Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def _find_canary_xor_stmt(self, block, canary_value_stack_offset):
for idx, stmt in enumerate(block.statements):
if isinstance(stmt, ailment.Stmt.ConditionalJump):
if isinstance(stmt.condition, ailment.Expr.UnaryOp) and stmt.condition.op == "Not":
# !(s_10 ^ fs:0x28 == 0)
negated = True
condition = stmt.condition.operand
else:
negated = False
condition = stmt.condition
if isinstance(condition, ailment.Expr.BinaryOp) and (
not negated and condition.op == "CmpEQ" or
negated and condition.op == "CmpNE"
):
pass
else:
continue
expr = condition.operands[0]
import ailment
# STMT_CLASSES = [None]*ailment.Stmt.tag_count
# for name, cls in vars(ailment.Stmt).items():
# if isinstance(cls, type) and issubclass(cls, ailment.Stmt.Statement) and cls is not ailment.Stmt.IRStmt:
# STMT_CLASSES[cls.tag_int] = globals()['SimIRStmt_' + name]
# if any(x is None for x in STMT_CLASSES):
# raise ImportError("Something is messed up loading angr: not all ailment stmts accounted for")
STMT_CLASSES = {
ailment.Stmt.Assignment: SimIRStmt_Assignment,
ailment.Stmt.Store: SimIRStmt_Store,
ailment.Stmt.Jump: SimIRStmt_Jump,
ailment.Stmt.ConditionalJump: SimIRStmt_ConditionalJump,
ailment.Stmt.Call: SimIRStmt_Call,
# ailment.Stmt.DirtyStatement: SimIRStmt_DirtyStatement
def _test_empty_node(self, node):
if type(node) is ailment.Block:
if not node.statements:
return True
if len(node.statements) == 1 and type(node.statements[0]) is ailment.Stmt.ConditionalJump:
# conditional jumps have been taken care of during reaching condition recovery
return True
else:
# not empty
return False
# unsupported node type. probably not empty?
return False
def _ail_handle_ConditionalJump(self, stmt):
cond = self._expr(stmt.condition)
true_target = self._expr(stmt.true_target)
false_target = self._expr(stmt.false_target)
if cond is stmt.condition and \
true_target is stmt.true_target and \
false_target is stmt.false_target:
pass
else:
new_jump_stmt = Stmt.ConditionalJump(stmt.idx, cond, true_target, false_target, **stmt.tags)
self.state.add_replacement(self._codeloc(),
stmt,
new_jump_stmt,
)
def _ifs_handle_block(self, block, successor): # pylint:disable=no-self-use
"""
:param ailment.Block block:
:return:
"""
if block.statements and isinstance(block.statements[-1], ailment.Stmt.ConditionalJump):
cond_stmt = block.statements[-1] # ailment.Stmt.ConditionalJump
if isinstance(successor, ConditionNode):
true_cond = False
if cond_stmt.true_target is not None and successor.true_node is not None:
# True branch exists. Test if the true target is the address
if cond_stmt.true_target.value == successor.true_node.addr:
true_cond = True
if cond_stmt.true_target is not None and successor.false_node is not None:
# True branch exists. Test if the true target is the address
if cond_stmt.true_target.value == successor.false_node.addr:
true_cond = True
false_cond = False
if cond_stmt.false_target is not None and successor.false_node is not None:
# False branch exists. Test if the false target is the address
if cond_stmt.false_target.value == successor.false_node.addr:
def _extract_jump_targets(stmt):
"""
Extract goto targets from a Jump or a ConditionalJump statement.
:param stmt: The statement to analyze.
:return: A list of known concrete jump targets.
:rtype: list
"""
targets = [ ]
# FIXME: We are assuming all jump targets are concrete targets. They may not be.
if isinstance(stmt, ailment.Stmt.Jump):
targets.append(stmt.target.value)
elif isinstance(stmt, ailment.Stmt.ConditionalJump):
targets.append(stmt.true_target.value)
targets.append(stmt.false_target.value)
return targets
for stmt_idx, stmt in enumerate(block.statements):
# I wish I could do functional programming in this method...
stmt_type = type(stmt)
if stmt_type is ailment.Stmt.Store:
# find a memory variable
mem_vars = variable_manager.find_variables_by_atom(block.addr, stmt_idx, stmt)
if len(mem_vars) == 1:
stmt.variable, stmt.offset = next(iter(mem_vars))
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.data)
elif stmt_type is ailment.Stmt.Assignment:
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.dst)
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.src)
elif stmt_type is ailment.Stmt.ConditionalJump:
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.condition)
elif stmt_type is ailment.Stmt.Call:
if stmt.ret_expr:
self._link_variables_on_expr(variable_manager, block, stmt_idx, stmt, stmt.ret_expr)