Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def _calls_stack_chk_fail(self, node):
for stmt in node.statements:
if isinstance(stmt, ailment.Stmt.Call) and isinstance(stmt.target, ailment.Expr.Const):
const_target = stmt.target.value
if const_target in self.kb.functions:
func = self.kb.functions.function(addr=const_target)
if func.name == "__stack_chk_fail":
return True
return False
stmt_type = type(stmt)
if stmt_type is ailment.Stmt.Store:
# find a memory variable
mem_vars = variable_manager.find_variables_by_atom(block.addr, stmt_idx, stmt)
if len(mem_vars) == 1:
stmt.variable, stmt.offset = next(iter(mem_vars))
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.data)
elif stmt_type is ailment.Stmt.Assignment:
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.dst)
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.src)
elif stmt_type is ailment.Stmt.ConditionalJump:
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.condition)
elif stmt_type is ailment.Stmt.Call:
if stmt.ret_expr:
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.ret_expr)
target = self._expr(stmt.target)
new_args = None
if stmt.args:
new_args = [ ]
for arg in stmt.args:
new_arg = self._expr(arg)
replacement = self.state.get_variable(new_arg)
if replacement is not None:
new_args.append(replacement)
else:
new_args.append(arg)
if new_args != stmt.args:
new_call_stmt = Stmt.Call(stmt.idx, target, calling_convention=stmt.calling_convention,
prototype=stmt.prototype, args=new_args, ret_expr=stmt.ret_expr,
**stmt.tags)
self.state.add_replacement(self._codeloc(),
stmt,
new_call_stmt,
)
self.posmap = None
self.nodemap = None
self._indent = indent
self._handlers = {
SequenceNode: self._handle_Sequence,
CodeNode: self._handle_Code,
LoopNode: self._handle_Loop,
ConditionNode: self._handle_Condition,
ConditionalBreakNode: self._handle_ConditionalBreak,
MultiNode: self._handle_MultiNode,
Block: self._handle_AILBlock,
# AIL statements
Stmt.Store: self._handle_Stmt_Store,
Stmt.Assignment: self._handle_Stmt_Assignment,
Stmt.Call: self._handle_Stmt_Call,
# AIL expressions
Expr.Register: self._handle_Expr_Register,
Expr.Load: self._handle_Expr_Load,
Expr.Tmp: self._handle_Expr_Tmp,
Expr.Const: self._handle_Expr_Const,
Expr.UnaryOp: self._handle_Expr_UnaryOp,
Expr.BinaryOp: self._handle_Expr_BinaryOp,
Expr.Convert: self._handle_Expr_Convert,
Expr.StackBaseOffset: self._handle_Expr_StackBaseOffset,
Expr.DirtyExpression: self._handle_Expr_Dirty,
# SimVariables
SimStackVariable: self._handle_Variable_SimStackVariable,
SimRegisterVariable: self._handle_Variable_SimRegisterVariable,
}
self._analyze()
def _ail_handle_Call(self, stmt):
target = self._expr(stmt.target)
new_args = None
if stmt.args:
new_args = [ ]
for arg in stmt.args:
new_arg = self._expr(arg)
new_args.append(new_arg)
return Stmt.Call(stmt.idx, target, calling_convention=stmt.calling_convention,
prototype=stmt.prototype, args=new_args, ret_expr=stmt.ret_expr,
**stmt.tags)
import ailment
# STMT_CLASSES = [None]*ailment.Stmt.tag_count
# for name, cls in vars(ailment.Stmt).items():
# if isinstance(cls, type) and issubclass(cls, ailment.Stmt.Statement) and cls is not ailment.Stmt.IRStmt:
# STMT_CLASSES[cls.tag_int] = globals()['SimIRStmt_' + name]
# if any(x is None for x in STMT_CLASSES):
# raise ImportError("Something is messed up loading angr: not all ailment stmts accounted for")
STMT_CLASSES = {
ailment.Stmt.Assignment: SimIRStmt_Assignment,
ailment.Stmt.Store: SimIRStmt_Store,
ailment.Stmt.Jump: SimIRStmt_Jump,
ailment.Stmt.ConditionalJump: SimIRStmt_ConditionalJump,
ailment.Stmt.Call: SimIRStmt_Call,
# ailment.Stmt.DirtyStatement: SimIRStmt_DirtyStatement