[source]¶

Bases: object

A class that takes arbitrary tags.

__init__(idx, **kwargs)[source]¶

Parameters:: idx (int | None)

idx¶

initialize_tags(tags)[source]¶

property tags: dict¶

ailment.utils.get_bits(expr)[source]¶

Return type:: int
Parameters:: expr (Never | Expression)

ailment.utils.stable_hash(t)[source]¶

Return type:: int
Parameters:: t (tuple)

ailment.utils.is_none_or_likeable(arg1, arg2, is_list=False)[source]¶: Returns whether two things are both None or can like each other

ailment.utils.is_none_or_matchable(arg1, arg2, is_list=False)[source]¶: Returns whether two things are both None or can match each other

ailment — angr Intermediate Language¶

Converter¶

Expressions¶

Statement¶

Misc. Things¶

`ailment` — angr Intermediate Language¶