How to use the ailment.Stmt.ConditionalJump function in ailment

To help you get started, we’ve selected a few ailment examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github angr / angr / angr / analyses / decompiler / optimization_passes / stack_canary_simplifier.py View on Github external
def _find_canary_xor_stmt(self, block, canary_value_stack_offset):

        for idx, stmt in enumerate(block.statements):
            if isinstance(stmt, ailment.Stmt.ConditionalJump):
                if isinstance(stmt.condition, ailment.Expr.UnaryOp) and stmt.condition.op == "Not":
                    # !(s_10 ^ fs:0x28 == 0)
                    negated = True
                    condition = stmt.condition.operand
                else:
                    negated = False
                    condition = stmt.condition
                if isinstance(condition, ailment.Expr.BinaryOp) and (
                        not negated and condition.op == "CmpEQ" or
                        negated and condition.op == "CmpNE"
                ):
                   pass
                else:
                    continue

                expr = condition.operands[0]
github angr / angr / angr / engines / ail / statements / __init__.py View on Github external
import ailment

# STMT_CLASSES = [None]*ailment.Stmt.tag_count
# for name, cls in vars(ailment.Stmt).items():
#     if isinstance(cls, type) and issubclass(cls, ailment.Stmt.Statement) and cls is not ailment.Stmt.IRStmt:
#         STMT_CLASSES[cls.tag_int] = globals()['SimIRStmt_' + name]
# if any(x is None for x in STMT_CLASSES):
#     raise ImportError("Something is messed up loading angr: not all ailment stmts accounted for")


STMT_CLASSES = {
	ailment.Stmt.Assignment:       SimIRStmt_Assignment,
	ailment.Stmt.Store:            SimIRStmt_Store,
	ailment.Stmt.Jump:             SimIRStmt_Jump,
	ailment.Stmt.ConditionalJump:  SimIRStmt_ConditionalJump,
	ailment.Stmt.Call:             SimIRStmt_Call,
	# ailment.Stmt.DirtyStatement:   SimIRStmt_DirtyStatement
github angr / angr / angr / analyses / decompiler / structurer.py View on Github external
def _test_empty_node(self, node):
        if type(node) is ailment.Block:
            if not node.statements:
                return True
            if len(node.statements) == 1 and type(node.statements[0]) is ailment.Stmt.ConditionalJump:
                # conditional jumps have been taken care of during reaching condition recovery
                return True
            else:
                # not empty
                return False
        # unsupported node type. probably not empty?
        return False
github angr / angr / angr / analyses / propagator / engine_ail.py View on Github external
def _ail_handle_ConditionalJump(self, stmt):
        cond = self._expr(stmt.condition)
        true_target = self._expr(stmt.true_target)
        false_target = self._expr(stmt.false_target)

        if cond is stmt.condition and \
                true_target is stmt.true_target and \
                false_target is stmt.false_target:
            pass
        else:
            new_jump_stmt = Stmt.ConditionalJump(stmt.idx, cond, true_target, false_target, **stmt.tags)
            self.state.add_replacement(self._codeloc(),
                                             stmt,
                                             new_jump_stmt,
                                             )
github angr / angr / angr / analyses / decompiler / region_simplifier.py View on Github external
def _ifs_handle_block(self, block, successor):  # pylint:disable=no-self-use
        """

        :param ailment.Block block:
        :return:
        """

        if block.statements and isinstance(block.statements[-1], ailment.Stmt.ConditionalJump):
            cond_stmt = block.statements[-1]  # ailment.Stmt.ConditionalJump
            if isinstance(successor, ConditionNode):
                true_cond = False
                if cond_stmt.true_target is not None and successor.true_node is not None:
                    # True branch exists. Test if the true target is the address
                    if cond_stmt.true_target.value == successor.true_node.addr:
                        true_cond = True
                if cond_stmt.true_target is not None and successor.false_node is not None:
                    # True branch exists. Test if the true target is the address
                    if cond_stmt.true_target.value == successor.false_node.addr:
                        true_cond = True

                false_cond = False
                if cond_stmt.false_target is not None and successor.false_node is not None:
                    # False branch exists. Test if the false target is the address
                    if cond_stmt.false_target.value == successor.false_node.addr:
github angr / angr / angr / analyses / decompiler / structurer.py View on Github external
def _extract_jump_targets(stmt):
        """
        Extract goto targets from a Jump or a ConditionalJump statement.

        :param stmt:    The statement to analyze.
        :return:        A list of known concrete jump targets.
        :rtype:         list
        """

        targets = [ ]

        # FIXME: We are assuming all jump targets are concrete targets. They may not be.

        if isinstance(stmt, ailment.Stmt.Jump):
            targets.append(stmt.target.value)
        elif isinstance(stmt, ailment.Stmt.ConditionalJump):
            targets.append(stmt.true_target.value)
            targets.append(stmt.false_target.value)

        return targets
github angr / angr / angr / analyses / decompiler / clinic.py View on Github external
for stmt_idx, stmt in enumerate(block.statements):
            # I wish I could do functional programming in this method...
            stmt_type = type(stmt)
            if stmt_type is ailment.Stmt.Store:
                # find a memory variable
                mem_vars = variable_manager.find_variables_by_atom(block.addr, stmt_idx, stmt)
                if len(mem_vars) == 1:
                    stmt.variable, stmt.offset = next(iter(mem_vars))
                self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.data)

            elif stmt_type is ailment.Stmt.Assignment:
                self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.dst)
                self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.src)

            elif stmt_type is ailment.Stmt.ConditionalJump:
                self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.condition)

            elif stmt_type is ailment.Stmt.Call:
                if stmt.ret_expr:
                    self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.ret_expr)