angr

The angr ProjectOct 15, 2024

CONTENTS

1

Introduction
1.1 Getting Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2 Citing angr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3 Going further: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3
3
3
4

2

Getting Started
2.1 Installing angr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2 Reporting Bugs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3 Developing angr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.4 Help Wanted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5
5
6
7
9

3

Core Concepts
3.1 Core Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2 Loading a Binary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.3 Symbolic Expressions and Constraint Solving . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.4 Machine State - memory, registers, and so on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.5 Simulation Managers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.6 Simulation and Instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.7 Analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.8 Symbolic Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.9 A final word of advice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13
13
18
24
30
35
39
44
45
47

4

Build-in Analyses
4.1 Control-flow Graph Recovery (CFG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2 Backward Slicing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3 Identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.4 angr Decompiler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

49
49
53
55
58

5

Advanced Topics
5.1 Gotchas when using angr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2 Understanding the Execution Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3 What’s Up With Mixins, Anyway? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.4 Optimization considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.5 Working with File System, Sockets, and Pipes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.6 Intermediate Representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.7 Working with Data and Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.8 Solver Engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.9 Symbolic memory addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.10 Java Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.11 Symbion: Interleaving symbolic and concrete execution . . . . . . . . . . . . . . . . . . . . . . . .

59
59
60
64
67
69
74
77
81
86
87
88

i

5.12 Debug variable resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.13 Variable visibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

89
91

6

Extending angr93
6.1 Hooks and SimProcedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
6.2 State Plugins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
6.3 Extending the Environment Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
6.4 Writing Analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
6.5 Scripting angr management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

7angr examples
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2 Reversing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.3 Vulnerability Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.4 Exploitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

107
107
107
109
110

8

Frequently Asked Questions
8.1 Why is it named angr? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.2 How should “angr” be stylized? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.3 Why isn’t symbolic execution doing the thing I want? . . . . . . . . . . . . . . . . . . . . . . . . . .
8.4 How can I get diagnostic information about what angr is doing? . . . . . . . . . . . . . . . . . . . .
8.5 Why is angr so slow? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.6 How do I find bugs using angr? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.7 Why did you choose VEX instead of another IR (such as LLVM, REIL, BAP, etc)? . . . . . . . . . .
8.8 Why are some ARM addresses off-by-one? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.9 How do I serialize angr objects? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.10 What does UnsupportedIROpError("floating point support disabled") mean? . . . . . .
8.11 Why is angr’s CFG different from IDA’s? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.12 Why do I get incorrect register values when reading from a state during a SimInspect breakpoint? . .

113
113
113
113
113
114
114
114
115
115
115
116
116

9

Appendix
9.1 Cheatsheet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.2 List of Claripy Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.3 List of State Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.4 CTF Challenge Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.5 Changelog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.6 Migrating to angr 9.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.7 Migrating to angr 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.8 Migrating to angr 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

117
117
121
122
125
128
139
140
142

10 API Reference
10.1 Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.2 Plugin Ecosystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.3 Program State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.4 Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.5 Memory Mixins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.6 Concretization Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.7 Simulation Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.8 Exploration Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.9 Simulation Engines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.10 Simulation Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.11 Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.12 Calling Conventions and Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.13 Knowledge Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.14 Serialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

147
207
218
220
382
414
495
498
506
543
595
599
613
654
784

ii

10.15 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786
10.16 SimOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1172
10.17 Function Signature Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1187
10.18 Utils . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1189
10.19 Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198
10.20 Distributed analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1204
11 Indices and tables

1209

Python Module Index

1211

Index

1217

iii

iv

angr

Welcome to angr’s documentation! This documentation is intended to be a guide for learning angr, as well as a reference
for the API. If you’re new to angr,
The angr team maintains a number of libraries that are used as part of angr. These libraries are:• archinfo - Information about CPU architectures• pyvex - Python bindings to the VEX IR• pypcode - Python bindings to the Pcode IR• ailment - angr’s high-level intermediate language• cle - Many-platform binary loader• claripy - Solver abstraction layer

CONTENTS

1

angr

2

CONTENTSCHAPTERONEINTRODUCTION

angr is a multi-architecture binary analysis toolkit, with the capability to perform dynamic symbolic execution (likeMayhem, KLEE, etc.) and various static analyses on binaries. If you’d like to learn how to use it, you’re in the rightplace!
We’ve tried to make using angr as pain-free as possible - our goal is to create a user-friendly binary analysis suite,
allowing a user to simply start up iPython and easily perform intensive binary analyses with a couple of commands.
That being said, binary analysis is complex, which makes angr complex. This documentation is an attempt to help out
with that, providing narrative explanation and exploration of angr and its design.
Several challenges must be overcome to programmatically analyze a binary. They are, roughly:• Loading a binary into the analysis program.
• Translating a binary into an intermediate representation (IR).
• Performing the actual analysis. This could be:– A partial or full-program static analysis (i.e., dependency analysis, program slicing).
– A symbolic exploration of the program’s state space (i.e., “Can we execute it until we find an overflow?”).
– Some combination of the above (i.e., “Let’s execute only program slices that lead to a memory write, tofind an overflow.”)
angr has components that meet all of these challenges. This documentation will explain how each component works,
and how they can all be used to accomplish your goals.

1.1 Getting Support
To get help with angr, you can ask via:
• the slack channel: angr.slack.com, for which you can get an account here.
• opening an issue on the appropriate github repository

1.2 Citing angr
If you use angr in an academic work, please cite the papers for which it was developed:@article{shoshitaishvili2016state,title={SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis},
author={Shoshitaishvili, Yan and Wang, Ruoyu and Salls, Christopher and Stephens, Nick␣˓→and Polino, Mario and Dutcher, Audrey and Grosen, Jessie and Feng, Siji and Hauser,␣
˓→Christophe and Kruegel, Christopher and Vigna, Giovanni},
booktitle={IEEE Symposium on Security and Privacy},(continues on next page)

3

angr

(continued from previous page)year={2016}}@article{stephens2016driller,
title={Driller: Augmenting Fuzzing Through Selective Symbolic Execution},
author={Stephens, Nick and Grosen, Jessie and Salls, Christopher and Dutcher, Audrey␣˓→and Wang, Ruoyu and Corbetta, Jacopo and Shoshitaishvili, Yan and Kruegel, Christopher␣˓→and Vigna, Giovanni},
booktitle={NDSS},
year={2016}}@article{shoshitaishvili2015firmalice,
title={Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in␣˓→Binary Firmware},author={Shoshitaishvili, Yan and Wang, Ruoyu and Hauser, Christophe and Kruegel,␣˓→Christopher and Vigna, Giovanni},
booktitle={NDSS},
year={2015}}

1.3 Going further:
You can read this paper, explaining some of the internals, algorithms, and used techniques to get a better understandingon what’s going on under the hood.
If you enjoy playing CTFs and would like to learn angr in a similar fashion, angr_ctf will be a fun way for you to getfamiliar with much of the symbolic execution capability of angr. The angr_ctf repo is maintained by @jakespringer.

4

Chapter 1. Introduction

CHAPTERTWOGETTING STARTED

2.1 Installing angr
angr is a library for Python 3.8+, and must be installed into a Python environment before it can be used.

2.1.1 Installing from PyPI
angr is published on PyPI, and using this is the easiest and recommended way to install angr. It can be installed angrwith pip:
pip install angr

 Tip
It is recommended to use an isolated python environment rather than installing angr globally. Doing so reduces
dependency conflicts and aids in reproducibility while debugging. Some popular tools that accomplish this include:• venv• pipenv• virtualenv• virtualenvwrapper• condaò NoteThe PyPI distribution includes binary packages for most popular system configurations. If you are using a systemthat is not supported by the binary packages, you will need to build the C dependencies from source. See theInstalling from Source section for more information.

2.1.2 Installing from Source
angr is a collection of Python packages, each of which is published on GitHub. The easiest way to install angr fromsource is to use angr-dev.
To set up a development environment manually, first ensure that build dependencies are installed. These consist of
python development headers, make, and a C compiler. On Ubuntu, these can be installed with:

5

angr

sudo apt-get install python3-dev build-essential
Then, checkout and install the following packages, in order:• archinfo• pyvex (clone with --recursive)• cle• claripy• ailment• angr (pip install with --no-build-isolation)

2.1.3 Installing with Docker
The angr team maintains a container image on Docker Hub that includes angr and its dependencies. This image can bepulled with:docker pull angr/angr
The image can be run with:docker run -it angr/angrThis will start a shell in the container, with angr installed and ready to use.

2.1.4 Troubleshooting
angr has no attribute Project, or similar
If angr can be imported but the Project class is missing, it is likely one of two problems:
1. There is a script named angr.py in the working directory. Rename it to something else.
2. There is a folder called angr in your working directory, possibly the cloned repository. Change the working
directory to somewhere else.
AttributeError: ‘module’ object has no attribute ‘KS_ARCH_X86’
The keystone package is installed, which conflicts with the keystone-engine package, an optional dependency ofangr. Uninstall keystone and install keystone-engine.

2.2 Reporting Bugs
If you’ve found something that angr isn’t able to solve and appears to be a bug, please let us know!
1. Create a fork off of angr/binaries and angr/angr
2. Give us a pull request with angr/binaries, with the binaries in question
3. Give us a pull request for angr/angr, with testcases that trigger the binaries in angr/tests/broken_x.py,
angr/tests/broken_y.py, etc
Please try to follow the testcase format that we have (so the code is in a test_blah function), that way we can very easily
merge that and make the scripts run.
An example is:

6

Chapter 2. Getting Started

angr

def test_some_broken_feature():p = angr.Project("some_binary")
result = p.analyses.SomethingThatDoesNotWork()
assert result == "what it should *actually* be if it worked"
if __name__ == '__main__':test_some_broken_feature()
This will greatly help us recreate your bug and fix it faster.
The ideal situation is that, when the bug is fixed, your testcases passes (i.e., the assert at the end does not raise an
AssertionError).
Then, we can just fix the bug and rename broken_x.py to test_x.py and the testcase will run in our internal CI at
every push, ensuring that we do not break this feature again.

2.3 Developing angr
These are some guidelines so that we can keep the codebase in good shape!

2.3.1 pre-commit
Many angr repos contain pre-commit hooks provided by pre-commit. Installing this is as easy as pip installpre-commit. After git cloning an angr repository, if the repo contains a .pre-commit-config.yaml, run
pre-commit install. Future git commits will now invoke these hooks automatically.

2.3.2 Coding style
We format our code with black and otherwise try to get as close as the PEP8 code convention as is reasonable without
being dumb. If you use Vim, the python-mode plugin does all you need. You can also manually configure vim to adopt
this behavior.
Most importantly, please consider the following when writing code as part of angr:• Try to use attribute access (see the @property decorator) instead of getters and setters wherever you can. This
isn’t Java, and attributes enable tab completion in iPython. That being said, be reasonable: attributes should befast. A rule of thumb is that if something could require a constraint solve, it should not be an attribute.
• Use our pylintrc from the angr-dev repo. It’s fairly permissive, but our CI server will fail your builds if pylint
complains under those settings.
• DO NOT, under ANY circumstances, raise Exception or assert False. Use the right exception type.
If there isn’t a correct exception type, subclass the core exception of the module that you’re working in (i.e.,
AngrError in angr, SimError in SimuVEX, etc) and raise that. We catch, and properly handle, the right typesof errors in the right places, but AssertionError and Exception are not handled anywhere and force-terminate
analyses.
• Avoid tabs; use space indentation instead. Even though it’s wrong, the de facto standard is 4 spaces. It is a goodidea to adopt this from the beginning, as merging code that mixes both tab and space indentation is awful.
• Avoid super long lines. It’s okay to have longer lines, but keep in mind that long lines are harder to read andshould be avoided. Let’s try to stick to 120 characters.
• Avoid extremely long functions, it is often better to break them up into smaller functions.
• Always use _ instead of __ for private members (so that we can access them when debugging). You might notthink that anyone has a need to call a given function, but trust us, you’re wrong.

2.3. Developing angr

7

angr

• Format your code with black; config is already defined within pyproject.toml.

2.3.3 Documentation
Document your code. Every class definition and public function definition should have some description of:• What it does.
• What are the type and the meaning of the parameters.
• What it returns.
Class docstrings will be enforced by our linter. Do not under any circumstances write a docstring which doesn’t provide
more information than the name of the class. What you should try to write is a description of the environment thatthe class should be used in. If the class should not be instantiated by end-users, write a description of where it will
be generated and how instances can be acquired. If the class should be instantiated by end-users, explain what kindof object it represents at its core, what behavior is expected of its parameters, and how to safely manage objects of its
type.
We use Sphinx to generate the API documentation. Sphinx supports docstrings written in ReStructured Text withspecial keywords to document function and class parameters, return values, return types, members, etc.
Here is an example of function documentation. Ideally the parameter descriptions should be aligned vertically to makethe docstrings as readable as possible.
def prune(self, filter_func=None, from_stash=None, to_stash=None):"""
Prune unsatisfiable paths from a stash.
:param filter_func: Only prune paths that match this filter.
:param from_stash: Prune paths from this stash. (default: 'active'):param to_stash:
Put pruned paths in this stash. (default: 'pruned'):returns:
The resulting PathGroup.
:rtype:PathGroup"""This format has the advantage that the function parameters are clearly identified in the generated documentation. However, it can make the documentation repetitive, in some cases a textual description can be more readable. Pick theformat you feel is more appropriate for the functions or classes you are documenting.
def read_bytes(self, addr, n):"""Read `n` bytes at address `addr` in memory and return an array of bytes.
"""

2.3.4 Unit tests
If you’re pushing a new feature and it is not accompanied by a test case it will be broken in very short order. Pleasewrite test cases for your stuff.
We have an internal CI server to run tests to check functionality and regression on each commit. In order to have ourserver run your tests, write your tests in a format acceptable to nosetests in a file matching test_*.py in the tests
folder of the appropriate repository. A test file can contain any number of functions of the form def test_*(): orclasses of the form class Test*(unittest.TestCase):. Each of them will be run as a test, and if they raise any
exceptions or assertions, the test fails. Do not use the nose.tools.assert_* functions, as we are presently trying tomigrate to nose2. Use assert statements with descriptive messages or the unittest.TestCase assert methods.

8

Chapter 2. Getting Started

angrLook at the existing tests for examples. Many of them use an alternate format where the test_* function is actually agenerator that yields tuples of functions to call and their arguments, for easy parametrization of tests.
Finally, do not add docstrings to your test functions.

2.4 Help Wanted
v TodoThis page is woefully out of date. We need to update it.
angr is a huge project, and it’s hard to keep up. Here, we list some big TODO items that we would love community
contributions for in the hope that it can direct community involvement. They (will) have a wide range of complexity,
and there should be something for all skill levels!
We tag issues on our github repositories that would be good for community involvement as “Help wanted”. To see theexhaustive list of these, use this github search!

2.4.1 Documentation
There are many parts of angr that suffer from little or no documentation. We desperately need community help in this
area.
API
We are always behind on documentation. We’ve created several tracking issues on github to understand what’s still
missing:
1. angr
2. claripy
3. cle4. pyvex
GitBookThis book is missing some core areas. Specifically, the following could be improved:
1. Finish some of the TODOs floating around the book.
2. Organize the Examples page in some way that makes sense. Right now, most of the examples are very redundant.
It might be cool to have a simple table of most of them so that the page is not so overwhelming.
angr course
Developing a “course” of sorts to get people started with angr would be really beneficial. Steps have already been madein this direction here, but more expansion would be beneficial.
Ideally, the course would have a hands-on component, of increasing difficulty, that would require people to use more
and more of angr’s capabilities.

2.4. Help Wanted

9

angr

2.4.2 Research re-implementation
Unfortunately, not everyone bases their research on angr ;-). Until that’s remedied, we’ll need to periodically implement
related work, on top of angr, to make it reusable within the scope of the framework. This section lists some of thisrelated work that’s ripe for reimplementation in angr.
Redundant State Detection for Dynamic Symbolic Execution
Bugrara, et al. describe a method to identify and trim redundant states, increasing the speed of symbolic execution by
up to 50 times and coverage by 4%. This would be great to have in angr, as an ExplorationTechnique. The paper is
here: http://nsl.cs.columbia.edu/projects/minestrone/papers/atc13-bugrara.pdf
In-Vivo Multi-Path Analysis of Software Systems
Rather than developing symbolic summaries for every system call, we can use a technique proposed by S2E for concretizing necessary data and dispatching them to the OS itself. This would make angr applicable to a much larger setof binaries than it can currently analyze.
While this would be most useful for system calls, once it is implemented, it could be trivially applied to any locationof code (i.e., library functions). By carefully choosing which library functions are handled like this, we can greatly
increase angr’s scalability.

2.4.3 Development
We have several projects in mind that primarily require development effort.
angr-management
The angr GUI, angr-management needs a lot of work. Here is a non-exhaustive list of what is currently missing in
angr-management:• A navigator toolbar showing content in a program’s memory space, just like IDA Pro’s navigator toolbar.
• A text-based disassembly view of the program.
• Better view showing details in program states during path exploration, including modifiable register view, memory view, file descriptor view, etc.
• A GUI for cross referencing.
Exposing angr’s capabilities in a usable way, graphically, would be really useful!
IDA Plugins
Much of angr’s functionality could be exposed via IDA. For example, angr’s data dependence graph could be exposedin IDA through annotations, or obfuscated values can be resolved using symbolic execution.
Additional architectures
More architecture support would make angr all the more useful. Supporting a new architecture with angr would involve:
1. Adding the architecture information to archinfo
2. Adding an IR translation. This may be either an extension to PyVEX, producing IRSBs, or another IR entirely.
3. If your IR is not VEX, add a SimEngine to support it.
4. Adding a calling convention (angr.SimCC) to support SimProcedures (including system calls)
5. Adding or modifying an angr.SimOS to support initialization activities.

10

Chapter 2. Getting Started

angr

6. Creating a CLE backend to load binaries, or extending the CLE ELF backend to know about the new architecture
if the binary format is ELF.
ideas for new architectures:• PIC, AVR, other embedded architectures• SPARC (there is some preliminary libVEX support for SPARC here)
ideas for new IRs:
• LLVM IR (with this, we can extend angr from just a Binary Analysis Framework to a Program Analysis Framework and expand its capabilities in other ways!)• SOOT (there is no reason that angr can’t analyze Java code, although doing so would require some extensions to
our memory model)
Environment support
We use the concept of “function summaries” in angr to model the environment of operating systems (i.e., the effectsof their system calls) and library functions. Extending this would be greatly helpful in increasing angr’s utility. These
function summaries can be found here.
A specific subset of this is system calls. Even more than library function SimProcedures (without which angr can always
execute the actual function), we have very few workarounds for missing system calls. Every implemented system callextends the set of binaries that angr can handle.

2.4.4 Design Problems
There are some outstanding design challenges regarding the integration of additional functionalities into angr.
Type annotation and type information usage
angr has fledgling support for types, in the sense that it can parse them out of header files. However, those types are
not well exposed to do anything useful with. Improving this support would make it possible to, for example, annotate
certain memory regions with certain type information and interact with them intelligently. Consider, for example,
interacting with a linked list like this: print state.mem[state.regs.rax].llist.next.next.value.
(editor’s note: you can actually already do this)

2.4.5 Research Challenges
Historically, angr has progressed in the course of research into novel areas of program analysis. Here, we list several
self-contained research projects that can be tackled.
Semantic function identification/diffing
Current function diffing techniques (TODO: some examples) have drawbacks. For the CGC, we created a semanticbased binary identification engine ( https://github.com/angr/identifier) that can identify functions based on testcases.
There are two areas of improvement, each of which is its own research project:
1. Currently, the testcases used by this component are human-generated. However, symbolic execution can be used
to automatically generate testcases that can be used to recognize instances of a given function in other binaries.
2. By creating testcases that achieve a “high-enough” code coverage of a given function, we can detect changes
in functionality by applying the set of testcases to another implementation of the same function and analyzingchanges in code coverage. This can then be used as a semantic function diff.

2.4. Help Wanted

11

angr

Applying AFL’s path selection criteria to symbolic execution
AFL does an excellent job in identifying “unique” paths during fuzzing by tracking the control flow transitions takenby every path. This same metric can be applied to symbolic exploration, and would probably do a depressingly goodjob, considering how simple it is.

2.4.6 Overarching Research Directions
There are areas of program analysis that are not well explored. We list general directions of research here, but readers
should keep in mind that these directions likely describe potential undertakings of entire PhD dissertations.
Process interactions
Almost all work in the field of binary analysis deals with single binaries, but this is often unrealistic in the real world.
For example, the type of input that can be passed to a CGI program depend on pre-processing by a web server. Currently,
there is no way to support the analysis of multiple concurrent processes in angr, and many open questions in the field(i.e., how to model concurrent actions).
Intra-process concurrency
Similar to the modeling of interactions between processes, little work has been done in understanding the interactionof concurrent threads in the same process. Currently, angr has no way to reason about this, and it is unclear from thetheoretical perspective how to approach this.
A subset of this problem is the analysis of signal handlers (or hardware interrupts). Each signal handler can be modeled
as a thread that can be executed at any time that a signal can be triggered. Understanding when it is meaningful to analyze
these handlers is an open problem. One system that does reason about the effect of interrupts is FIE.
Path explosion
Many approaches (such as Veritesting) attempt to mitigate the path explosion problem in symbolic execution. However,despite these efforts, path explosion is still the main problem preventing symbolic execution from being mainstream.
angr provides an excellent base to implement new techniques to control path explosion. Most approaches can be easily
implemented as ExplorationTechnique s and quickly evaluated (for example, on the CGC dataset).

12

Chapter 2. Getting Started

CHAPTER

THREE

CORE CONCEPTS

3.1 Core Concepts
To get started with angr, you’ll need to have a basic overview of some fundamental angr concepts and how to constructsome basic angr objects. We’ll go over this by examining what’s directly available to you after you’ve loaded a binary!
Your first action with angr will always be to load a binary into a project. We’ll use /bin/true for these examples.
>>> import angr>>> proj = angr.Project('/bin/true')
A project is your control base in angr. With it, you will be able to dispatch analyses and simulations on the executable
you just loaded. Almost every single object you work with in angr will depend on the existence of a project in some
form.
 Tip
Using and exploring angr in IPython (or other Python command line interpreters) is a main use case that we design
angr for. When you are not sure what interfaces are available, tab completion is your friend!
Sometimes tab completion in IPython can be slow. We find the following workaround helpful without degrading
the validity of completion results:# Drop this file in IPython profile's startup directory to avoid running it every time.
import IPython
py = IPython.get_ipython()py.Completer.use_jedi = False

3.1.1 Basic properties
First, we have some basic properties about the project: its CPU architecture, its filename, and the address of its entry
point.
>>> import monkeyhex # this will format numerical results in hexadecimal>>> proj.arch<Arch AMD64 (LE)>>>> proj.entry
0x401670>>> proj.filename'/bin/true'

13

angr

• arch is an instance of an archinfo.Arch object for whichever architecture the program is compiled, in this caselittle-endian amd64. It contains a ton of clerical data about the CPU it runs on, which you can peruse at yourleisure. The common ones you care about are arch.bits, arch.bytes (that one is a @property declarationon the main Arch class), arch.name, and arch.memory_endness.
• entry is the entry point of the binary!
• filename is the absolute filename of the binary. Riveting stuff!

3.1.2 Loading
Getting from a binary file to its representation in a virtual address space is pretty complicated! We have a module
called CLE to handle that. CLE’s result, called the loader, is available in the .loader property. We’ll get into detailon how to use this soon, but for now just know that you can use it to see the shared libraries that angr loaded alongside
your program and perform basic queries about the loaded address space.
>>> proj.loader<Loaded true, maps [0x400000:0x5004000]>>>> proj.loader.shared_objects # may look a little different for you!
{'ld-linux-x86-64.so.2': <ELF Object ld-2.24.so, maps [0x2000000:0x2227167]>,'libc.so.6': <ELF Object libc-2.24.so, maps [0x1000000:0x13c699f]>}>>> proj.loader.min_addr
0x400000>>> proj.loader.max_addr
0x5004000>>> proj.loader.main_object # we've loaded several binaries into this project. Here's␣˓→the main one!
<ELF Object true, maps [0x400000:0x60721f]>>>> proj.loader.main_object.execstack # sample query: does this binary have an␣˓→executable stack?
False>>> proj.loader.main_object.pic # sample query: is this binary position-independent?
True

3.1.3 The factory
There are a lot of classes in angr, and most of them require a project to be instantiated. Instead of making you passaround the project everywhere, we provide project.factory, which has several convenient constructors for common
objects you’ll want to use frequently.
This section will also serve as an introduction to several basic angr concepts. Strap in!
BlocksFirst, we have project.factory.block(), which is used to extract a basic block of code from a given address. Thisis an important fact - angr analyzes code in units of basic blocks. You will get back a Block object, which can tell you
lots of fun things about the block of code:>>> block = proj.factory.block(proj.entry) # lift a block of code from the program's␣
˓→entry point<Block for 0x401670, 42 bytes>(continues on next page)

14

Chapter 3. Core Concepts

angr(continued from previous page)>>> block.pp()
0x401670:
0x401672:
0x401675:
0x401676:
0x401679:
0x40167d:0x40167e:0x40167f:
0x401686:
0x40168d:
0x401694:

xor
mov
pop
mov
and
push
push
lea
lea
lea
call

# pretty-print a disassembly to stdout
ebp, ebp
r9, rdx
rsi
rdx, rsp
rsp, 0xfffffffffffffff0
rax
rsp
r8, [rip + 0x2e2a]rcx, [rip + 0x2db3]
rdi, [rip - 0xd4]
qword ptr [rip + 0x205866]>>> block.instructions# how many instructions are there?
0xb>>> block.instruction_addrs# what are the addresses of the instructions?
[0x401670, 0x401672, 0x401675, 0x401676, 0x401679, 0x40167d, 0x40167e, 0x40167f,␣
˓→0x401686, 0x40168d, 0x401694]
Additionally, you can use a Block object to get other representations of the block of code:>>> block.capstone<CapstoneBlock for 0x401670>>>> block.vex
˓→not a program address)<pyvex.block.IRSB at 0x7706330># capstone disassembly# VEX IRSB (that's a Python internal address,␣StatesHere’s another fact about angr - the Project object only represents an “initialization image” for the program. When
you’re performing execution with angr, you are working with a specific object representing a simulated program state- a SimState. Let’s grab one right now!
>>> state = proj.factory.entry_state()<SimState @ 0x401670>
A SimState contains a program’s memory, registers, filesystem data. . . any “live data” that can be changed by execution
has a home in the state. We’ll cover how to interact with states in depth later, but for now, let’s use state.regs andstate.mem to access the registers and memory of this state:>>> state.regs.rip# get the current instruction pointer<BV64 0x401670>>>> state.regs.rax<BV64 0x1c>>>> state.mem[proj.entry].int.resolved # interpret the memory at the entry point as a C␣
˓→int
<BV32 0x8949ed31>
Those aren’t Python ints! Those are bitvectors. Python integers don’t have the same semantics as words on a CPU, e.g.
wrapping on overflow, so we work with bitvectors, which you can think of as an integer as represented by a series ofbits, to represent CPU data in angr. Note that each bitvector has a .length property describing how wide it is in bits.

3.1. Core Concepts

15

angr

We’ll learn all about how to work with them soon, but for now, here’s how to convert from Python ints to bitvectors
and back again:>>> bv = state.solver.BVV(0x1234, 32)
˓→0x1234<BV32 0x1234>>>> state.solver.eval(bv)0x1234# create a 32-bit-wide bitvector with value␣# BVV stands for bitvector value# convert to Python int

You can store these bitvectors back to registers and memory, or you can directly store a Python integer and it’ll be
converted to a bitvector of the appropriate size:>>> state.regs.rsi = state.solver.BVV(3, 64)>>> state.regs.rsi<BV64 0x3>>>> state.mem[0x1000].long = 4>>> state.mem[0x1000].long.resolved<BV64 0x4>
The mem interface is a little confusing at first, since it’s using some pretty hefty Python magic. The short version of
how to use it is:• Use array[index] notation to specify an address• Use .<type> to specify that the memory should be interpreted as type (common values: char, short, int, long,size_t, uint8_t, uint16_t. . . )• From there, you can either:– Store a value to it, either a bitvector or a Python int– Use .resolved to get the value as a bitvector– Use .concrete to get the value as a Python int
There are more advanced usages that will be covered later!
Finally, if you try reading some more registers you may encounter a very strange looking value:>>> state.regs.rdi<BV64 reg_48_11_64{UNINITIALIZED}>This is still a 64-bit bitvector, but it doesn’t contain a numerical value. Instead, it has a name! This is called a symbolic
variable and it is the underpinning of symbolic execution. Don’t panic! We will discuss all of this in detail exactly two
chapters from now.
Simulation Managers
If a state lets us represent a program at a given point in time, there must be a way to get it to the next point in time. A
simulation manager is the primary interface in angr for performing execution, simulation, whatever you want to call it,with states. As a brief introduction, let’s show how to tick that state we created earlier forward a few basic blocks.
First, we create the simulation manager we’re going to be using. The constructor can take a state or a list of states.
>>> simgr = proj.factory.simulation_manager(state)<SimulationManager with 1 active>>>> simgr.active[<SimState @ 0x401670>]

16

Chapter 3. Core Concepts

angrA simulation manager can contain several stashes of states. The default stash, active, is initialized with the state wepassed in. We could look at simgr.active[0] to look at our state some more, if we haven’t had enough!
Now. . . get ready, we’re going to do some execution.
>>> simgr.step()
We’ve just performed a basic block’s worth of symbolic execution! We can look at the active stash again, noticing thatit’s been updated, and furthermore, that it has not modified our original state. SimState objects are treated as immutableby execution - you can safely use a single state as a “base” for multiple rounds of execution.
>>> simgr.active[<SimState @ 0x1020300>]>>> simgr.active[0].regs.rip<BV64 0x1020300>>>> state.regs.rip<BV64 0x401670># new and exciting!
# still the same!

/bin/true isn’t a very good example for describing how to do interesting things with symbolic execution, so we’ll
stop here for now.

3.1.4 Analyses
angr comes pre-packaged with several built-in analyses that you can use to extract some fun kinds of information froma program. Here they are:>>> proj.analyses.
# Press TAB here in ipython to get an autocomplete-listing␣˓→of everything:proj.analyses.BackwardSliceproj.analyses.CongruencyCheckproj.analyses.
˓→reload_analyses
proj.analyses.BinaryOptimizer
proj.analyses.DDG
proj.analyses.
˓→StaticHooker
proj.analyses.BinDiff
proj.analyses.DFG
proj.analyses.
˓→VariableRecovery
proj.analyses.BoyScout
proj.analyses.Disassembly
proj.analyses.
˓→VariableRecoveryFast
proj.analyses.CDG
proj.analyses.GirlScout
proj.analyses.
˓→Veritesting
proj.analyses.CFG
proj.analyses.Identifierproj.analyses.VFG
proj.analyses.CFGEmulated
proj.analyses.LoopFinder
proj.analyses.VSA_
˓→DDG
proj.analyses.CFGFast
proj.analyses.Reassembler
A couple of these are documented later in this book, but in general, if you want to find how to use a given analysis, you
should look in the api documentation for angr.analyses. As an extremely brief example: here’s how you construct
and use a quick control-flow graph:# Originally, when we loaded this binary it also loaded all its dependencies into the␣˓→same virtual addressspace# This is undesirable for most analysis.
>>> proj = angr.Project('/bin/true', auto_load_libs=False)>>> cfg = proj.analyses.CFGFast()<CFGFast Analysis Result at 0x2d85130># cfg.graph is a networkx DiGraph full of CFGNode instances(continues on next page)

3.1. Core Concepts

17

angr

(continued from previous page)# You should go look up the networkx APIs to learn how to use this!
>>> cfg.graph<networkx.classes.digraph.DiGraph at 0x2da43a0>>>> len(cfg.graph.nodes())
951# To get the CFGNode for a given address, use cfg.get_any_node>>> entry_node = cfg.get_any_node(proj.entry)>>> len(list(cfg.graph.successors(entry_node)))2

3.1.5 Now what?
Having read this page, you should now be acquainted with several important angr concepts: basic blocks, states, bitvectors, simulation managers, and analyses. You can’t really do anything interesting besides just use angr as a glorified
debugger, though! Keep reading, and you will unlock deeper powers. . .

3.2 Loading a Binary
Previously, you saw just the barest taste of angr’s loading facilities - you loaded /bin/true, and then loaded it again
without its shared libraries. You also saw proj.loader and a few things it could do. Now, we’ll dive into the nuancesof these interfaces and the things they can tell you.
We briefly mentioned angr’s binary loading component, CLE. CLE stands for “CLE Loads Everything”, and is responsible for taking a binary (and any libraries that it depends on) and presenting it to the rest of angr in a way that is easy
to work with.

3.2.1 The Loader
Let’s load examples/fauxware/fauxware and take a deeper look at how to interact with the loader.
>>> import angr, monkeyhex>>> proj = angr.Project('examples/fauxware/fauxware')>>> proj.loader<Loaded fauxware, maps [0x400000:0x5008000]>
Loaded Objects
The CLE loader (cle.Loader) represents an entire conglomerate of loaded binary objects, loaded and mapped intoa single memory space. Each binary object is loaded by a loader backend that can handle its filetype (a subclass ofcle.Backend). For example, cle.ELF is used to load ELF binaries.
There will also be objects in memory that don’t correspond to any loaded binary. For example, an object used to provide
thread-local storage support, and an externs object used to provide unresolved symbols.
You can get the full list of objects that CLE has loaded with loader.all_objects, as well as several more targetedclassifications:# All loaded objects>>> proj.loader.all_objects[<ELF Object fauxware, maps [0x400000:0x60105f]>,<ELF Object libc-2.23.so, maps [0x1000000:0x13c999f]>,<ELF Object ld-2.23.so, maps [0x2000000:0x2227167]>,(continues on next page)

18

Chapter 3. Core Concepts

angr(continued from previous page)<ELFTLSObject Object cle##tls, maps [0x3000000:0x3015010]>,<ExternObject Object cle##externs, maps [0x4000000:0x4008000]>,<KernelObject Object cle##kernel, maps [0x5000000:0x5008000]>]# This is the "main" object, the one that you directly specified when loading the project>>> proj.loader.main_object<ELF Object fauxware, maps [0x400000:0x60105f]># This is a dictionary mapping from shared object name to object>>> proj.loader.shared_objects{ 'fauxware': <ELF Object fauxware, maps [0x400000:0x60105f]>,'libc.so.6': <ELF Object libc-2.23.so, maps [0x1000000:0x13c999f]>,'ld-linux-x86-64.so.2': <ELF Object ld-2.23.so, maps [0x2000000:0x2227167]> }# Here's all the objects that were loaded from ELF files# If this were a windows program we'd use all_pe_objects!
>>> proj.loader.all_elf_objects[<ELF Object fauxware, maps [0x400000:0x60105f]>,<ELF Object libc-2.23.so, maps [0x1000000:0x13c999f]>,<ELF Object ld-2.23.so, maps [0x2000000:0x2227167]>]# Here's the "externs object", which we use to provide addresses for unresolved imports␣
˓→and angr internals>>> proj.loader.extern_object<ExternObject Object cle##externs, maps [0x4000000:0x4008000]># This object is used to provide addresses for emulated syscalls>>> proj.loader.kernel_object<KernelObject Object cle##kernel, maps [0x5000000:0x5008000]># Finally, you can to get a reference to an object given an address in it>>> proj.loader.find_object_containing(0x400000)<ELF Object fauxware, maps [0x400000:0x60105f]>
You can interact directly with these objects to extract metadata from them:>>> obj = proj.loader.main_object# The entry point of the object>>> obj.entry
0x400580>>> obj.min_addr, obj.max_addr(0x400000, 0x60105f)# Retrieve this ELF's segments and sections>>> obj.segments<Regions: [<ELFSegment memsize=0xa74, filesize=0xa74, vaddr=0x400000, flags=0x5,␣
˓→offset=0x0>,<ELFSegment memsize=0x238, filesize=0x228, vaddr=0x600e28, flags=0x6,␣
˓→offset=0xe28>]>>>> obj.sections(continues on next page)3.2. Loading a Binary

19

angr

(continued from previous page)<Regions: [<Unnamed | offset 0x0, vaddr 0x0, size 0x0>,<.interp | offset 0x238, vaddr 0x400238, size 0x1c>,<.note.ABI-tag | offset 0x254, vaddr 0x400254, size 0x20>,...etc# You can get an individual segment or section by an address it contains:>>> obj.find_segment_containing(obj.entry)<ELFSegment memsize=0xa74, filesize=0xa74, vaddr=0x400000, flags=0x5, offset=0x0>>>> obj.find_section_containing(obj.entry)<.text | offset 0x580, vaddr 0x400580, size 0x338># Get the address of the PLT stub for a symbol>>> addr = obj.plt['strcmp']>>> addr
0x400550>>> obj.reverse_plt[addr]'strcmp'# Show the prelinked base of the object and the location it was actually mapped into␣˓→memory by CLE>>> obj.linked_base
0x400000>>> obj.mapped_base
0x400000
Symbols and Relocations
You can also work with symbols while using CLE. A symbol is a fundamental concept in the world of executableformats, effectively mapping a name to an address.
The easiest way to get a symbol from CLE is to use loader.find_symbol, which takes either a name or an address
and returns a Symbol object.
>>> strcmp = proj.loader.find_symbol('strcmp')>>> strcmp<Symbol "strcmp" in libc.so.6 at 0x1089cd0>
The most useful attributes on a symbol are its name, its owner, and its address, but the “address” of a symbol can be
ambiguous. The Symbol object has three ways of reporting its address:• .rebased_addr is its address in the global address space. This is what is shown in the print output.
• .linked_addr is its address relative to the prelinked base of the binary. This is the address reported in, forexample, readelf(1).
• .relative_addr is its address relative to the object base. This is known in the literature (particularly the
Windows literature) as an RVA (relative virtual address).
>>> strcmp.name'strcmp'>>> strcmp.owner<ELF Object libc-2.23.so, maps [0x1000000:0x13c999f]>(continues on next page)

20

Chapter 3. Core Concepts

angr(continued from previous page)>>> strcmp.rebased_addr
0x1089cd0>>> strcmp.linked_addr
0x89cd0>>> strcmp.relative_addr
0x89cd0
In addition to providing debug information, symbols also support the notion of dynamic linking. libc provides thestrcmp symbol as an export, and the main binary depends on it. If we ask CLE to give us a strcmp symbol fromthe main object directly, it’ll tell us that this is an import symbol. Import symbols do not have meaningful addresses
associated with them, but they do provide a reference to the symbol that was used to resolve them, as .resolvedby.
>>> strcmp.is_export
True>>> strcmp.is_import
False# On Loader, the method is find_symbol because it performs a search operation to find␣˓→the symbol.
# On an individual object, the method is get_symbol because there can only be one symbol␣
˓→with a given name.
>>> main_strcmp = proj.loader.main_object.get_symbol('strcmp')>>> main_strcmp<Symbol "strcmp" in fauxware (import)>>>> main_strcmp.is_export
False>>> main_strcmp.is_importTrue>>> main_strcmp.resolvedby<Symbol "strcmp" in libc.so.6 at 0x1089cd0>
The specific ways that the links between imports and exports should be registered in memory are handled by anothernotion called relocations. A relocation says, “when you match [import] up with an export symbol, please write the export’s address to [location], formatted as [format].” We can see the full list of relocations for an object (as Relocation
instances) as obj.relocs, or just a mapping from symbol name to Relocation as obj.imports. There is no corresponding list of export symbols.
A relocation’s corresponding import symbol can be accessed as .symbol. The address the relocation will write tois accessible through any of the address identifiers you can use for Symbol, and you can get a reference to the object
requesting the relocation with .owner as well.
# Relocations don't have a good pretty-printing, so those addresses are Python-internal,␣
˓→unrelated to our program>>> proj.loader.shared_objects['libc.so.6'].imports{'__libc_enable_secure': <cle.backends.elf.relocation.amd64.R_X86_64_GLOB_DAT at␣
˓→0x7ff5c5fce780>,'__tls_get_addr': <cle.backends.elf.relocation.amd64.R_X86_64_JUMP_SLOT at␣
˓→0x7ff5c6018358>,'_dl_argv': <cle.backends.elf.relocation.amd64.R_X86_64_GLOB_DAT at 0x7ff5c5fd2e48>,'_dl_find_dso_for_object': <cle.backends.elf.relocation.amd64.R_X86_64_JUMP_SLOT at␣
˓→0x7ff5c6018588>,'_dl_starting_up': <cle.backends.elf.relocation.amd64.R_X86_64_GLOB_DAT at␣
˓→0x7ff5c5fd2550>,(continues on next page)3.2. Loading a Binary

21

angr

(continued from previous page)'_rtld_global': <cle.backends.elf.relocation.amd64.R_X86_64_GLOB_DAT at 0x7ff5c5fce4e0>,'_rtld_global_ro': <cle.backends.elf.relocation.amd64.R_X86_64_GLOB_DAT at␣
˓→0x7ff5c5fcea20>}
If an import cannot be resolved to any export, for example, because a shared library could not be found, CLE willautomatically update the externs object (loader.extern_obj) to claim it provides the symbol as an export.

3.2.2 Loading Options
If you are loading something with angr.Project and you want to pass an option to the cle.Loader instance that
Project implicitly creates, you can just pass the keyword argument directly to the Project constructor, and it will bepassed on to CLE. You should look at the CLE API docs. if you want to know everything that could possibly be passed
in as an option, but we will go over some important and frequently used options here.
We’ve discussed auto_load_libs already - it enables or disables CLE’s attempt to automatically resolve shared librarydependencies, and is on by default. Additionally, there is the opposite, except_missing_libs, which, if set to true,
will cause an exception to be thrown whenever a binary has a shared library dependency that cannot be resolved.
You can pass a list of strings to force_load_libs and anything listed will be treated as an unresolved shared librarydependency right out of the gate, or you can pass a list of strings to skip_libs to prevent any library of that name frombeing resolved as a dependency. Additionally, you can pass a list of strings (or a single string) to ld_path, which will
be used as an additional search path for shared libraries, before any of the defaults: the same directory as the loaded
program, the current working directory, and your system libraries.
If you want to specify some options that only apply to a specific binary object, CLE will let you do that too. The
parameters main_opts and lib_opts do this by taking dictionaries of options. main_opts is a mapping from option
names to option values, while lib_opts is a mapping from library name to dictionaries mapping option names tooption values.
The options that you can use vary from backend to backend, but some common ones are:• backend - which backend to use, as either a class or a name• base_addr - a base address to use• entry_point - an entry point to use• arch - the name of an architecture to use
Example:>>> angr.Project('examples/fauxware/fauxware', main_opts={'backend': 'blob', 'arch':
˓→'i386'}, lib_opts={'libc.so.6': {'backend': 'elf'}})<Project examples/fauxware/fauxware>
Backends
CLE currently has backends for statically loading ELF, PE, CGC, Mach-O and ELF core dump files, as well as loading
files into a flat address space. CLE will automatically detect the correct backend to use in most cases, so you shouldn’t
need to specify which backend you’re using unless you’re doing some pretty weird stuff.
You can force CLE to use a specific backend for an object by including a key in its options dictionary, as describedabove. Some backends cannot autodetect which architecture to use and must have a arch specified. The key doesn’t
need to match any list of architectures; angr will identify which architecture you mean given almost any common
identifier for any supported arch.
To refer to a backend, use the name from this table:

22

Chapter 3. Core Concepts

angrbackendnamedescription

requires
arch?

elf
pe
mach-ocgc
backedcgc

Static loader for ELF files based on PyELFTools
Static loader for PE files based on PEFile
Static loader for Mach-O files. Does not support dynamic linking or rebasing.
Static loader for Cyber Grand Challenge binaries
Static loader for CGC binaries that allows specifying memory and register
backers
Static loader for ELF core dumps
Loads the file into memory as a flat image

no
no
no
no
no

elfcore
blob

no
yes

3.2.3 Symbolic Function Summaries
By default, Project tries to replace external calls to library functions by using symbolic summaries termed SimProcedures - effectively just Python functions that imitate the library function’s effect on the state. We’ve implemented
a whole bunch of functions as SimProcedures. These builtin procedures are available in the angr.SIM_PROCEDURES
dictionary, which is two-leveled, keyed first on the package name (libc, posix, win32, stubs) and then on the name of
the library function. Executing a SimProcedure instead of the actual library function that gets loaded from your system
makes analysis a LOT more tractable, at the cost of some potential inaccuracies <Gotchas when using angr>.
When no such summary is available for a given function:• if auto_load_libs is True (this is the default), then the real library function is executed instead. This may or
may not be what you want, depending on the actual function. For example, some of libc’s functions are extremelycomplex to analyze and will most likely cause an explosion of the number of states for the path trying to executethem.
• if auto_load_libs is False, then external functions are unresolved, and Project will resolve them to a generic“stub” SimProcedure called ReturnUnconstrained. It does what its name says: it returns a unique unconstrained symbolic value each time it is called.
• if use_sim_procedures (this is a parameter to angr.Project, not cle.Loader) is False (it is True by
default), then only symbols provided by the extern object will be replaced with SimProcedures, and they will be
replaced by a stub ReturnUnconstrained, which does nothing but return a symbolic value.
• you may specify specific symbols to exclude from being replaced with SimProcedures with the parameters toangr.Project: exclude_sim_procedures_list and exclude_sim_procedures_func.
• Look at the code for angr.Project._register_object for the exact algorithm.
The mechanism by which angr replaces library code with a Python summary is called hooking, and you can do it too!
When performing simulation, at every step angr checks if the current address has been hooked, and if so, runs the hookinstead of the binary code at that address. The API to let you do this is proj.hook(addr, hook), where hook is a
SimProcedure instance. You can manage your project’s hooks with .is_hooked, .unhook, and .hooked_by, whichshould hopefully not require explanation.
There is an alternate API for hooking an address that lets you specify your own off-the-cuff function to use as a hook,by using proj.hook(addr) as a function decorator. If you do this, you can also optionally specify a length keyword
argument to make execution jump some number of bytes forward after your hook finishes.
>>> stub_func = angr.SIM_PROCEDURES['stubs']['ReturnUnconstrained'] # this is a CLASS>>> proj.hook(0x10000, stub_func()) # hook with an instance of the class>>> proj.is_hooked(0x10000)
˓→explanitory
True# these functions should be pretty self(continues on next page)3.2. Loading a Binary

23

angr

(continued from previous page)>>> proj.hooked_by(0x10000)<ReturnUnconstrained>>>> proj.unhook(0x10000)>>> @proj.hook(0x20000, length=5)... def my_hook(state):...
state.regs.rax = 1>>> proj.is_hooked(0x20000)
True
Furthermore, you can use proj.hook_symbol(name, hook), providing the name of a symbol as the first argument,
to hook the address where the symbol lives. One very important usage of this is to extend the behavior of angr’s built-in
library SimProcedures. Since these library functions are just classes, you can subclass them, overriding pieces of their
behavior, and then use your subclass in a hook.

3.2.4 So far so good!
By now, you should have a reasonable understanding of how to control the environment in which your analysis happens,on the level of the CLE loader and the angr Project. You should also understand that angr makes a reasonable attempt
to simplify its analysis by hooking complex library functions with SimProcedures that summarize the effects of thefunctions.
In order to see all the things you can do with the CLE loader and its backends, look at the CLE API docs.

3.3 Symbolic Expressions and Constraint Solving
angr’s power comes not from it being an emulator, but from being able to execute with what we call symbolic variables.
Instead of saying that a variable has a concrete numerical value, we can say that it holds a symbol, effectively just aname. Then, performing arithmetic operations with that variable will yield a tree of operations (termed an abstract
syntax tree or AST, from compiler theory). ASTs can be translated into constraints for an SMT solver, like z3, in order
to ask questions like “given the output of this sequence of operations, what must the input have been?” Here, you’lllearn how to use angr to answer this.

3.3.1 Working with Bitvectors
Let’s get a dummy project and state so we can start playing with numbers.
>>> import angr, monkeyhex>>> proj = angr.Project('/bin/true')>>> state = proj.factory.entry_state()
A bitvector is just a sequence of bits, interpreted with the semantics of a bounded integer for arithmetic. Let’s make afew.
# 64-bit bitvectors with concrete values 1 and 100>>> one = state.solver.BVV(1, 64)>>> one<BV64 0x1>>>> one_hundred = state.solver.BVV(100, 64)>>> one_hundred<BV64 0x64>(continues on next page)

24

Chapter 3. Core Concepts

angr(continued from previous page)# create a 27-bit bitvector with concrete value 9>>> weird_nine = state.solver.BVV(9, 27)>>> weird_nine<BV27 0x9>
As you can see, you can have any sequence of bits and call them a bitvector. You can do math with them too:>>> one + one_hundred<BV64 0x65># You can provide normal Python integers and they will be coerced to theappropriate type: >>> one_hundred + 0x100 <BV64 0x164># The semantics of normal wrapping arithmetic apply>>> one_hundred - one*200<BV64 0xffffffffffffff9c>
You cannot say one + weird_nine, though. It is a type error to perform an operation on bitvectors of differing
lengths. You can, however, extend weird_nine so it has an appropriate number of bits:>>> weird_nine.zero_extend(64 - 27)<BV64 0x9>>>> one + weird_nine.zero_extend(64 - 27)<BV64 0xa>
zero_extend will pad the bitvector on the left with the given number of zero bits. You can also use sign_extend
to pad with a duplicate of the highest bit, preserving the value of the bitvector under two’s complement signed integer
semantics.
Now, let’s introduce some symbols into the mix.
# Create a bitvector symbol named "x" of length 64 bits>>> x = state.solver.BVS("x", 64)>>> x<BV64 x_9_64>>>> y = state.solver.BVS("y", 64)>>> y<BV64 y_10_64>
x and y are now symbolic variables, which are kind of like the variables you learned to work with in 7th grade algebra.
Notice that the name you provided has been mangled by appending an incrementing counter and You can do as mucharithmetic as you want with them, but you won’t get a number back, you’ll get an AST instead.
>>> x + one<BV64 x_9_64 + 0x1>>>> (x + one) / 2<BV64 (x_9_64 + 0x1) / 0x2>>>> x - y
<BV64 x_9_64 - y_10_64>
Technically x and y and even one are also ASTs - any bitvector is a tree of operations, even if that tree is only one layer
3.3. Symbolic Expressions and Constraint Solving

25

angr

deep. To understand this, let’s learn how to process ASTs.
Each AST has a .op and a .args. The op is a string naming the operation being performed, and the args are the values
the operation takes as input. Unless the op is BVV or BVS (or a few others. . . ), the args are all other ASTs, the tree
eventually terminating with BVVs or BVSs.
>>> tree = (x + 1) / (y + 2)>>> tree<BV64 (x_9_64 + 0x1) / (y_10_64 + 0x2)>>>> tree.op'__floordiv__'>>> tree.args(<BV64 x_9_64 + 0x1>, <BV64 y_10_64 + 0x2>)>>> tree.args[0].op'__add__'>>> tree.args[0].args(<BV64 x_9_64>, <BV64 0x1>)>>> tree.args[0].args[1].op'BVV'>>> tree.args[0].args[1].args(1, 64)
From here on out, we will use the word “bitvector” to refer to any AST whose topmost operation produces a bitvector.
There can be other data types represented through ASTs, including floating point numbers and, as we’re about to see,booleans.

3.3.2 Symbolic Constraints
Performing comparison operations between any two similarly-typed ASTs will yield another AST - not a bitvector, but
now a symbolic boolean.
>>> x == 1
<Bool x_9_64 == 0x1>>>> x == one<Bool x_9_64 == 0x1>>>> x > 2
<Bool x_9_64 > 0x2>>>> x + y == one_hundred + 5<Bool (x_9_64 + y_10_64) == 0x69>>>> one_hundred > 5<Bool True>>>> one_hundred > -5
<Bool False>
One tidbit you can see from this is that the comparisons are unsigned by default. The -5 in the last example is coerced
to <BV64 0xfffffffffffffffb>, which is definitely not less than one hundred. If you want the comparison to besigned, you can say one_hundred.SGT(-5) (that’s “signed greater-than”). A full list of operations can be found at
the end of this chapter.
This snippet also illustrates an important point about working with angr - you should never directly use a comparison
between variables in the condition for an if- or while-statement, since the answer might not have a concrete truth value.
Even if there is a concrete truth value, if one > one_hundred will raise an exception. Instead, you should use
solver.is_true and solver.is_false, which test for concrete truthyness/falsiness without performing a constraint
solve.

26

Chapter 3. Core Concepts

angr>>> yes = one == 1>>> no = one == 2>>> maybe = x == y>>> state.solver.is_true(yes)True>>> state.solver.is_false(yes)False>>> state.solver.is_true(no)False>>> state.solver.is_false(no)True>>> state.solver.is_true(maybe)
False>>> state.solver.is_false(maybe)
False

3.3.3 Constraint Solving
You can treat any symbolic boolean as an assertion about the valid values of a symbolic variable by adding it as aconstraint to the state. You can then query for a valid value of a symbolic variable by asking for an evaluation of asymbolic expression.
An example will probably be more clear than an explanation here:>>> state.solver.add(x > y)>>> state.solver.add(y > 2)>>> state.solver.add(10 > x)>>> state.solver.eval(x)4By adding these constraints to the state, we’ve forced the constraint solver to consider them as assertions that mustbe satisfied about any values it returns. If you run this code, you might get a different value for x, but that value willdefinitely be greater than 3 (since y must be greater than 2 and x must be greater than y) and less than 10. Furthermore,
if you then say state.solver.eval(y), you’ll get a value of y which is consistent with the value of x that you got.
If you don’t add any constraints between two queries, the results will be consistent with each other.
From here, it’s easy to see how to do the task we proposed at the beginning of the chapter - finding the input that
produced a given output.
# get a fresh state without constraints>>> state = proj.factory.entry_state()>>> input = state.solver.BVS('input', 64)>>> operation = (((input + 4) * 3) >> 1) + input>>> output = 200>>> state.solver.add(operation == output)>>> state.solver.eval(input)
0x3333333333333381
Note that, again, this solution only works because of the bitvector semantics. If we were operating over the domain of
integers, there would be no solutions!
If we add conflicting or contradictory constraints, such that there are no values that can be assigned to the variables suchthat the constraints are satisfied, the state becomes unsatisfiable, or unsat, and queries against it will raise an exception.
You can check the satisfiability of a state with state.satisfiable().

3.3. Symbolic Expressions and Constraint Solving

27

angr

>>> state.solver.add(input < 2**32)>>> state.satisfiable()
False
You can also evaluate more complex expressions, not just single variables.
# fresh state>>> state = proj.factory.entry_state()>>> state.solver.add(x - y >= 4)>>> state.solver.add(y > 0)>>> state.solver.eval(x)5>>> state.solver.eval(y)1>>> state.solver.eval(x + y)
6
From this we can see that eval is a general purpose method to convert any bitvector into a Python primitive while
respecting the integrity of the state. This is why we use eval to convert from concrete bitvectors to Python ints, too!
Also note that the x and y variables can be used in this new state despite having been created using an old state. Variables
are not tied to any one state, and can exist freely.

3.3.4 Floating point numbers
z3 has support for the theory of IEEE754 floating point numbers, and so angr can use them as well. The main differenceis that instead of a width, a floating point number has a sort. You can create floating point symbols and values with
FPV and FPS.
# fresh state>>> state = proj.factory.entry_state()>>> a = state.solver.FPV(3.2, state.solver.fp.FSORT_DOUBLE)>>> a<FP64 FPV(3.2, DOUBLE)>>>> b = state.solver.FPS('b', state.solver.fp.FSORT_DOUBLE)>>> b<FP64 FPS('FP_b_0_64', DOUBLE)>>>> a + b
<FP64 fpAdd('RNE', FPV(3.2, DOUBLE), FPS('FP_b_0_64', DOUBLE))>>>> a + 4.4<FP64 FPV(7.6000000000000005, DOUBLE)>>>> b + 2 < 0<Bool fpLT(fpAdd('RNE', FPS('FP_b_0_64', DOUBLE), FPV(2.0, DOUBLE)), FPV(0.0, DOUBLE))>So there’s a bit to unpack here - for starters the pretty-printing isn’t as smart about floating point numbers. But pastthat, most operations actually have a third parameter, implicitly added when you use the binary operators - the rounding
mode. The IEEE754 spec supports multiple rounding modes (round-to-nearest, round-to-zero, round-to-positive, etc),
so z3 has to support them. If you want to specify the rounding mode for an operation, use the fp operation explicitly(solver.fpAdd for example) with a rounding mode (one of solver.fp.RM_*) as the first argument.
Constraints and solving work in the same way, but with eval returning a floating point number:
28

Chapter 3. Core Concepts

angr>>> state.solver.add(b + 2 < 0)>>> state.solver.add(b + 2 > -1)>>> state.solver.eval(b)-2.4999999999999996
This is nice, but sometimes we need to be able to work directly with the representation of the float as a bitvector. You
can interpret bitvectors as floats and vice versa, with the methods raw_to_bv and raw_to_fp:>>> a.raw_to_bv()<BV64 0x400999999999999a>>>> b.raw_to_bv()<BV64 fpToIEEEBV(FPS('FP_b_0_64', DOUBLE))>>>> state.solver.BVV(0, 64).raw_to_fp()<FP64 FPV(0.0, DOUBLE)>>>> state.solver.BVS('x', 64).raw_to_fp()<FP64 fpToFP(x_1_64, DOUBLE)>
These conversions preserve the bit-pattern, as if you casted a float pointer to an int pointer or vice versa. However, if
you want to preserve the value as closely as possible, as if you casted a float to an int (or vice versa), you can use a
different set of methods, val_to_fp and val_to_bv. These methods must take the size or sort of the target value asa parameter, due to the floating-point nature of floats.
>>> a<FP64 FPV(3.2, DOUBLE)>>>> a.val_to_bv(12)<BV12 0x3>>>> a.val_to_bv(12).val_to_fp(state.solver.fp.FSORT_FLOAT)<FP32 FPV(3.0, FLOAT)>
These methods can also take a signed parameter, designating the signedness of the source or target bitvector.

3.3.5 More Solving Methods
eval will give you one possible solution to an expression, but what if you want several? What if you want to ensurethat the solution is unique? The solver provides you with several methods for common solving patterns:• solver.eval(expression) will give you one possible solution to the given expression.
• solver.eval_one(expression) will give you the solution to the given expression, or throw an error if morethan one solution is possible.
• solver.eval_upto(expression, n) will give you up to n solutions to the given expression, returning fewer
than n if fewer than n are possible.
• solver.eval_atleast(expression, n) will give you n solutions to the given expression, throwing an error
if fewer than n are possible.
• solver.eval_exact(expression, n) will give you n solutions to the given expression, throwing an error if
fewer or more than are possible.
• solver.min(expression) will give you the minimum possible solution to the given expression.
• solver.max(expression) will give you the maximum possible solution to the given expression.
Additionally, all of these methods can take the following keyword arguments:• extra_constraints can be passed as a tuple of constraints. These constraints will be taken into account forthis evaluation, but will not be added to the state.
3.3. Symbolic Expressions and Constraint Solving

29

angr

• cast_to can be passed a data type to cast the result to. Currently, this can only be int and bytes, which
will cause the method to return the corresponding representation of the underlying data. For example, state.
solver.eval(state.solver.BVV(0x41424344, 32), cast_to=bytes) will return b'ABCD'.

3.3.6 Summary
That was a lot!! After reading this, you should be able to create and manipulate bitvectors, booleans, and floating pointvalues to form trees of operations, and then query the constraint solver attached to a state for possible solutions under aset of constraints. Hopefully by this point you understand the power of using ASTs to represent computations, and thepower of a constraint solver.
In the appendix, you can find a reference for all the additional operations you can apply to ASTs, in case you ever needa quick table to look at.

3.4 Machine State - memory, registers, and so on
So far, we’ve only used angr’s simulated program states (SimState objects) in the barest possible way in order todemonstrate basic concepts about angr’s operation. Here, you’ll learn about the structure of a state object and how tointeract with it in a variety of useful ways.

3.4.1 Review: Reading and writing memory and registers
If you’ve been reading this book in order (and you should be, at least for this first section), you already saw the basics
of how to access memory and registers. state.regs provides read and write access to the registers through attributeswith the names of each register, and state.mem provides typed read and write access to memory with index-accessnotation to specify the address followed by an attribute access to specify the type you would like to interpret the memory
as.
Additionally, you should now know how to work with ASTs, so you can now understand that any bitvector-typed AST
can be stored in registers or memory.
Here are some quick examples for copying and performing operations on data from the state:>>> import angr, claripy>>> proj = angr.Project('/bin/true')>>> state = proj.factory.entry_state()# copy rsp to rbp>>> state.regs.rbp = state.regs.rsp# store rdx to memory at 0x1000>>> state.mem[0x1000].uint64_t = state.regs.rdx# dereference rbp>>> state.regs.rbp = state.mem[state.regs.rbp].uint64_t.resolved# add rax, qword ptr [rsp + 8]>>> state.regs.rax += state.mem[state.regs.rsp + 8].uint64_t.resolved

3.4.2 Basic Execution
Earlier, we showed how to use a Simulation Manager to do some basic execution. We’ll show off the full capabilitiesof the simulation manager in the next chapter, but for now we can use a much simpler interface to demonstrate how
symbolic execution works: state.step(). This method will perform one step of symbolic execution and return
an object called angr.engines.successors.SimSuccessors. Unlike normal emulation, symbolic execution can
30

Chapter 3. Core Concepts

angrproduce several successor states that can be classified in a number of ways. For now, what we care about is the .
successors property of this object, which is a list containing all the “normal” successors of a given step.
Why a list, instead of just a single successor state? Well, angr’s process of symbolic execution is just the taking theoperations of the individual instructions compiled into the program and performing them to mutate a SimState. Whena line of code like if (x > 4) is reached, what happens if x is a symbolic bitvector? Somewhere in the depths ofangr, the comparison x > 4 is going to get performed, and the result is going to be <Bool x_32_1 > 4>.
That’s fine, but the next question is, do we take the “true” branch or the “false” one? The answer is, we take both! We
generate two entirely separate successor states - one simulating the case where the condition was true and simulating
the case where the condition was false. In the first state, we add x > 4 as a constraint, and in the second state, we add!(x > 4) as a constraint. That way, whenever we perform a constraint solve using either of these successor states, theconditions on the state ensure that any solutions we get are valid inputs that will cause execution to follow the same
path that the given state has followed.
To demonstrate this, let’s use a fake firmware image <../examples/fauxware/fauxware> as an example. If you look at
the source code <../examples/fauxware/fauxware.c> for this binary, you’ll see that the authentication mechanism forthe firmware is backdoored; any username can be authenticated as an administrator with the password “SOSNEAKY”.
Furthermore, the first comparison against user input that happens is the comparison against the backdoor, so if we step
until we get more than one successor state, one of those states will contain conditions constraining the user input to be
the backdoor password. The following snippet implements this:>>> proj = angr.Project('examples/fauxware/fauxware')>>> state = proj.factory.entry_state(stdin=angr.SimFile) # ignore that argument for now␣˓→- we're disabling a more complicated default setup for the sake of education>>> while True:...
succ = state.step()...
if len(succ.successors) == 2:
...
break
...
state = succ.successors[0]>>> state1, state2 = succ.successors>>> state1<SimState @ 0x400629>>>> state2<SimState @ 0x400699
Don’t look at the constraints on these states directly - the branch we just went through involves the result of strcmp,
which is a tricky function to emulate symbolically, and the resulting constraints are very complicated.
The program we emulated took data from standard input, which angr treats as an infinite stream of symbolic data
by default. To perform a constraint solve and get a possible value that input could have taken in order to satisfy theconstraints, we’ll need to get a reference to the actual contents of stdin. We’ll go over how our file and input subsystems
work later on this very page, but for now, just use state.posix.stdin.load(0, state.posix.stdin.size) toretrieve a bitvector representing all the content read from stdin so far.
>>> input_data = state1.posix.stdin.load(0, state1.posix.stdin.size)>>> state1.solver.eval(input_data, cast_to=bytes)
b'\x00\x00\x00\x00\x00\x00\x00\x00\x00SOSNEAKY\x00\x00\x00'>>> state2.solver.eval(input_data, cast_to=bytes)
b'\x00\x00\x00\x00\x00\x00\x00\x00\x00S\x00\x80N\x00\x00 \x00\x00\x00\x00'
As you can see, in order to go down the state1 path, you must have given as a password the backdoor string “SOSNEAKY”. In order to go down the state2 path, you must have given something besides “SOSNEAKY”. z3 has

3.4. Machine State - memory, registers, and so on

31

angr

helpfully provided one of the billions of strings fitting this criteria.
Fauxware was the first program angr’s symbolic execution ever successfully worked on, back in 2013. By finding its
backdoor using angr you are participating in a grand tradition of having a bare-bones understanding of how to use
symbolic execution to extract meaning from binaries!

3.4.3 State Presets
So far, whenever we’ve been working with a state, we’ve created it with project.factory.entry_state(). This isjust one of several state constructors available on the project factory:• .blank_state() constructs a “blank slate” blank state, with most of its data left uninitialized. When accessing
uninitialized data, an unconstrained symbolic value will be returned.
• .entry_state() constructs a state ready to execute at the main binary’s entry point.
• .full_init_state() constructs a state that is ready to execute through any initializers that need to be run
before the main binary’s entry point, for example, shared library constructors or preinitializers. When it isfinished with these it will jump to the entry point.
• .call_state() constructs a state ready to execute a given function.
You can customize the state through several arguments to these constructors:• All of these constructors can take an addr argument to specify the exact address to start.
• If you’re executing in an environment that can take command line arguments or an environment, you can pass alist of arguments through args and a dictionary of environment variables through env into entry_state andfull_init_state. The values in these structures can be strings or bitvectors, and will be serialized into thestate as the arguments and environment to the simulated execution. The default args is an empty list, so if the
program you’re analyzing expects to find at least an argv[0], you should always provide that!
• If you’d like to have argc be symbolic, you can pass a symbolic bitvector as argc to the entry_state andfull_init_state constructors. Be careful, though: if you do this, you should also add a constraint to theresulting state that your value for argc cannot be larger than the number of args you passed into args.
• To use the call state, you should call it with .call_state(addr, arg1, arg2, ...), where addr is theaddress of the function you want to call and argN is the Nth argument to that function, either as a Python integer,
string, or array, or a bitvector. If you want to have memory allocated and actually pass in a pointer to an object,
you should wrap it in an PointerWrapper, i.e. angr.PointerWrapper("point to me!"). The results of thisAPI can be a little unpredictable, but we’re working on it.
• To specify the calling convention used for a function with call_state, you can pass a SimCC instance as thecc argument.:raw-html-m2r:<br> We try to pick a sane default, but for special cases you will need to help angrout.
There are several more options that can be used in any of these constructors! See the docs on the project.factory
object (an angr.factory.AngrObjectFactory) for more details.

3.4.4 Low level interface for memory
The state.mem interface is convenient for loading typed data from memory, but when you want to do raw loads andstores to and from ranges of memory, it’s very cumbersome. It turns out that state.mem is actually just a bunch of logic
to correctly access the underlying memory storage, which is just a flat address space filled with bitvector data: state.
memory. You can use state.memory directly with the .load(addr, size) and .store(addr, val) methods:>>> s = proj.factory.blank_state()>>> s.memory.store(0x4000, s.solver.BVV(0x0123456789abcdef0123456789abcdef, 128))>>> s.memory.load(0x4004, 6) # load-size is in bytes<BV48 0x89abcdef0123>

32

Chapter 3. Core Concepts

angrAs you can see, the data is loaded and stored in a “big-endian” fashion, since the primary purpose of state.memory is
to load an store swaths of data with no attached semantics. However, if you want to perform a byteswap on the loaded
or stored data, you can pass a keyword argument endness - if you specify little-endian, byteswap will happen. The
endness should be one of the members of the Endness enum in the archinfo package used to hold declarative data
about CPU architectures for angr. Additionally, the endness of the program being analyzed can be found as arch.
memory_endness - for instance state.arch.memory_endness.
>>> import archinfo>>> s.memory.load(0x4000, 4, endness=archinfo.Endness.LE)<BV32 0x67452301>
There is also a low-level interface for register access, state.registers, that uses the exact same API as state.
memory, but explaining its behavior involves a dive into the abstractions that angr uses to seamlessly work with multiple
architectures. The short version is that it is simply a register file, with the mapping between registers and offsets definedin archinfo.

3.4.5 State Options
There are a lot of little tweaks that can be made to the internals of angr that will optimize behavior in some situations
and be a detriment in others. These tweaks are controlled through state options.
On each SimState object, there is a set (state.options) of all its enabled options. Each option (really just a string)
controls the behavior of angr’s execution engine in some minute way. A listing of the full domain of options, alongwith the defaults for different state types, can be found in the appendix. You can access an individual option for adding
to a state through angr.options. The individual options are named with CAPITAL_LETTERS, but there are also
common groupings of objects that you might want to use bundled together, named with lowercase_letters.
When creating a SimState through any constructor, you may pass the keyword arguments add_options andremove_options, which should be sets of options that modify the initial options set from the default.
# Example: enable lazy solves, an option that causes state satisfiability to be checked␣
˓→as infrequently as possible.
# This change to the settings will be propagated to all successor states created from␣˓→this state after this line.
>>> s.options.add(angr.options.LAZY_SOLVES)# Create a new state with lazy solves enabled>>> s = proj.factory.entry_state(add_options={angr.options.LAZY_SOLVES})# Create a new state without simplification options enabled>>> s = proj.factory.entry_state(remove_options=angr.options.simplification)

3.4.6 State Plugins
With the exception of the set of options just discussed, everything stored in a SimState is actually stored in a plugin
attached to the state. Almost every property on the state we’ve discussed so far is a plugin - memory, registers, mem,regs, solver, etc. This design allows for code modularity as well as the ability to easily implement new kinds of data
storage for other aspects of an emulated state, or the ability to provide alternate implementations of plugins.
For example, the normal memory plugin simulates a flat memory space, but analyses can choose to enable the “abstract
memory” plugin, which uses alternate data types for addresses to simulate free-floating memory mappings independentof address, to provide state.memory. Conversely, plugins can reduce code complexity: state.memory and state.
registers are actually two different instances of the same plugin, since the registers are emulated with an address
space as well.

3.4. Machine State - memory, registers, and so on

33

angr

The globals pluginstate.globals is an extremely simple plugin: it implements the interface of a standard Python dict, allowing you tostore arbitrary data on a state.
The history pluginstate.history is a very important plugin storing historical data about the path a state has taken during execution. It
is actually a linked list of several history nodes, each one representing a single round of execution—you can traverse
this list with state.history.parent.parent etc.
To make it more convenient to work with this structure, the history also provides several efficient iterators over thehistory of certain values. In general, these values are stored as history.recent_NAME and the iterator over themis just history.NAME. For example, for addr in state.history.bbl_addrs: print hex(addr) will printout a basic block address trace for the binary, while state.history.recent_bbl_addrs is the list of basic blocks
executed in the most recent step, state.history.parent.recent_bbl_addrs is the list of basic blocks executedin the previous step, etc. If you ever need to quickly obtain a flat list of these values, you can access .hardcopy,
e.g. state.history.bbl_addrs.hardcopy. Keep in mind though, index-based accessing is implemented on theiterators.
Here is a brief listing of some of the values stored in the history:• history.descriptions is a listing of string descriptions of each of the rounds of execution performed on thestate.
• history.bbl_addrs is a listing of the basic block addresses executed by the state. There may be more than one
per round of execution, and not all addresses may correspond to binary code - some may be addresses at which
SimProcedures are hooked.
• history.jumpkinds is a listing of the disposition of each of the control flow transitions in the state’s history,as VEX enum strings.
• history.jump_guards is a listing of the conditions guarding each of the branches that the state has encountered.
• history.events is a semantic listing of “interesting events” which happened during execution, such as thepresence of a symbolic jump condition, the program popping up a message box, or execution terminating withan exit code.
• history.actions is usually empty, but if you add the angr.options.refs options to the state, it will be
populated with a log of all the memory, register, and temporary value accesses performed by the program.
The callstack pluginangr will track the call stack for the emulated program. On every call instruction, a frame will be added to the top of the
tracked callstack, and whenever the stack pointer drops below the point where the topmost frame was called, a frame
is popped. This allows angr to robustly store data local to the current emulated function.
Similar to the history, the callstack is also a linked list of nodes, but there are no provided iterators over the contentsof the nodes - instead you can directly iterate over state.callstack to get the callstack frames for each of the active
frames, in order from most recent to oldest. If you just want the topmost frame, this is state.callstack.
• callstack.func_addr is the address of the function currently being executed• callstack.call_site_addr is the address of the basic block which called the current function• callstack.stack_ptr is the value of the stack pointer from the beginning of the current function• callstack.ret_addr is the location that the current function will return to if it returns

34

Chapter 3. Core Concepts

angr3.4.7 More about I/O: Files, file systems, and network sockets
Please refer to Working with File System, Sockets, and Pipes for a more complete and detailed documentation of how
I/O is modeled in angr.

3.4.8 Copying and Merging
A state supports very fast copies, so that you can explore different possibilities:>>> proj = angr.Project('/bin/true')>>> s = proj.factory.blank_state()>>> s1 = s.copy()>>> s2 = s.copy()>>> s1.mem[0x1000].uint32_t = 0x41414141>>> s2.mem[0x1000].uint32_t = 0x42424242
States can also be merged together.
# merge will return a tuple. the first element is the merged state# the second element is a symbolic variable describing a state flag
# the third element is a boolean describing whether any merging was done>>> (s_merged, m, anything_merged) = s1.merge(s2)# this is now an expression that can resolve to "AAAA" *or* "BBBB">>> aaaa_or_bbbb = s_merged.mem[0x1000].uint32_tv Tododescribe limitations of merging

3.5 Simulation Managers
The most important control interface in angr is the SimulationManager, which allows you to control symbolic execution
over groups of states simultaneously, applying search strategies to explore a program’s state space. Here, you’ll learn
how to use it.
Simulation managers let you wrangle multiple states in a slick way. States are organized into “stashes”, which you canstep forward, filter, merge, and move around as you wish. This allows you to, for example, step two different stashes ofstates at different rates, then merge them together. The default stash for most operations is the active stash, which iswhere your states get put when you initialize a new simulation manager.

3.5.1 Stepping
The most basic capability of a simulation manager is to step forward all states in a given stash by one basic block. You
do this with .step().
>>> import angr>>> proj = angr.Project('examples/fauxware/fauxware', auto_load_libs=False)>>> state = proj.factory.entry_state()>>> simgr = proj.factory.simgr(state)>>> simgr.active[<SimState @ 0x400580>](continues on next page)

3.5. Simulation Managers

35

angr

(continued from previous page)>>> simgr.step()>>> simgr.active[<SimState @ 0x400540>]
Of course, the real power of the stash model is that when a state encounters a symbolic branch condition, both of thesuccessor states appear in the stash, and you can step both of them in sync. When you don’t really care about controlling
analysis very carefully and you just want to step until there’s nothing left to step, you can just use the .run() method.
# Step until the first symbolic branch>>> while len(simgr.active) == 1:...
simgr.step()>>> simgr<SimulationManager with 2 active>>>> simgr.active[<SimState @ 0x400692>, <SimState @ 0x400699>]# Step until everything terminates>>> simgr.run()>>> simgr<SimulationManager with 3 deadended>
We now have 3 deadended states! When a state fails to produce any successors during execution, for example, because
it reached an exit syscall, it is removed from the active stash and placed in the deadended stash.

3.5.2 Stash Management
Let’s see how to work with other stashes.
To move states between stashes, use .move(), which takes from_stash, to_stash, and filter_func (optional,
default is to move everything). For example, let’s move everything that has a certain string in its output:>>> simgr.move(from_stash='deadended', to_stash='authenticated', filter_func=lambda s: b
˓→'Welcome' in s.posix.dumps(1))>>> simgr<SimulationManager with 2 authenticated, 1 deadended>
We were able to just create a new stash named “authenticated” just by asking for states to be moved to it. All the statesin this stash have “Welcome” in their stdout, which is a fine metric for now.
Each stash is just a list, and you can index into or iterate over the list to access each of the individual states, but there
are some alternate methods to access the states too. If you prepend the name of a stash with one_, you will be given
the first state in the stash. If you prepend the name of a stash with mp_, you will be given a mulpyplexed version of the
stash.
>>> for s in simgr.deadended + simgr.authenticated:...
print(hex(s.addr))
0x1000030
0x1000078
0x1000078>>> simgr.one_deadended<SimState @ 0x1000030>(continues on next page)

36

Chapter 3. Core Concepts

angr(continued from previous page)>>> simgr.mp_authenticatedMP([<SimState @ 0x1000078>, <SimState @ 0x1000078>])>>> simgr.mp_authenticated.posix.dumps(0)MP(['\x00\x00\x00\x00\x00\x00\x00\x00\x00SOSNEAKY\x00','\x00\x00\x00\x00\x00\x00\x00\x00\x00S\x80\x80\x80\x80@\x80@\x00'])
Of course, step, run, and any other method that operates on a single stash of paths can take a stash argument,
specifying which stash to operate on.
There are lots of fun tools that the simulation manager provides you for managing your stashes. We won’t go into therest of them for now, but you should check out the API documentation. TODO: link
Stash types
You can use stashes for whatever you like, but there are a few stashes that will be used to categorize some special kindsof states. These are:
Stash Description
acThis stash contains the states that will be stepped by default, unless an alternate stash is specified.
tive
dead- A state goes to the deadended stash when it cannot continue the execution for some reason, including no more
ended valid instructions, unsat state of all of its successors, or an invalid instruction pointer.
prunedWhen using LAZY_SOLVES, states are not checked for satisfiability unless absolutely necessary. When a stateis found to be unsat in the presence of LAZY_SOLVES, the state hierarchy is traversed to identify when, in its
history, it initially became unsat. All states that are descendants of that point (which will also be unsat, sincea state cannot become un-unsat) are pruned and put in this stash.
un- If the save_unconstrained option is provided to the SimulationManager constructor, states that are detercon- mined to be unconstrained (i.e., with the instruction pointer controlled by user data or some other source ofstrainedsymbolic data) are placed here.
un- If the save_unsat option is provided to the SimulationManager constructor, states that are determined to besat
unsatisfiable (i.e., they have constraints that are contradictory, like the input having to be both “AAAA” and“BBBB” at the same time) are placed here.
There is another list of states that is not a stash: errored. If, during execution, an error is raised, then the state will
be wrapped in an ErrorRecord object, which contains the state and the error it raised, and then the record will beinserted into errored. You can get at the state as it was at the beginning of the execution tick that caused the error
with record.state, you can see the error that was raised with record.error, and you can launch a debug shell at
the site of the error with record.debug(). This is an invaluable debugging tool!

3.5.3 Simple Exploration
An extremely common operation in symbolic execution is to find a state that reaches a certain address, while discarding
all states that go through another address. Simulation manager has a shortcut for this pattern, the .explore() method.
When launching .explore() with a find argument, execution will run until a state is found that matches the findcondition, which can be the address of an instruction to stop at, a list of addresses to stop at, or a function which takes
a state and returns whether it meets some criteria. When any of the states in the active stash match the find condition,
they are placed in the found stash, and execution terminates. You can then explore the found state, or decide to discard
it and continue with the other ones. You can also specify an avoid condition in the same format as find. When a state
matches the avoid condition, it is put in the avoided stash, and execution continues. Finally, the num_find argument
controls the number of states that should be found before returning, with a default of 1. Of course, if you run out ofstates in the active stash before finding this many solutions, execution will stop anyway.

3.5. Simulation Managers

37

angr

Let’s look at a simple crackme example <./examples.md#reverseme-modern-binary-exploitation—csci-4968>:
First, we load the binary.
>>> proj = angr.Project('examples/CSCI-4968-MBE/challenges/crackme0x00a/crackme0x00a')
Next, we create a SimulationManager.
>>> simgr = proj.factory.simgr()
Now, we symbolically execute until we find a state that matches our condition (i.e., the “win” condition).
>>> simgr.explore(find=lambda s: b"Congrats" in s.posix.dumps(1))<SimulationManager with 1 active, 1 found>
Now, we can get the flag out of that state!
>>> s = simgr.found[0]>>> print(s.posix.dumps(1))
Enter password: Congrats!
>>> flag = s.posix.dumps(0)>>> print(flag)g00dJ0B!
Pretty simple, isn’t it?
Other examples can be found by browsing the examples.
Exploration Techniquesangr ships with several pieces of canned functionality that let you customize the behavior of a simulation manager, called
exploration techniques. The archetypical example of why you would want an exploration technique is to modify thepattern in which the state space of the program is explored - the default “step everything at once” strategy is effectively
breadth-first search, but with an exploration technique you could implement, for example, depth-first search. However,
the instrumentation power of these techniques is much more flexible than that - you can totally alter the behavior ofangr’s stepping process. Writing your own exploration techniques will be covered in a later chapter.
To use an exploration technique, call simgr.use_technique(tech), where tech is an instance of an ExplorationTechnique subclass. angr’s built-in exploration techniques can be found under angr.exploration_techniques.
Here’s a quick overview of some of the built-in ones:• DFS: Depth first search, as mentioned earlier. Keeps only one state active at once, putting the rest in the deferred
stash until it deadends or errors.
• Explorer: This technique implements the .explore() functionality, allowing you to search for and avoid addresses.
• LengthLimiter: Puts a cap on the maximum length of the path a state goes through.
• LoopSeer: Uses a reasonable approximation of loop counting to discard states that appear to be going througha loop too many times, putting them in a spinning stash and pulling them out again if we run out of otherwise
viable states.
• ManualMergepoint: Marks an address in the program as a merge point, so states that reach that address will bebriefly held, and any other states that reach that same point within a timeout will be merged together.
• MemoryWatcher: Monitors how much memory is free/available on the system between simgr steps and stops
exploration if it gets too low.
38

Chapter 3. Core Concepts

angr• Oppologist: The “operation apologist” is an especially fun gadget - if this technique is enabled and angr encounters an unsupported instruction, for example a bizarre and foreign floating point SIMD op, it will concretize all
the inputs to that instruction and emulate the single instruction using the unicorn engine, allowing execution tocontinue.
• Spiller: When there are too many states active, this technique can dump some of them to disk in order to keep
memory consumption low.
• Threading: Adds thread-level parallelism to the stepping process. This doesn’t help much because of Python’s
global interpreter locks, but if you have a program whose analysis spends a lot of time in angr’s native-code
dependencies (unicorn, z3, libvex) you can seem some gains.
• Tracer: An exploration technique that causes execution to follow a dynamic trace recorded from some othersource. The dynamic tracer repository has some tools to generate those traces.
• Veritesting: An implementation of a CMU paper on automatically identifying useful merge points. This is so
useful, you can enable it automatically with veritesting=True in the SimulationManager constructor! Notethat it frequenly doesn’t play nice with other techniques due to the invasive way it implements static symbolic
execution.
Look at the API documentation for the SimulationManager and ExplorationTechnique classes for more information.

3.6 Simulation and Instrumentation
When you ask for a step of execution to happen in angr, something has to actually perform the step. angr uses a seriesof engines (subclasses of the SimEngine class) to emulate the effects that of a given section of code has on an input
state. The execution core of angr simply tries all the available engines in sequence, taking the first one that is able tohandle the step. The following is the default list of engines, in order:• The failure engine kicks in when the previous step took us to some uncontinuable state• The syscall engine kicks in when the previous step ended in a syscall• The hook engine kicks in when the current address is hooked• The unicorn engine kicks in when the UNICORN state option is enabled and there is no symbolic data in the state• The VEX engine kicks in as the final fallback.

3.6.1 SimSuccessors
The code that actually tries all the engines in turn is project.factory.successors(state, **kwargs),
which passes its arguments onto each of the engines. This function is at the heart of state.step() andsimulation_manager.step(). It returns a SimSuccessors object, which we discussed briefly before. The purposeof SimSuccessors is to perform a simple categorization of the successor states, stored in various list attributes. Theyare:

3.6. Simulation and Instrumentation

39

angr

At- Guard IntributeCon- strucdition
tion PointerDescription

successors
True Can be A normal, satisfiable successor state to the state processed by the engine. The instruction(can sympointer of this state may be symbolic (i.e., a computed jump based on user input), so thebebolicstate might actually represent several potential continuations of execution going forward.
sym- (butbolic, 256 sobut
lutions
con- or less;strainedsee
tounconstrained_successors).
True)
unsat_successors
False Can be Unsatisfiable successors. These are successors whose guard conditions can only be false(can sym(i.e., jumps that cannot be taken, or the default branch of jumps that must be taken).
bebolic.
symbolic,
but
constrained
toFalse).
flat_successors
True ConAs noted above, states in the successors list can have symbolic instruction pointers. This(can creteis rather confusing, as elsewhere in the code (i.e., in SimEngineVEX.process, when it’sbevalue.
time to step that state forward), we make assumptions that a single program state only
symrepresents the execution of a single spot in the code. To alleviate this, when we encounterbolic,
states in successors with symbolic instruction pointers, we compute all possible concretebutsolutions (up to an arbitrary threshold of 256) for them, and make a copy of the state forconeach such solution. We call this process “flattening”. These flat_successors are states,
strainedeach of which has a different, concrete instruction pointer. For example, if the instruction
topointer of a state in successors was X+5, where X had constraints of X > 0x800000 andTrue).
X <= 0x800010, we would flatten it into 16 different flat_successors states, one withan instruction pointer of 0x800006, one with 0x800007, and so on until 0x800015.
unconstrained_successors
True SymDuring the flattening procedure described above, if it turns out that there are more than 256(can bolic
possible solutions for the instruction pointer, we assume that the instruction pointer has been
be(withoverwritten with unconstrained data (i.e., a stack overflow with user data). This assumption
sym- moreis not sound in general. Such states are placed in unconstrained_successors and not
bolic, thanin successors.
but
256
con- solustrainedtions).
toTrue).
all_successors
Any- Can be This is successors + unsat_successors + unconstrained_successors.
thing symbolic.

40

Chapter 3. Core Concepts

angr3.6.2 Breakpoints
v Todorewrite this to fix the narrative
Like any decent execution engine, angr supports breakpoints. This is pretty cool! A point is set as follows:>>> import angr>>> b = angr.Project('examples/fauxware/fauxware')# get our state>>> s = b.factory.entry_state()# add a breakpoint. This breakpoint will drop into ipdb right before a memory write␣˓→happens.
>>> s.inspect.b('mem_write')# on the other hand, we can have a breakpoint trigger right *after* a memory write␣˓→happens.
# we can also have a callback function run instead of opening ipdb.
>>> def debug_func(state):...
print("State %s is about to do a memory write!")>>> s.inspect.b('mem_write', when=angr.BP_AFTER, action=debug_func)# or, you can have it drop you in an embedded IPython!
>>> s.inspect.b('mem_write', when=angr.BP_AFTER, action=angr.BP_IPYTHON)
There are many other places to break than a memory write. Here is the list. You can break at BP_BEFORE or
BP_AFTER for each of these events.

3.6. Simulation and Instrumentation

41

angr

Event type

Event meaning

mem_read
mem_write
address_concretization
reg_read
reg_write
tmp_read
tmp_write
expr

Memory is being read.
Memory is being written.
A symbolic memory access is being resolved.

statement
instruction
irsb
constraints
exit
fork
symbolic_variablecall
returnsimproceduredirty
syscallengine_process

A register is being read.
A register is being written.
A temp is being read.
A temp is being written.
An expression is being created (i.e., a result of an arithmetic operation or a constant in theIR).
An IR statement is being translated.
A new (native) instruction is being translated.
A new basic block is being translated.
New constraints are being added to the state.
A successor is being generated from execution.
A symbolic execution state has forked into multiple states.
A new symbolic variable is being created.
A call instruction is hit.
A ret instruction is hit.
A simprocedure (or syscall) is executed.
A dirty IR callback is executed.
A syscall is executed (called in addition to the simprocedure event).
A SimEngine is about to process some code.

These events expose different attributes:
Event type

Attribute name

Attribute availability

Attribute meaning

mem_read
mem_read
mem_read
mem_read
mem_write
mem_write
mem_write
mem_write
reg_read
reg_read
reg_read
reg_read
reg_write
reg_write
reg_write
reg_write
tmp_readtmp_read
tmp_write
tmp_write
expr
expr

mem_read_address
mem_read_expr
mem_read_length
mem_read_condition
mem_write_address
mem_write_length
mem_write_expr
mem_write_condition
reg_read_offset
reg_read_length
reg_read_expr
reg_read_condition
reg_write_offset
reg_write_length
reg_write_expr
reg_write_condition
tmp_read_num
tmp_read_expr
tmp_write_num
tmp_write_expr
expr
expr_result

BP_BEFORE or BP_AFTER
BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_AFTER
BP_BEFORE or BP_AFTER
BP_AFTER
BP_BEFORE or BP_AFTER
BP_AFTER

The address at which memory is
The expression at that address.
The length of the memory read.
The condition of the memory rea
The address at which memory is
The length of the memory write.
The expression that is being writt
The condition of the memory wri
The offset of the register being re
The length of the register read.
The expression in the register.
The condition of the register readThe offset of the register being w
The length of the register write.
The expression that is being writt
The condition of the register writ
The number of the temp being re
The expression of the temp.
The number of the temp written.
The expression written to the tem
The IR expression.
The value (e.g. AST) which the e42

Chapter 3. Core Concepts

angrEvent type

Attribute name

Attribute availability

Attribute meaningstatement
instruction
irsb
constraints
call
exit
exit
exit
symbolic_variable
symbolic_variable
symbolic_variableaddress_concretization
address_concretization
address_concretization
address_concretization
address_concretization
address_concretization
syscallsimprocedure
simprocedure
simprocedure
simprocedure
dirty
dirty
dirty
dirty
engine_processengine_processstatement
instruction
address
added_constraints
function_address
exit_target
exit_guard
exit_jumpkind
symbolic_namesymbolic_size
symbolic_expr
address_concretization_strategy
address_concretization_action
address_concretization_memory
address_concretization_expr
address_concretization_add_constraints
address_concretization_result
syscall_namesimprocedure_namesimprocedure_addr
simprocedure_result
simprocedure
dirty_namedirty_handler
dirty_args
dirty_result
sim_engine
successors

BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_AFTER
BP_AFTER
BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE
BP_BEFORE or BP_AFTER
BP_AFTER
BP_BEFORE or BP_AFTER
BP_BEFORE or BP_AFTER

The index of the IR statement (inThe address of the native instruct
The address of the basic block.
The list of constraint expressions
The name of the function being c
The expression representing the t
The expression representing the g
The expression representing the k
The name of the symbolic variab
The size of the symbolic variable
The expression representing the n
The SimConcretizationStrategy b
The SimAction object being used
The SimMemory object on which
The AST representing the memor
Whether or not constraints should
The list of resolved memory addr
The name of the system call.
The name of the simprocedure.
The address of the simprocedure.
The return value of the simproced
The actual SimProcedure object.
The name of the dirty call.
The function that will be run to h
The address of the dirty.
The return value of the dirty call.
The SimEngine that is processing
The SimSuccessors object definin

These attributes can be accessed as members of state.inspect during the appropriate breakpoint callback to accessthe appropriate values. You can even modify these value to modify further uses of the values!
>>> def track_reads(state):...
print('Read', state.inspect.mem_read_expr, 'from', state.inspect.mem_read_
˓→address)...
>>> s.inspect.b('mem_read', when=angr.BP_AFTER, action=track_reads)
Additionally, each of these properties can be used as a keyword argument to inspect.b to make the breakpoint conditional:# This will break before a memory write if 0x1000 is a possible value of its target␣˓→expression>>> s.inspect.b('mem_write', mem_write_address=0x1000)# This will break before a memory write if 0x1000 is the *only* value of its target␣˓→expression>>> s.inspect.b('mem_write', mem_write_address=0x1000, mem_write_address_unique=True)# This will break after instruction 0x8000, but only 0x1000 is a possible value of the␣˓→last expression that was read from memory(continues on next page)

3.6. Simulation and Instrumentation

43

angr

(continued from previous page)>>> s.inspect.b('instruction', when=angr.BP_AFTER, instruction=0x8000, mem_read_
˓→expr=0x1000)
Cool stuff! In fact, we can even specify a function as a condition:# this is a complex condition that could do anything! In this case, it makes sure that␣
˓→RAX is 0x41414141 and# that the basic block starting at 0x8004 was executed sometime in this path's history>>> def cond(state):...
return state.eval(state.regs.rax, cast_to=str) == 'AAAA' and 0x8004 in state.
˓→inspect.backtrace>>> s.inspect.b('mem_write', condition=cond)That is some cool stuff!
Caution about mem_read breakpoint
The mem_read breakpoint gets triggered anytime there are memory reads by either the executing program or the binary
analysis. If you are using breakpoint on mem_read and also using state.mem to load data from memory addresses,
then know that the breakpoint will be fired as you are technically reading memory.
So if you want to load data from memory and not trigger any mem_read breakpoint you have had set up, then use
state.memory.load with the keyword arguments disable_actions=True and inspect=False.
This is also true for state.find and you can use the same keyword arguments to prevent mem_read breakpoints fromfiring.

3.7 Analyses
angr’s goal is to make it easy to carry out useful analyses on binary programs. To this end, angr allows you to package
analysis code in a common format that can be easily applied to any project. We will cover writing your own analyses
Writing Analyses, but the idea is that all the analyses appear under project.analyses (for example, project.
analyses.CFGFast()) and can be called as functions, returning analysis result instances.

3.7.1 Built-in Analyses
Name

Description

CFGFast
CFGEmulated
VFG

Constructs a fast Control Flow Graph of the program
Constructs an accurate Control Flow Graph of the program

DDG
BackwardSlice
Identifier
More!

44

Performs VSA on every function of the program, creating a Value Flow Graph and detecting stackvariables
Calculates a Data Dependency Graph, allowing one to determine what statements a given value depends on
Computes a Backward Slice of a program with respect to a certain target
Identifies common library functions in CGC binaries
angr has quite a few analyses, most of which work! If you’d like to know how to use one, please submit
an issue requesting documentation.

Chapter 3. Core Concepts

angr3.7.2 Resilience
Analyses can be written to be resilient, and catch and log basically any error. These errors, depending on how they’recaught, are logged to the errors or named_errors attribute of the analysis. However, you might want to run ananalysis in “fail fast” mode, so that errors are not handled. To do this, the argument fail_fast=True can be passed
into the analysis constructor.

3.8 Symbolic Execution
Symbolic execution is a program analysis technique used to explore multiple execution paths of a program simultaneously. Unlike normal execution, which runs the program with specific inputs, symbolic execution treats inputs as
symbolic variables rather than concrete values. This means the execution can represent a wide range of inputs withsymbolic expressions. Symbolic execution allows, at a time in emulation, to determine for a branch all conditions
necessary to take a branch or not. Every variable is represented as a symbolic value, and each branch as a constraint.
Thus, symbolic execution allows us to see which conditions allow the program to go from point A to point B by resolving these constraints. The execution paths are then analyzed by solving constraints generated by these symbolic
expressions, allowing the discovery of bugs and vulnerabilities that might be missed in standard testing.

3.8.1 Example:
Consider the following simple program :const char* check_value(int x) {if (x > 10) {return "Greater";} else {return "Lesser or Equal";}}
In normal execution, if x is set to 5, the program will follow the path where x <= 10 and return “Lesser or Equal”. In
symbolic execution, x is treated as a symbolic variable, X. The execution engine explores both paths:• Path 1: X > 10 leading to the result “Greater”• Path 2: X <= 10 leading to the result “Lesser or Equal”
Constraints for both paths are generated and solved to understand all possible behaviors of the program.
In software verification, it helps ensure that the code behaves as expected across all possible inputs and states. For
security analysis, symbolic execution can uncover vulnerabilities such as input validation errors, which could be exploited by attackers. Additionally, in automated testing, it aids in generating comprehensive test cases that cover edgecases and rare execution paths, enhancing the robustness and security of software systems. Overall, symbolic execution
provides a powerful means to rigorously analyze and improve software and firmware reliability.

3.8.2 Basic Execution
Now let’s see an example use case of symbolic execution with angr. Consider the following example code,
void helloWorld() {printf("Hello, World!\n");}void firstCall(uint32_t num) {if (num > 50 && num <100)(continues on next page)3.8. Symbolic Execution

45

angr

(continued from previous page)

HelloWorld();}
The firstCall function will accept a 32-bit number as an input and will call helloWorld function if the number isbetween 50 and 100.
You can perform a symbolic execution to find a correct and valid input to reach the final helloWorld function callwith angr using the following sample code.
import angr, claripy# Load the binary
project = angr.Project('./3func', auto_load_libs=False)# Define the address of the firstCall function
firstCall_addr = project.loader.main_object.get_symbol("firstCall")# Define the address of the helloWorld function
helloWorld_addr = project.loader.main_object.get_symbol("helloWorld")# Create a symbolic variable for the firstCall arg
input_arg = claripy.BVS('input_arg', 32)# Create a blank state at the address of the firstCall function
init_state = project.factory.blank_state(addr=firstCall_addr.rebased_addr)# Assuming the calling convention passes the argument in a register# (e.g., x86 uses edi for the argument)
init_state.regs.edi = input_arg# Create a simulation manager
simgr = project.factory.simulation_manager(init_state)# Explore the binary, looking for the address of helloWorldsimgr.explore(find=helloWorld_addr.rebased_addr)# Check if we found a state that reached the target
if simgr.found:
input_value = simgr.found[0].solver.eval(input_arg)
print(f"Value of input_arg that reaches HelloWorld: {input_value}")# Get the constraints for reaching the helloWorld function
constraints = simgr.found[0].solver.constraints# Create a solver with the constraints
solver = claripy.Solver()solver.add(constraints)
min_val = solver.min(input_arg)
max_val = solver.max(input_arg)
print(f"Function arg: min = {min_val}, max = {max_val}")else:
print("Did not find a state that reaches HelloWorld.")
It will produce the output like the below with a valid example function arg that can reach the function helloWorld
that you can use as a test case.

46

Chapter 3. Core Concepts

angrValue of input_arg that reaches HelloWorld: 71
Function arg: min = 51, max = 99

3.9 A final word of advice
Congratulations! If you’ve read this far through the book (editor’s note: this comment only really applies when we’ve
actually finished writing all the TODOs so far) then you’ve been introduced to all the fundamental components of angrnecessary to get started with binary analysis.
Ultimately, angr is just an emulator. It is a highly instrumentable and very unique emulator with lots of considerations
for environment, true, but at its core, the work you do with angr is about extracting knowledge about how a bunch of
bytecode behaves on a CPU. In designing angr, we’ve tried to provide you with the tools and abstractions on top of
this emulator to make certain common tasks more useful, but there’s no problem you can’t solve just by working witha SimState and observing the affects of .step().
As you read further into this book, we’ll describe more technical subjects and how to tune angr’s behavior for complicated scenarios. This knowledge should inform your use of angr so you can take the quickest path to a solution to any
given problem, but ultimately, you will want to solve problems by exercising creativity with the tools at your disposal.
If you can take a problem and wrangle it into a form where it has defined and tractable inputs and outputs, you canabsolutely use angr to achieve your goals, given that these goals involve analyzing binaries. None of the abstractions
or instrumentations we provide are the end-all of how to use angr for a given task - angr is designed so it can be usedin as integrated or as ad-hoc of a manner as you desire. If you see a path from problem to solution, take it.
Of course, it’s very difficult to become well-acquainted with such a huge piece of technology as angr. To this end you
can absolutely lean on the community (through the angr slack is the best option) to discuss angr and solving problems
with it.
Good luck!

3.9. A final word of advice

47

angr

48

Chapter 3. Core Concepts

CHAPTERFOUR

BUILD-IN ANALYSES

4.1 Control-flow Graph Recovery (CFG)
angr includes analyses to recover the control-flow graph of a binary program. This also includes recovery of function
boundaries, as well as reasoning about indirect jumps and other useful metadata.

4.1.1 General ideas
A basic analysis that one might carry out on a binary is a Control Flow Graph. A CFG is a graph with (conceptually)
basic blocks as nodes and jumps/calls/rets/etc as edges.
In angr, there are two types of CFG that can be generated: a static CFG (CFGFast) and a dynamic CFG (CFGEmulated).
CFGFast uses static analysis to generate a CFG. It is significantly faster, but is theoretically bounded by the fact thatsome control-flow transitions can only be resolved at execution-time. This is the same sort of CFG analysis performedby other popular reverse-engineering tools, and its results are comparable with their output.
CFGEmulated uses symbolic execution to capture the CFG. While it is theoretically more accurate, it is dramaticallyslower. It is also typically less complete, due to issues with the accuracy of emulation (system calls, missing hardware
features, and so on)
If you are unsure which CFG to use, or are having problems with CFGEmulated, try CFGFast first.
A CFG can be constructed by doing:>>> import angr
# load your project>>> p = angr.Project('/bin/true', load_options={'auto_load_libs': False})# Generate a static CFG>>> cfg = p.analyses.CFGFast()# generate a dynamic CFG>>> cfg = p.analyses.CFGEmulated(keep_state=True)

4.1.2 Using the CFG
The CFG, at its core, is a NetworkX di-graph. This means that all of the normal NetworkX APIs are available:>>> print("This is the graph:", cfg.graph)>>> print("It has %d nodes and %d edges" % (len(cfg.graph.nodes()), len(cfg.graph.
˓→edges())))

49

angr

The nodes of the CFG graph are instances of class CFGNode. Due to context sensitivity, a given basic block can havemultiple nodes in the graph (for multiple contexts).
# this grabs *any* node at a given location:>>> entry_node = cfg.get_any_node(p.entry)# on the other hand, this grabs all of the nodes>>> print("There were %d contexts for the entry block" % len(cfg.get_all_nodes(p.entry)))# we can also look up predecessors and successors>>> print("Predecessors of the entry point:", entry_node.predecessors)>>> print("Successors of the entry point:", entry_node.successors)>>> print("Successors (and type of jump) of the entry point:", [ jumpkind + " to " +␣˓→str(node.addr) for node,jumpkind in cfg.get_successors_and_jumpkind(entry_node) ])Viewing the CFG
Control-flow graph rendering is a hard problem. angr does not provide any built-in mechanism for rendering the output
of a CFG analysis, and attempting to use a traditional graph rendering library, like matplotlib, will result in an unusable
image.
One solution for viewing angr CFGs is found in axt’s angr-utils repository.

4.1.3 Shared Libraries
The CFG analysis does not distinguish between code from different binary objects. This means that by default, it will
try to analyze control flow through loaded shared libraries. This is almost never intended behavior, since this will
extend the analysis time to several days, probably. To load a binary without shared libraries, add the following keyword
argument to the Project constructor: load_options={'auto_load_libs': False}

4.1.4 Function Manager
The CFG result produces an object called the Function Manager, accessible through cfg.kb.functions. The mostcommon use case for this object is to access it like a dictionary. It maps addresses to Function objects, which can tell
you properties about a function.
>>> entry_func = cfg.kb.functions[p.entry]
Functions have several important properties!
• entry_func.block_addrs is a set of addresses at which basic blocks belonging to the function begin.
• entry_func.blocks is the set of basic blocks belonging to the function, that you can explore and disassemble
using capstone.
• entry_func.string_references() returns a list of all the constant strings that were referred to at any pointin the function. They are formatted as (addr, string) tuples, where addr is the address in the binary’s data
section the string lives, and string is a Python string that contains the value of the string.
• entry_func.returning is a boolean value signifying whether or not the function can return. False indicatesthat all paths do not return.
• entry_func.callable is an angr Callable object referring to this function. You can call it like a Python
function with Python arguments and get back an actual result (may be symbolic) as if you ran the function withthose arguments!
• entry_func.transition_graph is a NetworkX DiGraph describing control flow within the function itself. It
resembles the control-flow graphs IDA displays on a per-function level.
50

Chapter 4. Build-in Analysesangr• entry_func.name is the name of the function.
• entry_func.has_unresolved_calls and entry.has_unresolved_jumps have to do with detecting imprecision within the CFG. Sometimes, the analysis cannot detect what the possible target of an indirect call or
jump could be. If this occurs within a function, that function will have the appropriate has_unresolved_*
value set to True.
• entry_func.get_call_sites() returns a list of all the addresses of basic blocks which end in calls out toother functions.
• entry_func.get_call_target(callsite_addr) will, given callsite_addr from the list of call site addresses, return where that callsite will call out to.
• entry_func.get_call_return(callsite_addr) will, given callsite_addr from the list of call site addresses, return where that callsite should return to.
and many more !

4.1.5 CFGFast details
CFGFast performs a static control-flow and function recovery. Starting with the entry point (or any user-defined points)roughly the following procedure is performed:
1) The basic block is lifted to VEX IR, and all its exits (jumps, calls, returns, or continuation to the next block) arecollected2) For each exit, if this exit is a constant address, we add an edge to the CFG of the correct type, and add thedestination block to the set of blocks to be analyzed.
3) In the event of a function call, the destination block is also considered the start of a new function. If the targetfunction is known to return, the block after the call is also analyzed.
4) In the event of a return, the current function is marked as returning, and the appropriate edges in the callgraphand CFG are updated.
5) For all indirect jumps (block exits with a non-constant destination) Indirect Jump Resolution is performed.
Finding function starts
CFGFast supports multiple ways of deciding where a function starts and ends.
First the binary’s main entry point will be analyzed. For binaries with symbols (e.g., non-stripped ELF and PE binaries)
all function symbols will be used as possible starting points. For binaries without symbols, such as stripped binaries,
or binaries loaded using the blob loader backend, CFG will scan the binary for a set of function prologues defined forthe binary’s architecture. Finally, by default, the binary’s entire code section will be scanned for executable contents,
regardless of prologues or symbols.
In addition to these, as with CFGEmulated, function starts will also be considered when they are the target of a “call”
instruction on the given architecture.
All of these options can be disabled
FakeRets and function returns
When a function call is observed, we first assume that the callee function eventually returns, and treat the block after it
as part of the caller function. This inferred control-flow edge is known as a “FakeRet”. If, in analyzing the callee, wefind this not to be true, we update the CFG, removing this “FakeRet”, and updating the callgraph and function blocks
accordingly. As such, the CFG is recovered twice. In doing this, the set of blocks in each function, and whether thefunction returns, can be recovered and propagated directly.

4.1. Control-flow Graph Recovery (CFG)

51

angr

Indirect Jump Resolution
Options
These are the most useful options when working with CFGFast:
OptionDescription

force_complete_scan(Default: True) Treat the entire binary as code for the purposes of function detection. If you havea blob (e.g., mixed code and data) you want to turn this off.
funcA list of addresses, to use as entry points into the analysis.
tion_starts
normalize(Default: False) Normalize the resulting functions (e.g., each basic block belongs to at most one
function, back-edges point to the start of basic blocks)
re(Default: True) Perform additional analysis to attempt to find targets for every indirect jump foundsolve_indirect_jumps
during CFG creation.
more!
Examine the docstring on p.analyses.CFGFast for more up-to-date options

4.1.6 CFGEmulated details
Options
The most common options for CFGEmulated include:
OptionDescription

conThis sets the context sensitivity level of the analysis. See the context sensitivity level section
text_sensitivity_level below for more information. This is 1 by default.
starts
A list of addresses, to use as entry points into the analysis.
avoid_runs
A list of addresses to ignore in the analysis.
call_depth
Limit the depth of the analysis to some number calls. This is useful for checking whichfunctions a specific function can directly jump to (by setting call_depth to 1).
initial_state
An initial state can be provided to the CFG, which it will use throughout its analysis.
keep_state
To save memory, the state at each basic block is discarded by default. If keep_state is True,
the state is saved in the CFGNode.
enWhether to enable an intensive technique for resolving indirect jumps
able_symbolic_back_traversal
enWhether to enable another intensive technique for resolving direct jumps
able_advanced_backward_slicing
more!
Examine the docstring on p.analyses.CFGEmulated for more up-to-date options
Context Sensitivity Levelangr constructs a CFG by executing every basic block and seeing where it goes. This introduces some challenges: abasic block can act differently in different contexts. For example, if a block ends in a function return, the target of that
return will be different, depending on different callers of the function containing that basic block.
The context sensitivity level is, conceptually, the number of such callers to keep on the callstack. To explain thisconcept, let’s look at the following code:
void error(char *error){puts(error);}(continues on next page)

52

Chapter 4. Build-in Analysesangr(continued from previous page)

void alpha(){puts("alpha");error("alpha!");}void beta(){puts("beta");error("beta!");}void main(){alpha();
beta();}
The above sample has four call chains: main>alpha>puts, main>alpha>error>puts and main>beta>puts, andmain>beta>error>puts. While, in this case, angr can probably execute both call chains, this becomes unfeasible forlarger binaries. Thus, angr executes the blocks with states limited by the context sensitivity level. That is, each function
is re-analyzed for each unique context that it is called in.
For example, the puts() function above will be analyzed with the following contexts, given different context sensitivity
levels:Level Meaning

Contexts

0
1
2

puts
alpha>puts beta>puts error>puts
alpha>error>puts main>alpha>puts beta>error>puts main>beta>puts

3

Callee-only
One caller, plus callee
Two callers, plus
calleeThree callers, plus
calleemain>alpha>error>puts
main>beta>puts

main>alpha>puts

main>beta>error>puts

The upside of increasing the context sensitivity level is that more information can be gleaned from the CFG. For
example, with context sensitivity of 1, the CFG will show that, when called from alpha, puts returns to alpha, whencalled from error, puts returns to error, and so forth. With context sensitivity of 0, the CFG simply shows thatputs returns to alpha, beta, and error. This, specifically, is the context sensitivity level used in IDA. The downsideof increasing the context sensitivity level is that it exponentially increases the analysis time.

4.2 Backward Slicing
A program slice is a subset of statements that is obtained from the original program, usually by removing zero or morestatements. Slicing is often helpful in debugging and program understanding. For instance, it’s usually easier to locate
the source of a variable on a program slice.
A backward slice is constructed from a target in the program, and all data flows in this slice end at the target.
angr has a built-in analysis, called BackwardSlice, to construct a backward program slice. This section will act as a
how-to for angr’s BackwardSlice analysis, and followed by some in-depth discussion over the implementation choices
and limitations.

4.2. Backward Slicing

53

angr

4.2.1 First Step FirstTo build a BackwardSlice, you will need the following information as input.
• Required CFG. A control flow graph (CFG) of the program. This CFG must be an accurate CFG (CFGEmulated).
• Required Target, which is the final destination that your backward slice terminates at.
• Optional CDG. A control dependence graph (CDG) derived from the CFG. angr has a built-in analysis CDG forthat purpose.
• Optional DDG. A data dependence graph (DDG) built on top of the CFG. angr has a built-in analysis DDG forthat purpose.
A BackwardSlice can be constructed with the following code:>>> import angr
# Load the project>>> b = angr.Project("examples/fauxware/fauxware", load_options={"auto_load_libs": False}˓→)# Generate a CFG first. In order to generate data dependence graph afterwards, you'll␣
˓→have to:# - keep all input states by specifying keep_state=True.
# - store memory, register and temporary values accesses by adding the angr.options.refs␣˓→option set.
# Feel free to provide more parameters (for example, context_sensitivity_level) for CFG# recovery based on your needs.
>>> cfg = b.analyses.CFGEmulated(keep_state=True,...
state_add_options=angr.sim_options.refs,...
context_sensitivity_level=2)# Generate the control dependence graph>>> cdg = b.analyses.CDG(cfg)# Build the data dependence graph. It might take a while. Be patient!
>>> ddg = b.analyses.DDG(cfg)# See where we wanna go... let's go to the exit() call, which is modeled as a
# SimProcedure.
>>> target_func = cfg.kb.functions.function(name="exit")# We need the CFGNode instance>>> target_node = cfg.get_any_node(target_func.addr)# Let's get a BackwardSlice out of them!
# ``targets`` is a list of objects, where each one is either a CodeLocation# object, or a tuple of CFGNode instance and a statement ID. Setting statement# ID to -1 means the very beginning of that CFGNode. A SimProcedure does not# have any statement, so you should always specify -1 for it.
>>> bs = b.analyses.BackwardSlice(cfg, cdg=cdg, ddg=ddg, targets=[ (target_node, -1) ])# Here is our awesome program slice!
>>> print(bs)Sometimes it’s difficult to get a data dependence graph, or you may simply want build a program slice on top of a CFG.
That’s basically why DDG is an optional parameter. You can build a BackwardSlice solely based on CFG by doing:

54

Chapter 4. Build-in Analysesangr>>> bs = b.analyses.BackwardSlice(cfg, control_flow_slice=True)
BackwardSlice (to [(<CFGNode exit (0x10000a0) [0]>, -1)])

4.2.2 Using The BackwardSlice Object
Before you go ahead and use BackwardSlice object, you should notice that the design of this class is fairly arbitraryright now, and it is still subject to change in the near future. We’ll try our best to keep this documentation up-to-date.
Members
After construction, a BackwardSlice has the following members which describe a program slice:
MemberMode

runs_in_slice CFGonly
cfg_nodes_in_slice
CFGonly
choWithsen_statements DDG
choWithsen_exits
DDG

Meaning
A networkx.DiGraph instance showing addresses of blocks and SimProcedures in the
program slice, as well as transitions between them
A networkx.DiGraph instance showing CFGNodes in the program slice and transitions
in between
A dict mapping basic block addresses to lists of statement IDs that are part of the programslice
A dict mapping basic block addresses to a list of “exits”. Each exit in the list is a validtransition in the program slice

Each “exit” in chosen_exit is a tuple including a statement ID and a list of target addresses. For example, an “exit”
might look like the following:(35, [ 0x400020 ])If the “exit” is the default exit of a basic block, it’ll look like the following:("default", [ 0x400085 ])Export an Annotated Control Flow Graph
User-friendly Representation
Take a look at BackwardSlice.dbg_repr()!

4.2.3 Implementation Choices
4.2.4 Limitations
CompletenessSoundness

4.3 Identifier
The identifier uses test cases to identify common library functions in CGC binaries. It prefilters by finding some basic
information about stack variables/arguments. The information of about stack variables can be generally useful in otherprojects.

4.3. Identifier

55

angr

>>> import angr
# get all the matches>>> p = angr.Project("../binaries/tests/i386/identifiable")# note analysis is executed via the Identifier call>>> idfer = p.analyses.Identifier()>>> for funcInfo in idfer.func_info:...
print(hex(funcInfo.addr), funcInfo.name)
0x8048e60 memcmp
0x8048ef0 memcpy
0x8048f60 memmove
0x8049030 memset
0x8049320 fdprintf
0x8049a70 sprintf
0x8049f40 strcasecmp
0x804a0f0 strcmp
0x804a190 strcpy
0x804a260 strlen
0x804a3d0 strncmp
0x804a620 strtol
0x804aa00 strtol
0x80485b0 free
0x804aab0 free
0x804aad0 free
0x8048660 malloc
0x80485b0 free

56

Chapter 4. Build-in Analysesangr4.3. Identifier

57

angr

4.4 angr Decompiler
4.4.1 Analysis Passes
Name

Description

Sub-analysis

CFG recovery
Indirect branch resolving
Removing alignment blocks
Calling convention recovery
Stackpointeranalysis
IR Lifting

Recover the control flow graph.
Resolve the targets of indirect branches.

Indirect branch resolving
Jump table resolving

AIL graph building
Rewriting singletarget
indirectbranches
Makingreturnstatements
Simplifying AIL
blocksReaching definition analysis
Constant folding
Copy propagation
Dead assignment
elimination
Peephole
optimizations
Simplifying AIL
function
Assignment expression folding
Unifying
local
variables
Call expression
folding
Call site building
Variable recovery
Variable type inference
Simplification
passesRegion identification
Structure analysis
Code generation
58

Determine values of stack pointer at each
instruction.
Lift the original representation to AIL,
block by block.
Replace single-target indirect brancheswith direct branches.
Convert Ijk_Ret jump kinds into AIL Return statements.
Simplify each AIL block.

Simplify the entire AIL function.
Eliminate variables that are assigned toonce and used once.
Find local variables that are always equivalent and eliminate redundant copies.
Fold call expressions into the variable
where its return value is stored.
Apply calling conventions to each call site
and rewrite call statements to ones with arguments
Identify local and global variables.
Collect type constraints and infer variabletypes.

Constant folding, copy propagation, dead assignment elimination, peephole optimizations

Assignment expression folding, unifying local
variables, call expression folding, reaching definition analysis
Copy propagation
Copy propagation
Copy propagation
Reaching definition analysis

Identify single-entry, single-exit regions.
Structure each identified region to createhigh-level control flow structures.
Chapter 4. Build-in Analyses

CHAPTERFIVEADVANCED TOPICS

5.1 Gotchas when using angrThis section contains a list of gotchas that users/victims of angr frequently run into.

5.1.1 SimProcedure inaccuracy
To make symbolic execution more tractable, angr replaces common library functions with summaries written in Python.
We call these summaries SimProcedures. SimProcedures allow us to mitigate path explosion that would otherwise be
introduced by, for example, strlen running on a symbolic string.
Unfortunately, our SimProcedures are far from perfect. If angr is displaying unexpected behavior, it might be caused
by a buggy/incomplete SimProcedure. There are several things that you can do:
1. Disable the SimProcedure (you can exclude specific SimProcedures by passing options to the angr.Projectclass. This has the drawback of likely leading to a path explosion, unless you are very careful about constraining
the input to the function in question. The path explosion can be partially mitigated with other angr capabilities(such as Veritesting).
2. Replace the SimProcedure with something written directly to the situation in question. For example, our scanf
implementation is not complete, but if you just need to support a single, known format string, you can write ahook to do exactly that.
3. Fix the SimProcedure.

5.1.2 Unsupported syscalls
System calls are also implemented as SimProcedures. Unfortunately, there are system calls that we have not yet implemented in angr. There are several workarounds for an unsupported system call:
1. Implement the system call.
v Tododocument this process
2. Hook the callsite of the system call (using project.hook) to make the required modifications to the state in an
ad-hoc way.
3. Use the state.posix.queued_syscall_returns list to queue syscall return values. If a return value isqueued, the system call will not be executed, and the value will be used instead. Furthermore, a function can bequeued instead as the “return value”, which will result in that function being applied to the state when the systemcall is triggered.

59

angr

5.1.3 Symbolic memory model
The default memory model used by angr is inspired by Mayhem. This memory model supports limited symbolic reads
and writes. If the memory index of a read is symbolic and the range of possible values of this index is too wide, theindex is concretized to a single value. If the memory index of a write is symbolic at all, the index is concretized to asingle value. This is configurable by changing the memory concretization strategies of state.memory.

5.1.4 Symbolic lengths
SimProcedures, and especially system calls such as read() and write() might run into a situation where the lengthof a buffer is symbolic. In general, this is handled very poorly: in many cases, this length will end up being concretizedoutright or retroactively concretized in later steps of execution. Even in cases when it is not, the source or destination
file might end up looking a bit “weird”.

5.1.5 Division by ZeroZ3 has some issues with divisions by zero. For example:>>> z = z3.Solver()>>> a = z3.BitVec('a', 32)>>> b = z3.BitVec('b', 32)>>> c = z3.BitVec('c', 32)>>> z.add(a/b == c)>>> z.add(b == 0)>>> z.check()>>> print(z.model().eval(b), z.model().eval(a/b))
0 4294967295
This makes it very difficult to handle certain situations in Claripy. We post-process the VEX IR itself to explicitly
check for zero-divisions and create IRSB side-exits corresponding to the exceptional case, but SimProcedures andcustom analysis code may let occurrences of zero divisions split through, which will then cause weird issues in youranalysis. Be safe — when dividing, add a constraint against the denominator being zero.

5.2 Understanding the Execution Pipeline
If you’ve made it this far you know that at its core, angr is a highly flexible and intensely instrumentable emulator.
In order to get the most mileage out of it, you’ll want to know what happens at every step of the way when you say
simgr.run().
This is intended to be a more advanced document; you’ll need to understand the function and intent of
SimulationManager, ExplorationTechnique, SimState, and SimEngine in order to understand what we’re talking about at times! You may want to have the angr source open to follow along with this.
At every step along the way, each function will take **kwargs and pass them along to the next function in the hierarchy,
so you can pass parameters to any point in the hierarchy and they will trickle down to everything below.

5.2.1 Simulation Managers
So you’ve set your analysis in motion. Time to begin our journey.
run()
SimulationManager.run() takes several optional parameters, all of which control when to break out of the stepping
loop. Notably, n, and until. n is used immediately - the run function loops, calling the step() function and passing
on all its parameters until either n steps have happened or some other termination condition has occurred. If n is notprovided, it defaults to 1, unless an until function is provided, in which case there will be no numerical cap on the
60

Chapter 5. Advanced Topics

angrloop. Additionally, the stash that is being used is taken into consideration, as if it becomes empty execution mustterminate.
So, in summary, when you call run(), step() will be called in a loop until any of the following:
1. The n number of steps have elapsed
2. The until function returns true
3. The exploration techniques complete() hooks (combined via the SimulationManager.completion_mode
parameter/attribute - it is by default the any builtin function but can be changed to all for example) indicate thatthe analysis is complete
4. The stash being executed becomes empty
An aside: explore()
SimulationManager.explore() is a very thin wrapper around run() which adds the Explorer exploration technique, since performing one-off explorations is a very common action. Its code in its entirety is below:
num_find += len(self._stashes[find_stash]) if find_stash in self._stashes else 0tech = self.use_technique(Explorer(find, avoid, find_stash, avoid_stash, cfg, num_find))try:
self.run(stash=stash, n=n, **kwargs)
finally:
self.remove_technique(tech)
return self
Exploration technique hooking
From here down, every function in the simulation manager can be instrumented by an exploration technique. The
exact mechanism through which this works is that when you call SimulationManager.use_technique(), angrmonkeypatches the simulation manager to replace any function implemented in the exploration technique’s body witha function which will first call the exploration technique’s function, and then on the second call will call the originalfunction. This is somewhat messy to implement and certainly not thread safe by any means, but does produce a clean
and powerful interface for exploration techniques to instrument stepping behavior, either before or after the originalfunction is called, even choosing whether or not to call the original function whatsoever. Additionally, it allows multiple exploration techniques to hook the same function, as the monkeypatched function simply becomes the “original”
function for the next-applied hook.
step()
There is a lot of complicated logic in step() to handle degenerate cases - mostly implementing the population of
the deadended stash, the save_unsat option, and calling the filter() exploration technique hooks. Beyond this,though, most of the logic is looping through the stash specified by the stash argument and calling step_state()on each state, then applying the dict result of step_state() to the stash list. Finally, if the step_func parameter isprovided, it is called with the simulation manager as a parameter before the step ends.
step_state()
The default step_state(), which can be overridden or instrumented by exploration techniques, is also simple - itcalls successors(), which returns a SimSuccessors object, and then translates it into a dict mapping stash names to
new states which should be added to that stash. It also implements error handling - if successors() throws an error,
it will be caught and an ErrorRecord will be inserted into SimulationManager.errored.

5.2. Understanding the Execution Pipeline

61

angr

successors()
We’ve almost made it out of SimulationManager. successors(), which can also be instrumented by exploration
techniques, is supposed to take a state and step it forward, returning a SimSuccessors object categorizing its successors
independently of any stash logic. If the successor_func parameter was provided, it is used and its return value isreturned directly. If this parameter was not provided, we use the project.factory.successors method to tick thestate forward and get our SimSuccessors.

5.2.2 The Engine
When we get to the actual successors generation, we need to figure out how to actually perform the execution. Hopefully, the angr documentation has been organized in a way such that by the time you reach this page, you know that a
SimEngine is a device that knows how to take a state and produce its successors. There is only one “default engine”
per project, but you can provide the engine parameter to specify which engine will be used to perform the step.
Keep in mind that this parameter can be provided way at the top, to .step(), .explore(), .run() or anything elsethat starts execution, and they will be filtered down to this level. Any additional parameters will continue being passed
down, until they reach the part of the engine they are intended for. The engine will discard any parameters it doesn’t
understand.
Generally, the main entry point of an engine is SimEngine.process(), which can return whatever result it likes, but
for simulation managers, engines are required to use SuccessorsMixin, which provides a process() method, which
creates a SimSuccessors object and then calls process_successors() so that other mixins can fill it out.
angr’s default engine, the UberEngine, contains several mixins which provide the process_successors() method:• SimEngineFailure - handles stepping states with degenerate jumpkinds• SimEngineSyscall - handles stepping states which have performed a syscall and need it executed• HooksMixin - handles stepping states which have reached a hooked address and need the hook executed• SimEngineUnicorn - executes machine code via the unicorn engine• SootMixin - executes java bytecode via the SOOT IR• HeavyVEXMixin - executes machine code via the VEX IR
Each of these mixins is implemented to fill out the SimSuccessors object if they can handle the current state, otherwise
they call super() to pass the job on to the next class in the stack.

5.2.3 Engine mixins
SimEngineFailure handles error cases. It is only used when the previous jumpkind is one of Ijk_EmFail,Ijk_MapFail, Ijk_Sig*, Ijk_NoDecode (but only if the address is not hooked), or Ijk_Exit. In the first fourcases, its action is to raise an exception. In the last case, its action is to simply produce no successors.
SimEngineSyscall services syscalls. It is used when the previous jumpkind is anything of the form Ijk_Sys*. It
works by making a call into SimOS to retrieve the SimProcedure that should be run to respond to this syscall, and thenrunning it! Pretty simple.
HooksMixin provides the hooking functionality in angr. It is used when a state is at an address that is hooked, and theprevious jumpkind is not Ijk_NoHook. It simply looks up the associated SimProcedure and runs it on the state! It also
takes the parameter procedure, which will cause the given procedure to be run for the current step even if the address
is not hooked.
SimEngineUnicorn performs concrete execution with the Unicorn Engine. It is used when the state option o.UNICORN
is enabled, and a myriad of other conditions designed for maximum efficiency (described below) are met.
SootMixin performs execution over the SOOT IR. Not very important unless you are analyzing java bytecode, in whichcase it is very important.

62

Chapter 5. Advanced Topics

angrSimEngineVEX is the big fellow. It is used whenever any of the previous can’t be used. It attempts to lift bytes fromthe current address into an IRSB, and then executes that IRSB symbolically. There are a huge number of parametersthat can control this process, so it is best to reference the API doc for angr.engines.vex.engine.SimEngineVEX.
process() describing them.
The exact process by which SimEngineVEX digs into an IRSB is a little complicated, but essentially it runs all theblock’s statements in order. This code is worth reading if you want to see the true inner core of angr’s symbolic
execution.

5.2.4 When using Unicorn Engine
If you add the o.UNICORN state option, at every step SimEngineUnicorn will be invoked, and try to see if it is allowed
to use Unicorn to execute concretely.
What you REALLY want to do is to add the predefined set o.unicorn (lowercase) of options to your state:
unicorn = { UNICORN, UNICORN_SYM_REGS_SUPPORT, INITIALIZE_ZERO_REGISTERS, UNICORN_HANDLE_
˓→TRANSMIT_SYSCALL }These will enable some additional functionalities and defaults which will greatly enhance your experience. Additionally, there are a lot of options you can tune on the state.unicorn plugin.
A good way to understand how unicorn works is by examining the logging output (logging.getLogger('angr.
engines.unicorn_engine').setLevel('DEBUG'); logging.getLogger('angr.state_plugins.
unicorn_engine').setLevel('DEBUG') from a sample run of unicorn.
INFO| 2017-02-25 08:19:48,012 | angr.state_plugins.unicorn | started emulation at␣
˓→0x4012f9 (1000000 steps)
Here, angr diverts to unicorn engine, beginning with the basic block at 0x4012f9. The maximum step count is set to1000000, so if execution stays in Unicorn for 1000000 blocks, it’ll automatically pop out. This is to avoid hanging in
an infinite loop. The block count is configurable via the state.unicorn.max_steps variable.
INFO| 2017-02-25 08:19:48,014 | angr.state_plugins.unicorn | mmap [0x401000,␣˓→0x401fff], 5 (symbolic)
INFO| 2017-02-25 08:19:48,016 | angr.state_plugins.unicorn | mmap [0x7fffffffffe0000,
˓→ 0x7fffffffffeffff], 3 (symbolic)
INFO| 2017-02-25 08:19:48,019 | angr.state_plugins.unicorn | mmap [0x6010000,␣˓→0x601ffff], 3
INFO| 2017-02-25 08:19:48,022 | angr.state_plugins.unicorn | mmap [0x602000,␣˓→0x602fff], 3 (symbolic)
INFO| 2017-02-25 08:19:48,023 | angr.state_plugins.unicorn | mmap [0x400000,␣˓→0x400fff], 5
INFO| 2017-02-25 08:19:48,025 | angr.state_plugins.unicorn | mmap [0x7000000,␣
˓→0x7000fff], 5angr performs lazy mapping of data that is accessed by unicorn engine, as it is accessed. 0x401000 is the page of
instructions that it is executing, 0x7fffffffffe0000 is the stack, and so on. Some of these pages are symbolic, meaningthat they contain at least some data that, when accessed, will cause execution to abort out of Unicorn.
INFO| 2017-02-25 08:19:48,037 | angr.state_plugins.unicorn | finished emulation at␣
˓→0x7000080 after 3 steps: STOP_STOPPOINT
Execution stays in Unicorn for 3 basic blocks (a computational waste, considering the required setup), after which itreaches a simprocedure location and jumps out to execute the simproc in angr.

5.2. Understanding the Execution Pipeline

63

angr

INFO
| 2017-02-25 08:19:48,076 | angr.state_plugins.unicorn | started emulation at␣
˓→0x40175d (1000000 steps)
INFO| 2017-02-25 08:19:48,077 | angr.state_plugins.unicorn | mmap [0x401000,␣˓→0x401fff], 5 (symbolic)
INFO| 2017-02-25 08:19:48,079 | angr.state_plugins.unicorn | mmap [0x7fffffffffe0000,
˓→ 0x7fffffffffeffff], 3 (symbolic)
INFO| 2017-02-25 08:19:48,081 | angr.state_plugins.unicorn | mmap [0x6010000,␣˓→0x601ffff], 3
After the simprocedure, execution jumps back into Unicorn.
WARNING | 2017-02-25 08:19:48,082 | angr.state_plugins.unicorn | fetching empty page␣
˓→[0x0, 0xfff]
INFO| 2017-02-25 08:19:48,103 | angr.state_plugins.unicorn | finished emulation at␣
˓→0x401777 after 1 steps: STOP_EXECNONE
Execution bounces out of Unicorn almost right away because the binary accessed the zero-page.
INFO| 2017-02-25 08:19:48,120 | angr.engines.unicorn_engine | not enough runs since␣˓→last unicorn (100)
INFO| 2017-02-25 08:19:48,125 | angr.engines.unicorn_engine | not enough runs since␣˓→last unicorn (99)
To avoid thrashing in and out of Unicorn (which is expensive), we have cooldowns (attributes of the state.unicorn
plugin) that wait for certain conditions to hold (i.e., no symbolic memory accesses for X blocks) before jumping backinto unicorn when a unicorn run is aborted due to anything but a simprocedure or syscall. Here, the condition it’s
waiting for is for 100 blocks to be executed before jumping back in.

5.3 What’s Up With Mixins, Anyway?
If you are trying to work more intently with the deeper parts of angr, you will need to understand one of the design
patterns we use frequently: the mixin pattern.
In brief, the mixin pattern is where Python’s subclassing features is used not to implement IS-A relationships (a Child isa kind of Person) but instead to implement pieces of functionality for a type in different classes to make more modular
and maintainable code. Here’s an example of the mixin pattern in action:
class Base:def add_one(self, v):
return v + 1
class StringsMixin(Base):def add_one(self, v):
coerce = type(v) is str
if coerce:v = int(v)result = super().add_one(v)if coerce:
result = str(result)
return resultclass ArraysMixin(Base):def add_one(self, v):(continues on next page)

64

Chapter 5. Advanced Topics

angr(continued from previous page)

if type(v) is list:
return [super().add_one(v_x) for v_x in v]
else:
return super().add_one(v)class FinalClass(ArraysMixin, StringsMixin, Base):pass
With this construction, we are able to define a very simple interface in the Base class, and by “mixing in” two mixins,
we can create the FinalClass which has the same interface but with additional features. This is accomplished throughPython’s powerful multiple inheritance model, which handles method dispatch by creating a method resolution order,or MRO, which is unsurprisingly a list which determines the order in which methods are called as execution proceeds
through super() calls. You can view a class’ MRO as such:
FinalClass.__mro__(FinalClass, ArraysMixin, StringsMixin, Base, object)This means that when we take an instance of FinalClass and call add_one(), Python first checks to see if
FinalClass defines an add_one, and then ArraysMixin, and so on and so forth. Furthermore, when ArraysMixin
calls super().add_one(), Python will skip past ArraysMixin in the MRO, first checking if StringsMixin defines
an add_one, and so forth.
Because multiple inheritance can create strange dependency graphs in the subclass relationship, there are rules forgenerating the MRO and for determining if a given mix of mixins is even allowed. This is important to understandwhen building complex classes with many mixins which have dependencies on each other. In short: left-to-right,
depth-first, but deferring any base classes which are shared by multiple subclasses (the merge point of a diamondpattern in the inheritance graph) until the last point where they would be encountered in this depth-first search. For
example, if you have classes A, B(A), C(B), D(A), E(C, D), then the method resolution order will be E, C, B, D, A. If
there is any case in which the MRO would be ambiguous, the class construction is illegal and will throw an exception
at import time.
This is complicated! If you find yourself confused, the canonical document explaining the rationale, history, andmechanics of Python’s multiple inheritance can be found here.

5.3.1 Mixins in Claripy Solvers
v TodoWrite this section

5.3.2 Mixins in angr Engines
The main entry point to a SimEngine is process(), but how do we determine what that does?
The mixin model is used in SimEngine and friends in order to allow pieces of functionality to be reused between staticand symbolic analyses. The default engine, UberEngine, is defined as follows:class UberEngine(SimEngineFailure,
SimEngineSyscall,
HooksMixin,
SimEngineUnicorn,
SuperFastpathMixin,(continues on next page)

5.3. What’s Up With Mixins, Anyway?

65

angr

(continued from previous page)

TrackActionsMixin,
SimInspectMixin,
HeavyResilienceMixin,
SootMixin,
HeavyVEXMixin):
pass
Each of these mixins provides either execution through a different medium or some additional instrumentation feature. Though they are not listed here explicitly, there are some base classes implicit to this hierarchy which set up theway this class is traversed. Most of these mixins inherit from SuccessorsMixin, which is what provides the basic
process() implementation. This function sets up the SimSuccessors for the rest of the mixins to fill in, and thencalls process_successors(), which each of the mixins which provide some mode of execution implement. If themixin can handle the step, it does so and returns, otherwise it calls super().process_successors(). In this way,
the MRO for the engine class determines what the order of precedence for the engine’s pieces is.
HeavyVEXMixin and friends
Let’s take a closer look at the last mixin, HeavyVEXMixin. If you look at the module hierarchy of the angr engines
submodule, you will see that the vex submodule has a lot of pieces in it which are organized by how tightly tied toparticular state types or data types they are. The heavy VEX mixin is one version of the culmination of all of these.
Let’s look at its definition:
class HeavyVEXMixin(SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEXMixin,␣
˓→VEXLifter):...
# a WHOLE lot of implementation
So, the heavy VEX mixin is meant to provide fully instrumented symbolic execution on a SimState. What does thisentail? The mixins tell the tale.
First, the plain VEXMixin. This mixin is designed to provide the barest-bones framework for processing a VEX block.
Take a look at its source code. Its main purpose is to perform the preliminary digestion of the VEX IRSB and dispatchprocessing of it to methods which are provided by mixins - look at the methods which are either pass or return
NotImplemented. Notice that absolutely none of its code makes any assumption whatsoever of what the type ofstate is or even what the type of the data words inside state are. This job is delegated to other mixins, making the
VEXMixin an appropriate base class for literally any analysis on VEX blocks.
The next-most interesting mixin is the ClaripyDataMixin, whose source code is here. This mixin actually integrates
the fact that we are executing over the domain of Claripy ASTs. It does this by implementing some of the methods
which are unimplemented in the VEXMixin, most importantly the ITE expression, all the operations, and the clean
helpers.
In terms of what it looks like to actually touch the SimState, the SimStateStorageMixin provides the glue between
the VEXMixin’s interface for memory writes et al and SimState’s interface for memory writes and such. It is unremarkable, except for a small interaction between it and the ClaripyDataMixin. The Claripy mixin also overrides
the memory/register read/write functions, for the purpose of converting between the bitvector and floating-point types,
since the vex interface expects to be able to load and store floats, but the SimState interface wants to load and store
only bitvectors. Because of this, the claripy mixin must come before the storage mixin in the MRO. This is very muchan interaction like the one in the add_one example at the start of this page - one mixin serves as a data filtering layer
for another mixin.

66

Chapter 5. Advanced Topics

angrInstrumenting the data layer
Let’s turn our attention to a mixin which is not included in the HeavyVEXMixin but rather mixed into the UberEngine
formula explicitly: the TrackActionsMixin. This mixin implements “SimActions”, which is angr parlance for
dataflow tracking. Again, look at the source code. The way it does this is that it wraps and unwraps the data layer topass around additional information about data flows. Look at how it instruments RdTmp, for instance. It immediately
super()-calls to the next method in the MRO, but instead of returning that data it returns a tuple of the data and its
dependencies, which depending on whether you want temporary variables to be atoms in the dataflow model, will either
be just the tmp which was read or the dependencies of the value written to that tmp.
This pattern continues for every single method that this mixin touches - any expression it receives must be unpacked
into the expression and its dependencies, and any result must be packaged with its dependencies before it is returned.
This works because the mixin above it makes no assumptions about what data it is passing around, and the mixin
below it never gets to see any dependencies whatsoever. In fact, there could be multiple mixins performing this kindof wrap-unwrap trick and they could all coexist peacefully!
Note that a mixin which instruments the data layer in this way is obligated to override every single method which takes
or returns an expression value, even if it doesn’t perform any operation on the expression other than doing the wrappingand unwrapping. To understand why, imagine that the mixin does not override the handle_vex_const expression,
so immediate value loads are not annotated with dependencies. The expression value which will be returned from themixin which does provide handle_vex_const will not be a tuple of (expression, deps), it will just be the expression.
Imagine this execution is taking place in the context of a WrTmp(t0, Const(0)). The const expression will be passed
down to the WrTmp handler along with the identifier of the tmp to write to. However, since handle_vex_stmt_WrTmp
will be overridden by our mixin which touches the data layer, it expects to be passed the tuple including the deps, andso it will crash when trying to unpack the not-a-tuple value.
In this way, you can sort of imagine that a mixin which instruments the data layer in this way is actually creating acontract within Python’s nonexistent typesystem - you are guaranteed to receive back any types you return, but you
must pass down any types you receive as return values from below.

5.3.3 Mixins in the memory modelv Todowrite this section

5.4 Optimization considerations
The performance of angr as an analysis tool or emulator is greatly handicapped by the fact that lots of it is written in
Python. Regardless, there are a lot of optimizations and tweaks you can use to make angr faster and lighter.

5.4.1 General speed tips
• Use pypy. Pypy is an alternate Python interpreter that performs optimized jitting of Python code. In our tests,
it’s a 10x speedup out of the box.
• Only use the SimEngine mixins that you need. SimEngine uses a mixin model which allows you to add and remove
features by constructing new classes. The default engine mixes in every possible features, and the consequenceof that is that it is slower than it needs to be. Look at the definition for UberEngine (the default SimEngine),
copy its declaration, and remove all the base classes which provide features you don’t need.
• Don’t load shared libraries unless you need them. The default setting in angr is to try at all costs to find sharedlibraries that are compatible with the binary you’ve loaded, including loading them straight out of your OS
libraries. This can complicate things in a lot of scenarios. If you’re performing an analysis that’s anything more
abstract than bare-bones symbolic execution, ESPECIALLY control-flow graph construction, you might want

5.4. Optimization considerations

67

angr

to make the tradeoff of sacrificing accuracy for tractability. angr does a reasonable job of making sane things
happen when library calls to functions that don’t exist try to happen.
• Use hooking and SimProcedures. If you’re enabling shared libraries, then you definitely want to have SimProcedures written for any complicated library function you’re jumping into. If there’s no autonomy requirement forthis project, you can often isolate individual problem spots where analysis hangs up and summarize them with ahook.
• Use SimInspect. SimInspect is the most underused and one of the most powerful features of angr. You can hookand modify almost any behavior of angr, including memory index resolution (which is often the slowest part ofany angr analysis).
• Write a concretization strategy. A more powerful solution to the problem of memory index resolution is aconcretization strategy.
• Use the Replacement Solver. You can enable it with the angr.options.REPLACEMENT_SOLVER state option.
The replacement solver allows you to specify AST replacements that are applied at solve-time. If you add replacements so that all symbolic data is replaced with concrete data when it comes time to do the solve, the runtime
is greatly reduced. The API for adding a replacement is state.se._solver.add_replacement(old, new).
The replacement solver is a bit finicky, so there are some gotchas, but it’ll definitely help.

5.4.2 If you’re performing lots of concrete or partially-concrete execution• Use the unicorn engine. If you have unicorn engine installed, angr can be built to take advantage of it for concrete
emulation. To enable it, add the options in the set angr.options.unicorn to your state. Keep in mind thatwhile most items under angr.options are individual options, angr.options.unicorn is a bundle of options,and is thus a set. NOTE: At time of writing the official version of unicorn engine will not work with angr - wehave a lot of patches to it to make it work well with angr. They’re all pending pull requests at this time, so sit
tight. If you’re really impatient, ping us about uploading our fork!
• Enable fast memory and fast registers. The state options angr.options.FAST_MEMORY and angr.options.
FAST_REGISTERS will do this. These will switch the memory/registers over to a less intensive memory modelthat sacrifices accuracy for speed. TODO: document the specific sacrifices. Should be safe for mostly concrete
access though. NOTE: not compatible with concretization strategies.
• Concretize your input ahead of time. This is the approach taken by driller. When creating a state withentry_state or the like, you can create a SimFile filled with symbolic data, pass it to the initialization function
as an argument entry_state(..., stdin=my_simfile), and then constrain the symbolic data in the SimFile
to what you want the input to be. If you don’t require any tracking of the data coming from stdin, you can forego
the symbolic part and just fill it with concrete data. If there are other sources of input besides standard input, dothe same for those.
• Use the afterburner. While using unicorn, if you add the UNICORN_THRESHOLD_CONCRETIZATION state option,
angr will accept thresholds after which it causes symbolic values to be concretized so that execution can spend
more time in Unicorn. Specifically, the following thresholds exist:– state.unicorn.concretization_threshold_memory - this is the number of times a symbolic variable, stored in memory, is allowed to kick execution out of Unicorn before it is forcefully concretized andforced into Unicorn anyways.
– state.unicorn.concretization_threshold_registers - this is the number of times a symbolic
variable, stored in a register, is allowed to kick execution out of Unicorn before it is forcefully concretized
and forced into Unicorn anyways.
– state.unicorn.concretization_threshold_instruction - this is the number of times that any
given instruction can force execution out of Unicorn (by running into symbolic data) before any symbolic
data encountered at that instruction is concretized to force execution into Unicorn.
You can get further control of what is and isn’t concretized with the following sets:

68

Chapter 5. Advanced Topics

angr– state.unicorn.always_concretize - a set of variable names that will always be concretized to force
execution into unicorn (in fact, the memory and register thresholds just end up causing variables to be added
to this list).
– state.unicorn.never_concretize - a set of variable names that will never be concretized and forced
into Unicorn under any condition.
– state.unicorn.concretize_at - a set of instruction addresses at which data should be concretized andforced into Unicorn. The instruction threshold causes addresses to be added to this set.
Once something is concretized with the afterburner, you will lose track of that variable. The state will still beconsistent, but you’ll lose dependencies, as the stuff that comes out of Unicorn is just concrete bits with nomemory of what variables they came from. Still, this might be worth it for the speed in some cases, if you knowwhat you want to (or do not want to) concretize.

5.4.3 Memory optimization
The golden rule for memory optimization is to make sure you’re not keeping any references to data you don’t care about
anymore, especially related to states which have been left behind. If you find yourself running out of memory during
analysis, the first thing you want to do is make sure you haven’t caused a state explosion, meaning that the analysis isaccumulating program states too quickly. If the state count is in control, then you can start looking for reference leaks.
A good tool to do this with is https://github.com/rhelmot/dumpsterdiver, which gives you an interactive prompt for
exploring the reference graph of a Python process.
One specific consideration that should be made when analyzing programs with very long paths is that the state history
is designed to accumulate data infinitely. This is less of a problem than it could be because the data is stored in a smart
tree structure and never copied, but it will accumulate infinitely. To downsize a state’s history and free all data related
to old steps, call state.history.trim().
One particularly problematic member of the history dataset is the basic block trace and the stack pointer trace. Whenusing unicorn engine, these lists of ints can become huge very very quickly. To disable unicorn’s capture of ip and sp
data, remove the state options UNICORN_TRACK_BBL_ADDRS and UNICORN_TRACK_STACK_POINTERS.

5.5 Working with File System, Sockets, and Pipes
It’s very important to be able to control the environment that emulated programs see, including how symbolic data is
introduced from the environment! angr has a robust series of abstractions to help you set up the environment you want.
The root of any interaction with the filesystem, sockets, pipes, or terminals is a SimFile object. A SimFile is a storage
abstraction that defines a sequence of bytes, symbolic or otherwise. There are several kinds of SimFiles which store
their data very differently - the two easiest examples are SimFile (the base class is actually called SimFileBase),
which stores files as a flat address-space of data, and SimPackets, which stores a sequence of variable-sized reads.
The former is best for modeling programs that need to perform seeks on their files, and is the default storage for opened
files, while the latter is best for modeling programs that depend on short-reads or use scanf, and is the default storage
for stdin/stdout/stderr.
Because SimFiles can have such diverse storage mechanisms, the interface for interacting with them is very abstracted.
You can read from the file from some position, you can write to the file at some position, you can ask how many bytes
are currently stored in the file, and you can concretize the file, generating a testcase for it. If you know specifically which
SimFile class you’re working with, you can take much more powerful control over it, and as a result you’re encouraged
to manually create any files you want to work with when you create your initial state.
Specifically, each SimFile class creates its own abstraction of a “position” within the file - each read and write takes
a position and returns a new position that you should use to continue from where you left off. If you’re working with
SimFiles of unknown type you have to treat this position as a totally opaque object with no semantics other than thecontract with the read/write functions.

5.5. Working with File System, Sockets, and Pipes

69

angr

However! This is a very poor match to how programs generally interact with files, so angr also has a SimFileDescriptor
abstraction, which provides the familiar read/write/seek/tell interfaces but will also return error conditions when theunderlying storage don’t support the appropriate operations - just like normal file descriptors!
You may access the mapping from file descriptor number to file descriptor object in state.posix.fd. See the API
document for angr.storage.file.SimFileDescriptorBase for more details.

5.5.1 Just tell me how to do what I want to do!
Okay okay!!
To create a SimFile, you should just create an instance of the class you want to use. Refer to angr.storage.file forthe full instructions.
Let’s go through a few illustrative examples, which cover how you can work with a concrete file, a symbolic file, a filewith mixed concrete and symbolic content, or streams.
Example 1: Create a file with concrete content>>> import angr>>> simfile = angr.SimFile('myconcretefile', content='hello world!\n')Here’s a nuance - you can’t use SimFiles without a state attached, because reasons. You’ll never have to do this in areal scenario (this operation happens automatically when you pass a SimFile into a constructor or the filesystem) but
let’s mock it up:>>> proj = angr.Project('/bin/true')>>> state = proj.factory.blank_state()>>> simfile.set_state(state)
To demonstrate the behavior of these files we’re going to use the fact that the default SimFile position is just the numberof bytes from the start of the file. SimFile.read returns a tuple (bitvector data, actual size, new pos):>>> data, actual_size, new_pos = simfile.read(0, 5)>>> import claripy>>> assert claripy.is_true(data == 'hello')>>> assert claripy.is_true(actual_size == 5)>>> assert claripy.is_true(new_pos == 5)Continue the read, trying to read way too much:>>> data, actual_size, new_pos = simfile.read(new_pos, 1000)
angr doesn’t try to sanitize the data returned, only the size - we returned 1000 bytes! The intent is that you’re only
allowed to use up to actual_size of them.
>>> assert len(data) == 1000*8 # bitvector sizes are in bits>>> assert claripy.is_true(actual_size == 8)>>> assert claripy.is_true(data.get_bytes(0, 8) == ' world!\n')>>> assert claripy.is_true(new_pos == 13)
Example 2: Create a file with symbolic content and a defined size>>> simfile = angr.SimFile('mysymbolicfile', size=0x20)>>> simfile.set_state(state)(continues on next page)

70

Chapter 5. Advanced Topics

angr(continued from previous page)>>> data, actual_size, new_pos = simfile.read(0, 0x30)>>> assert data.symbolic>>> assert claripy.is_true(actual_size == 0x20)
The basic SimFile provides the same interface as state.memory, so you can load data directly:>>> assert simfile.load(0, actual_size) is data.get_bytes(0, 0x20)
Example 3: Create a file with constrained symbolic content>>> bytes_list = [claripy.BVS('byte_%d' % i, 8) for i in range(32)]>>> bytes_ast = claripy.Concat(*bytes_list)>>> mystate = proj.factory.entry_state(stdin=angr.SimFile('/dev/stdin', content=bytes_
˓→ast))>>> for byte in bytes_list:...
mystate.solver.add(byte >= 0x20)...
mystate.solver.add(byte <= 0x7e)
Example 4: Create a file with some mixed concrete and symbolic content, but no EOF>>> variable = claripy.BVS('myvar', 10*8)>>> simfile = angr.SimFile('mymixedfile', content=variable.concat(claripy.BVV('\n')),␣
˓→has_end=False)>>> simfile.set_state(state)
We can always query the number of bytes stored in the file:>>> assert claripy.is_true(simfile.size == 11)
Reads will generate additional symbolic data past the current frontier:>>> data, actual_size, new_pos = simfile.read(0, 15)>>> assert claripy.is_true(actual_size == 15)>>> assert claripy.is_true(new_pos == 15)>>> assert claripy.is_true(data.get_bytes(0, 10) == variable)>>> assert claripy.is_true(data.get_bytes(10, 1) == '\n')>>> assert data.get_bytes(11, 4).symbolic
Example 5: Create a file with a symbolic size (has_end is implicitly true here)>>> symsize = claripy.BVS('mysize', 64)>>> state.solver.add(symsize >= 10)>>> state.solver.add(symsize < 20)>>> simfile = angr.SimFile('mysymsizefile', size=symsize)>>> simfile.set_state(state)
Reads will encode all possibilities:>>> data, actual_size, new_pos = simfile.read(0, 30)>>> assert set(state.solver.eval_upto(actual_size, 30)) == set(range(10, 20))

5.5. Working with File System, Sockets, and Pipes

71

angr

The maximum size can’t be easily resolved, so the data returned is 30 bytes long, and we’re supposed to use it conjunction with actual_size.
>>> assert len(data) == 30*8
Symbolic read sizes work too!
>>> symreadsize = claripy.BVS('myreadsize', 64)>>> state.solver.add(symreadsize >= 5)>>> state.solver.add(symreadsize < 30)>>> data, actual_size, new_pos = simfile.read(0, symreadsize)
All sizes between 5 and 20 should be possible:>>> assert set(state.solver.eval_upto(actual_size, 30)) == set(range(5, 20))
Example 6: Working with streams (SimPackets)
So far, we’ve only used the SimFile class, which models a random-accessible file object. However, in real life, files are
not everything. Streams (standard I/O, TCP, etc.) are a great example: While they hold data like a normal file does,
they do not support random accesses, e.g., you cannot read out the second byte of stdin if you have already read passed
that position, and you cannot modify any byte that has been previously sent out to a network endpoint. This allows us
to design a simpler abstraction for streams in angr.
Believe it or not, this simpler abstraction for streams will benefit symbolic execution. Consider an example programthat calls scanf N times to read in N strings. With a traditional SimFile, as we do not know the length of each input
string, there does not exist any clear boundary in the file between these symbolic input strings. In this case, angr will
perform N symbolic reads where each read will generate a gigantic tree of claripy ASTs, with string lengths being
symbolic. This is a nightmare for constraint solving. Nevertheless, the fact that scanf is used on a stream (stdin)
dictates that there will be zero overlap between individual reads, regardless of the sizes of each symbolic input string.
We may as well model stdin as a stream that comprises of consecutive packets, instead of a file containing a sequenceof bytes. Each of the packet can be of a fixed length or a symbolic length. Since there will be absolutely no byte overlap
between packets, the constraints that angr will produce after executing this example program will be a lot simpler.
The key concept involved is “short reads”, i.e. when you ask for n bytes but actually get back fewer bytes than that.
We use a different class implementing SimFileBase, SimPackets, to automatically enable support for short reads. By
default, stdin, stdout, and stderr are all SimPackets objects.
>>> simfile = angr.SimPackets('mypackets')>>> simfile.set_state(state)This’ll just generate a single packet. For SimPackets, the position is just a packet number! If left unspecified,short_reads is determined from a state option.
>>> data, actual_size, new_pos = simfile.read(0, 20, short_reads=True)>>> assert len(data) == 20*8>>> assert set(state.solver.eval_upto(actual_size, 30)) == set(range(21))
Data in a SimPackets is stored as tuples of (packet data, packet size) in .content.
>>> print(simfile.content)[(<BV160 packet_0_mypackets>, <BV64 packetsize_0_mypackets>)]>>> simfile.read(0, 1, short_reads=False)>>> print(simfile.content)(continues on next page)

72

Chapter 5. Advanced Topics

angr(continued from previous page)[(<BV160 packet_0_mypackets>, <BV64 packetsize_0_mypackets>), (<BV8 packet_1_mypackets>,
˓→<BV64 0x1>)]
So hopefully you understand sort of the kind of data that a SimFile can store and what’ll happen when a program tries
to interact with it with various combinations of symbolic and concrete data. Those examples only covered reads, butwrites are pretty similar.

5.5.2 The filesystem, for real now
If you want to make a SimFile available to the program, we need to either stick it in the filesystem or serve stdin/stdout
from it.
The simulated filesystem is the state.fs plugin. You can store, load, and delete files from the filesystem, with theinsert, get, and delete methods. Refer to angr.state_plugins.filesystem for details.
So to make our file available as /tmp/myfile:>>> state.fs.insert('/tmp/myfile', simfile)>>> assert state.fs.get('/tmp/myfile') is simfile
Then, after execution, we would extract the file from the result state and use simfile.concretize() to generate atestcase to reach that state. Keep in mind that concretize() returns different types depending on the file type - for a
SimFile it’s a bytestring and for SimPackets it’s a list of bytestrings.
The simulated filesystem supports a fun concept of “mounts”, where you can designate a subtree as instrumented by aparticular provider. The most common mount is to expose a part of the host filesystem to the guest, lazily importing
file data when the program asks for it:>>> state.fs.mount('/', angr.SimHostFilesystem('./guest_chroot'))
You can write whatever kind of mount you want to instrument filesystem access by subclassing angr.SimMount!

5.5.3 Stdio streams
For stdin and friends, it’s a little more complicated. The relevant plugin is state.posix, which stores all abstractions
relevant to a POSIX-compliant environment. You can always get a state’s stdin SimFile with state.posix.stdin,
but you can’t just replace it - as soon as the state is created, references to this file are created in the file descriptors.
Because of this you need to specify it at the time the POSIX plugin is created:>>> state.register_plugin('posix', angr.state_plugins.posix.SimSystemPosix(stdin=simfile,˓→ stdout=simfile, stderr=simfile))>>> assert state.posix.stdin is simfile>>> assert state.posix.stdout is simfile>>> assert state.posix.stderr is simfile
Or, there’s a nice shortcut while creating the state if you only need to specify stdin:>>> state = proj.factory.entry_state(stdin=simfile)>>> assert state.posix.stdin is simfile
Any of those places you can specify a SimFileBase, you can also specify a string or a bitvector (a flat SimFile with
fixed size will be created to hold it) or a SimFile type (it’ll be instantiated for you).

5.5. Working with File System, Sockets, and Pipes

73

angr

5.6 Intermediate Representation
In order to be able to analyze and execute machine code from different CPU architectures, such as MIPS, ARM, andPowerPC in addition to the classic x86, angr performs most of its analysis on an intermediate representation, a structured
description of the fundamental actions performed by each CPU instruction. By understanding angr’s IR, VEX (which
we borrowed from Valgrind), you will be able to write very quick static analyses and have a better understanding of
how angr works.
The VEX IR abstracts away several architecture differences when dealing with different architectures, allowing a single
analysis to be run on all of them:• Register names. The quantity and names of registers differ between architectures, but modern CPU designs holdto a common theme: each CPU contains several general purpose registers, a register to hold the stack pointer, a
set of registers to store condition flags, and so forth. The IR provides a consistent, abstracted interface to registers
on different platforms. Specifically, VEX models the registers as a separate memory space, with integer offsets(e.g., AMD64’s rax is stored starting at address 16 in this memory space).
• Memory access. Different architectures access memory in different ways. For example, ARM can access memory in both little-endian and big-endian modes. The IR abstracts away these differences.
• Memory segmentation. Some architectures, such as x86, support memory segmentation through the use of
special segment registers. The IR understands such memory access mechanisms.
• Instruction side-effects. Most instructions have side-effects. For example, most operations in Thumb modeon ARM update the condition flags, and stack push/pop instructions update the stack pointer. Tracking theseside-effects in an ad hoc manner in the analysis would be crazy, so the IR makes these effects explicit.
There are lots of choices for an IR. We use VEX, since the uplifting of binary code into VEX is quite well supported.
VEX is an architecture-agnostic, side-effects-free representation of a number of target machine languages. It abstracts
machine code into a representation designed to make program analysis easier. This representation has four main classesof objects:• Expressions. IR Expressions represent a calculated or constant value. This includes memory loads, register
reads, and results of arithmetic operations.
• Operations. IR Operations describe a modification of IR Expressions. This includes integer arithmetic, floatingpoint arithmetic, bit operations, and so forth. An IR Operation applied to IR Expressions yields an IR Expression
as a result.
• Temporary variables. VEX uses temporary variables as internal registers: IR Expressions are stored in temporary variables between use. The content of a temporary variable can be retrieved using an IR Expression. These
temporaries are numbered, starting at t0. These temporaries are strongly typed (e.g., “64-bit integer” or “32-bit
float”).
• Statements. IR Statements model changes in the state of the target machine, such as the effect of memory storesand register writes. IR Statements use IR Expressions for values they may need. For example, a memory store
IR Statement uses an IR Expression for the target address of the write, and another IR Expression for the content.
• Blocks. An IR Block is a collection of IR Statements, representing an extended basic block (termed “IR Super
Block” or “IRSB”) in the target architecture. A block can have several exits. For conditional exits from the
middle of a basic block, a special Exit IR Statement is used. An IR Expression is used to represent the target ofthe unconditional exit at the end of the block.
VEX IR is actually quite well documented in the libvex_ir.h file (https://github.com/angr/vex/blob/master/pub/libvex_ir.h) in the VEX repository. For the lazy, we’ll detail some parts of VEX that you’ll likely interact with fairly
frequently. To begin with, here are some IR Expressions:74

Chapter 5. Advanced Topics

angr

IR
Expression

Evaluated Value

VEX
OutputExampleConstant
Read
Temp
Get
Register
Load
MemoryOperation
If-ThenElse
HelperFunction

A constant value.

0x4:I32

The value stored in a VEX temporary variable.

RdTmp(t10)The value stored in a register.

GET:I32(16)The value stored at a memory address, with the address specified by another IR Expression.

LDle:I32 /LDbe:I64

A result of a specified IR Operation, applied to specified IR Expression arguments.

Add32

If a given IR Expression evaluates to 0, return one IR Expression. Otherwise, return
another.
VEX uses C helper functions for certain operations, such as computing the conditionalflags registers of certain architectures. These functions return IR Expressions.

ITE
function_name()

These expressions are then, in turn, used in IR Statements. Here are some common ones:
IR
Statement

MeaningVEX Output Example

Write
Temp
Put
Register
Store
MemoryExit

Set a VEX temporary variable to the value of the given IR Expression.

WrTmp(t1) = (IR Expression)
PUT(16) = (IR Expression)

Update a register with the value of the given IR Expression.
Update a location in memory, given as an IR Expression, with a value, also
given as an IR Expression.

STle(0x1000) = (IR Expression)

A conditional exit from a basic block, with the jump target specified by an IR
Expression. The condition is specified by an IR Expression.

if (condition) goto (Boring) 0x4000A00:I32

An example of an IR translation, on ARM, is produced below. In the example, the subtraction operation is translated
into a single IR block comprising 5 IR Statements, each of which contains at least one IR Expression (although, in real
life, an IR block would typically consist of more than one instruction). Register names are translated into numericalindices given to the GET Expression and PUT Statement. The astute reader will observe that the actual subtraction
is modeled by the first 4 IR Statements of the block, and the incrementing of the program counter to point to the next
instruction (which, in this case, is located at 0x59FC8) is modeled by the last statement.
The following ARM instruction:subs R2, R2, #8
Becomes this VEX IR:
t0 = GET:I32(16)t1 = 0x8:I32(continues on next page)

5.6. Intermediate Representation

75

angr

(continued from previous page)t3 = Sub32(t0,t1)
PUT(16) = t3
PUT(68) = 0x59FC8:I32
Now that you understand VEX, you can actually play with some VEX in angr: We use a library called PyVEX that
exposes VEX into Python. In addition, PyVEX implements its own pretty-printing so that it can show register names
instead of register offsets in PUT and GET instructions.
PyVEX is accessible through angr through the Project.factory.block interface. There are many different representations you could use to access syntactic properties of a block of code, but they all have in common the trait ofanalyzing a particular sequence of bytes. Through the factory.block constructor, you get a Block object that can beeasily turned into several different representations. Try .vex for a PyVEX IRSB, or .capstone for a Capstone block.
Let’s play with PyVEX:>>> import angr
# load the program binary>>> proj = angr.Project("/bin/true")# translate the starting basic block>>> irsb = proj.factory.block(proj.entry).vex# and then pretty-print it>>> irsb.pp()# translate and pretty-print a basic block starting at an address>>> irsb = proj.factory.block(0x401340).vex>>> irsb.pp()# this is the IR Expression of the jump target of the unconditional exit at the end of␣˓→the basic block>>> print(irsb.next)# this is the type of the unconditional exit (e.g., a call, ret, syscall, etc)>>> print(irsb.jumpkind)# you can also pretty-print it>>> irsb.next.pp()# iterate through each statement and print all the statements>>> for stmt in irsb.statements:...
stmt.pp()# pretty-print the IR expression representing the data, and the *type* of that IR␣
˓→expression written by every store statement>>> import pyvex>>> for stmt in irsb.statements:...
if isinstance(stmt, pyvex.IRStmt.Store):...
print("Data:",)...
stmt.data.pp()...
print("")...
print("Type:",)...
print(stmt.data.result_type)(continues on next page)

76

Chapter 5. Advanced Topics

angr(continued from previous page)...

print("")# pretty-print the condition and jump target of every conditional exit from the basic␣
˓→block>>> for stmt in irsb.statements:...
if isinstance(stmt, pyvex.IRStmt.Exit):...
print("Condition:",)...
stmt.guard.pp()...
print("")...
print("Target:",)...
stmt.dst.pp()...
print("")# these are the types of every temp in the IRSB>>> print(irsb.tyenv.types)# here is one way to get the type of temp 0>>> print(irsb.tyenv.types[0])5.6.1 Condition flags computation (for x86 and ARM)
One of the most common instruction side-effects on x86 and ARM CPUs is updating condition flags, such as thezero flag, the carry flag, or the overflow flag. Computer architects usually put the concatenation of these flags (yes,concatenation of the flags, since each condition flag is 1 bit wide) into a special register (i.e. EFLAGS/RFLAGS on x86,
APSR/CPSR on ARM). This special register stores important information about the program state, and is critical forcorrect emulation of the CPU.
VEX uses 4 registers as its “Flag thunk descriptors” to record details of the latest flag-setting operation. VEX has alazy strategy to compute the flags: when an operation that would update the flags happens, instead of computing theflags, VEX stores a code representing this operation to the cc_op pseudo-register, and the arguments to the operationin cc_dep1 and cc_dep2. Then, whenever VEX needs to get the actual flag values, it can figure out what the one bitcorresponding to the flag in question actually is, based on its flag thunk descriptors. This is an optimization in the flags
computation, as VEX can now just directly perform the relevant operation in the IR without bothering to compute andupdate the flags’ value.
Amongst different operations that can be placed in cc_op, there is a special value 0 which corresponds to OP_COPY
operation. This operation is supposed to copy the value in cc_dep1 to the flags. It simply means that cc_dep1 contains
the flags’ value. angr uses this fact to let us efficiently retrieve the flags’ value: whenever we ask for the actual flags,
angr computes their value, then dumps them back into cc_dep1 and sets cc_op = OP_COPY in order to cache thecomputation. We can also use this operation to allow the user to write to the flags: we just set cc_op = OP_COPY to
say that a new value being set to the flags, then set cc_dep1 to that new value.

5.7 Working with Data and Conventions
Frequently, you’ll want to access structured data from the program you’re analyzing. angr has several features to makethis less of a headache.

5.7.1 Working with types
angr has a system for representing types. These SimTypes are found in angr.types - an instance of any of theseclasses represents a type. Many of the types are incomplete unless they are supplemented with a SimState - their size
depends on the architecture you’re running under. You may do this with ty.with_arch(arch), which returns a copyof itself, with the architecture specified.
5.7. Working with Data and Conventions

77

angr

angr also has a light wrapper around pycparser, which is a C parser. This helps with getting instances of type objects:>>> import angr, monkeyhex# note that SimType objects have their __repr__ defined to return their c type name,# so this function actually returned a SimType instance.
>>> angr.types.parse_type('int')
int>>> angr.types.parse_type('char **')
char**>>> angr.types.parse_type('struct aa {int x; long y;}')struct aa>>> angr.types.parse_type('struct aa {int x; long y;}').fields
OrderedDict([('x', int), ('y', long)])
Additionally, you may parse C definitions and have them returned to you in a dict, either of variable/function declarations
or of newly defined types:>>> angr.types.parse_defns("int x; typedef struct llist { char* str; struct llist *next;␣
˓→} list_node; list_node *y;"){'x': int, 'y': struct llist*}>>> defs = angr.types.parse_types("int x; typedef struct llist { char* str; struct llist␣
˓→*next; } list_node; list_node *y;")>>> defs{'struct llist': struct llist, 'list_node': struct llist}# if you want to get both of these dicts at once, use parse_file, which returns both in␣˓→a tuple.
>>> angr.types.parse_file("int x; typedef struct llist { char* str; struct llist *next; }˓→ list_node; list_node *y;")({'x': int, 'y': struct llist*},{'struct llist': struct llist, 'list_node': struct llist})>>> defs['list_node'].fields
OrderedDict([('str', char*), ('next', struct llist*)])>>> defs['list_node'].fields['next'].pts_to.fields
OrderedDict([('str', char*), ('next', struct llist*)])# If you want to get a function type and you don't want to construct it manually,# you can use parse_type>>> angr.types.parse_type("int (int y, double z)")(int, double) -> int
And finally, you can register struct definitions for future use:>>> angr.types.register_types(angr.types.parse_type('struct abcd { int x; int y; }'))>>> angr.types.register_types(angr.types.parse_types('typedef long time_t;'))>>> angr.types.parse_defns('struct abcd a; time_t b;'){'a': struct abcd, 'b': long}78

Chapter 5. Advanced Topics

angr

These type objects aren’t all that useful on their own, but they can be passed to other parts of angr to specify data types.

5.7.2 Accessing typed data from memory
Now that you know how angr’s type system works, you can unlock the full power of the state.mem interface! Any
type that’s registered with the types module can be used to extract data from memory.
>>> p = angr.Project('examples/fauxware/fauxware')>>> s = p.factory.entry_state()>>> s.mem[0x601048]<<untyped> <unresolvable> at 0x601048>>>> s.mem[0x601048].long<long (64 bits) <BV64 0x4008d0> at 0x601048>>>> s.mem[0x601048].long.resolved<BV64 0x4008d0>>>> s.mem[0x601048].long.concrete
0x4008d0>>> s.mem[0x601048].struct.abcd<struct abcd {.x = <BV32 0x4008d0>,.y = <BV32 0x0>
} at 0x601048>>>> s.mem[0x601048].struct.abcd.x<int (32 bits) <BV32 0x4008d0> at 0x601048>>>> s.mem[0x601048].struct.abcd.y<int (32 bits) <BV32 0x0> at 0x60104c>>>> s.mem[0x601048].deref<<untyped> <unresolvable> at 0x4008d0>>>> s.mem[0x601048].deref.string<string_t <BV64 0x534f534e45414b59> at 0x4008d0>>>> s.mem[0x601048].deref.string.resolved<BV64 0x534f534e45414b59>>>> s.mem[0x601048].deref.string.concrete
b'SOSNEAKY'
The interface works like this:• You first use [array index notation] to specify the address you’d like to load from• If at that address is a pointer, you may access the deref property to return a SimMemView at the address present
in memory.
• You then specify a type for the data by simply accessing a property of that name. For a list of supported types,
look at state.mem.types.
• You can then refine the type. Any type may support any refinement it likes. Right now the only refinements

5.7. Working with Data and Conventions

79

angr

supported are that you may access any member of a struct by its member name, and you may index into a stringor array to access that element.
• If the address you specified initially points to an array of that type, you can say .array(n) to view the data as
an array of n elements.
• Finally, extract the structured data with .resolved or .concrete. .resolved will return bitvector values,
while .concrete will return integer, string, array, etc values, whatever best represents the data.
• Alternately, you may store a value to memory, by assigning to the chain of properties that you’ve constructed.
Note that because of the way Python works, x = s.mem[...].prop; x = val will NOT work, you must says.mem[...].prop = val.
If you define a struct using register_types(parse_type(struct_expr)), you can access it here as a type:>>> s.mem[p.entry].struct.abcd<struct abcd {.x = <BV32 0x8949ed31>,.y = <BV32 0x89485ed1>} at 0x400580>

5.7.3 Working with Calling Conventions
A calling convention is the specific means by which code passes arguments and return values through function calls.
angr’s abstraction of calling conventions is called SimCC. You can construct new SimCC instances through the angr
object factory, with p.factory.cc(...). This will give a calling convention which is guessed based your guest
architecture and OS. If angr guesses wrong, you can explicitly pick one of the calling conventions in the angr.
calling_conventions module.
If you have a very wacky calling convention, you can use angr.calling_conventions.SimCCUsercall. This will
ask you to specify locations for the arguments and the return value. To do this, use instances of the SimRegArg or
SimStackArg classes. You can find them in the factory - p.factory.cc.Sim*Arg.
Once you have a SimCC object, you can use it along with a SimState object and a function prototype (a SimTypeFunction) to extract or store function arguments more cleanly. Take a look at the angr.calling_conventions.SimCC>
for details. Alternately, you can pass it to an interface that can use it to modify its own behavior, like p.factory.
call_state, or. . .

5.7.4 Callables
Callables are a Foreign Functions Interface (FFI) for symbolic execution. Basic callable usage is to create one withmyfunc = p.factory.callable(addr), and then call it! result = myfunc(args, ...) When you call thecallable, angr will set up a call_state at the given address, dump the given arguments into memory, and run apath_group based on this state until all the paths have exited from the function. Then, it merges all the result states
together, pulls the return value out of that state, and returns it.
All the interaction with the state happens with the aid of a SimCC and a SimTypeFunction, to tell where to put
the arguments and where to get the return value. It will try to use a sane default for the architecture, but if you’d
like to customize it, you can pass a SimCC object in the cc keyword argument when constructing the callable. The
SimTypeFunction is required - you must pass the prototype parameter. If you pass a string to this parameter it will
be parsed as a function declaration.
You can pass symbolic data as function arguments, and everything will work fine. You can even pass more complicateddata, like strings, lists, and structures as native Python data (use tuples for structures), and it’ll be serialized as cleanly as
possible into the state. If you’d like to specify a pointer to a certain value, you can wrap it in a PointerWrapper object,available as p.factory.callable.PointerWrapper. The exact semantics of how pointer-wrapping work are a little
confusing, but they can be boiled down to “unless you specify it with a PointerWrapper or a specific SimArrayType,nothing will be wrapped in a pointer automatically unless it gets to the end and it hasn’t yet been wrapped in a pointer80

Chapter 5. Advanced Topics

angryet and the original type is a string, array, or tuple.” The relevant code is actually in SimCC - it’s the setup_callsite
function.
If you don’t care for the actual return value of the call, you can say func.perform_call(arg, ...), and then theproperties func.result_state and func.result_path_group will be populated. They will actually be populatedeven if you call the callable normally, but you probably care about them more in this case!

5.8 Solver Engine
angr’s solver engine is called Claripy. Claripy exposes the following design:• Claripy ASTs (the subclasses of claripy.ast.Base) provide a unified way to interact with concrete and symbolic
expressions• Frontends provide different paradigms for evaluating these expressions. For example, the FullFrontend solves
expressions using something like an SMT solver backend, while LightFrontend handles them by using an
abstract (and approximating) data domain backend.
• Each Frontend needs to, at some point, do actual operation and evaluations on an AST. ASTs don’t support this on their own. Instead, Backends translate ASTs into backend objects (i.e., Python primitives for
BackendConcrete, Z3 expressions for BackendZ3, strided intervals for BackendVSA, etc) and handle any appropriate state-tracking objects (such as tracking the solver state in the case of BackendZ3). Roughly speaking,frontends take ASTs as inputs and use backends to backend.convert() those ASTs into backend objects thatcan be evaluated and otherwise reasoned about.
• FrontendMixins customize the operation of Frontends. For example, ModelCacheMixin caches solutions
from an SMT solver.
• The combination of a Frontend, a number of FrontendMixins, and a number of Backends comprise a claripy
Solver.
Internally, Claripy seamlessly mediates the co-operation of multiple disparate backends – concrete bitvectors, VSA
constructs, and SAT solvers. It is pretty badass.
Most users of angr will not need to interact directly with Claripy (except for, maybe, claripy AST objects, which
represent symbolic expressions) – angr handles most interactions with Claripy internally. However, for dealing withexpressions, an understanding of Claripy might be useful.

5.8.1 Claripy ASTs
Claripy ASTs abstract away the differences between mathematical constructs that Claripy supports. They define a treeof operations (i.e., (a + b) / c) on any type of underlying data. Claripy handles the application of these operations
on the underlying objects themselves by dispatching requests to the backends.
Currently, Claripy supports the following types of ASTs:

5.8. Solver Engine

81

angr

Name

Description

Supported By (Claripy
Backends)

Example Code

BV

This is a bitvector, whether
symbolic (with a name) or
concrete (with a value). It
has a size (in bits).

BackendConcrete, BackendVSA, BackendZ3

FP

This is a floating-point
number, whether symbolic(with a name) or concrete(with a value).

BackendConcrete, BackendZ3

Create a 32-bit symbolic
bitvector “x”:
claripy.BVS(‘x’, 32) Create a
32-bit bitvector with thevalue 0xc001b3475: claripy.BVV(0xc001b3a75,32)`</li><li>Createa32-bit “strided interval”(see VSA documentation)that can be any divisibleby-10 number between
1000 and 2000: `claripy.SI(name=’x’, bits=32,
lower_bound=1000,
upper_bound=2000,
stride=10)`</li></ul>

BoolThis is a boolean operation(True or False).

BackendConcrete, BackendVSA, BackendZ3

Create a claripy.fp.FSORT_DOUBLE
symbolic floating point“b”: `claripy.FPS(‘b’,claripy.fp.FSORT_DOUBLE)`Createaclaripy.fp.FSORT_FLOAT
floating point withvalue 3.2:
claripy.FPV(3.2, claripy.fp.FSORT_FLOAT)
claripy.BoolV(True),or claripy.true orclaripy.false, or bycomparing two ASTs (i.e.,
claripy.BVS('x', 32)< claripy.BVS('y',32)

All of the above creation code returns claripy.AST objects, on which operations can then be carried out.
ASTs provide several useful operations.
>>> import claripy>>> bv = claripy.BVV(0x41424344, 32)# Size - you can get the size of an AST with .size()>>> assert bv.size() == 32# Reversing - .reversed is the reversed version of the BVV>>> assert bv.reversed is claripy.BVV(0x44434241, 32)

82(continues on next page)

Chapter 5. Advanced Topics

angr(continued from previous page)>>> assert bv.reversed.reversed is bv# Depth - you can get the depth of the AST>>> print(bv.depth)>>> assert bv.depth == 1>>> x = claripy.BVS('x', 32)>>> assert (x+bv).depth == 2>>> assert ((x+bv)/10).depth == 3
Applying a condition (==, !=, etc) on ASTs will return an AST that represents the condition being carried out. For
example:>>> r = bv == x>>> assert isinstance(r, claripy.ast.Bool)>>> p = bv == bv>>> assert isinstance(p, claripy.ast.Bool)>>> assert p.is_true()
You can combine these conditions in different ways.
>>> q = claripy.And(claripy.Or(bv == x, bv * 2 == x, bv * 3 == x), x == 0)>>> assert isinstance(p, claripy.ast.Bool)The usefulness of this will become apparent when we discuss Claripy solvers.
In general, Claripy supports all of the normal Python operations (+, -, |, ==, etc), and provides additional ones via the
Claripy instance object. Here’s a list of available operations from the latter.

5.8. Solver Engine

83

angr

Name

Description

ExampleLShR

Logically shifts a bit expression (BVV, BV, SI) to theright.
Sign-extends a bit expression.

claripy.LShR(x, 10)

SignExt
ZeroExt
Extract
ConcatRotateLeft
RotateRight
Reverse
And
Or
Not
If

Zero-extends a bit expression.
Extracts the given bits (zero-indexed from the right,
inclusive) from a bit expression.
Concatenates several bit expressions together into a
new bit expression.
Rotates a bit expression left.

claripy.SignExt(32, x)
orx.
sign_extend(32)claripy.ZeroExt(32, x)
orx.
zero_extend(32)Extract the rightmost byte of x: claripy.
Extract(7, 0, x) or x[7:0]
claripy.Concat(x, y, z)
claripy.RotateLeft(x, 8)

Rotates a bit expression right.

claripy.RotateRight(x, 8)

Endian-reverses a bit expression.

claripy.Reverse(x) or x.reversed

Logical And (on boolean expressions)
Logical Or (on boolean expressions)
Logical Not (on a boolean expression)
An If-then-else

claripy.And(x == y, x > 0)claripy.Or(x == y, y < 10)claripy.Not(x == y) is the same as x != yChoose the maximum of two expressions:claripy.If(x > y, x, y)
Check if x is less than or equal to y: claripy.
ULE(x, y)Check if x is less than y: claripy.ULT(x, y)
Check if x is greater than or equal to y:claripy.UGE(x, y)
Check if x is greater than y: claripy.UGT(x,y)
Check if x is less than or equal to y: claripy.
SLE(x, y)Check if x is less than y: claripy.SLT(x, y)
Check if x is greater than or equal to y:claripy.SGE(x, y)
Check if x is greater than y: claripy.SGT(x,y)

ULE

Unsigned less than or equal to.

ULT
UGE

Unsigned less than.
Unsigned greater than or equal to.

UGT

Unsigned greater than.

SLE

Signed less than or equal to.

SLT
SGE

Signed less than.
Signed greater than or equal to.

SGT

Signed greater than.

ò NoteThe default Python >, <, >=, and <= are unsigned in Claripy. This is different than their behavior in Z3, because it
seems more natural in binary analysis.

5.8.2 Solvers
The main point of interaction with Claripy are the Claripy Solvers. Solvers expose an API to interpret ASTs in different
ways and return usable values. There are several different solvers.

84

Chapter 5. Advanced Topics

angr

Name

Description

SolverThis is analogous to a z3.Solver(). It is a solver that tracks constraints on symbolic variables anduses a constraint solver (currently, Z3) to evaluate symbolic expressions.
SolverVSA This solver uses VSA to reason about values. It is an approximating solver, but produces values without
performing actual constraint solves.
SolverThis solver acts as a pass-through to a child solver, allowing the replacement of expressions on-the-fly.
Replace- It is used as a helper by other solvers and can be used directly to implement exotic analyses.
ment
SolverThis solver combines the SolverReplacement and the Solver (VSA and Z3) to allow for approximating
Hybridvalues. You can specify whether or not you want an exact result from your evaluations, and this solver
does the rest.
SolverThis solver implements optimizations that solve smaller sets of constraints to speed up constraint solving.
Composite
Some examples of solver usage:# create the solver and an expression>>> s = claripy.Solver()>>> x = claripy.BVS('x', 8)# now let's add a constraint on x>>> s.add(claripy.ULT(x, 5))>>> assert sorted(s.eval(x, 10)) == [0, 1, 2, 3, 4]>>> assert s.max(x) == 4>>> assert s.min(x) == 0
# we can also get the values of complex expressions>>> y = claripy.BVV(65, 8)>>> z = claripy.If(x == 1, x, y)>>> assert sorted(s.eval(z, 10)) == [1, 65]# and, of course, we can add constraints on complex expressions>>> s.add(z % 5 != 0)>>> assert s.eval(z, 10) == (1,)>>> assert s.eval(x, 10) == (1,) # interestingly enough, since z can't be y, x can only␣˓→be 1!
Custom solvers can be built by combining a Claripy Frontend (the class that handles the actual interaction with SMT
solver or the underlying data domain) and some combination of frontend mixins (that handle things like caching,filtering out duplicate constraints, doing opportunistic simplification, and so on).

5.8.3 Claripy Backends
Backends are Claripy’s workhorses. Claripy exposes ASTs to the world, but when actual computation has to be done,
it pushes those ASTs into objects that can be handled by the backends themselves. This provides a unified interface
to the outside world while allowing Claripy to support different types of computation. For example, BackendConcrete
provides computation support for concrete bitvectors and booleans, BackendVSA introduces VSA constructs such as
StridedIntervals (and details what happens when operations are performed on them, and BackendZ3 provides support
for symbolic variables and constraint solving.
There are a set of functions that a backend is expected to implement. For all of these functions, the “public” version is
5.8. Solver Engine

85

angr

expected to be able to deal with claripy’s AST objects, while the “private” version should only deal with objects specificto the backend itself. This is distinguished with Python idioms: a public function will be named func() while a private
function will be _func(). All functions should return objects that are usable by the backend in its private methods. If
this can’t be done (i.e., some functionality is being attempted that the backend can’t handle), the backend should raisea BackendError. In this case, Claripy will move on to the next backend in its list.
All backends must implement a convert() function. This function receives a claripy AST and should return an object
that the backend can handle in its private methods. Backends should also implement a convert() method, which will
receive anything that is not a claripy AST object (i.e., an integer or an object from a different backend). If convert()
or convert() receives something that the backend can’t translate to a format that is usable internally, the backend
should raise BackendError, and thus won’t be used for that object. All backends must also implement any functions of
the base Backend abstract class that currently raise NotImplementedError().
Claripy’s contract with its backends is as follows: backends should be able to handle, in their private functions, any
object that they return from their private or public functions. Claripy will never pass an object to any backend private
function that did not originate as a return value from a private or public function of that backend. One exception to thisis convert() and convert(), as Claripy can try to stuff anything it feels like into _convert() to see if the backend canhandle that type of object.
Backend Objects
To perform actual, useful computation on ASTs, Claripy uses backend objects. A BackendObject is a result of theoperation represented by the AST. Claripy expects these objects to be returned from their respective backends, and willpass such objects into that backend’s other functions.

5.9 Symbolic memory addressing
angr supports symbolic memory addressing, meaning that offsets into memory may be symbolic. Our implementationof this is inspired by “Mayhem”. Specifically, this means that angr concretizes symbolic addresses when they areused as the target of a write. This causes some surprises, as users tend to expect symbolic writes to be treated purely
symbolically, or “as symbolically” as we treat symbolic reads, but that is not the default behavior. However, like mostthings in angr, this is configurable.
The address resolution behavior is governed by concretization strategies, which are subclasses of angr.
concretization_strategies.SimConcretizationStrategy. Concretization strategies for reads are set instate.memory.read_strategies and for writes in state.memory.write_strategies. These strategies arecalled, in order, until one of them is able to resolve addresses for the symbolic index. By setting your own concretization strategies (or through the use of SimInspect address_concretization breakpoints, described above), you canchange the way angr resolves symbolic addresses.
For example, angr’s default concretization strategies for writes are:
1. A conditional concretization strategy that allows symbolic writes (with a maximum range of 128 possible solutions) for any indices that are annotated with angr.plugins.symbolic_memory.MultiwriteAnnotation.
2. A concretization strategy that simply selects the maximum possible solution of the symbolic index.
To enable symbolic writes for all indices, you can either add the SYMBOLIC_WRITE_ADDRESSES state option at state creation time or manually insert a angr.concretization_strategies.SimConcretizationStrategyRange object
into state.memory.write_strategies. The strategy object takes a single argument, which is the maximum rangeof possible solutions that it allows before giving up and moving on to the next (presumably non-symbolic) strategy.

86

Chapter 5. Advanced Topics

angr

5.9.1 Writing concretization strategies
v TodoWrite this section

5.10 Java Support
angr also supports symbolically executing Java code and Android apps! This also includes Android apps using a
combination of compiled Java and native (C/C++) code.
. Warning
Java support is experimental! Contribution from the community is highly encouraged! Pull requests are very
welcomed!
We implemented Java support by lifting the compiled Java code, both Java and DEX bytecode, leveraging our Soot
Python wrapper: pysoot. pysoot extracts a fully serializable interface from Android apps and Java code (unfortunately,
as of now, it only works on Linux). For every class of the generated IR (for instance, SootMethod), you can nicely
print its instructions (in a format similar to Soot shimple) using print() or str().
We then leverage the generated IR in a new angr engine able to run code in Soot IR: angr/engines/soot/engine.py. This
engine is also able to automatically switch to executing native code if the Java code calls any native method using the
JNI interface.
Together with the symbolic execution, we also implemented some basic static analysis, specifically a basic CFG reconstruction analysis. Moreover, we added support for string constraint solving, modifying claripy and using the CVC4
solver.

5.10.1 How to install
Enabling Java support requires few more steps than typical angr installation. Assuming you installed angr-dev, activate
the virtualenv and run:
pip install -e ./claripy[cvc4-solver]./setup.sh pysoot
Analyzing Android apps.
Analyzing Android apps (.APK files, containing Java code compiled to the DEX format) requires the Android SDK. Typically, it is installed in <HOME>/Android/SDK/platforms/platform-XX/android.jar, where XX is the Android
SDK version used by the app you want to analyze (you may want to install all the platforms required by the Android
apps you want to analyze).

5.10.2 Examples
There are multiple examples available:• Easy Java crackmes: java_crackme1, java_simple3, java_simple4• A more complex example (solving a CTF challenge): ictf2017_javaisnotfun, blogpost• Symbolically executing an Android app (using a mix of Java and native code): java_androidnative1• Many other low-level tests: test_java
5.10. Java Support

87

angr

5.11 Symbion: Interleaving symbolic and concrete execution
Let’s suppose you want to symbolically analyze a specific function of a program, but there is a huge initialization stepthat you want to skip because it is not necessary for your analysis, or cannot properly be emulated by angr. For example,
maybe your program is running on an embedded system and you have access to a debug interface, but you can’t easily
replicate the hardware in a simulated environment.
This is the perfect scenario for Symbion, our interleaved execution technique!
We implemented a built-in system that let users define a ConcreteTarget that is used to “import” a concrete stateof the target program from an external source into angr. Once the state is imported you can make parts of the state
symbolic, use symbolic execution on this state, run your analyses, and finally concretize the symbolic parts and resume
concrete execution in the external environment. By iterating this process it is possible to implement run-time andinteractive advanced symbolic analyses that are backed up by the real program’s execution!
Isn’t that cool?

5.11.1 How to install
To use this technique you’ll need an implementation of a ConcreteTarget (effectively, an object that is going to be the“glue” between angr and the external process.) We ship a default one (the AvatarGDBConcreteTarget, which control
an instance of a program being debugged under GDB) in the following repo https://github.com/angr/angr-targets.
Assuming you installed angr-dev, activate the virtualenv and run:git clone https://github.com/angr/angr-targets.git
cd angr-targets
pip install .
Now you’re ready to go!

5.11.2 Gists
Once you have created an entry state, instantiated a SimulationManager, and specified a list of stop_points using theSymbion interface we are going to resume the concrete process execution.
# Instantiating the ConcreteTarget
avatar_gdb = AvatarGDBConcreteTarget(avatar2.archs.x86.X86_64,
GDB_SERVER_IP, GDB_SERVER_PORT)# Creating the Projectp = angr.Project(binary_x64, concrete_target=avatar_gdb,
use_sim_procedures=True)# Getting an entry_state
entry_state = p.factory.entry_state()# Forget about these options as for now, will explain later.
entry_state.options.add(angr.options.SYMBION_SYNC_CLE)
entry_state.options.add(angr.options.SYMBION_KEEP_STUBS_ON_SYNC)# Use Symbion!
simgr.use_technique(angr.exploration_techniques.Symbion(find=[0x85b853])
When one of your stop_points (effectively a breakpoint) is hit, we give control to angr. A new plugin called concrete
is in charge of synchronizing the concrete state of the program inside a new SimState.

88

Chapter 5. Advanced Topics

angrRoughly, synchronization does the following:• All the registers’ values (NOT marked with concrete=False in the respective arch file in archinfo) are copied
inside the new SimState.
• The underlying memory backend is hooked in a way that all the further memory accesses triggered during symbolic execution are redirected to the concrete process.
• If the project is initialized with SimProcedure (use_sim_procedures=True) we are going to re-hook the externalfunctions’ addresses with a SimProcedure if we happen to have it, otherwise with a SimProcedure stub (youcan control this decision by using the Options SYMBION_KEEP_STUBS_ON_SYNC). Conversely, the realcode of the function is executed inside angr (Warning: do that at your own risk!)Once this process is completed, you can play with your new SimState backed by the concrete process stopped at thatparticular stop_point.

5.11.3 Options
The way we synchronize the concrete process inside angr is customizable by 2 state options:• SYMBION_SYNC_CLE: this option controls the synchronization of the memory mapping of the program
inside angr. When the project is created, the memory mapping inside angr is different from the one inside theconcrete process (this will change as soon as Symbion will be fully compatible with archr). If you want theprocess mapping to be fully synchronized with the one of the concrete process, set this option to the SimState
before initializing the SimulationManager (Note that this is going to happen at the first synchronization of theconcrete process inside angr, NOT before)
entry_state.options.add(angr.options.SYMBION_SYNC_CLE)
simgr = project.factory.simgr(state)• SYMBION_KEEP_STUBS_ON_SYNC: this option controls how we re-hook external functions with SimProcedures. If the project has been initialized to use SimProcedures (use_sim_procedures=True), we are going to
re-hook external functions with SimProcedures (if we have that particular implementation) or with a genericstub. If you want to execute SimProcedures for functions for which we have an available implementation and ageneric stub SimProcedure for the ones we have not, set this option to the SimState before initializing the SimulationManager. In the other case, we are going to execute the real code for the external functions that miss a
SimProcedure (no generic stub is going to be used).
entry_state.options.add(angr.options.SYMBION_KEEP_STUBS_ON_SYNC)
simgr = project.factory.simgr(state)

5.11.4 Example
You can find more information about this technique and a complete example in our blog post: https://angr.io/blog/
angr_symbion/. For more technical details a public paper will be available soon, or, ping @degrigis on our angr Slackchannel.

5.12 Debug variable resolution
angr now support resolve source level variable (debug variable) in binary with debug information. This article will
introduce you how to use it.

5.12. Debug variable resolution

89

angr

5.12.1 Setting up
To use it you need binary that is compiled with dwarf debugging information (ex: gcc -g) and load in angr withthe option load_debug_info. After that you need to run project.kb.dvars.load_from_dwarf() to set up thefeature and we’re set.
Overall it looks like this:# compile your binary with debug information
gcc -g -o debug_var debug_var.c>>> import angr>>> project = angr.Project('./examples/debug_var/simple_var', load_debug_info = True)>>> project.kb.dvars.load_from_dwarf()

5.12.2 Core featureWith things now set up you can view the value in the angr memory view of the debug variable within a state
with: state.dvars['variable_name'].mem or the value that it point to if it is a pointer with: state.
dvars['pointer_name'].deref.mem. Here are some example:
Given the source code in examples/debug_var/simple_var.c#include<stdio.h>
int global_var = 100;
int main(void){
int a = 10;
int* b = &a;printf("%d\n", *b);{
int a = 24;*b = *b + a;
int c[] = {5, 6, 7, 8};
printf("%d\n", a);}return 0;}# Get a state before executing printf(%d\n", *b) (line 7)# the addr to line 7 is 0x401193 you can search for it with>>> project.loader.main_object.addr_to_line{...}>>> addr = 0x401193# Create an simulation manager and run to that addr>>> simgr = project.factory.simgr()>>> simgr.explore(find = addr)<SimulationManager with 1 found>>>> state = simgr.found[0]# Resolve 'a' in state>>> state.dvars['a'].mem<int (32 bits) <BV32 0xa> at 0x7fffffffffeff30># Dereference pointer b>>> state.dvars['b'].deref.mem(continues on next page)

90

Chapter 5. Advanced Topics

angr(continued from previous page)<int (32 bits) <BV32 0xa> at 0x7fffffffffeff30># It works as expected when resolving the value of b gives the address of a>>> state.dvars['b'].mem<reg64_t <BV64 0x7fffffffffeff30> at 0x7fffffffffeff38>
Side-note: For string type you can use .string instead of .mem to resolve it. For struct type you can resolve its member
by .member("member_name").mem. For array type you can use .array(index).mem to access the element in array.

5.13 Variable visibility
If you have many variable with the same name but in different scope, calling state.dvars['var_name'] would
resolve the variable with the nearest scope.
Example:# Find the addr before executing printf("%d\n", a) (line 12)# with the same method to find addr>>> addr = 0x4011e0# Explore until find state>>> simgr.move(from_stash='found', to_stash='active')<SimulationManager with 1 active>>>> simgr.explore(find = addr)<SimulationManager with 1 found>>>> state = simgr.found[0]# Resolve 'a' in state before execute line 10>>> state.dvars['a'].mem<int (32 bits) <BV32 0x18> at 0x7fffffffffeff34>
Congratulation, you’ve now know how to resolve debug variable using angr, for more info check out the api-doc.

5.13. Variable visibility

91

angr

92

Chapter 5. Advanced Topics

CHAPTERSIX

EXTENDING ANGR

6.1 Hooks and SimProcedures
Hooks in angr are very powerful! You can use them to modify a program’s behavior in any way you could imagine.
However, the exact way you might want to program a specific hook may be non-obvious. This chapter should serve asa guide when programming SimProcedures.

6.1.1 Quick Start
Here’s an example that will remove all bugs from any program:>>> from angr import Project, SimProcedure>>> project = Project('examples/fauxware/fauxware')>>> class BugFree(SimProcedure):...
def run(self, argc, argv):...
print('Program running with argc=%s and argv=%s' % (argc, argv))...
return 0# this assumes we have symbols for the binary>>> project.hook_symbol('main', BugFree())# Run a quick execution!
>>> simgr = project.factory.simulation_manager()>>> simgr.run() # step until no more active states
Program running with argc=<SAO <BV64 0x0>> and argv=<SAO <BV64 0x7fffffffffeffa0>><SimulationManager with 1 deadended>
Now, whenever program execution reaches the main function, instead of executing the actual main function, it will
execute this procedure! It just prints out a message, and returns.
Now, let’s talk about what happens on the edge of this function! When entering the function, where do the values
that go into the arguments come from? You can define your run() function with however many arguments you like,and the SimProcedure runtime will automatically extract from the program state those arguments for you, via a calling
convention, and call your run function with them. Similarly, when you return a value from the run function, it is placed
into the state (again, according to the calling convention), and the actual control-flow action of returning from a function
is performed, which depending on the architecture may involve jumping to the link register or jumping to the result ofa stack pop.
It should be clear at this point that the SimProcedure we just wrote is meant to totally replace whatever function it ishooked over top of. In fact, the original use case for SimProcedures was replacing library functions. More on that later.

93

angr

6.1.2 Implementation Context
On a Project class, the dict project._sim_procedures is a mapping from address to SimProcedure instances.
When the execution pipeline reaches an address that is present in that dict, that is, an address that is hooked, it will
execute project._sim_procedures[address].execute(state). This will consult the calling convention to extract the arguments, make a copy of itself in order to preserve thread safety, and run the run() method. It is importantto produce a new instance of the SimProcedure for each time it is run, since the process of running a SimProcedurenecessarily involves mutating state on the SimProcedure instance, so we need separate ones for each step, lest we run
into race conditions in multithreaded environments.
kwargsThis hierarchy implies that you might want to reuse a single SimProcedure in multiple hooks. What if you want to hook
the same SimProcedure in several places, but tweaked slightly each time? angr’s support for this is that any additional
keyword arguments you pass to the constructor of your SimProcedure will end up getting passed as keyword args toyour SimProcedure’s run() method. Pretty cool!

6.1.3 Data Types
If you were paying attention to the example earlier, you noticed that when we printed out the arguments to the run()function, they came out as a weird <SAO <BV64 0xSTUFF>> class. This is a SimActionObject. Basically, you don’t
need to worry about it too much, it’s just a thin wrapper over a normal bitvector. It does a bit of tracking of what exactly
you do with it inside the SimProcedure—this is helpful for static analysis.
You may also have noticed that we directly returned the Python int 0 from the procedure. This will automatically bepromoted to a word-sized bitvector! You can return a native number, a bitvector, or a SimActionObject.
When you want to write a procedure that deals with floating point numbers, you will need to specify the calling convention manually.
It’s not too hard, just provide a cc to the hook: `cc =project.factory.cc_from_arg_kinds((True, True), ret_fp=True) andproject.hook(address,
ProcedureClass(cc=mycc)) This method for passing in a calling convention works for all calling conventions, so
if angr’s autodetected one isn’t right, you can fix that.

6.1.4 Control Flow
How can you exit a SimProcedure? We’ve already gone over the simplest way to do this, returning a value from run().
This is actually shorthand for calling self.ret(value). self.ret() is the function which knows how to performthe specific action of returning from a function.
SimProcedures can use lots of different functions like this!
• ret(expr): Return from a function• jump(addr): Jump to an address in the binary• exit(code): Terminate the program• call(addr, args, continue_at): Call a function in the binary• inline_call(procedure, *args): Call another SimProcedure in-line and return the results
That second-last one deserves some looking-at. We’ll get there after a quick detour. . .
Conditional Exits
What if we want to add a conditional branch out of a SimProcedure? In order to do that, you’ll need to work directlywith the SimSuccessors object for the current execution step.

94

Chapter 6. Extending angr

angr

The interface for this is `self.successors.add_successor(state, addr, guard, jumpkind). All of theseparameters should have an obvious meaning if you’ve followed along so far. Keep in mind that the state you pass inwill NOT be copied and WILL be mutated, so be sure to make a copy beforehand if there will be more work to do!
SimProcedure Continuations
How can we call a function in the binary and have execution resume within our SimProcedure? There is a whole bunchof infrastructure called the “SimProcedure Continuation” that will let you do this. When you use self.call(addr,
args, continue_at), addr is expected to be the address you’d like to call, args is the tuple of arguments you’d liketo call it with, and continue_at is the name of another method in your SimProcedure class that you’d like execution
to continue at when it returns. This method must have the same signature as the run() method. Furthermore, you canpass the keyword argument cc as the calling convention that ought to be used to communicate with the callee.
When you do this, you finish your current step, and execution will start again at the next step at the function you’ve
specified. When that function returns, it has to return to some concrete address! That address is specified by the
SimProcedure runtime: an address is allocated in angr’s externs segment to be used as the return site for returning to
the given method call. It is then hooked with a copy of the procedure instance tweaked to run the specified continue_atfunction instead of run(), with the same args and kwargs as the first time.
There are two pieces of metadata you need to attach to your SimProcedure class in order to use the continuation
subsystem correctly:• Set the class variable IS_FUNCTION = True
• Set the class variable local_vars to a tuple of strings, where each string is the name of an instance variable on
your SimProcedure whose value you would like to persist to when you return. Local variables can be any typeso long as you don’t mutate their instances.
You may have guessed by now that there exists some sort of auxiliary storage in order to hold on to all this data.
You would be right! The state plugin state.callstack has an entry called .procedure_data which is used by the
SimProcedure runtime to store information local to the current call frame. angr tracks the stack pointer in order to makethe current top of the state.callstack a meaningful local data store. It’s stuff that ought to be stored in memory ina stack frame, but the data can’t be serialized and/or memory allocation is hard.
As an example, let’s look at the SimProcedure that angr uses internally to run all the shared library initializers for afull_init_state for a linux program:class LinuxLoader(angr.SimProcedure):
NO_RET = True
IS_FUNCTION = True
local_vars = ('initializers',)
def run(self):
self.initializers = self.project.loader.initializers
self.run_initializer()def run_initializer(self):
if len(self.initializers) == 0:
self.project._simos.set_entry_register_values(self.state)
self.jump(self.project.entry)else:
addr = self.initializers[0]self.initializers = self.initializers[1:]self.call(addr, (self.state.posix.argc, self.state.posix.argv, self.state.
˓→posix.environ), 'run_initializer')
This is a particularly clever usage of the SimProcedure continuations. First, notice that the current project is available foruse on the procedure instance. This is some powerful stuff you can get yourself into; for safety you generally only want
6.1. Hooks and SimProcedures

95

angr

to use the project as a read-only or append-only data structure. Here we’re just getting the list of dynamic initializers
from the loader. Then, for as long as the list isn’t empty, we pop a single function pointer out of the list, being careful
not to mutate the list, since the list object is shared across states, and then call it, returning to the run_initializer
function again. When we run out of initializers, we set up the entry state and jump to the program entry point.
Very cool!

6.1.5 Global Variables
As a brief aside, you can store global variables in state.globals. This is a dictionary that just gets shallow-copiedfrom state to successor state. Because it’s only a shallow copy, its members are the same instances, so the same rules
as local variables in SimProcedure continuations apply. You need to be careful not to mutate any item that is used as a
global variable unless you know exactly what you’re doing.

6.1.6 Helping out static analysis
We’ve already looked at the class variable IS_FUNCTION, which allows you to use the SimProcedure continuation.
There are a few more class variables you can set, though these ones have no direct benefit to you - they merely markattributes of your function so that static analysis knows what it’s doing.
• NO_RET: Set this to true if control flow will never return from this function• ADDS_EXITS: Set this to true if you do any control flow other than returning• IS_SYSCALL: Self-explanatory
Furthermore, if you set ADDS_EXITS = True, you’ll need to define the method static_exits(). This function takes
a single parameter, a list of IRSBs that would be executed in the run-up to your function, and asks you to return a listof all the exits that you know would be produced by your function in that case. The return value is expected to be a listof tuples of (address (int), jumpkind (str)). This is meant to be a quick, best-effort analysis, and you shouldn’t try to do
anything crazy or intensive to get your answer.

6.1.7 User Hooks
The process of writing and using a SimProcedure makes a lot of assumptions that you want to hook over a wholefunction. What if you don’t? There’s an alternate interface for hooking, a user hook, that lets you streamline theprocess of hooking sections of code.
>>> @project.hook(0x1234, length=5)... def set_rax(state):...
state.regs.rax = 1
This is a lot simpler! The idea is to use a single function instead of an entire SimProcedure subclass. No extraction ofarguments is performed, no complex control flow happens.
Control flow is controlled by the length argument. After the function finishes executing in this example, the next step
will start at 5 bytes after the hooked address. If the length argument is omitted or set to zero, execution will resume
executing the binary code at exactly the hooked address, without re-triggering the hook. The Ijk_NoHook jumpkind
allows this to happen.
If you want more control over control flow coming out of a user hook, you can return a list of successor states. Eachsuccessor will be expected to have state.regs.ip, state.scratch.guard, and state.scratch.jumpkind set.
The IP is the target instruction pointer, the guard is a symbolic boolean representing a constraint to add to the state related
to it being taken as opposed to the others, and the jumpkind is a VEX enum string, like Ijk_Boring, representing thenature of the branch.
The general rule is, if you want your SimProcedure to either be able to extract function arguments or cause a program
return, write a full SimProcedure class. Otherwise, use a user hook.

96

Chapter 6. Extending angr

angr

6.1.8 Hooking Symbols
As you should recall from the section on loading a binary, dynamically linked programs have a list of symbols thatthey must import from the libraries they have listed as dependencies, and angr will make sure, rain or shine, that every
import symbol gets resolved by some address, whether it’s a real implementation of the function or just a dummy
address hooked with a do-nothing stub. As a result, you can just use the Project.hook_symbol API to hook theaddress referred to by a symbol!
This means that you can replace library functions with your own code. For instance, to replace rand() with a functionthat always returns a consistent sequence of values:>>> class NotVeryRand(SimProcedure):...
def run(self, return_values=None):...
rand_idx = self.state.globals.get('rand_idx', 0) % len(return_values)...
out = return_values[rand_idx]...
self.state.globals['rand_idx'] = rand_idx + 1...
return out>>> project.hook_symbol('rand', NotVeryRand(return_values=[413, 612, 1025, 1111]))
Now, whenever the program tries to call rand(), it’ll return the integers from the return_values array in a loop.

6.2 State Plugins
If you want to store some data on a state and have that information propagated from successor to successor, the easiest
way to do this is with state.globals. However, this can become obnoxious with large amounts of interesting data,
doesn’t work at all for merging states, and isn’t very object-oriented.
The solution to these problems is to write a State Plugin - an appendix to the state that holds data and implements aninterface for dealing with the lifecycle of a state.

6.2.1 My First Plugin
Let’s get started! All state plugins are implemented as subclasses of SimStatePlugin. Once you’ve read this document, you can use the API reference for this class angr.state_plugins.plugin.SimStatePlugin to quickly
review the semantics of all the interfaces you should implement.
The most important method you need to implement is copy: it should be annotated with the memo staticmethod andtake a dict called the “memo”—these’ll be important later—and returns a copy of the plugin. Short of that, you can dowhatever you want. Just make sure to call the superclass initializer!
>>> import angr>>> class MyFirstPlugin(angr.SimStatePlugin):...
def __init__(self, foo):...
super(MyFirstPlugin, self).__init__()...
self.foo = foo...
...
@angr.SimStatePlugin.memo...
def copy(self, memo):...
return MyFirstPlugin(self.foo)>>> state = angr.SimState(arch='AMD64')>>> state.register_plugin('my_plugin', MyFirstPlugin('bar'))>>> assert state.my_plugin.foo == 'bar'(continues on next page)

6.2. State Plugins

97

angr

(continued from previous page)>>> state2 = state.copy()>>> state.my_plugin.foo = 'baz'>>> state3 = state.copy()>>> assert state2.my_plugin.foo == 'bar'>>> assert state3.my_plugin.foo == 'baz'
It works! Note that plugins automatically become available as attributes on the state. state.get_plugin(name) is
also available as a more programmatic interface.

6.2.2 Where’s the state?
State plugins have access to the state, right? So why isn’t it part of the initializer? It turns out, there are a plethoraof issues related to initialization order and dependency issues, so to simplify things as much as possible, the state is
not part of the initializer but is rather set onto the state in a separate phase, by using the set_state method. You canoverride this state if you need to do things like propagate the state to subcomponents or extract architectural information.
>>> def set_state(self, state):...
super(SimStatePlugin, self).set_state(state)...
self.symbolic_word = claripy.BVS('my_variable', self.state.arch.bits)
Note the self.state! That’s what the super set_state sets up.
However, there’s no guarantee on what order the states will be set onto the plugins in, so if you need to interact withother plugins for initialization, you need to override the init_state method.
Once again, there’s no guarantee on what order these will be called in, so the rule is to make sure you set yourself up
good enough during set_state so that if someone else tries to interact with you, no type errors will happen. Here’s
an example of a good use of init_state, to map a memory region in the state. The use of an instance variable(presumably copied as part of copy()) ensures this only happens the first time the plugin is added to a state.
>>> def init_state(self):...
if self.region is None:...
self.region = self.state.memory.map_region(SOMEWHERE, 0x1000, 7)
Note: weak references
self.state is not the state itself, but rather a weak proxy to the state. You can still use this object as a normal state,
but attempts to store it persistently will not work.

6.2.3 Merging
The other element besides copying in the state lifecycle is merging. As input you get the plugins to merge and a listof “merge conditions” - symbolic booleans that are the “guard conditions” describing when the values from each stateshould actually apply.
The important properties of the merge conditions are:
• They are mutually exclusive and span an entire domain - exactly one may be satisfied at once, and there will be
additional constraints to ensure that at least one must be satisfied.
• len(merge_conditions) == len(others) + 1, since self counts too.
• zip(merge_conditions, [self] + others) will correctly pair merge conditions with plugins.
During the merge function, you should mutate self to become the merged version of itself and all the others, withrespect to the merge conditions. This involves using the if-then-else structure that claripy provides. Here is an example

98

Chapter 6. Extending angr

angrof constructing this merged structure by merging a bitvector instance variable called myvar, producing a binary tree of
if-then-else expressions searching for the correct condition:for other_plugin, condition in zip(others, merge_conditions[1:]): # chop off self's␣
˓→condition
self.myvar = claripy.If(condition, other_plugin.myvar, self.myvar)This is such a common construction that we provide a utility to perform it automatically: claripy.ite_cases. The
following code snippet is identical to the previous one:self.myvar = claripy.ite_cases(zip(merge_conditions[1:], [o.myvar for o in others]),␣
˓→self.myvar)
Keep in mind that like the rest of the top-level claripy functions, ite_cases and If are also available from state.
solver, and these versions will perform SimActionObject unwrapping if applicable.
Common Ancestor
The full prototype of the merge interface is def merge(self, others, merge_conditions,common_ancestor=None). others and merge_conditions have been discussed in depth already.
The common ancestor is the instance of the plugin from the most recent common ancestor of the states being merged.
It may not be available for all merges, in which case it will be None. There are no rules for how exactly you should use
this to improve the quality of your merges, but you may find it useful in more complex setups.

6.2.4 Widening
There is another kind of merging called widening which takes several states and produces a more general state. It is
used during static analysis.
v TodoExplain what this means

6.2.5 Serialization
In order to support serialization of states which contain your plugin, you should implement the__getstate__/__setstate__ magic method pair. Keep in mind the following guidelines:• Your serialization result should not include the state.
• After deserialization, set_state() will be called again.
This means that plugins are “detached” from the state and serialized in an isolated environment, and then reattached tothe state on deserialization.

6.2.6 Plugins all the way down
You may have components within your state plugins which are large and complicated and start breaking objectorientation in order to make copy/merge work well with the state lifecycle. You’re in luck! Things can be state plugins
even if they aren’t directly attached to a state. A great example of this is SimFile, which is a state plugin but is stored
in the filesystem plugin, and is never used with SimState.register_plugin. When you’re doing this, there are ahandful of rules to remember which will keep your plugins safe and happy:• Annotate your copy function with @SimStatePlugin.memo.

6.2. State Plugins

99

angr

• In order to prevent divergence while copying multiple references to the same plugin, make sure you’re passing
the memo (the argument to copy) to the .copy of any subplugins. This with the previous point will preserve
object identity.
• In order to prevent duplicate merging while merging multiple references to the same plugin, there should be aconcept of the “owner” of each instance, and only the owner should run the merge routine.
• While passing arguments down into sub-plugins merge() routines, make sure you unwrap others andcommon_ancestor into the appropriate types. For example, if PluginA contains a PluginB, the former should
do the following:>>> def merge(self, others, merge_conditions, common_ancestor=None):...
# ... merge self...
self.plugin_b.merge([o.plugin_b for o in others], merge_conditions,...
common_ancestor=None if common_ancestor is None else common_ancestor.plugin_
˓→b)

6.2.7 Setting Defaults
To make it so that a plugin will automatically become available on a state when requested, without having to register
it with the state first, you can register it as a default. The following code example will make it so that whenever youaccess state.my_plugin, a new instance of MyPlugin will be instantiated and registered with the state.
MyPlugin.register_default('my_plugin')

6.3 Extending the Environment Model
One of the biggest issues you may encounter while using angr to analyze programs is an incomplete model of theenvironment, or the APIs, surrounding your program. This usually takes the form of syscalls or dynamic library calls,
or in rare cases, loader artifacts. angr provides a convenient interface to do most of these things!
Everything discussed here involves writing SimProcedures, so make sure you know how to do that!.
Note that this page should be treated as a narrative document, not a reference document, so you should read it at least
once start to end.

6.3.1 Setup
You probably want to have a development install of angr, i.e. set up with the script in the angr-dev repository. It isremarkably easy to add new API models by just implementing them in certain folders of the angr repository. This isalso desirable because any work you do in this field will almost always be useful to other people, and this makes it
extremely easy to submit a pull request.
However, if you want to do your development out-of-tree, you want to work against a production version of angr, or you
want to make customized versions of already-implemented API functions, there are ways to incorporate your extensions
programmatically. Both these techniques, in-tree and out-of-tree, will be documented at each step.

6.3.2 Dynamic library functions - import dependencies
This is the easiest case, and the case that SimProcedures were originally designed for.
First, you need to write a SimProcedure representing the function. Then you need to let angr know about it.

100

Chapter 6. Extending angr

angrCase 1, in-tree development: SimLibraries and catalogues
angr has a magical folder in its repository, angr/procedures. Within it are all the SimProcedure implementations thatcome bundled with angr as well as information about what libraries implement what functions.
Each folder in the procedures directory corresponds to some sort of standard, or a body that specifies the interface partof an API and its semantics. We call each folder a catalog of procedures. For example, we have libc which contains
the functions defined by the C standard library, and a separate folder posix which contains the functions defined by
the posix standard. There is some magic which automatically scrapes these folders in the procedures directory andorganizes them into the angr.SIM_PROCEDURES dict. For example, angr/procedures/libc/printf.py contains
both class printf and class __printf_chk, so there exists both angr.SIM_PROCEDURES['libc']['printf']
and angr.SIM_PROCEDURES['libc']['__printf_chk'].
The purpose of this categorization is to enable easy sharing of procedures among different libraries. For example.
libc.so.6 contains all the C standard library functions, but so does msvcrt.dll! These relationships are represented with
objects called SimLibraries which represent an actual shared library file, its functions, and their metadata. Take alook at the API reference for SimLibrary along with the code for setting up glibc to learn how to use it.
SimLibraries are defined in a special folder in the procedures directory, procedures/definitions. Files inhere should contain an instance, not a subclass, of SimLibrary. The same magic that scrapes up SimProcedures
will also scrape up SimLibraries and put them in angr.SIM_LIBRARIES, keyed on each of their common names.
For example, angr/procedures/definitions/linux_loader.py contains lib = SimLibrary(); lib.
set_library_names('ld.so', 'ld-linux.so', 'ld.so.2', 'ld-linux.so.2', 'ld-linux-x86_64.
so.2'), so you can access it via angr.SIM_LIBRARIES['ld.so'] or angr.SIM_LIBRARIES['ld-linux.so']or any of the other names.
At load time, all the dynamic library dependencies are looked up in SIM_LIBRARIES and their procedures (or stubs!)
are hooked into the project’s address space to summarize any functions it can. The code for this process is found here.
SO, the bottom line is that you can just write your own SimProcedure and SimLibrary definitions, drop them into thedirectory structure, and they’ll automatically be applied. If you’re adding a procedure to an existing library, you canjust drop it into the appropriate catalog and it’ll be picked up by all the libraries using that catalog, since most libraries
construct their list of function implementation by batch-adding entire catalogs.
Case 2, out-of-tree development, tight integration
If you’d like to implement your procedures outside the angr repository, you can do that. You effectively do this byjust manually adding your procedures to the appropriate SimLibrary. Just call angr.SIM_LIBRARIES[libname].
add(name, proc_cls) to do the registration.
Note that this will only work if you do this before the project is loaded with angr.Project. Note also that adding theprocedure to angr.SIM_PROCEDURES, i.e. adding it directly to a catalog, will not work, since these catalogs are used
to construct the SimLibraries only at import and are used by value, not by reference.
Case 3, out-of-tree development, loose integration
Finally, if you don’t want to mess with SimLibraries at all, you can do things purely on the project level with
hook_symbol().

6.3.3 Syscalls
Unlike dynamic library methods, syscall procedures aren’t incorporated into the project via hooks. Instead, whenevera syscall instruction is encountered, the basic block should end with a jumpkind of Ijk_Sys. This will cause the next
step to be handled by the SimOS associated with the project, which will extract the syscall number from the state andquery a specialized SimLibrary with that.
This deserves some explanation.

6.3. Extending the Environment Model

101

angr

There is a subclass of SimLibrary called SimSyscallLibrary which is used for collecting all the functions that are partof an operating system’s syscall interface. SimSyscallLibrary uses the same system for managing implementations andmetadata as SimLibrary, but adds on top of it a system for managing syscall numbers for multiple ABIs (application
binary interfaces, like an API but lower level). The best example for an implementation of a SimSyscallLibrary is
the linux syscalls. It keeps its procedures in a normal SimProcedure catalog called linux_kernel and adds them tothe library, then adds several syscall number mappings, including separate mappings for mips-o32, mips-n32, andmips-n64.
In order for syscalls to be supported in the first place, the project’s SimOS must inherit from SimUserland, itself
a SimOS subclass. This requires the class to call SimUserland’s constructor with a super() call that includes thesyscall_library keyword argument, specifying the specific SimSyscallLibrary that contains the appropriate procedures and mappings for the operating system. Additionally, the class’s configure_project must perform a super()call including the abi_list keyword argument, which contains the list of ABIs that are valid for the current architecture. If the ABI for the syscall can’t be determined by just the syscall number, for example, that amd64 linux programs
can use either int 0x80 or syscall to invoke a syscall and these two ABIs use overlapping numbers, the SimOS caloverride syscall_abi(), which takes a SimState and returns the name of the current syscall ABI. This is determined
for int80/syscall by examining the most recent jumpkind, since libVEX will produce different syscall jumpkinds for thedifferent instructions.
Calling conventions for syscalls are a little weird right now and they ought to be refactored. The current situation requires that angr.SYSCALL_CC be a map of maps {arch_name: {os_name: cc_cls}}, where os_nameis the value of project.simos.name, and each of the calling convention classes must include an extra method
called syscall_number which takes a state and return the current syscall number. Look at the bottom of calling_conventions.py to learn more about it. Not very object-oriented at all. . .
As a side note, each syscall is given a unique address in a special object in CLE called the “kernel object”. Upon asyscall, the address for the specific syscall is set into the state’s instruction pointer, so it will show up in the logs. These
addresses are not hooked, they are just used to identify syscalls during analysis given only an address trace. The testfor determining if an address corresponds to a syscall is project.simos.is_syscall_addr(addr) and the syscallcorresponding to the address can be retrieved with project.simos.syscall_from_addr(addr).
Case 1, in-tree development
SimSyscallLibraries are stored in the same place as the normal SimLibraries, angr/procedures/definitions.
These libraries don’t have to specify any common name, but they can if they’d like to show up in SIM_LIBRARIES
for easy access.
The same thing about adding procedures to existing catalogs of dynamic library functions also applies to syscalls implementing a linux syscall is as easy as writing the SimProcedure and dropping the implementation into angr/procedures/linux_kernel. As long as the class name matches one of the names in the number-to-name mappingof the SimLibrary (all the linux syscall numbers are included with recent releases of angr), it will be used.
To add a new operating system entirely, you need to implement the SimOS as well, as a subclass of SimUserland. To
integrate it into the tree, you should add it to the simos directory, but this is not a magic directory like procedures.
Instead, you should add a line to angr/simos/__init__.py calling register_simos() with the OS name as it
appears in project.loader.main_object.os and the SimOS class. Your class should do everything describedabove.
Case 2, out-of-tree development, tight integration
You can add syscalls to a SimSyscallLibrary the same way you can add functions to a normal SimLibrary, by tweaking
the entries in angr.SIM_LIBRARIES. If you’re this for linux you want angr.SIM_LIBRARIES['linux'].add(name,proc_cls).
You can register a SimOS with angr from out-of-tree as well - the same register_simos method is just sitting there
waiting for you as angr.simos.register_simos(name, simos_cls).

102

Chapter 6. Extending angr

angrCase 3, out-of-tree development, loose integration
The SimSyscallLibrary the SimOS uses is copied from the original during setup, so it is safe to mutate. You can directly
fiddle with project.simos.syscall_library to manipulate an individual project’s syscalls.
You can provide a SimOS class (not an instance) directly to the Project constructor via the simos keyword argument,
so you can specify the SimOS for a project explicitly if you like.

6.3.4 SimData
What about when there is an import dependency on a data object? This is easily resolved when the given library is
actually loaded into memory - the relocation can just be resolved as normal. However, when the library is not loaded(for example, auto_load_libs=False, or perhaps some dependency is simply missing), things get tricky. It is notpossible to guess in most cases what the value should be, or even what its size should be, so if the guest program everdereferences a pointer to such a symbol, emulation will go off the rails.
CLE will warn you when this might happen:[22:26:58] [cle.backends.externs] | WARNING: Symbol was allocated without a known size;␣
˓→emulation will fail if it is used non-opaquely: _rtld_global[22:26:58] [cle.backends.externs] | WARNING: Symbol was allocated without a known size;␣
˓→emulation will fail if it is used non-opaquely: __libc_enable_secure[22:26:58] [cle.backends.externs] | WARNING: Symbol was allocated without a known size;␣
˓→emulation will fail if it is used non-opaquely: _rtld_global_ro[22:26:58] [cle.backends.externs] | WARNING: Symbol was allocated without a known size;␣
˓→emulation will fail if it is used non-opaquely: _dl_argv
If you see this message and suspect it is causing issues (i.e. the program is actually introspecting the value of thesesymbols), you can resolve it by implementing and registering a SimData class, which is like a SimProcedure but fordata. Simulated data. Very cool.
A SimData can effectively specify some data that must be used to provide an unresolved import symbol. It has a numberof mechanisms to make this more useful, including the ability to specify relocations and subdependencies.
Look at the SimData cle.backends.externs.simdata.SimData class reference and the existing SimData subclasses for guidelines on how to do this.

6.4 Writing Analyses
An analysis can be created by subclassing the angr.Analysis class. In this section, we’ll create a mock analysis toshow off the various features. Let’s start with something simple:>>> import angr>>> class MockAnalysis(angr.Analysis):...
def __init__(self, option):...
self.option = option>>> angr.AnalysesHub.register_default('MockAnalysis', MockAnalysis) # register the class␣˓→with angr's global analysis list
This is a very simple analysis – it takes an option, and stores it. Of course, it’s not useful, but this is just a demonstration.
Let’s see how to run our new analysis:

6.4. Writing Analyses

103

angr

>>> proj = angr.Project("/bin/true")>>> mock = proj.analyses.MockAnalysis('this is my option')>>> assert mock.option == 'this is my option'

6.4.1 Working with projects
Via some Python magic, your analysis will automatically have the project upon which you are running it under theself.project property. Use this to interact with your project and analyze it!
>>> class ProjectSummary(angr.Analysis):...
def __init__(self):...
self.result = 'This project is a %s binary with an entry point at %#x.' %␣
˓→(self.project.arch.name, self.project.entry)>>> angr.AnalysesHub.register_default('ProjectSummary', ProjectSummary)>>> proj = angr.Project("/bin/true")>>> summary = proj.analyses.ProjectSummary()>>> print(summary.result)This project is a AMD64 binary with an entry point at 0x401410.

6.4.2 Analysis Resilience
Sometimes, your (or our) code might suck and analyses might throw exceptions. We understand, and we also understandthat oftentimes a partial result is better than nothing. This is specifically true when, for example, running an analysis on
all of the functions in a program. Even if some of the functions fails, we still want to know the results of the functions
that do not.
To facilitate this, the Analysis base class provides a resilience context manager under self._resilience. Here’s
an example:>>> class ComplexFunctionAnalysis(angr.Analysis):...
def __init__(self):...
self._cfg = self.project.analyses.CFG()...
self.results = { }...
for addr, func in self._cfg.function_manager.functions.items():...
with self._resilience():...
if addr % 2 == 0:...
raise ValueError("can't handle functions at even addresses")
...
else:
...
self.results[addr] = "GOOD"
The context manager catches any exceptions thrown and logs them (as a tuple of the exception type, message, andtraceback) to self.errors. These are also saved and loaded when the analysis is saved and loaded (although thetraceback is discarded, as it is not picklable).
You can tune the effects of the resilience with two optional keyword parameters to self._resilience().
The first is name, which affects where the error is logged. By default, errors are placed in self.errors, but if nameis provided, then instead the error is logged to self.named_errors, which is a dict mapping name to a list of all theerrors that were caught under that name. This allows you to easily tell where thrown without examining its traceback.
The second argument is exception, which should be the type of the exception that resilience should catch. Thisdefaults to Exception, which handles (and logs) almost anything that could go wrong. You can also pass a tuple ofexception types to this option, in which case all of them will be caught.
104

Chapter 6. Extending angr

angrUsing resilience has a few advantages:
1. Your exceptions are gracefully logged and easily accessible afterwards. This is really nice for writing testcases.
2. When creating your analysis, the user can pass fail_fast=True, which transparently disable the resilience,
which is really nice for manual testing.
3. It’s prettier than having try except everywhere.
Have fun with analyses! Once you master the rest of angr, you can use analyses to understand anything computable!

6.5 Scripting angr management. Warning
Please note that the documentation and the API for angr management are highly in-flux. You will need to spend
time reading the source code. Grep is your friend. If you have questions, please ask in the angr slack.
If you build something which uses an API and you want to make sure it doesn’t break, you can contribute a testcase
for the API!
This codebase is absolutely filled to the brim with one-off hacks. If you see some code and think, “hm, that doesn’t
seem like an extensible or best-practices way to code that”, you’re probably right. Cleaning up angr management’s
code is a top priority for us, so if you have some ideas to fix these sorts of issues, please let us know, either in anissue or a pull request!

6.5.1 The console, and the basic objects
angr management opens with an IPython console ready for input. This console has in its namespace several objects
which are important for manipulating angr management and its data.
• First, the main_window. This is the QMainWindow instance for the application. It contains basic functions that
correspond to top-level buttons, such as loading a binary.
• Next, the workspace. This is a light object which coordinates the UI elements and manages the tabbed environment. You can use it to access any analysis-related GUI element, such as the disassembly view.
• Finally, the instance. This is angr management’s data model. It contains mechanisms for synchronizing components on shared data sources, as well as logic for creating long-running jobs.
workspace is also available as an attribute on main_window and instance is available as an attribute on workspace.
If you are programming in a namespace where none of these objects are available, you can import the angrmanagment.
logic.GlobalInfo object, which contains a reference to main_window.

6.5.2 The ObjectContainer
angr management uses a class called ObjectContainer to implement a pub-sub model and synchronize changing objectreferences. Let’s use instance.project as an example. This is an ObjectContainer that contains the current project.
You can use it in every way that you would normally use a project - you can access project.factory, project.kb,
etc. However, it also has two very important features that are helpful for building UIs.
First, the pub-sub model. You can subscribe to changes to this object by calling instance.project.
am_subscribe(callback). Then, you can notify listeners of changes by calling instance.project.am_event().
Note that events are NEVER automatically triggered - you must call am_event in order to trigger the callbacks. One
useful feature of this model is that you can provide arbitrary keyword arguments to am_event, and they will be passed
on to each callback. This means that you should always have your callbacks take **kwargs in order to account for unknown parameters. This feature is particularly useful to prevent feedback loops - if you ever find yourself in a situation

6.5. Scripting angr management

105

angr

where you need to broadcast an event from your callback, you can add an argument that you can use as a flag not torecurse any further.
Next, object reference mutability. Let’s say you have a widget that displays information about the project. Following theprinciple of least access, you should only provide as much information as is necessary to do the job - in this case, justthe project object. If you provide the basic project object, this will cause issues when a new project is loaded. Notably,
there will be a dangling reference held to the original project, preventing it from being garbage collected, and the widget
will not update, continuing to show the old project’s information. Now, if you provide the project’s ObjectContainer, a
new project can be created and inserted into the container and the reference will instantly be available to your widget.
If you ever wanted to load a new project yourself, all you have to do is assign to instance.project.am_obj and thensend off an event. Combined with the event publication model, this provides an efficient way to build responsive UIs
that follow the principle of least access.
One important way that you can’t use the object container the same way that you would a normal object is that isNone will obviously not work. To resolve this, you can use instance.project.am_none - this will be True when no
project is loaded.
One interesting feature of the ObjectContainer is that they can nest. If you have a container which contains a container
which contains an object, any events sent to the inner container will also be sent to subscribers to the outer container.
This allows patterns such as the list of SimStates actually containing a list of ObjectContainers which contain states,
and the “current state” container actually contains one of these containers. The result of this is that UI elements caneither subscribe to the current state, no matter
A full list of standard ObjectContainers that can be found in the instance __init__ method. There are more containers
floating around for synchronizing on non-global elements - for example, the current state of the disassembly view is
synchronized through its InfoDock object. Given a disassembly view instance, you can subscribe to, for example, its
current selected instructions through view.infodock.selected_insns.

6.5.3 Manipulating UI elements
The workspace contains methods to manipulate UI elements. Notably, you can manipulate all open tabs with theworkspace.view_manager reference. Additionally, you can pass any sort of object you like to workspace.viz() andit will attempt to visualize the object in the current window.

6.5.4 Writing plugins
angr management has a very flexible plugin framework. A plugin is a Python file containing a subclass ofangrmanagement.plugins.BasePlugin. Plugin files will be automatically loaded from the plugins module ofangr management, and also from ~/.local/share/angr-management/plugins. These paths are configurable
through the program configuration, but at the time of writing, this is not exposed in the UI.
The best way to see the tools you can use while building a plugin is to read the plugin base class source code. Any
method or attribute can be overridden from a base class and will be automatically called on relevant events.

6.5.5 Writing tests
Look at the existing tests for examples. Generally, you can test UI components by creating the component and driving
input to it via QTest. You can create a headless MainWindow instance by passing show=False to its constructor - thiswill also get you access to a workspace and an instance.

106

Chapter 6. Extending angr

CHAPTERSEVENANGR EXAMPLES

To help you get started with angr, we’ve created several examples. We’ve tried to organize them into major categories,
and briefly summarize that each example will expose you to. Enjoy!
If you want a high-level cheatsheet of the “techniques” used in the examples, see the angr strategies cheatsheet by
Florent Bordignon.
To jump to a specific category:• Introduction - examples showing off the very basics of angr’s functionality• Reversing - examples showing angr being used in reverse engineering tasks• Vulnerability Discovery - examples of angr being used to search for vulnerabilities• Exploitation - examples of angr being used as an exploitation assistance tool

7.1 Introduction
These are some introductory examples to give an idea of how to use angr’s API.

7.1.1 Fauxware
This is a basic script that explains how to use angr to symbolically execute a program and produce concrete input
satisfying certain conditions.
Binary, source, and script are found here.

7.2 Reversing
These are examples that use angr to solve reverse engineering challenges. There are a lot of these. We’ve chosen themost unique ones, and relegated the rest to the CTF Challenges section below.

7.2.1 Beginner reversing example: little_engine
Script author: Michael Reeves (github: @mastermjr)
Script runtime: 3 min 26 seconds (206 seconds)
Concepts presented:
stdin constraining, concrete optimization with Unicorn
This challenge is similar to the csaw challenge below, however the reversing is much more simple. The original code,
solution, and writeup for the challenge can be found at the b01lers github here.
The angr solution script is here and the binary is here.

107

angr

7.2.2 Whitehat CTF 2015 - Crypto 400
Script author: Yan Shoshitaishvili (github: @Zardus)
Script runtime: 30 seconds
Concepts presented: statically linked binary (manually hooking with function summaries),␣
˓→commandline argument, partial solutions
We solved this crackme with angr’s help. The resulting script will help you understand how angr can be used forcrackme assistance, not a full-out solve. Since angr cannot solve the actual crypto part of the challenge, we use it justto reduce the keyspace, and brute-force the rest.
You can find this script here and the binary here.

7.2.3 CSAW CTF 2015 Quals - Reversing 500, “wyvern”
Script author: Audrey Dutcher (github: @rhelmot)
Script runtime: 15 mins
Concepts presented: stdin constraining, concrete optimization with Unicorn
angr can outright solve this challenge with very little assistance from the user. The script to do so is here
<https://github.com/angr/angr-examples/tree/master/examples/csaw_wyvern/solve.py>_ and the binary is here.

7.2.4 TUMCTF 2016 - zwiebel
Script author: Fish
Script runtime: 2 hours 31 minutes with pypy and Unicorn - expect much longer with␣
˓→CPython only
Concepts presented: self-modifying code support, concrete optimization with Unicorn
This example is of a self-unpacking reversing challenge. This example shows how to enable Unicorn support and selfmodification support in angr. Unicorn support is essential to solve this challenge within a reasonable amount of time
- simulating the unpacking code symbolically is very slow. Thus, we execute it concretely in unicorn/qemu and only
switch into symbolic execution when needed.
You may refer to other writeup about the internals of this binary. I didn’t reverse too much since I was pretty confident
that angr is able to solve it :-)The long-term goal of optimizing angr is to execute this script within 10 minutes. Pretty ambitious :P
Here is the binary and the script.

7.2.5 FlareOn 2015 - Challenge 5
Script author: Adrian Tang (github: @tangabc)
Script runtime: 2 mins 10 secs
Concepts presented: Windows support
This is another reversing challenge from the FlareOn challenges.
“The challenge is designed to teach you about PCAP file parsing and traffic decryption by reverse engineering an
executable used to generate it. This is a typical scenario in our malware analysis practice where we need to figure out
precisely what the malware was doing on the network”
For this challenge, the author used angr to represent the desired encoded output as a series of constraints for the SAT
solver to solve for the input.
For a detailed write-up please visit the author’s post here and you can also find the solution from the FireEye here
108

Chapter 7. angr examples

angr

7.2.6 0ctf quals 2016 - trace
Script author: WGH (wgh@bushwhackers.ru)
Script runtime: 1 min 50 secs (CPython 2.7.10), 1 min 12 secs (PyPy 4.0.1)
Concepts presented: guided symbolic tracing
In this challenge we’re given a text file with trace of a program execution. The file has two columns, address andinstruction executed. So we know all the instructions being executed, and which branches were taken. But the initial
data is not known.
Reversing reveals that a buffer on the stack is initialized with known constant string first, then an unknown string isappended to it (the flag), and finally it’s sorted with some variant of quicksort. And we need to find the flag somehow.
angr easily solves this problem. We only have to direct it to the right direction at every branch, and the solver finds theflag at a glance.
Files are here.

7.2.7 ASIS CTF Finals 2015 - license
Script author: Fish Wang (github: @ltfish)
Script runtime: 3.6 sec
Concepts presented: using the filesystem, manual symbolic summary execution
This is a crackme challenge that reads a license file. Rather than hooking the read operations of the flag file, we actually
pass in a filesystem with the correct file created.
Here is the binary and the script.

7.2.8 DEFCON Quals 2017 - Crackme2000
Script author: Shellphish
Script runtime: varies, but on the order of seconds
Concepts presented: automated reverse engineering
DEFCON Quals had a whole category for automatic reversing in 2017. Our scripts are here.

7.3 Vulnerability Discovery
These are examples of angr being used to identify vulnerabilities in binaries.

7.3.1 Beginner vulnerability discovery example: strcpy_find
Script author: Kyle Ossinger (github: @k0ss)
Concepts presented: exploration to vulnerability, programmatic find condition
This is the first in a series of “tutorial scripts” I’ll be making which use angr to find exploitable conditions in binaries.
The first example is a very simple program. The script finds a path from the main entry point to strcpy, but only when
we control the source buffer of the strcpy operation. To hit the right path, angr has to solve for a password argument,
but angr solved this in less than 2 seconds on my machine using the standard Python interpreter. The script might looklarge, but that’s only because I’ve heavily commented it to be more helpful to beginners. The challenge binary is here
and the script is here.

7.3. Vulnerability Discovery

109

angr

7.3.2 CGC crash identification
Script author: Antonio Bianchi, Jacopo Corbetta
Concepts presented: exploration to vulnerability
This is a very easy binary containing a stack buffer overflow and an easter egg. CADET_00001 is one of the challenge
released by DARPA for the Cyber Grand Challenge: link The binary can run in the DECREE VM: link A copy ofthe original challenge and the angr solution is provided here CADET_00001.adapted (by Jacopo Corbetta) is the same
program, modified to be runnable in an Intel x86 Linux machine.

7.3.3 Grub “back to 28” bug
Script author: Audrey Dutcher (github: @rhelmot)
Concepts presented: unusual target (custom function hooking required), use of␣˓→exploration techniques to categorize and prune the program's state space
This is the demonstration presented at 32c3. The script uses angr to discover the input to crash grub’s password entry
prompt.
script - vulnerable module

7.4 Exploitation
These are examples of angr’s use as an exploitation assistance engine.

7.4.1 Insomnihack Simple AEG
Script author: Nick Stephens (github: @NickStephens)
Concepts presented: automatic exploit generation, global symbolic data tracking
Demonstration for Insomni’hack 2016. The script is a very simple implementation of AEG.
script7.4.2 SecuInside 2016 Quals - mbrainfuzz - symbolic exploration for exploitability
conditions
Script author: nsr (nsr@tasteless.eu)
Script runtime: ~15 seconds per binary
Concepts presented: symbolic exploration guided by static analysis, using the CFG
Originally, a binary was given to the ctf-player by the challenge-service, and an exploit had to be crafted automatically.
Four sample binaries, obtained during the ctf, are included in the example. All binaries follow the same format; thecommand-line argument is validated in a bunch of functions, and when every check succeeds, a memcpy() resulting
into a stack-based buffer overflow is executed. angr is used to find the way through the binary to the memcpy() and to
generate valid inputs to every checking function individually.
The sample binaries and the script are located here and additional information be found at the author’s Write-Up.

7.4.3 SECCON 2016 Quals - ropsynth
Script author: Yan Shoshitaishvili (github @zardus) and Nilo Redini
Script runtime: 2 minutes(continues on next page)

110

Chapter 7. angr examples

angr(continued from previous page)

Concepts presented: automatic ROP chain generation, binary modification, reasoning over␣˓→constraints, reasoning over action history
This challenge required the automatic generation of ropchains, with the twist that every ropchain was succeeded by an
input check that, if not passed, would terminate the application. We used symbolic execution to recover those checks,
removed the checks from the binary, used angrop to build the ropchains, and instrumented them with the inputs to pass
the checks.
The various challenge files are located here, with the actual solve script here.

7.4. Exploitation

111

angr

112

Chapter 7. angr examples

CHAPTEREIGHTFREQUENTLY ASKED QUESTIONSThis is a collection of commonly-asked “how do I do X?” questions and other general questions about angr, for those
too lazy to read this whole document.
If your question is of the form “how do I fix X issue after installing”, see also the Troubleshooting section of the:ref:`install instructions <Installing angr>`_.

8.1 Why is it named angr?
The core of angr’s analysis is on VEX IR, and when something is vexing, it makes you angry.

8.2 How should “angr” be stylized?
All lowercase, even at the beginning of sentences. It’s an anti-proper noun.

8.3 Why isn’t symbolic execution doing the thing I want?
The universal debugging technique for symbolic execution is as follows:• Check your simulation manager for errored states. print(simgr) is a good place to start, and if you see anything
to do with “errored”, go for print(simgr.errored).
• If you have any errored states and it’s not immediately obvious what you did wrong, you can get a pdb shell at
the crash site by going simgr.errored[n].debug().
• If no state has reached an address you care about, you should check the path each state has gone down: importpprint; pprint.pprint(state.history.descriptions.hardcopy). This will show you a high-levelsummary of what the symbolic execution engine did at each step along the state’s history. You will be able to seefrom this a basic block trace and also a list of executed simprocedures. If you’re using unicorn engine, you cancheck state.history.bbl_addrs.hardcopy to see what blocks were executed in each invocation of unicorn.
• If a state is going down the wrong path, you can check what constraints caused it to go that way: print(state.
solver.constraints). If a state has just gone past a branch, you can check the most recent branch condition
with state.history.events[-1].

8.4 How can I get diagnostic information about what angr is doing?
angr uses the standard logging module for logging, with every package and submodule creating a new logger.
The simplest way to get debug output is the following:

113

angr

import logging
logging.getLogger('angr').setLevel('DEBUG')
You may want to use INFO or whatever else instead. By default, angr will enable logging at the WARNING level.
Each angr module has its own logger string, usually all the Python modules above it in the hierarchy, plus itself, joinedwith dots. For example, angr.analyses.cfg. Because of the way the Python logging module works, you can set theverbosity for all submodules in a module by setting a verbosity level for the parent module. For example, logging.
getLogger('angr.analyses').setLevel('INFO') will make the CFG, as well as all other analyses, log at the
INFO level.

8.5 Why is angr so slow?
It’s complicated! Optimization considerations

8.6 How do I find bugs using angr?
It’s complicated! The easiest way to do this is to define a “bug condition”, for example, “the instruction pointer has
become a symbolic variable”, and run symbolic exploration until you find a state matching that condition, then dump
the input as a testcase. However, you will quickly run into the state explosion problem. How you address this is up
to you. Your solution may be as simple as adding an avoid condition or as complicated as implementing CMU’s
MAYHEM system as an Exploration Technique.

8.7 Why did you choose VEX instead of another IR (such as LLVM,
REIL, BAP, etc)?
We had two design goals in angr that influenced this choice:
1. angr needed to be able to analyze binaries from multiple architectures. This mandated the use of an IR to preserve
our sanity, and required the IR to support many architectures.
2. We wanted to implement a binary analysis engine, not a binary lifter. Many projects start and end with theimplementation of a lifter, which is a time consuming process. We needed to take something that existed andalready supported the lifting of multiple architectures.
Searching around the internet, the major choices were:• LLVM is an obvious first candidate, but lifting binary code to LLVM cleanly is a pain. The two solutions areeither lifting to LLVM through QEMU, which is hackish (and the only implementation of it seems very tightly
integrated into S2E), or McSema, which only supported x86 at the time but has since gone through a rewrite andgotten support for x86-64 and aarch64.
• TCG is QEMU’s IR, but extracting it seems very daunting as well and documentation is very scarce.
• REIL seems promising, but there is no standard reference implementation that supports all the architectures that
we wanted. It seems like a nice academic work, but to use it, we would have to implement our own lifters, which
we wanted to avoid.
• BAP was another possibility. When we started work on angr, BAP only supported lifting x86 code, and upto-date versions of BAP were only available to academic collaborators of the BAP authors. These were twodeal-breakers. BAP has since become open, but it still only supports x86_64, x86, and ARM.
• VEX was the only choice that offered an open library and support for many architectures. As a bonus, it is very
well documented and designed specifically for program analysis, making it very easy to use in angr.

114

Chapter 8. Frequently Asked Questions

angrWhile angr uses VEX now, there’s no fundamental reason that multiple IRs cannot be used. There are two parts ofangr, outside of the angr.engines.vex package, that are VEX-specific:• the jump labels (i.e., the Ijk_Ret for returns, Ijk_Call for calls, and so forth) are VEX enums.
• VEX treats registers as a memory space, and so does angr. While we provide accesses to state.regs.rax andfriends, on the backend, this does state.registers.load(8, 8), where the first 8 is a VEX-defined offset
for rax to the register file.
To support multiple IRs, we’ll either want to abstract these things or translate their labels to VEX analogues.

8.8 Why are some ARM addresses off-by-one?
In order to encode THUMB-ness of an ARM code address, we set the lowest bit to one. This convention comes from
LibVEX, and is not entirely our choice! If you see an odd ARM address, that just means the code at address - 1 isin THUMB mode.

8.9 How do I serialize angr objects?
Pickle will work. However, Python will default to using an extremely old pickle protocol that does not support more
complex Python data structures, so you must specify a more advanced data stream format. The easiest way to do thisis pickle.dumps(obj, -1).

8.10 What does UnsupportedIROpError("floating point support
disabled") mean?
This might crop up if you’re using a CGC analysis such as driller or rex. Floating point support in angr has been
disabled in the CGC analyses for a tight-knit nebula of reasons:• Libvex’s representation of floating point numbers is imprecise - it converts the 80-bit extended precision format
used by the x87 for computation to 64-bit doubles, making it impossible to get precise results• There is very limited implementation support in angr for the actual primitive operations themselves as reported
by libvex, so you will often get a less friendly “unsupported operation” error if you go too much further• For what operations are implemented, the basic optimizations that allow tractability during symbolic computation(AST deduplication, operation collapsing) are not implemented for floating point ops, leading to gigantic ASTs
• There are memory corruption bugs in z3 that get triggered frighteningly easily when you’re using huge workloads
of mixed floating point and bitvector ops. We haven’t been able to get a testcase that doesn’t involve “just run
angr” for the z3 guys to investigate.
Instead of trying to cope with all of these, we have simply disabled floating point support in the symbolic execution
engine. To allow for execution in the presence of floating point ops, we have enabled an exploration technique called thehttps://github.com/angr/angr/blob/master/angr/exploration_techniques/oppologist.py <oppologist> that is supposed
to catch these issues, concretize their inputs, and run the problematic instructions through qemu via unicorn engine,
allowing execution to continue. The intuition is that the specific values of floating point operations don’t typically affectthe exploitation process.
If you’re seeing this error and it’s terminating the analysis, it’s probably because you don’t have unicorn installed orconfigured correctly. If you’re seeing this issue just in a log somewhere, it’s just the oppologist kicking in and you havenothing to worry about.

8.8. Why are some ARM addresses off-by-one?

115

angr

8.11 Why is angr’s CFG different from IDA’s?
Two main reasons:• IDA does not split basic blocks at function calls. angr will, because they are a form of control flow and basic
blocks end at control flow instructions. You generally do not need the supergraph for performing automatedanalyses.
• IDA will split basic blocks if another block jumps into the middle of it. This is called basic block normalization,
and angr does not do it by default since it is unnecessary for most static analyses. You may enable it by passing
normalize=True to the CFG analysis.

8.12 Why do I get incorrect register values when reading from a state
during a SimInspect breakpoint?
libVEX will eliminate duplicate register writes within a single basic block when optimizations are enabled. Turn off
IR optimization to make everything look right at all times.
In the case of the instruction pointer, libVEX will frequently omit mid-block writes even when optimizations are
disabled. In this case, you should use state.scratch.ins_addr to get the current instruction pointer.

116

Chapter 8. Frequently Asked Questions

CHAPTERNINE

APPENDIX

9.1 Cheatsheet
The following cheatsheet aims to give an overview of various things you can do with angr and act as a quick reference
to check the syntax for something without having to dig through the deeper docs.

9.1.1 General getting started
Some useful imports
import angr #the main framework
import claripy #the solver engine
Loading the binary
proj = angr.Project("/path/to/binary", auto_load_libs=False) # auto_load_libs False for␣
˓→improved performance

9.1.2 States
Create a SimState object
state = proj.factory.entry_state()

9.1.3 Simulation Managers
Generate a simulation manager object
simgr = proj.factory.simulation_manager(state)

9.1.4 Exploring and analysing states
Choosing a different Exploring strategy
simgr.use_technique(angr.exploration_techniques.DFS())
Symbolically execute until we find a state satisfying our find= and avoid= parametersavoid_addr = [0x400c06, 0x400bc7]
find_addr = 0x400c10d
simgr.explore(find=find_addr, avoid=avoid_addr)

117

angr

found = simgr.found[0] # A state that reached the find condition from explore
found.solver.eval(sym_arg, cast_to=bytes) # Return a concrete string value for the sym␣˓→arg to reach this state
Symbolically execute until lambda expression is True
simgr.step(until=lambda sm: sm.active[0].addr >= first_jmp)
This is especially useful with the ability to access the current STDOUT or STDERR (1 here is the File Descriptor for
STDOUT)
simgr.explore(find=lambda s: "correct" in s.posix.dumps(1))
Memory Management on big searches (Auto Drop Stashes):simgr.explore(find=find_addr, avoid=avoid_addr, step_func=lambda lsm: lsm.drop(stash=
˓→'avoid'))
Manually Exploring
simgr.step(step_func=step_func, until=lambda lsm: len(sm.found) > 0)
def step_func(lsm):
lsm.stash(filter_func=lambda state: state.addr == 0x400c06, from_stash='active', to_˓→stash='avoid')lsm.stash(filter_func=lambda state: state.addr == 0x400bc7, from_stash='active', to_˓→stash='avoid')lsm.stash(filter_func=lambda state: state.addr == 0x400c10, from_stash='active', to_˓→stash='found')return lsm
Enable Logging output from Simulation Manager:
import logging
logging.getLogger('angr.sim_manager').setLevel(logging.DEBUG)
StashesMove Stash:
simgr.stash(from_stash="found", to_stash="active")
Drop Stashes:simgr.drop(stash="avoid")

9.1.5 Constraint Solver (claripy)
Create symbolic object
sym_arg_size = 15 #Length in Bytes because we will multiply with 8 later
sym_arg = claripy.BVS('sym_arg', 8*sym_arg_size)
Restrict sym_arg to typical char range
118

Chapter 9. Appendix

angrfor byte in sym_arg.chop(8):initial_state.add_constraints(byte >= '\x20') # ' 'initial_state.add_constraints(byte <= '\x7e') # '~'Create a state with a symbolic argument
argv = [proj.filename]argv.append(sym_arg)
state = proj.factory.entry_state(args=argv)
Use argument for solving:
sym_arg = angr.claripy.BVS("sym_arg", flag_size * 8)argv = [proj.filename]argv.append(sym_arg)
initial_state = proj.factory.full_init_state(args=argv, add_options=angr.options.unicorn,
˓→ remove_options={angr.options.LAZY_SOLVES})

9.1.6 FFI and Hooking
Calling a function from ipython
f = proj.factory.callable(address)f(10)x=claripy.BVS('x', 64)
f(x) #TODO: Find out how to make that result readable
If what you are interested in is not directly returned because for example the function returns the pointer to a buffer you
can access the state after the function returns with>>> f.result_state<SimState @ 0x1000550>
Hooking
There are already predefined hooks for libc functions (useful for statically compiled libraries)
proj = angr.Project('/path/to/binary', use_sim_procedures=True)
proj.hook(addr, angr.SIM_PROCEDURES['libc']['atoi']())
Hooking with Simprocedure:class fixpid(angr.SimProcedure):
def run(self):
return 0x30
proj.hook(0x4008cd, fixpid())

9.1.7 Other useful tricks
Drop into an ipython if a ctr+c is received (useful for debugging scripts that are running forever)import signal
def killmyself():(continues on next page)

9.1. Cheatsheet

119

angr

(continued from previous page)os.system('kill %d' % os.getpid())
def sigint_handler(signum, frame):print 'Stopping Execution for Debug. If you want to kill the program issue:␣
˓→killmyself()'
if not "IPython" in sys.modules:
import IPython
IPython.embed()
signal.signal(signal.SIGINT, sigint_handler)
Get the calltrace of a state to find out where we got stuck
state = simgr.active[0]print state.callstackGet a basic block
block = proj.factory.block(address)
block.capstone.pp() # Capstone object has pretty print and other data about the␣˓→disassembly
block.vex.pp()# Print vex representation

9.1.8 State manipulation
Write to state:aaaa = claripy.BVV(0x41414141, 32) # 32 = Bitsstate.memory.store(0x6021f2, aaaa)
Read Pointer to Pointer from Frame:poi1 = new_state.solver.eval(new_state.regs.rbp)-0x10
poi1 = new_state.mem[poi1].long.concrete
poi1 += 0x8
ptr1 = new_state.mem[poi1].long.concrete
Read from State:
key = []
for i in range(38):
key.append(extractkey.mem[0x602140 + i*4].int.concrete)
Alternatively, the below expression is equivalent
key = extractkey.mem[0x602140].int.array(38).concrete

9.1.9 Debugging angr
Set Breakpoint at every Memory read/write:
new_state.inspect.b('mem_read', when=angr.BP_AFTER, action=debug_funcRead)def debug_funcRead(state):
print 'Read', state.inspect.mem_read_expr, 'from', state.inspect.mem_read_address

120

Chapter 9. Appendix

angr

Set Breakpoint at specific Memory location:
new_state.inspect.b('mem_write', mem_write_address=0x6021f1, when=angr.BP_AFTER,␣
˓→action=debug_funcWrite)

9.2 List of Claripy Operations
9.2.1 Arithmetic and Logic
Name

Description

ExampleLShR

Logically shifts an expression to the right. (the default shifts are arithmetic)
Rotates an expression left

x.LShR(10)Rotates an expression right

x.RotateRight(8)Logical And (on boolean expressions)
Logical Or (on boolean expressions)
Logical Not (on a boolean expression)
An If-then-else

solver.And(x == y, x > 0)solver.Or(x == y, y < 10)solver.Not(x == y) is the same as x != yChoose the maximum of two expressions:solver.If(x > y, x, y)
Check if x is less than or equal to y: x.ULE(y)Check if x is less than y: x.ULT(y)Check if x is greater than or equal to y: x.UGE(y)Check if x is greater than y: x.UGT(y)Check if x is less than or equal to y: x.SLE(y)Check if x is less than y: x.SLT(y)Check if x is greater than or equal to y: x.SGE(y)Check if x is greater than y: x.SGT(y)RotateLeft
RotateRight
And
Or
Not
If
ULE
ULT
UGE
UGT
SLE
SLT
SGE
SGT

Unsigned less than or equal to
Unsigned less than
Unsigned greater than or equal to
Unsigned greater thanSigned less than or equal toSigned less thanSigned greater than or equal toSigned greater thanx.RotateLeft(8)v TodoAdd the floating point ops

9.2.2 Bitvector Manipulation
Name

Description

SignExt Pad a bitvector on the left with n sign bits
ZePad a bitvector on the left with n zero bits
roExt
ExExtracts the given bits (zero-indexed from the right, inclusive)
tractfrom an expression.
ConConcatenates any number of expressions together into a new excat
pression.

9.2. List of Claripy Operations

Examplex.sign_extend(n)x.zero_extend(n)Extract the least significant byte of x:x[7:0]
x.concat(y, ...)

121

angr

9.2.3 Extra Functionality
There’s a bunch of prepackaged behavior that you could implement by analyzing the ASTs and composing sets ofoperations, but here’s an easier way to do it:• You can chop a bitvector into a list of chunks of n bits with val.chop(n)• You can endian-reverse a bitvector with x.reversed• You can get the width of a bitvector in bits with val.length• You can test if an AST has any symbolic components with val.symbolic• You can get a set of the names of all the symbolic variables implicated in the construction of an AST with
val.variables

9.3 List of State Options
9.3.1 State Modes
These may be enabled by passing mode=xxx to a state constructor.
Mode name

Description

symbolic
The default mode. Useful for most emulation and analysis tasks.
symbolic_approximating
Symbolic mode, but enables approximations for constraint solving.
staticA preset useful for static analysis. The memory model becomes an abstract region-mapping system, “fake return” successors skipping calls are added, and more.
fastpath
A preset for extremely lightweight static analysis. Executing will skip all intensive processing togive a quick view of the behavior of code.
tracing
A preset for attempting to execute concretely through a program with a given input. Enables
unicorn, enables resilience options, and will attempt to emulate access violations correctly.

9.3.2 Option Sets
These are sets of options, found as angr.options.xxx.
Set
name

Description

common_options
Options necessary for basic execution
symbolic Options necessary for basic symbolic execution
resilienceOptions that harden angr’s emulation against unsupported operations, attempting to carry on by treating
the result as an unconstrained symbolic value and logging the occasion to state.history.events.
refs
Options that cause angr to keep a log of all the memory, register, and temporary references completewith dependency information in history.actions. This option consumes a lot of memory, so be
careful!
approximation
Options that enable approximations of constraint solves via value-set analysis instead of calling into z3
simplification
Options that cause data to be run through z3’s simplifiers before it reaches memory or register storage
unicorn Options that enable the unicorn engine for executing on concrete data

122

Chapter 9. Appendix

angr

9.3.3 Options
These are individual option objects, found as angr.options.XXX.
Option name

Description

ABSTRACT_MEMORY
ABSTRACT_SOLVER
ACTION_DEPS
APPROXIMATE_GUARDSAPPROXIMATE_MEMORY_INDICESAPPROXIMATE_MEMORY_SIZESAPPROXIMATE_SATISFIABILITYAST_DEPS
AUTO_REFSAVOID_MULTIVALUED_READSAVOID_MULTIVALUED_WRITES
BEST_EFFORT_MEMORY_STORING
BREAK_SIRSB_END
BREAK_SIRSB_START
BREAK_SIRSTMT_END
BREAK_SIRSTMT_START
BYPASS_ERRORED_IRCCALLBYPASS_ERRORED_IROP
BYPASS_UNSUPPORTED_IRCCALLBYPASS_UNSUPPORTED_IRDIRTYBYPASS_UNSUPPORTED_IREXPRBYPASS_UNSUPPORTED_IROP
BYPASS_UNSUPPORTED_IRSTMTBYPASS_UNSUPPORTED_SYSCALL
BYPASS_VERITESTING_EXCEPTIONSCACHELESS_SOLVERCALLLESSCGC_ENFORCE_FD
CGC_NON_BLOCKING_FDS
CGC_NO_SYMBOLIC_RECEIVE_LENGTHCOMPOSITE_SOLVER
CONCRETIZECONCRETIZE_SYMBOLIC_FILE_READ_SIZESCONCRETIZE_SYMBOLIC_WRITE_SIZESCONSERVATIVE_READ_STRATEGYCONSERVATIVE_WRITE_STRATEGYCONSTRAINT_TRACKING_IN_SOLVER
COW_STATESDOWNSIZE_Z3
DO_CCALLS
DO_GETS
DO_LOADS
DO_OPS
DO_PUTS
DO_RET_EMULATION
DO_STORESEFFICIENT_STATE_MERGINGENABLE_NX

Use SimAbstractMemory to model memory as discrete regions
Allow splitting constraint sets during simplification
Track dependencies in SimActions
Use VSA when evaluating guard conditions
Use VSA when evaluating memory indices
Use VSA when evaluating memory load/store sizes
Use VSA when evaluating state satisfiability
Enables dependency tracking for all claripy ASTs
An internal option used to track dependencies in SimProcedures
Return a symbolic value without touching memory for any read that has a symbolic ad
Do not perform any write that has a symbolic address
Handle huge writes of symbolic size by pretending they are actually smaller
Debug: trigger a breakpoint at the end of each block
Debug: trigger a breakpoint at the start of each block
Debug: trigger a breakpoint at the end of each IR statement
Debug: trigger a breakpoint at the start of each IR statement
Treat clean helpers that fail with errors as returning unconstrained symbolic values
Treat operations that fail with errors as returning unconstrained symbolic values
Treat unsupported clean helpers as returning unconstrained symbolic values
Treat unsupported dirty helpers as returning unconstrained symbolic values
Treat unsupported IR expressions as returning unconstrained symbolic values
Treat unsupported operations as returning unconstrained symbolic values
Treat unsupported IR statements as returning unconstrained symbolic values
Treat unsupported syscalls as returning unconstrained symbolic values
Discard emulation errors during veritestingenable SolverCachelessEmulate call instructions as an unconstraining of the return value register
CGC: make sure all reads and writes go to stdin and stdout, respectively
CGC: always report “data available” in fdwait
CGC: always read the maximum amount of data requested in the receive syscall
Enable SolverComposite for independent constraint set optimization
Concretize all symbolic expressions encountered during emulation
Concreteize the sizes of file reads
Concretize the sizes of symbolic writes to memory
Do not use SimConcretizationStrategyAny for reads; in case of read address concretiz
Do not use SimConcretizationStrategyAny for writes; in case of write address concret
Set track=True for making claripy Solvers; enable use of unsat_core
Copy states instead of mutating the initial state directly
Downsize the claripy solver whenever possible to save memory
Perform IR clean calls
Perform IR register reads
Perform IR memory loads
Perform IR computation operations
Perform IR register writes
For each Ijk_Call successor, add a corresponding Ijk_FakeRet successor
Perform IR memory stores
Keep in memory any state that might be a common ancestor in a merge
When in conjunction with STRICT_PAGE_ACCESS, raise a SimSegfaultException on e

9.3. List of State Options

123

angr

Option name

Description

EXCEPTION_HANDLINGFAST_MEMORYFAST_REGISTERS
INITIALIZE_ZERO_REGISTERSKEEP_IP_SYMBOLICKEEP_MEMORY_READS_DISCRETE
LAZY_SOLVESMEMORY_SYMBOLIC_BYTES_MAP
NO_SYMBOLIC_JUMP_RESOLUTIONNO_SYMBOLIC_SYSCALL_RESOLUTION
OPTIMIZE_IR
REGION_MAPPINGREPLACEMENT_SOLVER
REVERSE_MEMORY_HASH_MAP
REVERSE_MEMORY_NAME_MAP
SIMPLIFY_CONSTRAINTSSIMPLIFY_EXIT_GUARDSIMPLIFY_EXIT_STATESIMPLIFY_EXIT_TARGETSIMPLIFY_EXPRSSIMPLIFY_MEMORY_READSSIMPLIFY_MEMORY_WRITESSIMPLIFY_REGISTER_READSSIMPLIFY_REGISTER_WRITESSIMPLIFY_RETS
STRICT_PAGE_ACCESS
SUPER_FASTPATHSUPPORT_FLOATING_POINTSYMBOLICSYMBOLIC_INITIAL_VALUESSYMBOLIC_TEMPSSYMBOLIC_WRITE_ADDRESSESTRACK_CONSTRAINTSTRACK_CONSTRAINT_ACTIONSTRACK_JMP_ACTIONSTRACK_MEMORY_ACTIONSTRACK_MEMORY_MAPPINGTRACK_OP_ACTIONSTRACK_REGISTER_ACTIONSTRACK_SOLVER_VARIABLES
TRACK_TMP_ACTIONSTRUE_RET_EMULATION_GUARDUNDER_CONSTRAINED_SYMEXECUNICORNUNICORN_AGGRESSIVE_CONCRETIZATIONUNICORN_HANDLE_TRANSMIT_SYSCALLUNICORN_SYM_REGS_SUPPORTUNICORN_THRESHOLD_CONCRETIZATIONUNICORN_TRACK_BBL_ADDRSUNICORN_TRACK_STACK_POINTERS

Ask all SimExceptions raised during execution to be handled by the SimOS
Use SimFastMemory for memory storage
Use SimFastMemory for register storage
Treat the initial value of registers as zero instead of unconstrained symbolic
Don’t try to concretize successor states with symbolic instruction pointers
In abstract memory, handle failed loads by returning a DCIS?
Don’t check satisfiability until absolutely necessary
Maintain a mapping of symbolic variable to which memory address it “really” corresp
Do not attempt to flatten symbolic-ip successors into discrete targets
Do not attempt to flatten symbolic-syscall-number successors into discrete targets
Use LibVEX’s optimization
Maintain a mapping of symbolic variable to which memory region it corresponds to,
Enable SolverReplacement
Maintain a mapping from AST hash to which addresses it is present in
Maintain a mapping from symbolic variable name to which addresses it is present in,
Run added constraints through z3’s simplifcation
Run branch guards through z3’s simplification
Perform simplification on all successor states generated
Run jump/call/branch targets through z3’s simplification
Run the results of IR expressions through z3’s simplification
Run the results of memory reads through z3’s simplification
Run values stored to memory through z3’s simplification
Run values read from registers through z3’s simplification
Run values written to registers through z3’s simplification
Run values returned from SimProcedures through z3’s simplification
Raise a SimSegfaultException when attempting to interact with memory in a way not
Only execute the last four instructions of each block
When disabled, throw an UnsupportedIROpError when encountering floating point op
Enable constraint solving?
make state.solver.Unconstrained return a symbolic value instead of zero
Treat each IR temporary as a symbolic variable; treat stores to them as constraint addi
Allow writes with symbolic addresses to be processed by concretization strategies; whWhen disabled, don’t keep any constraints added to the state
Keep a SimAction for each constraint added
Keep a SimAction for each jump or branch
Keep a SimAction for each memory read and write
Keep track of which pages are mapped into memory and which are not
Keep a SimAction for each IR operation
Keep a SimAction for each register read and write
Maintain a listing of all the variables in all the constraints in the solver
Keep a SimAction for each temporary variable read and write
With DO_RET_EMULATION, add fake returns with guard condition true instead of false
Enable under-constrained symbolic execution
Use unicorn engine to execute symbolically when data is concrete
Concretize any register variable unicorn tries to access
CGC: handle the transmit syscall without leaving unicorn
Attempt to stay in unicorn even in the presence of symbolic registers by checking thatConcretize variables if they prevent unicorn from executing too often
Keep state.history.bbl_addrs up to date when using unicorn
Track a list of the stack pointer’s value at each block in state.scratch.stack_poi

124

Chapter 9. Appendix

angrOption name

Description

UNICORN_ZEROPAGE_GUARD
UNINITIALIZED_ACCESS_AWARENESSUNSUPPORTED_BYPASS_ZERO_DEFAULTUSE_SIMPLIFIED_CCALLSUSE_SYSTEM_TIMESVALIDATE_APPROXIMATIONSZERO_FILL_UNCONSTRAINED_MEMORY

Prevent unicorn from mapping the zero page into memory
Broken/unused?
When using the resilience options, return zero instead of an unconstrained symbol
Use a “simplified” set of ccalls optimized for specific cases
In library functions and syscalls and hardware instructions accessing clock data, retrie
Debug: When performing approximations, ensure that the approximation is sound by
Make the value of memory read from an uninitialized address zero instead of an unco

9.4 CTF Challenge Examples
angr is very often used in CTFs. These are example scripts resulting from that use, mostly from Shellphish but also
from many others.

9.4.1 ReverseMe example: HackCon 2016 - angry-reverser
Script author: Stanislas Lejay (github: @P1kachu)
Script runtime: ~31 minutes
Here is the binary and the script

9.4.2 ReverseMe example: SecurityFest 2016 - fairlight
Script author: chuckleberryfinn (github: @chuckleberryfinn)
Script runtime: ~20 seconds
A simple reverse me that takes a key as a command line argument and checks it against 14 checks. Possible to solve
the challenge using angr without reversing any of the checks.
Here is the binary and the script

9.4.3 ReverseMe example: DEFCON Quals 2016 - baby-re
Authors David Manouchehri (github: @Manouchehri), Stanislas Lejay (github: @P1kachu) and Audrey Dutcher(github: @rhelmot).
Script runtime: 10 sec
Here is the binary and the script

9.4.4 ReverseMe example: Google CTF - Unbreakable Enterprise Product Activation (150 points)
Script 0 author: David Manouchehri (github: @Manouchehri)
Script runtime: 4.5 sec
Script 1 author: Adam Van Prooyen (github: @docileninja)
Script runtime: 6.7 sec
A Linux binary that takes a key as a command line argument and checks it against a series of constraints.
Challenge Description:

9.4. CTF Challenge Examples

125

angr

We need help activating this product – we’ve lost our license key :(You’re our only hope!
Here are the binary and scripts: script 0, script_1

9.4.5 ReverseMe example: EKOPARTY CTF - Fuckzing reverse (250 points)
Author: Adam Van Prooyen (github: @docileninja)
Script runtime: 29 sec
A Linux binary that takes a team name as input and checks it against a series of constraints.
Challenge Description:
Hundreds of conditions to be meet, will you be able to surpass them?
Both sample binaries and the script are located here and additional information be found at the author’s write-up.

9.4.6 ReverseMe example: WhiteHat Grant Prix Global Challenge 2015 - Re400
Author: Fish Wang (github: @ltfish)
Script runtime: 5.5 sec
A Windows binary that takes a flag as argument, and tells you if the flag is correct or not.
“I have to patch out some checks that are difficult for angr to solve (e.g., it uses some bytes of the flag to decrypt somedata, and see if those data are legit Windows APIs). Other than that, angr works really well for solving this challenge.”
The binary and the script.

9.4.7 ReverseMe example: EKOPARTY CTF 2015 - rev 100
Author: Fish Wang (github: @ltfish)
Script runtime: 5.5 sec
This is a painful challenge to solve with angr. I should have done things in a smarter way.
Here is the binary and the script.

9.4.8 ReverseMe example: ASIS CTF Finals 2015 - fake
Author: Fish Wang (github: @ltfish)
Script runtime: 1 min 57 sec
The solution is pretty straight-forward.
The binary and the script.

9.4.9 ReverseMe example: Defcamp CTF Qualification 2015 - Reversing 100
Author: Fish Wang (github: @ltfish)
angr solves this challenge with almost zero user-interference.
See the script and the binary.

126

Chapter 9. Appendix

angr

9.4.10 ReverseMe example: Defcamp CTF Qualification 2015 - Reversing 200
Author: Fish Wang (github: @ltfish)
angr solves this challenge with almost zero user-interference. Veritesting is required to retrieve the flag promptly.
The script and the binary. It takes a few minutes to run on my laptop.

9.4.11 ReverseMe example: MMA CTF 2015 - HowToUse
Author: Audrey Dutcher (github: @rhelmot)
We solved this simple reversing challenge with angr, since we were too lazy to reverse it or run it in Windows. The
resulting script shows how we grabbed the flag out of the DLL.

9.4.12 CrackMe example: MMA CTF 2015 - SimpleHash
Author: Chris Salls (github: @salls)
This crackme is 95% solvable with angr, but we did have to overcome some difficulties. The script describes thedifficulties that were encountered and how we worked around them. The binary can be found here.

9.4.13 ReverseMe example: FlareOn 2015 - Challenge 10
Author: Fish Wang (github: @ltfish)
angr acts as a binary loader and an emulator in solving this challenge. I didn’t have to load the driver onto my Windowsbox.
The script demonstrates how to hook at arbitrary program points without affecting the intended bytes to be executed (azero-length hook). It also shows how to read bytes out of memory and decode as a string.
By the way, here is the link to the intended solution from FireEye.

9.4.14 ReverseMe example: FlareOn 2015 - Challenge 2
Author: Chris Salls (github: @salls)
This reversing challenge is simple to solve almost entirely with angr, and a lot faster than trying to reverse the password
checking function. The script is here

9.4.15 ReverseMe example: 0ctf 2016 - momo
Author: Fish Wang (github: @ltfish), ocean (github: @ocean1)This challenge is a movfuscated binary. To find the correct password after exploring the binary with Qira it is possible
to understand how to find the places in the binary where every character is checked using capstone and using angr toload the binary and brute-force the single characters of the flag. Be aware that the script is really slow. Runtime: > 1
hour.

9.4.16 CrackMe example: 9447 CTF 2015 - Reversing 330, “nobranch”
Author: Audrey Dutcher (github: @rhelmot)
angr cannot currently solve this problem natively, as the problem is too complex for z3 to solve. Formatting the constraints to z3 a little differently allows z3 to come up with an answer relatively quickly. (I was asleep while it wassolving, so I don’t know exactly how long!) The script for this is here and the binary is here.

9.4. CTF Challenge Examples

127

angr

9.4.17 CrackMe example: ais3_crackme
Author: Antonio Bianchi, Tyler Nighswander
ais3_crackme has been developed by Tyler Nighswander (tylerni7) for ais3 summer school. It is an easy crackme
challenge, checking its command line argument.

9.4.18 ReverseMe: Modern Binary Exploitation - CSCI 4968
Author: David Manouchehri (GitHub @Manouchehri)This folder contains scripts used to solve some of the challenges with angr. At the moment it only contains the examples
from the IOLI crackme suite, but eventually other solutions will be added.

9.4.19 CrackMe example: Android License Check
Author: Bernhard Mueller (GitHub @b-mueller)
A native binary for Android/ARM that validates a license key passed as a command line argument. It was created forthe symbolic execution tutorial in the OWASP Mobile Testing Guide.

9.5 Changelog
This lists the major changes in angr. Tracking minor changes are left as an exercise for the reader :-)9.5.1 angr 9.1• (#2961) Refactored SimCC to support passing and returning structs and arrays by value• (#2964) Functions from the knowledge base may now be pretty-printed, showing colors and reference arrows• Improved import angr speed substantially• (#2948) RDA’s dep_graph can now be used to track dependencies between temporaries, constants, guard conditions, and function calls - if you want it!
• (#2929) Basic support for structs with bitfields in SimType• There’s a decompiler now

9.5.2 angr 9.0• Switched to a new versioning scheme: major.minor.build_id

9.5.3 angr 8.19.7.25• (#1503) Implement necessary helpers and information storage for call pretty printing• (#1546) Add a new state option MEMORY_FIND_STRICT_SIZE_LIMIT• (#1548) SimProcedure.static_exits: Allow providing name hints• (cle#177) Use Enums for Symbol Types• (cle#193) Add support for “named regions”• (claripy#151) Implement operator precedence in claripy op rendering• Added support for interaction recording in angr-management• Several new simprocedure implementations• Substantial imporvments to our CFG
128

Chapter 9. Appendix

angr

9.5.4 angr 8.19.4.5• (#1234) Massive improvements to CFG recovery for ARM and ARM cortex-m binaries.
• (#1416) Added support for analyzing Java programs via the Soot IR, including the ability to analyze interplay
between Java code and JNI libraries. This branch was two years old!
• (#1427) Added a MemoryWatcher exploration technique to take action when the system is running out of RAM.
Thanks @bannsec.
• (#1432) Added a state.heap plugin which manages the heap (with pluggable heap schemes!) and provides
malloc functionality. Thanks @tgduckworth.
• Speed improvements for using the VEX engine and working with concrete data.
• Added SimLightRegisters, an alternate registers plugin that eliminates the abstraction of the register file for
performance improvements at the cost of removing all instrumentability.
• version__ variable has been added to all modules.
• The stack_base kwarg for call_state is not broken for the first time ever
• https://github.com/python/cpython/pull/11384

9.5.5 angr 8.19.2.4• (#1279) Support C++ function name demangling via itanium-demangler. Thanks @fmagin.
• (#1283) security_cookie is initialized for SimWindows. Thanks @zeroSteiner.
• (#1298) Introduce SimData. It’s a cleaner interface to deal with data imports in CLE – especially for those data
entries that are not imported because of missing or unloaded libraries. This commit fixes long-standing issues#151 and #693.
• (#1299, #1300, #1301, #1313, #1314, #1315, #1336, #1337, #1343, . . . ) Multiple CFGFast-related improvements and bug fixes.
• (#1332) UnresolvableTarget is now split into two classes:
UnresolvableCallTarget. Thanks @Kyle-Kyle.

UnresolvableJumpTarget and• (#1382) Add a preliminary implementation of angr decompiler.
Give it a try!
p = angr.
Project("cfg_loop_unrolling", auto_load_libs=False); p.analyses.CFG(); print(p.
analyses.Decompiler(p.kb.functions['test_func']).codegen.text).
• (#1421) SimActions now have incrementing IDs. Thanks @bannsec.
• (#1408) ANA, angr’s old identity-aware serialization backend, has been removed. Instead of non-obvious serialization behavior, all angr objects should now be pickleable. If one is not, please file an issue. For use-cases that
require identity-awareness (i.e., deduplicating ASTs across states serialized at different times), an angr.vaults
module has been introduced.
• Added a facility to synchronize state between angr and a running target a la avatar2• Changed unconstrained registers/memory warning to be less obnoxious and contain useful information. Also
added SYMBOL_FILL_UNCONSTRAINED_REGISTERS and SYMBOL_FILL_UNCONSTRAINED_MEMORY state options to silence them.

9.5.6 angr 8.18.10.25• The IDA backend for CLE has been removed. It has been broken for quite some time, but now it has been disabled
for your own safety.
• Surveyors have been removed! Finally! This is thanks to @danse-macabre who contributed an Exploration
Technique for the Slicecutor. Backwards slicing has now been brought out of the angr dark ages.
9.5. Changelog

129

angr

• SimCC can now be initialized with a string containing C function prototype in its func_ty argument• Similarly, Callable can now be run with its arguments instantiated from a string containing C expressions• Tracer has been substantially refactored - it will now handle more kinds of desyncs, ASLR slides, and is much
more friendly for hacking. We will be continuing to improve it!
• The Oppologist and Driller have been refactored to play nice with other exploration techniques• SimProcedure continuations now have symbols in the externs object, so describe_addr will work on them.
Additionally, the representation for SimProcedure (appearing in history.descriptions and project.
_sim_procedures among other places) has been improved to show this information.

9.5.7 angr 8.18.10.5
Largely a bugfix release, but with a few bonus treats:• API documentation has been rewritten for Exploration Technique. It should be much easier to use now.
• Simulation Manager will throw an error if you pass incorrect keyword arguments (??? why was it like this)• The save_unconstrained flag of Simulation Manager is now on by default• If a step produces only unsatisfiable states, they will appear in the 'unsat' stash regardless of the save_unsat
setting, since this usually indicates a bug. Add unsat to the auto_drop parameter to restore the old behavior.

9.5.8 angr 8.18.10.1
Welcome to angr 8! The biggest change for this major version bump is the transition to Python 3. You can read about
this, as well as a few other breaking changes, in the Migrating to angr 8.
• Switch to Python 3• Refactor to Clemory to clean up the API and speed things up drastically• Remove object.symbols_by_addr (dict) and add object.symbols (sorted list); add fuzzy parameter toloader.find_symbol• CFGFast is much, much faster now. CFGAccurate has been renamed to CFGEmulated.
• Support for avx2 unpack instructions, courtesy of D. J. Bernstein• Removed support for immutable simulation managers• angr will now show you a warning when using uninitialized memory or registers• angr will now NOT show you a warning if you have a capstone 3.x install unless you’re actually interacting withthe relevant missing parts• Many, many, many bug fixes

9.5.9 angr 7.8.7.1• Remove LoopLimiter and DFG.
• (#1063) CFGAccurate can now leverage indirect jump resolvers to resolve indirect jumps.

9.5.10 angr 7.8.6.23• (PyVEX!#134) We now recognize LDMDB r11, {xxx, pc} as a ret instruction for ARM.
• (#1053) CFGFast spends less time running next_pos_with_sort_not_in(), thus it runs faster on large binaries.
• (#1080) Jump table resolvers now support resolving ARM jump tables.

130

Chapter 9. Appendix

angr• (#1081, together with the PyVEX commit 61efbdcf6303a936aa3de35011d2d1e3fe5fdea5) The memory footprint of CFGFast is noticeably smaller, especially on large binaries (over 10 MB in size).
• (#1034) Concretizing a SimFile with unconstrained size can no longer run you out of memory.
• Other minor changes and bug fixes.

9.5.11 angr 7.8.6.16• The modeling of file system is refactored.
• (#808) Add a new class Control flow blanket (CFBlanket) to support generating a linear view of a control flow
graph.
• (#863) Add support to AIL, the new angr intermediate language (still pretty WIP though). Merged in several
static analyses (reaching definition analysis, VEX-to-AIL translation, redundant assignment elimination, code
region identification, control flow structuring, etc.) that support the development of decompilation in the near
future.
• (#888) SimulationManager is extensively refactored and cleaned up.
• (#892) Keystone is integrated. You can assemble instructions inside angr now.
• (#897) A new class PluginHub is added. Plugins (analyses, engines) are refactored to be based on PluginHub.
• (#899) Support of bidirectional mapping between syscall numbers and syscalls.
• (#925, #941, #942) A bunch of library function prototypes (including glibc) are added to angr.
• (#953) Fix the issue where evaluating the jump target of a jump table that contains many entries (e.g., > 512) isextremely slow.
• (#964) State options are now stored in insances of SimStateOptions. state.options is no longer a set of strings.
• (#973) Add two new exploration techniques: Stochastic and unique.
• (#996) SimType structs are now much easier to use.
• (#998) Add a new state option PRODUCE_ZERODIV_SUCCESSORS to generate divide-by-zero successors.
• Speed improvements and bug fixes in CFG generation (CFGFast and CFGAccurate).

9.5.12 angr 7.8.2.21• Refactor of how syscall handling and SimSyscallLibrary work - it is now possible to handle syscalls using multiple
ABIs in the same process• Added syscall name-number mappings from all linux ABIs, parsed from gdb• Add ManualMergepoint exploration technique for when veritesting is too mysterious for your tastes• Add LoopSeer exploration technique for managing loops during symbolic exploration (credit @tyb0807)• Add ProxyTechnique exploration technique for easily composing simple lambda-based instrumentations (credit@danse-macabre)

9.5.13 angr 7.7.12.16• You can now tell where the variables implicitly created by angr come from! state.solver.BVS now can take a
key parameter, which describes its meaning in relation to the emulated environment. You can then use state.
solver.get_variables(...) and state.solver.describe_variables(...) to map tags and ASTs toand from each other. Check out the API docs!

9.5. Changelog

131

angr

• The SimOS for a project is now a public property - project.simos instead of project._simos. Additionally,
the SimOS code structure has been shuffled around a bit - it’s now a subpackage instead of a submodule.
• The core components of Tracer and Driller have been refactored into Exploration Techniques and integrated into
angr proper, so you can now follow instruction traces without installing another repository! (credit @tyb0807)• Archinfo now contains a byte_width parameter and angr supports emulation of platforms with non-octet bytes,
lord help us• Upgraded to networkx 2 (credit @tyb0807)• Hopefully installation issues with capstone should be fixed FOREVER• Minor fixes to gender

9.5.14 angr 7.7.9.8
Welcome to angr 7! We worked long and hard all summer to make this release the best ever. It introduces several
breaking changes, so for a quick guide on the most common ways you’ll need to update your scripts, take a look at the
Migrating to angr 7.
• SimuVEX has been removed and its components have been integrated into angr
• Path has been removed and its components have been integrated into SimState, notably the new history stateplugin• PathGroup has been renamed to SimulationManager• SimState and SimProcedure now have a reference to their parent Project, though it is verboten to use it in anythingother than an append-only fashion• A new class SimLibrary is used to track SimProcedure and metadata corresponding to an individual sharedlibrary• Several CLE interfaces have been refactored up for consistency• Hook has been removed. Hooking is now done with individual SimProcedure instances, which are shallowcopied at execution time for thread-safety.
• The state.solver interface has been cleaned up drastically
These are the major refactor-y points. As for the improvements:• Greatly improved support for analyzing 32 bit windows binaries (partial credit @schieb)• Unicorn will now stop for stop points and breakpoints in the middle of blocks (credit @bennofs)• The processor flags for a state can now be accessed through state.regs.eflags on x86 and state.regs.
flags on ARM (partial credit @tyb0807)• Fledgling support for emulating exception handling. Currently the only implementation of this is support for
Structured Exception Handling on Windows, see angr.SimOS.handle_exception for details• Fledgling support for runtime library loading by treating the CLE loader as an append-only interface,
though only implemented for windows. See cle.Loader.dynamic_load and angr.procedures.win32.
dynamic_loading for details.
• The knowledge base has been refactored into a series of plugins similar to SimState (credit @danse-macabre)• The testcase-based function identifier we wrote for CGC has been integrated into angr as the Identifier analysis• Improved support for writing custom VEX lifters

132

Chapter 9. Appendix

angr

9.5.15 angr 6.7.6.9• angr: A static data-flow analysis framework has been introduced, and implemented as part of the
ForwardAnalysis class. Additionally, a few exemplary data-flow analyses, like VariableRecovery andVariableRecoveryFast, have been implemented in angr.
• angr: We introduced the notion of variable to the angr world. Now a VariableManager is available in the knowledge base. Variable information can be recovered by running a variable recovery analysis. Currently the variable
information recovered for each function is still pretty coarse. More updates to it will arrive soon.
• angr: Fix a bug in the topological sorting in CFGUtils, which resulted in suboptimal graph node ordering after
sorting.
• SimuVEX: LAZY_SOLVES is no longer enabled by default during symbolic execution. It’s still there if it’s wanted,
but it just caused confusion when on by default.
• SimuVEX: Thanks to @ekilmer, a few new libc SimProcedures are added.
• SimuVEX: The default memory model has been refactored for expandability. Custom pages can now be created(derive the simuvex.storage.ListPage class) and used instead of the default page classes to implement custom
memory behavior for specific pages. The user-friendly API for this is pending the next release.
• angr-management: Implemented our own graph layout and edge routing algorithm. We do not rely on grandalf
anymore.
• angr-management: Added support for displaying variable information for operands.
• angr-management: Added support for highlighting dependent operands when an operand is highlighted.

9.5.16 angr 6.7.3.26
Building off of the engine changes from the last release, we have begun to extend angr to other architectures. AVR and
MSP430 are in progress. In the meantime, subwire has created a reference implementation of BrainFuck support inangr, done two different ways! Check out angr-platforms for more info!
• We have rebased our fork of VEX on the latest master branch from Valgrind (as of 2 months ago, at least. . . ).
We have also submitted our patches to VEX to upstream, so we should be able to stop maintaining a fork prettysoon.
• The way we interact with VEX has changed substantially, and should speed things up a bit.
• Loading sets of binaries with many import symbols has been sped up• Many, many improvements to angr-management, including the switch away from enaml to using pyside directly.

9.5.17 angr 6.7.1.13
For the last month, we have been working on a major refactor of the angr to change the way that angr reasons about
the code that it analyzes. Until now, angr has been bound to the VEX intermediate representation to lift native code,
supporting a wide range of architectures but not being very expandable past them. This release represents the groundwork for what we call translation and execution engines. These engines are independent backends, pluggable into
the angr framework, that will allow angr to reason about a wide range of targets. For now, we have restructured theexisting VEX and Unicorn Engine support into this engine paradigm, but as we discuss in our blog post, the plan is
to create engines to enable angr’s reasoning of Java bytecode and source code, and to augment angr’s environment
support through the use of external dynamic sandboxes.
For now, these changes are mostly internal. We have attempted to maintain compatibility for end-users, but thosebuilding systems atop angr will have to adapt to the modern codebase. The following are the major changes:• simuvex: we have introduced SimEngine. SimEngine is a base class for abstractions over native code. For
example, angr’s VEX-specific functionality is now concentrated in SimEngineVEX, and new engines (such as

9.5. Changelog

133

angr

SimEngineLLVM) can be implemented (even outside of simuvex itself) to support the analysis of new types ofcode.
• simuvex: as part of the engines refactor, the SimRun class has been eliminated. Instead of different subclassesof SimRun that would be instantiated from an input state, engines each have a process function that, froman input state, produces a SimSuccessors instance containing lists of different successor states (normal, unsat,
unconstrained, etc) and any engine-specific artifacts (such as the VEX statements. Take a look at successors.
artifacts).
• simuvex: state.mem[x:]= y now requires a type for storage (for example state.mem[x:].dword = y).

• simuvex: the way of calling inline SimProcedures has been changed. Now you have to create a SimProcedure,
and then call execute() on it and pass in a program state as well as the arguments.
• simuvex: accessing registers through SimRegNameView (like state.regs.eax) always triggers SimInspect
breakpoints and creates new actions. Now you can access a register by prefixing its name with an underscore(e.g. state.regs._eax or state._ip) to avoid triggering breakpoints or creating actions.
• angr: the way hooks work has slightly changed, though is backwards-compatible. The new angr.Hookclass acts as a wrapper for hooks (SimProcedures and functions), keeping things cleaner in the project.
_sim_procedures dict.
• angr: we have deprecated the keyword argument max_size and changed it to to size in the angr.
Block constructor (i.e., the argument to project.factory.block and more upstream methods (path.step,
path_group.step, etc).
• angr: we have deprecated project.factory.sim_run and changed it to to project.factory.successors,and it now generates a SimSuccessors object.
• angr: project.factory.sim_block has been deprecated and replaced with project.factory.
successors(default_engine=True).
• angr: angr syscalls are no longer hooks. Instead, the syscall table is now in project._simos.syscall_table.
This will be made “public” after a usability refactor. If you were using project.is_hooked(addr) to see if anaddress has a related SimProcedure, now you probably want to check if there is a related syscall as well (using
project._simos.syscall_table.get_by_addr(addr) is not None).
• pyvex: to support custom lifters to VEX, pyvex has introduced the concept of backend lifters. Lifters can be
written in pure Python to produce VEX IR, allowing for extendability of angr’s VEX-based analyses to otherhardware architectures.
As usual, there are many other improvements and minor bugfixes.
• claripy: support unsat_core() to get the core of unsatness of constraints. It is in fact a thin wrapper of theunsat_core() function provided by Z3. Also a new state option CONSTRAINT_TRACKING_IN_SOLVER is added
to SimuVEX. That state option must be enabled if you want to use unsat_core() on any state.
• simuvex: SimMemory.load() and SimMemory.store() now takes a new parameter disable_actions. Setting it to True will prevent any SimAction creation.
• angr: CFGFast has a better support for ARM binaries, especially for code in THUMB mode.
• angr: thanks to an improvement in SimuVEX, CFGAccurate now uses slightly less memory than before.
• angr: len() on path trace or addr_trace is made much faster.
• angr: Fix a crash during CFG generation or symbolic execution on platforms/architectures with no syscall defined.
• angr: as part of the refactor, BackwardSlicing is temporarily disabled. It will be re-enabled once all DDGrelated refactor are merged to master.

134

Chapter 9. Appendix

angrAdditionally, packaging and build-system improvements coordinated between the angr and Unicorn Engine projects
have allowed angr’s Unicorn support to be built on Windows. Because of this, unicorn is now a dependency forsimuvex.
Looking forward, angr is poised to become a program analysis engine for binaries and more!

9.5.18 angr 5.6.12.3
It has been over a month since the last release 5.6.10.12. Again, we’ve made some significant changes and improvementson the code base.
• angr: Labels are now stored in KnowledgeBase.
• angr: Add a new analysis: Disassembly. The new Disassembly analysis provides an easy-to-use interface torender assembly of functions.
• angr: Fix the issue that ForwardAnalysis may prematurely terminate while there are still un-processed jobs.
• angr: Many small improvements and bug fixes on CFGFast.
• angr: Many small improvements and bug fixes on VFG. Bring back widening support. Fix the issue that VFG may
not terminate under certain cases. Implement a new graph traversal algorithm to have an optimal traversal order.
Allow state merging at non-merge-points, which allows faster convergence.
• angr-management: Display a progress during initial CFG recovery.
• angr-management: Display a “Load binary” window upon binary loading. Some analysis options can be adjusted
there.
• angr-management: Disassembly view: Edge routing on the graph is improved.
• angr-management: Disassembly view: Support starting a new symbolic execution task from an arbitrary addressin the program.
• angr-management: Disassembly view: Support renaming of function names and labels.
• angr-management: Disassembly view: Support “Jump to address”.
• angr-management: Disassembly view: Display resolved and unresolved jump targets. All jump targets aredouble-clickable.
• SimuVEX: Move region mapping from SimAbstractMemory to SimMemory. This will allow an easier conversion between SimAbstractMemory and SimSymbolicMemory, which is to say, conversion between symbolicstates and static states is now possible.
• SimuVEX & claripy: Provide support for unsat_core in Z3. It returns a set of constraints that led to unsatnessof the constraint set on the current state.
• archinfo: Add a new Boolean variable branch_delay_slot for each architecture. It is set to True on MIPS32.

9.5.19 angr 5.6.8.22
Major point release! An incredible number of things have changed in the month run-up to the Cyber Grand Challenge.
• Integration with Unicorn Engine supported for concrete execution. A new SimRun type, SimUnicorn, may step
through many basic blocks at once, so long as there is no operation on symbolic data. Please use our fork of
unicorn engine, which has many patches applied. All these patches are pending merge into upstream.
• Lots of improvements and bug fixes to CFGFast. Rumors are angr’s CFG was only “optimized” for x86-64
binaries (which is really because most of our test cases are compiled as 64-bit ELFs). Now it is also “optimized”
for x86 binaries :) (editor’s note: angr is built with cross-architecture analysis in mind. CFG construction ispretty much the only component which has architecture-specific behavior.)• Lots of improvements to the VFG analysis, including speed and accuracy. However, there is still a lot to be done.
9.5. Changelog

135

angr

• Lots of speed optimizations in general - CFGFast should be 3-6x faster under CPython with much less memory
usage.
• Now data dependence graph gives you a real dependence graph between variable definitions. Try data_graphand simplified_data_graph on a DDG object!
• New state option simuvex.o.STRICT_PAGE_ACCESS will cause a SimSegfaultError to be raised whenever
the guest reads/writes/executes memory that is either unmapped or doesn’t have the appropriate permissions.
• Merging of paths (as opposed to states) is performed in a much smarter way.
• The behavior of the support_selfmodifying_code project option is changed: Before, this would allow thestate to be used as a fallback source of instruction bytes when no backer from CLE is available. Now, this option
makes instruction lifting use the state as the source of bytes always. When the option is disabled and execution
jumps outside the normal binary, the state will be used automatically.
• Actually support self-modifying code - if a basic block of code modifies itself, the block will be re-lifted before
the next instruction starts.
• Syscalls are handled differently now - Before you would see a SimRun for a syscall helper, now you’ll just see a
SimProcedure for the given syscall. Additionally, each syscall has its own address in a “syscalls segment”, andsyscalls are treated as jumps to this segment. This simplifies a lot of things analysis-wise.
• CFGAccurate accepts a base_graph keyword to its constructor, e.g. CFGFast().graph, or even .graph of afunction, to use as a base for analysis.
• New fast memory model for cases where symbolic-addressed reads and writes are unlikely.
• Conflicts between the find and avoid parameters to the Explorer otiegnqwvk are resolved correctly. (credit
clslgrnc)• New analysis StaticHooker which hooks library functions in unstripped statically linked binaries.
• Lifter can be used without creating an angr Project. You must manually specify the architecture and bytestringin calls to .lift() and .fresh_block(). If you like, you can also specify the architecture as a parameter tothe constructor and omit it from the lifting calls.
• Add two new analyses developed for the CGC (mostly as examples of doing static analysis with angr): Reassembler and BinaryOptimizer.

9.5.20 angr 4.6.6.28
In general, there have been enormous amounts of speed improvements in this release. Depending on the workload,angr should run about twice as fast. Aside from this, there have also been many submodule-specific changes:
angrQuite a few changes and improvements are made to CFGFast and CFGAccurate in order to have better and faster CFG
recovery. The two biggest changes in CFGFast are jump table resolution and data references collection, respectively.
Now CFGFast resolves indirect jumps by default. You may get a list of indirect jumps recovered in CFGFast byaccessing the indirect_jumps attribute. For many cases, it resolves the jump table accurately. Data referencescollection is still in alpha mode. To test data references collection, just pass collect_data_references=True whencreating a fast CFG, and access the memory_data attribute after the CFG is constructed.
CFG recovery on ARM binaries is also improved.
A new paradigm called an “otiegnqwvk”, or an “exploration technique”, allows the packaging of special logic related
to path group stepping.

136

Chapter 9. Appendix

angrSimuVEX
Reads/writes to the x87 fpu registers now work correctly - there is special logic that rotates a pointer into part of theregister file to simulate the x87 stack.
With the recent changes to Claripy, we have configured SimuVEX to use the composite solver by default. This shouldbe transparent, but should be considered if strange issues (or differences in behavior) arise during symbolic execution.
Claripy
Fixed a bug in claripy where div__ was not always doing unsigned division, and added new methods SDiv and SModfor signed division and signed remainder, respectively.
Claripy frontends have been completely rewritten into a mixin-centric solver design. Basic frontend functionality(i.e., calling into the solver or dealing with backends) is handled by frontends (in claripy.frontends), and additional functionality (such as caching, deciding when to simplify, etc) is handled by frontend mixins (in claripy.
frontend_mixins). This makes it considerably easier to customize solvers to your specific needE. For examples,look at claripy/solver.py.
Alongside the solver rewrite, the composite solver (which splits constraints into independent constraint sets for faster
solving) has been immensely improved and is now functional and fast.

9.5.21 angr 4.6.6.4
Syscalls are no longer handled by simuvex.procedures.syscalls.handler. Instead, syscalls are now handled
by angr.SimOS.handle_syscall(). Previously, the address of a syscall SimProcedure is the address right after
the syscall instruction (e.g. int 80h), which collides with the real basic block starting at that address, and is very
confusing. Now each syscall SimProcedure has its own address, just as a normal SimProcedure. To support this, there
is another region mapped for the syscall addresses, Project._syscall_obj.
Some refactoring and bug fixes in CFGFast.
Claripy has been given the ability to handle annotations on ASTs. An annotation can be used to customize the behaviorof some backends without impacting others. For more information, check the docstrings of claripy.Annotationand claripy.Backend.apply_annotation.

9.5.22 angr 4.6.5.25
New state constructor - call_state. Comes with a refactor to SimCC, a refactor to callable, and the removal of PathGroup.call. All these changes are thoroughly documented, in angr/docs/advanced-topics/
structured_data.md
Refactor of SimType to make it easier to use types - they can be instantiated without a SimState and one can be added
later. Comes with some usability improvements to SimMemView. Also, there’s a better wrapper around PyCParser for
generating SimType instances from c declarations and definitions. Again, thoroughly documented, still in the structured
data doc.
CFG is now an alias to CFGFast instead of CFGAccurate. In general, CFGFast should work under most cases, and it’s
way faster than CFGAccurate. We believe such a change is necessary, and will make angr more approachable to newusers. You will have to change your code from CFG to CFGAccurate if you are relying on specific functionalities that
only exist in CFGAccurate, for example, context-sensitivity and state-preserving. An exception will be raised by angr
if any parameter passed to CFG is only supported by CFGAccurate. For more detailed explanation, please take a lookat the documentation of angr.analyses.CFG.

9.5. Changelog

137

angr

9.5.23 angr 4.6.3.28
PyVEX has a structural overhaul. The IRExpr, IRStmt, and IRConst modules no longer exist as submodules, andthose module names are deprecated. Use pyvex.expr, pyvex.stmt, and pyvex.const if you need to access themembers of those modules.
The names of the first three parameters to pyvex.IRSB (the required ones) have been changed. If you were passing thepositional args to IRSB as keyword args, consider switching to positional args. The order is data, mem_addr, arch.
The optional parameter sargc to the entry_state and full_init_state constructors has been removed and replaced with an argc parameter. sargc predates being able to have claripy ASTs independent from a solver. The new
system is to pass in the exact value, ast or integer, that you’d like to have as the guest program’s arg count.
CLE and angr can now accept file-like streams, that is, objects that support stream.read() and stream.seek() canbe passed in wherever a filepath is expected.
Documentation is much more complete, especially for PyVEX and angr’s symbolic execution control components.

9.5.24 angr 4.6.3.15
There have been several improvements to claripy that should be transparent to users:• There’s been a refactoring of the VSA StridedInterval classes to fix cases where operations were not sound.
Precision might suffer as a result, however.
• Some general speed improvements.
• We’ve introduced a new backend into claripy: the ReplacementBackend. This frontend generates replacement
sets from constraints added to it, and uses these replacement sets to increase the precision of VSA. Additionally,
we have introduced the HybridBackend, which combines this functionality with a constraint solver, allowing formemory index resolution using VSA.
angr itself has undergone some improvements, with API changes as a result:• We are moving toward a new way to store information that angr has recovered about a program: the knowledge
base. When an analysis recovers some truth about a program (i.e., “there’s a basic block at 0x400400”, or “theblock at 0x400400 has a jump to 0x400500”), it gets stored in a knowledge-base. Analysis that used to store data
(currently, the CFG) now store them in a knowledge base and can share the global knowledge base of the project,
now accessible via project.kb. Over time, this knowledge base will be expanded in the course of any analysis
or symbolic execution, so angr is constantly learning more information about the program it is analyzing.
• A forward data-flow analysis framework (called ForwardAnalysis) has been introduced, and the CFG was rewritten on top of it. The framework is still in alpha stage - expect more changes to be made. Documentation andmore details will arrive shortly. The goal is to refactor other data-flow analysis, like CFGFast, VFG, DDG, etc.
to use ForwardAnalysis.
• We refactored the CFG to a) improve code readability, and b) eliminate some bad designs that linger due tohistorical reasons.

9.5.25 angr 4.5.12.?
Claripy has a new manager for backends, allowing external backends (i.e., those implemented by other modules)
to be used. The result is that claripy.backend_concrete is now claripy.backends.concrete, claripy.
backend_vsa is now claripy.backends.vsa, and so on.

9.5.26 angr 4.5.12.12
Improved the ability to recover from failures in instruction decoding. You can now hook specific addresses at which
VEX fails to decode with project.hook, even if those addresses are not the beginning of a basic block.

138

Chapter 9. Appendix

angr

9.5.27 angr 4.5.11.23
This is a pretty beefy release, with over half of claripy having been rewritten and major changes to other analyses.
Internally, Claripy has been unified – the VSA mode and symbolic mode now work on the same structures instead ofrequiring structures to be created differently. This opens the door for awesome capabilities in the future, but could also
result in unexpected behavior if we failed to account for something.
Claripy has had some major interface changes:• claripy.BV has been renamed to claripy.BVS (bit-vector symbol). It can now create bitvectors out of strings (i.e.,
claripy.BVS(0x41, 8) and claripy.BVS(“A”) are identical).
• state.BV and state.BVV are deprecated. Please use state.se.BVS and state.se.BVV.
• BV.model is deprecated. If you’re using it, you’re doing something wrong, anyways. If you really need a specificmodel, convert it with the appropriate backend (i.e., claripy.backend_concrete.convert(bv)).
There have also been some changes to analyses:• Interface: CFG argument keep_input_state has been renamed to keep_state. With this option enabled,
both input and final states are kept.
• Interface: Two arguments cfg_node and stmt_id of BackwardSlicing have been deprecated. Instead,
BackwardSlicing takes a single argument, targets. This means that we now support slicing from multiple sources.
• Performance: The speed of CFG recovery has been slightly improved. There is a noticeable speed improvement
on MIPS binaries.
• Several bugs have been fixed in DDG, and some sanity checks were added to make it more usable.
And some general changes to angr itself:• StringSpec is deprecated! You can now pass claripy bitvectors directly as arguments.

9.6 Migrating to angr 9.1
angr 9.1 is here!

9.6.1 Calling Conventions and Prototypes
The main change motivating angr 9.1 is this large refactor of SimCC. Here are the breaking changes:
SimCCs can no longer be customized
If you were using the sp_delta, args, or ret_val parameters to SimCC, you should use the new class
SimCCUsercall, which lets (requires) you to be explicit about the locations of each argument.
Passing SimTypes is now mandatory
Every method call on SimCC which interacts with typed data now requires a SimType to be passed in. Previously,
the use of is_fp and size was optional, but now these parameters will no longer be accepted and a SimType will be
required.
This has some fairly non-intuitive consequences - in order to accommodate more esoteric calling conventions (think:passing large structs by value via an “invisible reference”) you have to specify a function’s return type before you can
extract any of its arguments.
Additionally, some non-cc interfaces, such as call_state and callable and SimProcedure.call(), now requirea prototype to be passed to them. You’d be surprised how many bugs we found in our own code from enforcing thisrequirement!
9.6. Migrating to angr 9.1

139

angr

PointerWrapper has a new parameter
Imagine you’re passing something into a function which has a parameter of type char*. Is this a pointer to a single
char or a pointer to an array of chars? The answer changes how we typecheck the values you pass in. If you’re passinga PointerWrapper wrapping a large value which should be treated as an array of chars, you should construct yourpointerwrapper as PointerWrapper(foo, buffer=True). The buffer argument to PointerWrapper now instructs
SimCC to treat the data to be serialized as an array of the child type instead of as a scalar.
func_ty -> prototype
Every usage of the name func_ty has been replaced with the name prototype. This was done for consistency between
the static analysis code and the dynamic FFI.

9.7 Migrating to angr 8
angr has moved from Python 2 to Python 3! We took this opportunity of a major version bump to make a few breaking
API changes that improve quality-of-life.

9.7.1 What do I need to know for migrating my scripts to Python 3?
To begin, just the standard py3k changes, the relevant parts of which we’ll rehash here as a reference guide:• Strings and bytestrings– Strings are now unicode by default, a new bytes type holds bytestrings– Bytestring literals can be constructed with the b prefix, like b'ABCD'– Conversion between strings and bytestrings happens with .encode() and .decode(), which use utf-8 asa default. The latin-1 codec will map byte values to their equivalent unicode codepoints– The ord() and chr() functions operate on strings, not bytestrings– Enumerating over or indexing into bytestrings produces an unsigned 8 bit integer, not a 1-byte bytestring– Bytestrings have all the string manipulation functions present on strings, including join, upper/lower,translate, etc– hex and base64 are no longer string encoding codecs. For hex, use bytes.fromhex() and bytes.hex().
For base64 use the base64 module.
• Builtin functions– print and exec are now builtin functions instead of statements– Many builtin functions previously returning lists now return iterators, such as map, filter, and zip.
reduce is no longer a builtin; you have to import it from functools.
• Numbers– The / operator is explicitly floating-point division, the // operator is expliclty integer division. The magic
functions for overriding these ops are truediv__ and floordiv__– The int and long types have been merged, there is only int now• Dictionary objects have had their .iterkeys, .itervalues, and .iteritems methods removed, and thennon-iter versions have been made to return efficient iterators• Comparisons between objects of very different types (such as between strings and ints) will raise an exception
In terms of how this has affected angr, any string that represents data from the emulated program will be abytestring. This means that where you previously said state.solver.eval(x, cast_to=str) you should now

140

Chapter 9. Appendix

angrsay cast_to=bytes. When creating concrete bitvectors from strings (including implicitly by just making a comparison against a string) these should be bytestrings. If they are not they will be utf-8 converted and a warning will be
printed. Symbol names should be unicode strings.
For division, however, ASTs are strongly typed so they will treat both division operators as the kind of division thatmakes sense for their type.

9.7.2 Clemory API changes
The memory object in CLE (project.loader.memory, not state.memory) has had a few breaking API changes since thebytes type is much nicer to work with than the py2 string for this specific case, and the old API was an inconsistent
mess.
BeforeAftermemory.read_bytes(addr, n) -> list[str]memory.write_bytes(addr, list[str])
memory.get_byte(addr) -> str
memory.read_addr_at(addr) -> int
memory.write_addr_at(addr, value) -> int
memory.stride_repr -> list[(start, end,
str)]

memory.load(addr, n) -> bytes
memory.store(addr, bytes)
memory[addr] -> int
memory.unpack_word(addr) -> int
memory.pack_word(addr, value)
memory.backers() -> iter[(start,
bytearray)]Additionally, pack_word and unpack_word now take optional size, endness, and signed parameters. We havealso added memory.pack(addr, fmt, *data) and memory.unpack(addr, fmt), which take format strings foruse with the struct module.
If you were using the cbackers or read_bytes_c functions, the conversion is a little more complicated - we wereable to remove the split notion of “backers” and “updates” and replaced all backers with bytearrays that we mutate, so
we can work directly with the backer objects. The backers() function iterates through all bottom-level backer objects
and their start addresses. You can provide an optional address to the function, and it will skip over all backers that end
before that address.
Here is some sample code for producing a C-pointer to a given address:
import cffi, cle
ffi = cffi.FFI()
ld = cle.Loader('/bin/true')
addr = ld.main_object.entry
try:backer_start, backer = next(ld.memory.backers(addr))
except StopIteration:raise Exception("not mapped")
if backer_start > addr:
raise Exception("not mapped")cbacker = ffi.from_buffer(backer)
addr_pointer = cbacker + (addr - backer_start)
You should not have to use this if you aren’t passing the data to a native library - the normal load methods should now
be more than fast enough for intensive use.

9.7. Migrating to angr 8

141

angr

9.7.3 CLE symbols changes
Previously, your mechanisms for looking up symbols by their address were loader.find_symbol() and object.
symbols_by_addr, where there was clearly some overlap. However, symbols_by_addr stayed because it was the
only way to enumerate symbols in an object. This has changed! symbols_by_addr is deprecated and here is now
object.symbols, a sorted list of Symbol objects, to enumerate symbols in a binary.
Additionally, you can now enumerate all symbols in the entire project with loader.symbols. This change has alsoenabled us to add a fuzzy parameter to find_symbol (returns the first symbol before the given address) and make theoutput of loader.describe_addr much nicer (shows offset from closest symbol).

9.7.4 Deprecations and name changes• All parameters in cle that started with custom_ - so, custom_base_addr, custom_entry_point,
custom_offset, custom_arch, and custom_ld_path - have had the custom_ removed from the beginningof their names.
• All the functions that were deprecated more than a year ago (at or before the angr 7 release) have been removed.
• state.se has been deprecated. You should have been using state.solver for the past few years.
• Support for immutable simulation managers has been removed. So far as we’re aware, nobody was actually using
this, and it was making debugging a pain.

9.8 Migrating to angr 7
The release of angr 7 introduces several departures from long-standing angr-isms. While the community has created acompatibility layer to give external code written for angr 6 a good chance of working on angr 7, the best thing to do isto port it to the new version. This document serves as a guide for this.

9.8.1 SimuVEX is goneangr versions up through angr 6 split the program analysis into two modules: simuvex, which was responsible foranalyzing the effects of a single piece of code (whether a basic block or a SimProcedure) on a program state, and angr,which aggregated analyses of these basic blocks into program-level analysis such as control-flow recovery, symbolic
execution, and so forth. In theory, this would encourage for the encapsulation of block-level analyses, and allow otherprogram analysis frameworks to build upon simuvex for their needs. In practice, no one (to our knowledge) usedsimuvex without angr, and the separation introduced frustrating limitations (such as not being able to reference thehistory of a state from a SimInspect breakpoint) and duplication of code (such as the need to synchronize data fromstate.scratch into path.history).
Realizing that SimuVEX wasn’t a usable independent package, we brainstormed about merging it into angr and further
noticed that this would allow us to address the frustrations resulting from their separation.
All of the SimuVEX concepts (SimStates, SimProcedures, calling conventions, types, etc) have been migrated into
angr. The migration guide for common classes is bellow:
BeforeAftersimuvex.SimStatesimuvex.SimProcedure
simuvex.SimEngine
simuvex.SimCC

angr.SimState
angr.SimProcedureangr.SimEngine
angr.SimCC

And for common modules:

142

Chapter 9. Appendix

angrBeforeAftersimuvex.s_cc
simuvex.s_statesimuvex.s_procedure
simuvex.plugins
simuvex.engines
simuvex.concretization_strategies

angr.calling_conventions
angr.sim_stateangr.sim_procedureangr.state_plugins
angr.engines
angr.concretization_strategies

Additionally, simuvex.SimProcedures has been renamed to angr.SIM_PROCEDURES, since it is a global variable
and not a class. There have been some other changes to its semantics, see the section on SimProcedures for details.

9.8.2 Removal of angr.Path
In angr, a Path object maintained references to a SimState and its history. The fact that the history was separated
from the state caused a lot of headaches when trying to analyze states inside a breakpoint, and caused overhead insynchronizing data from the state to its history.
In the new model, a state’s history is maintained in a SimState plugin: state.history. Since the path would now
simply point to the state, we got rid of it. The mapping of concepts is roughly as follows:
BeforeAfterpathpath.state
path.history
path.callstack
path.trace
path.addr_trace
path.jumpkinds
path.guards
path.targets
path.actions
path.eventspath.recent_actions
path.reachable

state
state
state.history
state.callstackstate.history.descriptions
state.history.bbl_addrs
state.history.jumpkinds
state.history.jump_guards
state.history.jump_targets
state.history.actions
state.history.events
state.history.recent_actions
state.history.reachable()

An important behavior change about path.actions and path.recent_actions - actions are no longer tracked bydefault. If you would like them to be tracked again, please add angr.options.refs to your state.
Path Group -> Simulation Manager
Since there are no paths, there cannot be a path group. Instead, we have a Simulation Manager now (we recommend
using the abbreviation “simgr” in places you were previously using “pg”), which is exactly the same as a path group
except it holds states instead of paths. You can make one with project.factory.simulation_manager(...).
Errored Paths
Before, error resilience was handled at the path level, where stepping a path that caused an error would return a subclassof Path called ErroredPath, and these paths would be put in the errored stash of a path group. Now, error resilienceis handled at the simulation manager level, and any state that throws an error during stepping will be wrapped in an
ErrorRecord object, which is not a subclass of SimState, and put into the errored list attribute of the simulation
manager, which is not a stash.

9.8. Migrating to angr 7

143

angr

An ErrorRecord object has attributes for .state (the initial state that caused the error), .error (the error that was
thrown), and .traceback (the traceback from the error). To debug these errors you can call .debug().
These changes are because we were uncomfortable making a subclass of SimState, and the ErrorRecord class then has
sufficiently different semantics from a normal state that it cannot be placed in a stash.

9.8.3 Changes to SimProcedures
The most noticeable difference from the old version to the new version is that the catalog of built-in simprocedures are no longer organized strictly according to which library they live in. Now, they are organized according to which standards they conform to, which helps with re-using procedures between different libraries.
For instance, the old SimProcedures['libc.so.6'] has been split up between SIM_PROCEDURES['libc'],
SIM_PROCEDURES['posix'], and SIM_PROCEDURES['glibc'], depending on what specifications each function
conforms to. This allows us to reuse the libc catalog in msvcrt.dll and the MUSL libc, for example.
In order to group SimProcedures together by libraries, we have introduced a new abstraction called the SimLibrary,
the definitions for which are stored in angr.procedures.definitions. Each SimLibrary object stores information
about a single shared library, and can contain SimProcedure implementations, calling convention information, andtype information. SimLibraries are scraped from the filesystem at import time, just like SimProcedures, and placed
into angr.SIM_LIBRARIES.
Syscalls are now categorized through a subclass of SimLibrary called SimSyscallLibrary. The API for managing
syscalls through SimOS has been changed - check the API docs for the SimUserspace class.
One important implication of this change is that if you previously used a trick where you changed one of the SimProcedures present in the SimProcedures dict in order to change which SimProcedures would be used to hook overlibrary functions by default, this will no longer work. Instead of SimProcedures[lib][func_name] = proc, you
now need to say SIM_LIBRARIES[lib].add(func_name, proc). But really you should just be using hook_symbol
anyway.

9.8.4 Changes to hooking
The Hook class is gone. Instead, we now can hook with individual instances of SimProcedure objects, as opposed tojust the classes. A shallow copy of the SimProcedure will be made at runtime to preserve thread safety.
So, previously, where you would have done project.hook(addr, Hook(proc, ...)) or project.hook(addr,proc), you can now do project.hook(addr, proc(...)). In order to use simple functions as hooks, you caneither say project.hook(addr, func) or decorate the declaration of your function with @project.hook(addr).
Having simprocedures as instances and letting them have access to the project cleans up a lot of other hacks that were
present in the codebase, mostly related to the self.call(...) SimProcedure continuation system. It is no longer
required to set IS_FUNCTION = True if you intend to use self.call() while writing a SimProcedure, and eachcall-return target you use will have a unique address associated with it. These addresses will be allocated lazily, which
does have the side effect of making address allocation nondeterministic, sometimes based on dictionary-iteration order.

9.8.5 Changes to loading
The hook_symbol method will no longer attempt to redo relocations for the given symbol, instead just hooking directly
over the address of the symbol in whatever library it comes from. This speeds up loading substantially and ensuresmore consistent behavior for when mixing and matching native library code and SimProcedure summaries.
The angr externs object has been moved into CLE, which will ALWAYS make sure that every dependency is resolved
to something, never left unrelocated. Similarly, CLE provides the “kernel object” used to provide addresses for syscalls
now.

144

Chapter 9. Appendix

angrBeforeAfterproject._extern_obj
project._syscall_obj

loader.extern_object
loader.kernel_object

Several properties and methods have been renamed in CLE in order to maintain a more consistent and explicit API.
The most common changes are listed below:
BeforeAfterloader.whats_at()loader.addr_belongs_to_object()loader.find_symbol_name()
whatever the hell you were doing before to look up a symbol
loader.find_module_name()loader.describe_addr
loader.find_object_containing()
loader.find_symbol().nameloader.find_symbol(name or addr)
loader.find_object_containing().
providesloader.find_relevant_relocations()
loader.main_object
anything.min_addr
symbol.linked_addr

loader.find_symbol_got_entry()loader.main_bin
anything.get_min_addr()
symbol.addr

9.8.6 Changes to the solver interface
We cleaned up the menagerie of functions present on state.solver (if you’re still referring to it as state.se you
should stop) and simplified it into a cleaner interface:• solver.eval(expression) will give you one possible solution to the given expression.
• solver.eval_one(expression) will give you the solution to the given expression, or throw an error if morethan one solution is possible.
• solver.eval_upto(expression, n) will give you up to n solutions to the given expression, returning fewer
than n if fewer than n are possible.
• solver.eval_atleast(expression, n) will give you n solutions to the given expression, throwing an error
if fewer than n are possible.
• solver.eval_exact(expression, n) will give you n solutions to the given expression, throwing an error if
fewer or more than are possible.
• solver.min(expression) will give you the minimum possible solution to the given expression.
• solver.max(expression) will give you the maximum possible solution to the given expression.
Additionally, all of these methods can take the following keyword arguments:• extra_constraints can be passed as a tuple of constraints. These constraints will be taken into account forthis evaluation, but will not be added to the state.
• cast_to can be passed a data type to cast the result to. Currently, this can only be str, which will cause themethod to return the byte representation of the underlying data. For example, state.solver.eval(state.
solver.BVV(0x41424344, 32, cast_to=str) will return "ABCD".

9.8. Migrating to angr 7

145

angr

146

Chapter 9. Appendix

CHAPTERTENAPI REFERENCE

class angr.SimProcedure(project=None, cc=None, prototype=None, symbolic_return=None, returns=None,
is_syscall=False, is_stub=False, num_args=None, display_name=None,library_name=None, is_function=None, **kwargs)
Bases: object
A SimProcedure is a wonderful object which describes a procedure to run on a state.
You may subclass SimProcedure and override run(), replacing it with mutating self.state however you like,and then either returning a value or jumping away somehow.
A detailed discussion of programming SimProcedures may be found at https://docs.angr.io/extending-angr/simprocedures
Parametersarch – The architecture to use for this procedure
The following parameters are optional:
Parameters• symbolic_return – Whether the procedure’s return value should be stubbed into a single
symbolic variable constratined to the real return value• returns – Whether the procedure should return to its caller afterwards• is_syscall – Whether this procedure is a syscall• num_args – The number of arguments this procedure should extract• display_name – The name to use when displaying this procedure• library_name – The name of the library from which the function we’re emulating comes• cc – The SimCC to use for this procedure• sim_kwargs – Additional keyword arguments to be passed to run()• is_function – Whether this procedure emulates a function
The following class variables should be set if necessary when implementing a new SimProcedure:
Variables• NO_RET – Set this to true if control flow will never return from this function• DYNAMIC_RET – Set this to true if whether the control flow returns from this function or not
depends on the context (e.g., libc’s error() call). Must implement dynamic_returns() method.
• ADDS_EXITS – Set this to true if you do any control flow other than returning• IS_FUNCTION – Does this procedure simulate a function? True by default

147

angr

• ARGS_MISMATCH – Does this procedure have a different list of arguments than what is provided in the function specification? This may happen when we manually extract argumentsin the run() method of a SimProcedure. False by default.
• local_vars – If you use self.call(), set this to a list of all the local variable names inyour class. They will be restored on return.
The following instance variables are available when working with simprocedures from the inside or the outside:
Variables• project – The associated angr project• arch – The associated architecture• addr – The linear address at which the procedure is executing• cc – The calling convention in use for engaging with the ABI• canonical – The canonical version of this SimProcedure. Procedures are deepcopied formany reasons, including to be able to store state related to a specific run and to be able tohook continuations.
• kwargs – Any extra keyword arguments used to construct the procedure; will be passed torun• display_name – See the eponymous parameter• library_name – See the eponymous parameter• abi – If this is a syscall simprocedure, which ABI are we using to map the syscall numbers?
• symbolic_return – See the eponymous parameter• syscall_number – If this procedure is a syscall, the number will be populated here.
• returns – See eponymous parameter and NO_RET cvar
• is_syscall – See eponymous parameter• is_function – See eponymous parameter and cvar
• is_stub – See eponymous parameter• is_continuation – Whether this procedure is the original or a continuation resulting fromself.call()• continuations – A mapping from name to each known continuation• run_func – The name of the function implementing the procedure. “run” by default, butdifferent in continuations.
• num_args – The number of arguments to the procedure. If not provided in the parameter,
extracted from the definition of self.run
The following instance variables are only used in a copy of the procedure that is actually executing on a state:
Variables• state – The SimState we should be mutating to perform the procedure• successors – The SimSuccessors associated with the current step• arguments – The function arguments, deserialized from the state• arg_session – The ArgSession that was used to parse arguments out of the state, in caseyou need it for varargs

148

Chapter 10. API Referenceangr• use_state_arguments – Whether we’re using arguments extracted from the state or manually provided• ret_to – The current return address• ret_expr – The computed return value• call_ret_expr – The return value from having used self.call()• inhibit_autoret – Whether we should avoid automatically adding an exit for returning
once the run function ends
• arg_session – The ArgSession object that was used to extract the runtime argument values.
Useful for if you want to extract variadic args.
__init__(project=None, cc=None, prototype=None, symbolic_return=None, returns=None,
is_syscall=False, is_stub=False, num_args=None, display_name=None, library_name=None,is_function=None, **kwargs)
state:

SimState

execute(state, successors=None, arguments=None, ret_to=None)
Call this method with a SimState and a SimSuccessors to execute the procedure.
Alternately, successors may be none if this is an inline call. In that case, you should provide arguments tothe function.
make_continuation(name)
NO_RET = False
DYNAMIC_RET = False
ADDS_EXITS = False
IS_FUNCTION = True
ARGS_MISMATCH = False
ALT_NAMES = None
local_vars:

tuple[str, ...] = ()run(*args, **kwargs)
Implement the actual procedure here!
static_exits(blocks, **kwargs)
Get new exits by performing static analysis and heuristics. This is a fast and best-effort approach to get new
exits for scenarios where states are not available (e.g. when building a fast CFG).
Parameters
blocks (list) – Blocks that are executed before reaching this SimProcedure.
Returns
A list of dicts. Each dict should contain the following entries: ‘address’, ‘jumpkind’, and‘namehint’.
Return type
list

149

angr

dynamic_returns(blocks, **kwargs)
Determines if a call to this function returns or not by performing static analysis and heuristics.
Parameters
blocks – Blocks that are executed before reaching this SimProcedure.
Return typebool
Returns
True if the call returns, False otherwise.
property should_add_successors
set_args(args)
va_arg(ty, index=None)
inline_call(procedure, *arguments, **kwargs)
Call another SimProcedure in-line to retrieve its return value. Returns an instance of the procedure withthe ret_expr property set.
Parameters• procedure – The class of the procedure to execute• arguments – Any additional positional args will be used as arguments to the procedurecall• sim_kwargs – Any additional keyword args will be passed as sim_kwargs to the procedure
constructor
fix_prototype_returnty(ret_size)ret(expr=None)
Add an exit representing a return from this function. If this is not an inline call, grab a return address fromthe state and jump to it. If this is not an inline call, set a return expression with the calling convention.
call(addr, args, continue_at, cc=None, prototype=None, jumpkind='Ijk_Call')
Add an exit representing calling another function via pointer.
Parameters• addr – The address of the function to call• args – The list of arguments to call the function with• continue_at – Later, when the called function returns, execution of the current procedure
will continue in the named method.
• cc – Optional: use this calling convention for calling the new function. Default is to use
the current convention.
• prototype – Optional: The prototype to use for the call. Will default to all-ints.
jump(addr, jumpkind='Ijk_Boring')
Add an exit representing jumping to an address.
exit(exit_code)
Add an exit representing terminating the program.
ty_ptr(ty)150

Chapter 10. API Referenceangrproperty is_java
property argument_types
property return_type
class angr.BP(when='before', enabled=None, condition=None, action=None, **kwargs)
Bases: object
A breakpoint.
__init__(when='before', enabled=None, condition=None, action=None, **kwargs)
check(state, when)
Checks state state to see if the breakpoint should fire.
Parameters• state – The state.
• when – Whether the check is happening before or after the event.
Returns
A boolean representing whether the checkpoint should fire.
fire(state)
Trigger the breakpoint.
Parametersstate – The state.
class angr.SimStatePlugin
Bases: object
This is a base class for SimState plugins. A SimState plugin will be copied along with the state when the state isbranched. They are intended to be used for things such as tracking open files, tracking heap details, and providing
storage and persistence for SimProcedures.
STRONGREF_STATE = False__init__()set_state(state)
Sets a new state (for example, if the state has been branched)
set_strongref_state(state)copy(_memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

151

angr

static memo(f )A decorator function you should apply to copy
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return type
bool

152

Chapter 10. API Referenceangrclassmethod register_default(name, xtr=None)
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.Project(thing, default_analysis_mode=None, ignore_functions=None, use_sim_procedures=True,
exclude_sim_procedures_func=None, exclude_sim_procedures_list=(), arch=None,simos=None, engine=None, load_options=None, translation_cache=True,
selfmodifying_code=False, support_selfmodifying_code=None, store_function=None,load_function=None, analyses_preset=None, concrete_target=None,eager_ifunc_resolution=None, **kwargs)
Bases: object
This is the main class of the angr module. It is meant to contain a set of binaries and the relationships between
them, and perform analyses on them.
Parameters• thing – The path to the main executable object to analyze, or a CLE Loader object.
• arch (Arch )• load_options (dict[str, Any] | None)• selfmodifying_code (bool)• support_selfmodifying_code (bool | None)
The following parameters are optional.
Parameters• default_analysis_mode – The mode of analysis to use by default. Defaults to ‘symbolic’.
• ignore_functions – A list of function names that, when imported from shared libraries,
should never be stepped into in analysis (calls will return an unconstrained value).
• use_sim_procedures – Whether to replace resolved dependencies for which simprocedures are available with said simprocedures.
• exclude_sim_procedures_func – A function that, when passed a function name, returns
whether or not to wrap it with a simprocedure.
• exclude_sim_procedures_list – A list of functions to not wrap with simprocedures.
• arch – The target architecture (auto-detected otherwise).
• simos – a SimOS class to use for this project.
• engine – The SimEngine class to use for this project.
• translation_cache (bool) – If True, cache translated basic blocks rather than retranslating them.
• selfmodifying_code (bool) – Whether we aggressively support self-modifying code.
When enabled, emulation will try to read code from the current state instead of the original memory, regardless of the current memory protections.
• store_function – A function that defines how the Project should be stored. Default topickling.
• load_function – A function that defines how the Project should be loaded. Default to
unpickling.

153

angr

• analyses_preset (angr.misc.PluginPreset) – The plugin preset for the analyses
provider (i.e. Analyses instance).
• load_options (dict[str, Any] | None)• support_selfmodifying_code (bool | None)
Any additional keyword arguments passed will be passed onto cle.Loader.
Variables• analyses – The available analyses.
• entry – The program entrypoint.
• factory – Provides access to important analysis elements such as path groups and symbolic
execution results.
• filename – The filename of the executable.
• loader – The program loader.
• storage – Dictionary of things that should be loaded/stored with the Project.
Parameters• arch (Arch )• load_options (dict[str, Any] | None)• selfmodifying_code (bool)• support_selfmodifying_code (bool | None)__init__(thing, default_analysis_mode=None, ignore_functions=None, use_sim_procedures=True,
exclude_sim_procedures_func=None, exclude_sim_procedures_list=(), arch=None, simos=None,engine=None, load_options=None, translation_cache=True, selfmodifying_code=False,
support_selfmodifying_code=None, store_function=None, load_function=None,
analyses_preset=None, concrete_target=None, eager_ifunc_resolution=None, **kwargs)
Parameters• load_options (dict[str, Any] | None)• selfmodifying_code (bool)• support_selfmodifying_code (bool | None)
arch:

Arch

property analyses:

AnalysesHubWithDefaulthook(addr, hook=None, length=0, kwargs=None, replace=False)
Hook a section of code with a custom function. This is used internally to provide symbolic summaries oflibrary functions, and can be used to instrument execution or to modify control flow.
When hook is not specified, it returns a function decorator that allows easy hooking. Usage:# Assuming proj is an instance of angr.Project, we will add a custom hook at␣˓→the entry# point of the project.
@proj.hook(proj.entry)
def my_hook(state):
print("Welcome to execution!")154

Chapter 10. API ReferenceangrParameters• addr – The address to hook.
• hook – A angr.project.Hook describing a procedure to run at the given address. You
may also pass in a SimProcedure class or a function directly and it will be wrapped in a
Hook object for you.
• length – If you provide a function for the hook, this is the number of bytes that will beskipped by executing the hook by default.
• kwargs – If you provide a SimProcedure for the hook, these are the keyword argumentsthat will be passed to the procedure’s run method eventually.
• replace (bool | None) – Control the behavior on finding that the address is already hooked.
If true, silently replace the hook. If false (default), warn and do not replace the hook. If
none, warn and replace the hook.
is_hooked(addr)
Returns True if addr is hooked.
Parametersaddr – An address.
Return typebool
Returns
True if addr is hooked, False otherwise.
hooked_by(addr)
Returns the current hook for addr.
Parametersaddr – An address.
Return type
SimProcedure | None
Returns
None if the address is not hooked.
unhook(addr)
Remove a hook.
Parametersaddr – The address of the hook.
hook_symbol(symbol_name, simproc, kwargs=None, replace=None)
Resolve a dependency in a binary. Looks up the address of the given symbol, and then hooks that address.
If the symbol was not available in the loaded libraries, this address may be provided by the CLE externs
object.
Additionally, if instead of a symbol name you provide an address, some secret functionality will kick inand you will probably just hook that address, UNLESS you’re on powerpc64 ABIv1 or some yet-unknown
scary ABI that has its function pointers point to something other than the actual functions, in which caseit’ll do the right thing.
Parameters• symbol_name – The name of the dependency to resolve.

155

angr

• simproc – The SimProcedure instance (or function) with which to hook the symbol• kwargs – If you provide a SimProcedure for the hook, these are the keyword argumentsthat will be passed to the procedure’s run method eventually.
• replace (Optional[bool]) – Control the behavior on finding that the address is alreadyhooked. If true, silently replace the hook. If false, warn and do not replace the hook. If
none (default), warn and replace the hook.
Returns
The address of the new symbol.
Return typeint
symbol_hooked_by(symbol_name)Return the SimProcedure, if it exists, for the given symbol name.
Parameters
symbol_name (str) – Name of the symbol.
Return type
SimProcedure | None
Returns
None if the address is not hooked.
is_symbol_hooked(symbol_name)
Check if a symbol is already hooked.
Parameters
symbol_name (str) – Name of the symbol.
Returns
True if the symbol can be resolved and is hooked, False otherwise.
Return typeboolunhook_symbol(symbol_name)Remove the hook on a symbol. This function will fail if the symbol is provided by the extern object, as thatwould result in a state where analysis would be unable to cope with a call to this symbol.
rehook_symbol(new_address, symbol_name, stubs_on_sync)
Move the hook for a symbol to a specific address :type new_address: :param new_address: the new addressthat will trigger the SimProc execution :type symbol_name: :param symbol_name: the name of the symbol(f.i. strcmp ) :return: None
execute(*args, **kwargs)
This function is a symbolic execution helper in the simple style supported by triton and manticore. It
designed to be run after setting up hooks (see Project.hook), in which the symbolic state can be checked.
This function can be run in three different ways:• When run with no parameters, this function begins symbolic execution from the entrypoint.
• It can also be run with a “state” parameter specifying a SimState to begin symbolic execution from.
• Finally, it can accept any arbitrary keyword arguments,
project.factory.full_init_state.

which are all passed toIf symbolic execution finishes, this function returns the resulting simulation manager.

156

Chapter 10. API Referenceangrterminate_execution()
Terminates a symbolic execution that was started with Project.execute().
angr.load_shellcode(shellcode, arch, start_offset=0, load_address=0, thumb=False, **kwargs)
Load a new project based on a snippet of assembly or bytecode.
Parameters• shellcode (bytes | str) – The data to load, as either a bytestring of instructions or a stringof assembly text
• arch – The name of the arch to use, or an archinfo class• start_offset – The offset into the data to start analysis (default 0)• load_address – The address to place the data in memory (default 0)• thumb – Whether this is ARM Thumb shellcode
exception angr.AngrError
Bases: Exception
exception angr.AngrRuntimeError
Bases: RuntimeError
exception angr.AngrValueError
Bases: AngrError, ValueError
exception angr.AngrLifterError
Bases: AngrError
exception angr.AngrExitError
Bases: AngrError
exception angr.AngrPathError
Bases: AngrError
exception angr.AngrVaultError
Bases: AngrError
exception angr.PathUnreachableError
Bases: AngrPathError
exception angr.SimulationManagerError
Bases: AngrError
exception angr.AngrInvalidArgumentError
Bases: AngrError
exception angr.AngrSurveyorError
Bases: AngrError
exception angr.AngrAnalysisError
Bases: AngrError
exception angr.AngrBladeError
Bases: AngrError
exception angr.AngrBladeSimProcError
Bases: AngrBladeError

157

angr

exception angr.AngrAnnotatedCFGError
Bases: AngrError
exception angr.AngrBackwardSlicingError
Bases: AngrError
exception angr.AngrCallableError
Bases: AngrSurveyorError
exception angr.AngrCallableMultistateError
Bases: AngrCallableError
exception angr.AngrSyscallError
Bases: AngrError
exception angr.AngrSimOSError
Bases: AngrError
exception angr.AngrAssemblyError
Bases: AngrError
exception angr.AngrTypeError
Bases: AngrError, TypeError
exception angr.AngrMissingTypeError
Bases: AngrTypeError
exception angr.AngrIncongruencyError
Bases: AngrAnalysisError
exception angr.AngrForwardAnalysisError
Bases: AngrError
exception angr.AngrSkipJobNoticeBases: AngrForwardAnalysisError
exception angr.AngrDelayJobNoticeBases: AngrForwardAnalysisError
exception angr.AngrJobMergingFailureNoticeBases: AngrForwardAnalysisError
exception angr.AngrJobWideningFailureNoticeBases: AngrForwardAnalysisError
exception angr.AngrCFGError
Bases: AngrError
exception angr.AngrVFGError
Bases: AngrError
exception angr.AngrVFGRestartAnalysisNoticeBases: AngrVFGError
exception angr.AngrDataGraphError
Bases: AngrAnalysisError

158

Chapter 10. API Referenceangrexception angr.AngrDDGError
Bases: AngrAnalysisError
exception angr.AngrLoopAnalysisError
Bases: AngrAnalysisError
exception angr.AngrExplorationTechniqueError
Bases: AngrError
exception angr.AngrExplorerError
Bases: AngrExplorationTechniqueError
exception angr.AngrDirectorError
Bases: AngrExplorationTechniqueError
exception angr.AngrTracerError
Bases: AngrExplorationTechniqueError
exception angr.AngrDBError
Bases: AngrError
exception angr.AngrCorruptDBError
Bases: AngrDBError
exception angr.AngrIncompatibleDBError
Bases: AngrDBError
exception angr.TracerEnvironmentError
Bases: AngrError
exception angr.SimError
Bases: Exception
bbl_addr = None
stmt_idx = None
ins_addr = None
executed_instruction_count = None
guard = None
record_state(state)
exception angr.SimStateError
Bases: SimError
exception angr.SimMergeError
Bases: SimStateError
exception angr.SimMemoryError
Bases: SimStateError
exception angr.SimMemoryMissingError(missing_addr, missing_size, *args)
Bases: SimMemoryError__init__(missing_addr, missing_size, *args)

159

angr

exception angr.SimAbstractMemoryError
Bases: SimMemoryError
exception angr.SimRegionMapError
Bases: SimMemoryError
exception angr.SimMemoryLimitError
Bases: SimMemoryError
exception angr.SimMemoryAddressError
Bases: SimMemoryError
exception angr.SimFastMemoryError
Bases: SimMemoryError
exception angr.SimEventError
Bases: SimStateError
exception angr.SimPosixError
Bases: SimStateError
exception angr.SimFilesystemError
Bases: SimError
exception angr.SimSymbolicFilesystemError
Bases: SimFilesystemError
exception angr.SimFileError
Bases: SimMemoryError, SimFilesystemError
exception angr.SimHeapError
Bases: SimStateError
exception angr.SimUnsupportedError
Bases: SimError
exception angr.SimSolverError
Bases: SimError
exception angr.SimSolverModeError
Bases: SimSolverError
exception angr.SimSolverOptionError
Bases: SimSolverError
exception angr.SimValueError
Bases: SimSolverError
exception angr.SimUnsatError
Bases: SimValueError
exception angr.SimOperationError
Bases: SimError
exception angr.UnsupportedIROpError
Bases: SimOperationError, SimUnsupportedError
exception angr.SimExpressionError
Bases: SimError

160

Chapter 10. API Referenceangrexception angr.UnsupportedIRExprError
Bases: SimExpressionError, SimUnsupportedError
exception angr.SimCCallError
Bases: SimExpressionError
exception angr.UnsupportedCCallError
Bases: SimCCallError, SimUnsupportedError
exception angr.SimUninitializedAccessError(expr_type, expr)
Bases: SimExpressionError__init__(expr_type, expr)
exception angr.SimStatementError
Bases: SimError
exception angr.UnsupportedIRStmtError
Bases: SimStatementError, SimUnsupportedError
exception angr.UnsupportedDirtyError
Bases: UnsupportedIRStmtError, SimUnsupportedError
exception angr.SimMissingTempError
Bases: SimValueError, IndexError
exception angr.SimEngineError
Bases: SimError
exception angr.SimIRSBError
Bases: SimEngineError
exception angr.SimTranslationError
Bases: SimEngineError
exception angr.SimProcedureError
Bases: SimEngineError
exception angr.SimProcedureArgumentError
Bases: SimProcedureError
exception angr.SimShadowStackError
Bases: SimProcedureError
exception angr.SimFastPathError
Bases: SimEngineError
exception angr.SimIRSBNoDecodeError
Bases: SimIRSBError
exception angr.AngrUnsupportedSyscallError
Bases: AngrSyscallError, SimProcedureError, SimUnsupportedError
angr.UnsupportedSyscallError
alias of AngrUnsupportedSyscallError
exception angr.SimReliftException(state)
Bases: SimEngineError

161

angr

__init__(state)
exception angr.SimSlicerError
Bases: SimError
exception angr.SimActionError
Bases: SimError
exception angr.SimCCError
Bases: SimError
exception angr.SimUCManagerError
Bases: SimError
exception angr.SimUCManagerAllocationError
Bases: SimUCManagerError
exception angr.SimUnicornUnsupport
Bases: SimError
exception angr.SimUnicornError
Bases: SimError
exception angr.SimUnicornSymbolic
Bases: SimError
exception angr.SimEmptyCallStackError
Bases: SimError
exception angr.SimStateOptionsError
Bases: SimError
exception angr.SimException
Bases: SimError
exception angr.SimSegfaultException(addr, reason, original_addr=None)
Bases: SimException, SimMemoryError__init__(addr, reason, original_addr=None)angr.SimSegfaultError
alias of SimSegfaultException
exception angr.SimZeroDivisionException
Bases: SimException, SimOperationError
exception angr.AngrNoPluginError
Bases: AngrError
exception angr.SimConcreteMemoryError
Bases: AngrError
exception angr.SimConcreteRegisterError
Bases: AngrError
exception angr.SimConcreteBreakpointError
Bases: AngrError

162

Chapter 10. API Referenceangrexception angr.AngrDecompilationError
Bases: AngrError
exception angr.UnsupportedNodeTypeError
Bases: AngrError, NotImplementedError
class angr.Blade(graph, dst_run, dst_stmt_idx, direction='backward', project=None, cfg=None,
ignore_sp=False, ignore_bp=False, ignored_regs=None, max_level=3, base_state=None,
stop_at_calls=False, cross_insn_opt=False, max_predecessors=10, include_imarks=True)
Bases: object
Blade is a light-weight program slicer that works with networkx DiGraph containing CFGNodes. It is meant to
be used in angr for small or on-the-fly analyses.
Parameters• graph (networkx.DiGraph )• dst_run (int)• dst_stmt_idx (int)• direction (str)• ignore_sp (bool)• ignore_bp (bool)• max_level (int)• stop_at_calls (bool)• max_predecessors (int)• include_imarks (bool)__init__(graph, dst_run, dst_stmt_idx, direction='backward', project=None, cfg=None, ignore_sp=False,
ignore_bp=False, ignored_regs=None, max_level=3, base_state=None, stop_at_calls=False,
cross_insn_opt=False, max_predecessors=10, include_imarks=True)
Parameters• graph (DiGraph) – A graph representing the control flow graph. Note that it does not takeangr.analyses.CFGEmulated or angr.analyses.CFGFast.
• dst_run (int) – An address specifying the target SimRun.
• dst_stmt_idx (int) – The target statement index. -1 means executing until the last statement.
• direction (str) – ‘backward’ or ‘forward’ slicing. Forward slicing is not yet supported.
• project (angr.Project) – The project instance.
• cfg (angr.analyses.CFGBase) – the CFG instance. It will be made mandatory later.
• ignore_sp (bool) – Whether the stack pointer should be ignored in dependency tracking.
Any dependency from/to stack pointers will be ignored if this options is True.
• ignore_bp (bool) – Whether the base pointer should be ignored or not.
• max_level (int) – The maximum number of blocks that we trace back for.
• stop_at_calls (bool) – Limit slicing within a single function. Do not proceed when
encounters a call edge.

163

angr

• include_imarks (bool) – Should IMarks (instruction boundaries) be included in theslice.
• max_predecessors (int)
ReturnsNoneproperty slice
dbg_repr(arch=None)class angr.SimOS(project, name=None)
Bases: object
A class describing OS/arch-level configuration.
Parameters
project (angr.Project)__init__(project, name=None)
Parameters
project (Project)configure_project()Configure the project to set up global settings (like SimProcedures).
state_blank(addr=None, initial_prefix=None, brk=None, stack_end=None, stack_size=8388608,
stdin=None, thread_idx=None, permissions_backer=None, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.
• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space• brk – The address of the process’ break.
Returns
The initialized SimState.
Any additional arguments will be passed to the SimState constructor
state_entry(**kwargs)
state_full_init(**kwargs)
state_call(addr, *args, **kwargs)
prepare_call_state(calling_state, initial_state=None, preserve_registers=(), preserve_memory=())
This function prepares a state that is executing a call instruction. If given an initial_state, it copies over allof the critical registers to it from the calling_state. Otherwise, it prepares the calling_state for action.
This is mostly used to create minimalistic for CFG generation. Some ABIs, such as MIPS PIE and x86 PIE,
require certain information to be maintained in certain registers. For example, for PIE MIPS, this function
transfer t9, gp, and ra to the new state.

164

Chapter 10. API Referenceangrprepare_function_symbol(symbol_name, basic_addr=None)
Prepare the address space with the data necessary to perform relocations pointing to the given symbol
Returns a 2-tuple. The first item is the address of the function code, the second is the address of therelocation target.
handle_exception(successors, engine, exception)
Perform exception handling. This method will be called when, during execution, a SimException is thrown.
Currently, this can only indicate a segfault, but in the future it could indicate any unexpected exceptional
behavior that can’t be handled by ordinary control flow.
The method may mutate the provided SimSuccessors object in any way it likes, or re-raise the exception.
Parameters• successors – The SimSuccessors object currently being executed on• engine – The engine that was processing this step
• exception – The actual exception object
syscall(state, allow_unsupported=True)syscall_abi(state)
Return typestr
syscall_cc(state)
Return type
SimCCSyscall | None
is_syscall_addr(addr)
syscall_from_addr(addr, allow_unsupported=True)syscall_from_number(number, allow_unsupported=True, abi=None)
setup_gdt(state, gdt)
Write the GlobalDescriptorTable object in the current state memory
Parameters• state – state in which to write the GDT• gdt – GlobalDescriptorTable object
Returns
generate_gdt(fs, gs, fs_size=4294967295, gs_size=4294967295)
Generate a GlobalDescriptorTable object and populate it using the value of the gs and fs register
Parameters• fs – value of the fs segment register• gs – value of the gs segment register• fs_size – size of the fs segment register• gs_size – size of the gs segment register
Returns
gdt a GlobalDescriptorTable object

165

angr

class angr.Block(addr, project=None, arch=None, size=None, max_size=None, byte_string=None, vex=None,
thumb=False, backup_state=None, extra_stop_points=None, opt_level=None,
num_inst=None, traceflags=0, strict_block_end=None, collect_data_refs=False,
cross_insn_opt=True, load_from_ro_regions=False, const_prop=False, initial_regs=None,skip_stmts=False)
Bases: Serializable
Represents a basic block in a binary or a program.
BLOCK_MAX_SIZE = 4096__init__(addr, project=None, arch=None, size=None, max_size=None, byte_string=None, vex=None,
thumb=False, backup_state=None, extra_stop_points=None, opt_level=None, num_inst=None,
traceflags=0, strict_block_end=None, collect_data_refs=False, cross_insn_opt=True,
load_from_ro_regions=False, const_prop=False, initial_regs=None, skip_stmts=False)
arch
thumb
addr
size
pp(**kwargs)
set_initial_regs()
static reset_initial_regs()
property vex:

IRSB

property vex_nostmt
property disassembly: DisassemblerBlock
Provide a disassembly object using whatever disassembler is available
property capstone
property codenodeproperty bytes:

bytes

property instructions
property instruction_addrs
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
166

Chapter 10. API ReferenceangrReturns
A unserialized class object.
Return typecls
class angr.SimulationManager(project, active_states=None, stashes=None, hierarchy=None,
resilience=None, save_unsat=False, auto_drop=None, errored=None,completion_mode=<built-in function any>, techniques=None,suggestions=True, **kwargs)
Bases: object
The Simulation Manager is the future future.
Simulation managers allow you to wrangle multiple states in a slick way. States are organized into “stashes”,
which you can step forward, filter, merge, and move around as you wish. This allows you to, for example, step
two different stashes of states at different rates, then merge them together.
Stashes can be accessed as attributes (i.e. .active). A mulpyplexed stash can be retrieved by prepending the namewith mp_, e.g. .mp_active. A single state from the stash can be retrieved by prepending the name with one_, e.g.
.one_active.
Note that you shouldn’t usually be constructing SimulationManagers directly - there is a convenient shortcut for
creating them in Project.factory: see angr.factory.AngrObjectFactory.
The most important methods you should look at are step, explore, and use_technique.
Parameters• project (angr.project.Project) – A Project instance.
• stashes – A dictionary to use as the stash store.
• active_states – Active states to seed the “active” stash with.
• hierarchy – A StateHierarchy object to use to track the relationships between states.
• resilience – A set of errors to catch during stepping to put a state in the errore list. You
may also provide the values False, None (default), or True to catch, respectively, no errors,
all angr-specific errors, and a set of many common errors.
• save_unsat – Set to True in order to introduce unsatisfiable states into the unsat stash
instead of discarding them immediately.
• auto_drop – A set of stash names which should be treated as garbage chutes.
• completion_mode – A function describing how multiple exploration techniques with thecomplete hook set will interact. By default, the builtin function any.
• techniques – A list of techniques that should be pre-set to use with this manager.
• suggestions – Whether to automatically install the Suggestions exploration technique. Default True.
Variables• errored – Not a stash, but a list of ErrorRecords. Whenever a step raises an exception that
we catch, the state and some information about the error are placed in this list. You can adjust
the list of caught exceptions with the resilience parameter.
• stashes – All the stashes on this instance, as a dictionary.
• completion_mode – A function describing how multiple exploration techniques with thecomplete hook set will interact. By default, the builtin function any.

167

angr

ALL = '_ALL'
DROP = '_DROP'__init__(project, active_states=None, stashes=None, hierarchy=None, resilience=None, save_unsat=False,
auto_drop=None, errored=None, completion_mode=<built-in function any>, techniques=None,suggestions=True, **kwargs)
active:list[SimState]

stashed:list[SimState]pruned:list[SimState]

unsat:

list[SimState]deadended:list[SimState]

unconstrained:
found:

list[SimState]

list[SimState]one_active:

SimState

one_stashed:

SimState

one_pruned:

SimState

one_unsat:

SimState

one_deadended:

SimState

one_unconstrained:
one_found:

SimState

SimState

property errored:

list[ErrorRecord ]property stashes:

defaultdict[str, list[SimState]]

mulpyplex(*stashes)
Mulpyplex across several stashes.
Parameters
stashes – the stashes to mulpyplex
Returnsa mulpyplexed list of states from the stashes in question, in the specified ordercopy(deep=False)
Make a copy of this simulation manager. Pass deep=True to copy all the states in it as well.
If the current callstack includes hooked methods, the already-called methods will not be included in the
copy.
use_technique(tech)Use an exploration technique with this SimulationManager.
Techniques can be found in angr.exploration_techniques.

168

Chapter 10. API ReferenceangrParameters
tech (ExplorationTechnique) – An ExplorationTechnique object that contains code tomodify this SimulationManager’s behavior.
Returns
The technique that was added, for convenience
remove_technique(tech)
Remove an exploration technique from a list of active techniques.
Parameters
tech (ExplorationTechnique) – An ExplorationTechnique object.
explore(stash='active', n=None, find=None, avoid=None, find_stash='found', avoid_stash='avoid',
cfg=None, num_find=1, avoid_priority=False, **kwargs)
Tick stash “stash” forward (up to “n” times or until “num_find” states are found), looking for condition “find”, avoiding condition “avoid”. Stores found states into “find_stash’ and avoided states into
“avoid_stash”.
The “find” and “avoid” parameters may be any of:• An address to find
• A set or list of addresses to find
• A function that takes a state and returns whether or not it matches.
If an angr CFG is passed in as the “cfg” parameter and “find” is either a number or a list or a set, then any
states which cannot possibly reach a success state without going through a failure state will be preemptively
avoided.
run(stash='active', n=None, until=None, **kwargs)
Run until the SimulationManager has reached a completed state, according to the current exploration techniques. If no exploration techniques that define a completion state are being used, run until there is nothingleft to run.
Parameters• stash – Operate on this stash• n – Step at most this many times• until – If provided, should be a function that takes a SimulationManager and returns Trueor False. Stepping will terminate when it is True.
Returns
The simulation manager, for chaining.
Return type
SimulationManager
complete()
Returns whether or not this manager has reached a “completed” state.
step(stash='active', target_stash=None, n=None, selector_func=None, step_func=None, error_list=None,
successor_func=None, until=None, filter_func=None, **run_args)
Step a stash of states forward and categorize the successors appropriately.
The parameters to this function allow you to control everything about the stepping and categorization process.
Parameters

169

angr

• stash – The name of the stash to step (default: ‘active’)• target_stash – The name of the stash to put the results in (default: same as stash)• error_list – The list to put ErrorRecord objects in (default: self.errored)• selector_func – If provided, should be a function that takes a state and returns a boolean.
If True, the state will be stepped. Otherwise, it will be kept as-is.
• step_func – If provided, should be a function that takes a SimulationManager and returns
a SimulationManager. Will be called with the SimulationManager at every step. Note that
this function should not actually perform any stepping - it is meant to be a maintenancefunction called after each step.
• successor_func – If provided, should be a function that takes a state and return its successors. Otherwise, project.factory.successors will be used.
• filter_func – If provided, should be a function that takes a state and return the name ofthe stash, to which the state should be moved.
• until – (DEPRECATED) If provided, should be a function that takes a SimulationManager and returns True or False. Stepping will terminate when it is True.
• n – (DEPRECATED) The number of times to step (default: 1 if “until” is not provided)
Additionally, you can pass in any of the following keyword args for project.factory.successors:
Parameters• jumpkind – The jumpkind of the previous exit
• addr – An address to execute at instead of the state’s ip.
• stmt_whitelist – A list of stmt indexes to which to confine execution.
• last_stmt – A statement index at which to stop execution.
• thumb – Whether the block should be lifted in ARM’s THUMB mode.
• backup_state – A state to read bytes from instead of using project memory.
• opt_level – The VEX optimization level to use.
• insn_bytes – A string of bytes to use for the block instead of the project.
• size – The maximum size of the block, in bytes.
• num_inst – The maximum number of instructions.
• traceflags – traceflags to be passed to VEX. Default: 0
Returns
The simulation manager, for chaining.
Return type
SimulationManager
step_state(state, successor_func=None, error_list=None, **run_args)
Don’t use this function manually - it is meant to interface with exploration techniques.
filter(state, filter_func=None)
Don’t use this function manually - it is meant to interface with exploration techniques.
selector(state, selector_func=None)
Don’t use this function manually - it is meant to interface with exploration techniques.

170

Chapter 10. API Referenceangrsuccessors(state, successor_func=None, **run_args)
Don’t use this function manually - it is meant to interface with exploration techniques.
prune(filter_func=None, from_stash='active', to_stash='pruned')
Prune unsatisfiable states from a stash.
This function will move all unsatisfiable states in the given stash into a different stash.
Parameters• filter_func – Only prune states that match this filter.
• from_stash – Prune states from this stash. (default: ‘active’)• to_stash – Put pruned states in this stash. (default: ‘pruned’)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
populate(stash, states)
Populate a stash with a collection of states.
Parameters• stash – A stash to populate.
• states – A list of states with which to populate the stash.
absorb(simgr)
Collect all the states from simgr and put them in their corresponding stashes in this manager. This will not
modify simgr.
move(from_stash, to_stash, filter_func=None)
Move states from one stash to another.
Parameters• from_stash – Take matching states from this stash.
• to_stash – Put matching states into this stash.
• filter_func – Stash states that match this filter. Should be a function that takes a state
and returns True or False. (default: stash all states)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
stash(filter_func=None, from_stash='active', to_stash='stashed')
Stash some states. This is an alias for move(), with defaults for the stashes.
Parameters• filter_func – Stash states that match this filter. Should be a function that takes a state
and returns True or False. (default: stash all states)• from_stash – Take matching states from this stash. (default: ‘active’)• to_stash – Put matching states into this stash. (default: ‘stashed’)

171

angr

Returns
The simulation manager, for chaining.
Return type
SimulationManager
unstash(filter_func=None, to_stash='active', from_stash='stashed')
Unstash some states. This is an alias for move(), with defaults for the stashes.
Parameters• filter_func – Unstash states that match this filter. Should be a function that takes a state
and returns True or False. (default: unstash all states)• from_stash – take matching states from this stash. (default: ‘stashed’)• to_stash – put matching states into this stash. (default: ‘active’)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
drop(filter_func=None, stash='active')
Drops states from a stash. This is an alias for move(), with defaults for the stashes.
Parameters• filter_func – Drop states that match this filter. Should be a function that takes a state
and returns True or False. (default: drop all states)• stash – Drop matching states from this stash. (default: ‘active’)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
apply(state_func=None, stash_func=None, stash='active', to_stash=None)
Applies a given function to a given stash.
Parameters• state_func – A function to apply to every state. Should take a state and return a state.
The returned state will take the place of the old state. If the function doesn’t return a state,
the old state will be used. If the function returns a list of states, they will replace the originalstates.
• stash_func – A function to apply to the whole stash. Should take a list of states and returna list of states. The resulting list will replace the stash. If both state_func and stash_func
are provided state_func is applied first, then stash_func is applied on the results.
• stash – A stash to work with.
• to_stash – If specified, this stash will be used to store the resulting states instead.
Returns
The simulation manager, for chaining.
Return type
SimulationManager

172

Chapter 10. API Referenceangrsplit(stash_splitter=None, stash_ranker=None, state_ranker=None, limit=8, from_stash='active',to_stash='stashed')
Split a stash of states into two stashes depending on the specified options.
The stash from_stash will be split into two stashes depending on the other options passed in. If to_stash isprovided, the second stash will be written there.
stash_splitter overrides stash_ranker, which in turn overrides state_ranker. If no functions are provided, thestates are simply split according to the limit.
The sort done with state_ranker is ascending.
Parameters• stash_splitter – A function that should take a list of states and return a tuple of twolists (the two resulting stashes).
• stash_ranker – A function that should take a list of states and return a sorted list of states.
This list will then be split according to “limit”.
• state_ranker – An alternative to stash_splitter. States will be sorted with outputs of thisfunction, which are to be used as a key. The first “limit” of them will be kept, the rest split
off.
• limit – For use with state_ranker. The number of states to keep. Default: 8• from_stash – The stash to split (default: ‘active’)• to_stash – The stash to write to (default: ‘stashed’)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
merge(merge_func=None, merge_key=None, stash='active', prune=True)
Merge the states in a given stash.
Parameters• stash – The stash (default: ‘active’)• merge_func – If provided, instead of using state.merge, call this function with the states
as the argument. Should return the merged state.
• merge_key – If provided, should be a function that takes a state and returns a key that willcompare equal for all states that are allowed to be merged together, as a first approximation.
By default: uses PC, callstack, and open file descriptors.
• prune – Whether to prune the stash prior to merging it
Returns
The simulation manager, for chaining.
Return type
SimulationManager
class angr.Analysis
Bases: object
This class represents an analysis on the program.
Variables

173

angr

• project – The project for this analysis.
• kb (KnowledgeBase) – The knowledgebase object.
• _progress_callback – A callback function for receiving the progress of this analysis. It
only takes one argument, which is a float number from 0.0 to 100.0 indicating the current
progress.
• _show_progressbar (bool) – If a progressbar should be shown during the analysis. It’s
independent from _progress_callback.
• _progressbar (progress.Progress) – The progress bar object.
project:kb:

Project

KnowledgeBase

errors = []named_errors = {}angr.register_analysis(cls, name)class angr.ExplorationTechnique
Bases: object
An otiegnqwvk is a set of hooks for a simulation manager that assists in the implementation of new techniquesin symbolic exploration.
TODO: choose actual name for the functionality (techniques? strategies?)
Any number of these methods may be overridden by a subclass. To use an exploration technique, call simgr.
use_technique with an instance of the technique.
__init__()setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)filter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters

174

Chapter 10. API Referenceangr• simgr (angr.SimulationManager)• state (angr.SimState)
selector(simgr, state, **kwargs)
Determine if a state should participate in the current round of stepping. Return True if the state should be
stepped, and False if the state should not be stepped. To defer to the original selection procedure, returnthe result of simgr.selector(state, **kwargs).
If the user provided a selector_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
step_state(simgr, state, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)complete(simgr)
Return whether or not this manager has reached a “completed” state, i.e. SimulationManager.run()should halt.
This is the one hook which is not subject to the nesting rules of hooks. You should not call simgr.
complete, you should make your own decision and return True or False. Each of the techniques’ completion checkers will be called and the final result will be compted with simgr.completion_mode.
Parameterssimgr (angr.SimulationManager)

175

angr

class angr.StateHierarchy
Bases: object
The state hierarchy holds weak references to SimStateHistory objects in a directed acyclic graph. It is usefulfor queries about a state’s ancestry, notably “what is the best ancestor state for a merge among these states” and“what is the most recent unsatisfiable state while using LAZY_SOLVES”__init__()get_ref(obj)dead_ref(ref )defer_cleanup()
add_state(s)add_history(h)simplify()
full_simplify()
lineage(h)Returns the lineage of histories leading up to h.
all_successors(h)history_successors(h)history_predecessors(h)history_contains(h)unreachable_state(state)
unreachable_history(h)most_mergeable(states)
Find the “most mergeable” set of states from those provided.
Parametersstates – a list of states
Returns
a tuple of: (list of states to merge, those states’ common history, list of states to not merge
yet)class angr.SimState(project=None, arch=None, plugins=None, mode=None, options=None,
add_options=None, remove_options=None, special_memory_filler=None, os_name=None,
plugin_preset='default', cle_memory_backer=None, dict_memory_backer=None,
permissions_map=None, default_permissions=3, stack_perms=None, stack_end=None,
stack_size=None, regioned_memory_cls=None, **kwargs)
Bases: PluginHub
The SimState represents the state of a program, including its memory, registers, and so forth.
Parameters• project (angr.Project) – The project instance.
• arch (archinfo.Arch |str) – The architecture of the state.
176

Chapter 10. API ReferenceangrVariables• regs – A convenient view of the state’s registers, where each register is a property• mem – A convenient view of the state’s memory, a angr.state_plugins.view.
SimMemView• registers – The state’s register file as a flat memory region• memory – The state’s memory as a flat memory region• solver – The symbolic solver and variable manager for this state• inspect – The breakpoint manager, a angr.state_plugins.inspect.SimInspector• log – Information about the state’s history• scratch – Information about the current execution step• posix – MISNOMER: information about the operating system or environment model• fs – The current state of the simulated filesystem• libc – Information about the standard library we are emulating• cgc – Information about the cgc environment• uc_manager – Control of under-constrained symbolic execution• unicorn – Control of the Unicorn Engine
solver:

SimSolver

posix:

SimSystemPosix

registers:
regs:

DefaultMemory

SimRegNameView

memory:DefaultMemory

callstack:mem:

CallStack

SimMemView

history:

SimStateHistory

inspect:

SimInspector

jni_references:
scratch:

SimStateJNIReferences

SimStateScratch__init__(project=None, arch=None, plugins=None, mode=None, options=None, add_options=None,remove_options=None, special_memory_filler=None, os_name=None, plugin_preset='default',
cle_memory_backer=None, dict_memory_backer=None, permissions_map=None,default_permissions=3, stack_perms=None, stack_end=None, stack_size=None,regioned_memory_cls=None, **kwargs)
property plugins
property se
Deprecated alias for solver

177

angr

property ip
Get the instruction pointer expression, trigger SimInspect breakpoints, and generate SimActions. Use _ip
to not trigger breakpoints or generate actions.
Returns
an expression
property addr
Get the concrete address of the instruction pointer, without triggering SimInspect breakpoints or generating
SimActions. An integer is returned, or an exception is raised if the instruction pointer is symbolic.
Returns
an intproperty arch:

Arch

T = ~T
get_plugin(name)Get the plugin named name. If no such plugin is currently active, try to activate a new one using the current
preset.
has_plugin(name)Return whether or not a plugin with the name name is currently active.
register_plugin(name, plugin, inhibit_init=False)
Add a new plugin plugin with name name to the active plugins.
property javavm_memory
In case of an JavaVM with JNI support, a state can store the memory plugin twice; one for the native andone for the java view of the state.
Returns
The JavaVM view of the memory plugin.
property javavm_registers
In case of an JavaVM with JNI support, a state can store the registers plugin twice; one for the native andone for the java view of the state.
Returns
The JavaVM view of the registers plugin.
simplify(*args)
Simplify this state’s constraints.
add_constraints(*constraints)
Add some constraints to the state.
You may pass in any number of symbolic booleans as variadic positional arguments.
satisfiable(**kwargs)
Whether the state’s constraints are satisfiable
downsize()
Clean up after the solver engine. Calling this when a state no longer needs to be solved on will reduce
memory usage.

178

Chapter 10. API Referenceangrstep(**kwargs)
Perform a step of symbolic execution using this state. Any arguments to AngrObjectFactory.successors
can be passed to this.
Returns
A SimSuccessors object categorizing the results of the step.
block(*args, **kwargs)
Represent the basic block at this state’s instruction pointer. Any arguments to AngrObjectFactory.block
can ba passed to this.
Returns
A Block object describing the basic block of code at this point.
copy()
Returns a copy of the state.
merge(*others, **kwargs)
Merges this state with the other states. Returns the merging result, merged state, and the merge flag.
Parameters• states – the states to merge• merge_conditions – a tuple of the conditions under which each state holds• common_ancestor – a state that represents the common history between the states being
merged. Usually it is only available when EFFICIENT_STATE_MERGING is enabled,
otherwise weak-refed states might be dropped from state history instances.
• plugin_whitelist – a list of plugin names that will be merged. If this option is given
and is not None, any plugin that is not inside this list will not be merged, and will be createdas a fresh instance in the new state.
• common_ancestor_history – a SimStateHistory instance that represents the common
history between the states being merged. This is to allow optimal state merging when
EFFICIENT_STATE_MERGING is disabled.
Returns(merged state, merge flag, a bool indicating if any merging occurred)widen(*others)
Perform a widening between self and other states :type others: :param others: :return:
reg_concrete(*args, **kwargs)
Returns the contents of a register but, if that register is symbolic, raises a SimValueError.
mem_concrete(*args, **kwargs)
Returns the contents of a memory but, if the contents are symbolic, raises a SimValueError.
stack_push(thing)
Push ‘thing’ to the stack, writing the thing to memory and adjusting the stack pointer.
stack_pop()
Pops from the stack and returns the popped thing. The length will be the architecture word size.
stack_read(offset, length, bp=False)
Reads length bytes, at an offset into the stack.
Parameters• offset – The offset from the stack pointer.
179

angr

• length – The number of bytes to read.
• bp – If True, offset from the BP instead of the SP. Default: False.
make_concrete_int(expr)
prepare_callsite(retval, args, cc='wtf')
dbg_print_stack(depth=None, sp=None)
Only used for debugging purposes. Return the current stack info in formatted string. If depth is None, thecurrent stack frame (from sp to bp) will be printed out.
set_mode(mode)
property thumbproperty with_condition
angr.default_cc(arch, platform='Linux', language=None, syscall=False, **kwargs)
Return the default calling convention for a given architecture, platform, and language combination.
Parameters• arch (str) – The architecture name.
• platform (str | None) – The platform name (e.g., “Linux” or “Win32”).
• language (Optional[str]) – The programming language name (e.g., “go”).
• syscall (bool) – Return syscall convention (True), or normal calling convention (False,
default).
Return type
type[SimCC] | None
Returns
A default calling convention class if we can find one for the architecture, platform, and language
combination, or None if nothing fits.
class angr.PointerWrapper(value, buffer=False)
Bases: object__init__(value, buffer=False)class angr.SimCC(arch)
Bases: object
A calling convention allows you to extract from a state the data passed from function to function by calls andreturns. Most of the methods provided by SimCC that operate on a state assume that the program is just after acall but just before stack frame allocation, though this may be overridden with the stack_base parameter to eachindividual method.
This is the base class for all calling conventions.
Parametersarch (archinfo.Arch )__init__(arch)
Parametersarch (Arch) – The Archinfo arch for this CC

180

Chapter 10. API Referenceangr

ARG_REGS: list[str] = []FP_ARG_REGS: list[str] = []STACKARG_SP_BUFF = 0
STACKARG_SP_DIFF = 0
CALLER_SAVED_REGS: list[str] = []RETURN_ADDR: SimFunctionArgument = None
RETURN_VAL: SimFunctionArgument = None
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = None
FP_RETURN_VAL: SimFunctionArgument | None = None
ARCH = None
CALLEE_CLEANUP = False
STACK_ALIGNMENT = 1
property int_args
Iterate through all the possible arg positions that can only be used to store integer or pointer values.
Returns an iterator of SimFunctionArguments
property memory_args
Iterate through all the possible arg positions that can be used to store any kind of argument.
Returns an iterator of SimFunctionArguments
property fp_args
Iterate through all the possible arg positions that can only be used to store floating point values.
Returns an iterator of SimFunctionArguments
is_fp_arg(arg)This should take a SimFunctionArgument instance and return whether or not that argument is a floatingpoint argument.
Returns True for MUST be a floating point arg,
False for MUST NOT be a floating point arg, None for when it can be either.
class ArgSession(cc)Bases: object
A class to keep track of the state accumulated in laying parameters out into memorycc
fp_iter
int_iterboth_iter__init__(cc)

181

angr

getstate()
setstate(state)arg_session(ret_ty)
Return an arg session.
A session provides the control interface necessary to describe how integral and floating-point arguments
are laid out into memory. The default behavior is that there are a finite list of int-only and fp-only argument
slots, and an infinite number of generic slots, and when an argument of a given type is requested, the mostslot available is used. If you need different behavior, subclass ArgSession.
You need to provide the return type of the function in order to kick off an arg layout session.
Parameters
ret_ty (SimType | None)
return_in_implicit_outparam(ty)stack_space(args)
Parametersargs – A list of SimFunctionArguments
Returns
The number of bytes that should be allocated on the stack to store all these args, NOT INCLUDING the return address.
return_val(ty, perspective_returned=False)
The location the return value is stored, based on its type.
property return_addr
The location the return address is stored.
next_arg(session, arg_type)
Parameters• session (ArgSession)• arg_type (SimType)static is_fp_value(val)static guess_prototype(args, prototype=None)
Come up with a plausible SimTypeFunction for the given args (as would be passed to e.g. setup_callsite).
You can pass a variadic function prototype in the base_type parameter and all its arguments will be used,
only guessing types for the variadic arguments.
arg_locs(prototype)
Return type
list[SimFunctionArgument]
get_args(state, prototype, stack_base=None)
set_return_val(state, val, ty, stack_base=None, perspective_returned=False)

182

Chapter 10. API Referenceangrsetup_callsite(state, ret_addr, args, prototype, stack_base=None, alloc_base=None,
grow_like_stack=True)
This function performs the actions of the caller getting ready to jump into a function.
Parameters• state – The SimState to operate on• ret_addr – The address to return to when the called function finishes• args – The list of arguments that that the called function will see• prototype – The signature of the call you’re making. Should include variadic args concretely.
• stack_base – An optional pointer to use as the top of the stack, circa the function entry
point• alloc_base – An optional pointer to use as the place to put excess argument data
• grow_like_stack – When allocating data at alloc_base, whether to allocate at decreasing
addresses
The idea here is that you can provide almost any kind of python type in args and it’ll be translated to abinary format to be placed into simulated memory. Lists (representing arrays) must be entirely elements ofthe same type and size, while tuples (representing structs) can be elements of any type and size. If you’d
like there to be a pointer to a given value, wrap the value in a PointerWrapper.
If stack_base is not provided, the current stack pointer will be used, and it will be updated. If alloc_base is
not provided, the stack base will be used and grow_like_stack will implicitly be True.
grow_like_stack controls the behavior of allocating data at alloc_base. When data from args needs tobe wrapped in a pointer, the pointer needs to point somewhere, so that data is dumped into memory at
alloc_base. If you set alloc_base to point to somewhere other than the stack, set grow_like_stack to False
so that sequential allocations happen at increasing addresses.
teardown_callsite(state, return_val=None, prototype=None, force_callee_cleanup=False)
This function performs the actions of the callee as it’s getting ready to return. It returns the address to returnto.
Parameters• state – The state to mutate• return_val – The value to return• prototype – The prototype of the given function• force_callee_cleanup – If we should clean up the stack allocation for the argumentseven if it’s not the callee’s job to do so
TODO: support the stack_base parameter from setup_callsite. . . ? Does that make sense in this context?
Maybe it could make sense by saying that you pass it in as something like the “saved base pointer” value?
static find_cc(arch, args, sp_delta, platform='Linux')
Pinpoint the best-fit calling convention and return the corresponding SimCC instance, or None if no fit isfound.
Parameters• arch (Arch) – An ArchX instance. Can be obtained from archinfo.
• args (list[SimFunctionArgument]) – A list of arguments. It may be updated by the
first matched calling convention to remove non-argument arguments.

183

angr

• sp_delta (int) – The change of stack pointer before and after the call is made.
• platform (str)
Return type
SimCC | None
Returns
A calling convention instance, or None if none of the SimCC subclasses seems to fit thearguments provided.
get_arg_info(state, prototype)This is just a simple wrapper that collects the information from various locations prototype is as passed toself.arg_locs and self.get_args :param angr.SimState state: The state to evaluate and extract the values from:return: A list of tuples, where the nth tuple is (type, name, location, value) of the nth argumentclass angr.SimFileBase(name=None, writable=True, ident=None, concrete=False, file_exists=True, **kwargs)
Bases: SimStatePlugin
SimFiles are the storage mechanisms used by SimFileDescriptors.
Different types of SimFiles can have drastically different interfaces, and as a result there’s not much that canbe specified on this base class. All the read and write methods take a pos argument, which may have different
semantics per-class. 0 will always be a valid position to use, though, and the next position you should use is partof the return tuple.
Some simfiles are “streams”, meaning that the position that reads come from is determined not by the position
you pass in (it will in fact be ignored), but by an internal variable. This is stored as .pos if you care to read it.
Don’t write to it. The same lack-of-semantics applies to this field as well.
Variables• name – The name of the file. Purely for cosmetic purposes• ident – The identifier of the file, typically autogenerated from the name and a nonce. Purely
for cosmetic purposes, but does appear in symbolic values autogenerated in the file.
• seekable – Bool indicating whether seek operations on this file should succeed. If this is
True, then pos must be a number of bytes from the start of the file.
• writable – Bool indicating whether writing to this file is allowed.
• pos – If the file is a stream, this will be the current position. Otherwise, None.
• concrete – Whether or not this file contains mostly concrete data. Will be used by some
SimProcedures to choose how to handle variable-length operations like fgets.
• file_exists – Set to False, if file does not exists, set to a claripy Bool if unknown, default
True.
seekable = False
pos = None__init__(name=None, writable=True, ident=None, concrete=False, file_exists=True, **kwargs)
static make_ident(name)concretize(**kwargs)
Return a concretization of the contents of the file. The type of the return value of this method will varydepending on which kind of SimFile you’re using.

184

Chapter 10. API Referenceangrread(pos, size, **kwargs)
Read some data from the file.
Parameters• pos – The offset in the file to read from.
• size – The size to read. May be symbolic.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read), theactual size of the read, and the new file position pointer.
write(pos, data, size=None, **kwargs)
Write some data to the file.
Parameters• pos – The offset in the file to write to. May be ignored if the file is a stream or device.
• data – The data to write as a bitvector• size – The optional size of the data to write. If not provided will default to the length ofthe data. Must be constrained to less than or equal to the size of the data.
Returns
The new file position pointer.
property size
The number of data bytes stored by the file at present. May be a symbolic value.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.SimFile(name=None, content=None, size=None, has_end=None, seekable=True, writable=True,
ident=None, concrete=None, **kwargs)
Bases: SimFileBase, DefaultMemory
The normal SimFile is meant to model files on disk. It subclasses SimSymbolicMemory so loads and stores
to/from it are very simple.
Parameters• name – The name of the file• content – Optional initial content for the file as a string or bitvector• size – Optional size of the file. If content is not specified, it defaults to zero• has_end – Whether the size boundary is treated as the end of the file or a frontier atwhich new content will be generated. If unspecified, will pick its value based on options.FILES_HAVE_EOF. Another caveat is that if the size is also unspecified this value
will default to False.
185

angr

• seekable – Optional bool indicating whether seek operations on this file should succeed,
default True.
• writable – Whether writing to this file is allowed• concrete – Whether or not this file contains mostly concrete data. Will be used by some
SimProcedures to choose how to handle variable-length operations like fgets.
Variables
has_end – Whether this file has an EOF__init__(name=None, content=None, size=None, has_end=None, seekable=True, writable=True,
ident=None, concrete=None, **kwargs)
property categoryreg, mem, or file.
Type
Return the category of this SimMemory instance. It can be one of the three following categories
set_state(state)
Sets a new state (for example, if the state has been branched)property size
The number of data bytes stored by the file at present. May be a symbolic value.
concretize(**kwargs)
Return a concretization of the contents of the file, as a flat bytestring.
read(pos, size, **kwargs)
Read some data from the file.
Parameters• pos – The offset in the file to read from.
• size – The size to read. May be symbolic.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read), theactual size of the read, and the new file position pointer.
write(pos, data, size=None, events=True, **kwargs)
Write some data to the file.
Parameters• pos – The offset in the file to write to. May be ignored if the file is a stream or device.
• data – The data to write as a bitvector• size – The optional size of the data to write. If not provided will default to the length ofthe data. Must be constrained to less than or equal to the size of the data.
Returns
The new file position pointer.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.

186

Chapter 10. API Referenceangr

In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin

187

angr

Returns
True if the state plugin is actually widened.
Return typeboolclass angr.SimPackets(name, write_mode=None, content=None, writable=True, ident=None, **kwargs)
Bases: SimFileBase
The SimPackets is meant to model inputs whose content is delivered a series of asynchronous chunks. The datais stored as a list of read or write results. For symbolic sizes, state.libc.max_packet_size will be respected. If the
SHORT_READS option is enabled, reads will return a symbolic size constrained to be less than or equal to therequested size.
A SimPackets cannot be used for both reading and writing - for socket objects that can be both read and written to you should use a file descriptor to multiplex the read and write operations into two separate file storage
mechanisms.
Parameters• name – The name of the file, for cosmetic purposes• write_mode – Whether this file is opened in read or write mode. If this is unspecified it will
be autodetected.
• content – Some initial content to use for the file. Can be a list of bytestrings or a list oftuples of content ASTs and size ASTs.
Variables• write_mode – See the eponymous parameter• content – A list of packets, as tuples of content ASTs and size ASTs.
__init__(name, write_mode=None, content=None, writable=True, ident=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)property size
The number of data bytes stored by the file at present. May be a symbolic value.
concretize(**kwargs)
Returns a list of the packets read or written as bytestrings.
read(pos, size, **kwargs)
Read a packet from the stream.
Parameters• pos (int) – The packet number to read from the sequence of the stream. May be None toappend to the stream.
• size – The size to read. May be symbolic.
• short_reads – Whether to replace the size with a symbolic value constrained to less thanor equal to the original size. If unspecified, will be chosen based on the state option.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read) andthe actual size of the read.

188

Chapter 10. API Referenceangrwrite(pos, data, size=None, events=True, **kwargs)
Write a packet to the stream.
Parameters• pos (int) – The packet number to write in the sequence of the stream. May be None toappend to the stream.
• data – The data to write, as a string or bitvector.
• size – The optional size to write. May be symbolic; must be constrained to at most thesize of data.
Returns
The next packet to use after thiscopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters

189

angr

• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.SimFileStream(name=None, content=None, pos=0, **kwargs)
Bases: SimFile
A specialized SimFile that uses a flat memory backing, but functions as a stream, tracking its position internally.
The pos argument to the read and write methods will be ignored, and will return None. Instead, there is an
attribute pos on the file itself, which will give you what you want.
Parameters• name – The name of the file, for cosmetic purposes• pos – The initial position of the file, default zero• kwargs – Any other keyword arguments will go on to the SimFile constructor.
Variables
pos – The current position in the file.
__init__(name=None, content=None, pos=0, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)read(pos, size, **kwargs)
Read some data from the file.
Parameters• pos – The offset in the file to read from.
• size – The size to read. May be symbolic.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read), theactual size of the read, and the new file position pointer.

190

Chapter 10. API Referenceangrwrite(_, data, size=None, **kwargs)
Write some data to the file.
Parameters• pos – The offset in the file to write to. May be ignored if the file is a stream or device.
• data – The data to write as a bitvector• size – The optional size of the data to write. If not provided will default to the length ofthe data. Must be constrained to less than or equal to the size of the data.
Returns
The new file position pointer.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with

191

angr

• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolclass angr.SimPacketsStream(name, pos=0, **kwargs)
Bases: SimPackets
A specialized SimPackets that tracks its position internally.
The pos argument to the read and write methods will be ignored, and will return None. Instead, there is an
attribute pos on the file itself, which will give you what you want.
Parameters• name – The name of the file, for cosmetic purposes• pos – The initial position of the file, default zero• kwargs – Any other keyword arguments will go on to the SimPackets constructor.
Variables
pos – The current position in the file.
__init__(name, pos=0, **kwargs)read(pos, size, **kwargs)
Read a packet from the stream.
Parameters• pos (int) – The packet number to read from the sequence of the stream. May be None toappend to the stream.
• size – The size to read. May be symbolic.
• short_reads – Whether to replace the size with a symbolic value constrained to less thanor equal to the original size. If unspecified, will be chosen based on the state option.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read) andthe actual size of the read.
write(_, data, size=None, **kwargs)
Write a packet to the stream.
Parameters• pos (int) – The packet number to write in the sequence of the stream. May be None toappend to the stream.
• data – The data to write, as a string or bitvector.
• size – The optional size to write. May be symbolic; must be constrained to at most thesize of data.
Returns
The next packet to use after this192

Chapter 10. API Referenceangrcopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolclass angr.SimFileDescriptor(simfile, flags=0)
Bases: SimFileDescriptorBase
A simple file descriptor forwarding reads and writes to a SimFile. Contains information about the current opened
state of the file, such as the flags or (if relevant) the current position.
193

angr

Variables• file – The SimFile described to by this descriptor• flags – The mode that the file descriptor was opened with, a bitfield of flags__init__(simfile, flags=0)
read_data(size, **kwargs)
Reads some data from the file, returning the data.
Parameters
size – The requested length of the read
Returns
A tuple of the data read and the real length of the read
write_data(data, size=None, **kwargs)
Write some data, provided as an argument into the file.
Parameters• data – A bitvector to write into the file• size – The requested size of the write (may be symbolic)
Returns
The real length of the writeseek(offset, whence='start')
Seek the file descriptor to a different position in the file.
Parameters• offset – The offset to seek to, interpreted according to whence• whence – What the offset is relative to; one of the strings “start”, “current”, or “end”
Returns
A symbolic boolean describing whether the seek succeeded or not
eof()
Return the EOF status. May be a symbolic boolean.
tell()
Return the current position, or None if the concept doesn’t make sense for the given file.
size()
Return the size of the data stored in the file in bytes, or None if the concept doesn’t make sense for the given
file.
concretize(**kwargs)
Return a concretization of the underlying file. Returns whatever format is preferred by the file.
property file_exists
This should be True in most cases. Only if we opened an fd of unknown existence, ALL_FILES_EXIST is
False and ANY_FILE_MIGHT_EXIST is True, this is a symbolic boolean.
property read_storage
Return the SimFile backing reads from this fd

194

Chapter 10. API Referenceangrproperty write_storage
Return the SimFile backing writes to this fd
property read_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
property write_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
195

angr

Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.SimFileDescriptorDuplex(read_file, write_file)
Bases: SimFileDescriptorBase
A file descriptor that refers to two file storage mechanisms, one to read from and one to write to. As a result,operations like seek, eof, etc no longer make sense.
Parameters• read_file – The SimFile to read from• write_file – The SimFile to write to__init__(read_file, write_file)
read_data(size, **kwargs)
Reads some data from the file, returning the data.
Parameters
size – The requested length of the read
Returns
A tuple of the data read and the real length of the read
write_data(data, size=None, **kwargs)
Write some data, provided as an argument into the file.
Parameters• data – A bitvector to write into the file• size – The requested size of the write (may be symbolic)
Returns
The real length of the write

196

Chapter 10. API Referenceangr

set_state(state)
Sets a new state (for example, if the state has been branched)eof()
Return the EOF status. May be a symbolic boolean.
tell()
Return the current position, or None if the concept doesn’t make sense for the given file.
seek(offset, whence='start')
Seek the file descriptor to a different position in the file.
Parameters• offset – The offset to seek to, interpreted according to whence• whence – What the offset is relative to; one of the strings “start”, “current”, or “end”
Returns
A symbolic boolean describing whether the seek succeeded or notsize()
Return the size of the data stored in the file in bytes, or None if the concept doesn’t make sense for the given
file.
concretize(**kwargs)
Return a concretization of the underlying files, as a tuple of (read file, write file).
property read_storage
Return the SimFile backing reads from this fd
property write_storage
Return the SimFile backing writes to this fd
property read_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
property write_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

197

angr

merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.SimMount
Bases: SimStatePlugin

198

Chapter 10. API ReferenceangrThis is the base class for “mount points” in angr’s simulated filesystem. Subclass this class and give it to thefilesystem to intercept all file creations and opens below the mountpoint. Since this a SimStatePlugin you may
also want to implement set_state, copy, merge, etc.
get(path_elements)
Implement this function to instrument file lookups.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A SimFile, or Noneinsert(path_elements, simfile)
Implement this function to instrument file creation.
Parameters• path_elements – A list of path elements traversing from the mountpoint to the file• simfile – The file to insert
Returns
A bool indicating whether the insert occurred
delete(path_elements)
Implement this function to instrument file deletion.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A bool indicating whether the delete occurred
lookup(sim_file)
Look up the path of a SimFile in the mountpoint
Parameters
sim_file – A SimFile object needs to be looked up
Returns
A string representing the path of the file in the mountpoint Or None if the SimFile does notexist in the mountpointclass angr.SimHostFilesystem(host_path=None, **kwargs)
Bases: SimConcreteFilesystem
Simulated mount that makes some piece from the host filesystem available to the guest.
Parameters• host_path (str) – The path on the host to mount• pathsep (str) – The host path separator character, default os.path.sep__init__(host_path=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo

199

angr

The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.SimHeapBrk(heap_base=None, heap_size=None)
Bases: SimHeapBase
SimHeapBrk represents a trivial heap implementation based on the Unix brk system call. This type of heap storesvirtually no metadata, so it is up to the user to determine when it is safe to release memory. This also means thatit does not properly support standard heap operations like realloc.
This heap implementation is a holdover from before any more proper implementations were modelled. At thetime, various libc (or win32) SimProcedures handled the heap in the same way that this plugin does now. To
make future heap implementations plug-and-playable, they should implement the necessary logic themselves, anddependent SimProcedures should invoke a method by the same name as theirs (prepended with an underscore)
upon the heap plugin. Depending on the heap implementation, if the method is not supported, an error shouldbe raised.
Out of consideration for the original way the heap was handled, this plugin implements functionality for all relevant SimProcedures (even those that would not normally be supported together in a single heap implementation).
Variables
heap_location – the address of the top of the heap, bounding the allocations made startingfrom heap_base__init__(heap_base=None, heap_size=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
allocate(sim_size)
The actual allocation primitive for this heap implementation. Increases the position of the break to allocate
space. Has no guards against the heap growing too large.
Parameters
sim_size – a size specifying how much to increase the break pointer by
Returnsa pointer to the previous break position, above which there is now allocated space
release(sim_size)
The memory release primitive for this heap implementation. Decreases the position of the break to deallocate space. Guards against releasing beyond the initial heap base.
Parameters
sim_size – a size specifying how much to decrease the break pointer by (may be symbolicor not)200

Chapter 10. API Referenceangrmerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.SimHeapPTMalloc(heap_base=None, heap_size=None)
Bases: SimHeapFreelist

201

angr

A freelist-style heap implementation inspired by ptmalloc. The chunks used by this heap contain heap metadata
in addition to user data. While the real-world ptmalloc is implemented using multiple lists of free chunks (corresponding to their different sizes), this more basic model uses a single list of chunks and searches for free chunks
using a first-fit algorithm.
NOTE: The plugin must be registered using register_plugin with name heap in order to function properly.
Variables• heap_base – the address of the base of the heap in memory• heap_size – the total size of the main memory region managed by the heap in memory• mmap_base – the address of the region from which large mmap allocations will be made• free_head_chunk – the head of the linked list of free chunks in the heap__init__(heap_base=None, heap_size=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
chunks()Returns an iterator over all the chunks in the heap.
allocated_chunks()
Returns an iterator over all the allocated chunks in the heap.
free_chunks()
Returns an iterator over all the free chunks in the heap.
chunk_from_mem(ptr)
Given a pointer to a user payload, return the base of the chunk associated with that payload (i.e. the chunkpointer). Returns None if ptr is null.
Parameters
ptr – a pointer to the base of a user payload in the heap
Returnsa pointer to the base of the associated heap chunk, or None if ptr is nullmalloc(sim_size)
A somewhat faithful implementation of libc malloc.
Parameters
sim_size – the amount of memory (in bytes) to be allocatedReturns
the address of the allocation, or a NULL pointer if the allocation failed

202

Chapter 10. API Referenceangrfree(ptr)
A somewhat faithful implementation of libc free.
Parameters
ptr – the location in memory to be freed
calloc(sim_nmemb, sim_size)
A somewhat faithful implementation of libc calloc.
Parameters• sim_nmemb – the number of elements to allocated• sim_size – the size of each element (in bytes)
Returns
the address of the allocation, or a NULL pointer if the allocation failed
realloc(ptr, size)
A somewhat faithful implementation of libc realloc.
Parameters• ptr – the location in memory to be reallocated• size – the new size desired for the allocation
Returns
the address of the allocation, or a NULL pointer if the allocation was freed or if no new
allocation was mademerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters

203

angr

• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.PTChunk(base, sim_state, heap=None)
Bases: Chunk
A chunk, inspired by the implementation of chunks in ptmalloc. Provides a representation of a chunk
via a view into the memory plugin. For the chunk definitions and docs that this was loosely based
off of, see glibc malloc/malloc.c, line 1033, as of commit 5a580643111ef6081be7b4c7bd1997a5447c903f.
Alternatively, take the following link. https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=67cdfd0ad2f003964cd0f7dfe3bcd85ca98528a7;hb=5a580643111ef6081be7b4c7bd1997a5447c903f#l1033
Variables• base – the location of the base of the chunk in memory• state – the program state that the chunk is resident in• heap – the heap plugin that the chunk is managed by__init__(base, sim_state, heap=None)
get_size()
Returns the actual size of a chunk (as opposed to the entire size field, which may include some flags).
get_data_size()
Returns the size of the data portion of a chunk.
set_size(size, is_free=None)
Use this to set the size on a chunk. When the chunk is new (such as when a free chunk is shrunk to form anallocated chunk and a remainder free chunk) it is recommended that the is_free hint be used since setting
the size depends on the chunk’s freeness, and vice versa.
Parameters• size – size of the chunk

204

Chapter 10. API Referenceangr• is_free – boolean indicating the chunk’s freeness
set_prev_freeness(is_free)
Sets (or unsets) the flag controlling whether the previous chunk is free.
Parameters
is_free – if True, sets the previous chunk to be free; if False, sets it to be allocatedis_prev_free()Returns a concrete state of the flag indicating whether the previous chunk is free or not. Issues a warning
if that flag is symbolic and has multiple solutions, and then assumes that the previous chunk is free.
Returns
True if the previous chunk is free; False otherwise
prev_size()
Returns the size of the previous chunk, masking off what would be the flag bits if it were in the actual size
field. Performs NO CHECKING to determine whether the previous chunk size is valid (for example, when
the previous chunk is not free, its size cannot be determined).
is_free()
Returns a concrete determination as to whether the chunk is free.
data_ptr()
Returns the address of the payload of the chunk.
next_chunk()
Returns the chunk immediately following (and adjacent to) this one, if it exists.
Returns
The following chunk, or None if applicable
prev_chunk()
Returns the chunk immediately prior (and adjacent) to this one, if that chunk is free. If the prior chunk is
not free, then its base cannot be located and this method raises an error.
Returns
If possible, the previous chunk; otherwise, raises an error
fwd_chunk()
Returns the chunk following this chunk in the list of free chunks. If this chunk is not free, then it resides inno such list and this method raises an error.
Returns
If possible, the forward chunk; otherwise, raises an error
set_fwd_chunk(fwd)
Sets the chunk following this chunk in the list of free chunks.
Parameters
fwd – the chunk to follow this chunk in the list of free chunks
bck_chunk()
Returns the chunk backward from this chunk in the list of free chunks. If this chunk is not free, then it
resides in no such list and this method raises an error.
Returns
If possible, the backward chunk; otherwise, raises an error

205

angr

set_bck_chunk(bck)Sets the chunk backward from this chunk in the list of free chunks.
Parameters
bck – the chunk to precede this chunk in the list of free chunks
class angr.Server(project, spill_yard=None, db=None, max_workers=None, max_states=10, staging_max=10,
bucketizer=True, recursion_limit=1000, worker_exit_callback=None, techniques=None,
add_options=None, remove_options=None)
Bases: object
Server implements the analysis server with a series of control interfaces exposed.
Variables• project – An instance of angr.Project.
• spill_yard (str) – A directory to store spilled states.
• db (str) – Path of the database that stores information about spilled states.
• max_workers (int) – Maximum number of workers. Each worker starts a new process.
• max_states (int) – Maximum number of active states for each worker.
• staging_max (int) – Maximum number of inactive states that are kept into memory before
spilled onto the disk and potentially be picked up by another worker.
• bucketizer (bool) – Use the Bucketizer exploration strategy.
• _worker_exit_callback – A method that will be called upon the exit of each worker.
__init__(project, spill_yard=None, db=None, max_workers=None, max_states=10, staging_max=10,
bucketizer=True, recursion_limit=1000, worker_exit_callback=None, techniques=None,
add_options=None, remove_options=None)
inc_active_workers()
dec_active_workers()stop()
property active_workers
property stopped
on_worker_exit(worker_id, stashes)run()class angr.KnowledgeBase(project, obj=None, name=None)
Bases: object
Represents a “model” of knowledge about an artifact.
Contains things like a CFG, data references, etc.
functions:

FunctionManager

variables:

VariableManager

structured_code:

206

StructuredCodeManager

Chapter 10. API Reference

angr

defs:

KeyDefinitionManager

cfgs:

CFGManager

types:

TypesStorepropagations:xrefs:

PropagationManager

XRefManager__init__(project, obj=None, name=None)
property callgraphproperty unresolved_indirect_jumps
property resolved_indirect_jumps
has_plugin(name)get_plugin(name)register_plugin(name, plugin)
release_plugin(name)
K = ~K
get_knowledge(requested_plugin_cls)
Type inference safe method to request a knowledge base plugin Explicitly passing the type of the requested
plugin achieves two things: 1. Every location using this plugin can be easily found with an IDE by searching
explicit references to the type 2. Basic type inference can deduce the result type and properly type checkusages of it
If there isn’t already an instance of this class None will be returned to make it clear to the caller that there
is no existing knowledge of this type yet. The code that initially creates this knowledge should use theregister_plugin method to register the initial knowledge state :type requested_plugin_cls: type[K] :param
requested_plugin_cls: :rtype: K | None :return: Instance of the requested plugin class or null if it is not a
known plugin
Parameters
requested_plugin_cls (type[K])Return type
K | None
request_knowledge(requested_plugin_cls)
Return typeK
Parameters
requested_plugin_cls (type[K])10.1 Project

10.1. Project

207

angr

angr.project.load_shellcode(shellcode, arch, start_offset=0, load_address=0, thumb=False, **kwargs)
Load a new project based on a snippet of assembly or bytecode.
Parameters• shellcode (bytes | str) – The data to load, as either a bytestring of instructions or a stringof assembly text
• arch – The name of the arch to use, or an archinfo class• start_offset – The offset into the data to start analysis (default 0)• load_address – The address to place the data in memory (default 0)• thumb – Whether this is ARM Thumb shellcodeclass angr.project.Project(thing, default_analysis_mode=None, ignore_functions=None,
use_sim_procedures=True, exclude_sim_procedures_func=None,
exclude_sim_procedures_list=(), arch=None, simos=None, engine=None,load_options=None, translation_cache=True, selfmodifying_code=False,
support_selfmodifying_code=None, store_function=None, load_function=None,
analyses_preset=None, concrete_target=None, eager_ifunc_resolution=None,**kwargs)
Bases: object
This is the main class of the angr module. It is meant to contain a set of binaries and the relationships between
them, and perform analyses on them.
Parameters• thing – The path to the main executable object to analyze, or a CLE Loader object.
• arch (Arch )• load_options (dict[str, Any] | None)• selfmodifying_code (bool)• support_selfmodifying_code (bool | None)
The following parameters are optional.
Parameters• default_analysis_mode – The mode of analysis to use by default. Defaults to ‘symbolic’.
• ignore_functions – A list of function names that, when imported from shared libraries,
should never be stepped into in analysis (calls will return an unconstrained value).
• use_sim_procedures – Whether to replace resolved dependencies for which simprocedures are available with said simprocedures.
• exclude_sim_procedures_func – A function that, when passed a function name, returns
whether or not to wrap it with a simprocedure.
• exclude_sim_procedures_list – A list of functions to not wrap with simprocedures.
• arch – The target architecture (auto-detected otherwise).
• simos – a SimOS class to use for this project.
• engine – The SimEngine class to use for this project.
• translation_cache (bool) – If True, cache translated basic blocks rather than retranslating them.

208

Chapter 10. API Referenceangr• selfmodifying_code (bool) – Whether we aggressively support self-modifying code.
When enabled, emulation will try to read code from the current state instead of the original memory, regardless of the current memory protections.
• store_function – A function that defines how the Project should be stored. Default topickling.
• load_function – A function that defines how the Project should be loaded. Default to
unpickling.
• analyses_preset (angr.misc.PluginPreset) – The plugin preset for the analyses
provider (i.e. Analyses instance).
• load_options (dict[str, Any] | None)• support_selfmodifying_code (bool | None)
Any additional keyword arguments passed will be passed onto cle.Loader.
Variables• analyses – The available analyses.
• entry – The program entrypoint.
• factory – Provides access to important analysis elements such as path groups and symbolic
execution results.
• filename – The filename of the executable.
• loader – The program loader.
• storage – Dictionary of things that should be loaded/stored with the Project.
Parameters• arch (Arch )• load_options (dict[str, Any] | None)• selfmodifying_code (bool)• support_selfmodifying_code (bool | None)__init__(thing, default_analysis_mode=None, ignore_functions=None, use_sim_procedures=True,
exclude_sim_procedures_func=None, exclude_sim_procedures_list=(), arch=None, simos=None,engine=None, load_options=None, translation_cache=True, selfmodifying_code=False,
support_selfmodifying_code=None, store_function=None, load_function=None,
analyses_preset=None, concrete_target=None, eager_ifunc_resolution=None, **kwargs)
Parameters• load_options (dict[str, Any] | None)• selfmodifying_code (bool)• support_selfmodifying_code (bool | None)
arch:

Arch

property analyses:

AnalysesHubWithDefaulthook(addr, hook=None, length=0, kwargs=None, replace=False)
Hook a section of code with a custom function. This is used internally to provide symbolic summaries oflibrary functions, and can be used to instrument execution or to modify control flow.
When hook is not specified, it returns a function decorator that allows easy hooking. Usage:
10.1. Project

209

angr

# Assuming proj is an instance of angr.Project, we will add a custom hook at␣˓→the entry# point of the project.
@proj.hook(proj.entry)
def my_hook(state):
print("Welcome to execution!")Parameters• addr – The address to hook.
• hook – A angr.project.Hook describing a procedure to run at the given address. You
may also pass in a SimProcedure class or a function directly and it will be wrapped in a
Hook object for you.
• length – If you provide a function for the hook, this is the number of bytes that will beskipped by executing the hook by default.
• kwargs – If you provide a SimProcedure for the hook, these are the keyword argumentsthat will be passed to the procedure’s run method eventually.
• replace (bool | None) – Control the behavior on finding that the address is already hooked.
If true, silently replace the hook. If false (default), warn and do not replace the hook. If
none, warn and replace the hook.
is_hooked(addr)
Returns True if addr is hooked.
Parametersaddr – An address.
Return typebool
Returns
True if addr is hooked, False otherwise.
hooked_by(addr)
Returns the current hook for addr.
Parametersaddr – An address.
Return type
SimProcedure | None
Returns
None if the address is not hooked.
unhook(addr)
Remove a hook.
Parametersaddr – The address of the hook.
hook_symbol(symbol_name, simproc, kwargs=None, replace=None)
Resolve a dependency in a binary. Looks up the address of the given symbol, and then hooks that address.
If the symbol was not available in the loaded libraries, this address may be provided by the CLE externs
object.

210

Chapter 10. API ReferenceangrAdditionally, if instead of a symbol name you provide an address, some secret functionality will kick inand you will probably just hook that address, UNLESS you’re on powerpc64 ABIv1 or some yet-unknown
scary ABI that has its function pointers point to something other than the actual functions, in which caseit’ll do the right thing.
Parameters• symbol_name – The name of the dependency to resolve.
• simproc – The SimProcedure instance (or function) with which to hook the symbol• kwargs – If you provide a SimProcedure for the hook, these are the keyword argumentsthat will be passed to the procedure’s run method eventually.
• replace (Optional[bool]) – Control the behavior on finding that the address is alreadyhooked. If true, silently replace the hook. If false, warn and do not replace the hook. If
none (default), warn and replace the hook.
Returns
The address of the new symbol.
Return typeint
symbol_hooked_by(symbol_name)Return the SimProcedure, if it exists, for the given symbol name.
Parameters
symbol_name (str) – Name of the symbol.
Return type
SimProcedure | None
Returns
None if the address is not hooked.
is_symbol_hooked(symbol_name)
Check if a symbol is already hooked.
Parameters
symbol_name (str) – Name of the symbol.
Returns
True if the symbol can be resolved and is hooked, False otherwise.
Return typeboolunhook_symbol(symbol_name)Remove the hook on a symbol. This function will fail if the symbol is provided by the extern object, as thatwould result in a state where analysis would be unable to cope with a call to this symbol.
rehook_symbol(new_address, symbol_name, stubs_on_sync)
Move the hook for a symbol to a specific address :type new_address: :param new_address: the new addressthat will trigger the SimProc execution :type symbol_name: :param symbol_name: the name of the symbol(f.i. strcmp ) :return: None
execute(*args, **kwargs)
This function is a symbolic execution helper in the simple style supported by triton and manticore. It
designed to be run after setting up hooks (see Project.hook), in which the symbolic state can be checked.
This function can be run in three different ways:

10.1. Project

211

angr

• When run with no parameters, this function begins symbolic execution from the entrypoint.
• It can also be run with a “state” parameter specifying a SimState to begin symbolic execution from.
• Finally, it can accept any arbitrary keyword arguments,
project.factory.full_init_state.

which are all passed toIf symbolic execution finishes, this function returns the resulting simulation manager.
terminate_execution()
Terminates a symbolic execution that was started with Project.execute().
class angr.factory.AngrObjectFactory(project, default_engine=None)
Bases: object
This factory provides access to important analysis elements.
Parameters
default_engine (type[SimEngine] | None)__init__(project, default_engine=None)
Parameters
default_engine (type[SimEngine] | None)snippet(addr, jumpkind=None, **block_opts)
successors(*args, engine=None, **kwargs)
Perform execution using an engine. Generally, return a SimSuccessors object classifying the results of therun.
Parameters• state – The state to analyze• engine – The engine to use. If not provided, will use the project default.
• addr – optional, an address to execute at instead of the state’s ip• jumpkind – optional, the jumpkind of the previous exit
• inline – This is an inline execution. Do not bother copying the state.
Additional keyword arguments will be passed directly into each engine’s process method.
blank_state(**kwargs)
Returns a mostly-uninitialized state object. All parameters are optional.
Parameters• addr – The address the state should start at instead of the entry point.
• initial_prefix – If this is provided, all symbolic registers will hold symbolic values
with names prefixed by this string.
• fs – A dictionary of file names with associated preset SimFile objects.
• concrete_fs – bool describing whether the host filesystem should be consulted when
opening files.
• chroot – A path to use as a fake root directory, Behaves similarly to a real chroot. Used
only when concrete_fs is set to True.
• kwargs – Any additional keyword args will be passed to the SimState constructor.

212

Chapter 10. API ReferenceangrReturns
The blank state.
Return type
SimStateentry_state(**kwargs)
Returns a state object representing the program at its entry point. All parameters are optional.
Parameters• addr – The address the state should start at instead of the entry point.
• initial_prefix – If this is provided, all symbolic registers will hold symbolic values
with names prefixed by this string.
• fs – a dictionary of file names with associated preset SimFile objects.
• concrete_fs – boolean describing whether the host filesystem should be consulted when
opening files.
• chroot – a path to use as a fake root directory, behaves similar to a real chroot. used only
when concrete_fs is set to True.
• argc – a custom value to use for the program’s argc. May be either an int or a bitvector. If
not provided, defaults to the length of args.
• args – a list of values to use as the program’s argv. May be mixed strings and bitvectors.
• env – a dictionary to use as the environment for the program. Both keys and values may
be mixed strings and bitvectors.
Returns
The entry state.
Return type
SimState
full_init_state(**kwargs)
Very much like entry_state(), except that instead of starting execution at the program entry point, execution begins at a special SimProcedure that plays the role of the dynamic loader, calling each of theinitializer functions that should be called before execution reaches the entry point.
It can take any of the arguments that can be provided to entry_state, except for addr.
call_state(addr, *args, **kwargs)
Returns a state object initialized to the start of a given function, as if it were called with given parameters.
Parameters• addr – The address the state should start at instead of the entry point.
• args – Any additional positional arguments will be used as arguments to the function call.
The following parameters are optional.
Parameters• base_state – Use this SimState as the base for the new state instead of a blank state.
• cc – Optionally provide a SimCC object to use a specific calling convention.
• ret_addr – Use this address as the function’s return target.
• stack_base – An optional pointer to use as the top of the stack, circa the function entrypoint
10.1. Project

213

angr

• alloc_base – An optional pointer to use as the place to put excess argument data
• grow_like_stack – When allocating data at alloc_base, whether to allocate at decreasing
addresses• toc – The address of the table of contents for ppc64• initial_prefix – If this is provided, all symbolic registers will hold symbolic values
with names prefixed by this string.
• fs – A dictionary of file names with associated preset SimFile objects.
• concrete_fs – bool describing whether the host filesystem should be consulted when
opening files.
• chroot – A path to use as a fake root directory, Behaves similarly to a real chroot. Used
only when concrete_fs is set to True.
• kwargs – Any additional keyword args will be passed to the SimState constructor.
Returns
The state at the beginning of the function.
Return type
SimState
The idea here is that you can provide almost any kind of python type in args and it’ll be translated to abinary format to be placed into simulated memory. Lists (representing arrays) must be entirely elements ofthe same type and size, while tuples (representing structs) can be elements of any type and size. If you’d
like there to be a pointer to a given value, wrap the value in a SimCC.PointerWrapper. Any value that can’t
fit in a register will be automatically put in a PointerWrapper.
If stack_base is not provided, the current stack pointer will be used, and it will be updated. If alloc_base is
not provided, the current stack pointer will be used, and it will be updated. You might not like the results
if you provide stack_base but not alloc_base.
grow_like_stack controls the behavior of allocating data at alloc_base. When data from args needs tobe wrapped in a pointer, the pointer needs to point somewhere, so that data is dumped into memory at
alloc_base. If you set alloc_base to point to somewhere other than the stack, set grow_like_stack to False
so that sequential allocations happen at increasing addresses.
simulation_manager(thing=None, **kwargs)
Constructs a new simulation manager.
Parameters• thing (Union[list[SimState], SimState, None]) – What to put in the new SimulationManager’s active stash (either a SimState or a list of SimStates).
• kwargs – Any additional keyword arguments will be passed to the SimulationManager
constructor
Returns
The new SimulationManager
Return typeangr.sim_manager.SimulationManager
Many different types can be passed to this method:• If nothing is passed in, the SimulationManager is seeded with a state initialized for the program entry
point, i.e. entry_state().
• If a SimState is passed in, the SimulationManager is seeded with that state.

214

Chapter 10. API Referenceangr• If a list is passed in, the list must contain only SimStates and the whole list will be used to seed theSimulationManager.
simgr(*args, **kwargs)
Alias for simulation_manager to save our poor fingers
callable(addr, prototype=None, concrete_only=False, perform_merge=True, base_state=None, toc=None,
cc=None, add_options=None, remove_options=None)
A Callable is a representation of a function in the binary that can be interacted with like a native python
function.
Parameters• addr – The address of the function to use• prototype – The prototype of the call to use, as a string or a SimTypeFunction• concrete_only – Throw an exception if the execution splits into multiple states• perform_merge – Merge all result states into one at the end (only relevant if concrete_only=False)• base_state – The state from which to do these runs
• toc – The address of the table of contents for ppc64• cc – The SimCC to use for a calling convention
Returns
A Callable object that can be used as a interface for executing guest code like a python function.
Return typeangr.callable.Callable
cc()
Return a SimCC (calling convention) parameterized for this project.
Relevant subclasses of SimFunctionArgument are SimRegArg and SimStackArg, and shortcuts to them canbe found on this cc object.
For stack arguments, offsets are relative to the stack pointer on function entry.
function_prototype()
Return a default function prototype parameterized for this project and SimOS.
block(addr, size=None, max_size=None, byte_string=None, vex=None, thumb=False, backup_state=None,
extra_stop_points=None, opt_level=None, num_inst=None, traceflags=0, insn_bytes=None,insn_text=None, strict_block_end=None, collect_data_refs=False, cross_insn_opt=True,
load_from_ro_regions=False, const_prop=False, initial_regs=None, skip_stmts=False)
fresh_block(addr, size, backup_state=None)class angr.block.DisassemblerBlock(addr, insns, thumb, arch)
Bases: object
Helper class to represent a block of disassembled target architecture instructions__init__(addr, insns, thumb, arch)
addr

10.1. Project

215

angr

insns
thumb
arch
pp()
class angr.block.DisassemblerInsn
Bases: object
Helper class to represent a disassembled target architecture instruction
property size:

intproperty address:

int

property mnemonic:

str

property op_str:

strclass angr.block.CapstoneBlock(addr, insns, thumb, arch)
Bases: DisassemblerBlock
Deep copy of the capstone blocks, which have serious issues with having extended lifespans outside of capstoneitselfclass angr.block.CapstoneInsn(capstone_insn)
Bases: DisassemblerInsn
Represents a capstone instruction.
__init__(capstone_insn)
insn
property size:

intproperty address:

int

property mnemonic:

str

property op_str:

strclass angr.block.Block(addr, project=None, arch=None, size=None, max_size=None, byte_string=None,
vex=None, thumb=False, backup_state=None, extra_stop_points=None,
opt_level=None, num_inst=None, traceflags=0, strict_block_end=None,collect_data_refs=False, cross_insn_opt=True, load_from_ro_regions=False,
const_prop=False, initial_regs=None, skip_stmts=False)
Bases: Serializable
Represents a basic block in a binary or a program.
BLOCK_MAX_SIZE = 4096__init__(addr, project=None, arch=None, size=None, max_size=None, byte_string=None, vex=None,
thumb=False, backup_state=None, extra_stop_points=None, opt_level=None, num_inst=None,
traceflags=0, strict_block_end=None, collect_data_refs=False, cross_insn_opt=True,
load_from_ro_regions=False, const_prop=False, initial_regs=None, skip_stmts=False)

216

Chapter 10. API Reference

angr

arch
thumb
addr
size
pp(**kwargs)
set_initial_regs()
static reset_initial_regs()
property vex:

IRSB

property vex_nostmt
property disassembly:

DisassemblerBlock

Provide a disassembly object using whatever disassembler is available
property capstone
property codenodeproperty bytes:

bytes

property instructions
property instruction_addrs
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
class angr.block.SootBlock(addr, project=None, arch=None)
Bases: object
Represents a Soot IR basic block.
__init__(addr, project=None, arch=None)
property soot10.1. Project

217

angr

property size
property codenode10.2 Plugin Ecosystemclass angr.misc.plugins.PluginHub
Bases: Generic[P]A plugin hub is an object which contains many plugins, as well as the notion of a “preset”, or a backer that can
provide default implementations of plugins which cater to a certain circumstance.
Objects in angr like the SimState, the Analyses hub, the SimEngine selector, etc all use this model to unify theirmechanisms for automatically collecting and selecting components to use. If you’re familiar with design patterns
this is a configurable Strategy Pattern.
Each PluginHub subclass should have a corresponding Plugin subclass, and perhaps a PluginPreset subclass if it
wants its presets to be able to specify anything more interesting than a list of defaults.
__init__()classmethod register_default(name, plugin_cls, preset='default')classmethod register_preset(name, preset)
Register a preset instance with the class of the hub it corresponds to. This allows individual plugin objects
to automatically register themselves with a preset by using a classmethod of their own with only the nameof the preset to register with.
property plugin_preset
Get the current active plugin preset
property has_plugin_preset:

bool

Check whether or not there is a plugin preset in use on this hub right now
use_plugin_preset(preset)
Apply a preset to the hub. If there was a previously active preset, discard it.
Preset can be either the string name of a preset or a PluginPreset instance.
discard_plugin_preset()
Discard the current active preset. Will release any active plugins that could have come from the old preset.
get_plugin(name)Get the plugin named name. If no such plugin is currently active, try to activate a new one using the current
preset.
Return type
TypeVar(P)Parametersname (str)has_plugin(name)Return whether or not a plugin with the name name is currently active.
register_plugin(name, plugin)
Add a new plugin plugin with name name to the active plugins.

218

Chapter 10. API ReferenceangrParametersname (str)release_plugin(name)
Deactivate and remove the plugin with name name.
class angr.misc.plugins.PluginPreset
Bases: object
A plugin preset object contains a mapping from name to a plugin class. A preset can be active on a hub, which
will cause it to handle requests for plugins which are not already present on the hub.
Unlike Plugins and PluginHubs, instances of PluginPresets are defined on the module level for individual presets.
You should register the preset instance with a hub to allow plugins to easily add themselves to the preset without
an explicit reference to the preset itself.
__init__()activate(hub)This method is called when the preset becomes active on a hub.
deactivate(hub)This method is called when the preset is discarded from the hub.
add_default_plugin(name, plugin_cls)
Add a plugin to the preset.
list_default_plugins()
Return a list of the names of available default plugins.
request_plugin(name)Return the plugin class which is registered under the name name, or raise NoPlugin if the name isn’t available.
Return type
type[TypeVar(P)]Parametersname (str)copy()
Return a copy of self.
class angr.misc.plugins.PluginVendor
Bases: Generic[P], PluginHub[P]A specialized hub which serves only as a plugin vendor, never having any “active” plugins. It will directly return
the plugins provided by the preset instead of instantiating them.
release_plugin(name)
Deactivate and remove the plugin with name name.
register_plugin(name, plugin)
Add a new plugin plugin with name name to the active plugins.
class angr.misc.plugins.VendorPreset
Bases: PluginPreset
A specialized preset class for use with the PluginVendor.

10.2. Plugin Ecosystem

219

angr

10.3 Program State
angr.sim_state.arch_overridable(f )class angr.sim_state.SimState(project=None, arch=None, plugins=None, mode=None, options=None,
add_options=None, remove_options=None, special_memory_filler=None,
os_name=None, plugin_preset='default', cle_memory_backer=None,
dict_memory_backer=None, permissions_map=None,default_permissions=3, stack_perms=None, stack_end=None,
stack_size=None, regioned_memory_cls=None, **kwargs)
Bases: PluginHub
The SimState represents the state of a program, including its memory, registers, and so forth.
Parameters• project (angr.Project) – The project instance.
• arch (archinfo.Arch |str) – The architecture of the state.
Variables• regs – A convenient view of the state’s registers, where each register is a property• mem – A convenient view of the state’s memory, a angr.state_plugins.view.
SimMemView• registers – The state’s register file as a flat memory region• memory – The state’s memory as a flat memory region• solver – The symbolic solver and variable manager for this state• inspect – The breakpoint manager, a angr.state_plugins.inspect.SimInspector• log – Information about the state’s history• scratch – Information about the current execution step• posix – MISNOMER: information about the operating system or environment model• fs – The current state of the simulated filesystem• libc – Information about the standard library we are emulating• cgc – Information about the cgc environment• uc_manager – Control of under-constrained symbolic execution• unicorn – Control of the Unicorn Engine
solver:

SimSolver

posix:

SimSystemPosix

registers:
regs:

SimRegNameView

memory:DefaultMemory

callstack:
mem:

220

DefaultMemory

CallStack

SimMemView

Chapter 10. API Referenceangrhistory:

SimStateHistory

inspect:

SimInspector

jni_references:
scratch:

SimStateJNIReferences

SimStateScratch__init__(project=None, arch=None, plugins=None, mode=None, options=None, add_options=None,remove_options=None, special_memory_filler=None, os_name=None, plugin_preset='default',
cle_memory_backer=None, dict_memory_backer=None, permissions_map=None,default_permissions=3, stack_perms=None, stack_end=None, stack_size=None,regioned_memory_cls=None, **kwargs)
property plugins
property se
Deprecated alias for solver
property ip
Get the instruction pointer expression, trigger SimInspect breakpoints, and generate SimActions. Use _ip
to not trigger breakpoints or generate actions.
Returns
an expression
property addr
Get the concrete address of the instruction pointer, without triggering SimInspect breakpoints or generating
SimActions. An integer is returned, or an exception is raised if the instruction pointer is symbolic.
Returns
an intproperty arch:

Arch

T = ~T
get_plugin(name)Get the plugin named name. If no such plugin is currently active, try to activate a new one using the current
preset.
has_plugin(name)Return whether or not a plugin with the name name is currently active.
register_plugin(name, plugin, inhibit_init=False)
Add a new plugin plugin with name name to the active plugins.
property javavm_memory
In case of an JavaVM with JNI support, a state can store the memory plugin twice; one for the native andone for the java view of the state.
Returns
The JavaVM view of the memory plugin.
property javavm_registers
In case of an JavaVM with JNI support, a state can store the registers plugin twice; one for the native andone for the java view of the state.
Returns
The JavaVM view of the registers plugin.

10.3. Program State

221

angr

simplify(*args)
Simplify this state’s constraints.
add_constraints(*constraints)
Add some constraints to the state.
You may pass in any number of symbolic booleans as variadic positional arguments.
satisfiable(**kwargs)
Whether the state’s constraints are satisfiable
downsize()
Clean up after the solver engine. Calling this when a state no longer needs to be solved on will reduce
memory usage.
step(**kwargs)
Perform a step of symbolic execution using this state. Any arguments to AngrObjectFactory.successors
can be passed to this.
Returns
A SimSuccessors object categorizing the results of the step.
block(*args, **kwargs)
Represent the basic block at this state’s instruction pointer. Any arguments to AngrObjectFactory.block
can ba passed to this.
Returns
A Block object describing the basic block of code at this point.
copy()
Returns a copy of the state.
merge(*others, **kwargs)
Merges this state with the other states. Returns the merging result, merged state, and the merge flag.
Parameters• states – the states to merge• merge_conditions – a tuple of the conditions under which each state holds• common_ancestor – a state that represents the common history between the states being
merged. Usually it is only available when EFFICIENT_STATE_MERGING is enabled,
otherwise weak-refed states might be dropped from state history instances.
• plugin_whitelist – a list of plugin names that will be merged. If this option is given
and is not None, any plugin that is not inside this list will not be merged, and will be createdas a fresh instance in the new state.
• common_ancestor_history – a SimStateHistory instance that represents the common
history between the states being merged. This is to allow optimal state merging when
EFFICIENT_STATE_MERGING is disabled.
Returns(merged state, merge flag, a bool indicating if any merging occurred)widen(*others)
Perform a widening between self and other states :type others: :param others: :return:
reg_concrete(*args, **kwargs)
Returns the contents of a register but, if that register is symbolic, raises a SimValueError.

222

Chapter 10. API Referenceangr

mem_concrete(*args, **kwargs)
Returns the contents of a memory but, if the contents are symbolic, raises a SimValueError.
stack_push(thing)
Push ‘thing’ to the stack, writing the thing to memory and adjusting the stack pointer.
stack_pop()
Pops from the stack and returns the popped thing. The length will be the architecture word size.
stack_read(offset, length, bp=False)
Reads length bytes, at an offset into the stack.
Parameters• offset – The offset from the stack pointer.
• length – The number of bytes to read.
• bp – If True, offset from the BP instead of the SP. Default: False.
make_concrete_int(expr)
prepare_callsite(retval, args, cc='wtf')
dbg_print_stack(depth=None, sp=None)
Only used for debugging purposes. Return the current stack info in formatted string. If depth is None, thecurrent stack frame (from sp to bp) will be printed out.
set_mode(mode)
property thumbproperty with_condition
class angr.sim_state_options.StateOption(name, types, default='_NO_DEFAULT_VALUE',
description=None)
Bases: object
Describes a state option.
__init__(name, types, default='_NO_DEFAULT_VALUE', description=None)
name
types
default
description
property has_default_value
one_type()class angr.sim_state_options.SimStateOptions(thing)Bases: object
A per-state manager of state options. An option can be either a key-valued entry or a Boolean switch (which canbe seen as a key-valued entry whose value can only be either True or False).

10.3. Program State

223

angr

OPTIONS = {'ABSTRACT_MEMORY': <O ABSTRACT_MEMORY[bool]>, 'ABSTRACT_SOLVER': <O
ABSTRACT_SOLVER[bool]>, 'ACTION_DEPS': <O ACTION_DEPS[bool]>, 'ADD_AUTO_REFS': <O
ADD_AUTO_REFS[bool]>, 'ALLOW_SEND_FAILURES': <O ALLOW_SEND_FAILURES[bool]>,'ALL_FILES_EXIST': <O ALL_FILES_EXIST[bool]>, 'ANY_FILE_MIGHT_EXIST': <O
ANY_FILE_MIGHT_EXIST[bool]>, 'APPROXIMATE_FIRST': <O APPROXIMATE_FIRST[bool]>,'APPROXIMATE_GUARDS': <O APPROXIMATE_GUARDS[bool]>, 'APPROXIMATE_MEMORY_INDICES': <O
APPROXIMATE_MEMORY_INDICES[bool]>, 'APPROXIMATE_MEMORY_SIZES': <O
APPROXIMATE_MEMORY_SIZES[bool]>, 'APPROXIMATE_SATISFIABILITY': <O
APPROXIMATE_SATISFIABILITY[bool]>, 'AST_DEPS': <O AST_DEPS[bool]>, 'AUTO_REFS': <O
AUTO_REFS[bool]>, 'AVOID_MULTIVALUED_READS': <O AVOID_MULTIVALUED_READS[bool]>,'AVOID_MULTIVALUED_WRITES': <O AVOID_MULTIVALUED_WRITES[bool]>,'BEST_EFFORT_MEMORY_STORING': <O BEST_EFFORT_MEMORY_STORING[bool]>,'BYPASS_ERRORED_IRCCALL': <O BYPASS_ERRORED_IRCCALL[bool]>, 'BYPASS_ERRORED_IROP':<O BYPASS_ERRORED_IROP[bool]>, 'BYPASS_ERRORED_IRSTMT': <O
BYPASS_ERRORED_IRSTMT[bool]>, 'BYPASS_UNSUPPORTED_IRCCALL': <O
BYPASS_UNSUPPORTED_IRCCALL[bool]>, 'BYPASS_UNSUPPORTED_IRDIRTY': <O
BYPASS_UNSUPPORTED_IRDIRTY[bool]>, 'BYPASS_UNSUPPORTED_IREXPR': <O
BYPASS_UNSUPPORTED_IREXPR[bool]>, 'BYPASS_UNSUPPORTED_IROP': <O
BYPASS_UNSUPPORTED_IROP[bool]>, 'BYPASS_UNSUPPORTED_IRSTMT': <O
BYPASS_UNSUPPORTED_IRSTMT[bool]>, 'BYPASS_UNSUPPORTED_SYSCALL': <O
BYPASS_UNSUPPORTED_SYSCALL[bool]>, 'BYPASS_VERITESTING_EXCEPTIONS': <O
BYPASS_VERITESTING_EXCEPTIONS[bool]>, 'CACHELESS_SOLVER': <O
CACHELESS_SOLVER[bool]>, 'CALLLESS': <O CALLLESS[bool]>, 'CGC_ENFORCE_FD': <O
CGC_ENFORCE_FD[bool]>, 'CGC_NON_BLOCKING_FDS': <O CGC_NON_BLOCKING_FDS[bool]>,'CGC_NO_SYMBOLIC_RECEIVE_LENGTH': <O CGC_NO_SYMBOLIC_RECEIVE_LENGTH[bool]>,'COMPOSITE_SOLVER': <O COMPOSITE_SOLVER[bool]>, 'CONCRETIZE': <O CONCRETIZE[bool]>,'CONCRETIZE_SYMBOLIC_FILE_READ_SIZES': <O
CONCRETIZE_SYMBOLIC_FILE_READ_SIZES[bool]>, 'CONCRETIZE_SYMBOLIC_WRITE_SIZES': <O
CONCRETIZE_SYMBOLIC_WRITE_SIZES[bool]>, 'CONSERVATIVE_READ_STRATEGY': <O
CONSERVATIVE_READ_STRATEGY[bool]>, 'CONSERVATIVE_WRITE_STRATEGY': <O
CONSERVATIVE_WRITE_STRATEGY[bool]>, 'CONSTRAINT_TRACKING_IN_SOLVER': <O
CONSTRAINT_TRACKING_IN_SOLVER[bool]>, 'COPY_STATES': <O COPY_STATES[bool]>,'CPUID_SYMBOLIC': <O CPUID_SYMBOLIC[bool]>, 'DOWNSIZE_Z3': <O DOWNSIZE_Z3[bool]>,'DO_CCALLS': <O DO_CCALLS[bool]>, 'DO_RET_EMULATION': <O DO_RET_EMULATION[bool]>,'EFFICIENT_STATE_MERGING': <O EFFICIENT_STATE_MERGING[bool]>, 'ENABLE_NX': <O
ENABLE_NX[bool]>, 'EXCEPTION_HANDLING': <O EXCEPTION_HANDLING[bool]>,'EXTENDED_IROP_SUPPORT': <O EXTENDED_IROP_SUPPORT[bool]>, 'FAST_MEMORY': <O
FAST_MEMORY[bool]>, 'FAST_REGISTERS': <O FAST_REGISTERS[bool]>, 'FILES_HAVE_EOF': <O
FILES_HAVE_EOF[bool]>, 'HYBRID_SOLVER': <O HYBRID_SOLVER[bool]>,'JAVA_IDENTIFY_GETTER_SETTER': <O JAVA_IDENTIFY_GETTER_SETTER[bool]>,'JAVA_TRACK_ATTRIBUTES': <O JAVA_TRACK_ATTRIBUTES[bool]>, 'KEEP_IP_SYMBOLIC': <O
KEEP_IP_SYMBOLIC[bool]>, 'LAZY_SOLVES': <O LAZY_SOLVES[bool]>,'MEMORY_CHUNK_INDIVIDUAL_READS': <O MEMORY_CHUNK_INDIVIDUAL_READS[bool]>,'MEMORY_FIND_STRICT_SIZE_LIMIT': <O MEMORY_FIND_STRICT_SIZE_LIMIT[bool]>,'MEMORY_SYMBOLIC_BYTES_MAP': <O MEMORY_SYMBOLIC_BYTES_MAP[bool]>,'NO_CROSS_INSN_OPT': <O NO_CROSS_INSN_OPT[bool]>, 'NO_IP_CONCRETIZATION': <O
NO_IP_CONCRETIZATION[bool]>, 'NO_SYMBOLIC_JUMP_RESOLUTION': <O
NO_SYMBOLIC_JUMP_RESOLUTION[bool]>, 'NO_SYMBOLIC_SYSCALL_RESOLUTION': <O
NO_SYMBOLIC_SYSCALL_RESOLUTION[bool]>, 'OPTIMIZE_IR': <O OPTIMIZE_IR[bool]>,'PRODUCE_ZERODIV_SUCCESSORS': <O PRODUCE_ZERODIV_SUCCESSORS[bool]>,'REGION_MAPPING': <O REGION_MAPPING[bool]>, 'REPLACEMENT_SOLVER': <O
REPLACEMENT_SOLVER[bool]>, 'REVERSE_MEMORY_HASH_MAP': <O
REVERSE_MEMORY_HASH_MAP[bool]>, 'REVERSE_MEMORY_NAME_MAP': <O
REVERSE_MEMORY_NAME_MAP[bool]>, 'SHORT_READS': <O SHORT_READS[bool]>,'SIMPLIFY_CONSTRAINTS': <O SIMPLIFY_CONSTRAINTS[bool]>, 'SIMPLIFY_EXIT_GUARD': <O
SIMPLIFY_EXIT_GUARD[bool]>, 'SIMPLIFY_EXIT_STATE': <O SIMPLIFY_EXIT_STATE[bool]>,
224 'SIMPLIFY_EXIT_TARGET': <O SIMPLIFY_EXIT_TARGET[bool]>, 'SIMPLIFY_EXPRS':
Chapter 10. API<OReference
SIMPLIFY_EXPRS[bool]>, 'SIMPLIFY_MEMORY_READS': <O SIMPLIFY_MEMORY_READS[bool]>,'SIMPLIFY_MEMORY_WRITES': <O SIMPLIFY_MEMORY_WRITES[bool]>,'SIMPLIFY_MERGED_CONSTRAINTS': <O SIMPLIFY_MERGED_CONSTRAINTS[bool]>,angr__init__(thing)Parameters
thing – Either a set of Boolean switches to enable, or an existing SimStateOptions instance.
add(boolean_switch)[COMPATIBILITY] Enable a Boolean switch.
Parametersboolean_switch (str) – Name of the Boolean switch.
ReturnsNone
update(boolean_switches)[COMPATIBILITY] In order to be compatible with the old interface, you can enable a collection of Boolean
switches at the same time by doing the following:>>> state.options.update({sim_options.SYMBOLIC, sim_options.ABSTRACT_MEMORY})or>>> state.options.update(sim_options.unicorn)
Parametersboolean_switches (set) – A collection of Boolean switches to enable.
ReturnsNoneremove(name)Drop a state option if it exists, or raise a KeyError if the state option is not set.
[COMPATIBILITY] Remove a Boolean switch.
Parametersname (str) – Name of the state option.
ReturnsNNone
discard(name)Drop a state option if it exists, or silently return if the state option is not set.
[COMPATIBILITY] Disable a Boolean switch.
Parametersname (str) – Name of the Boolean switch.
ReturnsNone
difference(boolean_switches)[COMPATIBILITY] Make a copy of the current instance, and then discard all options that are inboolean_switches.
Parametersboolean_switches (set) – A collection of Boolean switches to disable.

10.3. Program State

225

angr

Returns
A new SimStateOptions instance.
copy()
Get a copy of the current SimStateOptions instance.
Returns
A new SimStateOptions instance.
Return type
SimStateOptions
tally(exclude_false=True, description=False)
Return a string representation of all state options.
Parameters• exclude_false (bool) – Whether to exclude Boolean switches that are disabled.
• description (bool) – Whether to display the description of each option.
Returns
A string representation.
Return typestrclassmethod register_option(name, types, default=None, description=None)
Register a state option.
Parameters• name (str) – Name of the state option.
• types – A collection of allowed types of this state option.
• default – The default value of this state option.
• description (str) – The description of this state option.
ReturnsNoneclassmethod register_bool_option(name, description=None)
Register a Boolean switch as state option. This is equivalent to cls.register_option(name, set([bool]), description=description)
Parameters• name (str) – Name of the state option.
• description (str) – The description of this state option.
ReturnsNoneclass angr.state_plugins.SimStatePlugin
Bases: object
This is a base class for SimState plugins. A SimState plugin will be copied along with the state when the state isbranched. They are intended to be used for things such as tracking open files, tracking heap details, and providing
storage and persistence for SimProcedures.
STRONGREF_STATE = False

226

Chapter 10. API Referenceangr__init__()state:

SimState

set_state(state)
Sets a new state (for example, if the state has been branched)
set_strongref_state(state)copy(_memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
static memo(f )A decorator function you should apply to copy
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins

10.3. Program State

227

angr

• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclassmethod register_default(name, xtr=None)
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.state_plugins.SimStateLibc
Bases: SimStatePlugin
This state plugin keeps track of various libc stuff:

228

Chapter 10. API Referenceangr

LOCALE_ARRAY = [b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00',
b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x03', b'\x02 ', b'\x02 ', b'\x02 ', b'\x02 ', b'\x02\x00', b'\x02\x00', b'\x02\x00',
b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00',
b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00',
b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x01`', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8',
b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0',
b'\x08\xd5', b'\x08\xd5', b'\x08\xd5', b'\x08\xd5', b'\x08\xd5', b'\x08\xd5',
b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5',
b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5',
b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5',
b'\x08\xc5', b'\x08\xc5', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x08\xd6', b'\x08\xd6', b'\x08\xd6', b'\x08\xd6',
b'\x08\xd6', b'\x08\xd6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6',
b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6',
b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6',
b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x02\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
10.3. b'\x00\x00',
Program Stateb'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
229
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',

angr

TOLOWER_LOC_ARRAY = [128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139,
140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156,
157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,
174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190,
191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207,
208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241,
242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 4294967295, 0, 1,
2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45,
46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 97, 98,
99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115,
116, 117, 118, 119, 120, 121, 122, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101,
102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118,
119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135,
136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152,
153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169,
170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186,
187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203,
204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220,
221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237,
238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
255]
TOUPPER_LOC_ARRAY = [128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139,
140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156,
157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,
174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190,
191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207,
208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241,
242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 4294967295, 0, 1,
2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45,
46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66,
67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87,
88, 89, 90, 91, 92, 93, 94, 95, 96, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76,
77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 123, 124, 125, 126, 127,
128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144,
145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161,
162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178,
179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195,
196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212,
213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229,
230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246,
247, 248, 249, 250, 251, 252, 253, 254, 255]__init__()copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.

230

Chapter 10. API Referenceangr

In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin

10.3. Program State

231

angr

Returns
True if the state plugin is actually widened.
Return typebool
property errno
ret_errno(val)class angr.state_plugins.SimInspector
Bases: SimStatePlugin
The breakpoint interface, used to instrument execution. For usage information, look here: https://docs.angr.io/
core-concepts/simulation#breakpoints
BP_AFTER = 'after'
BP_BEFORE = 'before'
BP_BOTH = 'both'__init__()action(event_type, when, **kwargs)
Called from within the engine when events happens. This function checks all breakpoints registered forthat event and fires the ones whose conditions match.
make_breakpoint(event_type, *args, **kwargs)
Creates and adds a breakpoint which would trigger on event_type. Additional arguments are passed to the
BP constructor.
Returns
The created breakpoint, so that it can be removed later.
b(event_type, *args, **kwargs)
Creates and adds a breakpoint which would trigger on event_type. Additional arguments are passed to the
BP constructor.
Returns
The created breakpoint, so that it can be removed later.
add_breakpoint(event_type, bp)
Adds a breakpoint which would trigger on event_type.
Parameters• event_type – The event type to trigger on• bp – The breakpoint
Returns
The created breakpoint.
remove_breakpoint(event_type, bp=None, filter_func=None)
Removes a breakpoint.
Parameters• bp – The breakpoint to remove.
• filter_func – A filter function to specify whether each breakpoint should be removed
or not.

232

Chapter 10. API Referenceangrcopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
downsize()
Remove previously stored attributes from this plugin instance to save memory. This method is supposed tobe called by breakpoint implementors. A typical workflow looks like the following :>>> # Add `attr0` and `attr1` to `self.state.inspect`>>> self.state.inspect(xxxxxx, attr0=yyyy, attr1=zzzz)>>> # Get new attributes out of SimInspect in case they are modified by the user>>> new_attr0 = self.state._inspect.attr0>>> new_attr1 = self.state._inspect.attr1>>> # Remove them from SimInspect>>> self.state._inspect.downsize()merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with

10.3. Program State

233

angr

• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
set_state(state)
Sets a new state (for example, if the state has been branched)class angr.state_plugins.PosixDevFS
Bases: SimMountget(path)
Implement this function to instrument file lookups.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A SimFile, or Noneinsert(path, simfile)
Implement this function to instrument file creation.
Parameters• path_elements – A list of path elements traversing from the mountpoint to the file• simfile – The file to insert
Returns
A bool indicating whether the insert occurred
delete(path)
Implement this function to instrument file deletion.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A bool indicating whether the delete occurred

234

Chapter 10. API Referenceangrlookup(_)
Look up the path of a SimFile in the mountpoint
Parameters
sim_file – A SimFile object needs to be looked up
Returns
A string representing the path of the file in the mountpoint Or None if the SimFile does notexist in the mountpoint
merge(others, conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin

10.3. Program State

235

angr

Returns
True if the state plugin is actually widened.
Return typebool
copy(_)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.PosixProcFS
Bases: SimMount
The virtual file system mounted at /proc (as of now, on Linux).
get(path)
Implement this function to instrument file lookups.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A SimFile, or Noneinsert(path, simfile)
Implement this function to instrument file creation.
Parameters• path_elements – A list of path elements traversing from the mountpoint to the file• simfile – The file to insert
Returns
A bool indicating whether the insert occurred
delete(path)
Implement this function to instrument file deletion.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A bool indicating whether the delete occurred
lookup(_)
Look up the path of a SimFile in the mountpoint
Parameters
sim_file – A SimFile object needs to be looked up

236

Chapter 10. API ReferenceangrReturns
A string representing the path of the file in the mountpoint Or None if the SimFile does notexist in the mountpoint
merge(others, conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool

10.3. Program State

237

angr

copy(_)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.SimSystemPosix(stdin=None, stdout=None, stderr=None, fd=None,
sockets=None, socket_queue=None, argv=None, argc=None,environ=None, auxv=None, tls_modules=None, sigmask=None,
pid=None, ppid=None, uid=None, gid=None, brk=None)
Bases: SimStatePlugin
Data storage and interaction mechanisms for states with an environment conforming to posix. Available asstate.posix.
SIG_BLOCK = 0
SIG_UNBLOCK = 1
SIG_SETMASK = 2
EPERM = 1
ENOENT = 2
ESRCH = 3
EINTR = 4
EIO = 5ENXIO = 6
E2BIG = 7
ENOEXEC = 8
EBADF = 9
ECHILD = 10
EAGAIN = 11
ENOMEM = 12
EACCES = 13
EFAULT = 14
ENOTBLK = 15
EBUSY = 16

238

Chapter 10. API Referenceangr

EEXIST = 17
EXDEV = 18
ENODEV = 19
ENOTDIR = 20
EISDIR = 21
EINVAL = 22
ENFILE = 23
EMFILE = 24
ENOTTY = 25
ETXTBSY = 26
EFBIG = 27
ENOSPC = 28
ESPIPE = 29
EROFS = 30
EMLINK = 31
EPIPE = 32
EDOM = 33
ERANGE = 34__init__(stdin=None, stdout=None, stderr=None, fd=None, sockets=None, socket_queue=None,
argv=None, argc=None, environ=None, auxv=None, tls_modules=None, sigmask=None,
pid=None, ppid=None, uid=None, gid=None, brk=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property closed_fds
init_state()
Use this function to perform any initialization on the state at plugin-add time
set_brk(new_brk)

10.3. Program State

239

angr

set_state(state)
Sets a new state (for example, if the state has been branched)open(name, flags, preferred_fd=None)
Open a symbolic file. Basically open(2).
Parameters• name (string or bytes) – Path of the symbolic file, as a string or bytes.
• flags – File operation flags, a bitfield of constants from open(2), as an AST• preferred_fd – Assign this fd if it’s not already claimed.
Returns
The file descriptor number allocated (maps through posix.get_fd to a SimFileDescriptor) or-1 if the open fails.
mode from open(2) is unsupported at present.
open_socket(ident)
get_fd(fd, create_file=True)
Looks up the SimFileDescriptor associated with the given number (an AST). If the number is concrete anddoes not map to anything, return None. If the number is symbolic, constrain it to an open fd and create a
new file for it. Set create_file to False if no write-access is planned (i.e. fd is read-only).
get_concrete_fd(fd, create_file=True)
Same behavior as get_fd(fd), only the result is a concrete integer fd (or -1) instead of a SimFileDescriptor.
close(fd)Closes the given file descriptor (an AST). Returns whether the operation succeeded (a concrete boolean)fstat(fd)fstat_with_result(sim_fd)
sigmask(sigsetsize=None)
Gets the current sigmask. If it’s blank, a new one is created (of sigsetsize).
Parameterssigsetsize – the size (in bytes of the sigmask set)
Returns
the sigmask
sigprocmask(how, new_mask, sigsetsize, valid_ptr=True)
Updates the signal mask.
Parameters• how – the “how” argument of sigprocmask (see manpage)• new_mask – the mask modification to apply• sigsetsize – the size (in bytes of the sigmask set)
• valid_ptr – is set if the new_mask was not NULL

240

Chapter 10. API Referenceangrmerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
dump_file_by_path(path, **kwargs)
Returns the concrete content for a file by path.
Parameters10.3. Program State

241

angr

• path – file path as string• kwargs – passed to state.solver.eval
Returns
file contents as string
dumps(fd, **kwargs)
Returns the concrete content for a file descriptor.
BACKWARD COMPATIBILITY: if you ask for file descriptors 0 1 or 2, it will return the data from stdin,
stdout, or stderr as a flat string.
Parameters
fd – A file descriptor.
Returns
The concrete content.
Return typestrclass angr.state_plugins.SimSolver(solver=None, all_variables=None, temporal_tracked_variables=None,
eternal_tracked_variables=None)
Bases: SimStatePlugin
This is the plugin you’ll use to interact with symbolic variables, creating them and evaluating them. It should beavailable on a state as state.solver.
Any top-level variable of the claripy module can be accessed as a property of this object.
__init__(solver=None, all_variables=None, temporal_tracked_variables=None,
eternal_tracked_variables=None)reload_solver(constraints=None)
Reloads the solver. Useful when changing solver options.
Parametersconstraints (list) – A new list of constraints to use in the reloaded solver instead of thecurrent one
get_variables(*keys)
Iterate over all variables for which their tracking key is a prefix of the values provided.
Elements are a tuple, the first element is the full tracking key, the second is the symbol.
>>> list(s.solver.get_variables('mem'))[(('mem', 0x1000), <BV64 mem_1000_4_64>), (('mem', 0x1008), <BV64 mem_1008_5_64>˓→)]>>> list(s.solver.get_variables('file'))[(('file', 1, 0), <BV8 file_1_0_6_8>), (('file', 1, 1), <BV8 file_1_1_7_8>),(('file', 2, 0), <BV8 file_2_0_8_8>)]>>> list(s.solver.get_variables('file', 2))[(('file', 2, 0), <BV8 file_2_0_8_8>)]

242

Chapter 10. API Referenceangr>>> list(s.solver.get_variables())[(('mem', 0x1000), <BV64 mem_1000_4_64>), (('mem', 0x1008), <BV64 mem_1008_5_64>
˓→),(('file', 1, 0), <BV8 file_1_0_6_8>), (('file', 1, 1), <BV8 file_1_1_7_8>),(('file', 2, 0), <BV8 file_2_0_8_8>)]
register_variable(v, key, eternal=True)
Register a value with the variable tracking system
Parameters• v – The BVS to register• key – A tuple to register the variable under
Parma eternal
Whether this is an eternal variable, default True. If False, an incrementing counter will beappended to the key.
describe_variables(v)Given an AST, iterate over all the keys of all the BVS leaves in the tree which are registered.
Unconstrained(name, bits, uninitialized=True, inspect=True, events=True, key=None, eternal=False,
uc_alloc_depth=None, **kwargs)
Creates an unconstrained symbol or a default concrete value (0), based on the state options.
Parameters• name – The name of the symbol.
• bits – The size (in bits) of the symbol.
• uninitialized – Whether this value should be counted as an “uninitialized” value in thecourse of an analysis.
• inspect – Set to False to avoid firing SimInspect breakpoints• events – Set to False to avoid generating a SimEvent for the occasion• key – Set this to a tuple of increasingly specific identifiers (for example, ('mem',
0xffbeff00) or ('file', 4, 0x20) to cause it to be tracked, i.e. accessible throughsolver.get_variables.
• eternal – Set to True in conjunction with setting a key to cause all states with the sameancestry to retrieve the same symbol when trying to create the value. If False, a counter
will be appended to the key.
Returns
an unconstrained symbol (or a concrete value of 0).
BVS(name, size, min=None, max=None, stride=None, uninitialized=False, explicit_name=None, key=None,
eternal=False, inspect=True, events=True, **kwargs)
Creates a bit-vector symbol (i.e., a variable). Other keyword parameters are passed directly on to theconstructor of claripy.ast.BV.
Parameters• name – The name of the symbol.
• size – The size (in bits) of the bit-vector.
• min – The minimum value of the symbol. Note that this only work when using VSA.

10.3. Program State

243

angr

• max – The maximum value of the symbol. Note that this only work when using VSA.
• stride – The stride of the symbol. Note that this only work when using VSA.
• uninitialized – Whether this value should be counted as an “uninitialized” value in thecourse of an analysis.
• explicit_name – Set to True to prevent an identifier from appended to the name to ensure
uniqueness.
• key – Set this to a tuple of increasingly specific identifiers (for example, ('mem',
0xffbeff00) or ('file', 4, 0x20) to cause it to be tracked, i.e. accessible throughsolver.get_variables.
• eternal – Set to True in conjunction with setting a key to cause all states with the sameancestry to retrieve the same symbol when trying to create the value. If False, a counter
will be appended to the key.
• inspect – Set to False to avoid firing SimInspect breakpoints• events – Set to False to avoid generating a SimEvent for the occasion
Returns
A BV object representing this symbol.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

244

Chapter 10. API ReferenceangrDuring static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
downsize()
Frees memory associated with the constraint solver by clearing all of its internal caches.
property constraints
Returns the constraints of the state stored by the solver.
eval_to_ast(e, n, extra_constraints=(), exact=None)
Evaluate an expression, using the solver if necessary. Returns AST objects.
Parameters• e – the expression• n – the number of desired solutions• extra_constraints – extra constraints to apply to the solver• exact – if False, returns approximate solutions
Returns
a tuple of the solutions, in the form of claripy AST nodes
Return type
tuple
max(e, extra_constraints=(), exact=None, signed=False)
Return the maximum value of expression e.

10.3. Program State

245

angr

:param e : expression (an AST) to evaluate :type extra_constraints: :param extra_constraints: extra constraints (as ASTs) to add to the solver for this solve :param exact : if False, return approximate solutions.
:param signed : Whether the expression should be treated as a signed value. :return: the maximum possible
value of e (backend object)
min(e, extra_constraints=(), exact=None, signed=False)
Return the minimum value of expression e.
:param e : expression (an AST) to evaluate :type extra_constraints: :param extra_constraints: extra constraints (as ASTs) to add to the solver for this solve :param exact : if False, return approximate solutions.
:param signed : Whether the expression should be treated as a signed value. :return: the minimum possible
value of e (backend object)solution(e, v, extra_constraints=(), exact=None)
Return True if v is a solution of expr with the extra constraints, False otherwise.
Parameters• e – An expression (an AST) to evaluate• v – The proposed solution (an AST)
• extra_constraints – Extra constraints (as ASTs) to add to the solver for this solve.
• exact – If False, return approximate solutions.
Returns
True if v is a solution of expr, False otherwise
is_true(e, extra_constraints=(), exact=None)
If the expression provided is absolutely, definitely a true boolean, return True. Note that returning False
doesn’t necessarily mean that the expression can be false, just that we couldn’t figure that out easily.
Parameters• e – An expression (an AST) to evaluate• extra_constraints – Extra constraints (as ASTs) to add to the solver for this solve.
• exact – If False, return approximate solutions.
Returns
True if v is definitely true, False otherwise
is_false(e, extra_constraints=(), exact=None)
If the expression provided is absolutely, definitely a false boolean, return True. Note that returning False
doesn’t necessarily mean that the expression can be true, just that we couldn’t figure that out easily.
Parameters• e – An expression (an AST) to evaluate• extra_constraints – Extra constraints (as ASTs) to add to the solver for this solve.
• exact – If False, return approximate solutions.
Returns
True if v is definitely false, False otherwise
unsat_core(extra_constraints=())
This function returns the unsat core from the backend solver.
Parameters
extra_constraints – Extra constraints (as ASTs) to add to the solver for this solve.

246

Chapter 10. API ReferenceangrReturns
The unsat core.
satisfiable(extra_constraints=(), exact=None)
This function does a constraint check and checks if the solver is in a sat state.
Parameters• extra_constraints – Extra constraints (as ASTs) to add to s for this solve• exact – If False, return approximate solutions.
Returns
True if sat, otherwise false
add(*constraints)
Add some constraints to the solver.
Parametersconstraints – Pass any constraints that you want to add (ASTs) as varargs.
CastType = ~CastType
eval_upto(e, n, cast_to=None, **kwargs)
Evaluate an expression, using the solver if necessary. Returns primitives as specified by the cast_to parameter. Only certain primitives are supported, check the implementation of _cast_to to see which ones.
Parameters• e – the expression• n – the number of desired solutions• extra_constraints – extra constraints to apply to the solver• exact – if False, returns approximate solutions• cast_to – desired type of resulting values
Returns
a tuple of the solutions, in the form of Python primitives
Return typetupleeval(e, cast_to=None, **kwargs)
Evaluate an expression to get any possible solution. The desired output types can be specified using thecast_to parameter. extra_constraints can be used to specify additional constraints the returned values mustsatisfy.
Parameters• e – the expression to get a solution for• kwargs – Any additional kwargs will be passed down to eval_upto• cast_to – desired type of resulting values
Raises
SimUnsatError – if no solution could be found satisfying the given constraints
Returns

10.3. Program State

247

angr

eval_one(e, cast_to=None, **kwargs)
Evaluate an expression to get the only possible solution. Errors if either no or more than one solution isreturned. A kwarg parameter default can be specified to be returned instead of failure!
Parameters• e – the expression to get a solution for• cast_to – desired type of resulting values• default – A value can be passed as a kwarg here. It will be returned in case of failure.
• kwargs – Any additional kwargs will be passed down to eval_upto
Raises• SimUnsatError – if no solution could be found satisfying the given constraints• SimValueError – if more than one solution was found to satisfy the given constraints
Returns
The value for eeval_atmost(e, n, cast_to=None, **kwargs)
Evaluate an expression to get at most n possible solutions. Errors if either none or more than n solutions
are returned.
Parameters• e – the expression to get a solution for• n – the inclusive upper limit on the number of solutions• cast_to – desired type of resulting values• kwargs – Any additional kwargs will be passed down to eval_upto
Raises• SimUnsatError – if no solution could be found satisfying the given constraints• SimValueError – if more than n solutions were found to satisfy the given constraints
Returns
The solutions for eeval_atleast(e, n, cast_to=None, **kwargs)
Evaluate an expression to get at least n possible solutions. Errors if less than n solutions were found.
Parameters• e – the expression to get a solution for• n – the inclusive lower limit on the number of solutions• cast_to – desired type of resulting values• kwargs – Any additional kwargs will be passed down to eval_upto
Raises• SimUnsatError – if no solution could be found satisfying the given constraints• SimValueError – if less than n solutions were found to satisfy the given constraints
Returns
The solutions for e

248

Chapter 10. API Referenceangreval_exact(e, n, cast_to=None, **kwargs)
Evaluate an expression to get exactly the n possible solutions. Errors if any number of solutions other thann was found to exist.
Parameters• e – the expression to get a solution for• n – the inclusive lower limit on the number of solutions• cast_to – desired type of resulting values• kwargs – Any additional kwargs will be passed down to eval_upto
Raises• SimUnsatError – if no solution could be found satisfying the given constraints• SimValueError – if any number of solutions other than n were found to satisfy the given
constraints
Returns
The solutions for e
min_int(e, extra_constraints=(), exact=None, signed=False)
Return the minimum value of expression e.
:param e : expression (an AST) to evaluate :type extra_constraints: :param extra_constraints: extra constraints (as ASTs) to add to the solver for this solve :param exact : if False, return approximate solutions.
:param signed : Whether the expression should be treated as a signed value. :return: the minimum possible
value of e (backend object)max_int(e, extra_constraints=(), exact=None, signed=False)
Return the maximum value of expression e.
:param e : expression (an AST) to evaluate :type extra_constraints: :param extra_constraints: extra constraints (as ASTs) to add to the solver for this solve :param exact : if False, return approximate solutions.
:param signed : Whether the expression should be treated as a signed value. :return: the maximum possible
value of e (backend object)unique(e, **kwargs)
Returns True if the expression e has only one solution by querying the constraint solver. It does also addthat unique solution to the solver’s constraints.
symbolic(e)Returns True if the expression e is symbolic.
single_valued(e)Returns True whether e is a concrete value or is a value set with only 1 possible value. This differs fromunique in that this does not query the constraint solver.
simplify(e=None)
Simplifies e. If e is None, simplifies the constraints of this state.
variables(e)Returns the symbolic variables present in the AST of e.
class angr.state_plugins.SimLightRegisters(reg_map=None, registers=None)
Bases: SimStatePlugin__init__(reg_map=None, registers=None)

10.3. Program State

249

angr

copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
set_state(state)
Sets a new state (for example, if the state has been branched)
resolve_register(offset, size)load(offset, size=None, **kwargs)
store(offset, value, size=None, endness=None, **kwargs)
class angr.state_plugins.SimStateLog(log=None)
Bases: SimStatePlugin__init__(log=None)
property actions
add_event(event_type, **kwargs)
add_action(action)
extend_actions(new_actions)
events_of_type(event_type)
actions_of_type(action_type)property fresh_constraints
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.

250

Chapter 10. API ReferenceangrNote that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
clear()
class angr.state_plugins.SimStateHistory(parent=None, clone=None)
Bases: SimStatePlugin
This class keeps track of historically-relevant information for paths.
STRONGREF_STATE = True

10.3. Program State

251

angr

__init__(parent=None, clone=None)
init_state()
Use this function to perform any initialization on the state at plugin-add time
set_strongref_state(state)property addr
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin

252

Chapter 10. API ReferenceangrReturns
True if the state plugin is actually widened.
Return typebool
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
trim()
Discard the ancestry of this state.
filter_actions(start_block_addr=None, end_block_addr=None, block_stmt=None, insn_addr=None,
read_from=None, write_to=None)
Filter self.actions based on some common parameters.
[start_block_addr, end_block_addr]
Parameters• start_block_addr – Only return actions generated in blocks starting at this address.
• end_block_addr – Only return actions generated in blocks ending at this address.
• block_stmt – Only return actions generated in the nth statement of each block.
• insn_addr – Only return actions generated in the assembly instruction at this address.
• read_from – Only return actions that perform a read from the specified location.
• write_to – Only return actions that perform a write to the specified location.
Notes: If IR optimization is turned on, reads and writes may not occur in the instruction they originallycame from. Most commonly, If a register is read from twice in the same block, the second read will not
happen, instead reusing the temp the value is already stored in.
Valid values for read_from and write_to are the string literals ‘reg’ or ‘mem’ (matching any read or write
to registers or memory, respectively), any string (representing a read or write to the named register), andany integer (representing a read or write to the memory at this address).
demote()Demotes this history node, causing it to drop the strong state reference.
reachable()
add_event(event_type, **kwargs)
add_action(action)
extend_actions(new_actions)subscribe_actions()

10.3. Program State

253

angr

property recent_constraints
property recent_actions
property block_countproperty lineage
property parents
property events:

Reversible[SimEvent]

property actions:

Reversible[SimAction]

property jumpkinds:

Reversible[str]property jump_guards:

Reversible[Bool]

property jump_targets
property jump_sources
property descriptions:

Reversible[str]property bbl_addrs:

Reversible[int]property ins_addrs:

Reversible[int]property stack_actions
closest_common_ancestor(other)
Find the common ancestor between this history node and ‘other’.
Parameters
other – the PathHistory to find a common ancestor with.
Returns
the common ancestor SimStateHistory, or None if there isn’t one
constraints_since(other)
Returns the constraints that have been accumulated since other.
Parameters
other – a prior PathHistory object
Returns
a list of constraints
make_child()class angr.state_plugins.SimStateScratch(scratch=None)
Bases: SimStatePlugin
Implements the scratch state plugin.
__init__(scratch=None)
property priv
push_priv(priv)

254

Chapter 10. API Referenceangr

pop_priv()
set_tyenv(tyenv)
tmp_expr(tmp)
Returns the Claripy expression of a VEX temp value.
Parameters• tmp – the number of the tmp• simplify – simplify the tmp before returning it
Returnsa Claripy expression of the tmp
store_tmp(tmp, content, reg_deps=frozenset({}), tmp_deps=frozenset({}), deps=None, **kwargs)
Stores a Claripy expression in a VEX temp value. If in symbolic mode, this involves adding a constraint
for the tmp’s symbolic variable.
Parameters• tmp – the number of the tmp• content – a Claripy expression of the content• reg_deps – the register dependencies of the content• tmp_deps – the temporary value dependencies of the content
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.

10.3. Program State

255

angr

self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
clear()
class angr.state_plugins.SimStateCGC
Bases: SimStatePlugin
This state plugin keeps track of CGC state.
EBADF = 1
EFAULT = 2
EINVAL = 3
ENOMEM = 4
ENOSYS = 5
EPIPE = 6
FD_SETSIZE = 1024

256

Chapter 10. API Referenceangrmax_allocation = 268435456__init__()copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
peek_input()
discard_input(num_bytes)
peek_output()
discard_output(num_bytes)
addr_invalid(a)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with

10.3. Program State

257

angr

• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
get_max_sinkhole(length)
Find a sinkhole which is large enough to support length bytes.
This uses first-fit. The first sinkhole (ordered in descending order by their address) which can hold length
bytes is chosen. If there are more than length bytes in the sinkhole, a new sinkhole is created representing
the remaining bytes while the old sinkhole is removed.
add_sinkhole(address, length)
Add a sinkhole.
Allow the possibility for the program to reuse the memory represented by the address length pair.
class angr.state_plugins.GDB(omit_fp=False, adjust_stack=False)
Bases: SimStatePlugin
Initialize or update a state from gdb dumps of the stack, heap, registers and data (or arbitrary) segments.
__init__(omit_fp=False, adjust_stack=False)
Parameters• omit_fp – The frame pointer register is used for something else.
–omit_frame_pointer)(i.e.

• adjust_stack – Use different stack addresses than the gdb session (not recommended).
set_stack(stack_dump, stack_top)
Stack dump is a dump of the stack from gdb, i.e. the result of the following gdb command :dump binary memory [stack_dump] [begin_addr] [end_addr]
We set the stack to the same addresses as the gdb session to avoid pointers corruption.
Parameters• stack_dump – The dump file.
• stack_top – The address of the top of the stack in the gdb session.

258

Chapter 10. API Referenceangr

set_heap(heap_dump, heap_base)
Heap dump is a dump of the heap from gdb, i.e. the result of the following gdb command:
dump binary memory [stack_dump] [begin] [end]Parameters• heap_dump – The dump file.
• heap_base – The start address of the heap in the gdb session.
set_data(addr, data_dump)
Update any data range (most likely use is the data segments of loaded objects)
set_regs(regs_dump)
Initialize register values within the stateParameters
regs_dump – The output of info registers in gdb.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.SimUCManager(man=None)
Bases: SimStatePlugin__init__(man=None)assign(dst_addr_ast)
Assign a new region for under-constrained symbolic execution.
Parameters
dst_addr_ast – the symbolic AST which address of the new allocated region will be assigned to.
Returns
as ast of memory address that points to a new region
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

10.3. Program State

259

angr

get_alloc_depth(addr)
Return type
int | None
Parametersaddr (int | Base)
set_alloc_depth(addr, depth)
Parameters• addr (Base)• depth (int)
is_bounded(ast)Test whether an AST is bounded by any existing constraint in the related solver.
Parametersast – an claripy.AST object
Returns
True if there is at least one related constraint, False otherwise
set_state(state)
Sets a new state (for example, if the state has been branched)class angr.state_plugins.Unicorn(syscall_hooks=None, cache_key=None, unicount=None,symbolic_var_counts=None, symbolic_inst_counts=None,
concretized_asts=None, always_concretize=None,never_concretize=None, concretize_at=None,
concretization_threshold_memory=None,
concretization_threshold_registers=None,
concretization_threshold_instruction=None, cooldown_symbolic_stop=2,
cooldown_unsupported_stop=2, cooldown_nonunicorn_blocks=100,
cooldown_stop_point=1, max_steps=1000000)
Bases: SimStatePlugin
setup the unicorn engine for a state
UC_CONFIG = {}__init__(syscall_hooks=None, cache_key=None, unicount=None, symbolic_var_counts=None,symbolic_inst_counts=None, concretized_asts=None, always_concretize=None,never_concretize=None, concretize_at=None, concretization_threshold_memory=None,
concretization_threshold_registers=None, concretization_threshold_instruction=None,cooldown_symbolic_stop=2, cooldown_unsupported_stop=2, cooldown_nonunicorn_blocks=100,
cooldown_stop_point=1, max_steps=1000000)
Initializes the Unicorn plugin for angr. This plugin handles communication with UnicornEngine.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!

260

Chapter 10. API ReferenceangrParameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool

10.3. Program State

261

angr

set_state(state)
Sets a new state (for example, if the state has been branched)property uc
static delete_uc()
set_last_block_details(details)
set_stops(stop_points)
set_tracking(track_bbls, track_stack)hook()
uncache_region(addr, length)
clear_page_cache()setup(syscall_data=None, fd_bytes=None)start(step=None)
get_recent_bbl_addrs()
get_stop_details()
finish(succ_state)
destroy(succ_state)
set_regs()
setting unicorn registers
setup_flags()
setup_gdt(fs, gs)
read_msr(msr=3221225728)
write_msr(val, msr=3221225728)
get_regs(succ_state)loading registers from unicorn. If succ_state is not None, update it instead of self.state. Needed whenhandling symbolic exits in native interface
class angr.state_plugins.SimAction(state, region_type)
Bases: SimEvent
A SimAction represents a semantic action that an analyzed program performs.
TMP = 'tmp'
REG = 'reg'
MEM = 'mem'

262

Chapter 10. API Referenceangr__init__(state, region_type)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
property all_objects
property is_symbolic
property tmp_deps
property reg_deps
copy()
downsize()
Clears some low-level details (that take up memory) out of the SimAction.
class angr.state_plugins.SimActionExit(state, target, condition=None, exit_type=None)
Bases: SimAction
An Exit action represents a (possibly conditional) jump.
CONDITIONAL = 'conditional'
DEFAULT = 'default'__init__(state, target, condition=None, exit_type=None)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
property all_objects
property is_symbolicclass angr.state_plugins.SimActionConstraint(state, constraint, condition=None)
Bases: SimAction
A constraint action represents an extra constraint added during execution of a path.
__init__(state, constraint, condition=None)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
property all_objects
property is_symbolicclass angr.state_plugins.SimActionOperation(state, op, exprs, result)
Bases: SimAction
An action representing an operation between variables and/or constants.

10.3. Program State

263

angr

__init__(state, op, exprs, result)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
property all_objects
property is_symbolicclass angr.state_plugins.SimActionData(state, region_type, action, tmp=None, addr=None, size=None,
data=None, condition=None, fallback=None, fd=None)
Bases: SimAction
A Data action represents a read or a write from memory, registers or a file.
READ = 'read'
WRITE = 'write'
OPERATE = 'operate'__init__(state, region_type, action, tmp=None, addr=None, size=None, data=None, condition=None,
fallback=None, fd=None)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
downsize()
Clears some low-level details (that take up memory) out of the SimAction.
property all_objects
property is_symbolic
property tmp_deps
property reg_deps
property storage
class angr.state_plugins.SimActionObject(ast, reg_deps=frozenset({}), tmp_deps=frozenset({}),
deps=frozenset({}), state=None)
Bases: object
A SimActionObject tracks an AST and its dependencies.
Parameters• ast (Base)• reg_deps (frozenset[SimActionData | SimActionOperation])• tmp_deps (frozenset[SimActionData | SimActionOperation])• deps (frozenset)• state (SimState | None)

264

Chapter 10. API Referenceangr__init__(ast, reg_deps=frozenset({}), tmp_deps=frozenset({}), deps=frozenset({}), state=None)
Parameters• ast (Base)• reg_deps (frozenset[SimActionData | SimActionOperation])• tmp_deps (frozenset[SimActionData | SimActionOperation])• deps (frozenset)• state (SimState | None)
ast:

Base

reg_deps:

frozenset[SimActionData | SimActionOperation]

tmp_deps:

frozenset[SimActionData | SimActionOperation]

to_claripy()
Return typeBasecopy()
Return type
SimActionObject
is_leaf()
Return typebool
property op:

strproperty args:

tuple[ArgType, ...]

property length:

int | None

property variables:

frozenset[str]property symbolic:boolproperty annotations:
property depth:

tuple[Annotation, ...]

int

SDiv(other)
Return type
SimActionObject
SMod(other)
Return type
SimActionObject
union(other)
Return type
SimActionObject

10.3. Program State

265

angr

intersection(other)
Return type
SimActionObject
widen(other)
Return type
SimActionObject
raw_to_bv()
Return type
SimActionObject
bv_to_fp()
Return type
SimActionObject
class angr.state_plugins.SimEvent(state, event_type, **kwargs)
Bases: object
A SimEvent is a log entry for some notable event during symbolic execution. It logs the location it was generated(ins_addr, bbl_addr, stmt_idx, and sim_procedure) as well as arbitrary tags (objects).
You may also be interested in SimAction, which is a specialization of SimEvent for CPU events.
__init__(state, event_type, **kwargs)
angr.state_plugins.resource_event(state, exception)
class angr.state_plugins.CallStack(call_site_addr=0, func_addr=0, stack_ptr=0, ret_addr=0,
jumpkind='Ijk_Call', next_frame=None,
invoke_return_variable=None)
Bases: SimStatePlugin
Stores the address of the function you’re in and the value of SP at the VERY BOTTOM of the stack, i.e. points
to the return address.
Parameters
next_frame (CallStack | None)__init__(call_site_addr=0, func_addr=0, stack_ptr=0, ret_addr=0, jumpkind='Ijk_Call',next_frame=None, invoke_return_variable=None)
Parameters
next_frame (CallStack | None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

266

Chapter 10. API Referenceangr

set_state(state)
Sets a new state (for example, if the state has been branched)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool

10.3. Program State

267

angr

property current_function_address
Address of the current function.
Returns
the address of the function
Return typeint
property current_stack_pointerGet the value of the stack pointer.
Returns
Value of the stack pointerReturn typeint
property current_return_target
Get the return target.
Returns
The address of return target.
Return type
int
static stack_suffix_to_string(stack_suffix)
Convert a stack suffix to a human-readable string representation. :param tuple stack_suffix: The stack suffix.
:return: A string representation :rtype: str
property top
Returns the element at the top of the callstack without removing it.
Returns
A CallStack.
push(cf )Push the frame cf onto the stack. Return the new stack.
pop()
Pop the top frame from the stack. Return the new stack.
call(callsite_addr, addr, retn_target=None, stack_pointer=None)
Push a stack frame into the call stack. This method is called when calling a function in CFG recovery.
Parameters• callsite_addr (int) – Address of the call site
• addr (int) – Address of the call target• retn_target (int or None) – Address of the return target• stack_pointer (int) – Value of the stack pointerReturnsNoneret(retn_target=None)
Pop one or many call frames from the stack. This method is called when returning from a function in CFG
recovery.

268

Chapter 10. API ReferenceangrParameters
retn_target (int) – The target to return to.
ReturnsNone
dbg_repr()
Debugging representation of this CallStack object.
Returns
Details of this CalLStack
Return typestr
stack_suffix(context_sensitivity_level)
Generate the stack suffix. A stack suffix can be used as the key to a SimRun in CFG recovery.
Parameters
context_sensitivity_level (int) – Level of context sensitivity.
Returns
A tuple of stack suffix.
Return type
tuple
class angr.state_plugins.SimStateGlobals(backer=None)
Bases: SimStatePlugin__init__(backer=None)
set_state(state)
Sets a new state (for example, if the state has been branched)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit

10.3. Program State

269

angr

There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
keys()
values()items()
get(k, alt=None)pop(k, alt=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.SimStatePreconstrainer(constrained_addrs=None)
Bases: SimStatePlugin
This state plugin manages the concept of preconstraining - adding constraints which you would like to remove
later.

270

Chapter 10. API ReferenceangrParametersconstrained_addrs – SimActions for memory operations whose addresses should be constrained during crash analysis__init__(constrained_addrs=None)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
10.3. Program State

271

angr

copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
preconstrain(value, variable)
Add a preconstraint that variable == value to the state.
Parameters• value – The concrete value. Can be a bitvector or a bytestring or an integer.
• variable – The BVS to preconstrain.
preconstrain_file(content, simfile, set_length=False)
Preconstrain the contents of a file.
Parameters• content – The content to preconstrain the file to. Can be a bytestring or a list thereof.
• simfile – The actual simfile to preconstrain
preconstrain_flag_page(magic_content)
Preconstrain the data in the flag page.
Parameters
magic_content – The content of the magic page as a bytestring.
remove_preconstraints(to_composite_solver=True, simplify=True)
Remove the preconstraints from the state.
If you are using the zen plugin, this will also use that to filter the constraints.
Parameters• to_composite_solver – Whether to convert the replacement solver to a composite
solver. You probably want this if you’re switching from tracing to symbolic analysis.
• simplify – Whether to simplify the resulting set of constraints.
reconstrain()
Split the solver. If any of the subsolvers time out after a short timeout (10 seconds), re-add the preconstraints
associated with each of its variables. Hopefully these constraints still allow us to do meaningful things to
the state.
class angr.state_plugins.SimStateLoopData(back_edge_trip_counts=None, header_trip_counts=None,current_loop=None)
Bases: SimStatePlugin
This class keeps track of loop-related information for states. Note that we have 2 counters for loop iterations(trip counts): the first recording the number of times one of the back edges (or continue edges) of a loop is
taken, whereas the second recording the number of times the loop header (or loop entry) is executed. These 2
counters may differ since compilers usually optimize loops hence completely change the loop structure at the
272

Chapter 10. API Referenceangrbinary level. This is supposed to be used with LoopSeer exploration technique, which monitors loop execution.
For the moment, the only thing we want to analyze is loop trip counts, but nothing prevents us from extending
this plugin for other loop analyses.
__init__(back_edge_trip_counts=None, header_trip_counts=None, current_loop=None)
Parameters• back_edge_trip_counts – Dictionary that stores back edge based trip counts for eachloop. Keys are address of loop headers.
• header_trip_counts – Dictionary that stores header based trip counts for each loop.
Keys are address of loop headers.
• current_loop – List of currently running loops. Each element is a tuple (loop object, listof loop exits).
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool

10.3. Program State

273

angr

widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.SimRegNameView
Bases: SimStatePlugincopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.

274

Chapter 10. API Referenceangrself.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
get(reg_name)class angr.state_plugins.SimMemView(ty=None, addr=None, state=None)
Bases: SimStatePlugin
This is a convenient interface with which you can access a program’s memory.
The interface works like this:• You first use [array index notation] to specify the address you’d like to load from• If at that address is a pointer, you may access the deref property to return a SimMemView at the address
present in memory.
• You then specify a type for the data by simply accessing a property of that name. For a list of supported
types, look at state.mem.types.
• You can then refine the type. Any type may support any refinement it likes. Right now the only refinements
supported are that you may access any member of a struct by its member name, and you may index into astring or array to access that element.

10.3. Program State

275

angr

• If the address you specified initially points to an array of that type, you can say .array(n) to view the dataas an array of n elements.
• Finally, extract the structured data with .resolved or .concrete. .resolved will return bitvector values,
while .concrete will return integer, string, array, etc values, whatever best represents the data.
• Alternately, you may store a value to memory, by assigning to the chain of properties that you’ve constructed. Note that because of the way python works, x = s.mem[...].prop; x = val will NOT work,
you must say s.mem[...].prop = val.
For example:>>> s.mem[0x601048].long<long (64 bits) <BV64 0x4008d0> at 0x601048>>>> s.mem[0x601048].long.resolved<BV64 0x4008d0>>>> s.mem[0x601048].deref<<untyped> <unresolvable> at 0x4008d0>>>> s.mem[0x601048].deref.string.concrete'SOSNEAKY'
Parametersstate (SimState)__init__(ty=None, addr=None, state=None)
set_state(state)
Sets a new state (for example, if the state has been branched)

276

Chapter 10. API Referenceangrtypes: ClassVar[dict] = {'CharT': char, 'FILE_t': struct FILE_t, '_Bool': bool,'_ENTRY': struct _ENTRY, '_IO_codecvt': struct _IO_codecvt, '_IO_iconv_t': struct_IO_iconv_t, '_IO_lock_t': struct pthread_mutex_t, '_IO_marker': struct_IO_marker, '_IO_wide_data': struct _IO_wide_data, '__clock_t': uint32_t,'__dev_t': uint64_t, '__gid_t': unsigned int, '__ino64_t': unsigned long long,'__ino_t': unsigned long, '__int128': int128_t, '__int256': int256_t,'__mbstate_t': struct __mbstate_t, '__mode_t': unsigned int, '__nlink_t':
unsigned int, '__off64_t': long long, '__off_t': long, '__pid_t': int,'__suseconds_t': int64_t, '__time_t': long, '__uid_t': unsigned int,'_obstack_chunk': struct _obstack_chunk, 'aiocb': struct aiocb, 'aiocb64': structaiocb64, 'aioinit': struct aioinit, 'argp': struct argp, 'argp_child': structargp_child, 'argp_option': struct argp_option, 'argp_parser_t': (int, char*,struct argp_state*) -> int, 'argp_state': struct argp_state, 'basic_string':
string_t, 'bool': bool, 'byte': uint8_t, 'cc_t': char, 'char': char, 'clock_t':
uint32_t, 'crypt_data': struct crypt_data, 'dirent': struct dirent, 'dirent64':
struct dirent64, 'double': double, 'drand48_data': struct <anon>, 'dword':
uint32_t, 'error_t': int, 'exit_status': struct exit_status, 'float': float,'fstab': struct fstab, 'group': struct group, 'hostent': struct hostent,'hsearch_data': struct hsearch_data, 'if_nameindex': struct if_nameindex,'in_addr': struct in_addr, 'in_port_t': uint16_t, 'ino64_t': unsigned long long,'ino_t': unsigned long, 'int': int, 'int16_t': int16_t, 'int32_t': int32_t,'int64_t': int64_t, 'int8_t': int8_t, 'iovec': struct <anon>, 'itimerval':
struct itimerval, 'lconv': struct lconv, 'long': long, 'long double': double,'long int': long, 'long long': long long, 'long long int': long long, 'long
signed': long, 'long unsigned int': unsigned long, 'mallinfo': struct mallinfo,'mallinfo2': struct mallinfo2, 'mntent': struct mntent, 'netent': struct netent,'ntptimeval': struct ntptimeval, 'obstack': struct obstack, 'off64_t': long long,'off_t': long, 'option': struct option, 'passwd': struct passwd, 'pid_t': int,
'printf_info': struct printf_info, 'protoent': struct protoent, 'ptrdiff_t':long, 'qword': uint64_t, 'random_data': struct <anon>, 'rlim64_t': uint64_t,'rlim_t': unsigned long, 'rlimit': struct rlimit, 'rlimit64': struct rlimit64,'rusage': struct rusage, 'sa_family_t': unsigned short, 'sched_param': structsched_param, 'sembuf': struct sembuf, 'servent': struct servent, 'sgttyb': structsgttyb, 'short': short, 'short int': short, 'sigevent': struct sigevent,'signed': int, 'signed char': char, 'signed int': int, 'signed long': long,'signed long int': long, 'signed long long': long long, 'signed long long int':
long long, 'signed short': short, 'signed short int': short, 'sigstack': struct
sigstack, 'sigval': union sigval { sival_int int; sival_ptr void*; }, 'size_t':
size_t, 'sockaddr': struct sockaddr, 'sockaddr_in': struct sockaddr_in, 'speed_t':long, 'ssize': size_t, 'ssize_t': size_t, 'stat': struct stat, 'stat64': struct
stat64, 'string': string_t, 'struct iovec': struct iovec, 'struct timespec':
struct timespec, 'struct timeval': struct timeval, 'tcflag_t': unsigned long,'termios': struct termios, 'time_t': long, 'timespec': struct timeval, 'timeval':
struct timeval, 'timex': struct timex, 'timezone': struct timezone, 'tm': struct
tm, 'tms': struct tms, 'uint16_t': uint16_t, 'uint32_t': uint32_t, 'uint64_t':
uint64_t, 'uint8_t': uint8_t, 'uintptr_t': unsigned long, 'unsigned': unsigned
int, 'unsigned __int128': uint128_t, 'unsigned __int256': uint256_t, 'unsigned
char': char, 'unsigned int': unsigned int, 'unsigned long': unsigned long,'unsigned long int': unsigned long, 'unsigned long long': unsigned long long,'unsigned long long int': unsigned long long, 'unsigned short': unsigned short,'unsigned short int': unsigned short, 'utimbuf': struct utimbuf, 'utmp': structutmp, 'utmpx': struct utmx, 'utsname': struct utsname, 'va_list': structva_list[1], 'void': void, 'vtimes': struct vtimes, 'wchar_t': short, 'winsize':
struct winsize, 'word': uint16_t, 'wstring': wstring_t}
10.3. Program State

277

angr

state:

angr.SimState = None

struct:StructModewith_type(sim_type)
Returns a copy of the SimMemView with a type.
Parameters
sim_type (SimType) – The new type.
Return type
SimMemView
Returns
The typed SimMemView copy.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters

278

Chapter 10. API Referenceangr• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
property resolvable
property resolved
property concrete
property deref:

SimMemView

array(n)Return type
SimMemView
member(member_name)If self is a struct and member_name is a member of the struct, return that member element. Otherwise raise
an exception.
Return type
SimMemView
Parameters
member_name (str)store(value)class angr.state_plugins.StructMode(view)
Bases: object__init__(view)class angr.state_plugins.Stat(st_dev, st_ino, st_nlink, st_mode, st_uid, st_gid, st_rdev, st_size, st_blksize,st_blocks, st_atime, st_atimensec, st_mtime, st_mtimensec, st_ctime,
st_ctimensec)
Bases: tuple

10.3. Program State

279

angr

st_atime
Alias for field number 10
st_atimensec
Alias for field number 11
st_blksize
Alias for field number 8
st_blocks
Alias for field number 9
st_ctime
Alias for field number 14
st_ctimensec
Alias for field number 15
st_dev
Alias for field number 0
st_gidAlias for field number 5
st_inoAlias for field number 1
st_modeAlias for field number 3
st_mtime
Alias for field number 12
st_mtimensec
Alias for field number 13
st_nlink
Alias for field number 2
st_rdev
Alias for field number 6
st_size
Alias for field number 7
st_uidAlias for field number 4class angr.state_plugins.SimFilesystem(files=None, pathsep=None, cwd=None, mountpoints=None)
Bases: SimStatePlugin
angr’s emulated filesystem. Available as state.fs. When constructing, all parameters are optional.
Parameters• files – A mapping from filepath to SimFile• pathsep – The character used to separate path elements, default forward slash.
• cwd – The path of the current working directory to use

280

Chapter 10. API Referenceangr• mountpoints – A mapping from filepath to SimMountpoint
Variables• pathsep – The current pathsep• cwd – The current working directory• unlinks – A list of unlink operations, tuples of filename and simfile. Be careful, this list isshallow-copied from successor to successor, so don’t mutate anything in it without copying.
__init__(files=None, pathsep=None, cwd=None, mountpoints=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property unlinks
set_state(state)
Sets a new state (for example, if the state has been branched)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters10.3. Program State

281

angr

• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
chdir(path)
Changes the current directory to the given pathget(path)
Get a file from the filesystem. Returns a SimFile or None.
insert(path, simfile)
Insert a file into the filesystem. Returns whether the operation was successful.
delete(path)
Remove a file from the filesystem. Returns whether the operation was successful.
This will add a fs_unlink event with the path of the file and also the index into the unlinks list.
mount(path, mount)
Add a mountpoint to the filesystem.
unmount(path)
Remove a mountpoint from the filesystem.
get_mountpoint(path)
Look up the mountpoint servicing the given path.
Returns
A tuple of the mount and a list of path elements traversing from the mountpoint to the specified
file.
class angr.state_plugins.SimMount
Bases: SimStatePlugin
This is the base class for “mount points” in angr’s simulated filesystem. Subclass this class and give it to thefilesystem to intercept all file creations and opens below the mountpoint. Since this a SimStatePlugin you may
also want to implement set_state, copy, merge, etc.

282

Chapter 10. API Referenceangrget(path_elements)
Implement this function to instrument file lookups.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A SimFile, or Noneinsert(path_elements, simfile)
Implement this function to instrument file creation.
Parameters• path_elements – A list of path elements traversing from the mountpoint to the file• simfile – The file to insert
Returns
A bool indicating whether the insert occurred
delete(path_elements)
Implement this function to instrument file deletion.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A bool indicating whether the delete occurred
lookup(sim_file)
Look up the path of a SimFile in the mountpoint
Parameters
sim_file – A SimFile object needs to be looked up
Returns
A string representing the path of the file in the mountpoint Or None if the SimFile does notexist in the mountpointclass angr.state_plugins.SimHostFilesystem(host_path=None, **kwargs)
Bases: SimConcreteFilesystem
Simulated mount that makes some piece from the host filesystem available to the guest.
Parameters• host_path (str) – The path on the host to mount• pathsep (str) – The host path separator character, default os.path.sep__init__(host_path=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!

10.3. Program State

283

angr

Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.SimHeapBase(heap_base=None, heap_size=None)
Bases: SimStatePlugin
This is the base heap class that all heap implementations should subclass. It defines a few handlers for common
heap functions (the libc memory management functions). Heap implementations are expected to override thesefunctions regardless of whether they implement the SimHeapLibc interface. For an example, see the SimHeapBrk
implementation, which is based on the original libc SimProcedure implementations.
Variables• heap_base – the address of the base of the heap in memory• heap_size – the total size of the main memory region managed by the heap in memory• mmap_base – the address of the region from which large mmap allocations will be made__init__(heap_base=None, heap_size=None)copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.state_plugins.SimHeapBrk(heap_base=None, heap_size=None)
Bases: SimHeapBase
SimHeapBrk represents a trivial heap implementation based on the Unix brk system call. This type of heap storesvirtually no metadata, so it is up to the user to determine when it is safe to release memory. This also means thatit does not properly support standard heap operations like realloc.
This heap implementation is a holdover from before any more proper implementations were modelled. At thetime, various libc (or win32) SimProcedures handled the heap in the same way that this plugin does now. To
make future heap implementations plug-and-playable, they should implement the necessary logic themselves, anddependent SimProcedures should invoke a method by the same name as theirs (prepended with an underscore)
upon the heap plugin. Depending on the heap implementation, if the method is not supported, an error shouldbe raised.
Out of consideration for the original way the heap was handled, this plugin implements functionality for all relevant SimProcedures (even those that would not normally be supported together in a single heap implementation).
Variables
heap_location – the address of the top of the heap, bounding the allocations made startingfrom heap_base__init__(heap_base=None, heap_size=None)

284

Chapter 10. API Referenceangrcopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
allocate(sim_size)
The actual allocation primitive for this heap implementation. Increases the position of the break to allocate
space. Has no guards against the heap growing too large.
Parameters
sim_size – a size specifying how much to increase the break pointer by
Returnsa pointer to the previous break position, above which there is now allocated space
release(sim_size)
The memory release primitive for this heap implementation. Decreases the position of the break to deallocate space. Guards against releasing beyond the initial heap base.
Parameters
sim_size – a size specifying how much to decrease the break pointer by (may be symbolicor not)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
10.3. Program State

285

angr

Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.state_plugins.SimHeapLibc(heap_base=None, heap_size=None)
Bases: SimHeapBase
A class of heap that implements the major libc heap management functions.
malloc(sim_size)
A somewhat faithful implementation of libc malloc.
Parameters
sim_size – the amount of memory (in bytes) to be allocatedReturns
the address of the allocation, or a NULL pointer if the allocation failed
free(ptr)
A somewhat faithful implementation of libc free.
Parameters
ptr – the location in memory to be freed
calloc(sim_nmemb, sim_size)
A somewhat faithful implementation of libc calloc.
Parameters• sim_nmemb – the number of elements to allocated• sim_size – the size of each element (in bytes)
Returns
the address of the allocation, or a NULL pointer if the allocation failed
realloc(ptr, size)
A somewhat faithful implementation of libc realloc.
Parameters
286

Chapter 10. API Referenceangr• ptr – the location in memory to be reallocated• size – the new size desired for the allocation
Returns
the address of the allocation, or a NULL pointer if the allocation was freed or if no new
allocation was madeclass angr.state_plugins.SimHeapPTMalloc(heap_base=None, heap_size=None)
Bases: SimHeapFreelist
A freelist-style heap implementation inspired by ptmalloc. The chunks used by this heap contain heap metadata
in addition to user data. While the real-world ptmalloc is implemented using multiple lists of free chunks (corresponding to their different sizes), this more basic model uses a single list of chunks and searches for free chunks
using a first-fit algorithm.
NOTE: The plugin must be registered using register_plugin with name heap in order to function properly.
Variables• heap_base – the address of the base of the heap in memory• heap_size – the total size of the main memory region managed by the heap in memory• mmap_base – the address of the region from which large mmap allocations will be made• free_head_chunk – the head of the linked list of free chunks in the heap__init__(heap_base=None, heap_size=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
chunks()Returns an iterator over all the chunks in the heap.
allocated_chunks()
Returns an iterator over all the allocated chunks in the heap.
free_chunks()
Returns an iterator over all the free chunks in the heap.
chunk_from_mem(ptr)
Given a pointer to a user payload, return the base of the chunk associated with that payload (i.e. the chunkpointer). Returns None if ptr is null.
Parameters
ptr – a pointer to the base of a user payload in the heap
Returnsa pointer to the base of the associated heap chunk, or None if ptr is null

10.3. Program State

287

angr

malloc(sim_size)
A somewhat faithful implementation of libc malloc.
Parameters
sim_size – the amount of memory (in bytes) to be allocatedReturns
the address of the allocation, or a NULL pointer if the allocation failed
free(ptr)
A somewhat faithful implementation of libc free.
Parameters
ptr – the location in memory to be freed
calloc(sim_nmemb, sim_size)
A somewhat faithful implementation of libc calloc.
Parameters• sim_nmemb – the number of elements to allocated• sim_size – the size of each element (in bytes)
Returns
the address of the allocation, or a NULL pointer if the allocation failed
realloc(ptr, size)
A somewhat faithful implementation of libc realloc.
Parameters• ptr – the location in memory to be reallocated• size – the new size desired for the allocation
Returns
the address of the allocation, or a NULL pointer if the allocation was freed or if no new
allocation was mademerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

288

Chapter 10. API ReferenceangrDuring static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.state_plugins.PTChunk(base, sim_state, heap=None)
Bases: Chunk
A chunk, inspired by the implementation of chunks in ptmalloc. Provides a representation of a chunk
via a view into the memory plugin. For the chunk definitions and docs that this was loosely based
off of, see glibc malloc/malloc.c, line 1033, as of commit 5a580643111ef6081be7b4c7bd1997a5447c903f.
Alternatively, take the following link. https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=67cdfd0ad2f003964cd0f7dfe3bcd85ca98528a7;hb=5a580643111ef6081be7b4c7bd1997a5447c903f#l1033
Variables• base – the location of the base of the chunk in memory• state – the program state that the chunk is resident in• heap – the heap plugin that the chunk is managed by__init__(base, sim_state, heap=None)
get_size()
Returns the actual size of a chunk (as opposed to the entire size field, which may include some flags).
get_data_size()
Returns the size of the data portion of a chunk.

10.3. Program State

289

angr

set_size(size, is_free=None)
Use this to set the size on a chunk. When the chunk is new (such as when a free chunk is shrunk to form anallocated chunk and a remainder free chunk) it is recommended that the is_free hint be used since setting
the size depends on the chunk’s freeness, and vice versa.
Parameters• size – size of the chunk• is_free – boolean indicating the chunk’s freeness
set_prev_freeness(is_free)
Sets (or unsets) the flag controlling whether the previous chunk is free.
Parameters
is_free – if True, sets the previous chunk to be free; if False, sets it to be allocatedis_prev_free()Returns a concrete state of the flag indicating whether the previous chunk is free or not. Issues a warning
if that flag is symbolic and has multiple solutions, and then assumes that the previous chunk is free.
Returns
True if the previous chunk is free; False otherwise
prev_size()
Returns the size of the previous chunk, masking off what would be the flag bits if it were in the actual size
field. Performs NO CHECKING to determine whether the previous chunk size is valid (for example, when
the previous chunk is not free, its size cannot be determined).
is_free()
Returns a concrete determination as to whether the chunk is free.
data_ptr()
Returns the address of the payload of the chunk.
next_chunk()
Returns the chunk immediately following (and adjacent to) this one, if it exists.
Returns
The following chunk, or None if applicable
prev_chunk()
Returns the chunk immediately prior (and adjacent) to this one, if that chunk is free. If the prior chunk is
not free, then its base cannot be located and this method raises an error.
Returns
If possible, the previous chunk; otherwise, raises an error
fwd_chunk()
Returns the chunk following this chunk in the list of free chunks. If this chunk is not free, then it resides inno such list and this method raises an error.
Returns
If possible, the forward chunk; otherwise, raises an error
set_fwd_chunk(fwd)
Sets the chunk following this chunk in the list of free chunks.
Parameters
fwd – the chunk to follow this chunk in the list of free chunks

290

Chapter 10. API Referenceangrbck_chunk()
Returns the chunk backward from this chunk in the list of free chunks. If this chunk is not free, then it
resides in no such list and this method raises an error.
Returns
If possible, the backward chunk; otherwise, raises an error
set_bck_chunk(bck)Sets the chunk backward from this chunk in the list of free chunks.
Parameters
bck – the chunk to precede this chunk in the list of free chunks
class angr.state_plugins.PTChunkIterator(chunk, cond=<function PTChunkIterator.<lambda>>)Bases: object__init__(chunk, cond=<function PTChunkIterator.<lambda>>)class angr.state_plugins.Concrete(segment_registers_initialized=False,
segment_registers_callback_initialized=False, whitelist=None,fs_register_bp=None, already_sync_objects_addresses=None)
Bases: SimStatePlugin__init__(segment_registers_initialized=False, segment_registers_callback_initialized=False,
whitelist=None, fs_register_bp=None, already_sync_objects_addresses=None)copy(_memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(_others, _merge_conditions, _common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,(continues on next page)

10.3. Program State

291

angr

(continued from previous page)

common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
set_state(state)
Sets a new state (for example, if the state has been branched)sync()
Handle the switch between the concrete execution and angr. This method takes care of: 1- Synchronize
registers. 2- Set a concrete target to the memory backer so the memory reads are redirected in the concrete
process memory. 3- If possible restore the SimProcedures with the real addresses inside the concrete process. 4- Set an inspect point to sync the segments register as soon as they are read during the symbolic
execution. 5- Flush all the pages loaded until now.
Returnsclass angr.state_plugins.SimStateJNIReferences(local_refs=None, global_refs=None)
Bases: SimStatePlugin
Management of the mapping between opaque JNI references and the corresponding Java objects.
__init__(local_refs=None, global_refs=None)
lookup(opaque_ref )Lookups the object that was used for creating the reference.

292

Chapter 10. API Referenceangrcreate_new_reference(obj, global_ref=False)
Create a new reference thats maps to the given object.
Parameters• obj – Object which gets referenced.
• global_ref (bool) – Whether a local or global reference is created.
clear_local_references()
Clear all local references.
delete_reference(opaque_ref , global_ref=False)
Delete the stored mapping of a reference.
Parameters• opaque_ref – Reference which should be removed.
• global_ref (bool) – Whether opaque_ref is a local or global reference.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit

10.3. Program State

293

angr

There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.state_plugins.SimJavaVmClassloader(initialized_classes=None)
Bases: SimStatePlugin
JavaVM Classloader is used as an interface for resolving and initializing Java classes.
__init__(initialized_classes=None)
get_class(class_name, init_class=False, step_func=None)
Get a class descriptor for the class.
Parameters• class_name (str) – Name of class.
• init_class (bool) – Whether the class initializer <clinit> should be executed.
• step_func (func) – Callback function executed at every step of the simulation manager
during the execution of the main <clinit> method
get_superclass(class_)
Get the superclass of the class.
get_class_hierarchy(base_class)Walks up the class hierarchy and returns a list of all classes between base class (inclusive) andjava.lang.Object (exclusive).
is_class_initialized(class_)
Indicates whether the classes initializing method <clinit> was already executed on the state.

294

Chapter 10. API Referenceangrinit_class(class_, step_func=None)
This method simulates the loading of a class by the JVM, during which parts of the class (e.g. static fields)
are initialized. For this, we run the class initializer method <clinit> (if available) and update the stateaccordingly.
Note: Initialization is skipped, if the class has already been
initialized (or if it’s not loaded in CLE).
property initialized_classes
List of all initialized classes.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
10.3. Program State

295

angr

Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.state_plugins.SimSymbolizer
Bases: SimStatePlugin
The symbolizer state plugin ensures that pointers that are stored in memory are symbolic. This allows for the
tracking of and reasoning over these pointers (for example, to reason about memory disclosure).
__init__()init_state()
Use this function to perform any initialization on the state at plugin-add time
set_symbolization_for_all_pages()
Sets the symbolizer to symbolize pointers to all pages as they are written to memory..
set_symbolized_target_range(base, length)
All pointers to the target range will be symbolized as they are written to memory.
Due to optimizations, the _pages_ containing this range will be set as symbolization targets, not just therange itself.
resymbolize()Re-symbolizes all pointers in memory. This can be called to symbolize any pointers to target regions thatwere written (and not mangled beyond recognition) before symbolization was set.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

296

Chapter 10. API Referenceangrclass angr.state_plugins.SimDebugVariable(state, addr, var_type)
Bases: object
A SimDebugVariable will get dynamically created when queriyng for variable in a state with the SimDebugVariablePlugin. It features a link to the state, an address and a type.
Parameters• state (SimState)• var_type (VariableType)__init__(state, addr, var_type)
Parameters• state (SimState)• var_type (VariableType)static from_cle_variable(state, cle_variable, dwarf_cfa)
Return type
SimDebugVariable
Parameters• state (SimState)• cle_variable (Variable)
property mem_untyped:
property mem:

SimMemView

SimMemView

property string:

SimMemView

with_type(sim_type)
Return type
SimMemView
Parameters
sim_type (SimType)property resolvable
property resolved
property concrete
store(value)
property deref:

SimDebugVariable

array(i)Return type
SimDebugVariable
member(member_name)Return type
SimDebugVariable

10.3. Program State

297

angr

Parameters
member_name (str)class angr.state_plugins.SimDebugVariablePlugin
Bases: SimStatePlugin
This is the plugin you’ll use to interact with (global/local) program variables. These variables have a name and avisibility scope which depends on the pc address of the state. With this plugin, you can access/modify the valueof such variable or find its memory address. For creating program variables, or for importing them from cle, see
the knowledge plugin debug_variables. Run p.kb.dvars.load_from_dwarf() before using this plugin.
Example>>> p = angr.Project("various_variables", load_debug_info=True)>>> p.kb.dvars.load_from_dwarf()>>> state = # navigate to the state you want>>> state.dvars.get_variable("pointer2").deref.mem<int (32 bits) <BV32 0x1> at 0x404020>
get_variable(var_name)Returns the visible variable (if any) with name var_name based on the current state.ip.
Return type
SimDebugVariable
Parameters
var_name (str)property dwarf_cfa
Returns the current cfa computation. Set this property to the correct value if needed.
property dwarf_cfa_approx
class angr.state_plugins.plugin.SimStatePlugin
Bases: object
This is a base class for SimState plugins. A SimState plugin will be copied along with the state when the state isbranched. They are intended to be used for things such as tracking open files, tracking heap details, and providing
storage and persistence for SimProcedures.
STRONGREF_STATE = False__init__()state:

SimState

set_state(state)
Sets a new state (for example, if the state has been branched)
set_strongref_state(state)copy(_memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
298

Chapter 10. API ReferenceangrParameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
static memo(f )A decorator function you should apply to copy
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.

10.3. Program State

299

angr

Return typeboolclassmethod register_default(name, xtr=None)
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.state_plugins.inspect.BP(when='before', enabled=None, condition=None, action=None,**kwargs)
Bases: object
A breakpoint.
__init__(when='before', enabled=None, condition=None, action=None, **kwargs)
check(state, when)
Checks state state to see if the breakpoint should fire.
Parameters• state – The state.
• when – Whether the check is happening before or after the event.
Returns
A boolean representing whether the checkpoint should fire.
fire(state)
Trigger the breakpoint.
Parametersstate – The state.
class angr.state_plugins.inspect.SimInspector
Bases: SimStatePlugin
The breakpoint interface, used to instrument execution. For usage information, look here: https://docs.angr.io/
core-concepts/simulation#breakpoints
BP_AFTER = 'after'
BP_BEFORE = 'before'
BP_BOTH = 'both'__init__()action(event_type, when, **kwargs)
Called from within the engine when events happens. This function checks all breakpoints registered forthat event and fires the ones whose conditions match.
make_breakpoint(event_type, *args, **kwargs)
Creates and adds a breakpoint which would trigger on event_type. Additional arguments are passed to the
BP constructor.
Returns
The created breakpoint, so that it can be removed later.

300

Chapter 10. API Referenceangrb(event_type, *args, **kwargs)
Creates and adds a breakpoint which would trigger on event_type. Additional arguments are passed to the
BP constructor.
Returns
The created breakpoint, so that it can be removed later.
add_breakpoint(event_type, bp)
Adds a breakpoint which would trigger on event_type.
Parameters• event_type – The event type to trigger on• bp – The breakpoint
Returns
The created breakpoint.
remove_breakpoint(event_type, bp=None, filter_func=None)
Removes a breakpoint.
Parameters• bp – The breakpoint to remove.
• filter_func – A filter function to specify whether each breakpoint should be removed
or not.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
downsize()
Remove previously stored attributes from this plugin instance to save memory. This method is supposed tobe called by breakpoint implementors. A typical workflow looks like the following :>>> # Add `attr0` and `attr1` to `self.state.inspect`>>> self.state.inspect(xxxxxx, attr0=yyyy, attr1=zzzz)>>> # Get new attributes out of SimInspect in case they are modified by the user>>> new_attr0 = self.state._inspect.attr0>>> new_attr1 = self.state._inspect.attr1>>> # Remove them from SimInspect>>> self.state._inspect.downsize()merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’s
10.3. Program State

301

angr

referees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
set_state(state)
Sets a new state (for example, if the state has been branched)state:

angr.SimState

class angr.state_plugins.libc.SimStateLibc
Bases: SimStatePlugin
This state plugin keeps track of various libc stuff:

302

Chapter 10. API Referenceangr

LOCALE_ARRAY = [b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00',
b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x03', b'\x02 ', b'\x02 ', b'\x02 ', b'\x02 ', b'\x02\x00', b'\x02\x00', b'\x02\x00',
b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00',
b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x02\x00',
b'\x02\x00', b'\x02\x00', b'\x02\x00', b'\x01`', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8',
b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x08\xd8', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0',
b'\x08\xd5', b'\x08\xd5', b'\x08\xd5', b'\x08\xd5', b'\x08\xd5', b'\x08\xd5',
b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5',
b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5',
b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5', b'\x08\xc5',
b'\x08\xc5', b'\x08\xc5', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x08\xd6', b'\x08\xd6', b'\x08\xd6', b'\x08\xd6',
b'\x08\xd6', b'\x08\xd6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6',
b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6',
b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6',
b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x08\xc6', b'\x04\xc0', b'\x04\xc0',
b'\x04\xc0', b'\x04\xc0', b'\x02\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
10.3. b'\x00\x00',
Program Stateb'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
303
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',
b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00', b'\x00\x00',

angr

TOLOWER_LOC_ARRAY = [128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139,
140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156,
157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,
174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190,
191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207,
208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241,
242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 4294967295, 0, 1,
2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45,
46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 97, 98,
99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115,
116, 117, 118, 119, 120, 121, 122, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101,
102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118,
119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135,
136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152,
153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169,
170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186,
187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203,
204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220,
221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237,
238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
255]
TOUPPER_LOC_ARRAY = [128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139,
140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156,
157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,
174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190,
191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207,
208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241,
242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 4294967295, 0, 1,
2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45,
46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66,
67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87,
88, 89, 90, 91, 92, 93, 94, 95, 96, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76,
77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 123, 124, 125, 126, 127,
128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144,
145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161,
162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178,
179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195,
196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212,
213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229,
230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246,
247, 248, 249, 250, 251, 252, 253, 254, 255]__init__()copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.

304

Chapter 10. API Referenceangr

In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin

10.3. Program State

305

angr

Returns
True if the state plugin is actually widened.
Return typebool
property errno
ret_errno(val)state:

angr.SimState

class angr.state_plugins.posix.PosixDevFS
Bases: SimMountget(path)
Implement this function to instrument file lookups.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A SimFile, or Noneinsert(path, simfile)
Implement this function to instrument file creation.
Parameters• path_elements – A list of path elements traversing from the mountpoint to the file• simfile – The file to insert
Returns
A bool indicating whether the insert occurred
delete(path)
Implement this function to instrument file deletion.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A bool indicating whether the delete occurred
lookup(_)
Look up the path of a SimFile in the mountpoint
Parameters
sim_file – A SimFile object needs to be looked up
Returns
A string representing the path of the file in the mountpoint Or None if the SimFile does notexist in the mountpoint
merge(others, conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to

306

Chapter 10. API Referenceangrresolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
copy(_)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!

10.3. Program State

307

angr

Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.posix.PosixProcFS
Bases: SimMount
The virtual file system mounted at /proc (as of now, on Linux).
get(path)
Implement this function to instrument file lookups.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A SimFile, or Noneinsert(path, simfile)
Implement this function to instrument file creation.
Parameters• path_elements – A list of path elements traversing from the mountpoint to the file• simfile – The file to insert
Returns
A bool indicating whether the insert occurred
delete(path)
Implement this function to instrument file deletion.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A bool indicating whether the delete occurred
lookup(_)
Look up the path of a SimFile in the mountpoint
Parameters
sim_file – A SimFile object needs to be looked up
Returns
A string representing the path of the file in the mountpoint Or None if the SimFile does notexist in the mountpoint
merge(others, conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)308

Chapter 10. API ReferenceangrWhen implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
copy(_)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.posix.SimSystemPosix(stdin=None, stdout=None, stderr=None, fd=None,
sockets=None, socket_queue=None, argv=None,
argc=None, environ=None, auxv=None,tls_modules=None, sigmask=None, pid=None,
ppid=None, uid=None, gid=None, brk=None)
10.3. Program State

309

angr

Bases: SimStatePlugin
Data storage and interaction mechanisms for states with an environment conforming to posix. Available asstate.posix.
SIG_BLOCK = 0
SIG_UNBLOCK = 1
SIG_SETMASK = 2
EPERM = 1
ENOENT = 2
ESRCH = 3
EINTR = 4
EIO = 5ENXIO = 6
E2BIG = 7
ENOEXEC = 8
EBADF = 9
ECHILD = 10
EAGAIN = 11
ENOMEM = 12
EACCES = 13
EFAULT = 14
ENOTBLK = 15
EBUSY = 16
EEXIST = 17
EXDEV = 18
ENODEV = 19
ENOTDIR = 20
EISDIR = 21
EINVAL = 22
ENFILE = 23
EMFILE = 24
ENOTTY = 25

310

Chapter 10. API Referenceangr

ETXTBSY = 26
EFBIG = 27
ENOSPC = 28
ESPIPE = 29
EROFS = 30
EMLINK = 31
EPIPE = 32
EDOM = 33
ERANGE = 34__init__(stdin=None, stdout=None, stderr=None, fd=None, sockets=None, socket_queue=None,
argv=None, argc=None, environ=None, auxv=None, tls_modules=None, sigmask=None,
pid=None, ppid=None, uid=None, gid=None, brk=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property closed_fds
init_state()
Use this function to perform any initialization on the state at plugin-add time
set_brk(new_brk)
set_state(state)
Sets a new state (for example, if the state has been branched)open(name, flags, preferred_fd=None)
Open a symbolic file. Basically open(2).
Parameters• name (string or bytes) – Path of the symbolic file, as a string or bytes.
• flags – File operation flags, a bitfield of constants from open(2), as an AST• preferred_fd – Assign this fd if it’s not already claimed.
Returns
The file descriptor number allocated (maps through posix.get_fd to a SimFileDescriptor) or-1 if the open fails.
mode from open(2) is unsupported at present.

10.3. Program State

311

angr

open_socket(ident)
get_fd(fd, create_file=True)
Looks up the SimFileDescriptor associated with the given number (an AST). If the number is concrete anddoes not map to anything, return None. If the number is symbolic, constrain it to an open fd and create a
new file for it. Set create_file to False if no write-access is planned (i.e. fd is read-only).
get_concrete_fd(fd, create_file=True)
Same behavior as get_fd(fd), only the result is a concrete integer fd (or -1) instead of a SimFileDescriptor.
close(fd)Closes the given file descriptor (an AST). Returns whether the operation succeeded (a concrete boolean)fstat(fd)fstat_with_result(sim_fd)
sigmask(sigsetsize=None)
Gets the current sigmask. If it’s blank, a new one is created (of sigsetsize).
Parameterssigsetsize – the size (in bytes of the sigmask set)
Returns
the sigmask
sigprocmask(how, new_mask, sigsetsize, valid_ptr=True)
Updates the signal mask.
Parameters• how – the “how” argument of sigprocmask (see manpage)• new_mask – the mask modification to apply• sigsetsize – the size (in bytes of the sigmask set)
• valid_ptr – is set if the new_mask was not NULL
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

312

Chapter 10. API ReferenceangrDuring static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
dump_file_by_path(path, **kwargs)
Returns the concrete content for a file by path.
Parameters• path – file path as string• kwargs – passed to state.solver.eval
Returns
file contents as string
dumps(fd, **kwargs)
Returns the concrete content for a file descriptor.
BACKWARD COMPATIBILITY: if you ask for file descriptors 0 1 or 2, it will return the data from stdin,
stdout, or stderr as a flat string.
Parameters
fd – A file descriptor.
Returns
The concrete content.
Return typestr
state:

angr.SimState

10.3. Program State

313

angr

class angr.state_plugins.filesystem.Stat(st_dev, st_ino, st_nlink, st_mode, st_uid, st_gid, st_rdev,
st_size, st_blksize, st_blocks, st_atime, st_atimensec, st_mtime,
st_mtimensec, st_ctime, st_ctimensec)
Bases: tuple
st_atime
Alias for field number 10
st_atimensec
Alias for field number 11
st_blksize
Alias for field number 8
st_blocks
Alias for field number 9
st_ctime
Alias for field number 14
st_ctimensec
Alias for field number 15
st_dev
Alias for field number 0
st_gidAlias for field number 5
st_inoAlias for field number 1
st_modeAlias for field number 3
st_mtime
Alias for field number 12
st_mtimensec
Alias for field number 13
st_nlink
Alias for field number 2
st_rdev
Alias for field number 6
st_size
Alias for field number 7
st_uidAlias for field number 4class angr.state_plugins.filesystem.SimFilesystem(files=None, pathsep=None, cwd=None,
mountpoints=None)
Bases: SimStatePlugin
angr’s emulated filesystem. Available as state.fs. When constructing, all parameters are optional.

314

Chapter 10. API ReferenceangrParameters• files – A mapping from filepath to SimFile• pathsep – The character used to separate path elements, default forward slash.
• cwd – The path of the current working directory to use• mountpoints – A mapping from filepath to SimMountpoint
Variables• pathsep – The current pathsep• cwd – The current working directory• unlinks – A list of unlink operations, tuples of filename and simfile. Be careful, this list isshallow-copied from successor to successor, so don’t mutate anything in it without copying.
__init__(files=None, pathsep=None, cwd=None, mountpoints=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property unlinks
set_state(state)
Sets a new state (for example, if the state has been branched)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

10.3. Program State

315

angr

During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
chdir(path)
Changes the current directory to the given pathget(path)
Get a file from the filesystem. Returns a SimFile or None.
insert(path, simfile)
Insert a file into the filesystem. Returns whether the operation was successful.
delete(path)
Remove a file from the filesystem. Returns whether the operation was successful.
This will add a fs_unlink event with the path of the file and also the index into the unlinks list.
mount(path, mount)
Add a mountpoint to the filesystem.
unmount(path)
Remove a mountpoint from the filesystem.
get_mountpoint(path)
Look up the mountpoint servicing the given path.
Returns
A tuple of the mount and a list of path elements traversing from the mountpoint to the specified
file.

316

Chapter 10. API Referenceangrclass angr.state_plugins.filesystem.SimMount
Bases: SimStatePlugin
This is the base class for “mount points” in angr’s simulated filesystem. Subclass this class and give it to thefilesystem to intercept all file creations and opens below the mountpoint. Since this a SimStatePlugin you may
also want to implement set_state, copy, merge, etc.
get(path_elements)
Implement this function to instrument file lookups.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A SimFile, or Noneinsert(path_elements, simfile)
Implement this function to instrument file creation.
Parameters• path_elements – A list of path elements traversing from the mountpoint to the file• simfile – The file to insert
Returns
A bool indicating whether the insert occurred
delete(path_elements)
Implement this function to instrument file deletion.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A bool indicating whether the delete occurred
lookup(sim_file)
Look up the path of a SimFile in the mountpoint
Parameters
sim_file – A SimFile object needs to be looked up
Returns
A string representing the path of the file in the mountpoint Or None if the SimFile does notexist in the mountpointclass angr.state_plugins.filesystem.SimConcreteFilesystem(pathsep='/')
Bases: SimMount
Abstract SimMount allowing the user to import files from some external source into the guest
Parameters
pathsep (str) – The host path separator character, default os.path.sep__init__(pathsep='/')
get(path_elements)
Implement this function to instrument file lookups.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file

10.3. Program State

317

angr

Returns
A SimFile, or Noneinsert(path_elements, simfile)
Implement this function to instrument file creation.
Parameters• path_elements – A list of path elements traversing from the mountpoint to the file• simfile – The file to insert
Returns
A bool indicating whether the insert occurred
delete(path_elements)
Implement this function to instrument file deletion.
Parameters
path_elements – A list of path elements traversing from the mountpoint to the file
Returns
A bool indicating whether the delete occurred
lookup(sim_file)
Look up the path of a SimFile in the mountpoint
Parameters
sim_file – A SimFile object needs to be looked up
Returns
A string representing the path of the file in the mountpoint Or None if the SimFile does notexist in the mountpoint
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
set_state(state)
Sets a new state (for example, if the state has been branched)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.

318

Chapter 10. API ReferenceangrThere will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.state_plugins.filesystem.SimHostFilesystem(host_path=None, **kwargs)
Bases: SimConcreteFilesystem
Simulated mount that makes some piece from the host filesystem available to the guest.
Parameters• host_path (str) – The path on the host to mount• pathsep (str) – The host path separator character, default os.path.sep__init__(host_path=None, **kwargs)

10.3. Program State

319

angr

copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
angr.state_plugins.solver.timed_function(f )angr.state_plugins.solver.enable_timing()
angr.state_plugins.solver.disable_timing()
angr.state_plugins.solver.error_converter(f )angr.state_plugins.solver.concrete_path_bool(f )
angr.state_plugins.solver.concrete_path_not_bool(f )
angr.state_plugins.solver.concrete_path_scalar(f )angr.state_plugins.solver.concrete_path_tuple(f )
angr.state_plugins.solver.concrete_path_list(f )class angr.state_plugins.solver.SimSolver(solver=None, all_variables=None,
temporal_tracked_variables=None,
eternal_tracked_variables=None)
Bases: SimStatePlugin
This is the plugin you’ll use to interact with symbolic variables, creating them and evaluating them. It should beavailable on a state as state.solver.
Any top-level variable of the claripy module can be accessed as a property of this object.
__init__(solver=None, all_variables=None, temporal_tracked_variables=None,
eternal_tracked_variables=None)reload_solver(constraints=None)
Reloads the solver. Useful when changing solver options.
Parametersconstraints (list) – A new list of constraints to use in the reloaded solver instead of thecurrent one
get_variables(*keys)
Iterate over all variables for which their tracking key is a prefix of the values provided.
Elements are a tuple, the first element is the full tracking key, the second is the symbol.
>>> list(s.solver.get_variables('mem'))[(('mem', 0x1000), <BV64 mem_1000_4_64>), (('mem', 0x1008), <BV64 mem_1008_5_64>
˓→)]

320

Chapter 10. API Referenceangr>>> list(s.solver.get_variables('file'))[(('file', 1, 0), <BV8 file_1_0_6_8>), (('file', 1, 1), <BV8 file_1_1_7_8>),(('file', 2, 0), <BV8 file_2_0_8_8>)]>>> list(s.solver.get_variables('file', 2))[(('file', 2, 0), <BV8 file_2_0_8_8>)]>>> list(s.solver.get_variables())[(('mem', 0x1000), <BV64 mem_1000_4_64>), (('mem', 0x1008), <BV64 mem_1008_5_64>
˓→),(('file', 1, 0), <BV8 file_1_0_6_8>), (('file', 1, 1), <BV8 file_1_1_7_8>),(('file', 2, 0), <BV8 file_2_0_8_8>)]
register_variable(v, key, eternal=True)
Register a value with the variable tracking system
Parameters• v – The BVS to register• key – A tuple to register the variable under
Parma eternal
Whether this is an eternal variable, default True. If False, an incrementing counter will beappended to the key.
describe_variables(v)Given an AST, iterate over all the keys of all the BVS leaves in the tree which are registered.
Unconstrained(name, bits, uninitialized=True, inspect=True, events=True, key=None, eternal=False,
uc_alloc_depth=None, **kwargs)
Creates an unconstrained symbol or a default concrete value (0), based on the state options.
Parameters• name – The name of the symbol.
• bits – The size (in bits) of the symbol.
• uninitialized – Whether this value should be counted as an “uninitialized” value in thecourse of an analysis.
• inspect – Set to False to avoid firing SimInspect breakpoints• events – Set to False to avoid generating a SimEvent for the occasion• key – Set this to a tuple of increasingly specific identifiers (for example, ('mem',
0xffbeff00) or ('file', 4, 0x20) to cause it to be tracked, i.e. accessible throughsolver.get_variables.
• eternal – Set to True in conjunction with setting a key to cause all states with the sameancestry to retrieve the same symbol when trying to create the value. If False, a counter
will be appended to the key.
Returns
an unconstrained symbol (or a concrete value of 0).
BVS(name, size, min=None, max=None, stride=None, uninitialized=False, explicit_name=None, key=None,
eternal=False, inspect=True, events=True, **kwargs)

10.3. Program State

321

angr

Creates a bit-vector symbol (i.e., a variable). Other keyword parameters are passed directly on to theconstructor of claripy.ast.BV.
Parameters• name – The name of the symbol.
• size – The size (in bits) of the bit-vector.
• min – The minimum value of the symbol. Note that this only work when using VSA.
• max – The maximum value of the symbol. Note that this only work when using VSA.
• stride – The stride of the symbol. Note that this only work when using VSA.
• uninitialized – Whether this value should be counted as an “uninitialized” value in thecourse of an analysis.
• explicit_name – Set to True to prevent an identifier from appended to the name to ensure
uniqueness.
• key – Set this to a tuple of increasingly specific identifiers (for example, ('mem',
0xffbeff00) or ('file', 4, 0x20) to cause it to be tracked, i.e. accessible throughsolver.get_variables.
• eternal – Set to True in conjunction with setting a key to cause all states with the sameancestry to retrieve the same symbol when trying to create the value. If False, a counter
will be appended to the key.
• inspect – Set to False to avoid firing SimInspect breakpoints• events – Set to False to avoid generating a SimEvent for the occasion
Returns
A BV object representing this symbol.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)322

Chapter 10. API ReferenceangrWhen implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
downsize()
Frees memory associated with the constraint solver by clearing all of its internal caches.
property constraints
Returns the constraints of the state stored by the solver.
eval_to_ast(e, n, extra_constraints=(), exact=None)
Evaluate an expression, using the solver if necessary. Returns AST objects.
Parameters• e – the expression• n – the number of desired solutions• extra_constraints – extra constraints to apply to the solver• exact – if False, returns approximate solutions

10.3. Program State

323

angr

Returns
a tuple of the solutions, in the form of claripy AST nodes
Return type
tuple
max(e, extra_constraints=(), exact=None, signed=False)
Return the maximum value of expression e.
:param e : expression (an AST) to evaluate :type extra_constraints: :param extra_constraints: extra constraints (as ASTs) to add to the solver for this solve :param exact : if False, return approximate solutions.
:param signed : Whether the expression should be treated as a signed value. :return: the maximum possible
value of e (backend object)
min(e, extra_constraints=(), exact=None, signed=False)
Return the minimum value of expression e.
:param e : expression (an AST) to evaluate :type extra_constraints: :param extra_constraints: extra constraints (as ASTs) to add to the solver for this solve :param exact : if False, return approximate solutions.
:param signed : Whether the expression should be treated as a signed value. :return: the minimum possible
value of e (backend object)solution(e, v, extra_constraints=(), exact=None)
Return True if v is a solution of expr with the extra constraints, False otherwise.
Parameters• e – An expression (an AST) to evaluate• v – The proposed solution (an AST)
• extra_constraints – Extra constraints (as ASTs) to add to the solver for this solve.
• exact – If False, return approximate solutions.
Returns
True if v is a solution of expr, False otherwise
is_true(e, extra_constraints=(), exact=None)
If the expression provided is absolutely, definitely a true boolean, return True. Note that returning False
doesn’t necessarily mean that the expression can be false, just that we couldn’t figure that out easily.
Parameters• e – An expression (an AST) to evaluate• extra_constraints – Extra constraints (as ASTs) to add to the solver for this solve.
• exact – If False, return approximate solutions.
Returns
True if v is definitely true, False otherwise
is_false(e, extra_constraints=(), exact=None)
If the expression provided is absolutely, definitely a false boolean, return True. Note that returning False
doesn’t necessarily mean that the expression can be true, just that we couldn’t figure that out easily.
Parameters• e – An expression (an AST) to evaluate• extra_constraints – Extra constraints (as ASTs) to add to the solver for this solve.
• exact – If False, return approximate solutions.

324

Chapter 10. API ReferenceangrReturns
True if v is definitely false, False otherwise
unsat_core(extra_constraints=())
This function returns the unsat core from the backend solver.
Parameters
extra_constraints – Extra constraints (as ASTs) to add to the solver for this solve.
Returns
The unsat core.
satisfiable(extra_constraints=(), exact=None)
This function does a constraint check and checks if the solver is in a sat state.
Parameters• extra_constraints – Extra constraints (as ASTs) to add to s for this solve• exact – If False, return approximate solutions.
Returns
True if sat, otherwise false
add(*constraints)
Add some constraints to the solver.
Parametersconstraints – Pass any constraints that you want to add (ASTs) as varargs.
CastType = ~CastType
eval_upto(e, n, cast_to=None, **kwargs)
Evaluate an expression, using the solver if necessary. Returns primitives as specified by the cast_to parameter. Only certain primitives are supported, check the implementation of _cast_to to see which ones.
Parameters• e – the expression• n – the number of desired solutions• extra_constraints – extra constraints to apply to the solver• exact – if False, returns approximate solutions• cast_to – desired type of resulting values
Returns
a tuple of the solutions, in the form of Python primitives
Return typetupleeval(e, cast_to=None, **kwargs)
Evaluate an expression to get any possible solution. The desired output types can be specified using thecast_to parameter. extra_constraints can be used to specify additional constraints the returned values mustsatisfy.
Parameters• e – the expression to get a solution for• kwargs – Any additional kwargs will be passed down to eval_upto

10.3. Program State

325

angr

• cast_to – desired type of resulting values
Raises
SimUnsatError – if no solution could be found satisfying the given constraints
Returnsstate:

angr.SimState

eval_one(e, cast_to=None, **kwargs)
Evaluate an expression to get the only possible solution. Errors if either no or more than one solution isreturned. A kwarg parameter default can be specified to be returned instead of failure!
Parameters• e – the expression to get a solution for• cast_to – desired type of resulting values• default – A value can be passed as a kwarg here. It will be returned in case of failure.
• kwargs – Any additional kwargs will be passed down to eval_upto
Raises• SimUnsatError – if no solution could be found satisfying the given constraints• SimValueError – if more than one solution was found to satisfy the given constraints
Returns
The value for eeval_atmost(e, n, cast_to=None, **kwargs)
Evaluate an expression to get at most n possible solutions. Errors if either none or more than n solutions
are returned.
Parameters• e – the expression to get a solution for• n – the inclusive upper limit on the number of solutions• cast_to – desired type of resulting values• kwargs – Any additional kwargs will be passed down to eval_upto
Raises• SimUnsatError – if no solution could be found satisfying the given constraints• SimValueError – if more than n solutions were found to satisfy the given constraints
Returns
The solutions for eeval_atleast(e, n, cast_to=None, **kwargs)
Evaluate an expression to get at least n possible solutions. Errors if less than n solutions were found.
Parameters• e – the expression to get a solution for• n – the inclusive lower limit on the number of solutions• cast_to – desired type of resulting values• kwargs – Any additional kwargs will be passed down to eval_upto

326

Chapter 10. API ReferenceangrRaises• SimUnsatError – if no solution could be found satisfying the given constraints• SimValueError – if less than n solutions were found to satisfy the given constraints
Returns
The solutions for eeval_exact(e, n, cast_to=None, **kwargs)
Evaluate an expression to get exactly the n possible solutions. Errors if any number of solutions other thann was found to exist.
Parameters• e – the expression to get a solution for• n – the inclusive lower limit on the number of solutions• cast_to – desired type of resulting values• kwargs – Any additional kwargs will be passed down to eval_upto
Raises• SimUnsatError – if no solution could be found satisfying the given constraints• SimValueError – if any number of solutions other than n were found to satisfy the given
constraints
Returns
The solutions for e
min_int(e, extra_constraints=(), exact=None, signed=False)
Return the minimum value of expression e.
:param e : expression (an AST) to evaluate :type extra_constraints: :param extra_constraints: extra constraints (as ASTs) to add to the solver for this solve :param exact : if False, return approximate solutions.
:param signed : Whether the expression should be treated as a signed value. :return: the minimum possible
value of e (backend object)max_int(e, extra_constraints=(), exact=None, signed=False)
Return the maximum value of expression e.
:param e : expression (an AST) to evaluate :type extra_constraints: :param extra_constraints: extra constraints (as ASTs) to add to the solver for this solve :param exact : if False, return approximate solutions.
:param signed : Whether the expression should be treated as a signed value. :return: the maximum possible
value of e (backend object)unique(e, **kwargs)
Returns True if the expression e has only one solution by querying the constraint solver. It does also addthat unique solution to the solver’s constraints.
symbolic(e)Returns True if the expression e is symbolic.
single_valued(e)Returns True whether e is a concrete value or is a value set with only 1 possible value. This differs fromunique in that this does not query the constraint solver.
simplify(e=None)
Simplifies e. If e is None, simplifies the constraints of this state.

10.3. Program State

327

angr

variables(e)Returns the symbolic variables present in the AST of e.
class angr.state_plugins.log.SimStateLog(log=None)
Bases: SimStatePlugin__init__(log=None)
property actions
add_event(event_type, **kwargs)
add_action(action)
extend_actions(new_actions)
events_of_type(event_type)
actions_of_type(action_type)property fresh_constraints
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

328

Chapter 10. API ReferenceangrDuring static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
clear()
class angr.state_plugins.callstack.CallStack(call_site_addr=0, func_addr=0, stack_ptr=0,
ret_addr=0, jumpkind='Ijk_Call', next_frame=None,
invoke_return_variable=None)
Bases: SimStatePlugin
Stores the address of the function you’re in and the value of SP at the VERY BOTTOM of the stack, i.e. points
to the return address.
Parameters
next_frame (CallStack | None)__init__(call_site_addr=0, func_addr=0, stack_ptr=0, ret_addr=0, jumpkind='Ijk_Call',next_frame=None, invoke_return_variable=None)
Parameters
next_frame (CallStack | None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
10.3. Program State

329

angr

Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
set_state(state)
Sets a new state (for example, if the state has been branched)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.

330

Chapter 10. API ReferenceangrReturn typebool
property current_function_address
Address of the current function.
Returns
the address of the function
Return typeint
property current_stack_pointerGet the value of the stack pointer.
Returns
Value of the stack pointerReturn typeint
property current_return_target
Get the return target.
Returns
The address of return target.
Return type
int
static stack_suffix_to_string(stack_suffix)
Convert a stack suffix to a human-readable string representation. :param tuple stack_suffix: The stack suffix.
:return: A string representation :rtype: str
property top
Returns the element at the top of the callstack without removing it.
Returns
A CallStack.
push(cf )Push the frame cf onto the stack. Return the new stack.
pop()
Pop the top frame from the stack. Return the new stack.
call(callsite_addr, addr, retn_target=None, stack_pointer=None)
Push a stack frame into the call stack. This method is called when calling a function in CFG recovery.
Parameters• callsite_addr (int) – Address of the call site
• addr (int) – Address of the call target• retn_target (int or None) – Address of the return target• stack_pointer (int) – Value of the stack pointerReturnsNone10.3. Program State

331

angr

ret(retn_target=None)
Pop one or many call frames from the stack. This method is called when returning from a function in CFG
recovery.
Parameters
retn_target (int) – The target to return to.
ReturnsNone
dbg_repr()
Debugging representation of this CallStack object.
Returns
Details of this CalLStack
Return typestr
stack_suffix(context_sensitivity_level)
Generate the stack suffix. A stack suffix can be used as the key to a SimRun in CFG recovery.
Parameters
context_sensitivity_level (int) – Level of context sensitivity.
Returns
A tuple of stack suffix.
Return type
tuple
class angr.state_plugins.callstack.CallStackAction(callstack_hash, callstack_depth, action,
callframe=None, ret_site_addr=None)
Bases: object
Used in callstack backtrace, which is a history of callstacks along a path, to record individual actions occurredeach time the callstack is changed.
__init__(callstack_hash, callstack_depth, action, callframe=None, ret_site_addr=None)class angr.state_plugins.light_registers.SimLightRegisters(reg_map=None, registers=None)
Bases: SimStatePlugin__init__(reg_map=None, registers=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
set_state(state)
Sets a new state (for example, if the state has been branched)

332

Chapter 10. API Referenceangrresolve_register(offset, size)load(offset, size=None, **kwargs)
store(offset, value, size=None, endness=None, **kwargs)
class angr.state_plugins.history.SimStateHistory(parent=None, clone=None)
Bases: SimStatePlugin
This class keeps track of historically-relevant information for paths.
STRONGREF_STATE = True__init__(parent=None, clone=None)
jump_guard:
jumpkind:

BV | Nonestr | None

init_state()
Use this function to perform any initialization on the state at plugin-add time
set_strongref_state(state)property addr
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins

10.3. Program State

333

angr

• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
trim()
Discard the ancestry of this state.
filter_actions(start_block_addr=None, end_block_addr=None, block_stmt=None, insn_addr=None,
read_from=None, write_to=None)
Filter self.actions based on some common parameters.
[start_block_addr, end_block_addr]
Parameters• start_block_addr – Only return actions generated in blocks starting at this address.
• end_block_addr – Only return actions generated in blocks ending at this address.
• block_stmt – Only return actions generated in the nth statement of each block.
• insn_addr – Only return actions generated in the assembly instruction at this address.
• read_from – Only return actions that perform a read from the specified location.
• write_to – Only return actions that perform a write to the specified location.
Notes: If IR optimization is turned on, reads and writes may not occur in the instruction they originallycame from. Most commonly, If a register is read from twice in the same block, the second read will not
happen, instead reusing the temp the value is already stored in.

334

Chapter 10. API ReferenceangrValid values for read_from and write_to are the string literals ‘reg’ or ‘mem’ (matching any read or write
to registers or memory, respectively), any string (representing a read or write to the named register), andany integer (representing a read or write to the memory at this address).
demote()Demotes this history node, causing it to drop the strong state reference.
reachable()
add_event(event_type, **kwargs)
add_action(action)
extend_actions(new_actions)subscribe_actions()
property recent_constraints
property recent_actions
property block_countproperty lineage
property parents
property events:

Reversible[SimEvent]

property actions:

Reversible[SimAction]

property jumpkinds:

Reversible[str]property jump_guards:

Reversible[Bool]

property jump_targets
property jump_sources
property descriptions:

Reversible[str]property bbl_addrs:

Reversible[int]property ins_addrs:

Reversible[int]property stack_actions
closest_common_ancestor(other)
Find the common ancestor between this history node and ‘other’.
Parameters
other – the PathHistory to find a common ancestor with.
Returns
the common ancestor SimStateHistory, or None if there isn’t one
constraints_since(other)
Returns the constraints that have been accumulated since other.
Parameters
other – a prior PathHistory object

10.3. Program State

335

angr

Returns
a list of constraints
make_child()
state:

angr.SimState

class angr.state_plugins.history.TreeIter(start, end=None)
Bases: object__init__(start, end=None)
property hardcopy
count(v)Count occurrences of value v in the entire history. Note that the subclass must implement the __reversed__method, otherwise an exception will be thrown. :param object v: The value to look for :return: The numberof occurrences :rtype: int
class angr.state_plugins.history.HistoryIter(start, end=None)
Bases: TreeIter
class angr.state_plugins.history.LambdaAttrIter(start, f , **kwargs)
Bases: TreeIter__init__(start, f , **kwargs)
class angr.state_plugins.history.LambdaIterIter(start, f , reverse=True, **kwargs)
Bases: LambdaAttrIter__init__(start, f , reverse=True, **kwargs)
class angr.state_plugins.gdb.GDB(omit_fp=False, adjust_stack=False)
Bases: SimStatePlugin
Initialize or update a state from gdb dumps of the stack, heap, registers and data (or arbitrary) segments.
__init__(omit_fp=False, adjust_stack=False)
Parameters• omit_fp – The frame pointer register is used for something else.
–omit_frame_pointer)(i.e.

• adjust_stack – Use different stack addresses than the gdb session (not recommended).
set_stack(stack_dump, stack_top)
Stack dump is a dump of the stack from gdb, i.e. the result of the following gdb command :dump binary memory [stack_dump] [begin_addr] [end_addr]
We set the stack to the same addresses as the gdb session to avoid pointers corruption.
Parameters• stack_dump – The dump file.
• stack_top – The address of the top of the stack in the gdb session.

336

Chapter 10. API Referenceangr

set_heap(heap_dump, heap_base)
Heap dump is a dump of the heap from gdb, i.e. the result of the following gdb command:
dump binary memory [stack_dump] [begin] [end]Parameters• heap_dump – The dump file.
• heap_base – The start address of the heap in the gdb session.
set_data(addr, data_dump)
Update any data range (most likely use is the data segments of loaded objects)
set_regs(regs_dump)
Initialize register values within the stateParameters
regs_dump – The output of info registers in gdb.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.cgc.SimStateCGC
Bases: SimStatePlugin
This state plugin keeps track of CGC state.
EBADF = 1
EFAULT = 2
EINVAL = 3
ENOMEM = 4
ENOSYS = 5
EPIPE = 6
FD_SETSIZE = 1024
max_allocation = 268435456__init__()copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
10.3. Program State

337

angr

The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
peek_input()
discard_input(num_bytes)
peek_output()
discard_output(num_bytes)
addr_invalid(a)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return type
bool

338

Chapter 10. API Referenceangrwiden(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
get_max_sinkhole(length)
Find a sinkhole which is large enough to support length bytes.
This uses first-fit. The first sinkhole (ordered in descending order by their address) which can hold length
bytes is chosen. If there are more than length bytes in the sinkhole, a new sinkhole is created representing
the remaining bytes while the old sinkhole is removed.
add_sinkhole(address, length)
Add a sinkhole.
Allow the possibility for the program to reuse the memory represented by the address length pair.
state:

angr.SimState

This file contains objects to track additional information during a trace or modify symbolic variables during a trace.
The ChallRespInfo plugin tracks variables in stdin and stdout to enable handling of challenge response It handles
atoi/int2str in a special manner since path constraints will usually prevent their values from being modified
The Zen plugin simplifies expressions created from variables in the flag page (losing some accuracy) to avoid situations
where they become to complex for z3, but the actual equation doesn’t matter much. This can happen in challenge
response if all of the values in the flag page are multiplied together before being printed.
class angr.state_plugins.trace_additions.FormatInfo
Bases: object
copy()
compute(state)
get_type()class angr.state_plugins.trace_additions.FormatInfoStrToInt(addr, func_name, str_arg_num, base,
base_arg, allows_negative)
Bases: FormatInfo__init__(addr, func_name, str_arg_num, base, base_arg, allows_negative)copy()
compute(state)
get_type()class angr.state_plugins.trace_additions.FormatInfoIntToStr(addr, func_name, int_arg_num,
str_dst_num, base, base_arg)
Bases: FormatInfo

10.3. Program State

339

angr

__init__(addr, func_name, int_arg_num, str_dst_num, base, base_arg)
copy()
compute(state)
get_type()class angr.state_plugins.trace_additions.FormatInfoDontConstrain(addr, func_name,check_symbolic_arg)
Bases: FormatInfo__init__(addr, func_name, check_symbolic_arg)
copy()
compute(state)
get_type()
angr.state_plugins.trace_additions.int2base(x, base)angr.state_plugins.trace_additions.generic_info_hook(state)angr.state_plugins.trace_additions.end_info_hook(state)angr.state_plugins.trace_additions.exit_hook(state)angr.state_plugins.trace_additions.syscall_hook(state)angr.state_plugins.trace_additions.constraint_hook(state)class angr.state_plugins.trace_additions.ChallRespInfo
Bases: SimStatePlugin
This state plugin keeps track of the reads and writes to symbolic addresses__init__()copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to

340

Chapter 10. API Referenceangrresolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
static get_byte(var_name)lookup_original(replacement)
pop_from_backup()
get_stdin_indices(variable)
get_stdout_indices(variable)
get_real_len(input_val, base, result_bv, allows_negative)

10.3. Program State

341

angr

get_possible_len(input_val, base, allows_negative)
get_same_length_constraints()
static atoi_dumps(state, require_same_length=True)
static prep_tracer(state, format_infos=None)angr.state_plugins.trace_additions.zen_hook(state, expr)
angr.state_plugins.trace_additions.zen_memory_write(state)angr.state_plugins.trace_additions.zen_register_write(state)class angr.state_plugins.trace_additions.ZenPlugin(max_depth=13)
Bases: SimStatePlugin__init__(max_depth=13)
static get_flag_rand_args(expr)
get_expr_depth(expr)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

342

Chapter 10. API ReferenceangrDuring static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
get_flag_bytes(ast)filter_constraints(constraints)
analyze_transmit(state, buf )static prep_tracer(state)class angr.state_plugins.globals.SimStateGlobals(backer=None)
Bases: SimStatePlugin__init__(backer=None)
set_state(state)
Sets a new state (for example, if the state has been branched)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)10.3. Program State

343

angr

When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
keys()
values()items()
get(k, alt=None)pop(k, alt=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo

344

Chapter 10. API Referenceangr

The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.uc_manager.SimUCManager(man=None)
Bases: SimStatePlugin__init__(man=None)assign(dst_addr_ast)
Assign a new region for under-constrained symbolic execution.
Parameters
dst_addr_ast – the symbolic AST which address of the new allocated region will be assigned to.
Returns
as ast of memory address that points to a new region
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
get_alloc_depth(addr)
Return type
int | None
Parametersaddr (int | Base)
set_alloc_depth(addr, depth)
Parameters• addr (Base)• depth (int)
is_bounded(ast)Test whether an AST is bounded by any existing constraint in the related solver.
Parametersast – an claripy.AST object
Returns
True if there is at least one related constraint, False otherwise

10.3. Program State

345

angr

set_state(state)
Sets a new state (for example, if the state has been branched)class angr.state_plugins.scratch.SimStateScratch(scratch=None)
Bases: SimStatePlugin
Implements the scratch state plugin.
__init__(scratch=None)
property priv
push_priv(priv)
pop_priv()
set_tyenv(tyenv)
tmp_expr(tmp)
Returns the Claripy expression of a VEX temp value.
Parameters• tmp – the number of the tmp• simplify – simplify the tmp before returning it
Returnsa Claripy expression of the tmp
store_tmp(tmp, content, reg_deps=frozenset({}), tmp_deps=frozenset({}), deps=None, **kwargs)
Stores a Claripy expression in a VEX temp value. If in symbolic mode, this involves adding a constraint
for the tmp’s symbolic variable.
Parameters• tmp – the number of the tmp• content – a Claripy expression of the content• reg_deps – the register dependencies of the content• tmp_deps – the temporary value dependencies of the content
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’s
346

Chapter 10. API Referenceangrreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
clear()
class angr.state_plugins.preconstrainer.SimStatePreconstrainer(constrained_addrs=None)
Bases: SimStatePlugin
This state plugin manages the concept of preconstraining - adding constraints which you would like to remove
later.
Parametersconstrained_addrs – SimActions for memory operations whose addresses should be constrained during crash analysis
10.3. Program State

347

angr

__init__(constrained_addrs=None)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return type
bool

348

Chapter 10. API Referenceangrcopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
preconstrain(value, variable)
Add a preconstraint that variable == value to the state.
Parameters• value – The concrete value. Can be a bitvector or a bytestring or an integer.
• variable – The BVS to preconstrain.
preconstrain_file(content, simfile, set_length=False)
Preconstrain the contents of a file.
Parameters• content – The content to preconstrain the file to. Can be a bytestring or a list thereof.
• simfile – The actual simfile to preconstrain
preconstrain_flag_page(magic_content)
Preconstrain the data in the flag page.
Parameters
magic_content – The content of the magic page as a bytestring.
remove_preconstraints(to_composite_solver=True, simplify=True)
Remove the preconstraints from the state.
If you are using the zen plugin, this will also use that to filter the constraints.
Parameters• to_composite_solver – Whether to convert the replacement solver to a composite
solver. You probably want this if you’re switching from tracing to symbolic analysis.
• simplify – Whether to simplify the resulting set of constraints.
reconstrain()
Split the solver. If any of the subsolvers time out after a short timeout (10 seconds), re-add the preconstraints
associated with each of its variables. Hopefully these constraints still allow us to do meaningful things to
the state.
class angr.state_plugins.unicorn_engine.MEM_PATCH
Bases: Structure
struct mem_update_t
address
Structure/Union member

10.3. Program State

349

angr

lengthStructure/Union member
next
Structure/Union member
class angr.state_plugins.unicorn_engine.TRANSMIT_RECORD
Bases: Structure
struct transmit_record_t
count
Structure/Union member
data
Structure/Union member
fd
Structure/Union member
class angr.state_plugins.unicorn_engine.TaintEntityEnum
Bases: object
taint_entity_enum_t
TAINT_ENTITY_REG = 0
TAINT_ENTITY_TMP = 1
TAINT_ENTITY_MEM = 2
TAINT_ENTITY_NONE = 3class angr.state_plugins.unicorn_engine.MemoryValue
Bases: Structure
struct memory_value_t
address
Structure/Union member
is_value_set
Structure/Union member
is_value_symbolic
Structure/Union member
value
Structure/Union member
class angr.state_plugins.unicorn_engine.RegisterValue
Bases: Structure
struct register_value_t
offsetStructure/Union member
size
Structure/Union member

350

Chapter 10. API Reference

angr

value
Structure/Union member
class angr.state_plugins.unicorn_engine.VEXStmtDetails
Bases: Structure
struct sym_vex_stmt_details_t
has_memory_dep
Structure/Union member
memory_values
Structure/Union member
memory_values_count
Structure/Union member
stmt_idx
Structure/Union member
class angr.state_plugins.unicorn_engine.BlockDetails
Bases: Structure
struct sym_block_details_ret_t
block_addr
Structure/Union member
block_size
Structure/Union member
block_trace_ind
Structure/Union member
has_symbolic_exit
Structure/Union member
register_values
Structure/Union member
register_values_count
Structure/Union member
symbolic_vex_stmts
Structure/Union member
symbolic_vex_stmts_count
Structure/Union member
class angr.state_plugins.unicorn_engine.STOP
Bases: object
enum stop_t
STOP_NORMAL = 0
STOP_STOPPOINT = 1
STOP_ERROR = 2

10.3. Program State

351

angr

STOP_SYSCALL = 3
STOP_EXECNONE = 4
STOP_ZEROPAGE = 5
STOP_NOSTART = 6
STOP_SEGFAULT = 7
STOP_ZERO_DIV = 8
STOP_NODECODE = 9
STOP_HLT = 10
STOP_VEX_LIFT_FAILED = 11
STOP_SYMBOLIC_PC = 12
STOP_SYMBOLIC_READ_ADDR = 13
STOP_SYMBOLIC_READ_SYMBOLIC_TRACKING_DISABLED = 14
STOP_SYMBOLIC_WRITE_ADDR = 15
STOP_SYMBOLIC_BLOCK_EXIT_CONDITION = 16
STOP_SYMBOLIC_BLOCK_EXIT_TARGET = 17
STOP_UNSUPPORTED_STMT_PUTI = 18
STOP_UNSUPPORTED_STMT_STOREG = 19
STOP_UNSUPPORTED_STMT_LOADG = 20
STOP_UNSUPPORTED_STMT_CAS = 21
STOP_UNSUPPORTED_STMT_LLSC = 22
STOP_UNSUPPORTED_STMT_DIRTY = 23
STOP_UNSUPPORTED_EXPR_GETI = 24
STOP_UNSUPPORTED_STMT_UNKNOWN = 25
STOP_UNSUPPORTED_EXPR_UNKNOWN = 26
STOP_UNKNOWN_MEMORY_WRITE_SIZE = 27
STOP_SYSCALL_ARM = 28
STOP_X86_CPUID = 29

352

Chapter 10. API Referenceangrstop_message = {0: 'Reached maximum steps', 1: 'Hit a stop point', 2: 'Something
wrong', 3: 'Unable to handle syscall', 4: 'Fetching empty page', 5: 'Accessing
zero page', 6: 'Failed to start', 7: 'Permissions or mapping error', 8: 'Divide
by zero', 9: 'Instruction decoding error', 10: 'hlt instruction encountered', 11:'Failed to lift block to VEX', 12: 'Instruction pointer became symbolic', 13:'Attempted to read from symbolic address', 14: 'Attempted to read symbolic datafrom memory but symbolic tracking is disabled', 15: 'Attempted to write to symbolic
address', 16: "Guard condition of block's exit statement is symbolic", 17: 'Targetof default exit of block is symbolic', 18: 'Symbolic taint propagation for PutI
statement not yet supported', 19: 'Symbolic taint propagation for StoreG statement
not yet supported', 20: 'Symbolic taint propagation for LoadG statement not yet
supported', 21: 'Symbolic taint propagation for CAS statement not yet supported',
22: 'Symbolic taint propagation for LLSC statement not yet supported', 23:'Symbolic taint propagation for Dirty statement not yet supported', 24: 'Symbolic
taint propagation for GetI expression not yet supported', 25: 'Canoo propagate
symbolic taint for unsupported VEX statement type', 26: 'Cannot propagate symbolic
taint for unsupported VEX expression', 27: 'Unicorn failed to determine size ofmemory write', 28: 'ARM syscalls are currently not supported by SimEngineUnicorn',
29: 'Block executes cpuid which should be handled in VEX engine'}
symbolic_stop_reasons = {12, 13, 14, 15, 16, 17, 28, 29}
unsupported_reasons = {11, 18, 19, 20, 21, 22, 23, 25, 26}
static name_stop(num)static get_stop_msg(stop_reason)class angr.state_plugins.unicorn_engine.StopDetails
Bases: Structure
struct stop_details_t
block_addr
Structure/Union member
block_size
Structure/Union member
stop_reason
Structure/Union member
class angr.state_plugins.unicorn_engine.SimOSEnum
Bases: object
enum simos_t
SIMOS_CGC = 0
SIMOS_LINUX = 1
SIMOS_OTHER = 2
exception angr.state_plugins.unicorn_engine.MemoryMappingError
Bases: Exception
exception angr.state_plugins.unicorn_engine.AccessingZeroPageError
Bases: MemoryMappingError

10.3. Program State

353

angr

exception angr.state_plugins.unicorn_engine.FetchingZeroPageError
Bases: MemoryMappingError
exception angr.state_plugins.unicorn_engine.SegfaultError
Bases: MemoryMappingError
exception angr.state_plugins.unicorn_engine.MixedPermissonsError
Bases: MemoryMappingError
class angr.state_plugins.unicorn_engine.AggressiveConcretizationAnnotation(addr)
Bases: SimplificationAvoidanceAnnotation__init__(addr)
class angr.state_plugins.unicorn_engine.Uniwrapper(arch, cache_key, thumb=False)
Bases: Uc__init__(arch, cache_key, thumb=False)
hook_add(htype, callback, user_data=None, begin=1, end=0, arg1=0)
hook_del(h)mem_map(addr, size, perms=7)
mem_map_ptr(addr, size, perms, ptr)
mem_unmap(addr, size)
mem_reset()
hook_reset()
reset()
class angr.state_plugins.unicorn_engine.Unicorn(syscall_hooks=None, cache_key=None,
unicount=None, symbolic_var_counts=None,symbolic_inst_counts=None, concretized_asts=None,
always_concretize=None, never_concretize=None,
concretize_at=None,
concretization_threshold_memory=None,
concretization_threshold_registers=None,
concretization_threshold_instruction=None,cooldown_symbolic_stop=2,
cooldown_unsupported_stop=2,
cooldown_nonunicorn_blocks=100,
cooldown_stop_point=1, max_steps=1000000)
Bases: SimStatePlugin
setup the unicorn engine for a state
UC_CONFIG = {}__init__(syscall_hooks=None, cache_key=None, unicount=None, symbolic_var_counts=None,symbolic_inst_counts=None, concretized_asts=None, always_concretize=None,never_concretize=None, concretize_at=None, concretization_threshold_memory=None,
concretization_threshold_registers=None, concretization_threshold_instruction=None,cooldown_symbolic_stop=2, cooldown_unsupported_stop=2, cooldown_nonunicorn_blocks=100,
cooldown_stop_point=1, max_steps=1000000)
354

Chapter 10. API ReferenceangrInitializes the Unicorn plugin for angr. This plugin handles communication with UnicornEngine.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool

10.3. Program State

355

angr

widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
set_state(state)
Sets a new state (for example, if the state has been branched)property uc
static delete_uc()
set_last_block_details(details)
set_stops(stop_points)
set_tracking(track_bbls, track_stack)hook()
uncache_region(addr, length)
clear_page_cache()setup(syscall_data=None, fd_bytes=None)start(step=None)
get_recent_bbl_addrs()
get_stop_details()
finish(succ_state)
destroy(succ_state)
set_regs()
setting unicorn registers
setup_flags()
setup_gdt(fs, gs)
read_msr(msr=3221225728)
write_msr(val, msr=3221225728)
get_regs(succ_state)loading registers from unicorn. If succ_state is not None, update it instead of self.state. Needed whenhandling symbolic exits in native interface

356

Chapter 10. API Referenceangrstate:

angr.SimState

class angr.state_plugins.loop_data.SimStateLoopData(back_edge_trip_counts=None,
header_trip_counts=None, current_loop=None)
Bases: SimStatePlugin
This class keeps track of loop-related information for states. Note that we have 2 counters for loop iterations(trip counts): the first recording the number of times one of the back edges (or continue edges) of a loop is
taken, whereas the second recording the number of times the loop header (or loop entry) is executed. These 2
counters may differ since compilers usually optimize loops hence completely change the loop structure at thebinary level. This is supposed to be used with LoopSeer exploration technique, which monitors loop execution.
For the moment, the only thing we want to analyze is loop trip counts, but nothing prevents us from extending
this plugin for other loop analyses.
__init__(back_edge_trip_counts=None, header_trip_counts=None, current_loop=None)
Parameters• back_edge_trip_counts – Dictionary that stores back edge based trip counts for eachloop. Keys are address of loop headers.
• header_trip_counts – Dictionary that stores header based trip counts for each loop.
Keys are address of loop headers.
• current_loop – List of currently running loops. Each element is a tuple (loop object, listof loop exits).
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins
10.3. Program State

357

angr

• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.concrete.Concrete(segment_registers_initialized=False,
segment_registers_callback_initialized=False,
whitelist=None, fs_register_bp=None,already_sync_objects_addresses=None)
Bases: SimStatePlugin__init__(segment_registers_initialized=False, segment_registers_callback_initialized=False,
whitelist=None, fs_register_bp=None, already_sync_objects_addresses=None)copy(_memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

358

Chapter 10. API Referenceangrmerge(_others, _merge_conditions, _common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
set_state(state)
Sets a new state (for example, if the state has been branched)

10.3. Program State

359

angr

sync()
Handle the switch between the concrete execution and angr. This method takes care of: 1- Synchronize
registers. 2- Set a concrete target to the memory backer so the memory reads are redirected in the concrete
process memory. 3- If possible restore the SimProcedures with the real addresses inside the concrete process. 4- Set an inspect point to sync the segments register as soon as they are read during the symbolic
execution. 5- Flush all the pages loaded until now.
Returnsclass angr.state_plugins.javavm_classloader.SimJavaVmClassloader(initialized_classes=None)
Bases: SimStatePlugin
JavaVM Classloader is used as an interface for resolving and initializing Java classes.
__init__(initialized_classes=None)
get_class(class_name, init_class=False, step_func=None)
Get a class descriptor for the class.
Parameters• class_name (str) – Name of class.
• init_class (bool) – Whether the class initializer <clinit> should be executed.
• step_func (func) – Callback function executed at every step of the simulation manager
during the execution of the main <clinit> method
get_superclass(class_)
Get the superclass of the class.
get_class_hierarchy(base_class)Walks up the class hierarchy and returns a list of all classes between base class (inclusive) andjava.lang.Object (exclusive).
is_class_initialized(class_)
Indicates whether the classes initializing method <clinit> was already executed on the state.
init_class(class_, step_func=None)
This method simulates the loading of a class by the JVM, during which parts of the class (e.g. static fields)
are initialized. For this, we run the class initializer method <clinit> (if available) and update the stateaccordingly.
Note: Initialization is skipped, if the class has already been
initialized (or if it’s not loaded in CLE).
property initialized_classes
List of all initialized classes.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!

360

Chapter 10. API ReferenceangrParameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool

10.3. Program State

361

angr

class angr.state_plugins.jni_references.SimStateJNIReferences(local_refs=None,
global_refs=None)
Bases: SimStatePlugin
Management of the mapping between opaque JNI references and the corresponding Java objects.
__init__(local_refs=None, global_refs=None)
lookup(opaque_ref )Lookups the object that was used for creating the reference.
create_new_reference(obj, global_ref=False)
Create a new reference thats maps to the given object.
Parameters• obj – Object which gets referenced.
• global_ref (bool) – Whether a local or global reference is created.
clear_local_references()
Clear all local references.
delete_reference(opaque_ref , global_ref=False)
Delete the stored mapping of a reference.
Parameters• opaque_ref – Reference which should be removed.
• global_ref (bool) – Whether opaque_ref is a local or global reference.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.

362

Chapter 10. API Referenceangrself.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.state_plugins.heap.SimHeapBase(heap_base=None, heap_size=None)
Bases: SimStatePlugin
This is the base heap class that all heap implementations should subclass. It defines a few handlers for common
heap functions (the libc memory management functions). Heap implementations are expected to override thesefunctions regardless of whether they implement the SimHeapLibc interface. For an example, see the SimHeapBrk
implementation, which is based on the original libc SimProcedure implementations.
Variables• heap_base – the address of the base of the heap in memory• heap_size – the total size of the main memory region managed by the heap in memory• mmap_base – the address of the region from which large mmap allocations will be made__init__(heap_base=None, heap_size=None)

10.3. Program State

363

angr

copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.state_plugins.heap.SimHeapBrk(heap_base=None, heap_size=None)
Bases: SimHeapBase
SimHeapBrk represents a trivial heap implementation based on the Unix brk system call. This type of heap storesvirtually no metadata, so it is up to the user to determine when it is safe to release memory. This also means thatit does not properly support standard heap operations like realloc.
This heap implementation is a holdover from before any more proper implementations were modelled. At thetime, various libc (or win32) SimProcedures handled the heap in the same way that this plugin does now. To
make future heap implementations plug-and-playable, they should implement the necessary logic themselves, anddependent SimProcedures should invoke a method by the same name as theirs (prepended with an underscore)
upon the heap plugin. Depending on the heap implementation, if the method is not supported, an error shouldbe raised.
Out of consideration for the original way the heap was handled, this plugin implements functionality for all relevant SimProcedures (even those that would not normally be supported together in a single heap implementation).
Variables
heap_location – the address of the top of the heap, bounding the allocations made startingfrom heap_base__init__(heap_base=None, heap_size=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
allocate(sim_size)
The actual allocation primitive for this heap implementation. Increases the position of the break to allocate
space. Has no guards against the heap growing too large.
Parameters
sim_size – a size specifying how much to increase the break pointer by

364

Chapter 10. API ReferenceangrReturnsa pointer to the previous break position, above which there is now allocated space
release(sim_size)
The memory release primitive for this heap implementation. Decreases the position of the break to deallocate space. Guards against releasing beyond the initial heap base.
Parameters
sim_size – a size specifying how much to decrease the break pointer by (may be symbolicor not)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
10.3. Program State

365

angr

Returns
True if the state plugin is actually widened.
Return typeboolclass angr.state_plugins.heap.SimHeapLibc(heap_base=None, heap_size=None)
Bases: SimHeapBase
A class of heap that implements the major libc heap management functions.
malloc(sim_size)
A somewhat faithful implementation of libc malloc.
Parameters
sim_size – the amount of memory (in bytes) to be allocatedReturns
the address of the allocation, or a NULL pointer if the allocation failed
free(ptr)
A somewhat faithful implementation of libc free.
Parameters
ptr – the location in memory to be freed
calloc(sim_nmemb, sim_size)
A somewhat faithful implementation of libc calloc.
Parameters• sim_nmemb – the number of elements to allocated• sim_size – the size of each element (in bytes)
Returns
the address of the allocation, or a NULL pointer if the allocation failed
realloc(ptr, size)
A somewhat faithful implementation of libc realloc.
Parameters• ptr – the location in memory to be reallocated• size – the new size desired for the allocation
Returns
the address of the allocation, or a NULL pointer if the allocation was freed or if no new
allocation was madeclass angr.state_plugins.heap.SimHeapPTMalloc(heap_base=None, heap_size=None)
Bases: SimHeapFreelist
A freelist-style heap implementation inspired by ptmalloc. The chunks used by this heap contain heap metadata
in addition to user data. While the real-world ptmalloc is implemented using multiple lists of free chunks (corresponding to their different sizes), this more basic model uses a single list of chunks and searches for free chunks
using a first-fit algorithm.
NOTE: The plugin must be registered using register_plugin with name heap in order to function properly.
Variables• heap_base – the address of the base of the heap in memory
366

Chapter 10. API Referenceangr• heap_size – the total size of the main memory region managed by the heap in memory• mmap_base – the address of the region from which large mmap allocations will be made• free_head_chunk – the head of the linked list of free chunks in the heap__init__(heap_base=None, heap_size=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
chunks()Returns an iterator over all the chunks in the heap.
allocated_chunks()
Returns an iterator over all the allocated chunks in the heap.
free_chunks()
Returns an iterator over all the free chunks in the heap.
chunk_from_mem(ptr)
Given a pointer to a user payload, return the base of the chunk associated with that payload (i.e. the chunkpointer). Returns None if ptr is null.
Parameters
ptr – a pointer to the base of a user payload in the heap
Returnsa pointer to the base of the associated heap chunk, or None if ptr is nullmalloc(sim_size)
A somewhat faithful implementation of libc malloc.
Parameters
sim_size – the amount of memory (in bytes) to be allocatedReturns
the address of the allocation, or a NULL pointer if the allocation failed
free(ptr)
A somewhat faithful implementation of libc free.
Parameters
ptr – the location in memory to be freed
calloc(sim_nmemb, sim_size)
A somewhat faithful implementation of libc calloc.
Parameters• sim_nmemb – the number of elements to allocated10.3. Program State

367

angr

• sim_size – the size of each element (in bytes)
Returns
the address of the allocation, or a NULL pointer if the allocation failed
realloc(ptr, size)
A somewhat faithful implementation of libc realloc.
Parameters• ptr – the location in memory to be reallocated• size – the new size desired for the allocation
Returns
the address of the allocation, or a NULL pointer if the allocation was freed or if no new
allocation was mademerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return type
bool

368

Chapter 10. API Referenceangrwiden(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.state_plugins.heap.PTChunk(base, sim_state, heap=None)
Bases: Chunk
A chunk, inspired by the implementation of chunks in ptmalloc. Provides a representation of a chunk
via a view into the memory plugin. For the chunk definitions and docs that this was loosely based
off of, see glibc malloc/malloc.c, line 1033, as of commit 5a580643111ef6081be7b4c7bd1997a5447c903f.
Alternatively, take the following link. https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=67cdfd0ad2f003964cd0f7dfe3bcd85ca98528a7;hb=5a580643111ef6081be7b4c7bd1997a5447c903f#l1033
Variables• base – the location of the base of the chunk in memory• state – the program state that the chunk is resident in• heap – the heap plugin that the chunk is managed by__init__(base, sim_state, heap=None)
get_size()
Returns the actual size of a chunk (as opposed to the entire size field, which may include some flags).
get_data_size()
Returns the size of the data portion of a chunk.
set_size(size, is_free=None)
Use this to set the size on a chunk. When the chunk is new (such as when a free chunk is shrunk to form anallocated chunk and a remainder free chunk) it is recommended that the is_free hint be used since setting
the size depends on the chunk’s freeness, and vice versa.
Parameters• size – size of the chunk• is_free – boolean indicating the chunk’s freeness
set_prev_freeness(is_free)
Sets (or unsets) the flag controlling whether the previous chunk is free.
Parameters
is_free – if True, sets the previous chunk to be free; if False, sets it to be allocatedis_prev_free()Returns a concrete state of the flag indicating whether the previous chunk is free or not. Issues a warning
if that flag is symbolic and has multiple solutions, and then assumes that the previous chunk is free.
10.3. Program State

369

angr

Returns
True if the previous chunk is free; False otherwise
prev_size()
Returns the size of the previous chunk, masking off what would be the flag bits if it were in the actual size
field. Performs NO CHECKING to determine whether the previous chunk size is valid (for example, when
the previous chunk is not free, its size cannot be determined).
is_free()
Returns a concrete determination as to whether the chunk is free.
data_ptr()
Returns the address of the payload of the chunk.
next_chunk()
Returns the chunk immediately following (and adjacent to) this one, if it exists.
Returns
The following chunk, or None if applicable
prev_chunk()
Returns the chunk immediately prior (and adjacent) to this one, if that chunk is free. If the prior chunk is
not free, then its base cannot be located and this method raises an error.
Returns
If possible, the previous chunk; otherwise, raises an error
fwd_chunk()
Returns the chunk following this chunk in the list of free chunks. If this chunk is not free, then it resides inno such list and this method raises an error.
Returns
If possible, the forward chunk; otherwise, raises an error
set_fwd_chunk(fwd)
Sets the chunk following this chunk in the list of free chunks.
Parameters
fwd – the chunk to follow this chunk in the list of free chunks
bck_chunk()
Returns the chunk backward from this chunk in the list of free chunks. If this chunk is not free, then it
resides in no such list and this method raises an error.
Returns
If possible, the backward chunk; otherwise, raises an error
set_bck_chunk(bck)Sets the chunk backward from this chunk in the list of free chunks.
Parameters
bck – the chunk to precede this chunk in the list of free chunks
class angr.state_plugins.heap.PTChunkIterator(chunk, cond=<function PTChunkIterator.<lambda>>)Bases: object__init__(chunk, cond=<function PTChunkIterator.<lambda>>)370

Chapter 10. API Referenceangrclass angr.state_plugins.heap.heap_base.SimHeapBase(heap_base=None, heap_size=None)
Bases: SimStatePlugin
This is the base heap class that all heap implementations should subclass. It defines a few handlers for common
heap functions (the libc memory management functions). Heap implementations are expected to override thesefunctions regardless of whether they implement the SimHeapLibc interface. For an example, see the SimHeapBrk
implementation, which is based on the original libc SimProcedure implementations.
Variables• heap_base – the address of the base of the heap in memory• heap_size – the total size of the main memory region managed by the heap in memory• mmap_base – the address of the region from which large mmap allocations will be made__init__(heap_base=None, heap_size=None)copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
init_state()
Use this function to perform any initialization on the state at plugin-add timeclass angr.state_plugins.heap.heap_brk.SimHeapBrk(heap_base=None, heap_size=None)
Bases: SimHeapBase
SimHeapBrk represents a trivial heap implementation based on the Unix brk system call. This type of heap storesvirtually no metadata, so it is up to the user to determine when it is safe to release memory. This also means thatit does not properly support standard heap operations like realloc.
This heap implementation is a holdover from before any more proper implementations were modelled. At thetime, various libc (or win32) SimProcedures handled the heap in the same way that this plugin does now. To
make future heap implementations plug-and-playable, they should implement the necessary logic themselves, anddependent SimProcedures should invoke a method by the same name as theirs (prepended with an underscore)
upon the heap plugin. Depending on the heap implementation, if the method is not supported, an error shouldbe raised.
Out of consideration for the original way the heap was handled, this plugin implements functionality for all relevant SimProcedures (even those that would not normally be supported together in a single heap implementation).
Variables
heap_location – the address of the top of the heap, bounding the allocations made startingfrom heap_base__init__(heap_base=None, heap_size=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.

10.3. Program State

371

angr

In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
allocate(sim_size)
The actual allocation primitive for this heap implementation. Increases the position of the break to allocate
space. Has no guards against the heap growing too large.
Parameters
sim_size – a size specifying how much to increase the break pointer by
Returnsa pointer to the previous break position, above which there is now allocated space
release(sim_size)
The memory release primitive for this heap implementation. Decreases the position of the break to deallocate space. Guards against releasing beyond the initial heap base.
Parameters
sim_size – a size specifying how much to decrease the break pointer by (may be symbolicor not)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with

372

Chapter 10. API Referenceangr• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.state_plugins.heap.heap_freelist.Chunk(base, sim_state)
Bases: object
The sort of chunk as would typically be found in a freelist-style heap implementation. Provides a representationof a chunk via a view into the memory plugin. Chunks may be adjacent, in different senses, to as many as fourother chunks. For any given chunk, two of these chunks are adjacent to it in memory, and are referred to as the“previous” and “next” chunks throughout this implementation. For any given free chunk, there may also be two
significant chunks that are adjacent to it in some linked list of free chunks. These chunks are referred to the“backward” and “forward” chunks relative to the chunk in question.
Variables• base – the location of the base of the chunk in memory• state – the program state that the chunk is resident in__init__(base, sim_state)
get_size()
Returns the actual size of a chunk (as opposed to the entire size field, which may include some flags).
get_data_size()
Returns the size of the data portion of a chunk.
set_size(size)
Sets the size of the chunk, preserving any flags.
data_ptr()
Returns the address of the payload of the chunk.
is_free()
Returns a concrete determination as to whether the chunk is free.
next_chunk()
Returns the chunk immediately following (and adjacent to) this one.

10.3. Program State

373

angr

prev_chunk()
Returns the chunk immediately prior (and adjacent) to this one.
fwd_chunk()
Returns the chunk following this chunk in the list of free chunks.
set_fwd_chunk(fwd)
Sets the chunk following this chunk in the list of free chunks.
Parameters
fwd – the chunk to follow this chunk in the list of free chunks
bck_chunk()
Returns the chunk backward from this chunk in the list of free chunks.
set_bck_chunk(bck)Sets the chunk backward from this chunk in the list of free chunks.
Parameters
bck – the chunk to precede this chunk in the list of free chunks
class angr.state_plugins.heap.heap_freelist.SimHeapFreelist(heap_base=None, heap_size=None)
Bases: SimHeapLibc
A freelist-style heap implementation. Distinguishing features of such heaps include chunks containing heap
metadata in addition to user data and at least (but often more than) one linked list of free chunks.
chunks()Returns an iterator over all the chunks in the heap.
allocated_chunks()
Returns an iterator over all the allocated chunks in the heap.
free_chunks()
Returns an iterator over all the free chunks in the heap.
chunk_from_mem(ptr)
Given a pointer to a user payload, return the chunk associated with that payload.
Parameters
ptr – a pointer to the base of a user payload in the heap
Returns
the associated heap chunkprint_heap_state()
print_all_chunks()
class angr.state_plugins.heap.heap_libc.SimHeapLibc(heap_base=None, heap_size=None)
Bases: SimHeapBase
A class of heap that implements the major libc heap management functions.
malloc(sim_size)
A somewhat faithful implementation of libc malloc.
Parameters
sim_size – the amount of memory (in bytes) to be allocated374

Chapter 10. API ReferenceangrReturns
the address of the allocation, or a NULL pointer if the allocation failed
free(ptr)
A somewhat faithful implementation of libc free.
Parameters
ptr – the location in memory to be freed
calloc(sim_nmemb, sim_size)
A somewhat faithful implementation of libc calloc.
Parameters• sim_nmemb – the number of elements to allocated• sim_size – the size of each element (in bytes)
Returns
the address of the allocation, or a NULL pointer if the allocation failed
realloc(ptr, size)
A somewhat faithful implementation of libc realloc.
Parameters• ptr – the location in memory to be reallocated• size – the new size desired for the allocation
Returns
the address of the allocation, or a NULL pointer if the allocation was freed or if no new
allocation was madeclass angr.state_plugins.heap.heap_ptmalloc.PTChunk(base, sim_state, heap=None)
Bases: Chunk
A chunk, inspired by the implementation of chunks in ptmalloc. Provides a representation of a chunk
via a view into the memory plugin. For the chunk definitions and docs that this was loosely based
off of, see glibc malloc/malloc.c, line 1033, as of commit 5a580643111ef6081be7b4c7bd1997a5447c903f.
Alternatively, take the following link. https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=67cdfd0ad2f003964cd0f7dfe3bcd85ca98528a7;hb=5a580643111ef6081be7b4c7bd1997a5447c903f#l1033
Variables• base – the location of the base of the chunk in memory• state – the program state that the chunk is resident in• heap – the heap plugin that the chunk is managed by__init__(base, sim_state, heap=None)
get_size()
Returns the actual size of a chunk (as opposed to the entire size field, which may include some flags).
get_data_size()
Returns the size of the data portion of a chunk.
set_size(size, is_free=None)
Use this to set the size on a chunk. When the chunk is new (such as when a free chunk is shrunk to form anallocated chunk and a remainder free chunk) it is recommended that the is_free hint be used since setting
the size depends on the chunk’s freeness, and vice versa.
10.3. Program State

375

angr

Parameters• size – size of the chunk• is_free – boolean indicating the chunk’s freeness
set_prev_freeness(is_free)
Sets (or unsets) the flag controlling whether the previous chunk is free.
Parameters
is_free – if True, sets the previous chunk to be free; if False, sets it to be allocatedis_prev_free()Returns a concrete state of the flag indicating whether the previous chunk is free or not. Issues a warning
if that flag is symbolic and has multiple solutions, and then assumes that the previous chunk is free.
Returns
True if the previous chunk is free; False otherwise
prev_size()
Returns the size of the previous chunk, masking off what would be the flag bits if it were in the actual size
field. Performs NO CHECKING to determine whether the previous chunk size is valid (for example, when
the previous chunk is not free, its size cannot be determined).
is_free()
Returns a concrete determination as to whether the chunk is free.
data_ptr()
Returns the address of the payload of the chunk.
next_chunk()
Returns the chunk immediately following (and adjacent to) this one, if it exists.
Returns
The following chunk, or None if applicable
prev_chunk()
Returns the chunk immediately prior (and adjacent) to this one, if that chunk is free. If the prior chunk is
not free, then its base cannot be located and this method raises an error.
Returns
If possible, the previous chunk; otherwise, raises an error
fwd_chunk()
Returns the chunk following this chunk in the list of free chunks. If this chunk is not free, then it resides inno such list and this method raises an error.
Returns
If possible, the forward chunk; otherwise, raises an error
set_fwd_chunk(fwd)
Sets the chunk following this chunk in the list of free chunks.
Parameters
fwd – the chunk to follow this chunk in the list of free chunks
bck_chunk()
Returns the chunk backward from this chunk in the list of free chunks. If this chunk is not free, then it
resides in no such list and this method raises an error.

376

Chapter 10. API ReferenceangrReturns
If possible, the backward chunk; otherwise, raises an error
set_bck_chunk(bck)Sets the chunk backward from this chunk in the list of free chunks.
Parameters
bck – the chunk to precede this chunk in the list of free chunks
class angr.state_plugins.heap.heap_ptmalloc.PTChunkIterator(chunk, cond=<function
PTChunkIterator.<lambda>>)Bases: object__init__(chunk, cond=<function PTChunkIterator.<lambda>>)class angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc(heap_base=None, heap_size=None)
Bases: SimHeapFreelist
A freelist-style heap implementation inspired by ptmalloc. The chunks used by this heap contain heap metadata
in addition to user data. While the real-world ptmalloc is implemented using multiple lists of free chunks (corresponding to their different sizes), this more basic model uses a single list of chunks and searches for free chunks
using a first-fit algorithm.
NOTE: The plugin must be registered using register_plugin with name heap in order to function properly.
Variables• heap_base – the address of the base of the heap in memory• heap_size – the total size of the main memory region managed by the heap in memory• mmap_base – the address of the region from which large mmap allocations will be made• free_head_chunk – the head of the linked list of free chunks in the heap__init__(heap_base=None, heap_size=None)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
chunks()Returns an iterator over all the chunks in the heap.
allocated_chunks()
Returns an iterator over all the allocated chunks in the heap.
free_chunks()
Returns an iterator over all the free chunks in the heap.

10.3. Program State

377

angr

chunk_from_mem(ptr)
Given a pointer to a user payload, return the base of the chunk associated with that payload (i.e. the chunkpointer). Returns None if ptr is null.
Parameters
ptr – a pointer to the base of a user payload in the heap
Returnsa pointer to the base of the associated heap chunk, or None if ptr is nullmalloc(sim_size)
A somewhat faithful implementation of libc malloc.
Parameters
sim_size – the amount of memory (in bytes) to be allocatedReturns
the address of the allocation, or a NULL pointer if the allocation failed
free(ptr)
A somewhat faithful implementation of libc free.
Parameters
ptr – the location in memory to be freed
calloc(sim_nmemb, sim_size)
A somewhat faithful implementation of libc calloc.
Parameters• sim_nmemb – the number of elements to allocated• sim_size – the size of each element (in bytes)
Returns
the address of the allocation, or a NULL pointer if the allocation failed
realloc(ptr, size)
A somewhat faithful implementation of libc realloc.
Parameters• ptr – the location in memory to be reallocated• size – the new size desired for the allocation
Returns
the address of the allocation, or a NULL pointer if the allocation was freed or if no new
allocation was mademerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)378

Chapter 10. API ReferenceangrWhen implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
init_state()
Use this function to perform any initialization on the state at plugin-add timeangr.state_plugins.heap.utils.concretize(x, solver, sym_handler)
For now a lot of naive concretization is done when handling heap metadata to keep things manageable. This
idiom showed up a lot as a result, so to reduce code repetition this function uses a callback to handle the one or
two operations that varied across invocations.
Parameters• x – the item to be concretized• solver – the solver to evaluate the item with• sym_handler – the handler to be used when the item may take on more than one value
Returnsa concrete value for the item

10.3. Program State

379

angr

class angr.state_plugins.symbolizer.SimSymbolizer
Bases: SimStatePlugin
The symbolizer state plugin ensures that pointers that are stored in memory are symbolic. This allows for the
tracking of and reasoning over these pointers (for example, to reason about memory disclosure).
__init__()init_state()
Use this function to perform any initialization on the state at plugin-add time
set_symbolization_for_all_pages()
Sets the symbolizer to symbolize pointers to all pages as they are written to memory..
set_symbolized_target_range(base, length)
All pointers to the target range will be symbolized as they are written to memory.
Due to optimizations, the _pages_ containing this range will be set as symbolization targets, not just therange itself.
resymbolize()Re-symbolizes all pointers in memory. This can be called to symbolize any pointers to target regions thatwere written (and not mangled beyond recognition) before symbolization was set.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.state_plugins.debug_variables.SimDebugVariable(state, addr, var_type)
Bases: object
A SimDebugVariable will get dynamically created when queriyng for variable in a state with the SimDebugVariablePlugin. It features a link to the state, an address and a type.
Parameters• state (SimState)• var_type (VariableType)__init__(state, addr, var_type)
Parameters• state (SimState)• var_type (VariableType)static from_cle_variable(state, cle_variable, dwarf_cfa)
Return type
SimDebugVariable

380

Chapter 10. API ReferenceangrParameters• state (SimState)• cle_variable (Variable)
property mem_untyped:
property mem:

SimMemView

SimMemView

property string:

SimMemView

with_type(sim_type)
Return type
SimMemView
Parameters
sim_type (SimType)property resolvable
property resolved
property concrete
store(value)
property deref:

SimDebugVariable

array(i)Return type
SimDebugVariable
member(member_name)Return type
SimDebugVariable
Parameters
member_name (str)class angr.state_plugins.debug_variables.SimDebugVariablePlugin
Bases: SimStatePlugin
This is the plugin you’ll use to interact with (global/local) program variables. These variables have a name and avisibility scope which depends on the pc address of the state. With this plugin, you can access/modify the valueof such variable or find its memory address. For creating program variables, or for importing them from cle, see
the knowledge plugin debug_variables. Run p.kb.dvars.load_from_dwarf() before using this plugin.
Example>>> p = angr.Project("various_variables", load_debug_info=True)>>> p.kb.dvars.load_from_dwarf()>>> state = # navigate to the state you want>>> state.dvars.get_variable("pointer2").deref.mem<int (32 bits) <BV32 0x1> at 0x404020>

10.3. Program State

381

angr

get_variable(var_name)Returns the visible variable (if any) with name var_name based on the current state.ip.
Return type
SimDebugVariable
Parameters
var_name (str)property dwarf_cfa
Returns the current cfa computation. Set this property to the correct value if needed.
property dwarf_cfa_approx

10.4 Storage
class angr.storage.SimFile(name=None, content=None, size=None, has_end=None, seekable=True,
writable=True, ident=None, concrete=None, **kwargs)
Bases: SimFileBase, DefaultMemory
The normal SimFile is meant to model files on disk. It subclasses SimSymbolicMemory so loads and stores
to/from it are very simple.
Parameters• name – The name of the file• content – Optional initial content for the file as a string or bitvector• size – Optional size of the file. If content is not specified, it defaults to zero• has_end – Whether the size boundary is treated as the end of the file or a frontier atwhich new content will be generated. If unspecified, will pick its value based on options.FILES_HAVE_EOF. Another caveat is that if the size is also unspecified this value
will default to False.
• seekable – Optional bool indicating whether seek operations on this file should succeed,
default True.
• writable – Whether writing to this file is allowed• concrete – Whether or not this file contains mostly concrete data. Will be used by some
SimProcedures to choose how to handle variable-length operations like fgets.
Variables
has_end – Whether this file has an EOF__init__(name=None, content=None, size=None, has_end=None, seekable=True, writable=True,
ident=None, concrete=None, **kwargs)
property categoryreg, mem, or file.
Type
Return the category of this SimMemory instance. It can be one of the three following categories
set_state(state)
Sets a new state (for example, if the state has been branched)

382

Chapter 10. API Referenceangrproperty size
The number of data bytes stored by the file at present. May be a symbolic value.
concretize(**kwargs)
Return a concretization of the contents of the file, as a flat bytestring.
read(pos, size, **kwargs)
Read some data from the file.
Parameters• pos – The offset in the file to read from.
• size – The size to read. May be symbolic.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read), theactual size of the read, and the new file position pointer.
write(pos, data, size=None, events=True, **kwargs)
Write some data to the file.
Parameters• pos – The offset in the file to write to. May be ignored if the file is a stream or device.
• data – The data to write as a bitvector• size – The optional size of the data to write. If not provided will default to the length ofthe data. Must be constrained to less than or equal to the size of the data.
Returns
The new file position pointer.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
10.4. Storage

383

angr

self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.storage.SimMemoryObject(obj, base, endness, length=None, byte_width=8)
Bases: object
A SimMemoryObject is a reference to a byte or several bytes in a specific object in memory. It should be used
only by the bottom layer of memory.
__init__(obj, base, endness, length=None, byte_width=8)
is_bytesbaseobjectlengthendnesssize()

384

Chapter 10. API Referenceangrproperty variables
property symbolic
property last_addr
concrete_bytes(offset, size)
Return typebytes | None
Parameters• offset (int)• size (int)includes(x)bytes_at(addr, length, allow_concrete=False, endness='Iend_BE')
class angr.storage.DefaultMemory(*args, **kwargs)
Bases:
HexDumperMixin,
SmartFindMixin,
UnwrapperMixin,
NameResolutionMixin,
DataNormalizationMixin,
SimplificationMixin,
InspectMixinHigh ,ActionsMixinHigh ,UnderconstrainedMixin,
SizeConcretizationMixin,
SizeNormalizationMixin,
AddressConcretizationMixin, ActionsMixinLow, ConditionalMixin, ConvenientMappingsMixin,
DirtyAddrsMixin,
StackAllocationMixin,
ConcreteBackerMixin,
ClemoryBackerMixin,
DictBackerMixin,
PrivilegedPagingMixin,
UltraPagesMixin,
DefaultFillerMixin,
SymbolicMergerMixin, PagedMemoryMixin
class angr.state_plugins.view.SimRegNameView
Bases: SimStatePlugincopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
10.4. Storage

385

angr

self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
get(reg_name)class angr.state_plugins.view.SimMemView(ty=None, addr=None, state=None)
Bases: SimStatePlugin
This is a convenient interface with which you can access a program’s memory.
The interface works like this:• You first use [array index notation] to specify the address you’d like to load from• If at that address is a pointer, you may access the deref property to return a SimMemView at the address
present in memory.
• You then specify a type for the data by simply accessing a property of that name. For a list of supported
types, look at state.mem.types.
• You can then refine the type. Any type may support any refinement it likes. Right now the only refinements
supported are that you may access any member of a struct by its member name, and you may index into astring or array to access that element.

386

Chapter 10. API Referenceangr• If the address you specified initially points to an array of that type, you can say .array(n) to view the dataas an array of n elements.
• Finally, extract the structured data with .resolved or .concrete. .resolved will return bitvector values,
while .concrete will return integer, string, array, etc values, whatever best represents the data.
• Alternately, you may store a value to memory, by assigning to the chain of properties that you’ve constructed. Note that because of the way python works, x = s.mem[...].prop; x = val will NOT work,
you must say s.mem[...].prop = val.
For example:>>> s.mem[0x601048].long<long (64 bits) <BV64 0x4008d0> at 0x601048>>>> s.mem[0x601048].long.resolved<BV64 0x4008d0>>>> s.mem[0x601048].deref<<untyped> <unresolvable> at 0x4008d0>>>> s.mem[0x601048].deref.string.concrete'SOSNEAKY'__init__(ty=None, addr=None, state=None)
set_state(state)
Sets a new state (for example, if the state has been branched)

10.4. Storage

387

angr

types: ClassVar[dict] = {'CharT': char, 'FILE_t': struct FILE_t, '_Bool': bool,'_ENTRY': struct _ENTRY, '_IO_codecvt': struct _IO_codecvt, '_IO_iconv_t': struct_IO_iconv_t, '_IO_lock_t': struct pthread_mutex_t, '_IO_marker': struct_IO_marker, '_IO_wide_data': struct _IO_wide_data, '__clock_t': uint32_t,'__dev_t': uint64_t, '__gid_t': unsigned int, '__ino64_t': unsigned long long,'__ino_t': unsigned long, '__int128': int128_t, '__int256': int256_t,'__mbstate_t': struct __mbstate_t, '__mode_t': unsigned int, '__nlink_t':
unsigned int, '__off64_t': long long, '__off_t': long, '__pid_t': int,'__suseconds_t': int64_t, '__time_t': long, '__uid_t': unsigned int,'_obstack_chunk': struct _obstack_chunk, 'aiocb': struct aiocb, 'aiocb64': structaiocb64, 'aioinit': struct aioinit, 'argp': struct argp, 'argp_child': structargp_child, 'argp_option': struct argp_option, 'argp_parser_t': (int, char*,struct argp_state*) -> int, 'argp_state': struct argp_state, 'basic_string':
string_t, 'bool': bool, 'byte': uint8_t, 'cc_t': char, 'char': char, 'clock_t':
uint32_t, 'crypt_data': struct crypt_data, 'dirent': struct dirent, 'dirent64':
struct dirent64, 'double': double, 'drand48_data': struct <anon>, 'dword':
uint32_t, 'error_t': int, 'exit_status': struct exit_status, 'float': float,'fstab': struct fstab, 'group': struct group, 'hostent': struct hostent,'hsearch_data': struct hsearch_data, 'if_nameindex': struct if_nameindex,'in_addr': struct in_addr, 'in_port_t': uint16_t, 'ino64_t': unsigned long long,'ino_t': unsigned long, 'int': int, 'int16_t': int16_t, 'int32_t': int32_t,'int64_t': int64_t, 'int8_t': int8_t, 'iovec': struct <anon>, 'itimerval':
struct itimerval, 'lconv': struct lconv, 'long': long, 'long double': double,'long int': long, 'long long': long long, 'long long int': long long, 'long
signed': long, 'long unsigned int': unsigned long, 'mallinfo': struct mallinfo,'mallinfo2': struct mallinfo2, 'mntent': struct mntent, 'netent': struct netent,'ntptimeval': struct ntptimeval, 'obstack': struct obstack, 'off64_t': long long,'off_t': long, 'option': struct option, 'passwd': struct passwd, 'pid_t': int,
'printf_info': struct printf_info, 'protoent': struct protoent, 'ptrdiff_t':long, 'qword': uint64_t, 'random_data': struct <anon>, 'rlim64_t': uint64_t,'rlim_t': unsigned long, 'rlimit': struct rlimit, 'rlimit64': struct rlimit64,'rusage': struct rusage, 'sa_family_t': unsigned short, 'sched_param': structsched_param, 'sembuf': struct sembuf, 'servent': struct servent, 'sgttyb': structsgttyb, 'short': short, 'short int': short, 'sigevent': struct sigevent,'signed': int, 'signed char': char, 'signed int': int, 'signed long': long,'signed long int': long, 'signed long long': long long, 'signed long long int':
long long, 'signed short': short, 'signed short int': short, 'sigstack': struct
sigstack, 'sigval': union sigval { sival_int int; sival_ptr void*; }, 'size_t':
size_t, 'sockaddr': struct sockaddr, 'sockaddr_in': struct sockaddr_in, 'speed_t':long, 'ssize': size_t, 'ssize_t': size_t, 'stat': struct stat, 'stat64': struct
stat64, 'string': string_t, 'struct iovec': struct iovec, 'struct timespec':
struct timespec, 'struct timeval': struct timeval, 'tcflag_t': unsigned long,'termios': struct termios, 'time_t': long, 'timespec': struct timeval, 'timeval':
struct timeval, 'timex': struct timex, 'timezone': struct timezone, 'tm': struct
tm, 'tms': struct tms, 'uint16_t': uint16_t, 'uint32_t': uint32_t, 'uint64_t':
uint64_t, 'uint8_t': uint8_t, 'uintptr_t': unsigned long, 'unsigned': unsigned
int, 'unsigned __int128': uint128_t, 'unsigned __int256': uint256_t, 'unsigned
char': char, 'unsigned int': unsigned int, 'unsigned long': unsigned long,'unsigned long int': unsigned long, 'unsigned long long': unsigned long long,'unsigned long long int': unsigned long long, 'unsigned short': unsigned short,'unsigned short int': unsigned short, 'utimbuf': struct utimbuf, 'utmp': structutmp, 'utmpx': struct utmx, 'utsname': struct utsname, 'va_list': structva_list[1], 'void': void, 'vtimes': struct vtimes, 'wchar_t': short, 'winsize':
struct winsize, 'word': uint16_t, 'wstring': wstring_t}
388

Chapter 10. API Referenceangrstate:

angr.SimState = None

struct:StructModewith_type(sim_type)
Returns a copy of the SimMemView with a type.
Parameters
sim_type (SimType) – The new type.
Return type
SimMemView
Returns
The typed SimMemView copy.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters10.4. Storage

389

angr

• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
property resolvable
property resolved
property concrete
property deref:

SimMemView

array(n)Return type
SimMemView
member(member_name)If self is a struct and member_name is a member of the struct, return that member element. Otherwise raise
an exception.
Return type
SimMemView
Parameters
member_name (str)store(value)class angr.state_plugins.view.StructMode(view)
Bases: object__init__(view)class angr.storage.file.Flags
Bases: object
O_RDONLY = 0
O_WRONLY = 1

390

Chapter 10. API Referenceangr

O_RDWR = 2
O_ACCMODE = 3
O_APPEND = 1024
O_ASYNC = 8192
O_CLOEXEC = 524288
O_CREAT = 64
O_DIRECT = 16384
O_DIRECTORY = 65536
O_DSYNC = 4096
O_EXCL = 128
O_LARGEFILE = 32768
O_NOATIME = 262144
O_NOCTTY = 256
O_NOFOLLOW = 131072
O_NONBLOCK = 2048
O_NDELAY = 2048
O_PATH = 2097152
O_SYNC = 1052672
O_TMPFILE = 4259840
O_TRUNC = 512class angr.storage.file.SimFileBase(name=None, writable=True, ident=None, concrete=False,
file_exists=True, **kwargs)
Bases: SimStatePlugin
SimFiles are the storage mechanisms used by SimFileDescriptors.
Different types of SimFiles can have drastically different interfaces, and as a result there’s not much that canbe specified on this base class. All the read and write methods take a pos argument, which may have different
semantics per-class. 0 will always be a valid position to use, though, and the next position you should use is partof the return tuple.
Some simfiles are “streams”, meaning that the position that reads come from is determined not by the position
you pass in (it will in fact be ignored), but by an internal variable. This is stored as .pos if you care to read it.
Don’t write to it. The same lack-of-semantics applies to this field as well.
Variables• name – The name of the file. Purely for cosmetic purposes• ident – The identifier of the file, typically autogenerated from the name and a nonce. Purely
for cosmetic purposes, but does appear in symbolic values autogenerated in the file.

10.4. Storage

391

angr

• seekable – Bool indicating whether seek operations on this file should succeed. If this is
True, then pos must be a number of bytes from the start of the file.
• writable – Bool indicating whether writing to this file is allowed.
• pos – If the file is a stream, this will be the current position. Otherwise, None.
• concrete – Whether or not this file contains mostly concrete data. Will be used by some
SimProcedures to choose how to handle variable-length operations like fgets.
• file_exists – Set to False, if file does not exists, set to a claripy Bool if unknown, default
True.
seekable = False
pos = None__init__(name=None, writable=True, ident=None, concrete=False, file_exists=True, **kwargs)
static make_ident(name)concretize(**kwargs)
Return a concretization of the contents of the file. The type of the return value of this method will varydepending on which kind of SimFile you’re using.
read(pos, size, **kwargs)
Read some data from the file.
Parameters• pos – The offset in the file to read from.
• size – The size to read. May be symbolic.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read), theactual size of the read, and the new file position pointer.
write(pos, data, size=None, **kwargs)
Write some data to the file.
Parameters• pos – The offset in the file to write to. May be ignored if the file is a stream or device.
• data – The data to write as a bitvector• size – The optional size of the data to write. If not provided will default to the length ofthe data. Must be constrained to less than or equal to the size of the data.
Returns
The new file position pointer.
property size
The number of data bytes stored by the file at present. May be a symbolic value.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo

392

Chapter 10. API Referenceangr

The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
state:

angr.SimState

class angr.storage.file.SimFile(name=None, content=None, size=None, has_end=None, seekable=True,
writable=True, ident=None, concrete=None, **kwargs)
Bases: SimFileBase, DefaultMemory
The normal SimFile is meant to model files on disk. It subclasses SimSymbolicMemory so loads and stores
to/from it are very simple.
Parameters• name – The name of the file• content – Optional initial content for the file as a string or bitvector• size – Optional size of the file. If content is not specified, it defaults to zero• has_end – Whether the size boundary is treated as the end of the file or a frontier atwhich new content will be generated. If unspecified, will pick its value based on options.FILES_HAVE_EOF. Another caveat is that if the size is also unspecified this value
will default to False.
• seekable – Optional bool indicating whether seek operations on this file should succeed,
default True.
• writable – Whether writing to this file is allowed• concrete – Whether or not this file contains mostly concrete data. Will be used by some
SimProcedures to choose how to handle variable-length operations like fgets.
Variables
has_end – Whether this file has an EOF__init__(name=None, content=None, size=None, has_end=None, seekable=True, writable=True,
ident=None, concrete=None, **kwargs)
property categoryreg, mem, or file.
Type
Return the category of this SimMemory instance. It can be one of the three following categories
set_state(state)
Sets a new state (for example, if the state has been branched)property size
The number of data bytes stored by the file at present. May be a symbolic value.
concretize(**kwargs)
Return a concretization of the contents of the file, as a flat bytestring.
read(pos, size, **kwargs)
Read some data from the file.

10.4. Storage

393

angr

Parameters• pos – The offset in the file to read from.
• size – The size to read. May be symbolic.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read), theactual size of the read, and the new file position pointer.
write(pos, data, size=None, events=True, **kwargs)
Write some data to the file.
Parameters• pos – The offset in the file to write to. May be ignored if the file is a stream or device.
• data – The data to write as a bitvector• size – The optional size of the data to write. If not provided will default to the length ofthe data. Must be constrained to less than or equal to the size of the data.
Returns
The new file position pointer.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

394

Chapter 10. API ReferenceangrDuring static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.storage.file.SimFileStream(name=None, content=None, pos=0, **kwargs)
Bases: SimFile
A specialized SimFile that uses a flat memory backing, but functions as a stream, tracking its position internally.
The pos argument to the read and write methods will be ignored, and will return None. Instead, there is an
attribute pos on the file itself, which will give you what you want.
Parameters• name – The name of the file, for cosmetic purposes• pos – The initial position of the file, default zero• kwargs – Any other keyword arguments will go on to the SimFile constructor.
Variables
pos – The current position in the file.
__init__(name=None, content=None, pos=0, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)read(pos, size, **kwargs)
Read some data from the file.
Parameters• pos – The offset in the file to read from.
10.4. Storage

395

angr

• size – The size to read. May be symbolic.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read), theactual size of the read, and the new file position pointer.
write(_, data, size=None, **kwargs)
Write some data to the file.
Parameters• pos – The offset in the file to write to. May be ignored if the file is a stream or device.
• data – The data to write as a bitvector• size – The optional size of the data to write. If not provided will default to the length ofthe data. Must be constrained to less than or equal to the size of the data.
Returns
The new file position pointer.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit

396

Chapter 10. API ReferenceangrThere is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolclass angr.storage.file.SimPackets(name, write_mode=None, content=None, writable=True, ident=None,**kwargs)
Bases: SimFileBase
The SimPackets is meant to model inputs whose content is delivered a series of asynchronous chunks. The datais stored as a list of read or write results. For symbolic sizes, state.libc.max_packet_size will be respected. If the
SHORT_READS option is enabled, reads will return a symbolic size constrained to be less than or equal to therequested size.
A SimPackets cannot be used for both reading and writing - for socket objects that can be both read and written to you should use a file descriptor to multiplex the read and write operations into two separate file storage
mechanisms.
Parameters• name – The name of the file, for cosmetic purposes• write_mode – Whether this file is opened in read or write mode. If this is unspecified it will
be autodetected.
• content – Some initial content to use for the file. Can be a list of bytestrings or a list oftuples of content ASTs and size ASTs.
Variables• write_mode – See the eponymous parameter• content – A list of packets, as tuples of content ASTs and size ASTs.
__init__(name, write_mode=None, content=None, writable=True, ident=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)property size
The number of data bytes stored by the file at present. May be a symbolic value.
concretize(**kwargs)
Returns a list of the packets read or written as bytestrings.
read(pos, size, **kwargs)
Read a packet from the stream.
Parameters10.4. Storage

397

angr

• pos (int) – The packet number to read from the sequence of the stream. May be None toappend to the stream.
• size – The size to read. May be symbolic.
• short_reads – Whether to replace the size with a symbolic value constrained to less thanor equal to the original size. If unspecified, will be chosen based on the state option.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read) andthe actual size of the read.
write(pos, data, size=None, events=True, **kwargs)
Write a packet to the stream.
Parameters• pos (int) – The packet number to write in the sequence of the stream. May be None toappend to the stream.
• data – The data to write, as a string or bitvector.
• size – The optional size to write. May be symbolic; must be constrained to at most thesize of data.
Returns
The next packet to use after thiscopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,(continues on next page)

398

Chapter 10. API Referenceangr(continued from previous page)

common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.storage.file.SimPacketsStream(name, pos=0, **kwargs)
Bases: SimPackets
A specialized SimPackets that tracks its position internally.
The pos argument to the read and write methods will be ignored, and will return None. Instead, there is an
attribute pos on the file itself, which will give you what you want.
Parameters• name – The name of the file, for cosmetic purposes• pos – The initial position of the file, default zero• kwargs – Any other keyword arguments will go on to the SimPackets constructor.
Variables
pos – The current position in the file.
__init__(name, pos=0, **kwargs)read(pos, size, **kwargs)
Read a packet from the stream.
Parameters10.4. Storage

399

angr

• pos (int) – The packet number to read from the sequence of the stream. May be None toappend to the stream.
• size – The size to read. May be symbolic.
• short_reads – Whether to replace the size with a symbolic value constrained to less thanor equal to the original size. If unspecified, will be chosen based on the state option.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read) andthe actual size of the read.
write(_, data, size=None, **kwargs)
Write a packet to the stream.
Parameters• pos (int) – The packet number to write in the sequence of the stream. May be None toappend to the stream.
• data – The data to write, as a string or bitvector.
• size – The optional size to write. May be symbolic; must be constrained to at most thesize of data.
Returns
The next packet to use after thiscopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,(continues on next page)

400

Chapter 10. API Referenceangr(continued from previous page)

common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolclass angr.storage.file.SimFileDescriptorBase
Bases: SimStatePlugin
The base class for implementations of POSIX file descriptors.
All file descriptors should respect the CONCRETIZE_SYMBOLIC_{READ,WRITE}_SIZES state options.
read(pos, size, **kwargs)
Reads some data from the file, storing it into memory.
Parameters• pos – The address to read data from file• size – The requested length of the read
Returns
The real length of the read
write(pos, size, **kwargs)
Writes some data, loaded from the state, into the file.
Parameters• pos – The address to read the data to write from in memory• size – The requested size of the write
Returns
The real length of the write
read_data(size, **kwargs)
Reads some data from the file, returning the data.
Parameters
size – The requested length of the read
Returns
A tuple of the data read and the real length of the read

10.4. Storage

401

angr

write_data(data, size=None, **kwargs)
Write some data, provided as an argument into the file.
Parameters• data – A bitvector to write into the file• size – The requested size of the write (may be symbolic)
Returns
The real length of the writeseek(offset, whence='start')
Seek the file descriptor to a different position in the file.
Parameters• offset – The offset to seek to, interpreted according to whence• whence – What the offset is relative to; one of the strings “start”, “current”, or “end”
Returns
A symbolic boolean describing whether the seek succeeded or nottell()
Return the current position, or None if the concept doesn’t make sense for the given file.
eof()
Return the EOF status. May be a symbolic boolean.
size()
Return the size of the data stored in the file in bytes, or None if the concept doesn’t make sense for the given
file.
property read_storage
Return the SimFile backing reads from this fd
property write_storage
Return the SimFile backing writes to this fd
property read_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
property write_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
concretize(**kwargs)
Return a concretizeation of the data in the underlying file. Has different return types to represent different
data structures on a per-class basis.
Any arguments passed to this will be passed onto state.solver.eval.
property file_exists
This should be True in most cases. Only if we opened an fd of unknown existence, ALL_FILES_EXIST is
False and ANY_FILE_MIGHT_EXIST is True, this is a symbolic boolean.

402

Chapter 10. API Referenceangrclass angr.storage.file.SimFileDescriptor(simfile, flags=0)
Bases: SimFileDescriptorBase
A simple file descriptor forwarding reads and writes to a SimFile. Contains information about the current opened
state of the file, such as the flags or (if relevant) the current position.
Variables• file – The SimFile described to by this descriptor• flags – The mode that the file descriptor was opened with, a bitfield of flags__init__(simfile, flags=0)
read_data(size, **kwargs)
Reads some data from the file, returning the data.
Parameters
size – The requested length of the read
Returns
A tuple of the data read and the real length of the read
write_data(data, size=None, **kwargs)
Write some data, provided as an argument into the file.
Parameters• data – A bitvector to write into the file• size – The requested size of the write (may be symbolic)
Returns
The real length of the writeseek(offset, whence='start')
Seek the file descriptor to a different position in the file.
Parameters• offset – The offset to seek to, interpreted according to whence• whence – What the offset is relative to; one of the strings “start”, “current”, or “end”
Returns
A symbolic boolean describing whether the seek succeeded or not
eof()
Return the EOF status. May be a symbolic boolean.
tell()
Return the current position, or None if the concept doesn’t make sense for the given file.
size()
Return the size of the data stored in the file in bytes, or None if the concept doesn’t make sense for the given
file.
concretize(**kwargs)
Return a concretization of the underlying file. Returns whatever format is preferred by the file.
property file_exists
This should be True in most cases. Only if we opened an fd of unknown existence, ALL_FILES_EXIST is
False and ANY_FILE_MIGHT_EXIST is True, this is a symbolic boolean.

10.4. Storage

403

angr

property read_storage
Return the SimFile backing reads from this fd
property write_storage
Return the SimFile backing writes to this fd
property read_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
property write_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit

404

Chapter 10. API ReferenceangrThere is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.storage.file.SimFileDescriptorDuplex(read_file, write_file)
Bases: SimFileDescriptorBase
A file descriptor that refers to two file storage mechanisms, one to read from and one to write to. As a result,operations like seek, eof, etc no longer make sense.
Parameters• read_file – The SimFile to read from• write_file – The SimFile to write to__init__(read_file, write_file)
read_data(size, **kwargs)
Reads some data from the file, returning the data.
Parameters
size – The requested length of the read
Returns
A tuple of the data read and the real length of the read
write_data(data, size=None, **kwargs)
Write some data, provided as an argument into the file.
Parameters• data – A bitvector to write into the file• size – The requested size of the write (may be symbolic)10.4. Storage

405

angr

Returns
The real length of the write
set_state(state)
Sets a new state (for example, if the state has been branched)eof()
Return the EOF status. May be a symbolic boolean.
tell()
Return the current position, or None if the concept doesn’t make sense for the given file.
seek(offset, whence='start')
Seek the file descriptor to a different position in the file.
Parameters• offset – The offset to seek to, interpreted according to whence• whence – What the offset is relative to; one of the strings “start”, “current”, or “end”
Returns
A symbolic boolean describing whether the seek succeeded or notsize()
Return the size of the data stored in the file in bytes, or None if the concept doesn’t make sense for the given
file.
concretize(**kwargs)
Return a concretization of the underlying files, as a tuple of (read file, write file).
property read_storage
Return the SimFile backing reads from this fd
property write_storage
Return the SimFile backing writes to this fd
property read_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
property write_pos
Return the current position of the read file pointer.
If the underlying read file is a stream, this will return the position of the stream. Otherwise, will return theposition of the file descriptor in the file.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
406

Chapter 10. API Referenceangrmerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.storage.file.SimPacketsSlots(name, read_sizes, ident=None, **kwargs)
Bases: SimFileBase
SimPacketsSlots is the new SimDialogue, if you’ve ever seen that before.

10.4. Storage

407

angr

The idea is that in some cases, the only thing you really care about is getting the lengths of reads right, and someof them should be short reads, and some of them should be truncated. You provide to this class a list of read
lengths, and it figures out the length of each read, and delivers some content.
This class will NOT respect the position argument you pass it - this storage is not stateless.
seekable = False__init__(name, read_sizes, ident=None, **kwargs)
concretize(**kwargs)
Return a concretization of the contents of the file. The type of the return value of this method will varydepending on which kind of SimFile you’re using.
read(pos, size, **kwargs)
Read some data from the file.
Parameters• pos – The offset in the file to read from.
• size – The size to read. May be symbolic.
Returns
A tuple of the data read (a bitvector of the length that is the maximum length of the read), theactual size of the read, and the new file position pointer.
write(pos, data, size=None, **kwargs)
Write some data to the file.
Parameters• pos – The offset in the file to write to. May be ignored if the file is a stream or device.
• data – The data to write as a bitvector• size – The optional size of the data to write. If not provided will default to the length ofthe data. Must be constrained to less than or equal to the size of the data.
Returns
The new file position pointer.
property size
The number of data bytes stored by the file at present. May be a symbolic value.
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

408

Chapter 10. API Referenceangrmerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(_)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
angr.storage.memory_object.obj_bit_size(o)10.4. Storage

409

angr

class angr.storage.memory_object.SimMemoryObject(obj, base, endness, length=None, byte_width=8)
Bases: object
A SimMemoryObject is a reference to a byte or several bytes in a specific object in memory. It should be used
only by the bottom layer of memory.
__init__(obj, base, endness, length=None, byte_width=8)
is_bytesbaseobjectlengthendnesssize()
property variables
property symbolic
property last_addr
concrete_bytes(offset, size)
Return typebytes | None
Parameters• offset (int)• size (int)includes(x)bytes_at(addr, length, allow_concrete=False, endness='Iend_BE')
class angr.storage.memory_object.SimLabeledMemoryObject(obj, base, endness, length=None,byte_width=8, label=None)
Bases: SimMemoryObject
SimLabeledMemoryObject is a SimMemoryObject with a label__init__(obj, base, endness, length=None, byte_width=8, label=None)labelangr.storage.memory_object.bv_slice(value, offset, size, rev, bw)
Extremely cute utility to pretend you’ve serialized a value to stored bytes, sliced it a la python slicing, and thendeserialized those bytes to an integer again.
Parameters• value (BV) – The bitvector to slice• offset (int) – The byte offset from the first stored byte to slice from, or a negative offset
from the end.

410

Chapter 10. API Reference

angr• size (int) – The number of bytes to return. If None, return all bytes from the offset to theend. If larger than the number of bytes from the offset to the end, return all bytes from theoffset to the end.
• rev (bool) – Whether the pretend-serialization should be little-endian• bw (int) – The byte width
Return type
BV
Returns
The new bitvector
class angr.concretization_strategies.SimConcretizationStrategy(filter=None, exact=True)
Bases: object
Concretization strategies control the resolution of symbolic memory indices in SimuVEX. By subclassing this class and setting it as a concretization strategy (on state.memory.read_strategies andstate.memory.write_strategies), SimuVEX’s memory index concretization behavior can be modified.
__init__(filter=None, exact=True)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
concretize(memory, addr, **kwargs)
Concretizes the address into a list of values. If this strategy cannot handle this address, returns None.
copy()
Returns a copy of the strategy, if there is data that should be kept separate between states. If not, returns
self.
merge(others)
Merges this strategy with others (if there is data that should be kept separate between states. If not, is a
no-op.
class angr.concretization_strategies.SimConcretizationStrategyAny(filter=None, exact=True)
Bases: SimConcretizationStrategy
Concretization strategy that returns any single solution.
class angr.concretization_strategies.SimConcretizationStrategyControlledData(limit,
fixed_addrs,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that constraints the address to controlled data. Controlled data consists of symbolic data
and the addresses given as arguments. memory.
__init__(limit, fixed_addrs, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters10.4. Storage

411

angr

• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.SimConcretizationStrategyEval(limit, **kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves an address into some limited number of solutions. Always handles theconcretization, but only returns a maximum of limit number of solutions. Therefore, should only be used as the
fallback strategy.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.SimConcretizationStrategyMax(max_addr=None)
Bases: SimConcretizationStrategy
Concretization strategy that returns the maximum address.
Parameters
max_addr (int | None)__init__(max_addr=None)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
• max_addr (int | None)class angr.concretization_strategies.SimConcretizationStrategyNonzero(filter=None,exact=True)
Bases: SimConcretizationStrategy
Concretization strategy that returns any non-zero solution.
class angr.concretization_strategies.SimConcretizationStrategyNonzeroRange(limit, **kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves a range in a non-zero location.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.

412

Chapter 10. API Referenceangr• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.SimConcretizationStrategyNorepeats(repeat_expr, repeat_constraints=None,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves addresses, without repeating.
__init__(repeat_expr, repeat_constraints=None, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
copy()
Returns a copy of the strategy, if there is data that should be kept separate between states. If not, returns
self.
merge(others)
Merges this strategy with others (if there is data that should be kept separate between states. If not, is a
no-op.
class angr.concretization_strategies.SimConcretizationStrategyNorepeatsRange(repeat_expr,
min=None,granularity=None,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves a range, with no repeats.
__init__(repeat_expr, min=None, granularity=None, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
copy()
Returns a copy of the strategy, if there is data that should be kept separate between states. If not, returns
self.
merge(others)
Merges this strategy with others (if there is data that should be kept separate between states. If not, is a
no-op.
class angr.concretization_strategies.SimConcretizationStrategyRange(limit, **kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves addresses to a range.
10.4. Storage

413

angr

__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.SimConcretizationStrategySingle(filter=None, exact=True)
Bases: SimConcretizationStrategy
Concretization strategy that ensures a single solution for an address.
class angr.concretization_strategies.SimConcretizationStrategySolutions(limit, **kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves an address into some limited number of solutions.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.SimConcretizationStrategyUnlimitedRange(limit,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves addresses to a range without checking if the number of possible addresses
is within the limit.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.

10.5 Memory Mixins
class angr.storage.memory_mixins.ActionsMixinHigh(memory_id=None, endness='Iend_BE')Bases: MemoryMixinload(addr, size=None, condition=None, fallback=None, disable_actions=False, action=None, **kwargs)
store(addr, data, size=None, disable_actions=False, action=None, condition=None, **kwargs)

414

Chapter 10. API Referenceangrclass angr.storage.memory_mixins.ActionsMixinLow(memory_id=None, endness='Iend_BE')Bases: MemoryMixinload(addr, action=None, **kwargs)
store(addr, data, action=None, **kwargs)
Parameters
action (SimActionData | None)class angr.storage.memory_mixins.AddressConcretizationMixin(read_strategies=None,
write_strategies=None, **kwargs)
Bases: MemoryMixin
The address concretization mixin allows symbolic reads and writes to be handled sanely by dispatching them as
a number of conditional concrete reads/writes. It provides a “concretization strategies” interface allowing theprocess of serializing symbolic addresses into concrete ones to be specified.
__init__(read_strategies=None, write_strategies=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

10.5. Memory Mixins

415

angr

During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
concretize_write_addr(addr, strategies=None, condition=None)Concretizes an address meant for writing.
Parameters• addr – An expression for the address.
• strategies – A list of concretization strategies (to override the default).
• condition – Any extra constraints that should be observed when determining address
satisfiability
Returns
A list of concrete addresses.
concretize_read_addr(addr, strategies=None, condition=None)Concretizes an address meant for reading.
Parameters• addr – An expression for the address.
• strategies – A list of concretization strategies (to override the default).
Returns
A list of concrete addresses.
load(addr, size=None, condition=None, **kwargs)
store(addr, data, size=None, condition=None, **kwargs)
permissions(addr, permissions=None, **kwargs)
map_region(addr, length, permissions, **kwargs)
unmap_region(addr, length, **kwargs)
concrete_load(addr, size, *args, **kwargs)
Set SUPPORTS_CONCRETE_LOAD to True and implement concrete_load if reading concrete bytes isfaster in this memory model.
Parameters• addr – The address to load from.
416

Chapter 10. API Reference

angr• size – Size of the memory read.
• writing
Returns
A memoryview into the loaded bytes.
class angr.storage.memory_mixins.DataNormalizationMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
Normalizes the data field for a store and the fallback field for a load to be BVs.
store(addr, data, size=None, **kwargs)load(addr, size=None, fallback=None, **kwargs)
class angr.storage.memory_mixins.InspectMixinHigh(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
store(addr, data, size=None, condition=None, endness=None, inspect=True, **kwargs)load(addr, size=None, condition=None, endness=None, inspect=True, **kwargs)
class angr.storage.memory_mixins.ConditionalMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixinload(addr, condition=None, fallback=None, **kwargs)
store(addr, data, size=None, condition=None, **kwargs)
class angr.storage.memory_mixins.ConvenientMappingsMixin(**kwargs)
Bases: MemoryMixin
Implements mappings between names and hashes of symbolic variables and these variables themselves.
__init__(**kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
store(addr, data, size=None, **kwargs)
get_symbolic_addrs()
addrs_for_name(n)Returns addresses that contain expressions that contain a variable named n.
addrs_for_hash(h)Returns addresses that contain expressions that contain a variable with the hash of h.

10.5. Memory Mixins

417

angr

replace_all(old, new)Replaces all instances of expression old with expression new.
Parameters• old (BV) – A claripy expression. Must contain at least one named variable (to make itpossible to use the name index for speedup).
• new (BV) – The new variable to replace it with.
class angr.storage.memory_mixins.DefaultFillerMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
class angr.storage.memory_mixins.SpecialFillerMixin(special_memory_filler=None, **kwargs)
Bases: MemoryMixin__init__(special_memory_filler=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.ExplicitFillerMixin(uninitialized_read_handler=None, **kwargs)
Bases: MemoryMixin__init__(uninitialized_read_handler=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.DirtyAddrsMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
store(addr, data, size=None, **kwargs)
class angr.storage.memory_mixins.HexDumperMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin

418

Chapter 10. API Referenceangrhex_dump(start, size, word_size=4, words_per_row=4, endianness='Iend_BE', symbolic_char='?',
unprintable_char='.', solve=False, extra_constraints=None, inspect=False,
disable_actions=True)
Returns a hex dump as a string. The solver, if enabled, is called once for every byte potentially making thisfunction very slow. It is meant to be used mainly as a “visualization” for debugging.
Warning: May read and display more bytes than size due to rounding. Particularly, if size is less than, or
not a multiple of word_size*words_per_line.
Parameters• start – starting address from which to print• size – number of bytes to display• word_size – number of bytes to group together as one space-delimited unit
• words_per_row – number of words to display per row of output• endianness – endianness to use when displaying each word (ASCII representation is unchanged)• symbolic_char – the character to display when a byte is symbolic and has multiple solutions• unprintable_char – the character to display when a byte is not printable• solve – whether or not to attempt to solve (warning: can be very slow)• extra_constraints – extra constraints to pass to the solver is solve is True
• inspect – whether or not to trigger SimInspect breakpoints for the memory load
• disable_actions – whether or not to disable SimActions for the memory load
Returnshex dump as a stringclass angr.storage.memory_mixins.LabelMergerMixin(*args, **kwargs)
Bases: MemoryMixin
A memory mixin for merging labels. Labels come from SimLabeledMemoryObject.
__init__(*args, **kwargs)
copy(memo=None)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.MultiValueMergerMixin(*args, element_limit=5,
annotation_limit=256, top_func=None,
is_top_func=None, phi_maker=None,merge_into_top=True, **kwargs)
Bases: MemoryMixin
10.5. Memory Mixins

419

angr

__init__(*args, element_limit=5, annotation_limit=256, top_func=None, is_top_func=None,
phi_maker=None, merge_into_top=True, **kwargs)
copy(memo=None)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.NameResolutionMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
This mixin allows you to provide register names as load addresses, and will automatically translate this to anoffset and size.
store(addr, data, size=None, **kwargs)load(addr, size=None, **kwargs)
class angr.storage.memory_mixins.SimplificationMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
store(addr, data, **kwargs)
class angr.storage.memory_mixins.SimpleInterfaceMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixinload(addr, size=None, endness=None, condition=None, fallback=None, **kwargs)
store(addr, data, size=None, endness=None, condition=None, **kwargs)
class angr.storage.memory_mixins.SizeNormalizationMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
Provides basic services related to normalizing sizes. After this mixin, sizes will always be a plain int. Assumes
that the data is a BV.
• load will throw a TypeError if no size is provided• store will default to len(data)//byte_width if no size is provided
load(addr, size=None, **kwargs)
store(addr, data, size=None, **kwargs)
class angr.storage.memory_mixins.SizeConcretizationMixin(concretize_symbolic_write_size=False,
max_concretize_count=256,
max_symbolic_size=4194304,
raise_memory_limit_error=False,
size_limit=257, **kwargs)
Bases: MemoryMixin
This mixin allows memory to process symbolic sizes. It will not touch any sizes which are not ASTs with nonBVV ops. Assumes that the data is a BV.
420

Chapter 10. API Referenceangr• symbolic load sizes will be concretized as their maximum and a warning will be logged• symbolic store sizes will be dispatched as several conditional stores with concrete sizes
Parameters• concretize_symbolic_write_size (bool)• max_concretize_count (int | None)• max_symbolic_size (int)• raise_memory_limit_error (bool)• size_limit (int)__init__(concretize_symbolic_write_size=False, max_concretize_count=256,
max_symbolic_size=4194304, raise_memory_limit_error=False, size_limit=257, **kwargs)
Parameters• concretize_symbolic_write_size (bool)• max_concretize_count (int | None)• max_symbolic_size (int)• raise_memory_limit_error (bool)• size_limit (int)copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, **kwargs)
store(addr, data, size=None, condition=None, **kwargs)
class angr.storage.memory_mixins.SmartFindMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
Memory mixin providing basic searching over concrete and symbolic data.
find(addr, data, max_search, default=None, endness=None, chunk_size=None, max_symbolic_bytes=None,condition=None, char_size=1, **kwargs)
class angr.storage.memory_mixins.SymbolicMergerMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
class angr.storage.memory_mixins.TopMergerMixin(*args, top_func=None, **kwargs)
Bases: MemoryMixin
A memory mixin for merging values in memory to TOP.

10.5. Memory Mixins

421

angr

__init__(*args, top_func=None, **kwargs)
copy(memo=None)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.UnderconstrainedMixin(*args, **kwargs)
Bases: MemoryMixin__init__(*args, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, **kwargs)
store(addr, data, **kwargs)
class angr.storage.memory_mixins.UnwrapperMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
This mixin processes SimActionObjects by passing on their .ast field.
store(addr, data, size=None, condition=None, **kwargs)load(addr, size=None, condition=None, fallback=None, **kwargs)
find(addr, what, max_search, default=None, **kwargs)
copy_contents(dst, src, size, condition=None, **kwargs)
Override this method to provide faster copying of large chunks of data.
Parameters• dst – The destination of copying.
• src – The source of copying.
• size – The size of copying.
• condition – The storing condition.

422

Chapter 10. API Referenceangr• kwargs – Other parameters.
ReturnsNoneclass angr.storage.memory_mixins.ClemoryBackerMixin(cle_memory_backer=None, **kwargs)
Bases: PagedMemoryMixin
Parameters
cle_memory_backer (None | cle.Loader | cle.Clemory)__init__(cle_memory_backer=None, **kwargs)
Parameters
cle_memory_backer (None | Loader | Clemory)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.ConcreteBackerMixin(cle_memory_backer=None, **kwargs)
Bases: ClemoryBackerMixin
Parameters
cle_memory_backer (None | cle.Loader | cle.Clemory)class angr.storage.memory_mixins.DictBackerMixin(dict_memory_backer=None, **kwargs)
Bases: PagedMemoryMixin__init__(dict_memory_backer=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.PagedMemoryMixin(page_size=4096, default_permissions=3,
permissions_map=None, page_kwargs=None,**kwargs)
Bases: MemoryMixin
A bottom-level storage mechanism. Dispatches reads to individual pages, the type of which is the PAGE_TYPE
class variable.
10.5. Memory Mixins

423

angr

SUPPORTS_CONCRETE_LOAD = True
PAGE_TYPE: type[PageType] = None__init__(page_size=4096, default_permissions=3, permissions_map=None, page_kwargs=None,**kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, endness=None, **kwargs)
Parameters• addr (int)• size (int | None)store(addr, data, size=None, endness=None, **kwargs)
Parameters• addr (int)• size (int | None)erase(addr, size=None, **kwargs)
Set [addr:addr+size) to uninitialized. In many cases this will be faster than overwriting those locations withnew values. This is commonly used during static data flow analysis.
Parameters• addr – The address to start erasing.
• size – The number of bytes for erasing.
Return type
None
ReturnsNonemerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.

424

Chapter 10. API ReferenceangrThere will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (Iterable[PagedMemoryMixin]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
compare(other)
Return typebool
Parameters
other (PagedMemoryMixin)
permissions(addr, permissions=None, **kwargs)
map_region(addr, length, permissions, init_zero=False, **kwargs)
unmap_region(addr, length, **kwargs)
concrete_load(addr, size, writing=False, with_bitmap=False, **kwargs)
Set SUPPORTS_CONCRETE_LOAD to True and implement concrete_load if reading concrete bytes isfaster in this memory model.
Parameters• addr – The address to load from.
• size – Size of the memory read.
• writing
Returns
A memoryview into the loaded bytes.

10.5. Memory Mixins

425

angr

changed_bytes(other)
Return typeset[int]changed_pages(other)
Return type
dict[int, set[int] | None]copy_contents(dst, src, size, condition=None, **kwargs)
Override this method to provide faster copying of large chunks of data.
Parameters• dst – The destination of copying.
• src – The source of copying.
• size – The size of copying.
• condition – The storing condition.
• kwargs – Other parameters.
ReturnsNoneflush_pages(white_list)
Flush all pages not included in the white_list by removing their pages. Note, this will not wipe them frommemory if they were backed by a memory_backer, it will simply reset them to their initial state. Returns
the list of pages that were cleared consisting of (addr, length) tuples. :type white_list: :param white_list:
white list of regions in the form of (start, end) to exclude from the flush :return: a list of memory page
ranges that were flushed :rtype: list
class angr.storage.memory_mixins.ListPagesMixin(page_size=4096, default_permissions=3,
permissions_map=None, page_kwargs=None,**kwargs)
Bases: PagedMemoryMixin
PAGE_TYPE
alias of ListPageclass angr.storage.memory_mixins.UltraPagesMixin(page_size=4096, default_permissions=3,
permissions_map=None, page_kwargs=None,**kwargs)
Bases: PagedMemoryMixin
PAGE_TYPE
alias of UltraPage
class angr.storage.memory_mixins.ListPagesWithLabelsMixin(page_size=4096,
default_permissions=3,
permissions_map=None,
page_kwargs=None, **kwargs)
Bases: LabeledPagesMixin, ListPagesMixin
class angr.storage.memory_mixins.MVListPagesMixin(*args,
skip_missing_values_during_merging=False,**kwargs)

426

Chapter 10. API ReferenceangrBases: PagedMemoryMixin
PAGE_TYPE
alias of MVListPage__init__(*args, skip_missing_values_during_merging=False, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.MVListPagesWithLabelsMixin(*args,
skip_missing_values_during_merging=False,**kwargs)
Bases: LabeledPagesMixin, MVListPagesMixin
class angr.storage.memory_mixins.PrivilegedPagingMixin(page_size=4096, default_permissions=3,
permissions_map=None,
page_kwargs=None, **kwargs)
Bases: PagedMemoryMixin
A mixin for paged memory models which will raise SimSegfaultExceptions if STRICT_PAGE_ACCESS is enabled and a segfault condition is detected.
Segfault conditions include: - getting a page for reading which is non-readable - getting a page for writing which
is non-writable - creating a pageThe latter condition means that this should be inserted under any mixins which provide other implementationsof _initialize_page.
class angr.storage.memory_mixins.StackAllocationMixin(stack_end=None, stack_size=None,
stack_perms=None, **kwargs)
Bases: PagedMemoryMixin
This mixin adds automatic allocation for a stack region based on the stack_end and stack_size parameters.
__init__(stack_end=None, stack_size=None, stack_perms=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!

10.5. Memory Mixins

427

angr

Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
allocate_stack_pages(addr, size, **kwargs)
Pre-allocates pages for the stack without triggering any logic related to reading from them.
Parameters• addr (int) – The highest address that should be mapped• size (int) – The number of bytes to be allocated. byte 1 is the one at addr, byte 2 is theone before that, and so on.
Returns
A list of the new page objects
class angr.storage.memory_mixins.PagedMemoryMultiValueMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
Implement optimizations and fast accessors for the MultiValues-variant of Paged Memory.
load_annotations(addr, size, **kwargs)
Parameters• addr (int)• size (int)class angr.storage.memory_mixins.CooperationBase
Bases: object
Any given subclass of this class which is not a subclass of MemoryMixin should have the property that any
subclass it which is a subclass of MemoryMixin should all work with the same datatypes
class angr.storage.memory_mixins.MemoryObjectMixin
Bases: CooperationBase
Uses SimMemoryObjects in region storage. With this, load will return a list of tuple (address, MO) and store
will take a MO.
class angr.storage.memory_mixins.ISPOMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
An implementation of the International Stateless Persons Organisation, a mixin which should be applied as abottom layer for memories which have no state and must redirect certain operations to a parent memory. Main
usecase is for memory region classes which are stored within other memories, such as pages.
set_state(state)
Sets a new state (for example, if the state has been branched)class angr.storage.memory_mixins.RefcountMixin(**kwargs)
Bases: MemoryMixin
This mixin adds a locked reference counter and methods to manipulate it, to facilitate copy-on-write optimizations.
__init__(**kwargs)

428

Chapter 10. API Referenceangrcopy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
acquire_unique()Call this function to return a version of this page which can be used for writing, which may or may not be
the same object as before. If you use this you must immediately replace the shared reference you previously
had with the new unique copy.
acquire_shared()Call this function to indicate that this page has had a reference added to it and must be copied before it canbe acquired uniquely again. Creating the object implicitly starts it with one shared reference.
Return typeNone
release_shared()Call this function to indicate that this page has had a shared reference to it released
Return type
Noneclass angr.storage.memory_mixins.PermissionsMixin(permissions=None, **kwargs)
Bases: MemoryMixin
This mixin adds a permissions field and properties for extracting the read/write/exec permissions. It does NOT
add permissions checking.
__init__(permissions=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property perm_readproperty perm_write
property perm_exec

10.5. Memory Mixins

429

angr

class angr.storage.memory_mixins.HistoryTrackingMixin(*args, **kwargs)
Bases: RefcountMixin, MemoryMixin
Tracks the history of memory writes.
__init__(*args, **kwargs)
store(addr, data, size=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
acquire_unique()Call this function to return a version of this page which can be used for writing, which may or may not be
the same object as before. If you use this you must immediately replace the shared reference you previously
had with the new unique copy.
parents()changed_bytes(other, **kwargs)
Return typeset[int] | None
all_bytes_changed_in_history()
Return type
SegmentList
class angr.storage.memory_mixins.PageBase(*args, **kwargs)
Bases: HistoryTrackingMixin, RefcountMixin, CooperationBase, ISPOMixin, PermissionsMixin,
MemoryMixin
This is a fairly succinct definition of the contract between PagedMemoryMixin and its constituent pages:• Pages must implement the MemoryMixin model for loads, stores, copying, merging, etc• However, loading/storing may not necessarily use the same data domain as PagedMemoryMixin. In orderto do more efficient loads/stores across pages, we use the CooperationBase interface which allows the pageclass to determine how to generate and unwrap the objects which are actually stored.
• To support COW, we use the RefcountMixin and the ISPOMixin (which adds the contract element thatmemory=self be passed to every method call)• Pages have permissions associated with them, stored in the PermissionsMixin.
Read the docstrings for each of the constituent classes to understand the nuances of their functionalities

430

Chapter 10. API Referenceangrclass angr.storage.memory_mixins.ListPage(memory=None, content=None, sinkhole=None,mo_cmp=None, **kwargs)
Bases: MemoryObjectMixin, PageBase
This class implements a page memory mixin with lists as the main content store.
__init__(memory=None, content=None, sinkhole=None, mo_cmp=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, endness=None, page_addr=None, memory=None, cooperate=False, **kwargs)
store(addr, data, size=None, endness=None, memory=None, cooperate=False, **kwargs)
erase(addr, size=None, **kwargs)
Set [addr:addr+size) to uninitialized. In many cases this will be faster than overwriting those locations withnew values. This is commonly used during static data flow analysis.
Parameters• addr – The address to start erasing.
• size – The number of bytes for erasing.
Return type
None
ReturnsNonemerge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.

10.5. Memory Mixins

431

angr

self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (list[ListPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)
Returns
True if the state plugins are actually merged.
Return typeboolchanged_bytes(other, page_addr=None)
Parameters• other (ListPage)• page_addr (int | None)class angr.storage.memory_mixins.MVListPage(memory=None, content=None, sinkhole=None,mo_cmp=None, **kwargs)
Bases: MemoryObjectSetMixin, PageBase
MVListPage allows storing multiple values at the same location, thus allowing weak updates.
Each store() may take a value or multiple values, and a “weak” parameter to specify if this store is a weak update
or not. Each load() returns an iterator of all values stored at that location.
__init__(memory=None, content=None, sinkhole=None, mo_cmp=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
432

Chapter 10. API ReferenceangrReturn type
MVListPageload(addr, size=None, endness=None, page_addr=None, memory=None, cooperate=False, **kwargs)
Return type
list[tuple[int, Union[SimMemoryObject, SimLabeledMemoryObject]]]
store(addr, data, size=None, endness=None, memory=None, cooperate=False, weak=False, **kwargs)
erase(addr, size=None, **kwargs)
Set [addr:addr+size) to uninitialized. In many cases this will be faster than overwriting those locations withnew values. This is commonly used during static data flow analysis.
Parameters• addr – The address to start erasing.
• size – The number of bytes for erasing.
Return type
None
ReturnsNonemerge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (list[MVListPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins

10.5. Memory Mixins

433

angr

• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)
Returns
True if the state plugins are actually merged.
Return typebool
compare(other, page_addr=None, memory=None, changed_offsets=None)
Return typebool
Parameters• other (MVListPage)• page_addr (int | None)changed_bytes(other, page_addr=None)
Parameters• other (MVListPage)• page_addr (int | None)content_gen(index)
class angr.storage.memory_mixins.UltraPage(memory=None, init_zero=False, **kwargs)
Bases: MemoryObjectMixin, PageBase
Default page implementation
SUPPORTS_CONCRETE_LOAD = True__init__(memory=None, init_zero=False, **kwargs)
classmethod new_from_shared(data, memory=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, page_addr=None, endness=None, memory=None, cooperate=False, **kwargs)
store(addr, data, size=None, endness=None, memory=None, page_addr=None, cooperate=False,**kwargs)
Parameters

434

Chapter 10. API Referenceangr• data (int | SimMemoryObject)• size (int | None)merge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (list[UltraPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)
Returns
True if the state plugins are actually merged.
Return typebool
concrete_load(addr, size, **kwargs)
Set SUPPORTS_CONCRETE_LOAD to True and implement concrete_load if reading concrete bytes isfaster in this memory model.
Parameters• addr – The address to load from.
• size – Size of the memory read.
• writing10.5. Memory Mixins

435

angr

Returns
A memoryview into the loaded bytes.
changed_bytes(other, page_addr=None)
Return typeset[int]
replace_all_with_offsets(offsets, old, new, memory=None)
Parameters• offsets (Iterable[int])• old (BV)
• new (BV)
class angr.storage.memory_mixins.SlottedMemoryMixin(width=None, **kwargs)
Bases: MemoryMixin__init__(width=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)

436

Chapter 10. API ReferenceangrDuring static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolload(addr, size=None, endness=None, **kwargs)
store(addr, data, size=None, endness=None, **kwargs)changed_bytes(other)class angr.storage.memory_mixins.RegionedMemoryMixin(write_targets_limit=2048,
read_targets_limit=4096,
stack_region_map=None,
generic_region_map=None, stack_size=65536,
cle_memory_backer=None,
dict_memory_backer=None,regioned_memory_cls=None, **kwargs)
Bases: MemoryMixin
Regioned memory. This mixin manages multiple memory regions. Each address is represented as a tuple of(region ID, offset into the region), which is called a regioned address.
Converting absolute addresses into regioned addresses: We map an absolute address to a region by looking up
which region this address belongs to in the region map. Currently this is only enabled for stack. Heap support
has not landed yet.
When start analyzing a function, the user should call set_stack_address_mapping() to create a new region mapping. Likewise, when exiting from a function, the user should cancel the previous mapping by calling unset_stack_address_mapping().
Parameters• write_targets_limit (int)• read_targets_limit (int)• stack_region_map (RegionMap | None)• generic_region_map (RegionMap | None)• stack_size (int)• cle_memory_backer (Optional | None)• dict_memory_backer (dict | None)• regioned_memory_cls (type | None)

10.5. Memory Mixins

437

angr

__init__(write_targets_limit=2048, read_targets_limit=4096, stack_region_map=None,
generic_region_map=None, stack_size=65536, cle_memory_backer=None,
dict_memory_backer=None, regioned_memory_cls=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, endness=None, condition=None, **kwargs)
Parameters• size (BV | int | None)• condition (Bool | None)store(addr, data, size=None, endness=None, **kwargs)
Parameters
size (int | None)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters
438

Chapter 10. API Referenceangr• others (Iterable[RegionedMemoryMixin]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolfind(addr, data, max_search, **kwargs)
Parametersaddr (int | Bits)
set_state(state)
Sets a new state (for example, if the state has been branched)replace_all(old, new)Parameters• old (BV)
• new (BV)
set_stack_address_mapping(absolute_address, region_id, related_function_address=None)
Create a new mapping between an absolute address (which is the base address of a specific stack frame)
and a region ID.
Parameters• absolute_address (int) – The absolute memory address.
• region_id (str) – The region ID.
• related_function_address (Optional[int]) – Related function address.
unset_stack_address_mapping(absolute_address)
Remove a stack mapping.
Parameters
absolute_address (int) – An absolute memory address that is the base address of thestack frame to destroy.
stack_id(function_address)
Return a memory region ID for a function. If the default region ID exists in the region mapping, an integer
will appended to the region name. In this way we can handle recursive function calls, or a function thatappears more than once in the call frame.
This also means that stack_id() should only be called when creating a new stack frame for a function. You
are not supposed to call this function every time you want to map a function address to a stack ID.
Parametersfunction_address (int) – Address of the function.
Return type
str
Returns
ID of the new memory region.

10.5. Memory Mixins

439

angr

set_stack_size(size)
Parameters
size (int)class angr.storage.memory_mixins.RegionCategoryMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
property categoryreg, mem, or file.
Type
Return the category of this SimMemory instance. It can be one of the three following categories
class angr.storage.memory_mixins.StaticFindMixin(memory_id=None, endness='Iend_BE')Bases: SmartFindMixin
Implements data finding for abstract memory.
find(addr, data, max_search, default=None, endness=None, chunk_size=None, max_symbolic_bytes=None,condition=None, char_size=1, **kwargs)
class angr.storage.memory_mixins.AbstractMergerMixin(memory_id=None, endness='Iend_BE')Bases: MemoryMixin
AbstractMergerMixin handles merging initialized values.
class angr.storage.memory_mixins.MemoryRegionMetaMixin(related_function_addr=None, **kwargs)
Bases: MemoryMixin__init__(related_function_addr=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property is_stackproperty related_function_addr
get_abstract_locations(addr, size)
Get a list of abstract locations that is within the range of [addr, addr + size]
This implementation is pretty slow. But since this method won’t be called frequently, we can live with thebad implementation for now.
Parameters• addr – Starting address of the memory region.
• size – Size of the memory region, in bytes.
440

Chapter 10. API ReferenceangrReturns
A list of covered AbstractLocation objects, or an empty list if there is none.
store(addr, data, bbl_addr=None, stmt_id=None, ins_addr=None, endness=None, **kwargs)load(addr, size=None, bbl_addr=None, stmt_idx=None, ins_addr=None, **kwargs)
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.

10.5. Memory Mixins

441

angr

Return typebool
dbg_print(indent=0)
Print out debugging information
class angr.storage.memory_mixins.RegionedAddressConcretizationMixin(read_strategies=None,
write_strategies=None,**kwargs)
Bases: MemoryMixin__init__(read_strategies=None, write_strategies=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters
442

Chapter 10. API Referenceangr• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolclass angr.storage.memory_mixins.KeyValueMemoryMixin(*args, **kwargs)
Bases: MemoryMixin
KeyValueMemoryMixin is a mixin that provides a simple key-value store for memory.
__init__(*args, **kwargs)load(addr, size=None, none_if_missing=False, **kwargs)
store(addr, data, type_=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.JavaVmMemoryMixin(memory_id='mem', stack=None, heap=None,vm_static_table=None, load_strategies=None,store_strategies=None, max_array_size=1000,**kwargs)
Bases: MemoryMixin
A memory mixin for JavaVM memory.
__init__(memory_id='mem', stack=None, heap=None, vm_static_table=None, load_strategies=None,store_strategies=None, max_array_size=1000, **kwargs)
static get_new_uuid()
Generate a unique id within the scope of the JavaVM memory. This, for example, is used for distinguishingmemory objects of the same type (e.g. multiple instances of the same class).
store(addr, data, frame=0)load(addr, frame=0, none_if_missing=False)
push_stack_frame()
pop_stack_frame()
property stack

10.5. Memory Mixins

443

angr

store_array_element(array, idx, value)
store_array_elements(array, start_idx, data)
Stores either a single element or a range of elements in the array.
Parameters• array – Reference to the array.
• start_idx – Starting index for the store.
• data – Either a single value or a list of values.
load_array_element(array, idx)
load_array_elements(array, start_idx, no_of_elements)
Loads either a single element or a range of elements from the array.
Parameters• array – Reference to the array.
• start_idx – Starting index for the load.
• no_of_elements – Number of elements to load.
concretize_store_idx(idx, strategies=None)Concretizes a store index.
Parameters• idx – An expression for the index.
• strategies – A list of concretization strategies (to override the default).
• min_idx – Minimum value for a concretized index (inclusive).
• max_idx – Maximum value for a concretized index (exclusive).
Returns
A list of concrete indexes.
concretize_load_idx(idx, strategies=None)Concretizes a load index.
Parameters• idx – An expression for the index.
• strategies – A list of concretization strategies (to override the default).
• min_idx – Minimum value for a concretized index (inclusive).
• max_idx – Maximum value for a concretized index (exclusive).
Returns
A list of concrete indexes.
set_state(state)
Sets a new state (for example, if the state has been branched)

444

Chapter 10. API Referenceangrcopy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
10.5. Memory Mixins

445

angr

Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typeboolclass angr.storage.memory_mixins.DefaultMemory(*args, **kwargs)
Bases:
HexDumperMixin,
SmartFindMixin,
UnwrapperMixin,
NameResolutionMixin,
DataNormalizationMixin,
SimplificationMixin,
InspectMixinHigh ,ActionsMixinHigh ,UnderconstrainedMixin,
SizeConcretizationMixin,
SizeNormalizationMixin,
AddressConcretizationMixin, ActionsMixinLow, ConditionalMixin, ConvenientMappingsMixin,
DirtyAddrsMixin,
StackAllocationMixin,
ConcreteBackerMixin,
ClemoryBackerMixin,
DictBackerMixin,
PrivilegedPagingMixin,
UltraPagesMixin,
DefaultFillerMixin,
SymbolicMergerMixin, PagedMemoryMixin
class angr.storage.memory_mixins.DefaultListPagesMemory(*args, **kwargs)
Bases:
HexDumperMixin,
SmartFindMixin,
UnwrapperMixin,
NameResolutionMixin,
DataNormalizationMixin, SimplificationMixin, ActionsMixinHigh , UnderconstrainedMixin,
SizeConcretizationMixin,
SizeNormalizationMixin,
InspectMixinHigh ,AddressConcretizationMixin, ActionsMixinLow, ConditionalMixin, ConvenientMappingsMixin,
DirtyAddrsMixin,
StackAllocationMixin,
ClemoryBackerMixin,
DictBackerMixin,
PrivilegedPagingMixin,
ListPagesMixin,
DefaultFillerMixin,
SymbolicMergerMixin,
PagedMemoryMixin
class angr.storage.memory_mixins.FastMemory(uninitialized_read_handler=None, **kwargs)
Bases: NameResolutionMixin, SimpleInterfaceMixin, SimplificationMixin, InspectMixinHigh ,ConditionalMixin, ExplicitFillerMixin, DefaultFillerMixin, SlottedMemoryMixin
class angr.storage.memory_mixins.AbstractMemory(*args, **kwargs)
Bases:
UnwrapperMixin,
NameResolutionMixin,
DataNormalizationMixin,
SimplificationMixin,
InspectMixinHigh ,ActionsMixinHigh ,UnderconstrainedMixin,
SizeConcretizationMixin, SizeNormalizationMixin, ActionsMixinLow, ConditionalMixin,
RegionedAddressConcretizationMixin, RegionedMemoryMixin
class angr.storage.memory_mixins.RegionedMemory(related_function_addr=None, **kwargs)
Bases:
RegionCategoryMixin,
MemoryRegionMetaMixin,
StaticFindMixin,
UnwrapperMixin, NameResolutionMixin, DataNormalizationMixin, SimplificationMixin,
SizeConcretizationMixin,
SizeNormalizationMixin,
AddressConcretizationMixin,
ConvenientMappingsMixin,
DirtyAddrsMixin,
ClemoryBackerMixin,
DictBackerMixin,
UltraPagesMixin, DefaultFillerMixin, AbstractMergerMixin, PagedMemoryMixin
class angr.storage.memory_mixins.LabeledMemory(*args, top_func=None, **kwargs)
Bases:
SizeNormalizationMixin,
ListPagesWithLabelsMixin,
TopMergerMixin, LabelMergerMixin, PagedMemoryMixin

DefaultFillerMixin,

LabeledMemory is used in static analysis. It allows storing values with labels, such as Definition.
class angr.storage.memory_mixins.MultiValuedMemory(*args,
skip_missing_values_during_merging=False,**kwargs)
Bases:
SizeNormalizationMixin,
MVListPagesMixin,
DefaultFillerMixin,
MultiValueMergerMixin, PagedMemoryMixin, PagedMemoryMultiValueMixin

446

Chapter 10. API Referenceangrclass angr.storage.memory_mixins.KeyValueMemory(*args, **kwargs)
Bases: KeyValueMemoryMixin
class angr.storage.memory_mixins.JavaVmMemory(memory_id='mem', stack=None, heap=None,vm_static_table=None, load_strategies=None,store_strategies=None, max_array_size=1000,**kwargs)
Bases: JavaVmMemoryMixin
class angr.storage.memory_mixins.name_resolution_mixin.NameResolutionMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
This mixin allows you to provide register names as load addresses, and will automatically translate this to anoffset and size.
store(addr, data, size=None, **kwargs)load(addr, size=None, **kwargs)
class angr.storage.memory_mixins.smart_find_mixin.SmartFindMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
Memory mixin providing basic searching over concrete and symbolic data.
find(addr, data, max_search, default=None, endness=None, chunk_size=None, max_symbolic_bytes=None,condition=None, char_size=1, **kwargs)
class angr.storage.memory_mixins.default_filler_mixin.DefaultFillerMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
class angr.storage.memory_mixins.default_filler_mixin.SpecialFillerMixin(special_memory_filler=None,**kwargs)
Bases: MemoryMixin__init__(special_memory_filler=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.default_filler_mixin.ExplicitFillerMixin(uninitialized_read_handler=None,**kwargs)
Bases: MemoryMixin

10.5. Memory Mixins

447

angr

__init__(uninitialized_read_handler=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.bvv_conversion_mixin.DataNormalizationMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
Normalizes the data field for a store and the fallback field for a load to be BVs.
store(addr, data, size=None, **kwargs)load(addr, size=None, fallback=None, **kwargs)
class angr.storage.memory_mixins.hex_dumper_mixin.HexDumperMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
hex_dump(start, size, word_size=4, words_per_row=4, endianness='Iend_BE', symbolic_char='?',
unprintable_char='.', solve=False, extra_constraints=None, inspect=False,
disable_actions=True)
Returns a hex dump as a string. The solver, if enabled, is called once for every byte potentially making thisfunction very slow. It is meant to be used mainly as a “visualization” for debugging.
Warning: May read and display more bytes than size due to rounding. Particularly, if size is less than, or
not a multiple of word_size*words_per_line.
Parameters• start – starting address from which to print• size – number of bytes to display• word_size – number of bytes to group together as one space-delimited unit
• words_per_row – number of words to display per row of output• endianness – endianness to use when displaying each word (ASCII representation is unchanged)• symbolic_char – the character to display when a byte is symbolic and has multiple solutions• unprintable_char – the character to display when a byte is not printable• solve – whether or not to attempt to solve (warning: can be very slow)• extra_constraints – extra constraints to pass to the solver is solve is True
• inspect – whether or not to trigger SimInspect breakpoints for the memory load
448

Chapter 10. API Referenceangr• disable_actions – whether or not to disable SimActions for the memory load
Returnshex dump as a stringclass angr.storage.memory_mixins.underconstrained_mixin.UnderconstrainedMixin(*args,**kwargs)
Bases: MemoryMixin__init__(*args, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, **kwargs)
store(addr, data, **kwargs)
class angr.storage.memory_mixins.simple_interface_mixin.SimpleInterfaceMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixinload(addr, size=None, endness=None, condition=None, fallback=None, **kwargs)
store(addr, data, size=None, endness=None, condition=None, **kwargs)
class angr.storage.memory_mixins.actions_mixin.ActionsMixinHigh(memory_id=None,
endness='Iend_BE')Bases: MemoryMixinload(addr, size=None, condition=None, fallback=None, disable_actions=False, action=None, **kwargs)
store(addr, data, size=None, disable_actions=False, action=None, condition=None, **kwargs)
class angr.storage.memory_mixins.actions_mixin.ActionsMixinLow(memory_id=None,
endness='Iend_BE')Bases: MemoryMixinload(addr, action=None, **kwargs)
store(addr, data, action=None, **kwargs)
Parameters
action (SimActionData | None)

10.5. Memory Mixins

449

angr

class angr.storage.memory_mixins.symbolic_merger_mixin.SymbolicMergerMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
class angr.storage.memory_mixins.size_resolution_mixin.SizeNormalizationMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
Provides basic services related to normalizing sizes. After this mixin, sizes will always be a plain int. Assumes
that the data is a BV.
• load will throw a TypeError if no size is provided• store will default to len(data)//byte_width if no size is provided
load(addr, size=None, **kwargs)
store(addr, data, size=None, **kwargs)

class angr.storage.memory_mixins.size_resolution_mixin.SizeConcretizationMixin(concretize_symbolic_write_size=
max_concretize_count=256,
max_symbolic_size=4194304,
raise_memory_limit_error=Fals
size_limit=257,**kwargs)
Bases: MemoryMixin
This mixin allows memory to process symbolic sizes. It will not touch any sizes which are not ASTs with nonBVV ops. Assumes that the data is a BV.
• symbolic load sizes will be concretized as their maximum and a warning will be logged• symbolic store sizes will be dispatched as several conditional stores with concrete sizes
Parameters• concretize_symbolic_write_size (bool)• max_concretize_count (int | None)• max_symbolic_size (int)• raise_memory_limit_error (bool)• size_limit (int)__init__(concretize_symbolic_write_size=False, max_concretize_count=256,
max_symbolic_size=4194304, raise_memory_limit_error=False, size_limit=257, **kwargs)
Parameters• concretize_symbolic_write_size (bool)• max_concretize_count (int | None)• max_symbolic_size (int)• raise_memory_limit_error (bool)• size_limit (int)

450

Chapter 10. API Referenceangrcopy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, **kwargs)
store(addr, data, size=None, condition=None, **kwargs)
class angr.storage.memory_mixins.dirty_addrs_mixin.DirtyAddrsMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
store(addr, data, size=None, **kwargs)
class angr.storage.memory_mixins.address_concretization_mixin.MultiwriteAnnotation
Bases: Annotation
property eliminatable
Returns whether this annotation can be eliminated in a simplification.
Returns
True if eliminatable, False otherwise
property relocateableclass angr.storage.memory_mixins.address_concretization_mixin.AddressConcretizationMixin(read_strategies=No
write_strategies=N**kwargs)
Bases: MemoryMixin
The address concretization mixin allows symbolic reads and writes to be handled sanely by dispatching them as
a number of conditional concrete reads/writes. It provides a “concretization strategies” interface allowing theprocess of serializing symbolic addresses into concrete ones to be specified.
__init__(read_strategies=None, write_strategies=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!

10.5. Memory Mixins

451

angr

Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
concretize_write_addr(addr, strategies=None, condition=None)Concretizes an address meant for writing.
Parameters• addr – An expression for the address.
• strategies – A list of concretization strategies (to override the default).
• condition – Any extra constraints that should be observed when determining address
satisfiability
Returns
A list of concrete addresses.

452

Chapter 10. API Referenceangrconcretize_read_addr(addr, strategies=None, condition=None)Concretizes an address meant for reading.
Parameters• addr – An expression for the address.
• strategies – A list of concretization strategies (to override the default).
Returns
A list of concrete addresses.
load(addr, size=None, condition=None, **kwargs)
store(addr, data, size=None, condition=None, **kwargs)
permissions(addr, permissions=None, **kwargs)
map_region(addr, length, permissions, **kwargs)
unmap_region(addr, length, **kwargs)
concrete_load(addr, size, *args, **kwargs)
Set SUPPORTS_CONCRETE_LOAD to True and implement concrete_load if reading concrete bytes isfaster in this memory model.
Parameters• addr – The address to load from.
• size – Size of the memory read.
• writing
Returns
A memoryview into the loaded bytes.
class angr.storage.memory_mixins.clouseau_mixin.InspectMixinHigh(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
store(addr, data, size=None, condition=None, endness=None, inspect=True, **kwargs)load(addr, size=None, condition=None, endness=None, inspect=True, **kwargs)
class angr.storage.memory_mixins.conditional_store_mixin.ConditionalMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixinload(addr, condition=None, fallback=None, **kwargs)
store(addr, data, size=None, condition=None, **kwargs)
class angr.storage.memory_mixins.label_merger_mixin.LabelMergerMixin(*args, **kwargs)
Bases: MemoryMixin
A memory mixin for merging labels. Labels come from SimLabeledMemoryObject.
__init__(*args, **kwargs)

10.5. Memory Mixins

453

angr

copy(memo=None)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.simplification_mixin.SimplificationMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
store(addr, data, **kwargs)
class angr.storage.memory_mixins.unwrapper_mixin.UnwrapperMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
This mixin processes SimActionObjects by passing on their .ast field.
store(addr, data, size=None, condition=None, **kwargs)load(addr, size=None, condition=None, fallback=None, **kwargs)
find(addr, what, max_search, default=None, **kwargs)
copy_contents(dst, src, size, condition=None, **kwargs)
Override this method to provide faster copying of large chunks of data.
Parameters• dst – The destination of copying.
• src – The source of copying.
• size – The size of copying.
• condition – The storing condition.
• kwargs – Other parameters.
ReturnsNoneclass angr.storage.memory_mixins.convenient_mappings_mixin.ConvenientMappingsMixin(**kwargs)
Bases: MemoryMixin
Implements mappings between names and hashes of symbolic variables and these variables themselves.
__init__(**kwargs)

454

Chapter 10. API Referenceangrcopy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
store(addr, data, size=None, **kwargs)
get_symbolic_addrs()
addrs_for_name(n)Returns addresses that contain expressions that contain a variable named n.
addrs_for_hash(h)Returns addresses that contain expressions that contain a variable with the hash of h.
replace_all(old, new)Replaces all instances of expression old with expression new.
Parameters• old (BV) – A claripy expression. Must contain at least one named variable (to make itpossible to use the name index for speedup).
• new (BV) – The new variable to replace it with.
class angr.storage.memory_mixins.paged_memory.pages.mv_list_page.MVListPage(memory=None,content=None,
sinkhole=None,mo_cmp=None,**kwargs)
Bases: MemoryObjectSetMixin, PageBase
MVListPage allows storing multiple values at the same location, thus allowing weak updates.
Each store() may take a value or multiple values, and a “weak” parameter to specify if this store is a weak update
or not. Each load() returns an iterator of all values stored at that location.
__init__(memory=None, content=None, sinkhole=None, mo_cmp=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

10.5. Memory Mixins

455

angr

Return type
MVListPageload(addr, size=None, endness=None, page_addr=None, memory=None, cooperate=False, **kwargs)
Return type
list[tuple[int, Union[SimMemoryObject, SimLabeledMemoryObject]]]
store(addr, data, size=None, endness=None, memory=None, cooperate=False, weak=False, **kwargs)
erase(addr, size=None, **kwargs)
Set [addr:addr+size) to uninitialized. In many cases this will be faster than overwriting those locations withnew values. This is commonly used during static data flow analysis.
Parameters• addr – The address to start erasing.
• size – The number of bytes for erasing.
Return type
None
ReturnsNonemerge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (list[MVListPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins

456

Chapter 10. API Referenceangr• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)
Returns
True if the state plugins are actually merged.
Return typebool
compare(other, page_addr=None, memory=None, changed_offsets=None)
Return typebool
Parameters• other (MVListPage)• page_addr (int | None)changed_bytes(other, page_addr=None)
Parameters• other (MVListPage)• page_addr (int | None)content_gen(index)
class angr.storage.memory_mixins.paged_memory.pages.multi_values.MultiValues(v=None, offset_to_values=None)
Bases: object
Represents a byte vector where each byte can have one or multiple values.
As an implementation optimization (so that we do not create excessive sets and dicts), self._single_value storesa claripy AST when this MultiValues object represents only one value at offset 0.
Parametersv(claripy.ast.Bits | MultiValues | None | dict[int, set[claripy.ast.
Bits]])__init__(v=None, offset_to_values=None)
Parametersv (Bits | MultiValues | None | dict[int, set[Bits]])
add_value(offset, value)
Return type
None
Parameters• offset (int)• value (Bits)

10.5. Memory Mixins

457

angr

one_value(strip_annotations=False)
Return type
Bits | None
Parametersstrip_annotations (bool)merge(mv)
Return typeMultiValues
Parameters
mv (MultiValues)
keys()
Return typeset[int]
values()Return type
Iterator[set[Bits]]
items()
Return type
Iterator[tuple[int, set[Bits]]]
count()
Return type
int
extract(offset, length, endness)
Return typeMultiValues
Parameters• offset (int)• length (int)• endness (str)concat(other)
Return typeMultiValues
Parameters
other (MultiValues | Bits | bytes)
class angr.storage.memory_mixins.top_merger_mixin.TopMergerMixin(*args, top_func=None,**kwargs)
Bases: MemoryMixin
A memory mixin for merging values in memory to TOP.

458

Chapter 10. API Referenceangr__init__(*args, top_func=None, **kwargs)
copy(memo=None)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.multi_value_merger_mixin.MultiValueMergerMixin(*args, element_limit=5,
annotation_limit=256,
top_func=None,
is_top_func=None,
phi_maker=None,merge_into_top=True,**kwargs)
Bases: MemoryMixin__init__(*args, element_limit=5, annotation_limit=256, top_func=None, is_top_func=None,
phi_maker=None, merge_into_top=True, **kwargs)
copy(memo=None)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
class angr.storage.memory_mixins.paged_memory.paged_memory_mixin.PagedMemoryMixin(page_size=4096,
default_permissions=3,
permissions_map=None,
page_kwargs=None,**kwargs)
Bases: MemoryMixin
A bottom-level storage mechanism. Dispatches reads to individual pages, the type of which is the PAGE_TYPE
class variable.
SUPPORTS_CONCRETE_LOAD = True

10.5. Memory Mixins

459

angr

PAGE_TYPE: type[PageType] = None__init__(page_size=4096, default_permissions=3, permissions_map=None, page_kwargs=None,**kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, endness=None, **kwargs)
Parameters• addr (int)• size (int | None)store(addr, data, size=None, endness=None, **kwargs)
Parameters• addr (int)• size (int | None)erase(addr, size=None, **kwargs)
Set [addr:addr+size) to uninitialized. In many cases this will be faster than overwriting those locations withnew values. This is commonly used during static data flow analysis.
Parameters• addr – The address to start erasing.
• size – The number of bytes for erasing.
Return type
None
ReturnsNonemerge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)460

Chapter 10. API ReferenceangrWhen implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (Iterable[PagedMemoryMixin]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
compare(other)
Return typebool
Parameters
other (PagedMemoryMixin)
permissions(addr, permissions=None, **kwargs)
map_region(addr, length, permissions, init_zero=False, **kwargs)
unmap_region(addr, length, **kwargs)
concrete_load(addr, size, writing=False, with_bitmap=False, **kwargs)
Set SUPPORTS_CONCRETE_LOAD to True and implement concrete_load if reading concrete bytes isfaster in this memory model.
Parameters• addr – The address to load from.
• size – Size of the memory read.
• writing
Returns
A memoryview into the loaded bytes.
changed_bytes(other)
Return typeset[int]

10.5. Memory Mixins

461

angr

changed_pages(other)
Return type
dict[int, set[int] | None]copy_contents(dst, src, size, condition=None, **kwargs)
Override this method to provide faster copying of large chunks of data.
Parameters• dst – The destination of copying.
• src – The source of copying.
• size – The size of copying.
• condition – The storing condition.
• kwargs – Other parameters.
ReturnsNoneflush_pages(white_list)
Flush all pages not included in the white_list by removing their pages. Note, this will not wipe them frommemory if they were backed by a memory_backer, it will simply reset them to their initial state. Returns
the list of pages that were cleared consisting of (addr, length) tuples. :type white_list: :param white_list:
white list of regions in the form of (start, end) to exclude from the flush :return: a list of memory page
ranges that were flushed :rtype: list
state:

angr.SimState

class angr.storage.memory_mixins.paged_memory.paged_memory_mixin.LabeledPagesMixin(page_size=4096,
default_permissions=3,
permissions_map=None,
page_kwargs=None,**kwargs)
Bases: PagedMemoryMixin
load_with_labels(addr, size=None, endness=None, **kwargs)
Return typetuple[Base, tuple[tuple[int, int, int, Any]]]
Parameters• addr (int)• size (int | None)class angr.storage.memory_mixins.paged_memory.paged_memory_mixin.ListPagesMixin(page_size=4096,
default_permissions=3,
permissions_map=None,
page_kwargs=None,**kwargs)
Bases: PagedMemoryMixin

462

Chapter 10. API Referenceangr

PAGE_TYPE
alias of ListPageclass angr.storage.memory_mixins.paged_memory.paged_memory_mixin.MVListPagesMixin(*args,
skip_missing_values_during**kwargs)
Bases: PagedMemoryMixin
PAGE_TYPE
alias of MVListPage__init__(*args, skip_missing_values_during_merging=False, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

class angr.storage.memory_mixins.paged_memory.paged_memory_mixin.ListPagesWithLabelsMixin(page_size=4096,
default_permissions
permissions_map=Nonepage_kwargs=No**kwargs)
Bases: LabeledPagesMixin, ListPagesMixin

class angr.storage.memory_mixins.paged_memory.paged_memory_mixin.MVListPagesWithLabelsMixin(*args,
skip_missing_v**kwargs)
Bases: LabeledPagesMixin, MVListPagesMixin
class angr.storage.memory_mixins.paged_memory.paged_memory_mixin.UltraPagesMixin(page_size=4096,
default_permissions=3,
permissions_map=None,
page_kwargs=None,**kwargs)
Bases: PagedMemoryMixin
PAGE_TYPE
alias of UltraPage
class angr.storage.memory_mixins.paged_memory.page_backer_mixins.NotMemoryview(obj, offset,
size)
Bases: object

10.5. Memory Mixins

463

angr

__init__(obj, offset, size)class angr.storage.memory_mixins.paged_memory.page_backer_mixins.ClemoryBackerMixin(cle_memory_backer=Non**kwargs)
Bases: PagedMemoryMixin
Parameters
cle_memory_backer (None | cle.Loader | cle.Clemory)__init__(cle_memory_backer=None, **kwargs)
Parameters
cle_memory_backer (None | Loader | Clemory)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

class angr.storage.memory_mixins.paged_memory.page_backer_mixins.ConcreteBackerMixin(cle_memory_backer=No**kwargs)
Bases: ClemoryBackerMixin
Parameters
cle_memory_backer (None | cle.Loader | cle.Clemory)class angr.storage.memory_mixins.paged_memory.page_backer_mixins.DictBackerMixin(dict_memory_backer=None,**kwargs)
Bases: PagedMemoryMixin__init__(dict_memory_backer=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

class angr.storage.memory_mixins.paged_memory.stack_allocation_mixin.StackAllocationMixin(stack_end=None,
stack_size=None,
stack_perms=Non**kwargs)

464

Chapter 10. API ReferenceangrBases: PagedMemoryMixin
This mixin adds automatic allocation for a stack region based on the stack_end and stack_size parameters.
__init__(stack_end=None, stack_size=None, stack_perms=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
allocate_stack_pages(addr, size, **kwargs)
Pre-allocates pages for the stack without triggering any logic related to reading from them.
Parameters• addr (int) – The highest address that should be mapped• size (int) – The number of bytes to be allocated. byte 1 is the one at addr, byte 2 is theone before that, and so on.
Returns
A list of the new page objects
class angr.storage.memory_mixins.paged_memory.privileged_mixin.PrivilegedPagingMixin(page_size=4096,
default_permissions=3,
permissions_map=None,
page_kwargs=None,**kwargs)
Bases: PagedMemoryMixin
A mixin for paged memory models which will raise SimSegfaultExceptions if STRICT_PAGE_ACCESS is enabled and a segfault condition is detected.
Segfault conditions include: - getting a page for reading which is non-readable - getting a page for writing which
is non-writable - creating a pageThe latter condition means that this should be inserted under any mixins which provide other implementationsof _initialize_page.
class angr.storage.memory_mixins.paged_memory.pages.CooperationBase
Bases: object
Any given subclass of this class which is not a subclass of MemoryMixin should have the property that any
subclass it which is a subclass of MemoryMixin should all work with the same datatypes

10.5. Memory Mixins

465

angr

class angr.storage.memory_mixins.paged_memory.pages.MemoryObjectMixin
Bases: CooperationBase
Uses SimMemoryObjects in region storage. With this, load will return a list of tuple (address, MO) and store
will take a MO.
class angr.storage.memory_mixins.paged_memory.pages.ISPOMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
An implementation of the International Stateless Persons Organisation, a mixin which should be applied as abottom layer for memories which have no state and must redirect certain operations to a parent memory. Main
usecase is for memory region classes which are stored within other memories, such as pages.
set_state(state)
Sets a new state (for example, if the state has been branched)class angr.storage.memory_mixins.paged_memory.pages.RefcountMixin(**kwargs)
Bases: MemoryMixin
This mixin adds a locked reference counter and methods to manipulate it, to facilitate copy-on-write optimizations.
__init__(**kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
acquire_unique()Call this function to return a version of this page which can be used for writing, which may or may not be
the same object as before. If you use this you must immediately replace the shared reference you previously
had with the new unique copy.
acquire_shared()Call this function to indicate that this page has had a reference added to it and must be copied before it canbe acquired uniquely again. Creating the object implicitly starts it with one shared reference.
Return typeNone
release_shared()Call this function to indicate that this page has had a shared reference to it released
Return type
Noneclass angr.storage.memory_mixins.paged_memory.pages.PermissionsMixin(permissions=None,**kwargs)

466

Chapter 10. API ReferenceangrBases: MemoryMixin
This mixin adds a permissions field and properties for extracting the read/write/exec permissions. It does NOT
add permissions checking.
__init__(permissions=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property perm_readproperty perm_write
property perm_execclass angr.storage.memory_mixins.paged_memory.pages.HistoryTrackingMixin(*args, **kwargs)
Bases: RefcountMixin, MemoryMixin
Tracks the history of memory writes.
__init__(*args, **kwargs)
store(addr, data, size=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
acquire_unique()Call this function to return a version of this page which can be used for writing, which may or may not be
the same object as before. If you use this you must immediately replace the shared reference you previously
had with the new unique copy.
parents()changed_bytes(other, **kwargs)
Return typeset[int] | None

10.5. Memory Mixins

467

angr

all_bytes_changed_in_history()
Return type
SegmentList
class angr.storage.memory_mixins.paged_memory.pages.PageBase(*args, **kwargs)
Bases: HistoryTrackingMixin, RefcountMixin, CooperationBase, ISPOMixin, PermissionsMixin,
MemoryMixin
This is a fairly succinct definition of the contract between PagedMemoryMixin and its constituent pages:• Pages must implement the MemoryMixin model for loads, stores, copying, merging, etc• However, loading/storing may not necessarily use the same data domain as PagedMemoryMixin. In orderto do more efficient loads/stores across pages, we use the CooperationBase interface which allows the pageclass to determine how to generate and unwrap the objects which are actually stored.
• To support COW, we use the RefcountMixin and the ISPOMixin (which adds the contract element thatmemory=self be passed to every method call)• Pages have permissions associated with them, stored in the PermissionsMixin.
Read the docstrings for each of the constituent classes to understand the nuances of their functionalities
class angr.storage.memory_mixins.paged_memory.pages.ListPage(memory=None, content=None,
sinkhole=None, mo_cmp=None,**kwargs)
Bases: MemoryObjectMixin, PageBase
This class implements a page memory mixin with lists as the main content store.
__init__(memory=None, content=None, sinkhole=None, mo_cmp=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, endness=None, page_addr=None, memory=None, cooperate=False, **kwargs)
store(addr, data, size=None, endness=None, memory=None, cooperate=False, **kwargs)
erase(addr, size=None, **kwargs)
Set [addr:addr+size) to uninitialized. In many cases this will be faster than overwriting those locations withnew values. This is commonly used during static data flow analysis.
Parameters• addr – The address to start erasing.
• size – The number of bytes for erasing.
Return type
None
468

Chapter 10. API ReferenceangrReturnsNonemerge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (list[ListPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)
Returns
True if the state plugins are actually merged.
Return typeboolchanged_bytes(other, page_addr=None)
Parameters• other (ListPage)• page_addr (int | None)class angr.storage.memory_mixins.paged_memory.pages.MVListPage(memory=None, content=None,
sinkhole=None, mo_cmp=None,**kwargs)

10.5. Memory Mixins

469

angr

Bases: MemoryObjectSetMixin, PageBase
MVListPage allows storing multiple values at the same location, thus allowing weak updates.
Each store() may take a value or multiple values, and a “weak” parameter to specify if this store is a weak update
or not. Each load() returns an iterator of all values stored at that location.
__init__(memory=None, content=None, sinkhole=None, mo_cmp=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
Return type
MVListPageload(addr, size=None, endness=None, page_addr=None, memory=None, cooperate=False, **kwargs)
Return type
list[tuple[int, Union[SimMemoryObject, SimLabeledMemoryObject]]]
store(addr, data, size=None, endness=None, memory=None, cooperate=False, weak=False, **kwargs)
erase(addr, size=None, **kwargs)
Set [addr:addr+size) to uninitialized. In many cases this will be faster than overwriting those locations withnew values. This is commonly used during static data flow analysis.
Parameters• addr – The address to start erasing.
• size – The number of bytes for erasing.
Return type
None
ReturnsNonemerge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
470

Chapter 10. API ReferenceangrWhen implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (list[MVListPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)
Returns
True if the state plugins are actually merged.
Return typebool
compare(other, page_addr=None, memory=None, changed_offsets=None)
Return typebool
Parameters• other (MVListPage)• page_addr (int | None)changed_bytes(other, page_addr=None)
Parameters• other (MVListPage)• page_addr (int | None)content_gen(index)
class angr.storage.memory_mixins.paged_memory.pages.UltraPage(memory=None, init_zero=False,**kwargs)
Bases: MemoryObjectMixin, PageBase
Default page implementation
SUPPORTS_CONCRETE_LOAD = True

10.5. Memory Mixins

471

angr

__init__(memory=None, init_zero=False, **kwargs)
classmethod new_from_shared(data, memory=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, page_addr=None, endness=None, memory=None, cooperate=False, **kwargs)
store(addr, data, size=None, endness=None, memory=None, page_addr=None, cooperate=False,**kwargs)
Parameters• data (int | SimMemoryObject)• size (int | None)merge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters

472

Chapter 10. API Referenceangr• others (list[UltraPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)
Returns
True if the state plugins are actually merged.
Return typebool
concrete_load(addr, size, **kwargs)
Set SUPPORTS_CONCRETE_LOAD to True and implement concrete_load if reading concrete bytes isfaster in this memory model.
Parameters• addr – The address to load from.
• size – Size of the memory read.
• writing
Returns
A memoryview into the loaded bytes.
changed_bytes(other, page_addr=None)
Return typeset[int]
state:

angr.SimState

replace_all_with_offsets(offsets, old, new, memory=None)
Parameters• offsets (Iterable[int])• old (BV)
• new (BV)
class angr.storage.memory_mixins.paged_memory.pages.refcount_mixin.RefcountMixin(**kwargs)
Bases: MemoryMixin
This mixin adds a locked reference counter and methods to manipulate it, to facilitate copy-on-write optimizations.
__init__(**kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!

10.5. Memory Mixins

473

angr

Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
acquire_unique()Call this function to return a version of this page which can be used for writing, which may or may not be
the same object as before. If you use this you must immediately replace the shared reference you previously
had with the new unique copy.
acquire_shared()Call this function to indicate that this page has had a reference added to it and must be copied before it canbe acquired uniquely again. Creating the object implicitly starts it with one shared reference.
Return typeNone
release_shared()Call this function to indicate that this page has had a shared reference to it released
Return type
Noneclass angr.storage.memory_mixins.paged_memory.pages.permissions_mixin.PermissionsMixin(permissions=None,**kwargs)
Bases: MemoryMixin
This mixin adds a permissions field and properties for extracting the read/write/exec permissions. It does NOT
add permissions checking.
__init__(permissions=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property perm_readproperty perm_write
property perm_execclass angr.storage.memory_mixins.paged_memory.pages.history_tracking_mixin.HistoryTrackingMixin(*args,**kwargs
Bases: RefcountMixin, MemoryMixin
Tracks the history of memory writes.
__init__(*args, **kwargs)
store(addr, data, size=None, **kwargs)

474

Chapter 10. API Referenceangrcopy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
acquire_unique()Call this function to return a version of this page which can be used for writing, which may or may not be
the same object as before. If you use this you must immediately replace the shared reference you previously
had with the new unique copy.
parents()changed_bytes(other, **kwargs)
Return typeset[int] | None
all_bytes_changed_in_history()
Return type
SegmentList
class angr.storage.memory_mixins.paged_memory.pages.ispo_mixin.ISPOMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
An implementation of the International Stateless Persons Organisation, a mixin which should be applied as abottom layer for memories which have no state and must redirect certain operations to a parent memory. Main
usecase is for memory region classes which are stored within other memories, such as pages.
set_state(state)
Sets a new state (for example, if the state has been branched)class angr.storage.memory_mixins.paged_memory.pages.cooperation.CooperationBase
Bases: object
Any given subclass of this class which is not a subclass of MemoryMixin should have the property that any
subclass it which is a subclass of MemoryMixin should all work with the same datatypes
class angr.storage.memory_mixins.paged_memory.pages.cooperation.MemoryObjectMixin
Bases: CooperationBase
Uses SimMemoryObjects in region storage. With this, load will return a list of tuple (address, MO) and store
will take a MO.
class angr.storage.memory_mixins.paged_memory.pages.cooperation.MemoryObjectSetMixin
Bases: CooperationBase
Uses sets of SimMemoryObjects in region storage.

10.5. Memory Mixins

475

angr

class angr.storage.memory_mixins.paged_memory.pages.cooperation.BasicClaripyCooperation
Bases: CooperationBase
Mix this (along with PageBase) into a storage class which supports loading and storing claripy bitvectors and it
will be able to work as a page in the paged memory model.
class angr.storage.memory_mixins.paged_memory.pages.list_page.ListPage(memory=None,content=None,
sinkhole=None,mo_cmp=None,**kwargs)
Bases: MemoryObjectMixin, PageBase
This class implements a page memory mixin with lists as the main content store.
__init__(memory=None, content=None, sinkhole=None, mo_cmp=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, endness=None, page_addr=None, memory=None, cooperate=False, **kwargs)
store(addr, data, size=None, endness=None, memory=None, cooperate=False, **kwargs)
erase(addr, size=None, **kwargs)
Set [addr:addr+size) to uninitialized. In many cases this will be faster than overwriting those locations withnew values. This is commonly used during static data flow analysis.
Parameters• addr – The address to start erasing.
• size – The number of bytes for erasing.
Return type
None
ReturnsNonemerge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
476

Chapter 10. API ReferenceangrThere will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (list[ListPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)
Returns
True if the state plugins are actually merged.
Return typeboolchanged_bytes(other, page_addr=None)
Parameters• other (ListPage)• page_addr (int | None)class angr.storage.memory_mixins.paged_memory.pages.ultra_page.UltraPage(memory=None,
init_zero=False,**kwargs)
Bases: MemoryObjectMixin, PageBase
Default page implementation
SUPPORTS_CONCRETE_LOAD = True__init__(memory=None, init_zero=False, **kwargs)
classmethod new_from_shared(data, memory=None, **kwargs)
copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.

10.5. Memory Mixins

477

angr

In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, page_addr=None, endness=None, memory=None, cooperate=False, **kwargs)
store(addr, data, size=None, endness=None, memory=None, page_addr=None, cooperate=False,**kwargs)
Parameters• data (int | SimMemoryObject)• size (int | None)merge(others, merge_conditions, common_ancestor=None, page_addr=None, memory=None,changed_offsets=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (list[UltraPage]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged• page_addr (int | None)• changed_offsets (set[int] | None)

478

Chapter 10. API ReferenceangrReturns
True if the state plugins are actually merged.
Return typebool
concrete_load(addr, size, **kwargs)
Set SUPPORTS_CONCRETE_LOAD to True and implement concrete_load if reading concrete bytes isfaster in this memory model.
Parameters• addr – The address to load from.
• size – Size of the memory read.
• writing
Returns
A memoryview into the loaded bytes.
changed_bytes(other, page_addr=None)
Return typeset[int]
state:

angr.SimState

replace_all_with_offsets(offsets, old, new, memory=None)
Parameters• offsets (Iterable[int])• old (BV)
• new (BV)
class angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin(write_targets_limit=2048,
read_targets_limit=4096,
stack_region_map=None,
generic_region_map=None,
stack_size=65536,
cle_memory_backer=None,
dict_memory_backer=None,regioned_memory_cls=None,**kwargs)
Bases: MemoryMixin
Regioned memory. This mixin manages multiple memory regions. Each address is represented as a tuple of(region ID, offset into the region), which is called a regioned address.
Converting absolute addresses into regioned addresses: We map an absolute address to a region by looking up
which region this address belongs to in the region map. Currently this is only enabled for stack. Heap support
has not landed yet.
When start analyzing a function, the user should call set_stack_address_mapping() to create a new region mapping. Likewise, when exiting from a function, the user should cancel the previous mapping by calling unset_stack_address_mapping().

10.5. Memory Mixins

479

angr

__init__(write_targets_limit=2048, read_targets_limit=4096, stack_region_map=None,
generic_region_map=None, stack_size=65536, cle_memory_backer=None,
dict_memory_backer=None, regioned_memory_cls=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
load(addr, size=None, endness=None, condition=None, **kwargs)
Parameters• size (BV | int | None)• condition (Bool | None)store(addr, data, size=None, endness=None, **kwargs)
Parameters
size (int | None)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters
480

Chapter 10. API Referenceangr• others (Iterable[RegionedMemoryMixin]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolfind(addr, data, max_search, **kwargs)
Parametersaddr (int | Bits)
set_state(state)
Sets a new state (for example, if the state has been branched)replace_all(old, new)Parameters• old (BV)
• new (BV)
set_stack_address_mapping(absolute_address, region_id, related_function_address=None)
Create a new mapping between an absolute address (which is the base address of a specific stack frame)
and a region ID.
Parameters• absolute_address (int) – The absolute memory address.
• region_id (str) – The region ID.
• related_function_address (Optional[int]) – Related function address.
unset_stack_address_mapping(absolute_address)
Remove a stack mapping.
Parameters
absolute_address (int) – An absolute memory address that is the base address of thestack frame to destroy.
stack_id(function_address)
Return a memory region ID for a function. If the default region ID exists in the region mapping, an integer
will appended to the region name. In this way we can handle recursive function calls, or a function thatappears more than once in the call frame.
This also means that stack_id() should only be called when creating a new stack frame for a function. You
are not supposed to call this function every time you want to map a function address to a stack ID.
Parametersfunction_address (int) – Address of the function.
Return type
str
Returns
ID of the new memory region.

10.5. Memory Mixins

481

angr

set_stack_size(size)
Parameters
size (int)class angr.storage.memory_mixins.regioned_memory.RegionCategoryMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
property categoryreg, mem, or file.
Type
Return the category of this SimMemory instance. It can be one of the three following categories
class angr.storage.memory_mixins.regioned_memory.StaticFindMixin(memory_id=None,
endness='Iend_BE')Bases: SmartFindMixin
Implements data finding for abstract memory.
find(addr, data, max_search, default=None, endness=None, chunk_size=None, max_symbolic_bytes=None,condition=None, char_size=1, **kwargs)
class angr.storage.memory_mixins.regioned_memory.AbstractMergerMixin(memory_id=None,
endness='Iend_BE')Bases: MemoryMixin
AbstractMergerMixin handles merging initialized values.
class angr.storage.memory_mixins.regioned_memory.MemoryRegionMetaMixin(related_function_addr=None,**kwargs)
Bases: MemoryMixin__init__(related_function_addr=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property is_stackproperty related_function_addr
get_abstract_locations(addr, size)
Get a list of abstract locations that is within the range of [addr, addr + size]
This implementation is pretty slow. But since this method won’t be called frequently, we can live with thebad implementation for now.
482

Chapter 10. API ReferenceangrParameters• addr – Starting address of the memory region.
• size – Size of the memory region, in bytes.
Returns
A list of covered AbstractLocation objects, or an empty list if there is none.
store(addr, data, bbl_addr=None, stmt_id=None, ins_addr=None, endness=None, **kwargs)load(addr, size=None, bbl_addr=None, stmt_idx=None, ins_addr=None, **kwargs)
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.

10.5. Memory Mixins

483

angr

Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
dbg_print(indent=0)
Print out debugging information
class angr.storage.memory_mixins.regioned_memory.RegionedAddressConcretizationMixin(read_strategies=None,
write_strategies=None,**kwargs)
Bases: MemoryMixin__init__(read_strategies=None, write_strategies=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
484

Chapter 10. API ReferenceangrThere is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolclass angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin(write_targets_lim
read_targets_lim
stack_region_ma
generic_region_
stack_size=6553
cle_memory_bac
dict_memory_ba
regioned_memory**kwargs)
Bases: MemoryMixin
Regioned memory. This mixin manages multiple memory regions. Each address is represented as a tuple of(region ID, offset into the region), which is called a regioned address.
Converting absolute addresses into regioned addresses: We map an absolute address to a region by looking up
which region this address belongs to in the region map. Currently this is only enabled for stack. Heap support
has not landed yet.
When start analyzing a function, the user should call set_stack_address_mapping() to create a new region mapping. Likewise, when exiting from a function, the user should cancel the previous mapping by calling unset_stack_address_mapping().
__init__(write_targets_limit=2048, read_targets_limit=4096, stack_region_map=None,
generic_region_map=None, stack_size=65536, cle_memory_backer=None,
dict_memory_backer=None, regioned_memory_cls=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.

10.5. Memory Mixins

485

angr

load(addr, size=None, endness=None, condition=None, **kwargs)
Parameters• size (BV | int | None)• condition (Bool | None)store(addr, data, size=None, endness=None, **kwargs)
Parameters
size (int | None)merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others (Iterable[RegionedMemoryMixin]) – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolfind(addr, data, max_search, **kwargs)
Parametersaddr (int | Bits)

486

Chapter 10. API Referenceangr

set_state(state)
Sets a new state (for example, if the state has been branched)replace_all(old, new)Parameters• old (BV)
• new (BV)
set_stack_address_mapping(absolute_address, region_id, related_function_address=None)
Create a new mapping between an absolute address (which is the base address of a specific stack frame)
and a region ID.
Parameters• absolute_address (int) – The absolute memory address.
• region_id (str) – The region ID.
• related_function_address (Optional[int]) – Related function address.
unset_stack_address_mapping(absolute_address)
Remove a stack mapping.
Parameters
absolute_address (int) – An absolute memory address that is the base address of thestack frame to destroy.
stack_id(function_address)
Return a memory region ID for a function. If the default region ID exists in the region mapping, an integer
will appended to the region name. In this way we can handle recursive function calls, or a function thatappears more than once in the call frame.
This also means that stack_id() should only be called when creating a new stack frame for a function. You
are not supposed to call this function every time you want to map a function address to a stack ID.
Parametersfunction_address (int) – Address of the function.
Return type
str
Returns
ID of the new memory region.
set_stack_size(size)
Parameters
size (int)class angr.storage.memory_mixins.regioned_memory.region_data.AddressWrapper(region, region_base_addr,
address,
is_on_stack,function_address)
Bases: object
AddressWrapper is used in SimAbstractMemory, which provides extra meta information for an address (or aValueSet object) that is normalized from an integer/BVV/StridedInterval.

10.5. Memory Mixins

487

angr

Parameters• region (str)• region_base_addr (int)• is_on_stack (bool)• function_address (int | None)__init__(region, region_base_addr, address, is_on_stack, function_address)
Constructor for the class AddressWrapper.
Parameters• region (str) – Name of the memory regions it belongs to.
• region_base_addr (int) – Base address of the memory region• address – An address (not a ValueSet object).
• is_on_stack (bool) – Whether this address is on a stack region or not.
• function_address (int | None) – Related function address (if any).
regionregion_base_addr
address
is_on_stack
function_address
to_valueset(state)
Convert to a ValueSet instanceParametersstate – A state
Returns
The converted ValueSet instanceclass angr.storage.memory_mixins.regioned_memory.region_data.RegionDescriptor(region_id,
base_address,
related_function_address=None)
Bases: object
Descriptor for a memory region ID.
__init__(region_id, base_address, related_function_address=None)region_id
base_address
related_function_address

488

Chapter 10. API Referenceangrclass angr.storage.memory_mixins.regioned_memory.region_data.RegionMap(is_stack)Bases: object
Mostly used in SimAbstractMemory, RegionMap stores a series of mappings between concrete memory address
ranges and memory regions, like stack frames and heap regions.
__init__(is_stack)Constructor
Parameters
is_stack – Whether this is a region map for stack frames or not. Different strategies apply
for stack regions.
property is_empty
property stack_base
property region_ids
copy(memo=None, **kwargs)
map(absolute_address, region_id, related_function_address=None)
Add a mapping between an absolute address and a region ID. If this is a stack region map, all stack regions
beyond (lower than) this newly added regions will be discarded.
Parameters• absolute_address – An absolute memory address.
• region_id – ID of the memory region.
• related_function_address – A related function address, mostly used for stack regions.
unmap_by_address(absolute_address)
Removes a mapping based on its absolute address.
Parameters
absolute_address – An absolute address
absolutize(region_id, relative_address)
Convert a relative address in some memory region to an absolute address.
Parameters• region_id – The memory region ID• relative_address – The relative memory offset in that memory region
Returns
An absolute address if converted, or an exception is raised when region id does not exist.
relativize(absolute_address, target_region_id=None)
Convert an absolute address to the memory offset in a memory region.
Note that if an address belongs to heap region is passed in to a stack region map, it will be converted to
an offset included in the closest stack frame, and vice versa for passing a stack address to a heap region.
Therefore you should only pass in address that belongs to the same category (stack or non-stack) of thisregion map.
Parameters
absolute_address – An absolute memory address

10.5. Memory Mixins

489

angr

Returns
A tuple of the closest region ID, the relative offset, and the related function address.

class angr.storage.memory_mixins.regioned_memory.region_category_mixin.RegionCategoryMixin(memory_id=Nonendness='Iend_BE')Bases: MemoryMixin
property categoryreg, mem, or file.
Type
Return the category of this SimMemory instance. It can be one of the three following categories
class angr.storage.memory_mixins.regioned_memory.static_find_mixin.StaticFindMixin(memory_id=None,
endness='Iend_BE')Bases: SmartFindMixin
Implements data finding for abstract memory.
find(addr, data, max_search, default=None, endness=None, chunk_size=None, max_symbolic_bytes=None,condition=None, char_size=1, **kwargs)
class angr.storage.memory_mixins.regioned_memory.abstract_address_descriptor.
AbstractAddressDescriptor
Bases: object
AbstractAddressDescriptor describes a list of region+offset tuples. It provides a convenient way for accessing
the cardinality (the total number of addresses) without enumerating or creating all addresses in static mode.
__init__()property cardinality
add_regioned_address(region, addr)
Parameters• region (str)• addr (BV)
clear()
class angr.storage.memory_mixins.regioned_memory.region_meta_mixin.Segment(offset, size=0)
Bases: object
Segment represents a continuous memory region.
__init__(offset, size=0)
class angr.storage.memory_mixins.regioned_memory.region_meta_mixin.AbstractLocation(bbl_key,
stmt_id,region_id,
segment_list=None,region_offset=None,
size=None)
490

Chapter 10. API ReferenceangrBases: object
AbstractLocation represents a location in memory.
__init__(bbl_key, stmt_id, region_id, segment_list=None, region_offset=None, size=None)
property basicblock_key
property statement_id
property region
property segments
update(region_offset, size)copy()
merge(other)class angr.storage.memory_mixins.regioned_memory.region_meta_mixin.MemoryRegionMetaMixin(related_function_a**kwargs)
Bases: MemoryMixin__init__(related_function_addr=None, **kwargs)
copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
property is_stackproperty related_function_addr
get_abstract_locations(addr, size)
Get a list of abstract locations that is within the range of [addr, addr + size]
This implementation is pretty slow. But since this method won’t be called frequently, we can live with thebad implementation for now.
Parameters• addr – Starting address of the memory region.
• size – Size of the memory region, in bytes.
Returns
A list of covered AbstractLocation objects, or an empty list if there is none.
store(addr, data, bbl_addr=None, stmt_id=None, ins_addr=None, endness=None, **kwargs)

10.5. Memory Mixins

491

angr

load(addr, size=None, bbl_addr=None, stmt_idx=None, ins_addr=None, **kwargs)
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typebool
widen(others)
The widening operation for plugins. Widening is a special kind of merging that produces a more generalstate from several more specific states. It is used only during intensive static analysis. The same behavior
regarding copying and mutation from merge should be followed.
Parameters
others – the other state plugin
Returns
True if the state plugin is actually widened.
Return typebool
dbg_print(indent=0)
Print out debugging information

492

Chapter 10. API Referenceangrclass angr.storage.memory_mixins.regioned_memory.abstract_merger_mixin.AbstractMergerMixin(memory_id=Nonendness='Iend_BE')Bases: MemoryMixin
AbstractMergerMixin handles merging initialized values.

class angr.storage.memory_mixins.regioned_memory.regioned_address_concretization_mixin.RegionedAddressCo

Bases: MemoryMixin__init__(read_strategies=None, write_strategies=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo=None, **kwargs)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit
There is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)

10.5. Memory Mixins

493

angr

Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolclass angr.storage.memory_mixins.slotted_memory.SlottedMemoryMixin(width=None, **kwargs)
Bases: MemoryMixin__init__(width=None, **kwargs)
set_state(state)
Sets a new state (for example, if the state has been branched)copy(memo)
Should return a copy of the plugin without any state attached. Should check the memo first, and add itself
to memo if it ends up making a new copy.
In order to simplify using the memo, you should annotate implementations of this function with
SimStatePlugin.memo
The base implementation of this function constructs a new instance of the plugin’s class without calling its
initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
Parameters
memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to
avoid infinite recursion and diverged copies.
merge(others, merge_conditions, common_ancestor=None)
Should merge the state plugin with the provided others. This will be called by state.merge() after
copying the target state, so this should mutate the current instance to merge with the others.
Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
it is important that merge only ever be called once. This should be solved by designating one of the plugin’sreferees as the “real owner”, who should be the one to actually merge it. This technique doesn’t work to
resolve the similar issue that arises during copying because merging doesn’t produce a new reference toinsert.
There will be n others and n+1 merge conditions, since the first condition corresponds to self. To match
elements up to conditions, say zip([self] + others, merge_conditions)
When implementing this, make sure that you “deepen” both others and common_ancestor before calling
sub-elements’ merge methods, e.g.
self.foo.merge([o.foo for o in others],
merge_conditions,common_ancestor=common_ancestor.foo if common_ancestor is not None else None)
During static analysis, merge_conditions can be None, in which case you should use state.solver.
union(values). TODO: fish please make this less bullshit

494

Chapter 10. API ReferenceangrThere is a utility claripy.ite_cases which will help with constructing arbitrarily large merged
ASTs. Use it like self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o inothers]), self.bar)
Parameters• others – the other state plugins to merge with• merge_conditions – a symbolic condition for each of the plugins• common_ancestor – a common ancestor of this plugin and the others being merged
Returns
True if the state plugins are actually merged.
Return typeboolload(addr, size=None, endness=None, **kwargs)
store(addr, data, size=None, endness=None, **kwargs)changed_bytes(other)

10.6 Concretization Strategies
class angr.concretization_strategies.single.SimConcretizationStrategySingle(filter=None,exact=True)
Bases: SimConcretizationStrategy
Concretization strategy that ensures a single solution for an address.
class angr.concretization_strategies.eval.SimConcretizationStrategyEval(limit, **kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves an address into some limited number of solutions. Always handles theconcretization, but only returns a maximum of limit number of solutions. Therefore, should only be used as the
fallback strategy.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.norepeats.SimConcretizationStrategyNorepeats(repeat_expr,
repeat_constraints=None,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves addresses, without repeating.

10.6. Concretization Strategies

495

angr

__init__(repeat_expr, repeat_constraints=None, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
copy()
Returns a copy of the strategy, if there is data that should be kept separate between states. If not, returns
self.
merge(others)
Merges this strategy with others (if there is data that should be kept separate between states. If not, is a
no-op.
class angr.concretization_strategies.solutions.SimConcretizationStrategySolutions(limit,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves an address into some limited number of solutions.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.nonzero_range.SimConcretizationStrategyNonzeroRange(limit,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves a range in a non-zero location.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.range.SimConcretizationStrategyRange(limit, **kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves addresses to a range.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters
496

Chapter 10. API Referenceangr• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.max.SimConcretizationStrategyMax(max_addr=None)
Bases: SimConcretizationStrategy
Concretization strategy that returns the maximum address.
Parameters
max_addr (int | None)__init__(max_addr=None)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
• max_addr (int | None)class angr.concretization_strategies.norepeats_range.SimConcretizationStrategyNorepeatsRange(repeat_expr,
min=None,granularity=None,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves a range, with no repeats.
__init__(repeat_expr, min=None, granularity=None, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
copy()
Returns a copy of the strategy, if there is data that should be kept separate between states. If not, returns
self.
merge(others)
Merges this strategy with others (if there is data that should be kept separate between states. If not, is a
no-op.
class angr.concretization_strategies.nonzero.SimConcretizationStrategyNonzero(filter=None,exact=True)
Bases: SimConcretizationStrategy
Concretization strategy that returns any non-zero solution.
10.6. Concretization Strategies

497

angr

class angr.concretization_strategies.any.SimConcretizationStrategyAny(filter=None,exact=True)
Bases: SimConcretizationStrategy
Concretization strategy that returns any single solution.
class angr.concretization_strategies.controlled_data.SimConcretizationStrategyControlledData(limit,
fixed_addrs,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that constraints the address to controlled data. Controlled data consists of symbolic data
and the addresses given as arguments. memory.
__init__(limit, fixed_addrs, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.
class angr.concretization_strategies.unlimited_range.SimConcretizationStrategyUnlimitedRange(limit,**kwargs)
Bases: SimConcretizationStrategy
Concretization strategy that resolves addresses to a range without checking if the number of possible addresses
is within the limit.
__init__(limit, **kwargs)
Initializes the base SimConcretizationStrategy.
Parameters• filter – A function, taking arguments of (SimMemory, claripy.AST) that determines if
this strategy can handle resolving the provided AST.
• exact – A flag (default: True) that determines if the convenience resolution functions
provided by this class use exact or approximate resolution.

10.7 Simulation Manager
class angr.sim_manager.SimulationManager(project, active_states=None, stashes=None, hierarchy=None,
resilience=None, save_unsat=False, auto_drop=None,errored=None, completion_mode=<built-in function any>,techniques=None, suggestions=True, **kwargs)
Bases: object
The Simulation Manager is the future future.
Simulation managers allow you to wrangle multiple states in a slick way. States are organized into “stashes”,
which you can step forward, filter, merge, and move around as you wish. This allows you to, for example, step
two different stashes of states at different rates, then merge them together.
Stashes can be accessed as attributes (i.e. .active). A mulpyplexed stash can be retrieved by prepending the namewith mp_, e.g. .mp_active. A single state from the stash can be retrieved by prepending the name with one_, e.g.
.one_active.
498

Chapter 10. API ReferenceangrNote that you shouldn’t usually be constructing SimulationManagers directly - there is a convenient shortcut for
creating them in Project.factory: see angr.factory.AngrObjectFactory.
The most important methods you should look at are step, explore, and use_technique.
Parameters• project (angr.project.Project) – A Project instance.
• stashes – A dictionary to use as the stash store.
• active_states – Active states to seed the “active” stash with.
• hierarchy – A StateHierarchy object to use to track the relationships between states.
• resilience – A set of errors to catch during stepping to put a state in the errore list. You
may also provide the values False, None (default), or True to catch, respectively, no errors,
all angr-specific errors, and a set of many common errors.
• save_unsat – Set to True in order to introduce unsatisfiable states into the unsat stash
instead of discarding them immediately.
• auto_drop – A set of stash names which should be treated as garbage chutes.
• completion_mode – A function describing how multiple exploration techniques with thecomplete hook set will interact. By default, the builtin function any.
• techniques – A list of techniques that should be pre-set to use with this manager.
• suggestions – Whether to automatically install the Suggestions exploration technique. Default True.
Variables• errored – Not a stash, but a list of ErrorRecords. Whenever a step raises an exception that
we catch, the state and some information about the error are placed in this list. You can adjust
the list of caught exceptions with the resilience parameter.
• stashes – All the stashes on this instance, as a dictionary.
• completion_mode – A function describing how multiple exploration techniques with thecomplete hook set will interact. By default, the builtin function any.
ALL = '_ALL'
DROP = '_DROP'__init__(project, active_states=None, stashes=None, hierarchy=None, resilience=None, save_unsat=False,
auto_drop=None, errored=None, completion_mode=<built-in function any>, techniques=None,suggestions=True, **kwargs)
active:list[SimState]

stashed:list[SimState]pruned:list[SimState]

unsat:

list[SimState]deadended:list[SimState]

unconstrained:
found:

list[SimState]

list[SimState]

10.7. Simulation Manager

499

angr

one_active:

SimState

one_stashed:

SimState

one_pruned:

SimState

one_unsat:

SimState

one_deadended:

SimState

one_unconstrained:
one_found:

SimState

SimState

property errored:

list[ErrorRecord ]property stashes:

defaultdict[str, list[SimState]]

mulpyplex(*stashes)
Mulpyplex across several stashes.
Parameters
stashes – the stashes to mulpyplex
Returnsa mulpyplexed list of states from the stashes in question, in the specified ordercopy(deep=False)
Make a copy of this simulation manager. Pass deep=True to copy all the states in it as well.
If the current callstack includes hooked methods, the already-called methods will not be included in the
copy.
use_technique(tech)Use an exploration technique with this SimulationManager.
Techniques can be found in angr.exploration_techniques.
Parameters
tech (ExplorationTechnique) – An ExplorationTechnique object that contains code tomodify this SimulationManager’s behavior.
Returns
The technique that was added, for convenience
remove_technique(tech)
Remove an exploration technique from a list of active techniques.
Parameters
tech (ExplorationTechnique) – An ExplorationTechnique object.
explore(stash='active', n=None, find=None, avoid=None, find_stash='found', avoid_stash='avoid',
cfg=None, num_find=1, avoid_priority=False, **kwargs)
Tick stash “stash” forward (up to “n” times or until “num_find” states are found), looking for condition “find”, avoiding condition “avoid”. Stores found states into “find_stash’ and avoided states into
“avoid_stash”.
The “find” and “avoid” parameters may be any of:• An address to find
• A set or list of addresses to find500

Chapter 10. API Reference

angr• A function that takes a state and returns whether or not it matches.
If an angr CFG is passed in as the “cfg” parameter and “find” is either a number or a list or a set, then any
states which cannot possibly reach a success state without going through a failure state will be preemptively
avoided.
run(stash='active', n=None, until=None, **kwargs)
Run until the SimulationManager has reached a completed state, according to the current exploration techniques. If no exploration techniques that define a completion state are being used, run until there is nothingleft to run.
Parameters• stash – Operate on this stash• n – Step at most this many times• until – If provided, should be a function that takes a SimulationManager and returns Trueor False. Stepping will terminate when it is True.
Returns
The simulation manager, for chaining.
Return type
SimulationManager
complete()
Returns whether or not this manager has reached a “completed” state.
step(stash='active', target_stash=None, n=None, selector_func=None, step_func=None, error_list=None,
successor_func=None, until=None, filter_func=None, **run_args)
Step a stash of states forward and categorize the successors appropriately.
The parameters to this function allow you to control everything about the stepping and categorization process.
Parameters• stash – The name of the stash to step (default: ‘active’)• target_stash – The name of the stash to put the results in (default: same as stash)• error_list – The list to put ErrorRecord objects in (default: self.errored)• selector_func – If provided, should be a function that takes a state and returns a boolean.
If True, the state will be stepped. Otherwise, it will be kept as-is.
• step_func – If provided, should be a function that takes a SimulationManager and returns
a SimulationManager. Will be called with the SimulationManager at every step. Note that
this function should not actually perform any stepping - it is meant to be a maintenancefunction called after each step.
• successor_func – If provided, should be a function that takes a state and return its successors. Otherwise, project.factory.successors will be used.
• filter_func – If provided, should be a function that takes a state and return the name ofthe stash, to which the state should be moved.
• until – (DEPRECATED) If provided, should be a function that takes a SimulationManager and returns True or False. Stepping will terminate when it is True.
• n – (DEPRECATED) The number of times to step (default: 1 if “until” is not provided)
Additionally, you can pass in any of the following keyword args for project.factory.successors:

10.7. Simulation Manager

501

angr

Parameters• jumpkind – The jumpkind of the previous exit
• addr – An address to execute at instead of the state’s ip.
• stmt_whitelist – A list of stmt indexes to which to confine execution.
• last_stmt – A statement index at which to stop execution.
• thumb – Whether the block should be lifted in ARM’s THUMB mode.
• backup_state – A state to read bytes from instead of using project memory.
• opt_level – The VEX optimization level to use.
• insn_bytes – A string of bytes to use for the block instead of the project.
• size – The maximum size of the block, in bytes.
• num_inst – The maximum number of instructions.
• traceflags – traceflags to be passed to VEX. Default: 0
Returns
The simulation manager, for chaining.
Return type
SimulationManager
step_state(state, successor_func=None, error_list=None, **run_args)
Don’t use this function manually - it is meant to interface with exploration techniques.
filter(state, filter_func=None)
Don’t use this function manually - it is meant to interface with exploration techniques.
selector(state, selector_func=None)
Don’t use this function manually - it is meant to interface with exploration techniques.
successors(state, successor_func=None, **run_args)
Don’t use this function manually - it is meant to interface with exploration techniques.
prune(filter_func=None, from_stash='active', to_stash='pruned')
Prune unsatisfiable states from a stash.
This function will move all unsatisfiable states in the given stash into a different stash.
Parameters• filter_func – Only prune states that match this filter.
• from_stash – Prune states from this stash. (default: ‘active’)• to_stash – Put pruned states in this stash. (default: ‘pruned’)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
populate(stash, states)
Populate a stash with a collection of states.
Parameters• stash – A stash to populate.
502

Chapter 10. API Referenceangr• states – A list of states with which to populate the stash.
absorb(simgr)
Collect all the states from simgr and put them in their corresponding stashes in this manager. This will not
modify simgr.
move(from_stash, to_stash, filter_func=None)
Move states from one stash to another.
Parameters• from_stash – Take matching states from this stash.
• to_stash – Put matching states into this stash.
• filter_func – Stash states that match this filter. Should be a function that takes a state
and returns True or False. (default: stash all states)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
stash(filter_func=None, from_stash='active', to_stash='stashed')
Stash some states. This is an alias for move(), with defaults for the stashes.
Parameters• filter_func – Stash states that match this filter. Should be a function that takes a state
and returns True or False. (default: stash all states)• from_stash – Take matching states from this stash. (default: ‘active’)• to_stash – Put matching states into this stash. (default: ‘stashed’)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
unstash(filter_func=None, to_stash='active', from_stash='stashed')
Unstash some states. This is an alias for move(), with defaults for the stashes.
Parameters• filter_func – Unstash states that match this filter. Should be a function that takes a state
and returns True or False. (default: unstash all states)• from_stash – take matching states from this stash. (default: ‘stashed’)• to_stash – put matching states into this stash. (default: ‘active’)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
drop(filter_func=None, stash='active')
Drops states from a stash. This is an alias for move(), with defaults for the stashes.
Parameters10.7. Simulation Manager

503

angr

• filter_func – Drop states that match this filter. Should be a function that takes a state
and returns True or False. (default: drop all states)• stash – Drop matching states from this stash. (default: ‘active’)
Returns
The simulation manager, for chaining.
Return type
SimulationManager
apply(state_func=None, stash_func=None, stash='active', to_stash=None)
Applies a given function to a given stash.
Parameters• state_func – A function to apply to every state. Should take a state and return a state.
The returned state will take the place of the old state. If the function doesn’t return a state,
the old state will be used. If the function returns a list of states, they will replace the originalstates.
• stash_func – A function to apply to the whole stash. Should take a list of states and returna list of states. The resulting list will replace the stash. If both state_func and stash_func
are provided state_func is applied first, then stash_func is applied on the results.
• stash – A stash to work with.
• to_stash – If specified, this stash will be used to store the resulting states instead.
Returns
The simulation manager, for chaining.
Return type
SimulationManager
split(stash_splitter=None, stash_ranker=None, state_ranker=None, limit=8, from_stash='active',to_stash='stashed')
Split a stash of states into two stashes depending on the specified options.
The stash from_stash will be split into two stashes depending on the other options passed in. If to_stash isprovided, the second stash will be written there.
stash_splitter overrides stash_ranker, which in turn overrides state_ranker. If no functions are provided, thestates are simply split according to the limit.
The sort done with state_ranker is ascending.
Parameters• stash_splitter – A function that should take a list of states and return a tuple of twolists (the two resulting stashes).
• stash_ranker – A function that should take a list of states and return a sorted list of states.
This list will then be split according to “limit”.
• state_ranker – An alternative to stash_splitter. States will be sorted with outputs of thisfunction, which are to be used as a key. The first “limit” of them will be kept, the rest split
off.
• limit – For use with state_ranker. The number of states to keep. Default: 8• from_stash – The stash to split (default: ‘active’)• to_stash – The stash to write to (default: ‘stashed’)

504

Chapter 10. API ReferenceangrReturns
The simulation manager, for chaining.
Return type
SimulationManager
merge(merge_func=None, merge_key=None, stash='active', prune=True)
Merge the states in a given stash.
Parameters• stash – The stash (default: ‘active’)• merge_func – If provided, instead of using state.merge, call this function with the states
as the argument. Should return the merged state.
• merge_key – If provided, should be a function that takes a state and returns a key that willcompare equal for all states that are allowed to be merged together, as a first approximation.
By default: uses PC, callstack, and open file descriptors.
• prune – Whether to prune the stash prior to merging it
Returns
The simulation manager, for chaining.
Return type
SimulationManager
class angr.sim_manager.ErrorRecord(state, error, traceback)Bases: object
A container class for a state and an error that was thrown during its execution. You can find these in SimulationManager.errored.
Variables• state – The state that encountered an error, at the point in time just before the erroring stepbegan.
• error – The error that was thrown.
• traceback – The traceback for the error that was thrown.
__init__(state, error, traceback)debug()
Launch a postmortem debug shell at the site of the error.
reraise()class angr.state_hierarchy.StateHierarchy
Bases: object
The state hierarchy holds weak references to SimStateHistory objects in a directed acyclic graph. It is usefulfor queries about a state’s ancestry, notably “what is the best ancestor state for a merge among these states” and“what is the most recent unsatisfiable state while using LAZY_SOLVES”__init__()get_ref(obj)dead_ref(ref )10.7. Simulation Manager

505

angr

defer_cleanup()
add_state(s)add_history(h)simplify()
full_simplify()
lineage(h)Returns the lineage of histories leading up to h.
all_successors(h)history_successors(h)history_predecessors(h)history_contains(h)unreachable_state(state)
unreachable_history(h)most_mergeable(states)
Find the “most mergeable” set of states from those provided.
Parametersstates – a list of states
Returns
a tuple of: (list of states to merge, those states’ common history, list of states to not mergeyet)

10.8 Exploration Techniques
class angr.exploration_techniques.ExplorationTechnique
Bases: object
An otiegnqwvk is a set of hooks for a simulation manager that assists in the implementation of new techniquesin symbolic exploration.
TODO: choose actual name for the functionality (techniques? strategies?)
Any number of these methods may be overridden by a subclass. To use an exploration technique, call simgr.
use_technique with an instance of the technique.
__init__()setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
added

506

Chapter 10. API Referenceangrstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)filter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
selector(simgr, state, **kwargs)
Determine if a state should participate in the current round of stepping. Return True if the state should be
stepped, and False if the state should not be stepped. To defer to the original selection procedure, returnthe result of simgr.selector(state, **kwargs).
If the user provided a selector_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
step_state(simgr, state, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
10.8. Exploration Techniques

507

angr

If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)complete(simgr)
Return whether or not this manager has reached a “completed” state, i.e. SimulationManager.run()should halt.
This is the one hook which is not subject to the nesting rules of hooks. You should not call simgr.
complete, you should make your own decision and return True or False. Each of the techniques’ completion checkers will be called and the final result will be compted with simgr.completion_mode.
Parameterssimgr (angr.SimulationManager)
class angr.exploration_techniques.Slicecutor(annotated_cfg, force_taking_exit=False,
force_sat=False)
Bases: ExplorationTechnique
The Slicecutor is an exploration that executes provided code slices.
Parameters
force_sat (bool)__init__(annotated_cfg, force_taking_exit=False, force_sat=False)
All parameters except annotated_cfg are optional.
Parameters• annotated_cfg – The AnnotatedCFG that provides the code slice.
• force_taking_exit – Set to True if you want to create a successor based on our slice incase of unconstrained successors.
• force_sat (bool) – If a branch specified by the slice is unsatisfiable, set this option toTrue if you want to force it to be satisfiable and be taken anyway.
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
addedfilter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)

508

Chapter 10. API Referenceangrstep_state(simgr, state, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.DrillerCore(trace, fuzz_bitmap=None)
Bases: ExplorationTechnique
An exploration technique that symbolically follows an input looking for new state transitions.
It has to be used with Tracer exploration technique. Results are put in ‘diverted’ stash.
__init__(trace, fuzz_bitmap=None):param trace : The basic block trace. :type fuzz_bitmap: :param fuzz_bitmap: AFL’s bitmap of statetransitions. Defaults to saying every transition is worth satisfying.
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)10.8. Exploration Techniques

509

angr

class angr.exploration_techniques.LoopSeer(cfg=None, functions=None, loops=None,
use_header=False, bound=None, bound_reached=None,
discard_stash='spinning', limit_concrete_loops=True)
Bases: ExplorationTechniqueThis exploration technique monitors exploration and maintains all loop-related data (well, currently it is just theloop trip counts, but feel free to add something else).
__init__(cfg=None, functions=None, loops=None, use_header=False, bound=None, bound_reached=None,
discard_stash='spinning', limit_concrete_loops=True)
Parameters• cfg – Normalized CFG is required.
• functions – Function(s) containing the loop(s) to be analyzed.
• loops – Specific group of Loop(s) to be analyzed, if this is None we run the LoopFinder
analysis.
• use_header – Whether to use header based trip counter to compare with the bound limit.
• bound – Limit the number of iterations a loop may be executed.
• bound_reached – If provided, should be a function that takes the LoopSeer and thesucc_state. Will be called when loop execution reach the given bound. Default to moving states that exceed the loop limit to a discard stash.
• discard_stash – Name of the stash containing states exceeding the loop limit.
• limit_concrete_loops – If False, do not limit a loop back-edge if it is the only successor(Defaults to True to maintain the original behavior)
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
addedfilter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
510

Chapter 10. API ReferenceangrParameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.Tracer(trace=None, resiliency=False, keep_predecessors=1,
crash_addr=None, syscall_data=None, copy_states=False,
fast_forward_to_entry=True, mode='strict', aslr=True,
follow_unsat=False)
Bases: ExplorationTechnique
An exploration technique that follows an angr path with a concrete input. The tracing result is the state at the last
address of the trace, which can be found in the ‘traced’ stash.
If the given concrete input makes the program crash, you should provide crash_addr, and the crashing state will
be found in the ‘crashed’ stash.
Parameters• trace – The basic block trace.
• resiliency – Should we continue to step forward even if qemu and angr disagree?
• keep_predecessors – Number of states before the final state we should log.
• crash_addr – If the trace resulted in a crash, provide the crashing instruction pointer here,
and the ‘crashed’ stash will be populated with the crashing state.
• syscall_data – Data related to various syscalls recorded by tracer for replaying• copy_states – Whether COPY_STATES should be enabled for the tracing state. It is off
by default because most tracing workloads benefit greatly from not performing copying. You
want to enable it if you want to see the missed states. It will be re-added for the last 2% of
the trace in order to set the predecessors list correctly. If you turn this on you may want toenable the LAZY_SOLVES option.
• mode – Tracing mode.
• aslr – Whether there are aslr slides. if not, tracer uses trace address as state address.
• follow_unsat – Whether unsatisfiable states should be treated as potential successors ornot.
Variables
predecessors – A list of states in the history before the final state.
__init__(trace=None, resiliency=False, keep_predecessors=1, crash_addr=None, syscall_data=None,copy_states=False, fast_forward_to_entry=True, mode='strict', aslr=True, follow_unsat=False)
set_fd_data(fd_data)
Set concrete bytes of various fds read by the program
Parameters
fd_data (dict[int, bytes])
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
added

10.8. Exploration Techniques

511

angr

complete(simgr)
Return whether or not this manager has reached a “completed” state, i.e. SimulationManager.run()should halt.
This is the one hook which is not subject to the nesting rules of hooks. You should not call simgr.
complete, you should make your own decision and return True or False. Each of the techniques’ completion checkers will be called and the final result will be compted with simgr.completion_mode.
Parameterssimgr (angr.SimulationManager)filter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)step_state(simgr, state, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)classmethod crash_windup(state, crash_addr)
class angr.exploration_techniques.Explorer(find=None, avoid=None, find_stash='found',avoid_stash='avoid', cfg=None, num_find=1,
avoid_priority=False)
Bases: ExplorationTechnique

512

Chapter 10. API ReferenceangrSearch for up to “num_find” paths that satisfy condition “find”, avoiding condition “avoid”. Stashes found paths
into “find_stash’ and avoided paths into “avoid_stash”.
The “find” and “avoid” parameters may be any of:• An address to find
• A set or list of addresses to find
• A function that takes a path and returns whether or not it matches.
If an angr CFG is passed in as the “cfg” parameter and “find” is either a number or a list or a set, then any paths
which cannot possibly reach a success state without going through a failure state will be preemptively avoided.
If either the “find” or “avoid” parameter is a function returning a boolean, and a path triggers both conditions, itwill be added to the find stash, unless “avoid_priority” is set to True.
__init__(find=None, avoid=None, find_stash='found', avoid_stash='avoid', cfg=None, num_find=1,
avoid_priority=False)
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)filter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)complete(simgr)
Return whether or not this manager has reached a “completed” state, i.e. SimulationManager.run()should halt.
This is the one hook which is not subject to the nesting rules of hooks. You should not call simgr.
complete, you should make your own decision and return True or False. Each of the techniques’ completion checkers will be called and the final result will be compted with simgr.completion_mode.
Parameterssimgr (angr.SimulationManager)

10.8. Exploration Techniques

513

angr

class angr.exploration_techniques.Threading(threads=8, local_stash='thread_local')Bases: ExplorationTechnique
Enable multithreading.
This is only useful in paths where a lot of time is taken inside z3, doing constraint solving. This is because ofpython’s GIL, which says that only one thread at a time may be executing python code.
__init__(threads=8, local_stash='thread_local')step(simgr, stash='active', error_list=None, target_stash=None, **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)inner_step(state, simgr, **kwargs)
successors(simgr, state, engine=None, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.DFS(deferred_stash='deferred')Bases: ExplorationTechnique
Depth-first search.
Will only keep one path active at a time, any others will be stashed in the ‘deferred’ stash. When we run out ofactive paths to step, we take the longest one from deferred and continue.
__init__(deferred_stash='deferred')
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)514

Chapter 10. API Referenceangrclass angr.exploration_techniques.LengthLimiter(max_length, drop=False)
Bases: ExplorationTechnique
Length limiter on paths.
__init__(max_length, drop=False)step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.Veritesting(**options)
Bases: ExplorationTechnique
Enable veritesting. This technique, described in a paper[1] from CMU, attempts to address the problem of state
explosions in loops by performing smart merging.
[1] https://users.ece.cmu.edu/~aavgerin/papers/veritesting-icse-2014.pdf__init__(**options)step_state(simgr, state, successor_func=None, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.Oppologist
Bases: ExplorationTechnique
The Oppologist is an exploration technique that forces uncooperative code through qemu.
__init__()successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.

10.8. Exploration Techniques

515

angr

Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.Director(peek_blocks=100, peek_functions=5, goals=None,
cfg_keep_states=False, goal_satisfied_callback=None,num_fallback_states=5)
Bases: ExplorationTechnique
An exploration technique for directed symbolic execution.
A control flow graph (using CFGEmulated) is built and refined during symbolic execution. Each time the execution reaches a block that is outside of the CFG, the CFG recovery will be triggered with that state, with amaximum recovery depth (100 by default). If we see a basic block during state stepping that is not yet in thecontrol flow graph, we go back to control flow graph recovery and “peek” more blocks forward.
When stepping a simulation manager, all states are categorized into three different categories:• Might reach the destination within the peek depth. Those states are prioritized.
• Will not reach the destination within the peek depth. Those states are de-prioritized. However, there is alittle chance for those states to be explored as well in order to prevent over-fitting.
__init__(peek_blocks=100, peek_functions=5, goals=None, cfg_keep_states=False,
goal_satisfied_callback=None, num_fallback_states=5)Constructor.
step(simgr, stash='active', **kwargs)
Parameters• simgr• stash• kwargs
Returns
add_goal(goal)
Add a goal.
Parameters
goal (BaseGoal) – The goal to add.
ReturnsNoneclass angr.exploration_techniques.ExecuteAddressGoal(addr)
Bases: BaseGoal
A goal that prioritizes states reaching (or are likely to reach) certain address in some specific steps.
__init__(addr)
check(cfg, state, peek_blocks)
Check if the specified address will be executed
Parameters• cfg• state
516

Chapter 10. API Referenceangr• peek_blocks (int)
Returns
Return typebool
check_state(state)
Check if the current address is the target address.
Parametersstate (angr.SimState) – The state to check.
Returns
True if the current address is the target address, False otherwise.
Return typeboolclass angr.exploration_techniques.CallFunctionGoal(function, arguments)
Bases: BaseGoal
A goal that prioritizes states reaching certain function, and optionally with specific arguments. Note that constraints on arguments (and on function address as well) have to be identifiable on an accurate CFG. For example,
you may have a CallFunctionGoal saying “call printf with the first argument being ‘Hello, world’”, and CFGEmulated must be able to figure our the first argument to printf is in fact “Hello, world”, not some symbolic strings
that will be constrained to “Hello, world” during symbolic execution (or simulation, however you put it).
REQUIRE_CFG_STATES = True__init__(function, arguments)
check(cfg, state, peek_blocks)
Check if the specified function will be reached with certain arguments.
Parameters• cfg• state• peek_blocks
Returnscheck_state(state)
Check if the specific function is reached with certain arguments
Parametersstate (angr.SimState) – The state to check
Returns
True if the function is reached with certain arguments, False otherwise.
Return typeboolclass angr.exploration_techniques.Spiller(src_stash='active', min=5, max=10,
staging_stash='spill_stage', staging_min=10,
staging_max=20, pickle_callback=None,
unpickle_callback=None, post_pickle_callback=None,
priority_key=None, vault=None, states_collection=None)

10.8. Exploration Techniques

517

angr

Bases: ExplorationTechnique
Automatically spill states out. It can spill out states to a different stash, spill them out to ANA, or first do theformer and then (after enough states) the latter.
__init__(src_stash='active', min=5, max=10, staging_stash='spill_stage', staging_min=10,
staging_max=20, pickle_callback=None, unpickle_callback=None, post_pickle_callback=None,
priority_key=None, vault=None, states_collection=None)
Initializes the spiller.
Parameters• max – the number of states that are not spilled• src_stash – the stash from which to spill states (default: active)• staging_stash – the stash to which to spill states (default: “spill_stage”)• staging_max – the number of states that can be in the staging stash before things get spilled
to ANA (default: None. If staging_stash is set, then this means unlimited, and ANA will
not be used).
• priority_key – a function that takes a state and returns its numerical priority (MAX_INT
is lowest priority). By default, self.state_priority will be used, which prioritizes by object
ID.
• vault – an angr.Vault object to handle storing and loading of states. If not provided, anangr.vaults.VaultShelf will be created with a temporary file.
step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)static state_priority(state)class angr.exploration_techniques.ManualMergepoint(address, wait_counter=10, prune=True)
Bases: ExplorationTechnique__init__(address, wait_counter=10, prune=True)
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
added
mark_nofilter(simgr, stash)
mark_okfilter(simgr, stash)
step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters
518

Chapter 10. API Referenceangr• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.TechniqueBuilder(setup=None, step_state=None, step=None,
successors=None, filter=None, selector=None,complete=None)
Bases: ExplorationTechniqueThis meta technique could be used to hook a couple of simulation manager methods without actually creating a
new exploration technique, for example:
class SomeComplexAnalysis(Analysis):def do_something():simgr = self.project.factory.simulation_manager() simgr.use_tech(ProxyTechnique(step_state=self._step_state))simgr.run()def _step_state(self, state):# Do stuff! passIn the above example, the _step_state method can access all the necessary stuff, hidden in the analysis instance,
without passing that instance to a one-shot-styled exploration technique.
__init__(setup=None, step_state=None, step=None, successors=None, filter=None, selector=None,complete=None)class angr.exploration_techniques.StochasticSearch(start_state, restart_prob=0.0001)
Bases: ExplorationTechnique
Stochastic Search.
Will only keep one path active at a time, any others will be discarded. Before each pass through, weights are
randomly assigned to each basic block. These weights form a probability distribution for determining whichstate remains after splits. When we run out of active paths to step, we start again from the start state.
__init__(start_state, restart_prob=0.0001)
Parameters• start_state – The initial state from which exploration stems.
• restart_prob – The probability of randomly restarting the search (default 0.0001).
step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.UniqueSearch(similarity_func=None, deferred_stash='deferred')Bases: ExplorationTechnique
Unique Search.
Will only keep one path active at a time, any others will be deferred. The state that is explored depends on
how unique it is relative to the other deferred states. A path’s uniqueness is determined by its average similarity
between the other (deferred) paths. Similarity is calculated based on the supplied similarity_func, which by
default is: The (L2) distance between the counts of the state addresses in the history of the path.

10.8. Exploration Techniques

519

angr

__init__(similarity_func=None, deferred_stash='deferred')Parameters• similarity_func – How to calculate similarity between two states.
• deferred_stash – Where to store the deferred states.
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)static similarity(state_a, state_b)
The (L2) distance between the counts of the state addresses in the history of the path. :type state_a: :paramstate_a: The first state to compare :type state_b: :param state_b: The second state to compare
static sequence_matcher_similarity(state_a, state_b)
The difflib.SequenceMatcher ratio between the state addresses in the history of the path. :type state_a::param state_a: The first state to compare :type state_b: :param state_b: The second state to compareclass angr.exploration_techniques.Symbion(find=None, memory_concretize=None,
register_concretize=None, timeout=0, find_stash='found')Bases: ExplorationTechnique
The Symbion exploration technique uses the SimEngineConcrete available to step a SimState.
Parameters• find – address or list of addresses that we want to reach, these will be translated into breakpoints inside the concrete process using the ConcreteTarget interface provided by the user
inside the SimEngineConcrete.
• memory_concretize – list of tuples (address, symbolic variable) that are going to be written
in the concrete process memory.
• register_concretize – list of tuples (reg_name, symbolic variable) that are going to be
written• timeout – how long we should wait the concrete target to reach the breakpoint__init__(find=None, memory_concretize=None, register_concretize=None, timeout=0, find_stash='found')setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
added

520

Chapter 10. API Referenceangrstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)step_state(simgr, *args, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)complete(simgr)
Return whether or not this manager has reached a “completed” state, i.e. SimulationManager.run()should halt.
This is the one hook which is not subject to the nesting rules of hooks. You should not call simgr.
complete, you should make your own decision and return True or False. Each of the techniques’ completion checkers will be called and the final result will be compted with simgr.completion_mode.
Parameterssimgr (angr.SimulationManager)
class angr.exploration_techniques.MemoryWatcher(min_memory=512, memory_stash='lowmem')
Bases: ExplorationTechnique
Memory Watcher
Parameters• min_memory (int,optional) – Minimum amount of free memory in MB before stopping
execution (default: 95% memory use)
• memory_stash (str, optional) – What to call the low memory stash (default:‘lowmem’)At each step, keep an eye on how much memory is left on the system. Stash off states to effectively stop execution
if we’re below a given threshold.
__init__(min_memory=512, memory_stash='lowmem')
setup(simgr)
Perform any initialization on this manager you might need to do.

10.8. Exploration Techniques

521

angr

Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.Bucketizer
Bases: ExplorationTechnique
Loop bucketization: Pick log(n) paths out of n possible paths, and stash (or drop) everything else.
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.LocalLoopSeer(bound=None, bound_reached=None,
discard_stash='spinning')
Bases: ExplorationTechnique
LocalLoopSeer monitors exploration and maintains all loop-related data without relying on a control flow graph.
__init__(bound=None, bound_reached=None, discard_stash='spinning')
Parameters• bound – Limit the number of iterations a loop may be executed.
• bound_reached – If provided, should be a function that takes the LoopSeer and thesucc_state. Will be called when loop execution reach the given bound. Default to moving states that exceed the loop limit to a discard stash.
• discard_stash – Name of the stash containing states exceeding the loop limit.
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
added

522

Chapter 10. API Referenceangrfilter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.Timeout(timeout=None)
Bases: ExplorationTechnique
Timeout exploration technique that stops an active exploration if the run time exceeds a predefined timeout__init__(timeout=None)
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.Suggestions
Bases: ExplorationTechnique
An exploration technique which analyzes failure cases and logs suggestions for how to mitigate them in future
analyses.
__init__()10.8. Exploration Techniques

523

angr

step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)static report(state, event)class angr.exploration_techniques.StubStasher
Bases: ExplorationTechnique
Stash states that reach a stub SimProcedure.
static post_filter(state)step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.timeout.Timeout(timeout=None)
Bases: ExplorationTechnique
Timeout exploration technique that stops an active exploration if the run time exceeds a predefined timeout__init__(timeout=None)
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.dfs.DFS(deferred_stash='deferred')Bases: ExplorationTechnique
Depth-first search.
Will only keep one path active at a time, any others will be stashed in the ‘deferred’ stash. When we run out ofactive paths to step, we take the longest one from deferred and continue.
__init__(deferred_stash='deferred')

524

Chapter 10. API Referenceangrsetup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.explorer.Explorer(find=None, avoid=None, find_stash='found',avoid_stash='avoid', cfg=None, num_find=1,
avoid_priority=False)
Bases: ExplorationTechnique
Search for up to “num_find” paths that satisfy condition “find”, avoiding condition “avoid”. Stashes found paths
into “find_stash’ and avoided paths into “avoid_stash”.
The “find” and “avoid” parameters may be any of:• An address to find
• A set or list of addresses to find
• A function that takes a path and returns whether or not it matches.
If an angr CFG is passed in as the “cfg” parameter and “find” is either a number or a list or a set, then any paths
which cannot possibly reach a success state without going through a failure state will be preemptively avoided.
If either the “find” or “avoid” parameter is a function returning a boolean, and a path triggers both conditions, itwill be added to the find stash, unless “avoid_priority” is set to True.
__init__(find=None, avoid=None, find_stash='found', avoid_stash='avoid', cfg=None, num_find=1,
avoid_priority=False)
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)10.8. Exploration Techniques

525

angr

filter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)complete(simgr)
Return whether or not this manager has reached a “completed” state, i.e. SimulationManager.run()should halt.
This is the one hook which is not subject to the nesting rules of hooks. You should not call simgr.
complete, you should make your own decision and return True or False. Each of the techniques’ completion checkers will be called and the final result will be compted with simgr.completion_mode.
Parameterssimgr (angr.SimulationManager)
class angr.exploration_techniques.lengthlimiter.LengthLimiter(max_length, drop=False)
Bases: ExplorationTechnique
Length limiter on paths.
__init__(max_length, drop=False)step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.manual_mergepoint.ManualMergepoint(address,
wait_counter=10,
prune=True)
Bases: ExplorationTechnique__init__(address, wait_counter=10, prune=True)
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
added
mark_nofilter(simgr, stash)
mark_okfilter(simgr, stash)

526

Chapter 10. API Referenceangrstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.spiller.PickledStatesBase
Bases: object
The base class of pickled statessort()
Sort pickled states.
add(prio, sid)
Add a newly pickled state.
Parameters• prio (int) – Priority of the state.
• sid (str) – Persistent ID of the state.
ReturnsNone
pop_n(n)Pop the top N states.
Parametersn (int) – Number of states to take.
Returns
A list of states.
class angr.exploration_techniques.spiller.PickledStatesList
Bases: PickledStatesBase
List-backed pickled state storage.
__init__()sort()
Sort pickled states.
add(prio, sid)
Add a newly pickled state.
Parameters• prio (int) – Priority of the state.
• sid (str) – Persistent ID of the state.
ReturnsNone10.8. Exploration Techniques

527

angr

pop_n(n)Pop the top N states.
Parametersn (int) – Number of states to take.
Returns
A list of states.
class angr.exploration_techniques.spiller.PickledStatesDb(db_str='sqlite:///:memory:')
Bases: PickledStatesBase
Database-backed pickled state storage.
__init__(db_str='sqlite:///:memory:')sort()
Sort pickled states.
add(prio, sid, taken=False, stash='spilled')
Add a newly pickled state.
Parameters• prio (int) – Priority of the state.
• sid (str) – Persistent ID of the state.
ReturnsNone
pop_n(n, stash='spilled')
Pop the top N states.
Parametersn (int) – Number of states to take.
Returns
A list of states.
get_recent_n(n, stash='spilled')count()
class angr.exploration_techniques.spiller.Spiller(src_stash='active', min=5, max=10,
staging_stash='spill_stage', staging_min=10,
staging_max=20, pickle_callback=None,
unpickle_callback=None,
post_pickle_callback=None, priority_key=None,vault=None, states_collection=None)
Bases: ExplorationTechnique
Automatically spill states out. It can spill out states to a different stash, spill them out to ANA, or first do theformer and then (after enough states) the latter.
__init__(src_stash='active', min=5, max=10, staging_stash='spill_stage', staging_min=10,
staging_max=20, pickle_callback=None, unpickle_callback=None, post_pickle_callback=None,
priority_key=None, vault=None, states_collection=None)
Initializes the spiller.
Parameters

528

Chapter 10. API Referenceangr• max – the number of states that are not spilled• src_stash – the stash from which to spill states (default: active)• staging_stash – the stash to which to spill states (default: “spill_stage”)• staging_max – the number of states that can be in the staging stash before things get spilled
to ANA (default: None. If staging_stash is set, then this means unlimited, and ANA will
not be used).
• priority_key – a function that takes a state and returns its numerical priority (MAX_INT
is lowest priority). By default, self.state_priority will be used, which prioritizes by object
ID.
• vault – an angr.Vault object to handle storing and loading of states. If not provided, anangr.vaults.VaultShelf will be created with a temporary file.
step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)static state_priority(state)class angr.exploration_techniques.spiller_db.PickledState(**kwargs)
Bases: Base
idpriority
taken
stash
timestamp__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.exploration_techniques.threading.Threading(threads=8, local_stash='thread_local')Bases: ExplorationTechnique
Enable multithreading.
This is only useful in paths where a lot of time is taken inside z3, doing constraint solving. This is because ofpython’s GIL, which says that only one thread at a time may be executing python code.
__init__(threads=8, local_stash='thread_local')

10.8. Exploration Techniques

529

angr

step(simgr, stash='active', error_list=None, target_stash=None, **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)inner_step(state, simgr, **kwargs)
successors(simgr, state, engine=None, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.veritesting.Veritesting(**options)
Bases: ExplorationTechnique
Enable veritesting. This technique, described in a paper[1] from CMU, attempts to address the problem of state
explosions in loops by performing smart merging.
[1] https://users.ece.cmu.edu/~aavgerin/papers/veritesting-icse-2014.pdf__init__(**options)step_state(simgr, state, successor_func=None, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.tracer.TracingMode
Bases: object
Variables• Strict – Strict mode, the default mode, where an exception is raised immediately if tracer’s
path deviates from the provided trace.
530

Chapter 10. API Referenceangr• Permissive – Permissive mode, where tracer attempts to force the path back to the provided
trace when a deviation happens. This does not always work, especially when the cause ofdeviation is related to input that will later be used in exploit generation. But, it might work
magically sometimes.
• CatchDesync – CatchDesync mode, catch desync because of sim_procedures. It might bea sign of something interesting.
Strict = 'strict'Permissive = 'permissive'
CatchDesync = 'catch_desync'
exception angr.exploration_techniques.tracer.TracerDesyncError(msg, deviating_addr=None,
deviating_trace_idx=None)
Bases: AngrTracerError
An error class to report tracing Tracing desyncronization error__init__(msg, deviating_addr=None, deviating_trace_idx=None)class angr.exploration_techniques.tracer.RepHook(mnemonic)
Bases: object
Hook rep movs/stos to speed up constraint solving TODO: This should be made an exploration technique later__init__(mnemonic)run(state)class angr.exploration_techniques.tracer.Tracer(trace=None, resiliency=False, keep_predecessors=1,
crash_addr=None, syscall_data=None,copy_states=False, fast_forward_to_entry=True,
mode='strict', aslr=True, follow_unsat=False)
Bases: ExplorationTechnique
An exploration technique that follows an angr path with a concrete input. The tracing result is the state at the last
address of the trace, which can be found in the ‘traced’ stash.
If the given concrete input makes the program crash, you should provide crash_addr, and the crashing state will
be found in the ‘crashed’ stash.
Parameters• trace – The basic block trace.
• resiliency – Should we continue to step forward even if qemu and angr disagree?
• keep_predecessors – Number of states before the final state we should log.
• crash_addr – If the trace resulted in a crash, provide the crashing instruction pointer here,
and the ‘crashed’ stash will be populated with the crashing state.
• syscall_data – Data related to various syscalls recorded by tracer for replaying• copy_states – Whether COPY_STATES should be enabled for the tracing state. It is off
by default because most tracing workloads benefit greatly from not performing copying. You
want to enable it if you want to see the missed states. It will be re-added for the last 2% of
the trace in order to set the predecessors list correctly. If you turn this on you may want toenable the LAZY_SOLVES option.
• mode – Tracing mode.
10.8. Exploration Techniques

531

angr

• aslr – Whether there are aslr slides. if not, tracer uses trace address as state address.
• follow_unsat – Whether unsatisfiable states should be treated as potential successors ornot.
Variables
predecessors – A list of states in the history before the final state.
__init__(trace=None, resiliency=False, keep_predecessors=1, crash_addr=None, syscall_data=None,copy_states=False, fast_forward_to_entry=True, mode='strict', aslr=True, follow_unsat=False)
set_fd_data(fd_data)
Set concrete bytes of various fds read by the program
Parameters
fd_data (dict[int, bytes])
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
addedcomplete(simgr)
Return whether or not this manager has reached a “completed” state, i.e. SimulationManager.run()should halt.
This is the one hook which is not subject to the nesting rules of hooks. You should not call simgr.
complete, you should make your own decision and return True or False. Each of the techniques’ completion checkers will be called and the final result will be compted with simgr.completion_mode.
Parameterssimgr (angr.SimulationManager)filter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)532

Chapter 10. API Referenceangrstep_state(simgr, state, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)classmethod crash_windup(state, crash_addr)
class angr.exploration_techniques.driller_core.DrillerCore(trace, fuzz_bitmap=None)
Bases: ExplorationTechnique
An exploration technique that symbolically follows an input looking for new state transitions.
It has to be used with Tracer exploration technique. Results are put in ‘diverted’ stash.
__init__(trace, fuzz_bitmap=None):param trace : The basic block trace. :type fuzz_bitmap: :param fuzz_bitmap: AFL’s bitmap of statetransitions. Defaults to saying every transition is worth satisfying.
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.slicecutor.Slicecutor(annotated_cfg, force_taking_exit=False,
force_sat=False)
Bases: ExplorationTechnique
The Slicecutor is an exploration that executes provided code slices.
Parameters
force_sat (bool)__init__(annotated_cfg, force_taking_exit=False, force_sat=False)
All parameters except annotated_cfg are optional.
Parameters10.8. Exploration Techniques

533

angr

• annotated_cfg – The AnnotatedCFG that provides the code slice.
• force_taking_exit – Set to True if you want to create a successor based on our slice incase of unconstrained successors.
• force_sat (bool) – If a branch specified by the slice is unsatisfiable, set this option toTrue if you want to force it to be satisfiable and be taken anyway.
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
addedfilter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
step_state(simgr, state, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
534

Chapter 10. API Referenceangrclass angr.exploration_techniques.director.BaseGoal(sort)Bases: object
REQUIRE_CFG_STATES = False__init__(sort)check(cfg, state, peek_blocks)
Parameters• cfg (angr.analyses.CFGEmulated) – An instance of CFGEmulated.
• state (angr.SimState) – The state to check.
• peek_blocks (int) – Number of blocks to peek ahead from the current point.
Returns
True if we can determine that this condition is definitely satisfiable if the path is taken, False
otherwise.
Return typebool
check_state(state)
Check if the current state satisfies the goal.
Parametersstate (angr.SimState) – The state to check.
Returns
True if it satisfies the goal, False otherwise.
Return typeboolclass angr.exploration_techniques.director.ExecuteAddressGoal(addr)
Bases: BaseGoal
A goal that prioritizes states reaching (or are likely to reach) certain address in some specific steps.
__init__(addr)
check(cfg, state, peek_blocks)
Check if the specified address will be executed
Parameters• cfg• state• peek_blocks (int)
Returns
Return typebool
check_state(state)
Check if the current address is the target address.
Parametersstate (angr.SimState) – The state to check.

10.8. Exploration Techniques

535

angr

Returns
True if the current address is the target address, False otherwise.
Return typeboolclass angr.exploration_techniques.director.CallFunctionGoal(function, arguments)
Bases: BaseGoal
A goal that prioritizes states reaching certain function, and optionally with specific arguments. Note that constraints on arguments (and on function address as well) have to be identifiable on an accurate CFG. For example,
you may have a CallFunctionGoal saying “call printf with the first argument being ‘Hello, world’”, and CFGEmulated must be able to figure our the first argument to printf is in fact “Hello, world”, not some symbolic strings
that will be constrained to “Hello, world” during symbolic execution (or simulation, however you put it).
REQUIRE_CFG_STATES = True__init__(function, arguments)
check(cfg, state, peek_blocks)
Check if the specified function will be reached with certain arguments.
Parameters• cfg• state• peek_blocks
Returnscheck_state(state)
Check if the specific function is reached with certain arguments
Parametersstate (angr.SimState) – The state to check
Returns
True if the function is reached with certain arguments, False otherwise.
Return typeboolclass angr.exploration_techniques.director.Director(peek_blocks=100, peek_functions=5,
goals=None, cfg_keep_states=False,
goal_satisfied_callback=None,num_fallback_states=5)
Bases: ExplorationTechnique
An exploration technique for directed symbolic execution.
A control flow graph (using CFGEmulated) is built and refined during symbolic execution. Each time the execution reaches a block that is outside of the CFG, the CFG recovery will be triggered with that state, with amaximum recovery depth (100 by default). If we see a basic block during state stepping that is not yet in thecontrol flow graph, we go back to control flow graph recovery and “peek” more blocks forward.
When stepping a simulation manager, all states are categorized into three different categories:• Might reach the destination within the peek depth. Those states are prioritized.
• Will not reach the destination within the peek depth. Those states are de-prioritized. However, there is alittle chance for those states to be explored as well in order to prevent over-fitting.
536

Chapter 10. API Referenceangr__init__(peek_blocks=100, peek_functions=5, goals=None, cfg_keep_states=False,
goal_satisfied_callback=None, num_fallback_states=5)Constructor.
step(simgr, stash='active', **kwargs)
Parameters• simgr• stash• kwargs
Returns
add_goal(goal)
Add a goal.
Parameters
goal (BaseGoal) – The goal to add.
ReturnsNoneclass angr.exploration_techniques.oppologist.Oppologist
Bases: ExplorationTechnique
The Oppologist is an exploration technique that forces uncooperative code through qemu.
__init__()successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.loop_seer.LoopSeer(cfg=None, functions=None, loops=None,
use_header=False, bound=None,bound_reached=None,
discard_stash='spinning',
limit_concrete_loops=True)
Bases: ExplorationTechniqueThis exploration technique monitors exploration and maintains all loop-related data (well, currently it is just theloop trip counts, but feel free to add something else).
__init__(cfg=None, functions=None, loops=None, use_header=False, bound=None, bound_reached=None,
discard_stash='spinning', limit_concrete_loops=True)
Parameters10.8. Exploration Techniques

537

angr

• cfg – Normalized CFG is required.
• functions – Function(s) containing the loop(s) to be analyzed.
• loops – Specific group of Loop(s) to be analyzed, if this is None we run the LoopFinder
analysis.
• use_header – Whether to use header based trip counter to compare with the bound limit.
• bound – Limit the number of iterations a loop may be executed.
• bound_reached – If provided, should be a function that takes the LoopSeer and thesucc_state. Will be called when loop execution reach the given bound. Default to moving states that exceed the loop limit to a discard stash.
• discard_stash – Name of the stash containing states exceeding the loop limit.
• limit_concrete_loops – If False, do not limit a loop back-edge if it is the only successor(Defaults to True to maintain the original behavior)
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
addedfilter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.local_loop_seer.LocalLoopSeer(bound=None,bound_reached=None,
discard_stash='spinning')
Bases: ExplorationTechnique
LocalLoopSeer monitors exploration and maintains all loop-related data without relying on a control flow graph.

538

Chapter 10. API Referenceangr__init__(bound=None, bound_reached=None, discard_stash='spinning')
Parameters• bound – Limit the number of iterations a loop may be executed.
• bound_reached – If provided, should be a function that takes the LoopSeer and thesucc_state. Will be called when loop execution reach the given bound. Default to moving states that exceed the loop limit to a discard stash.
• discard_stash – Name of the stash containing states exceeding the loop limit.
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
addedfilter(simgr, state, **kwargs)
Perform filtering on which stash a state should be inserted into.
If the state should be filtered, return the name of the stash to move the state to. If you want to modify thestate before filtering it, return a tuple of the stash to move the state to and the modified state. To defer tothe original categorization procedure, return the result of simgr.filter(state, **kwargs)
If the user provided a filter_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)class angr.exploration_techniques.stochastic.StochasticSearch(start_state, restart_prob=0.0001)
Bases: ExplorationTechnique
Stochastic Search.
Will only keep one path active at a time, any others will be discarded. Before each pass through, weights are
randomly assigned to each basic block. These weights form a probability distribution for determining whichstate remains after splits. When we run out of active paths to step, we start again from the start state.
__init__(start_state, restart_prob=0.0001)
Parameters• start_state – The initial state from which exploration stems.

10.8. Exploration Techniques

539

angr

• restart_prob – The probability of randomly restarting the search (default 0.0001).
step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.unique.UniqueSearch(similarity_func=None,
deferred_stash='deferred')Bases: ExplorationTechnique
Unique Search.
Will only keep one path active at a time, any others will be deferred. The state that is explored depends on
how unique it is relative to the other deferred states. A path’s uniqueness is determined by its average similarity
between the other (deferred) paths. Similarity is calculated based on the supplied similarity_func, which by
default is: The (L2) distance between the counts of the state addresses in the history of the path.
__init__(similarity_func=None, deferred_stash='deferred')Parameters• similarity_func – How to calculate similarity between two states.
• deferred_stash – Where to store the deferred states.
setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)static similarity(state_a, state_b)
The (L2) distance between the counts of the state addresses in the history of the path. :type state_a: :paramstate_a: The first state to compare :type state_b: :param state_b: The second state to compare
static sequence_matcher_similarity(state_a, state_b)
The difflib.SequenceMatcher ratio between the state addresses in the history of the path. :type state_a::param state_a: The first state to compare :type state_b: :param state_b: The second state to compareclass angr.exploration_techniques.tech_builder.TechniqueBuilder(setup=None, step_state=None,
step=None, successors=None,filter=None, selector=None,complete=None)
Bases: ExplorationTechnique

540

Chapter 10. API ReferenceangrThis meta technique could be used to hook a couple of simulation manager methods without actually creating a
new exploration technique, for example:
class SomeComplexAnalysis(Analysis):def do_something():simgr = self.project.factory.simulation_manager() simgr.use_tech(ProxyTechnique(step_state=self._step_state))simgr.run()def _step_state(self, state):# Do stuff! passIn the above example, the _step_state method can access all the necessary stuff, hidden in the analysis instance,
without passing that instance to a one-shot-styled exploration technique.
__init__(setup=None, step_state=None, step=None, successors=None, filter=None, selector=None,complete=None)angr.exploration_techniques.common.condition_to_lambda(condition, default=False)
Translates an integer, set, list or function into a lambda that checks if state’s current basic block matches somecondition.
Parameters• condition – An integer, set, list or lambda to convert to a lambda.
• default – The default return value of the lambda (in case condition is None). Default: false.
Returns
A tuple of two items: a lambda that takes a state and returns the set of addresses that it matchedfrom the condition, and a set that contains the normalized set of addresses to stop at, or None if
no addresses were provided statically.
class angr.exploration_techniques.symbion.Symbion(find=None, memory_concretize=None,
register_concretize=None, timeout=0,
find_stash='found')Bases: ExplorationTechnique
The Symbion exploration technique uses the SimEngineConcrete available to step a SimState.
Parameters• find – address or list of addresses that we want to reach, these will be translated into breakpoints inside the concrete process using the ConcreteTarget interface provided by the user
inside the SimEngineConcrete.
• memory_concretize – list of tuples (address, symbolic variable) that are going to be written
in the concrete process memory.
• register_concretize – list of tuples (reg_name, symbolic variable) that are going to be
written• timeout – how long we should wait the concrete target to reach the breakpoint__init__(find=None, memory_concretize=None, register_concretize=None, timeout=0, find_stash='found')setup(simgr)
Perform any initialization on this manager you might need to do.
Parameterssimgr (angr.SimulationManager) – The simulation manager to which you have just been
added

10.8. Exploration Techniques

541

angr

step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)step_state(simgr, *args, **kwargs)
Determine the categorization of state successors into stashes. The result should be a dict mapping stash
names to the list of successor states that fall into that stash, or None as a stash name to use the original stash
name.
If you would like to directly work with a SimSuccessors object, you can obtain it with simgr.
successors(state, **kwargs). This is not recommended, as it denies other hooks the opportunity tolook at the successors. Therefore, the usual technique is to call simgr.step_state(state, **kwargs)
and then mutate the returned dict before returning it yourself.
..note:: This takes precedence over the filter hook - filter is only applied to states returned from here in theNone stash.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)complete(simgr)
Return whether or not this manager has reached a “completed” state, i.e. SimulationManager.run()should halt.
This is the one hook which is not subject to the nesting rules of hooks. You should not call simgr.
complete, you should make your own decision and return True or False. Each of the techniques’ completion checkers will be called and the final result will be compted with simgr.completion_mode.
Parameterssimgr (angr.SimulationManager)
class angr.exploration_techniques.memory_watcher.MemoryWatcher(min_memory=512,
memory_stash='lowmem')
Bases: ExplorationTechnique
Memory Watcher
Parameters• min_memory (int,optional) – Minimum amount of free memory in MB before stopping
execution (default: 95% memory use)
• memory_stash (str, optional) – What to call the low memory stash (default:‘lowmem’)At each step, keep an eye on how much memory is left on the system. Stash off states to effectively stop execution
if we’re below a given threshold.
__init__(min_memory=512, memory_stash='lowmem')
setup(simgr)
Perform any initialization on this manager you might need to do.

542

Chapter 10. API ReferenceangrParameterssimgr (angr.SimulationManager) – The simulation manager to which you have just beenaddedstep(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.exploration_techniques.bucketizer.Bucketizer
Bases: ExplorationTechnique
Loop bucketization: Pick log(n) paths out of n possible paths, and stash (or drop) everything else.
successors(simgr, state, **kwargs)
Perform the process of stepping a state forward, returning a SimSuccessors object.
To defer to the original succession procedure, return the result of simgr.successors(state,**kwargs). Be careful about not calling this method (e.g. calling project.factory.successors manually) as it denies other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs
for the step before calling the original, and mutate the result before returning it yourself.
If the user provided a successor_func in their step or run command, it will appear here.
Parameters• simgr (angr.SimulationManager)• state (angr.SimState)angr.exploration_techniques.suggestions.ast_weight(ast, memo=None)class angr.exploration_techniques.suggestions.Suggestions
Bases: ExplorationTechnique
An exploration technique which analyzes failure cases and logs suggestions for how to mitigate them in future
analyses.
__init__()step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)static report(state, event)10.9 Simulation Engines

10.9. Simulation Engines

543

angr

class angr.engines.SimSuccessors(addr, initial_state)
Bases: object
This class serves as a categorization of all the kinds of result states that can come from a SimEngine run.
Variables• addr (int) – The address at which execution is taking place, as a python int• initial_state – The initial state for which execution produced these successors• engine – The engine that produced these successors• sort – A string identifying the type of engine that produced these successors• processed (bool) – Whether or not the processing succeeded• description (str) – A textual description of the execution step
Parametersaddr (int | None)
The successor states produced by this run are categorized into several lists:
Variables• artifacts (dict) – Any analysis byproducts (for example, an IRSB) that were produced
during execution• successors – The “normal” successors. IP may be symbolic, but must have reasonable
number of solutions• unsat_successors – Any successor which is unsatisfiable after its guard condition isadded.
• all_successors – successors + unsat_successors• flat_successors – The normal successors, but any symbolic IPs have been concretized.
There is one state in this list for each possible value an IP may be concretized to for eachsuccessor state.
• unconstrained_successors – Any state for which during the flattening process we find
too many solutions.
Parametersaddr (int | None)
A more detailed description of the successor lists may be found here: https://docs.angr.io/core-concepts/
simulation#simsuccessors__init__(addr, initial_state)Parametersaddr (int | None)classmethod failure()property is_empty
add_successor(state, target, guard, jumpkind, add_guard=True, exit_stmt_idx=None, exit_ins_addr=None,source=None)
Add a successor state of the SimRun. This procedure stores method parameters into state.scratch, does somehousekeeping, and calls out to helper functions to prepare the state and categorize it into the appropriate
successor lists.

544

Chapter 10. API ReferenceangrParameters• state (SimState) – The successor state.
• target – The target (of the jump/call/ret).
• guard – The guard expression.
• jumpkind (str) – The jumpkind (call, ret, jump, or whatnot).
• add_guard (bool) – Whether to add the guard constraint (default: True).
• exit_stmt_idx (int) – The ID of the exit statement, an integer by default. ‘default’stands for the default exit, and None means it’s not from a statement (for example, from a
SimProcedure).
• exit_ins_addr (int) – The instruction pointer of this exit, which is an integer by default.
• source (int) – The source of the jump (i.e., the address of the basic block).
class angr.engines.SimEngine(project=None, **kwargs)
Bases: SimEngineBase
A SimEngine is a class which understands how to perform execution on a state. This is a base class.
abstract process(state, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)class angr.engines.SuccessorsMixin(*args, **kwargs)
Bases: SimEngine
A mixin for SimEngine which implements process to perform common operations related to symbolic execution
and dispatches to a process_successors method to fill a SimSuccessors object with the results.
__init__(*args, **kwargs)
process(state, *args, **kwargs)
Perform execution with a state.
You should only override this method in a subclass in order to provide the correct method signature anddocstring. You should override the _process method to do your actual execution.
Parameters• state – The state with which to execute. This state will be copied before modification.
• inline – This is an inline execution. Do not bother copying the state.
• force_addr – Force execution to pretend that we’re working at this concrete address
Returns
A SimSuccessors object categorizing the execution’s successor statesprocess_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.

10.9. Simulation Engines

545

angr

Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.TLSMixin(*args, **kwargs)
Bases: object
Mix this class into any class that defines __tls to make all of the attributes named in that list into thread-local
properties.
MAGIC MAGIC MAGIC
class angr.engines.HeavyVEXMixin(*args, **kwargs)
Bases: SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEXMixin, VEXLifter
Execution engine based on VEX, Valgrind’s IR.
Responds to the following parameters to the step stack:• irsb: The PyVEX IRSB object to use for execution. If not provided one will be lifted.
• skip_stmts: The number of statements to skip in processing• last_stmt: Do not execute any statements after this statement• whitelist: Only execute statements in this set• thumb: Whether the block should be force to be lifted in ARM’s THUMB mode.
• extra_stop_points:
An extra set of points at which to break basic blocks• opt_level: The VEX optimization level to use.
• insn_bytes: A string of bytes to use for the block instead of the project.
• size: The maximum size of the block, in bytes.
• num_inst: The maximum number of instructions.
• traceflags: traceflags to be passed to VEX. (default: 0)
process_successors(successors, irsb=None, insn_text=None, insn_bytes=None, thumb=False, size=None,
num_inst=None, extra_stop_points=None, opt_level=None, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters
546

Chapter 10. API Referenceangr• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.TrackActionsMixin(*args, **kwargs)
Bases: HeavyVEXMixin__init__(*args, **kwargs)
handle_vex_block(irsb)
class angr.engines.SimInspectMixin(project, **kwargs)
Bases: VEXMixin
handle_vex_block(irsb)
class angr.engines.HeavyResilienceMixin(project, **kwargs)
Bases: VEXResilienceMixin, ClaripyDataMixin
class angr.engines.SuperFastpathMixin(*args, **kwargs)
Bases: VEXSlicingMixin
This mixin implements the superfastpath execution mode, which skips all but the last four instructions.
handle_vex_block(irsb)
class angr.engines.ProcedureMixin
Bases: object
A mixin for SimEngine which adds the process_procedure method for calling a SimProcedure and adding its
results to a SimSuccessors.
process_procedure(state, successors, procedure, ret_to=None, arguments=None, **kwargs)
class angr.engines.ProcedureEngine(*args, **kwargs)
Bases: ProcedureMixin, SuccessorsMixin
A SimEngine that you may use if you only care about processing SimProcedures. Requires the procedure kwarg
to be passed to process.
process_successors(successors, procedure=None, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.

10.9. Simulation Engines

547

angr

class angr.engines.SimEngineUnicorn(*args, **kwargs)
Bases: SuccessorsMixin
Concrete execution in the Unicorn Engine, a fork of qemu.
Responds to the following parameters in the step stack:• step: How many basic blocks we want to execute• extra_stop_points: A collection of addresses at which execution should halt__init__(*args, **kwargs)
process_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.SimEngineFailure(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
process_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.SimEngineSyscall(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
A SimEngine mixin which adds a successors handling step that checks if a syscall was just requested and if so
handles it as a step.

548

Chapter 10. API Referenceangrprocess_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.SimEngineConcrete(project)
Bases: SuccessorsMixin
Concrete execution using a concrete target provided by the user.
__init__(project)
process_successors(successors, extra_stop_points=None, memory_concretize=None,
register_concretize=None, timeout=0, *args, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
to_engine(state, extra_stop_points, memory_concretize, register_concretize, timeout)
Handle the concrete execution of the process This method takes care of: 1- Set the breakpoints on the addresses provided by the user 2- Concretize the symbolic variables and perform the write inside the concrete
process 3- Continue the program execution.
Parameters• state – The state with which to execute• extra_stop_points – list of a addresses where to stop the concrete execution and returnto the simulated one• memory_concretize – list of tuples (address, symbolic variable) that are going to be
written in the concrete process memory.

10.9. Simulation Engines

549

angr

• register_concretize – list of tuples (reg_name, symbolic variable) that are going tobe written• timeout – how long we should wait the concrete target to reach the breakpoint
ReturnsNonestatic check_concrete_target_methods(concrete_target)
Check if the concrete target methods return the correct type of data :return: True if the concrete target iscompliantclass angr.engines.HooksMixin(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
A SimEngine mixin which adds a SimSuccessors handler which will look into the project’s hooks and run thehook at the current address.
Will respond to the following parameters provided to the step stack:• procedure: A SimProcedure instance to force-run instead of consulting the current hooks• ret_to: An address to force-return-to at the end of the procedure
process_successors(successors, procedure=None, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.SootMixin(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
Execution engine based on Soot.
lift_soot(addr=None, the_binary=None, **kwargs)
process_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters
550

Chapter 10. API Referenceangr• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
get_unconstrained_simprocedure()classmethod setup_callsite(state, args, ret_addr, ret_var=None)
static setup_arguments(state, args)
static prepare_return_state(state, ret_value=None)
static terminate_execution(statement, state, successors)
static prepare_native_return_state(native_state)
Hook target for native function call returns.
Recovers and stores the return value from native memory and toggles the state, s.t. execution continues in
the Soot engine.
class angr.engines.UberEngine(*args, **kwargs)
Bases:
SimEngineFailure,
SimEngineSyscall,
HooksMixin,
SimEngineUnicorn,
SuperFastpathMixin, TrackActionsMixin, SimInspectMixin, HeavyResilienceMixin, SootMixin,
HeavyVEXMixin, TLSMixin
irsb
state
stmt_idx
successors:

SimSuccessors | Nonetmps
class angr.engines.UberEnginePcode(*args, **kwargs)
Bases: SimEngineFailure, SimEngineSyscall, HooksMixin, HeavyPcodeMixin
class angr.engines.engine.SimEngineBase(project=None, **kwargs)
Bases: object
Even more basey of a base class for SimEngine. Used as a base by mixins which want access to the project but
for which having method process (contained in SimEngine) doesn’t make sense__init__(project=None, **kwargs)
class angr.engines.engine.SimEngine(project=None, **kwargs)
Bases: SimEngineBase
A SimEngine is a class which understands how to perform execution on a state. This is a base class.
abstract process(state, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)10.9. Simulation Engines

551

angr

class angr.engines.engine.TLSMixin(*args, **kwargs)
Bases: object
Mix this class into any class that defines __tls to make all of the attributes named in that list into thread-local
properties.
MAGIC MAGIC MAGIC
class angr.engines.engine.TLSProperty(name)
Bases: object__init__(name)class angr.engines.engine.SuccessorsMixin(*args, **kwargs)
Bases: SimEngine
A mixin for SimEngine which implements process to perform common operations related to symbolic execution
and dispatches to a process_successors method to fill a SimSuccessors object with the results.
__init__(*args, **kwargs)
process(state, *args, **kwargs)
Perform execution with a state.
You should only override this method in a subclass in order to provide the correct method signature anddocstring. You should override the _process method to do your actual execution.
Parameters• state – The state with which to execute. This state will be copied before modification.
• inline – This is an inline execution. Do not bother copying the state.
• force_addr – Force execution to pretend that we’re working at this concrete address
Returns
A SimSuccessors object categorizing the execution’s successor statesprocess_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.successors.SimSuccessors(addr, initial_state)
Bases: object
This class serves as a categorization of all the kinds of result states that can come from a SimEngine run.
Variables
552

Chapter 10. API Referenceangr• addr (int) – The address at which execution is taking place, as a python int• initial_state – The initial state for which execution produced these successors• engine – The engine that produced these successors• sort – A string identifying the type of engine that produced these successors• processed (bool) – Whether or not the processing succeeded• description (str) – A textual description of the execution step
Parametersaddr (int | None)
The successor states produced by this run are categorized into several lists:
Variables• artifacts (dict) – Any analysis byproducts (for example, an IRSB) that were produced
during execution• successors – The “normal” successors. IP may be symbolic, but must have reasonable
number of solutions• unsat_successors – Any successor which is unsatisfiable after its guard condition isadded.
• all_successors – successors + unsat_successors• flat_successors – The normal successors, but any symbolic IPs have been concretized.
There is one state in this list for each possible value an IP may be concretized to for eachsuccessor state.
• unconstrained_successors – Any state for which during the flattening process we find
too many solutions.
Parametersaddr (int | None)
A more detailed description of the successor lists may be found here: https://docs.angr.io/core-concepts/
simulation#simsuccessors__init__(addr, initial_state)Parametersaddr (int | None)classmethod failure()property is_empty
add_successor(state, target, guard, jumpkind, add_guard=True, exit_stmt_idx=None, exit_ins_addr=None,source=None)
Add a successor state of the SimRun. This procedure stores method parameters into state.scratch, does somehousekeeping, and calls out to helper functions to prepare the state and categorize it into the appropriate
successor lists.
Parameters• state (SimState) – The successor state.
• target – The target (of the jump/call/ret).
• guard – The guard expression.

10.9. Simulation Engines

553

angr

• jumpkind (str) – The jumpkind (call, ret, jump, or whatnot).
• add_guard (bool) – Whether to add the guard constraint (default: True).
• exit_stmt_idx (int) – The ID of the exit statement, an integer by default. ‘default’stands for the default exit, and None means it’s not from a statement (for example, from a
SimProcedure).
• exit_ins_addr (int) – The instruction pointer of this exit, which is an integer by default.
• source (int) – The source of the jump (i.e., the address of the basic block).
class angr.engines.procedure.ProcedureMixin
Bases: object
A mixin for SimEngine which adds the process_procedure method for calling a SimProcedure and adding its
results to a SimSuccessors.
process_procedure(state, successors, procedure, ret_to=None, arguments=None, **kwargs)
class angr.engines.procedure.ProcedureEngine(*args, **kwargs)
Bases: ProcedureMixin, SuccessorsMixin
A SimEngine that you may use if you only care about processing SimProcedures. Requires the procedure kwarg
to be passed to process.
process_successors(successors, procedure=None, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.hook.HooksMixin(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
A SimEngine mixin which adds a SimSuccessors handler which will look into the project’s hooks and run thehook at the current address.
Will respond to the following parameters provided to the step stack:• procedure: A SimProcedure instance to force-run instead of consulting the current hooks• ret_to: An address to force-return-to at the end of the procedure
process_successors(successors, procedure=None, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.

554

Chapter 10. API ReferenceangrKeep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.syscall.SimEngineSyscall(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
A SimEngine mixin which adds a successors handling step that checks if a syscall was just requested and if so
handles it as a step.
process_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.failure.SimEngineFailure(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
process_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.

10.9. Simulation Engines

555

angr

class angr.engines.vex.ClaripyDataMixin(project, **kwargs)
Bases: VEXMixin
This mixin provides methods that makes the vex engine process guest code using claripy ASTs as the data domain.
class angr.engines.vex.VEXMixin(project, **kwargs)
Bases: SimEngineBase__init__(project, **kwargs)
handle_vex_block(irsb)
Parametersirsb (IRSB)
class angr.engines.vex.VEXResilienceMixin(project, **kwargs)
Bases: VEXMixin
class angr.engines.vex.VEXSlicingMixin(*args, **kwargs)
Bases: VEXMixin__init__(*args, **kwargs)
process(*args, skip_stmts=0, last_stmt=None, whitelist=None, **kwargs)
handle_vex_block(irsb)
class angr.engines.vex.TrackActionsMixin(*args, **kwargs)
Bases: HeavyVEXMixin__init__(*args, **kwargs)
handle_vex_block(irsb)
class angr.engines.vex.HeavyVEXMixin(*args, **kwargs)
Bases: SuccessorsMixin, ClaripyDataMixin, SimStateStorageMixin, VEXMixin, VEXLifter
Execution engine based on VEX, Valgrind’s IR.
Responds to the following parameters to the step stack:• irsb: The PyVEX IRSB object to use for execution. If not provided one will be lifted.
• skip_stmts: The number of statements to skip in processing• last_stmt: Do not execute any statements after this statement• whitelist: Only execute statements in this set• thumb: Whether the block should be force to be lifted in ARM’s THUMB mode.
• extra_stop_points:
An extra set of points at which to break basic blocks• opt_level: The VEX optimization level to use.
• insn_bytes: A string of bytes to use for the block instead of the project.
• size: The maximum size of the block, in bytes.
• num_inst: The maximum number of instructions.
• traceflags: traceflags to be passed to VEX. (default: 0)556

Chapter 10. API Referenceangrprocess_successors(successors, irsb=None, insn_text=None, insn_bytes=None, thumb=False, size=None,
num_inst=None, extra_stop_points=None, opt_level=None, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.vex.SimInspectMixin(project, **kwargs)
Bases: VEXMixin
handle_vex_block(irsb)
class angr.engines.vex.HeavyResilienceMixin(project, **kwargs)
Bases: VEXResilienceMixin, ClaripyDataMixin
class angr.engines.vex.SuperFastpathMixin(*args, **kwargs)
Bases: VEXSlicingMixin
This mixin implements the superfastpath execution mode, which skips all but the last four instructions.
handle_vex_block(irsb)
class angr.engines.vex.VEXLifter(project, use_cache=None, cache_size=50000, default_opt_level=1,
selfmodifying_code=None, single_step=False,
default_strict_block_end=False, **kwargs)
Bases: SimEngineBase
Implements the VEX lifter engine mixin.
__init__(project, use_cache=None, cache_size=50000, default_opt_level=1, selfmodifying_code=None,
single_step=False, default_strict_block_end=False, **kwargs)
clear_cache()
lift_vex(addr=None, state=None, clemory=None, insn_bytes=None, offset=None, arch=None, size=None,
num_inst=None, traceflags=0, thumb=False, extra_stop_points=None, opt_level=None,
strict_block_end=None, skip_stmts=False, collect_data_refs=False, cross_insn_opt=None,load_from_ro_regions=False, const_prop=False)
Lift an IRSB.
There are many possible valid sets of parameters. You at the very least must pass some source of data,some source of an architecture, and some source of an address.
Sources of data in order of priority: insn_bytes, clemory, state
Sources of an address, in order of priority: addr, state
Sources of an architecture, in order of priority: arch, clemory, state
10.9. Simulation Engines

557

angr

Parameters• state – A state to use as a data source.
• clemory – A cle.memory.Clemory object to use as a data source.
• addr – The address at which to start the block.
• thumb – Whether the block should be lifted in ARM’s THUMB mode.
• opt_level – The VEX optimization level to use. The final IR optimization level is determined by (ordered by priority): - Argument opt_level - opt_level is set to 1 if OPTIMIZE_IR exists in state options - self._default_opt_level• insn_bytes – A string of bytes to use as a data source.
• offset – If using insn_bytes, the number of bytes in it to skip over.
• size – The maximum size of the block, in bytes.
• num_inst – The maximum number of instructions.
• traceflags – traceflags to be passed to VEX. (default: 0)• strict_block_end – Whether to force blocks to end at all conditional branches (default:
false)
class angr.engines.soot.SootMixin(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
Execution engine based on Soot.
lift_soot(addr=None, the_binary=None, **kwargs)
process_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
get_unconstrained_simprocedure()classmethod setup_callsite(state, args, ret_addr, ret_var=None)
static setup_arguments(state, args)
static prepare_return_state(state, ret_value=None)
static terminate_execution(statement, state, successors)

558

Chapter 10. API Referenceangrstatic prepare_native_return_state(native_state)
Hook target for native function call returns.
Recovers and stores the return value from native memory and toggles the state, s.t. execution continues in
the Soot engine.
class angr.engines.soot.engine.SootMixin(*args, **kwargs)
Bases: SuccessorsMixin, ProcedureMixin
Execution engine based on Soot.
lift_soot(addr=None, the_binary=None, **kwargs)
process_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
get_unconstrained_simprocedure()classmethod setup_callsite(state, args, ret_addr, ret_var=None)
static setup_arguments(state, args)
static prepare_return_state(state, ret_value=None)
static terminate_execution(statement, state, successors)
static prepare_native_return_state(native_state)
Hook target for native function call returns.
Recovers and stores the return value from native memory and toggles the state, s.t. execution continues in
the Soot engine.
class angr.engines.unicorn.SimEngineUnicorn(*args, **kwargs)
Bases: SuccessorsMixin
Concrete execution in the Unicorn Engine, a fork of qemu.
Responds to the following parameters in the step stack:• step: How many basic blocks we want to execute• extra_stop_points: A collection of addresses at which execution should halt__init__(*args, **kwargs)

10.9. Simulation Engines

559

angr

process_successors(successors, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
class angr.engines.concrete.SimEngineConcrete(project)
Bases: SuccessorsMixin
Concrete execution using a concrete target provided by the user.
__init__(project)
process_successors(successors, extra_stop_points=None, memory_concretize=None,
register_concretize=None, timeout=0, *args, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
to_engine(state, extra_stop_points, memory_concretize, register_concretize, timeout)
Handle the concrete execution of the process This method takes care of: 1- Set the breakpoints on the addresses provided by the user 2- Concretize the symbolic variables and perform the write inside the concrete
process 3- Continue the program execution.
Parameters• state – The state with which to execute• extra_stop_points – list of a addresses where to stop the concrete execution and returnto the simulated one• memory_concretize – list of tuples (address, symbolic variable) that are going to be
written in the concrete process memory.

560

Chapter 10. API Referenceangr• register_concretize – list of tuples (reg_name, symbolic variable) that are going tobe written• timeout – how long we should wait the concrete target to reach the breakpoint
ReturnsNonestatic check_concrete_target_methods(concrete_target)
Check if the concrete target methods return the correct type of data :return: True if the concrete target iscompliantangr.engines.pcode.register_pcode_arch_default_cc(arch)
Parametersarch (ArchPcode)class angr.engines.pcode.HeavyPcodeMixin(*args, **kwargs)
Bases: SuccessorsMixin, PcodeLifterEngineMixin, PcodeEmulatorMixin
Execution engine based on P-code, Ghidra’s IR.
Responds to the following parameters to the step stack:• irsb: The P-Code IRSB object to use for execution. If not provided one will be lifted.
• skip_stmts: The number of statements to skip in processing• last_stmt: Do not execute any statements after this statement• thumb: Whether the block should be force to be lifted in ARM’s THUMB mode. (FIXME)• extra_stop_points:
An extra set of points at which to break basic blocks• insn_bytes: A string of bytes to use for the block instead of the project.
• size: The maximum size of the block, in bytes.
• num_inst: The maximum number of instructions.
__init__(*args, **kwargs)
process_successors(successors, irsb=None, insn_text=None, insn_bytes=None, thumb=False, size=None,
num_inst=None, extra_stop_points=None, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors (SimSuccessors) – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
• irsb (IRSB | None)

10.9. Simulation Engines

561

angr

• insn_text (str | None)• insn_bytes (bytes | None)• thumb (bool)• size (int | None)• num_inst (int | None)• extra_stop_points (Iterable[int] | None)
Return type
Noneclass angr.engines.pcode.engine.HeavyPcodeMixin(*args, **kwargs)
Bases: SuccessorsMixin, PcodeLifterEngineMixin, PcodeEmulatorMixin
Execution engine based on P-code, Ghidra’s IR.
Responds to the following parameters to the step stack:• irsb: The P-Code IRSB object to use for execution. If not provided one will be lifted.
• skip_stmts: The number of statements to skip in processing• last_stmt: Do not execute any statements after this statement• thumb: Whether the block should be force to be lifted in ARM’s THUMB mode. (FIXME)• extra_stop_points:
An extra set of points at which to break basic blocks• insn_bytes: A string of bytes to use for the block instead of the project.
• size: The maximum size of the block, in bytes.
• num_inst: The maximum number of instructions.
__init__(*args, **kwargs)
process_successors(successors, irsb=None, insn_text=None, insn_bytes=None, thumb=False, size=None,
num_inst=None, extra_stop_points=None, **kwargs)
Implement this function to fill out the SimSuccessors object with the results of stepping state.
In order to implement a model where multiple mixins can potentially handle a request, a mixin may implement this method and then perform a super() call if it wants to pass on handling to the next mixin.
Keep in mind python’s method resolution order when composing multiple classes implementing thismethod. In short: left-to-right, depth-first, but deferring any base classes which are shared by multiple
subclasses (the merge point of a diamond pattern in the inheritance graph) until the last point where theywould be encountered in this depth-first search. For example, if you have classes A, B(A), C(B), D(A),E(C, D), then the method resolution order will be E, C, B, D, A.
Parameters• state – The state to manipulate• successors (SimSuccessors) – The successors object to fill out• kwargs – Any extra arguments. Do not fail if you are passed unexpected arguments.
• irsb (IRSB | None)• insn_text (str | None)• insn_bytes (bytes | None)

562

Chapter 10. API Referenceangr• thumb (bool)• size (int | None)• num_inst (int | None)• extra_stop_points (Iterable[int] | None)
Return type
Noneclass angr.engines.pcode.lifter.ExitStatement(dst, jumpkind)
Bases: object
This class exists to ease compatibility with CFGFast’s processing of exit_statements. See _scan_irsb method.
Parameters• dst (int | None)• jumpkind (str)__init__(dst, jumpkind)Parameters• dst (int | None)• jumpkind (str)dst:

int | None

jumpkind:strclass angr.engines.pcode.lifter.PcodeDisassemblerBlock(addr, insns, thumb, arch)
Bases: DisassemblerBlock
Helper class to represent a block of disassembled target architecture instructions
addr
insns
thumb
arch
class angr.engines.pcode.lifter.PcodeDisassemblerInsn(pcode_insn)
Bases: DisassemblerInsn
Helper class to represent a disassembled target architecture instruction__init__(pcode_insn)
property size:

intproperty address:

int

property mnemonic:

str

property op_str:

str

10.9. Simulation Engines

563

angr

class angr.engines.pcode.lifter.IRSB(data, mem_addr, arch, max_inst=None, max_bytes=None,bytes_offset=0, traceflags=0, opt_level=1, num_inst=None,
num_bytes=None, strict_block_end=False, skip_stmts=False,collect_data_refs=False)
Bases: object
IRSB stands for Intermediate Representation Super-Block. An IRSB in is a single-entry, multiple-exit code block.
Variables• arch (archinfo.Arch) – The architecture this block is lifted under• statements (list of IRStmt) – The statements in this block• next (IRExpr) – The expression for the default exit target of this block• offsIP (int) – The offset of the instruction pointer in the VEX guest state• stmts_used (int) – The number of statements in this IRSB
• jumpkind (str) – The type of this block’s default jump (call, boring, syscall, etc) as a VEX
enum string• direct_next (bool) – Whether this block ends with a direct (not indirect) jump or branch• size (int) – The size of this block in bytes• addr (int) – The address of this basic block, i.e. the address in the first IMark
Parameters• data (str | bytes | None)• mem_addr (int)• arch (archinfo.Arch )• max_inst (int | None)• max_bytes (int | None)• bytes_offset (int)• traceflags (int)• opt_level (int)• num_inst (int | None)• num_bytes (int | None)• strict_block_end (bool)• skip_stmts (bool)• collect_data_refs (bool)
MAX_EXITS = 400
MAX_DATA_REFS = 2000__init__(data, mem_addr, arch, max_inst=None, max_bytes=None, bytes_offset=0, traceflags=0,
opt_level=1, num_inst=None, num_bytes=None, strict_block_end=False, skip_stmts=False,collect_data_refs=False)
Parameters

564

Chapter 10. API Referenceangr• data (str | bytes | None) – The bytes to lift. Can be either a string of bytes or a cffi buffer
object. You may also pass None to initialize an empty IRSB.
• mem_addr (int) – The address to lift the data at.
• arch (Arch) – The architecture to lift the data as.
• max_inst (Optional[int]) – The maximum number of instructions to lift. (See note
below)• max_bytes (Optional[int]) – The maximum number of bytes to use.
• num_inst (Optional[int]) – Replaces max_inst if max_inst is None. If set to None aswell, no instruction limit is used.
• num_bytes (Optional[int]) – Replaces max_bytes if max_bytes is None. If set to Noneas well, no byte limit is used.
• bytes_offset (int) – The offset into data to start lifting at. Note that for ARM THUMB
mode, both mem_addr and bytes_offset must be odd (typically bytes_offset is set to 1).
• traceflags (int) – Unused by P-Code lifter• opt_level (int) – Unused by P-Code lifter• strict_block_end (bool) – Unused by P-Code lifter• skip_stmts (bool)• collect_data_refs (bool)
Return typeNone
ò NoteExplicitly specifying the number of instructions to lift (max_inst) may not always work exactly as expected. For example, on MIPS, it is meaningless to lift a branch or jump instruction without its delayslot. VEX attempts to Do The Right Thing by possibly decoding fewer instructions than requested.
Specifically, this means that lifting a branch or jump on MIPS as a single instruction (max_inst=1) will
result in an empty IRSB, and subsequent attempts to run this block will raise SimIRSBError(‘Empty
IRSB passed to SimIRSB.’).

ò NoteIf no instruction and byte limit is used, the lifter will continue lifting the block until the block ends
properly or until it runs out of data to lift.
addr:

int

arch:

archinfo.Arch

behaviors:

BehaviorFactory | None

data_refs:

Sequence

const_vals:

Sequence

10.9. Simulation Engines

565

angr

default_exit_target:
jumpkind:next:

Optional

str | Noneint | None

static empty_block(arch, addr, statements=None, nxt=None, tyenv=None, jumpkind=None,
direct_next=None, size=None)
Return type
IRSB
Parameters• arch (Arch )• addr (int)• statements (Sequence | None)• nxt (int | None)• jumpkind (str | None)• direct_next (bool | None)• size (int | None)
property has_statements:boolproperty exit_statements:

Sequence[tuple[int, int, ExitStatement]]

copy()
Copy by creating an empty IRSB and then filling in the leftover attributes. Copy is made as deep as possible
Return type
IRSB
extend(extendwith)
Appends an irsb to the current irsb. The irsb that is appended is invalidated. The appended irsb’s jumpkind
and default exit are used. :type extendwith: IRSB :param extendwith: The IRSB to append to this IRSB
Return type
IRSB
Parameters
extendwith (IRSB)
invalidate_direct_next()
Return type
None
pp()
Pretty-print the IRSB to stdout.
Return type
None
property tyenv
property stmts_used:

566

int

Chapter 10. API Referenceangrproperty offsIP: int
property direct_next:boolproperty expressions
Return an iterator of all expressions contained in the IRSB.
property instructions:int

The number of instructions in this blockproperty instruction_addresses:

Sequence[int]Addresses of instructions in this block.
property size:

int

The size of this block, in bytes
property operations
A list of all operations done by the IRSB, as libVEX enum names
property all_constants
Returns all constants in the block (including incrementing of the program counter) as pyvex.const.
IRConst.
property constants
The constants (excluding updates of the program counter) in the IRSB as pyvex.const.IRConst.
property constant_jump_targets
A set of the static jump targets of the basic block.
property constant_jump_targets_and_jumpkinds
A dict of the static jump targets of the basic block to their jumpkind.
property statements:

Iterable

property disassembly:

PcodeDisassemblerBlockclass angr.engines.pcode.lifter.Lifter(arch, addr)
Bases: object
A lifter is a class of methods for processing a block.
Variables• data – The bytes to lift as either a python string of bytes or a cffi buffer object.
• bytes_offset – The offset into data to start lifting at.
• max_bytes – The maximum number of bytes to lift. If set to None, no byte limit is used.
• max_inst – The maximum number of instructions to lift. If set to None, no instruction limit
is used.
• opt_level – Unused by P-Code lifter• traceflags – Unused by P-Code lifter• allow_arch_optimizations – Unused by P-Code lifter• strict_block_end – Unused by P-Code lifter• skip_stmts – Unused by P-Code lifter
Parameters10.9. Simulation Engines

567

angr

• arch (Arch )• addr (int)
REQUIRE_DATA_C = False
REQUIRE_DATA_PY = False__init__(arch, addr)
Parameters• arch (Arch )• addr (int)
arch:

Arch

addr:

int

data:

str | bytes | Nonebytes_offset:

int | None

opt_level:

int

traceflags:

int | None

allow_arch_optimizations:bool | None

strict_block_end:

bool | Nonecollect_data_refs:boolmax_inst:

int | None

max_bytes:

int | Noneskip_stmts:

bool

irsb:

IRSB

lift()
Lifts the data using the information passed into _lift. Should be overridden in child classes.
Should set the lifted IRSB to self.irsb. If a lifter raises a LiftingException on the data, this signals that thelifter cannot lift this data and arch and the lifter is skipped. If a lifter can lift any amount of data, it should
lift it and return the lifted block with a jumpkind of Ijk_NoDecode, signalling to pyvex that other lifters
should be used on the undecodable data.
Return type
Noneangr.engines.pcode.lifter.lift(data, addr, arch, max_bytes=None, max_inst=None, bytes_offset=0,
opt_level=1, traceflags=0, strict_block_end=True, inner=False,
skip_stmts=False, collect_data_refs=False)
Lift machine code in data to a P-code IRSB.
If a lifter raises a LiftingException on the data, it is skipped. If it succeeds and returns a block with a jumpkindof Ijk_NoDecode, all of the lifters are tried on the rest of the data and if they work, their output is appended to
the first block.
Parameters
568

Chapter 10. API Referenceangr• arch (Arch) – The arch to lift the data as.
• addr (int) – The starting address of the block. Effects the IMarks.
• data (str | bytes | None) – The bytes to lift as either a python string of bytes or a cffi buffer
object.
• max_bytes (Optional[int]) – The maximum number of bytes to lift. If set to None, nobyte limit is used.
• max_inst (Optional[int]) – The maximum number of instructions to lift. If set to None,no instruction limit is used.
• bytes_offset (int) – The offset into data to start lifting at.
• opt_level (int) – Unused by P-Code lifter• traceflags (int) – Unused by P-Code lifter• strict_block_end (bool)• inner (bool)• skip_stmts (bool)• collect_data_refs (bool)
Return typeIRSB
ò NoteExplicitly specifying the number of instructions to lift (max_inst) may not always work exactly as expected.
For example, on MIPS, it is meaningless to lift a branch or jump instruction without its delay slot. VEX
attempts to Do The Right Thing by possibly decoding fewer instructions than requested. Specifically, thismeans that lifting a branch or jump on MIPS as a single instruction (max_inst=1) will result in an empty IRSB,
and subsequent attempts to run this block will raise SimIRSBError(‘Empty IRSB passed to SimIRSB.’).

ò NoteIf no instruction and byte limit is used, the lifter will continue lifting the block until the block ends properlyor until it runs out of data to lift.
class angr.engines.pcode.lifter.PcodeBasicBlockLifter(arch)
Bases: object
Lifts basic blocks to P-code
Parametersarch (archinfo.Arch )__init__(arch)
Parametersarch (Arch )context:
behaviors:

Context
BehaviorFactory

10.9. Simulation Engines

569

angr

lift(irsb, baseaddr, data, bytes_offset=0, max_bytes=None, max_inst=None, branch_delay_slot=False,
is_sparc32=False)
Return type
None
Parameters• irsb (IRSB)• baseaddr (int)• data (bytes | bytearray)• bytes_offset (int)• max_bytes (int | None)• max_inst (int | None)• branch_delay_slot (bool)• is_sparc32 (bool)class angr.engines.pcode.lifter.PcodeLifter(arch, addr)
Bases: Lifter
Handles calling into pypcode to lift a block
Parameters• arch (Arch )• addr (int)data:

str | bytes | Nonebytes_offset:

int | None

opt_level:

int

traceflags:

int | None

allow_arch_optimizations:570

bool | None

strict_block_end:

bool | Nonecollect_data_refs:boolmax_inst:

int | None

max_bytes:

int | Noneskip_stmts:

bool

irsb:

IRSB

arch:

Arch

addr:

int

Chapter 10. API Referenceangrlift()
Lifts the data using the information passed into _lift. Should be overridden in child classes.
Should set the lifted IRSB to self.irsb. If a lifter raises a LiftingException on the data, this signals that thelifter cannot lift this data and arch and the lifter is skipped. If a lifter can lift any amount of data, it should
lift it and return the lifted block with a jumpkind of Ijk_NoDecode, signalling to pyvex that other lifters
should be used on the undecodable data.
Return type
Noneclass angr.engines.pcode.lifter.PcodeLifterEngineMixin(project=None, use_cache=None,
cache_size=50000, default_opt_level=1,
selfmodifying_code=None,
single_step=False,
default_strict_block_end=False, **kwargs)
Bases: SimEngineBase
Lifter mixin to lift from machine code to P-Code.
Parameters• use_cache (bool | None)• cache_size (int)• default_opt_level (int)• selfmodifying_code (bool | None)• single_step (bool)• default_strict_block_end (bool)__init__(project=None, use_cache=None, cache_size=50000, default_opt_level=1,
selfmodifying_code=None, single_step=False, default_strict_block_end=False, **kwargs)
Parameters• use_cache (bool | None)• cache_size (int)• default_opt_level (int)• selfmodifying_code (bool | None)• single_step (bool)• default_strict_block_end (bool)
clear_cache()
Return type
None
lift_vex(addr=None, state=None, clemory=None, insn_bytes=None, arch=None, size=None,
num_inst=None, traceflags=0, thumb=False, extra_stop_points=None, opt_level=None,
strict_block_end=None, skip_stmts=False, collect_data_refs=False, load_from_ro_regions=False,
cross_insn_opt=None, const_prop=None)
Temporary compatibility interface for integration with block code.
Parameters• addr (int | None)
10.9. Simulation Engines

571

angr

• state (SimState | None)• clemory (Clemory | None)• insn_bytes (bytes | None)• arch (Arch | None)• size (int | None)• num_inst (int | None)• traceflags (int)• thumb (bool)• extra_stop_points (Iterable[int] | None)• opt_level (int | None)• strict_block_end (bool | None)• skip_stmts (bool)• collect_data_refs (bool)• load_from_ro_regions (bool)• cross_insn_opt (bool | None)• const_prop (bool | None)
lift_pcode(addr=None, state=None, clemory=None, insn_bytes=None, arch=None, size=None,
num_inst=None, traceflags=0, thumb=False, extra_stop_points=None, opt_level=None,
strict_block_end=None, skip_stmts=False, collect_data_refs=False,
load_from_ro_regions=False, cross_insn_opt=None, const_prop=None)
Lift an IRSB.
There are many possible valid sets of parameters. You at the very least must pass some source of data,some source of an architecture, and some source of an address.
Sources of data in order of priority: insn_bytes, clemory, state
Sources of an address, in order of priority: addr, state
Sources of an architecture, in order of priority: arch, clemory, stateParameters• state (Optional[SimState]) – A state to use as a data source.
• clemory (Optional[Clemory]) – A cle.memory.Clemory object to use as a data source.
• addr (Optional[int]) – The address at which to start the block.
• thumb (bool) – Whether the block should be lifted in ARM’s THUMB mode.
• opt_level (Optional[int]) – Unused for P-Code lifter• insn_bytes (Optional[bytes]) – A string of bytes to use as a data source.
• size (Optional[int]) – The maximum size of the block, in bytes.
• num_inst (Optional[int]) – The maximum number of instructions.
• traceflags (int) – Unused by P-Code lifter• strict_block_end (Optional[bool]) – Unused by P-Code lifter• load_from_ro_regions (bool) – Unused by P-Code lifter
572

Chapter 10. API Referenceangr• arch (Arch | None)• extra_stop_points (Iterable[int] | None)• skip_stmts (bool)• collect_data_refs (bool)• cross_insn_opt (bool | None)• const_prop (bool | None)class angr.engines.pcode.emulate.PcodeEmulatorMixin(*args, **kwargs)
Bases: SimEngineBase
Mixin for p-code execution.
__init__(*args, **kwargs)
handle_pcode_block(irsb)
Execute a single P-Code IRSB.
Parametersirsb (IRSB) – Block to be executed.
Return type
Noneangr.engines.pcode.behavior.make_bv_sizes_equal(bv1, bv2)
Makes two BVs equal in length through sign extension.
Return typetuple[BV, BV]
Parameters• bv1 (BV)
• bv2 (BV)
class angr.engines.pcode.behavior.OpBehavior(opcode, is_unary, is_special=False)
Bases: object
Base class for all operation behaviors.
Parameters• opcode (int)• is_unary (bool)• is_special (bool)__init__(opcode, is_unary, is_special=False)
Parameters• opcode (int)• is_unary (bool)• is_special (bool)
Return type
None

10.9. Simulation Engines

573

angr

opcode:int

is_unary:is_special:

bool
bool

evaluate_unary(size_out, size_in, in1)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
static generic_compare(args, comparison)
Return type
BV
Parameters• args (Iterable[BV])• comparison (Callable[[BV, BV], BV])
classmethod booleanize(in1)
Reduce input BV to a single bit of truth: out <- 1 if (in1 != 0) else 0.
Return type
BV
Parametersin1 (BV)
class angr.engines.pcode.behavior.OpBehaviorCopy
Bases: OpBehavior
Behavior for the COPY operation.
__init__()evaluate_unary(size_out, size_in, in1)
Return type
BV

574

Chapter 10. API ReferenceangrParameters• size_out (int)• size_in (int)• in1 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorEqual
Bases: OpBehavior
Behavior for the INT_EQUAL operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorNotEqual
Bases: OpBehavior
Behavior for the INT_NOTEQUAL operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

10.9. Simulation Engines

575

angr

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntSless
Bases: OpBehavior
Behavior for the INT_SLESS operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntSlessEqual
Bases: OpBehavior
Behavior for the INT_SLESSEQUAL operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorIntLess
Bases: OpBehavior
Behavior for the INT_LESS operation.

576

Chapter 10. API Referenceangr__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntLessEqual
Bases: OpBehavior
Behavior for the INT_LESSEQUAL operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorIntZext
Bases: OpBehavior
Behavior for the INT_ZEXT operation.
__init__()evaluate_unary(size_out, size_in, in1)
Return type
BV
Parameters• size_out (int)
10.9. Simulation Engines

577

angr

• size_in (int)• in1 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntSext
Bases: OpBehavior
Behavior for the INT_SEXT operation.
__init__()evaluate_unary(size_out, size_in, in1)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntAdd
Bases: OpBehavior
Behavior for the INT_ADD operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool

578

bool

Chapter 10. API Referenceangrclass angr.engines.pcode.behavior.OpBehaviorIntSub
Bases: OpBehavior
Behavior for the INT_SUB operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntCarry
Bases: OpBehavior
Behavior for the INT_CARRY operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorIntScarry
Bases: OpBehavior
Behavior for the INT_SCARRY operation.
__init__()10.9. Simulation Engines

579

angr

evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntSborrow
Bases: OpBehavior
Behavior for the INT_SBORROW operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorInt2Comp
Bases: OpBehavior
Behavior for the INT_2COMP operation.
__init__()evaluate_unary(size_out, size_in, in1)
Return type
BV
Parameters• size_out (int)• size_in (int)
580

Chapter 10. API Referenceangr• in1 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntNegate
Bases: OpBehavior
Behavior for the INT_NEGATE operation.
__init__()evaluate_unary(size_out, size_in, in1)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntXor
Bases: OpBehavior
Behavior for the INT_XOR operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

10.9. Simulation Engines

581

angr

class angr.engines.pcode.behavior.OpBehaviorIntAnd
Bases: OpBehavior
Behavior for the INT_AND operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntOr
Bases: OpBehavior
Behavior for the INT_OR operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorIntLeft
Bases: OpBehavior
Behavior for the INT_LEFT operation.
__init__()582

Chapter 10. API Referenceangrevaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntRight
Bases: OpBehavior
Behavior for the INT_RIGHT operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorIntSrightBases: OpBehavior
Behavior for the INT_SRIGHT operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)
10.9. Simulation Engines

583

angr

• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntMult
Bases: OpBehavior
Behavior for the INT_MULT operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntDiv
Bases: OpBehavior
Behavior for the INT_DIV operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool

584

bool

Chapter 10. API Referenceangrclass angr.engines.pcode.behavior.OpBehaviorIntSdiv
Bases: OpBehavior
Behavior for the INT_SDIV operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorIntRem
Bases: OpBehavior
Behavior for the INT_REM operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorIntSrem
Bases: OpBehavior
Behavior for the INT_SREM operation.
__init__()10.9. Simulation Engines

585

angr

evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorBoolNegate
Bases: OpBehavior
Behavior for the BOOL_NEGATE operation.
__init__()evaluate_unary(size_out, size_in, in1)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorBoolXor
Bases: OpBehavior
Behavior for the BOOL_XOR operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
586

Chapter 10. API Referenceangr• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorBoolAnd
Bases: OpBehavior
Behavior for the BOOL_AND operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorBoolOr
Bases: OpBehavior
Behavior for the BOOL_OR operation.
__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:is_special:

bool
bool

10.9. Simulation Engines

587

angr

class angr.engines.pcode.behavior.OpBehaviorFloatEqual
Bases: OpBehavior
Behavior for the FLOAT_EQUAL operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatNotEqual
Bases: OpBehavior
Behavior for the FLOAT_NOTEQUAL operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatLess
Bases: OpBehavior
Behavior for the FLOAT_LESS operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatLessEqual
Bases: OpBehavior
Behavior for the FLOAT_LESSEQUAL operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatNan
Bases: OpBehavior
Behavior for the FLOAT_NAN operation.
__init__()opcode:is_unary:

int

588

bool

Chapter 10. API Referenceangris_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatAdd
Bases: OpBehavior
Behavior for the FLOAT_ADD operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatDiv
Bases: OpBehavior
Behavior for the FLOAT_DIV operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatMult
Bases: OpBehavior
Behavior for the FLOAT_MULT operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatSub
Bases: OpBehavior
Behavior for the FLOAT_SUB operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatNeg
Bases: OpBehavior
Behavior for the FLOAT_NEG operation.
__init__()opcode:int

10.9. Simulation Engines

589

angr

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatAbs
Bases: OpBehavior
Behavior for the FLOAT_ABS operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatSqrt
Bases: OpBehavior
Behavior for the FLOAT_SQRT operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatInt2Float
Bases: OpBehavior
Behavior for the FLOAT_INT2FLOAT operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatFloat2Float
Bases: OpBehavior
Behavior for the FLOAT_FLOAT2FLOAT operation.
__init__()opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorFloatTrunc
Bases: OpBehavior
Behavior for the FLOAT_TRUNC operation.
__init__()590

Chapter 10. API Referenceangropcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatCeil
Bases: OpBehavior
Behavior for the FLOAT_CEIL operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatFloor
Bases: OpBehavior
Behavior for the FLOAT_FLOOR operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorFloatRoundBases: OpBehavior
Behavior for the FLOAT_ROUND operation.
__init__()opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorPiece
Bases: OpBehavior
Behavior for the PIECE operation.
__init__()opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorSubpiece
Bases: OpBehavior
Behavior for the SUBPIECE operation.

10.9. Simulation Engines

591

angr

__init__()evaluate_binary(size_out, size_in, in1, in2)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
• in2 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.OpBehaviorPopcountBases: OpBehavior
Behavior for the POPCOUNT operation.
__init__()evaluate_unary(size_out, size_in, in1)
Return type
BV
Parameters• size_out (int)• size_in (int)• in1 (BV)
opcode:int

is_unary:is_special:

bool
bool

class angr.engines.pcode.behavior.OpBehaviorLzcountBases: OpBehavior
Behavior for the LZCOUNT operation.
__init__()evaluate_unary(size_out, size_in, in1)
Return type
BV
Parameters• size_out (int)• size_in (int)592

Chapter 10. API Referenceangr• in1 (BV)
opcode:int

is_unary:bool

is_special:boolclass angr.engines.pcode.behavior.BehaviorFactory
Bases: object
Returns the behavior object for a given opcode.
__init__()get_behavior_for_opcode(opcode)
Return type
OpBehavior
Parameters
opcode (int)class angr.engines.pcode.cc.SimCCM68k(arch)
Bases: SimCC
Default CC for M68k
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = []FP_ARG_REGS: list[str] = []STACKARG_SP_DIFF = 4
RETURN_VAL: SimFunctionArgument = <d0>
RETURN_ADDR: SimFunctionArgument = [0x0]class angr.engines.pcode.cc.SimCCRISCV(arch)
Bases: SimCC
Default CC for RISCV
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7']
RETURN_ADDR: SimFunctionArgument = <ra>
RETURN_VAL: SimFunctionArgument = <a0>class angr.engines.pcode.cc.SimCCSPARC(arch)
Bases: SimCC
Default CC for SPARC
Parametersarch (archinfo.Arch )10.9. Simulation Engines

593

angr

ARG_REGS: list[str] = ['o0', 'o1', 'o2', 'o3', 'o4', 'o5']
RETURN_VAL: SimFunctionArgument = <o0>
RETURN_ADDR: SimFunctionArgument = <o7>class angr.engines.pcode.cc.SimCCSH4(arch)
Bases: SimCC
Default CC for SH4
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r4', 'r5']
RETURN_VAL: SimFunctionArgument = <r0>
RETURN_ADDR: SimFunctionArgument = <pr>class angr.engines.pcode.cc.SimCCPARISC(arch)
Bases: SimCC
Default CC for PARISC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r26', 'r25']
RETURN_VAL: SimFunctionArgument = <r28>
RETURN_ADDR: SimFunctionArgument = <rp>class angr.engines.pcode.cc.SimCCPowerPC(arch)
Bases: SimCC
Default CC for PowerPC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = []STACKARG_SP_BUFF = 8
RETURN_ADDR: SimFunctionArgument = <lr>
RETURN_VAL: SimFunctionArgument = <r3>class angr.engines.pcode.cc.SimCCXtensa(arch)
Bases: SimCC
Default CC for Xtensa
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['i2', 'i3', 'i4', 'i5', 'i6', 'i7']594

Chapter 10. API Referenceangr

FP_ARG_REGS: list[str] = []RETURN_ADDR: SimFunctionArgument = <a0>
RETURN_VAL: SimFunctionArgument = <o2>angr.engines.pcode.cc.register_pcode_arch_default_cc(arch)
Parametersarch (ArchPcode)

10.10 Simulation Logging
class angr.state_plugins.sim_action.SimAction(state, region_type)
Bases: SimEvent
A SimAction represents a semantic action that an analyzed program performs.
TMP = 'tmp'
REG = 'reg'
MEM = 'mem'__init__(state, region_type)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
property all_objects
property is_symbolic
property tmp_deps
property reg_deps
copy()
downsize()
Clears some low-level details (that take up memory) out of the SimAction.
class angr.state_plugins.sim_action.SimActionExit(state, target, condition=None, exit_type=None)
Bases: SimAction
An Exit action represents a (possibly conditional) jump.
CONDITIONAL = 'conditional'
DEFAULT = 'default'__init__(state, target, condition=None, exit_type=None)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
property all_objects

10.10. Simulation Logging

595

angr

property is_symbolicclass angr.state_plugins.sim_action.SimActionConstraint(state, constraint, condition=None)
Bases: SimAction
A constraint action represents an extra constraint added during execution of a path.
__init__(state, constraint, condition=None)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
property all_objects
property is_symbolicclass angr.state_plugins.sim_action.SimActionOperation(state, op, exprs, result)
Bases: SimAction
An action representing an operation between variables and/or constants.
__init__(state, op, exprs, result)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
property all_objects
property is_symbolicclass angr.state_plugins.sim_action.SimActionData(state, region_type, action, tmp=None, addr=None,
size=None, data=None, condition=None,
fallback=None, fd=None)
Bases: SimAction
A Data action represents a read or a write from memory, registers or a file.
READ = 'read'
WRITE = 'write'
OPERATE = 'operate'__init__(state, region_type, action, tmp=None, addr=None, size=None, data=None, condition=None,
fallback=None, fd=None)
Initializes the SimAction.
Parametersstate – the state that’s the SimAction is taking place in.
downsize()
Clears some low-level details (that take up memory) out of the SimAction.
property all_objects
property is_symbolic
property tmp_deps

596

Chapter 10. API Referenceangrproperty reg_deps
property storage
angr.state_plugins.sim_action_object.ast_preserving_op(f , *args)
angr.state_plugins.sim_action_object.ast_stripping_decorator(f )class angr.state_plugins.sim_action_object.SimActionObject(ast, reg_deps=frozenset({}),
tmp_deps=frozenset({}),
deps=frozenset({}), state=None)
Bases: object
A SimActionObject tracks an AST and its dependencies.
Parameters• ast (Base)• reg_deps (frozenset[SimActionData | SimActionOperation])• tmp_deps (frozenset[SimActionData | SimActionOperation])• deps (frozenset)• state (SimState | None)__init__(ast, reg_deps=frozenset({}), tmp_deps=frozenset({}), deps=frozenset({}), state=None)
Parameters• ast (Base)• reg_deps (frozenset[SimActionData | SimActionOperation])• tmp_deps (frozenset[SimActionData | SimActionOperation])• deps (frozenset)• state (SimState | None)
ast:

Base

reg_deps:

frozenset[SimActionData | SimActionOperation]

tmp_deps:

frozenset[SimActionData | SimActionOperation]

to_claripy()
Return typeBasecopy()
Return type
SimActionObject
is_leaf()
Return typebool
property op:

str

10.10. Simulation Logging

597

angr

property args:

tuple[ArgType, ...]

property length:

int | None

property variables:

frozenset[str]property symbolic:boolproperty annotations:
property depth:

tuple[Annotation, ...]

int

SDiv(other)
Return type
SimActionObject
SMod(other)
Return type
SimActionObject
union(other)
Return type
SimActionObject
intersection(other)
Return type
SimActionObject
widen(other)
Return type
SimActionObject
raw_to_bv()
Return type
SimActionObject
bv_to_fp()
Return type
SimActionObject
class angr.state_plugins.sim_event.SimEvent(state, event_type, **kwargs)
Bases: object
A SimEvent is a log entry for some notable event during symbolic execution. It logs the location it was generated(ins_addr, bbl_addr, stmt_idx, and sim_procedure) as well as arbitrary tags (objects).
You may also be interested in SimAction, which is a specialization of SimEvent for CPU events.
__init__(state, event_type, **kwargs)
angr.state_plugins.sim_event.resource_event(state, exception)

598

Chapter 10. API Referenceangr10.11 Proceduresclass angr.sim_procedure.SimProcedure(project=None, cc=None, prototype=None, symbolic_return=None,
returns=None, is_syscall=False, is_stub=False, num_args=None,
display_name=None, library_name=None, is_function=None,**kwargs)
Bases: object
A SimProcedure is a wonderful object which describes a procedure to run on a state.
You may subclass SimProcedure and override run(), replacing it with mutating self.state however you like,and then either returning a value or jumping away somehow.
A detailed discussion of programming SimProcedures may be found at https://docs.angr.io/extending-angr/simprocedures
Parameters• arch – The architecture to use for this procedure• project (Project)• cc (SimCC)• prototype (SimTypeFunction)
The following parameters are optional:
Parameters• symbolic_return – Whether the procedure’s return value should be stubbed into a single
symbolic variable constratined to the real return value• returns – Whether the procedure should return to its caller afterwards• is_syscall – Whether this procedure is a syscall• num_args – The number of arguments this procedure should extract• display_name – The name to use when displaying this procedure• library_name – The name of the library from which the function we’re emulating comes• cc – The SimCC to use for this procedure• sim_kwargs – Additional keyword arguments to be passed to run()• is_function – Whether this procedure emulates a function• project (Project)• prototype (SimTypeFunction)
The following class variables should be set if necessary when implementing a new SimProcedure:
Variables• NO_RET – Set this to true if control flow will never return from this function• DYNAMIC_RET – Set this to true if whether the control flow returns from this function or not
depends on the context (e.g., libc’s error() call). Must implement dynamic_returns() method.
• ADDS_EXITS – Set this to true if you do any control flow other than returning• IS_FUNCTION – Does this procedure simulate a function? True by default

10.11. Procedures

599

angr

• ARGS_MISMATCH – Does this procedure have a different list of arguments than what is provided in the function specification? This may happen when we manually extract argumentsin the run() method of a SimProcedure. False by default.
• local_vars – If you use self.call(), set this to a list of all the local variable names inyour class. They will be restored on return.
Parameters• project (Project)• cc (SimCC)• prototype (SimTypeFunction)
The following instance variables are available when working with simprocedures from the inside or the outside:
Variables• project – The associated angr project• arch – The associated architecture• addr – The linear address at which the procedure is executing• cc – The calling convention in use for engaging with the ABI• canonical – The canonical version of this SimProcedure. Procedures are deepcopied formany reasons, including to be able to store state related to a specific run and to be able tohook continuations.
• kwargs – Any extra keyword arguments used to construct the procedure; will be passed torun• display_name – See the eponymous parameter• library_name – See the eponymous parameter• abi – If this is a syscall simprocedure, which ABI are we using to map the syscall numbers?
• symbolic_return – See the eponymous parameter• syscall_number – If this procedure is a syscall, the number will be populated here.
• returns – See eponymous parameter and NO_RET cvar
• is_syscall – See eponymous parameter• is_function – See eponymous parameter and cvar
• is_stub – See eponymous parameter• is_continuation – Whether this procedure is the original or a continuation resulting fromself.call()• continuations – A mapping from name to each known continuation• run_func – The name of the function implementing the procedure. “run” by default, butdifferent in continuations.
• num_args – The number of arguments to the procedure. If not provided in the parameter,
extracted from the definition of self.run
Parameters• project (Project)• cc (SimCC)

600

Chapter 10. API Referenceangr• prototype (SimTypeFunction)
The following instance variables are only used in a copy of the procedure that is actually executing on a state:
Variables• state – The SimState we should be mutating to perform the procedure• successors – The SimSuccessors associated with the current step• arguments – The function arguments, deserialized from the state• arg_session – The ArgSession that was used to parse arguments out of the state, in caseyou need it for varargs• use_state_arguments – Whether we’re using arguments extracted from the state or manually provided• ret_to – The current return address• ret_expr – The computed return value• call_ret_expr – The return value from having used self.call()• inhibit_autoret – Whether we should avoid automatically adding an exit for returning
once the run function ends
• arg_session – The ArgSession object that was used to extract the runtime argument values.
Useful for if you want to extract variadic args.
Parameters• project (Project)• cc (SimCC)• prototype (SimTypeFunction)__init__(project=None, cc=None, prototype=None, symbolic_return=None, returns=None,
is_syscall=False, is_stub=False, num_args=None, display_name=None, library_name=None,is_function=None, **kwargs)
project:arch:
cc:

Project

Arch

SimCC

prototype:state:

SimTypeFunction

SimState

arg_session:

None | ArgSession | int

execute(state, successors=None, arguments=None, ret_to=None)
Call this method with a SimState and a SimSuccessors to execute the procedure.
Alternately, successors may be none if this is an inline call. In that case, you should provide arguments tothe function.
make_continuation(name)
NO_RET = False
DYNAMIC_RET = False

10.11. Procedures

601

angr

ADDS_EXITS = False
IS_FUNCTION = True
ARGS_MISMATCH = False
ALT_NAMES = None
local_vars:

tuple[str, ...] = ()run(*args, **kwargs)
Implement the actual procedure here!
static_exits(blocks, **kwargs)
Get new exits by performing static analysis and heuristics. This is a fast and best-effort approach to get new
exits for scenarios where states are not available (e.g. when building a fast CFG).
Parameters
blocks (list) – Blocks that are executed before reaching this SimProcedure.
Returns
A list of dicts. Each dict should contain the following entries: ‘address’, ‘jumpkind’, and‘namehint’.
Return typelist
dynamic_returns(blocks, **kwargs)
Determines if a call to this function returns or not by performing static analysis and heuristics.
Parameters
blocks – Blocks that are executed before reaching this SimProcedure.
Return typebool
Returns
True if the call returns, False otherwise.
property should_add_successors
set_args(args)
va_arg(ty, index=None)
inline_call(procedure, *arguments, **kwargs)
Call another SimProcedure in-line to retrieve its return value. Returns an instance of the procedure withthe ret_expr property set.
Parameters• procedure – The class of the procedure to execute• arguments – Any additional positional args will be used as arguments to the procedurecall• sim_kwargs – Any additional keyword args will be passed as sim_kwargs to the procedure
constructor
fix_prototype_returnty(ret_size)

602

Chapter 10. API Referenceangrret(expr=None)
Add an exit representing a return from this function. If this is not an inline call, grab a return address fromthe state and jump to it. If this is not an inline call, set a return expression with the calling convention.
call(addr, args, continue_at, cc=None, prototype=None, jumpkind='Ijk_Call')
Add an exit representing calling another function via pointer.
Parameters• addr – The address of the function to call• args – The list of arguments to call the function with• continue_at – Later, when the called function returns, execution of the current procedure
will continue in the named method.
• cc – Optional: use this calling convention for calling the new function. Default is to use
the current convention.
• prototype – Optional: The prototype to use for the call. Will default to all-ints.
jump(addr, jumpkind='Ijk_Boring')
Add an exit representing jumping to an address.
exit(exit_code)
Add an exit representing terminating the program.
ty_ptr(ty)property is_java
property argument_types
property return_type
class angr.procedures.stubs.format_parser.FormatString(parser, components)
Bases: object
Describes a format string.
SCANF_DELIMITERS = [b'\t', b'\n', b'\x0b', b'\r', b' ']__init__(parser, components)
Takes a list of components which are either just strings or a FormatSpecifier.
property state
replace(va_arg)
Implement printf - based on the stored format specifier information, format the values from the arg getter
function args into a string.
Parameters
va_arg – A function which takes a type and returns the next argument of that type
Returns
The result formatted stringinterpret(va_arg, addr=None, simfd=None)
implement scanf - extract formatted data from memory or a file according to the stored format specifiers
and store them into the pointers extracted from args.
Parameters10.11. Procedures

603

angr

• va_arg – A function which, given a type, returns the next argument of that type• addr – The address in the memory to extract data from, or. . .
• simfd – A file descriptor to use for reading data fromReturns
The number of arguments parsed
class angr.procedures.stubs.format_parser.FormatSpecifier(string, length_spec, pad_chr, size,
signed)Bases: object
Describes a format specifier within a format string.
__init__(string, length_spec, pad_chr, size, signed)
stringsize
signedlength_spec
pad_chrproperty spec_type
class angr.procedures.stubs.format_parser.FormatParser(project=None, cc=None, prototype=None,symbolic_return=None, returns=None,
is_syscall=False, is_stub=False,
num_args=None, display_name=None,library_name=None, is_function=None,**kwargs)
Bases: SimProcedure
For SimProcedures relying on printf-style format strings.
Parameters• project (Project)• cc (SimCC)• prototype (SimTypeFunction)
ARGS_MISMATCH = Truebasic_spec = {b'A': double, b'E': double, b'F': double, b'G': double, b'X': unsigned
int, b'a': double, b'c': char, b'd': int, b'e': double, b'f': double, b'g':
double, b'i': int, b'n': unsigned int*, b'o': unsigned int, b'p': unsigned int*,
b's': char*, b'u': unsigned int, b'x': unsigned int}
int_sign = {'signed':[b'd', b'i'], 'unsigned':[b'o', b'u', b'x', b'X']}

int_len_mod = {b'h': (short, unsigned short), b'hh': (char, char), b'j': (longlong, unsigned long long), b'l': (long, unsigned long), b'll': (long long,unsigned long long), b't': (long, long), b'z': (size_t, size_t)}
other_types = {('string',):604<function FormatParser.<lambda>>}Chapter 10. API Referenceangrflags = ['#', '0', '\\-', ' ', '\\+', "\\'", 'I']
extract_components(fmt)
Extract the actual formats from the format string fmt.
Parameters
fmt (list) – A list of format chars.
Return type
list
Returnsa FormatString object
class angr.procedures.stubs.format_parser.ScanfFormatParser(project=None, cc=None,
prototype=None,symbolic_return=None,
returns=None, is_syscall=False,
is_stub=False, num_args=None,
display_name=None,library_name=None,is_function=None, **kwargs)
Bases: FormatParser
For SimProcedures relying on scanf-style format strings.
basic_spec = {b'A': float, b'E': float, b'F': float, b'G': float, b'X': unsigned
int, b'a': float, b'c': char, b'd': int, b'e': float, b'f': float, b'g':
float, b'i': int, b'n': unsigned int*, b'o': unsigned int, b'p': unsigned int*,
b's': char*, b'u': unsigned int, b'x': unsigned int}
float_spec = [b'e', b'E', b'f', b'F', b'g', b'G', b'a', b'A']
float_len_mod = {b'l': <class 'angr.sim_type.SimTypeDouble'>, b'll':'angr.sim_type.SimTypeDouble'>}<classclass angr.procedures.definitions.SimTypeCollection
Bases: object
A type collection is the mechanism for describing types. Types in a type collection can be referenced using__init__()set_names(*names)
add(name, t)
Add a type to the collection.
Parameters• name (str) – Name of the type to add.
• t (SimType) – The SimType object to add to the collection.
Return typeNone
get(name, bottom_on_missing=False)
Get a SimType object from the collection as identified by the name.
Parameters10.11. Procedures

605

angr

• name (str) – Name of the type to get.
• bottom_on_missing (bool) – Return a SimTypeBottom object if the required type does
not exist.
Return type
SimType
Returns
The SimType object.
init_str()
Return typestrclass angr.procedures.definitions.SimLibrary
Bases: object
A SimLibrary is the mechanism for describing a dynamic library’s API, its functions and metadata.
Any instance of this class (or its subclasses) found in the angr.procedures.definitions package will be
automatically picked up and added to angr.SIM_LIBRARIES via all its names.
Variables• fallback_cc – A mapping from architecture to the default calling convention that should
be used if no other information is present. Contains some sane defaults for linux.
• fallback_proc – A SimProcedure class that should be used to provide stub procedures.
By default, ReturnUnconstrained.
__init__()copy()
Make a copy of this SimLibrary, allowing it to be mutated without affecting the global version.
Returns
A new SimLibrary object with the same library references but different dict/list references
update(other)
Augment this SimLibrary with the information from another SimLibraryParameters
other – The other SimLibrary
property name
The first common name of this library, e.g. libc.so.6, or ‘??????’ if none are known.
set_library_names(*names)
Set some common names of this library by which it may be referred during linking
Parametersnames – Any number of string library names may be passed as varargs.
set_default_cc(arch_name, cc_cls)
Set the default calling convention used for this library under a given architecture
Parameters
arch_name – The string name of the architecture, i.e. the .name field from archinfo.
Parm cc_cls
The SimCC class (not an instance!) to use

606

Chapter 10. API Referenceangr

set_non_returning(*names)
Mark some functions in this class as never returning, i.e. loops forever or terminates execution
Parametersnames – Any number of string function names may be passed as varargs
set_prototype(name, proto)
Set the prototype of a function in the form of a SimTypeFunction containing argument and return types
Parameters• name – The name of the function as a string• proto – The prototype of the function as a SimTypeFunction
set_prototypes(protos)
Set the prototypes of many functions
Parameters
protos – Dictionary mapping function names to SimTypeFunction objects
set_c_prototype(c_decl)
Set the prototype of a function in the form of a C-style function declaration.
Parameters
c_decl (str) – The C-style declaration of the function.
Returns
A tuple of (function name, function prototype)
Return typetuple
add(name, proc_cls, **kwargs)
Add a function implementation to the library.
Parameters• name – The name of the function as a string• proc_cls – The implementation of the function as a SimProcedure _class_, not instance• kwargs – Any additional parameters to the procedure class constructor may be passed as
kwargs
add_all_from_dict(dictionary, **kwargs)
Batch-add function implementations to the library.
Parameters• dictionary – A mapping from name to procedure class, i.e. the first two arguments toadd()• kwargs – Any additional kwargs will be passed to the constructors of _each_ procedureclass
add_alias(name, *alt_names)
Add some duplicate names for a given function. The original function’s implementation must already beregistered.
Parameters• name – The name of the function for which an implementation is already present

10.11. Procedures

607

angr

• alt_names – Any number of alternate names may be passed as varargs
get(name, arch)
Get an implementation of the given function specialized for the given arch, or a stub procedure if none
exists.
Parameters• name – The name of the function as a string• arch – The architecure to use, as either a string or an archinfo.Arch instance
Returns
A SimProcedure instance representing the function as found in the library
get_stub(name, arch)
Get a stub procedure for the given function, regardless of if a real implementation is available. This will
apply any metadata, such as a default calling convention or a function prototype.
By stub, we pretty much always mean a ReturnUnconstrained SimProcedure with the appropriate display name and metadata set. This will appear in state.history.descriptions as <SimProcedure
display_name (stub)>Parameters• name – The name of the function as a string• arch – The architecture to use, as either a string or an archinfo.Arch instance
Returns
A SimProcedure instance representing a plausable stub as could be found in the library.
get_prototype(name, arch=None)
Get a prototype of the given function name, optionally specialize the prototype to a given architecture.
Parameters• name (str) – Name of the function.
• arch – The architecture to specialize to.
Return type
SimTypeFunction | None
Returns
Prototype of the function, or None if the prototype does not exist.
has_metadata(name)
Check if a function has either an implementation or any metadata associated with it
Parametersname – The name of the function as a string
Returns
A bool indicating if anything is known about the function
has_implementation(name)
Check if a function has an implementation associated with it
Parametersname – The name of the function as a string
Returns
A bool indicating if an implementation of the function is available

608

Chapter 10. API Referenceangrhas_prototype(func_name)
Check if a function has a prototype associated with it.
Parameters
func_name (str) – The name of the function.
Returns
A bool indicating if a prototype of the function is available.
Return typeboolclass angr.procedures.definitions.SimCppLibrary
Bases: SimLibrary
SimCppLibrary is a specialized version of SimLibrary that will demangle C++ function names before looking
for an implementation or prototype for it.
get(name, arch)
Get an implementation of the given function specialized for the given arch, or a stub procedure if none
exists. Demangle the function name if it is a mangled C++ name.
Parameters• name (str) – The name of the function as a string• arch – The architecure to use, as either a string or an archinfo.Arch instance
Returns
A SimProcedure instance representing the function as found in the library
get_stub(name, arch)
Get a stub procedure for the given function, regardless of if a real implementation is available. This will
apply any metadata, such as a default calling convention or a function prototype. Demangle the function
name if it is a mangled C++ name.
Parameters• name (str) – The name of the function as a string• arch – The architecture to use, as either a string or an archinfo.Arch instance
Returns
A SimProcedure instance representing a plausable stub as could be found in the library.
get_prototype(name, arch=None)
Get a prototype of the given function name, optionally specialize the prototype to a given architecture. The
function name will be demangled first.
Parameters• name (str) – Name of the function.
• arch – The architecture to specialize to.
Return type
SimTypeFunction | None
Returns
Prototype of the function, or None if the prototype does not exist.

10.11. Procedures

609

angr

has_metadata(name)
Check if a function has either an implementation or any metadata associated with it. Demangle the function
name if it is a mangled C++ name.
Parametersname – The name of the function as a string
Returns
A bool indicating if anything is known about the function
has_implementation(name)
Check if a function has an implementation associated with it. Demangle the function name if it is a mangled
C++ name.
Parametersname (str) – A mangled function name.
Returnsbool
has_prototype(func_name)
Check if a function has a prototype associated with it. Demangle the function name if it is a mangled C++
name.
Parametersname (str) – A mangled function name.
Returnsboolclass angr.procedures.definitions.SimSyscallLibrary
Bases: SimLibrary
SimSyscallLibrary is a specialized version of SimLibrary for dealing not with a dynamic library’s API but rather
an operating system’s syscall API. Because this interface is inherently lower-level than a dynamic library, many
parts of this class has been changed to store data based on an “ABI name” (ABI = application binary interface,
like an API but for when there’s no programming language) instead of an architecture. An ABI name is just anarbitrary string with which a calling convention and a syscall numbering is associated.
All the SimLibrary methods for adding functions still work, but now there’s an additional layer on top thatassociates them with numbers.
__init__()copy()
Make a copy of this SimLibrary, allowing it to be mutated without affecting the global version.
Returns
A new SimLibrary object with the same library references but different dict/list references
update(other)
Augment this SimLibrary with the information from another SimLibraryParameters
other – The other SimLibraryminimum_syscall_number(abi)Parameters
abi – The abi to evaluate

610

Chapter 10. API ReferenceangrReturns
The smallest syscall number known for the given abi
maximum_syscall_number(abi)Parameters
abi – The abi to evaluate
Returns
The largest syscall number known for the given abi
add_number_mapping(abi, number, name)
Associate a syscall number with the name of a function present in the underlying SimLibraryParameters• abi – The abi for which this mapping applies• number – The syscall number• name – The name of the function
add_number_mapping_from_dict(abi, mapping)
Batch-associate syscall numbers with names of functions present in the underlying SimLibraryParameters• abi – The abi for which this mapping applies• mapping – A dict mapping syscall numbers to function names
set_abi_cc(abi, cc_cls)
Set the default calling convention for an abi
Parameters• abi – The name of the abi• cc_cls – A SimCC _class_, not an instance, that should be used for syscalls using the abi
set_prototype(abi, name, proto)
Set the prototype of a function in the form of a SimTypeFunction containing argument and return types
Parameters• abi (str) – ABI of the syscall.
• name (str) – The name of the syscall as a string• proto (SimTypeFunction) – The prototype of the syscall as a SimTypeFunction
Return type
None
set_prototypes(abi, protos)
Set the prototypes of many syscalls.
Parameters• abi (str) – ABI of the syscalls.
• protos (dict[str, SimTypeFunction]) – Dictionary mapping syscall names to SimTypeFunction objects
Return type
None

10.11. Procedures

611

angr

get(number, arch, abi_list=())
The get() function for SimSyscallLibrary looks a little different from its original version.
Instead of providing a name, you provide a number, and you additionally provide a list of abi names thatare applicable. The first abi for which the number is present in the mapping will be chosen. This allows forthe easy abstractions of architectures like ARM or MIPS linux for which there are many ABIs that can beused at any time by using syscall numbers from various ranges. If no abi knows about the number, the stubprocedure with the name “sys_%d” will be used.
Parameters• number – The syscall number• arch – The architecture being worked with, as either a string name or an archinfo.Arch• abi_list – A list of ABI names that could be used
Returns
A SimProcedure representing the implementation of the given syscall, or a stub if no implementation is available
get_stub(number, arch, abi_list=())
Pretty much the intersection of SimLibrary.get_stub() and SimSyscallLibrary.get().
Parameters• number – The syscall number• arch – The architecture being worked with, as either a string name or an archinfo.Arch• abi_list – A list of ABI names that could be used
Returns
A SimProcedure representing a plausable stub that could model the syscall
get_prototype(abi, name, arch=None)
Get a prototype of the given syscall name and its ABI, optionally specialize the prototype to a given architecture.
Parameters• abi (str) – ABI of the prototype to get.
• name (str) – Name of the syscall.
• arch – The architecture to specialize to.
Return type
SimTypeFunction | None
Returns
Prototype of the syscall, or None if the prototype does not exist.
has_metadata(number, arch, abi_list=())
Pretty much the intersection of SimLibrary.has_metadata() and SimSyscallLibrary.get().
Parameters• number – The syscall number• arch – The architecture being worked with, as either a string name or an archinfo.Arch• abi_list – A list of ABI names that could be used
Returns
A bool of whether or not any implementation or metadata is known about the given syscall
612

Chapter 10. API Referenceangrhas_implementation(number, arch, abi_list=())
Pretty much the intersection of SimLibrary.has_implementation() and SimSyscallLibrary.get().
Parameters• number – The syscall number• arch – The architecture being worked with, as either a string name or an archinfo.Arch• abi_list – A list of ABI names that could be used
Returns
A bool of whether or not an implementation of the syscall is available
has_prototype(abi, name)
Check if a function has a prototype associated with it. Demangle the function name if it is a mangled C++
name.
Parameters• abi (str) – Name of the ABI.
• name (str) – The syscall name.
Return typebool
Returnsboolangr.procedures.definitions.load_type_collections(skip=None)
Return type
Noneangr.procedures.definitions.load_win32_type_collections()
Return type
Noneangr.procedures.definitions.load_external_definitions()
Loadlibrarydefinitions
fromspecific
directories.
By
defaultitparses
ANGR_EXTERNAL_DEFINITIONS_DIRS as a semicolon separated list of directory paths. Then it loads all.py files in each directory. These .py files should declare SimLibrary() objects and call .set_library_names() toregister themselves in angr.SIM_LIBRARIES.
angr.procedures.definitions.load_win32api_definitions()
angr.procedures.definitions.load_all_definitions()

10.12 Calling Conventions and Types
class angr.calling_conventions.PointerWrapper(value, buffer=False)
Bases: object__init__(value, buffer=False)class angr.calling_conventions.AllocHelper(ptrsize)
Bases: object

10.12. Calling Conventions and Types

613

angr

__init__(ptrsize)
alloc(size)
dump(val, state, loc=None)translate(val, base)apply(state, base)size()
classmethod calc_size(val, arch)classmethod stack_loc(val, arch, offset=0)
angr.calling_conventions.refine_locs_with_struct_type(arch, locs, arg_type, offset=0,
treat_bot_as_int=True)
Parameters• arch (Arch )• locs (list)• arg_type (SimType)• offset (int)class angr.calling_conventions.SerializableIterator
Bases: object
getstate()
setstate(state)class angr.calling_conventions.SerializableListIterator(lst)
Bases: SerializableIterator__init__(lst)
getstate()
setstate(state)class angr.calling_conventions.SerializableCounter(start, stride, mapping=<function
SerializableCounter.<lambda>>)Bases: SerializableIterator__init__(start, stride, mapping=<function SerializableCounter.<lambda>>)getstate()
setstate(state)class angr.calling_conventions.SimFunctionArgument(size, is_fp=False)
Bases: object
Represent a generic function argument.
Variables• size (int) – The size of the argument, in number of bytes.
614

Chapter 10. API Referenceangr• is_fp (bool) – Whether loads from this location should return a floating point bitvector__init__(size, is_fp=False)
check_value_set(value, arch)
check_value_get(value)
set_value(state, value, **kwargs)
get_value(state, **kwargs)
refine(size, arch=None, offset=None, is_fp=None)
get_footprint()
Return a list of SimRegArg and SimStackArgs that are the base components used for this location
Return type
Iterable[SimRegArg | SimStackArg]
class angr.calling_conventions.SimRegArg(reg_name, size, reg_offset=0, is_fp=False,
clear_entire_reg=False)
Bases: SimFunctionArgument
Represents a function argument that has been passed in a register.
Variables• reg_name (string) – The name of the represented register.
• size (int) – The size of the data to store, in number of bytes.
• reg_offset – The offset into the register to start storing data.
• clear_entire_reg – Whether a store to this register should zero the unused parts of theregister.
• is_fp (bool) – Whether loads from this location should return a floating point bitvector
Parameters• reg_name (RegisterName)• size (int)__init__(reg_name, size, reg_offset=0, is_fp=False, clear_entire_reg=False)
Parameters• reg_name (str)• size (int)get_footprint()
Return a list of SimRegArg and SimStackArgs that are the base components used for this location
check_offset(arch)
set_value(state, value, **kwargs)
get_value(state, **kwargs)
refine(size, arch=None, offset=None, is_fp=None)

10.12. Calling Conventions and Types

615

angr

sse_extend()class angr.calling_conventions.SimStackArg(stack_offset, size, is_fp=False)
Bases: SimFunctionArgument
Represents a function argument that has been passed on the stack.
Variables• stack_offset (int) – The position of the argument relative to the stack pointer after thefunction prelude.
• size (int) – The size of the argument, in number of bytes.
• is_fp (bool) – Whether loads from this location should return a floating point bitvector
Parameters• stack_offset (int)• size (int)• is_fp (bool)__init__(stack_offset, size, is_fp=False)
Parameters• stack_offset (int)• size (int)• is_fp (bool)
get_footprint()
Return a list of SimRegArg and SimStackArgs that are the base components used for this location
set_value(state, value, stack_base=None, **kwargs)
get_value(state, stack_base=None, **kwargs)
refine(size, arch=None, offset=None, is_fp=None)class angr.calling_conventions.SimComboArg(locations, is_fp=False)
Bases: SimFunctionArgument
An argument which spans multiple storage locations. Locations should be given least-significant first.
__init__(locations, is_fp=False)
get_footprint()
Return a list of SimRegArg and SimStackArgs that are the base components used for this location
set_value(state, value, **kwargs)
get_value(state, **kwargs)
class angr.calling_conventions.SimStructArg(struct, locs)
Bases: SimFunctionArgument
An argument which de/serializes a struct from a list of storage locations
Variables• struct – The simtype describing the structure

616

Chapter 10. API Referenceangr• locs – The storage locations to use
Parameters• struct (SimStruct)• locs (dict[str, SimFunctionArgument])__init__(struct, locs)
Parameters• struct (SimStruct)• locs (dict[str, SimFunctionArgument])
get_footprint()
Return a list of SimRegArg and SimStackArgs that are the base components used for this location
get_value(state, **kwargs)
set_value(state, value, **kwargs)
class angr.calling_conventions.SimArrayArg(locs)
Bases: SimFunctionArgument__init__(locs)
get_footprint()
Return a list of SimRegArg and SimStackArgs that are the base components used for this location
get_value(state, **kwargs)
set_value(state, value, **kwargs)
class angr.calling_conventions.SimReferenceArgument(ptr_loc, main_loc)
Bases: SimFunctionArgument
A function argument which is passed by reference.
Variables• ptr_loc – The location the reference’s pointer is stored• main_loc – A SimStackArgument describing how to load the argument’s value as if
it were stored at offset zero on the stack. It will be passed stack_base=ptr_loc.
get_value(state)__init__(ptr_loc, main_loc)
get_footprint()
Return a list of SimRegArg and SimStackArgs that are the base components used for this location
get_value(state, **kwargs)
set_value(state, value, **kwargs)
class angr.calling_conventions.ArgSession(cc)Bases: object
A class to keep track of the state accumulated in laying parameters out into memory__init__(cc)10.12. Calling Conventions and Types

617

angr

cc
fp_iter
int_iterboth_iter
getstate()
setstate(state)class angr.calling_conventions.UsercallArgSession(cc)Bases: object
An argsession for use with SimCCUsercall__init__(cc)ccreal_args
getstate()
setstate(state)class angr.calling_conventions.SimCC(arch)
Bases: object
A calling convention allows you to extract from a state the data passed from function to function by calls andreturns. Most of the methods provided by SimCC that operate on a state assume that the program is just after acall but just before stack frame allocation, though this may be overridden with the stack_base parameter to eachindividual method.
This is the base class for all calling conventions.
Parametersarch (archinfo.Arch )__init__(arch)
Parametersarch (Arch) – The Archinfo arch for this CC
ARG_REGS: list[str] = []FP_ARG_REGS: list[str] = []STACKARG_SP_BUFF = 0
STACKARG_SP_DIFF = 0
CALLER_SAVED_REGS: list[str] = []RETURN_ADDR: SimFunctionArgument = None
RETURN_VAL: SimFunctionArgument = None
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = None

618

Chapter 10. API Referenceangr

FP_RETURN_VAL: SimFunctionArgument | None = None
ARCH = None
CALLEE_CLEANUP = False
STACK_ALIGNMENT = 1
property int_args
Iterate through all the possible arg positions that can only be used to store integer or pointer values.
Returns an iterator of SimFunctionArguments
property memory_args
Iterate through all the possible arg positions that can be used to store any kind of argument.
Returns an iterator of SimFunctionArguments
property fp_args
Iterate through all the possible arg positions that can only be used to store floating point values.
Returns an iterator of SimFunctionArguments
is_fp_arg(arg)This should take a SimFunctionArgument instance and return whether or not that argument is a floatingpoint argument.
Returns True for MUST be a floating point arg,
False for MUST NOT be a floating point arg, None for when it can be either.
class ArgSession(cc)Bases: object
A class to keep track of the state accumulated in laying parameters out into memorycc
fp_iter
int_iterboth_iter__init__(cc)getstate()
setstate(state)arg_session(ret_ty)
Return an arg session.
A session provides the control interface necessary to describe how integral and floating-point arguments
are laid out into memory. The default behavior is that there are a finite list of int-only and fp-only argument
slots, and an infinite number of generic slots, and when an argument of a given type is requested, the mostslot available is used. If you need different behavior, subclass ArgSession.
You need to provide the return type of the function in order to kick off an arg layout session.
Parameters
ret_ty (SimType | None)

10.12. Calling Conventions and Types

619

angr

return_in_implicit_outparam(ty)stack_space(args)
Parametersargs – A list of SimFunctionArguments
Returns
The number of bytes that should be allocated on the stack to store all these args, NOT INCLUDING the return address.
return_val(ty, perspective_returned=False)
The location the return value is stored, based on its type.
property return_addr
The location the return address is stored.
next_arg(session, arg_type)
Parameters• session (ArgSession)• arg_type (SimType)static is_fp_value(val)static guess_prototype(args, prototype=None)
Come up with a plausible SimTypeFunction for the given args (as would be passed to e.g. setup_callsite).
You can pass a variadic function prototype in the base_type parameter and all its arguments will be used,
only guessing types for the variadic arguments.
arg_locs(prototype)
Return type
list[SimFunctionArgument]
get_args(state, prototype, stack_base=None)
set_return_val(state, val, ty, stack_base=None, perspective_returned=False)
setup_callsite(state, ret_addr, args, prototype, stack_base=None, alloc_base=None,
grow_like_stack=True)
This function performs the actions of the caller getting ready to jump into a function.
Parameters• state – The SimState to operate on• ret_addr – The address to return to when the called function finishes• args – The list of arguments that that the called function will see• prototype – The signature of the call you’re making. Should include variadic args concretely.
• stack_base – An optional pointer to use as the top of the stack, circa the function entry
point• alloc_base – An optional pointer to use as the place to put excess argument data
• grow_like_stack – When allocating data at alloc_base, whether to allocate at decreasing
addresses
620

Chapter 10. API Reference

angr

The idea here is that you can provide almost any kind of python type in args and it’ll be translated to abinary format to be placed into simulated memory. Lists (representing arrays) must be entirely elements ofthe same type and size, while tuples (representing structs) can be elements of any type and size. If you’d
like there to be a pointer to a given value, wrap the value in a PointerWrapper.
If stack_base is not provided, the current stack pointer will be used, and it will be updated. If alloc_base is
not provided, the stack base will be used and grow_like_stack will implicitly be True.
grow_like_stack controls the behavior of allocating data at alloc_base. When data from args needs tobe wrapped in a pointer, the pointer needs to point somewhere, so that data is dumped into memory at
alloc_base. If you set alloc_base to point to somewhere other than the stack, set grow_like_stack to False
so that sequential allocations happen at increasing addresses.
teardown_callsite(state, return_val=None, prototype=None, force_callee_cleanup=False)
This function performs the actions of the callee as it’s getting ready to return. It returns the address to returnto.
Parameters• state – The state to mutate• return_val – The value to return• prototype – The prototype of the given function• force_callee_cleanup – If we should clean up the stack allocation for the argumentseven if it’s not the callee’s job to do so
TODO: support the stack_base parameter from setup_callsite. . . ? Does that make sense in this context?
Maybe it could make sense by saying that you pass it in as something like the “saved base pointer” value?
static find_cc(arch, args, sp_delta, platform='Linux')
Pinpoint the best-fit calling convention and return the corresponding SimCC instance, or None if no fit isfound.
Parameters• arch (Arch) – An ArchX instance. Can be obtained from archinfo.
• args (list[SimFunctionArgument]) – A list of arguments. It may be updated by the
first matched calling convention to remove non-argument arguments.
• sp_delta (int) – The change of stack pointer before and after the call is made.
• platform (str)
Return type
SimCC | None
Returns
A calling convention instance, or None if none of the SimCC subclasses seems to fit thearguments provided.
get_arg_info(state, prototype)This is just a simple wrapper that collects the information from various locations prototype is as passed toself.arg_locs and self.get_args :param angr.SimState state: The state to evaluate and extract the values from:return: A list of tuples, where the nth tuple is (type, name, location, value) of the nth argumentclass angr.calling_conventions.SimLyingRegArg(name, size=8)
Bases: SimRegArg
A register that LIES about the types it holds

10.12. Calling Conventions and Types

621

angr

__init__(name, size=8)
get_value(state, **kwargs)
set_value(state, value, **kwargs)
refine(size, arch=None, offset=None, is_fp=None)class angr.calling_conventions.SimCCUsercall(arch, args, ret_loc)
Bases: SimCC__init__(arch, args, ret_loc)
Parametersarch – The Archinfo arch for this CC
ArgSession
alias of UsercallArgSession
next_arg(session, arg_type)return_val(ty, **kwargs)
The location the return value is stored, based on its type.
class angr.calling_conventions.SimCCCdecl(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = []FP_ARG_REGS: list[str] = []STACKARG_SP_DIFF = 4
CALLER_SAVED_REGS: list[str] = ['eax', 'ecx', 'edx']
RETURN_VAL: SimFunctionArgument = <eax>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <edx>
FP_RETURN_VAL: SimFunctionArgument | None = <st0>
RETURN_ADDR: SimFunctionArgument = [0x0]ARCHalias of ArchX86
next_arg(session, arg_type)
STRUCT_RETURN_THRESHOLD = 32
return_val(ty, perspective_returned=False)
The location the return value is stored, based on its type.
return_in_implicit_outparam(ty)622

Chapter 10. API Referenceangrclass angr.calling_conventions.SimCCMicrosoftCdecl(arch)
Bases: SimCCCdecl
Parametersarch (archinfo.Arch )STRUCT_RETURN_THRESHOLD = 64
class angr.calling_conventions.SimCCStdcall(arch)
Bases: SimCCMicrosoftCdecl
Parametersarch (archinfo.Arch )CALLEE_CLEANUP = Trueclass angr.calling_conventions.SimCCMicrosoftFastcall(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['ecx', 'edx']
STACKARG_SP_DIFF = 4
RETURN_VAL: SimFunctionArgument = <eax>
RETURN_ADDR: SimFunctionArgument = [0x0]ARCHalias of ArchX86
class angr.calling_conventions.MicrosoftAMD64ArgSession(cc)Bases: object__init__(cc)class angr.calling_conventions.SimCCMicrosoftAMD64(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['rcx', 'rdx', 'r8', 'r9']
FP_ARG_REGS: list[str] = ['xmm0', 'xmm1', 'xmm2', 'xmm3']
STACKARG_SP_DIFF = 8
STACKARG_SP_BUFF = 32
RETURN_VAL: SimFunctionArgument = <rax>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <rdx>
FP_RETURN_VAL: SimFunctionArgument | None = <xmm0>
RETURN_ADDR: SimFunctionArgument = [0x0]10.12. Calling Conventions and Types

623

angr

ARCH
alias of ArchAMD64
STACK_ALIGNMENT = 16
ArgSession
alias of MicrosoftAMD64ArgSession
STRUCT_RETURN_THRESHOLD = 64
next_arg(session, arg_type)return_in_implicit_outparam(ty)return_val(ty, perspective_returned=False)
The location the return value is stored, based on its type.
class angr.calling_conventions.SimCCSyscall(arch)
Bases: SimCC
The base class of all syscall CCs.
Parametersarch (archinfo.Arch )ERROR_REG: SimRegArg = None
SYSCALL_ERRNO_START = None
static syscall_num(state)
Return type
int
linux_syscall_update_error_reg(state, expr)
set_return_val(state, val, ty, **kwargs)
class angr.calling_conventions.SimCCX86LinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['ebx', 'ecx', 'edx', 'esi', 'edi', 'ebp']
FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <eax>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchX86
static syscall_num(state)class angr.calling_conventions.SimCCX86WindowsSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )624

Chapter 10. API Referenceangr

ARG_REGS: list[str] = []FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <eax>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchX86
static syscall_num(state)class angr.calling_conventions.SimCCSystemVAMD64(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['rdi', 'rsi', 'rdx', 'rcx', 'r8', 'r9']
FP_ARG_REGS: list[str] = ['xmm0', 'xmm1', 'xmm2', 'xmm3', 'xmm4', 'xmm5', 'xmm6','xmm7']STACKARG_SP_DIFF = 8
CALLER_SAVED_REGS: list[str] = ['rdi', 'rsi', 'rdx', 'rcx', 'r8', 'r9', 'r10','r11', 'rax']
RETURN_ADDR: SimFunctionArgument = [0x0]
RETURN_VAL: SimFunctionArgument = <rax>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <rdx>
FP_RETURN_VAL: SimFunctionArgument | None = <xmm0>
OVERFLOW_FP_RETURN_VAL = <xmm1>
ARCH
alias of ArchAMD64
STACK_ALIGNMENT = 16
next_arg(session, arg_type)return_val(ty, perspective_returned=False)
The location the return value is stored, based on its type.
Parametersty (SimType | None)
return_in_implicit_outparam(ty)class angr.calling_conventions.SimCCAMD64LinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )10.12. Calling Conventions and Types

625

angr

ARG_REGS: list[str] = ['rdi', 'rsi', 'rdx', 'r10', 'r8', 'r9']
RETURN_VAL: SimFunctionArgument = <rax>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchAMD64
CALLER_SAVED_REGS: list[str] = ['rax', 'rcx', 'r11']
static syscall_num(state)class angr.calling_conventions.SimCCAMD64WindowsSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = []FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <rax>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchAMD64
static syscall_num(state)class angr.calling_conventions.SimCCARM(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r0', 'r1', 'r2', 'r3']
FP_ARG_REGS: list[str] = []CALLER_SAVED_REGS: list[str] = []RETURN_ADDR: SimFunctionArgument = <lr>
RETURN_VAL: SimFunctionArgument = <r0>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <r1>
ARCH
alias of ArchARM
next_arg(session, arg_type)class angr.calling_conventions.SimCCARMHF(arch)
Bases: SimCCARM
Parametersarch (archinfo.Arch )626

Chapter 10. API Referenceangr

ARG_REGS: list[str] = ['r0', 'r1', 'r2', 'r3']
FP_ARG_REGS: list[str] = ['s0', 's1', 's2', 's3', 's4', 's5', 's6', 's7', 's8','s9', 's10', 's11', 's12', 's13', 's14', 's15']
FP_RETURN_VAL: SimFunctionArgument | None = <s0>
CALLER_SAVED_REGS: list[str] = []RETURN_ADDR: SimFunctionArgument = <lr>
RETURN_VAL: SimFunctionArgument = <r0>
ARCH
alias of ArchARMHF
class angr.calling_conventions.SimCCARMLinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r0', 'r1', 'r2', 'r3']
FP_ARG_REGS: list[str] = []RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
RETURN_VAL: SimFunctionArgument = <r0>
ARCH
alias of ArchARM
static syscall_num(state)class angr.calling_conventions.SimCCAArch64(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7']
FP_ARG_REGS: list[str] = []RETURN_ADDR: SimFunctionArgument = <lr>
RETURN_VAL: SimFunctionArgument = <x0>
ARCH
alias of ArchAArch64
class angr.calling_conventions.SimCCAArch64LinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['x0', 'x1', 'x2', 'x3', 'x4', 'x5', 'x6', 'x7']

10.12. Calling Conventions and Types

627

angr

FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <x0>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchAArch64
static syscall_num(state)class angr.calling_conventions.SimCCRISCV64LinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7']
FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <a0>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchRISCV64
static syscall_num(state)class angr.calling_conventions.SimCCO32(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3']
FP_ARG_REGS: list[str] = ['f12', 'f13', 'f14', 'f15']
STACKARG_SP_BUFF = 16
CALLER_SAVED_REGS: list[str] = ['t9', 'gp']
RETURN_ADDR: SimFunctionArgument = <ra>
RETURN_VAL: SimFunctionArgument = <v0>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <v1>
ARCH
alias of ArchMIPS32
next_arg(session, arg_type)class angr.calling_conventions.SimCCO32LinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )628

Chapter 10. API Referenceangr

ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3']
FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <v0>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchMIPS32
ERROR_REG: SimRegArg = <a3>
SYSCALL_ERRNO_START = -1133
static syscall_num(state)class angr.calling_conventions.SimCCN64(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7']
CALLER_SAVED_REGS: list[str] = ['t9', 'gp']
FP_ARG_REGS: list[str] = []STACKARG_SP_BUFF = 32
RETURN_ADDR: SimFunctionArgument = <ra>
RETURN_VAL: SimFunctionArgument = <v0>
ARCH
alias of ArchMIPS64
angr.calling_conventions.SimCCO64
alias of SimCCN64
class angr.calling_conventions.SimCCN64LinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['a0', 'a1', 'a2', 'a3', 'a4', 'a5', 'a6', 'a7']
FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <v0>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchMIPS64
ERROR_REG: SimRegArg = <a3>

10.12. Calling Conventions and Types

629

angr

SYSCALL_ERRNO_START = -1133
static syscall_num(state)class angr.calling_conventions.SimCCPowerPC(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = []STACKARG_SP_BUFF = 8
RETURN_ADDR: SimFunctionArgument = <lr>
RETURN_VAL: SimFunctionArgument = <r3>
OVERFLOW_RETURN_VAL: SimFunctionArgument | None = <r4>
ARCH
alias of ArchPPC32
class angr.calling_conventions.SimCCPowerPCLinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <r3>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchPPC32
ERROR_REG: SimRegArg = <cr0_0>
SYSCALL_ERRNO_START = -515
static syscall_num(state)class angr.calling_conventions.SimCCPowerPC64(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = []STACKARG_SP_BUFF = 112
RETURN_ADDR: SimFunctionArgument = <lr>630

Chapter 10. API Reference

angr

RETURN_VAL: SimFunctionArgument = <r3>
ARCHalias of ArchPPC64
class angr.calling_conventions.SimCCPowerPC64LinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9', 'r10']
FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <r3>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>
ARCH
alias of ArchPPC64
ERROR_REG: SimRegArg = <cr0_0>
SYSCALL_ERRNO_START = -515
static syscall_num(state)class angr.calling_conventions.SimCCSoot(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARCHalias of ArchSoot
ARG_REGS: list[str] = []setup_callsite(state, ret_addr, args, prototype, stack_base=None, alloc_base=None,
grow_like_stack=True)
This function performs the actions of the caller getting ready to jump into a function.
Parameters• state – The SimState to operate on• ret_addr – The address to return to when the called function finishes• args – The list of arguments that that the called function will see• prototype – The signature of the call you’re making. Should include variadic args concretely.
• stack_base – An optional pointer to use as the top of the stack, circa the function entry
point• alloc_base – An optional pointer to use as the place to put excess argument data
• grow_like_stack – When allocating data at alloc_base, whether to allocate at decreasing
addresses

10.12. Calling Conventions and Types

631

angr

The idea here is that you can provide almost any kind of python type in args and it’ll be translated to abinary format to be placed into simulated memory. Lists (representing arrays) must be entirely elements ofthe same type and size, while tuples (representing structs) can be elements of any type and size. If you’d
like there to be a pointer to a given value, wrap the value in a PointerWrapper.
If stack_base is not provided, the current stack pointer will be used, and it will be updated. If alloc_base is
not provided, the stack base will be used and grow_like_stack will implicitly be True.
grow_like_stack controls the behavior of allocating data at alloc_base. When data from args needs tobe wrapped in a pointer, the pointer needs to point somewhere, so that data is dumped into memory at
alloc_base. If you set alloc_base to point to somewhere other than the stack, set grow_like_stack to False
so that sequential allocations happen at increasing addresses.
static guess_prototype(args, prototype=None)
Come up with a plausible SimTypeFunction for the given args (as would be passed to e.g. setup_callsite).
You can pass a variadic function prototype in the base_type parameter and all its arguments will be used,
only guessing types for the variadic arguments.
class angr.calling_conventions.SimCCUnknown(arch)
Bases: SimCC
Represent an unknown calling convention.
Parametersarch (archinfo.Arch )class angr.calling_conventions.SimCCS390X(arch)
Bases: SimCC
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r2', 'r3', 'r4', 'r5', 'r6']
FP_ARG_REGS: list[str] = ['f0', 'f2', 'f4', 'f6']
STACKARG_SP_BUFF = 160
RETURN_ADDR: SimFunctionArgument = <r14>
RETURN_VAL: SimFunctionArgument = <r2>
ARCH
alias of ArchS390X
class angr.calling_conventions.SimCCS390XLinuxSyscall(arch)
Bases: SimCCSyscall
Parametersarch (archinfo.Arch )ARG_REGS: list[str] = ['r2', 'r3', 'r4', 'r5', 'r6', 'r7']
FP_ARG_REGS: list[str] = []RETURN_VAL: SimFunctionArgument = <r2>
RETURN_ADDR: SimFunctionArgument = <ip_at_syscall>

632

Chapter 10. API Reference

angr

ARCH
alias of ArchS390X
static syscall_num(state)angr.calling_conventions.register_default_cc(arch, cc, platform='Linux')
Parameters• arch (str)• cc (type[SimCC])• platform (str)angr.calling_conventions.default_cc(arch, platform='Linux', language=None, syscall=False, **kwargs)
Return the default calling convention for a given architecture, platform, and language combination.
Parameters• arch (str) – The architecture name.
• platform (str | None) – The platform name (e.g., “Linux” or “Win32”).
• language (Optional[str]) – The programming language name (e.g., “go”).
• syscall (bool) – Return syscall convention (True), or normal calling convention (False,
default).
Return type
type[SimCC] | None
Returns
A default calling convention class if we can find one for the architecture, platform, and language
combination, or None if nothing fits.
angr.calling_conventions.unify_arch_name(arch)
Return the unified architecture name.
Parametersarch (str) – The architecture name.
Return type
str
Returns
A unified architecture name.
angr.calling_conventions.register_syscall_cc(arch, os, cc)class angr.sim_variable.SimVariable(ident=None, name=None, region=None, category=None, size=None)
Bases: Serializable
Parameters• region (int | None)• size (int | None)__init__(ident=None, name=None, region=None, category=None, size=None)
Parameters• ident – A unique identifier provided by user or the program. Usually a string.
• name (str) – Name of this variable.
10.12. Calling Conventions and Types

633

angr

• region (int | None)• size (int | None)
ident
name
region:int | None

category:

str | Nonerenamedcandidate_namessize
copy()
loc_repr(arch)
The representation that shows up in a GUI
Parametersarch (Arch )property is_function_argumentclass angr.sim_variable.SimConstantVariable(ident=None, value=None, region=None, size=None)
Bases: SimVariable
Parameters
region (int | None)__init__(ident=None, value=None, region=None, size=None)
Parameters• ident – A unique identifier provided by user or the program. Usually a string.
• name (str) – Name of this variable.
value
loc_repr(arch)
The representation that shows up in a GUI
copy()
Return type
SimConstantVariableclass angr.sim_variable.SimTemporaryVariable(tmp_id, size=None)
Bases: SimVariable__init__(tmp_id, size=None)
Parameters• ident – A unique identifier provided by user or the program. Usually a string.
• name (str) – Name of this variable.

634

Chapter 10. API Referenceangr

tmp_idloc_repr(arch)
The representation that shows up in a GUI
copy()
Return type
SimTemporaryVariable
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
class angr.sim_variable.SimRegisterVariable(reg_offset, size, ident=None, name=None, region=None,
category=None)
Bases: SimVariable
Parameters• region (int | None)• category (str | None)__init__(reg_offset, size, ident=None, name=None, region=None, category=None)
Parameters• ident – A unique identifier provided by user or the program. Usually a string.
• name (str) – Name of this variable.
reg:

int

property bits
loc_repr(arch)
The representation that shows up in a GUI
copy()
Return type
SimRegisterVariable

10.12. Calling Conventions and Types

635

angr

serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
class angr.sim_variable.SimMemoryVariable(addr, size, ident=None, name=None, region=None,
category=None)
Bases: SimVariable
Parameters• region (int | None)• category (str | None)__init__(addr, size, ident=None, name=None, region=None, category=None)
Parameters• ident – A unique identifier provided by user or the program. Usually a string.
• name (str) – Name of this variable.
addr
loc_repr(arch)
The representation that shows up in a GUI
property bits
copy()
Return type
SimMemoryVariable
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage

636

Chapter 10. API Referenceangrclassmethod parse_from_cmessage(cmsg, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
class angr.sim_variable.SimStackVariable(offset, size, base='sp', base_addr=None, ident=None,
name=None, region=None, category=None)
Bases: SimMemoryVariable
Parameters• region (int | None)• category (str | None)__init__(offset, size, base='sp', base_addr=None, ident=None, name=None, region=None, category=None)
Parameters• ident – A unique identifier provided by user or the program. Usually a string.
• name (str) – Name of this variable.
baseoffsetbase_addr
loc_repr(arch)
The representation that shows up in a GUI
copy()
Return type
SimStackVariable
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
10.12. Calling Conventions and Types

637

angr

class angr.sim_variable.SimVariableSet
Bases: MutableSet
A collection of SimVariables.
__init__()add(item)
Add an element.
add_register_variable(reg_var)
add_memory_variable(mem_var)
discard(item)
Remove an element. Do not raise an exception if absent.
discard_register_variable(reg_var)
discard_memory_variable(mem_var)
add_memory_variables(addrs, size)copy()
complement(other)
Calculate the complement of self and other.
Parameters
other – Another SimVariableSet instance.
Returns
The complement result.
contains_register_variable(reg_var)
contains_memory_variable(mem_var)
class angr.sim_type.SimType(label=None)
Bases: object
SimType exists to track type information for SimProcedures.
base:bool = True__init__(label=None)
Parameterslabel – the type label.
property size:

int | None

The size of the type in bits, or None if no size is computable.
property alignment
The alignment of the type in bytes.
with_arch(arch)
Parametersarch (Arch | None)

638

Chapter 10. API Referenceangrc_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters• indent (int | None)• name_parens (bool)
copy()
extract(state, addr, concrete=False)
Return type
Any
Parameters• state (SimState)• concrete (bool)
store(state, addr, value)
Parameters• state (SimState)• value (Any)extract_claripy(bits)
Given a bitvector bits which was loaded from memory in a big-endian fashion, return a more appropriate
or structured representation of the data.
A type must have an arch associated in order to use this method.
Return type
Anyclass angr.sim_type.TypeRef(name, ty)
Bases: SimType
A TypeRef is a reference to a type with a name. This allows for interactivity in type analysis, by storing a typeand having the option to update it later and have all references to it automatically update as well.
__init__(name, ty)Parameterslabel – the type label.
property typeproperty name
This is a read-only property because it is desirable to store typerefs in a mapping from name to type, andwe want the mapping to be in the loop for any updates.
property size
The size of the type in bits, or None if no size is computable.
property alignment
The alignment of the type in bytes.
with_arch(arch)

10.12. Calling Conventions and Types

639

angr

c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)
copy()
class angr.sim_type.NamedTypeMixin(*args, name=None, **kwargs)
Bases: object
SimType classes with this mixin in the class hierarchy allows setting custom class names. A typical use
case is to represent same or similar type classes with different qualified names, such as “std::basic_string” vs“std::__cxx11::basic_string”. In such cases, .name stores the qualified name, and .unqualified_name() returns
the unqualified name of the type.
Parametersname (str | None)__init__(*args, name=None, **kwargs)
Parametersname (str | None)
property name:str

unqualified_name(lang='c++')Return typestr
Parameters
lang (str)class angr.sim_type.SimTypeBottom(label=None)
Bases: SimType
SimTypeBottom basically represents a type error.
c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)
copy()
class angr.sim_type.SimTypeTop(size=None, label=None)
Bases: SimType
SimTypeTop represents any type (mostly used with a pointer for void*).
Parameters
size (int | None)__init__(size=None, label=None)
Parameters• label – the type label.
• size (int | None)copy()

640

Chapter 10. API Referenceangrclass angr.sim_type.SimTypeReg(size, label=None)
Bases: SimType
SimTypeReg is the base type for all types that are register-sized.
Parameters
size (int | None)__init__(size, label=None)
Parameters• label – the type label.
• size (int | None) – the size of the type (e.g. 32bit, 8bit, etc.).
store(state, addr, value)
Parameters
value (StoreType)copy()
class angr.sim_type.SimTypeNum(size, signed=True, label=None)
Bases: SimType
SimTypeNum is a numeric type of arbitrary length
Parameters
size (int)__init__(size, signed=True, label=None)
Parameters• size (int) – The size of the integer, in bits
• signed – Whether the integer is signed or not• label – A label for the typeproperty size: int
The size of the type in bits, or None if no size is computable.
extract(state, addr, concrete=False)store(state, addr, value)
Parameters
value (StoreType)copy()
class angr.sim_type.SimTypeInt(signed=True, label=None)
Bases: SimTypeReg
SimTypeInt is a type that specifies a signed or unsigned C integer.
__init__(signed=True, label=None)
Parameters• signed – True if signed, False if unsigned• label – The type label

10.12. Calling Conventions and Types

641

angr

c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)property size
The size of the type in bits, or None if no size is computable.
extract(state, addr, concrete=False)
copy()
class angr.sim_type.SimTypeShort(signed=True, label=None)
Bases: SimTypeInt
class angr.sim_type.SimTypeLong(signed=True, label=None)
Bases: SimTypeInt
class angr.sim_type.SimTypeLongLong(signed=True, label=None)
Bases: SimTypeInt
class angr.sim_type.SimTypeFixedSizeInt(signed=True, label=None)
Bases: SimTypeInt
The base class for all fixed-size (i.e., the size stays the same on all platforms) integer types. Do not instantiate
this class directly.
c_repr(name=None, full=0, memo=None, indent=0)
property size: int
The size of the type in bits, or None if no size is computable.
class angr.sim_type.SimTypeInt128(signed=True, label=None)
Bases: SimTypeFixedSizeInt
class angr.sim_type.SimTypeInt256(signed=True, label=None)
Bases: SimTypeFixedSizeInt
class angr.sim_type.SimTypeChar(signed=True, label=None)
Bases: SimTypeReg
SimTypeChar is a type that specifies a character; this could be represented by a byte, but this is meant to beinterpreted as a character.
__init__(signed=True, label=None)
Parameterslabel – the type label.
store(state, addr, value)
Parameters
value (StoreType)extract(state, addr, concrete=False)
Return type
BV | bytes
Parametersconcrete (bool)

642

Chapter 10. API Referenceangrcopy()
class angr.sim_type.SimTypeWideChar(signed=True, label=None)
Bases: SimTypeReg
SimTypeWideChar is a type that specifies a wide character (a UTF-16 character).
__init__(signed=True, label=None)
Parameterslabel – the type label.
store(state, addr, value)
Parameters
value (StoreType)extract(state, addr, concrete=False)
Return typeAny
copy()
class angr.sim_type.SimTypeBool(signed=True, label=None)
Bases: SimTypeReg__init__(signed=True, label=None)
Parameterslabel – the type label.
store(state, addr, value)
Parameters
value (StoreType | bool)
extract(state, addr, concrete=False)
copy()
class angr.sim_type.SimTypeFd(label=None)
Bases: SimTypeReg
SimTypeFd is a type that specifies a file descriptor.
__init__(label=None)
Parameterslabel – the type label
property size
The size of the type in bits, or None if no size is computable.
copy()
extract(state, addr, concrete=False)class angr.sim_type.SimTypePointer(pts_to, label=None, offset=0)
Bases: SimTypeReg
SimTypePointer is a type that specifies a pointer to some other type.

10.12. Calling Conventions and Types

643

angr

__init__(pts_to, label=None, offset=0)
Parameters• label – The type label.
• pts_to – The type to which this pointer points.
c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)make(pts_to)property size
The size of the type in bits, or None if no size is computable.
copy()
extract(state, addr, concrete=False)class angr.sim_type.SimTypeReference(refs, label=None)
Bases: SimTypeReg
SimTypeReference is a type that specifies a reference to some other type.
__init__(refs, label=None)
Parameters• label – the type label.
• size – the size of the type (e.g. 32bit, 8bit, etc.).
c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)make(refs)
property size
The size of the type in bits, or None if no size is computable.
copy()
extract(state, addr, concrete=False)class angr.sim_type.SimTypeArray(elem_type, length=None, label=None)
Bases: SimType
SimTypeArray is a type that specifies a series of data laid out in sequence.
__init__(elem_type, length=None, label=None)
Parameters• label – The type label.
• elem_type – The type of each element in the array.
• length – An expression of the length of the array, if known.

644

Chapter 10. API Referenceangrc_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)property size
The size of the type in bits, or None if no size is computable.
property alignment
The alignment of the type in bytes.
copy()
extract(state, addr, concrete=False)store(state, addr, value)
Parameters
value (list[StoreType])
angr.sim_type.SimTypeFixedSizeArray
alias of SimTypeArrayclass angr.sim_type.SimTypeString(length=None, label=None, name=None)
Bases: NamedTypeMixin, SimType
SimTypeString is a type that represents a C-style string, i.e. a NUL-terminated array of bytes.
Parameters• length (int | None)• name (str | None)__init__(length=None, label=None, name=None)
Parameters• label – The type label.
• length (Optional[int]) – An expression of the length of the string, if known.
• name (str | None)c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)
extract(state, addr, concrete=False)
Parametersstate (SimState)property size
The size of the type in bits, or None if no size is computable.
property alignment
The alignment of the type in bytes.
copy()

10.12. Calling Conventions and Types

645

angr

class angr.sim_type.SimTypeWString(length=None, label=None, name=None)
Bases: NamedTypeMixin, SimType
A wide-character null-terminated string, where each character is 2 bytes.
Parameters• length (int | None)• name (str | None)__init__(length=None, label=None, name=None)
Parameters• label – the type label.
• length (int | None)• name (str | None)c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)
extract(state, addr, concrete=False)store(state, addr, value)
property size
The size of the type in bits, or None if no size is computable.
property alignment
The alignment of the type in bytes.
copy()
class angr.sim_type.SimTypeFunction(args, returnty, label=None, arg_names=None, variadic=False)
Bases: SimType
SimTypeFunction is a type that specifies an actual function (i.e. not a pointer) with certain types of arguments
and a certain return value.
Parameters• args (Iterable[SimType])• returnty (SimType | None)• arg_names (Iterable[str] | None)base:bool = False__init__(args, returnty, label=None, arg_names=None, variadic=False)
Parameters• label – The type label• args (Iterable[SimType]) – A tuple of types representing the arguments to the function• returnty (SimType | None) – The return type of the function, or none for void• variadic – Whether the function accepts varargs

646

Chapter 10. API Referenceangr• arg_names (Iterable[str] | None)c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)property size
The size of the type in bits, or None if no size is computable.
copy()
class angr.sim_type.SimTypeCppFunction(args, returnty, label=None, arg_names=None, ctor=False,
dtor=False)
Bases: SimTypeFunction
SimTypeCppFunction is a type that specifies an actual C++-style function with information about arguments,
return value, and more C++-specific properties.
Variables• ctor – Whether the function is a constructor or not.
• dtor – Whether the function is a destructor or not.
Parameters• args (tuple[SimType, ...])• returnty (SimType | None)• arg_names (Iterable[str] | None)• ctor (bool)• dtor (bool)__init__(args, returnty, label=None, arg_names=None, ctor=False, dtor=False)
Parameters• label – The type label• args – A tuple of types representing the arguments to the function• returnty – The return type of the function, or none for void• variadic – Whether the function accepts varargs• arg_names (Iterable[str] | None)• ctor (bool)• dtor (bool)
copy()
class angr.sim_type.SimTypeLength(signed=False, addr=None, length=None, label=None)
Bases: SimTypeLong
SimTypeLength is a type that specifies the length of some buffer in memory.
. . . I’m not really sure what the original design of this class was going for10.12. Calling Conventions and Types

647

angr

__init__(signed=False, addr=None, length=None, label=None)
Parameters• signed – Whether the value is signed or not• label – The type label.
• addr – The memory address (expression).
• length – The length (expression).
property size
The size of the type in bits, or None if no size is computable.
copy()
class angr.sim_type.SimTypeFloat(size=32)
Bases: SimTypeReg
An IEEE754 single-precision floating point number__init__(size=32)
Parameters• label – the type label.
• size – the size of the type (e.g. 32bit, 8bit, etc.).
sort = FLOAT
signed = True
property size:

int

The size of the type in bits, or None if no size is computable.
extract(state, addr, concrete=False)store(state, addr, value)
Parameters
value (StoreType | claripy.ast.FP)
copy()
class angr.sim_type.SimTypeDouble(align_double=True)
Bases: SimTypeFloat
An IEEE754 double-precision floating point number__init__(align_double=True)
Parameters• label – the type label.
• size – the size of the type (e.g. 32bit, 8bit, etc.).
sort = DOUBLE
property size:

int

The size of the type in bits, or None if no size is computable.

648

Chapter 10. API Referenceangrproperty alignment
The alignment of the type in bytes.
copy()
class angr.sim_type.SimStruct(fields, name=None, pack=False, align=None, anonymous=False)
Bases: NamedTypeMixin, SimType
Parameters• fields (dict[str, SimType] | OrderedDict[str, SimType])• anonymous (bool)__init__(fields, name=None, pack=False, align=None, anonymous=False)
Parameters• label – the type label.
• fields (dict[str, SimType] | OrderedDict[str, SimType])• anonymous (bool)property packed
property offsets:

dict[str, int]

extract(state, addr, concrete=False)
Return type
SimStructValuec_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)property size
The size of the type in bits, or None if no size is computable.
property alignment
The alignment of the type in bytes.
store(state, addr, value)
Parameters
value (StoreType)copy()
class angr.sim_type.SimStructValue(struct, values=None)
Bases: object
A SimStruct type paired with some real values__init__(struct, values=None)
Parameters• struct – A SimStruct instance describing the type of this struct• values – A mapping from struct fields to values

10.12. Calling Conventions and Types

649

angr

property structcopy()
class angr.sim_type.SimUnion(members, name=None, label=None)
Bases: NamedTypeMixin, SimTypefields = ('members', 'name')__init__(members, name=None, label=None)
Parameters• members – The members of the union, as a mapping name -> type• name – The name of the union
property size
The size of the type in bits, or None if no size is computable.
property alignment
The alignment of the type in bytes.
extract(state, addr, concrete=False)
c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Parameters
name_parens (bool)
copy()
class angr.sim_type.SimUnionValue(union, values=None)
Bases: object
A SimStruct type paired with some real values__init__(union, values=None)
Parameters• union – A SimUnion instance describing the type of this union• values – A mapping from union members to values
copy()
class angr.sim_type.SimCppClass(members=None, function_members=None, vtable_ptrs=None,
name=None, pack=False, align=None)
Bases: SimStruct
Parameters• members (dict[str, SimType] | None)• function_members (dict[str, SimTypeCppFunction] | None)• name (str | None)• pack (bool)

650

Chapter 10. API Referenceangr__init__(members=None, function_members=None, vtable_ptrs=None, name=None, pack=False,align=None)
Parameters• label – the type label.
• members (dict[str, SimType] | None)• function_members (dict[str, SimTypeCppFunction] | None)• name (str | None)• pack (bool)property members
extract(state, addr, concrete=False)
Return type
SimCppClassValue
store(state, addr, value)
Parameters
value (StoreType)copy()
class angr.sim_type.SimCppClassValue(class_type, values)
Bases: SimStructValue
A SimCppClass type paired with some real values
Parametersclass_type (SimCppClass)__init__(class_type, values)
Parameters• struct – A SimStruct instance describing the type of this struct• values – A mapping from struct fields to values• class_type (SimCppClass)copy()
class angr.sim_type.SimTypeNumOffset(size, signed=True, label=None, offset=0)
Bases: SimTypeNum
like SimTypeNum, but supports an offset of 1 to 7 to a byte aligned address to allow structs with bitfields__init__(size, signed=True, label=None, offset=0)
Parameters• size – The size of the integer, in bits
• signed – Whether the integer is signed or not• label – A label for the type10.12. Calling Conventions and Types

651

angr

extract(state, addr, concrete=False)
Parametersstate (SimState)store(state, addr, value)
copy()
class angr.sim_type.SimTypeRef(name, original_type)
Bases: SimType
SimTypeRef is a to-be-resolved reference to another SimType.
SimTypeRef is not SimTypeReference.
Parameters
original_type (type[SimStruct])__init__(name, original_type)
Parameters• label – the type label.
• original_type (type[SimStruct])
property name:str | None

set_size(v)Parametersv (int)c_repr(name=None, full=0, memo=None, indent=0, name_parens=True)
Return typestr
Parameters
name_parens (bool)
angr.sim_type.register_types(types)
Pass in some types and they will be registered to the global type store.
The argument may be either a mapping from name to SimType, or a plain SimType. The plain SimType must beeither a struct or union type with a name present.
>>> register_types(parse_types("typedef int x; typedef float y;"))>>> register_types(parse_type("struct abcd { int ab; float cd; }"))
angr.sim_type.do_preprocess(defn, include_path=())
Run a string through the C preprocessor that ships with pycparser but is weirdly inaccessible?
angr.sim_type.parse_signature(defn, preprocess=True, predefined_types=None, arch=None)
Parse a single function prototype and return its typeangr.sim_type.parse_defns(defn, preprocess=True, predefined_types=None, arch=None)
Parse a series of C definitions, returns a mapping from variable name to variable type object
angr.sim_type.parse_types(defn, preprocess=True, predefined_types=None, arch=None)
Parse a series of C definitions, returns a mapping from type name to type object

652

Chapter 10. API Referenceangrangr.sim_type.parse_file(defn, preprocess=True, predefined_types=None, arch=None)
Parse a series of C definitions, returns a tuple of two type mappings, one for variable definitions and one for typedefinitions.
Parameters
predefined_types (dict[Any, SimType] | None)angr.sim_type.type_parser_singleton()
Return type
CParserangr.sim_type.parse_type(defn, preprocess=True, predefined_types=None, arch=None)
Parse a simple type expression into a SimType>>> parse_type('int *')angr.sim_type.parse_type_with_name(defn, preprocess=True, predefined_types=None, arch=None)
Parse a simple type expression into a SimType, returning a tuple of the type object and any associated name thatmight be found in the place a name would go in a type declaration.
>>> parse_type_with_name('int *foo')Parameters
predefined_types (dict[Any, SimType] | None)angr.sim_type.normalize_cpp_function_name(name)Return typestr
Parametersname (str)angr.sim_type.parse_cpp_file(cpp_decl, with_param_names=False)
Parameters
with_param_names (bool)
angr.sim_type.dereference_simtype(t, type_collections, memo=None)
Return type
SimTypeParameters• t (SimType)• type_collections (list[SimTypeCollection])• memo (dict[str, SimType] | None)class angr.callable.Callable(project, addr, prototype=None, concrete_only=False, perform_merge=True,
base_state=None, toc=None, cc=None, add_options=None,remove_options=None)
Bases: object
Callable is a representation of a function in the binary that can be interacted with like a native python function.
If you set perform_merge=True (the default), the result will be returned to you, and you can get the result statewith callable.result_state.
10.12. Calling Conventions and Types

653

angr

Otherwise, you can get the resulting simulation manager at callable.result_path_group.
__init__(project, addr, prototype=None, concrete_only=False, perform_merge=True, base_state=None,
toc=None, cc=None, add_options=None, remove_options=None)
Parameters• project – The project to operate on• addr – The address of the function to use
The following parameters are optional:
Parameters• prototype – The signature of the calls you would like to make. This really shouldn’t be
optional.
• concrete_only – Throw an exception if the execution splits into multiple paths• perform_merge – Merge all result states into one at the end (only relevant if concrete_only=False)• base_state – The state from which to do these runs
• toc – The address of the table of contents for ppc64• cc – The SimCC to use for a calling convention
set_base_state(state)
Swap out the state you’d like to use to perform the call :type state: :param state: The state to use to performthe callperform_call(*args, prototype=None)
call_c(c_args)
Call this Callable with a string of C-style arguments.
Parametersc_args (str) – C-style arguments.
Returns
The return value from the call.
Return typeclaripy.Ast

10.13 Knowledge Base
Representing the artifacts of a project.
class angr.knowledge_base.KnowledgeBase(project, obj=None, name=None)
Bases: object
Represents a “model” of knowledge about an artifact.
Contains things like a CFG, data references, etc.
functions:

FunctionManager

variables:

VariableManager

structured_code:654

StructuredCodeManager

Chapter 10. API Reference

angr

defs:

KeyDefinitionManager

cfgs:

CFGManager

types:

TypesStorepropagations:xrefs:

PropagationManager

XRefManager__init__(project, obj=None, name=None)
property callgraphproperty unresolved_indirect_jumps
property resolved_indirect_jumps
has_plugin(name)get_plugin(name)register_plugin(name, plugin)
release_plugin(name)
K = ~K
get_knowledge(requested_plugin_cls)
Type inference safe method to request a knowledge base plugin Explicitly passing the type of the requested
plugin achieves two things: 1. Every location using this plugin can be easily found with an IDE by searching
explicit references to the type 2. Basic type inference can deduce the result type and properly type checkusages of it
If there isn’t already an instance of this class None will be returned to make it clear to the caller that there
is no existing knowledge of this type yet. The code that initially creates this knowledge should use theregister_plugin method to register the initial knowledge state :type requested_plugin_cls: type[K] :param
requested_plugin_cls: :rtype: K | None :return: Instance of the requested plugin class or null if it is not a
known plugin
Parameters
requested_plugin_cls (type[K])Return type
K | None
request_knowledge(requested_plugin_cls)
Return typeK
Parameters
requested_plugin_cls (type[K])class angr.knowledge_plugins.FunctionManager(kb)Bases: KnowledgeBasePlugin, MappingThis is a function boundaries management tool. It takes in intermediate results during CFG generation, andmanages a function map of the binary.
__init__(kb)10.13. Knowledge Base

655

angr

copy()
clear()
get_by_addr(addr)
Return type
Function
get_by_name(name)Return type
Generator[Function]
Parametersname (str)contains_addr(addr)
Decide if an address is handled by the function manager.
Note: this function is non-conformant with python programming idioms, but its needed for performancereasons.
Parametersaddr (int) – Address of the function.
ceiling_func(addr)
Return the function who has the least address that is greater than or equal to addr.
Parametersaddr (int) – The address to query.
Returns
A Function instance, or None if there is no other function after addr.
Return type
Function or Nonefloor_func(addr)
Return the function who has the greatest address that is less than or equal to addr.
Parametersaddr (int) – The address to query.
Returns
A Function instance, or None if there is no other function before addr.
Return type
Function or Nonequery(query)
Query for a function using selectors to disambiguate. Supported variations: :rtype: Function | None::<name> Function <name> in the main object ::<addr>::<name> Function <name> at <addr>::<obj>::<name> Function <name> in <obj>
Parameters
query (str)
Return type
Function | None

656

Chapter 10. API Referenceangrfunction(addr=None, name=None, create=False, syscall=False, plt=None)
Get a function object from the function manager.
Pass either addr or name with the appropriate values.
Parameters• addr (int) – Address of the function.
• name (str) – Name of the function.
• create (bool) – Whether to create the function or not if the function does not exist.
• syscall (bool) – True to create the function as a syscall, False otherwise.
• plt (bool or None) – True to find the PLT stub, False to find a non-PLT stub, None todisable this restriction.
Returns
The Function instance, or None if the function is not found and create is False.
Return type
Function or Nonedbg_draw(prefix='dbg_function_')rebuild_callgraph()class angr.knowledge_plugins.Function(function_manager, addr, name=None, syscall=None,
is_simprocedure=None, binary_name=None, is_plt=None,
returning=None, alignment=False)
Bases: Serializable
A representation of a function and various information about it.
Parameters• is_simprocedure (bool | None)• is_plt (bool | None)__init__(function_manager, addr, name=None, syscall=None, is_simprocedure=None,binary_name=None, is_plt=None, returning=None, alignment=False)
Function constructor. If the optional parameters are not provided, they will be automatically determined
upon the creation of a Function object.
Parameters• addr – The address of the function.
• is_simprocedure (bool | None)• is_plt (bool | None)
The following parameters are optional.
Parameters• name (str) – The name of the function.
• syscall (bool) – Whether this function is a syscall or not.
• is_simprocedure (bool) – Whether this function is a SimProcedure or not.
• binary_name (str) – Name of the binary where this function is.
• is_plt (bool) – If this function is a PLT entry.
10.13. Knowledge Base

657

angr

• returning (bool) – If this function returns.
• alignment (bool) – If this function acts as an alignment filler. Such functions usually
only contain nops.
transition_graphnormalized
addr
startpoint
is_alignment
bp_on_stackretaddr_on_stack
sp_delta
prototype:

SimTypeFunction | None

prototype_libname:str | None

is_prototype_guessed:boolprepared_registers
prepared_stack_variables
registers_read_afterwards
info
tags
ran_cca
is_syscall
is_simprocedure
is_pltis_default_namefrom_signaturebinary_namecalling_convention:

SimCC | None

property alignment
property nameproperty projectproperty returning

658

Chapter 10. API Referenceangrproperty blocks
An iterator of all local blocks in the current function.
Returns
angr.lifter.Block instances.
property cyclomatic_complexity
The cyclomatic complexity of the function.
Cyclomatic complexity is a software metric used to indicate the complexity of a program. It is a quantitative
measure of the number of linearly independent paths through a program’s source code. It is computed using
the formula: M = E - N + 2P, where E = the number of edges in the graph, N = the number of nodes in thegraph, P = the number of connected components.
The cyclomatic complexity value is lazily computed and cached for future use. Initially this value is None
until it is computed for the first time
Returns
The cyclomatic complexity of the function.
Return typeint
property xrefs
An iterator of all xrefs of the current function.
Returns
angr.knowledge_plugins.xrefs.xref.XRef instances.
property block_addrs
An iterator of all local block addresses in the current function.
Returns
block addresses.
property block_addrs_set
Return a set of block addresses for a better performance of inclusion tests.
Returns
A set of block addresses.
Return type
set
get_block(addr, size=None, byte_string=None)
Getting a block out of the current function.
Parameters• addr (int) – The address of the block.
• size (int) – The size of the block. This is optional. If not provided, angr will load
• byte_string (Optional[bytes])
Returns
get_block_size(addr)
Return type
int | None

10.13. Knowledge Base

659

angr

Parametersaddr (int)property nodes:

Iterable[CodeNode]get_node(addr)
Return type
Blockproperty has_unresolved_jumps
property has_unresolved_calls
property operations
All of the operations that are done by this functions.
property code_constants
All of the constants that are used by this functions’s code.
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, **kwargs)
Parameters
cmsg
Return Function
The function instantiated out of the cmsg data.
string_references(minimum_length=2)
All of the constant string references used by this function.
Parameters
minimum_length – The minimum length of strings to find (default is 1)
Returns
A generator yielding tuples of (address, string) where is address is the location of the string
in memory.
property local_runtime_values
Tries to find all runtime values of this function which do not come from inputs. These values are generated
by starting from a blank state and reanalyzing the basic blocks once each. Function calls are skipped, andback edges are never taken so these values are often unreliable, This function is good at finding simple
constant addresses which the function will use or calculate.
Returnsa set of constants
property num_arguments
property endpoints
property endpoints_with_type

660

Chapter 10. API Referenceangrproperty ret_sites
property jumpout_sites
property retout_sites
property callout_sites
property size
property binary
Get the object this function belongs to. :return: The object this function belongs to.
property offset:

int

the function’s binary offset (i.e., non-rebased address)Type
returnproperty symbol:

None | Symbol

the function’s Symbol, if any
Typereturnproperty pseudocode:str

the function’s pseudocodeTypereturnadd_jumpout_site(node)
Add a custom jumpout site.
Parametersnode – The address of the basic block that control flow leaves during this transition.
ReturnsNone
add_retout_site(node)
Add a custom retout site.
Retout (returning to outside of the function) sites are very rare. It mostly occurs during CFG recovery
when we incorrectly identify the beginning of a function in the first iteration, and then correctly identify
that function later in the same iteration (function alignments can lead to this bizarre case). We will markall edges going out of the header of that function as a outside edge, because all successors now belong to
the incorrectly-identified function. This identification error will be fixed in the second iteration of CFG
recovery. However, we still want to keep track of jumpouts/retouts during the first iteration so other logic
in CFG recovery still work.
Parametersnode – The address of the basic block that control flow leaves the current function after a call.
ReturnsNonemark_nonreturning_calls_endpoints()
Iterate through all call edges in transition graph. For each call a non-returning function, mark the source
basic block as an endpoint.

10.13. Knowledge Base

661

angr

This method should only be executed once all functions are recovered and analyzed by CFG recovery, so
we know whether each function returns or not.
ReturnsNone
get_call_sites()
Gets a list of all the basic blocks that end in calls.
Return type
Iterable[int]Returns
A view of the addresses of the blocks that end in calls.
get_call_target(callsite_addr)
Get the target of a call.
Parameters
callsite_addr – The address of a basic block that ends in a call.
Returns
The target of said call, or None if callsite_addr is not a callsite.
get_call_return(callsite_addr)
Get the hypothetical return address of a call.
Parameters
callsite_addr – The address of the basic block that ends in a call.
Returns
The likely return target of said call, or None if callsite_addr is not a callsite.
property graphGet a local transition graph. A local transition graph is a transition graph that only contains nodes thatbelong to the current function. All edges, except for the edges going out from the current function or
coming from outside the current function, are included.
The generated graph is cached in self._local_transition_graph.
Returns
A local transition graph.
Return typenetworkx.DiGraphgraph_ex(exception_edges=True)
Get a local transition graph with a custom configuration. A local transition graph is a transition graph that
only contains nodes that belong to the current function. This method allows user to exclude certain typesof edges together with the nodes that are only reachable through such edges, such as exception edges.
The generated graph is not cached.
Parameters
exception_edges (bool) – Should exception edges and the nodes that are only reachable
through exception edges be kept.
Returns
A local transition graph with a special configuration.
Return typenetworkx.DiGraph

662

Chapter 10. API Referenceangrtransition_graph_ex(exception_edges=True)
Get a transition graph with a custom configuration. This method allows user to exclude certain types ofedges together with the nodes that are only reachable through such edges, such as exception edges.
The generated graph is not cached.
Parameters
exception_edges (bool) – Should exception edges and the nodes that are only reachable
through exception edges be kept.
Returns
A local transition graph with a special configuration.
Return typenetworkx.DiGraphsubgraph(ins_addrs)
Generate a sub control flow graph of instruction addresses based on self.graphParameters
ins_addrs (iterable) – A collection of instruction addresses that should be included in
the subgraph.
Return networkx.DiGraph
A subgraph.
instruction_size(insn_addr)
Get the size of the instruction specified by insn_addr.
Parameters
insn_addr (int) – Address of the instruction
Return int
Size of the instruction in bytes, or None if the instruction is not found.
addr_to_instruction_addr(addr)
Obtain the address of the instruction that covers @addr.
Parametersaddr (int) – An address.
Returns
Address of the instruction that covers @addr, or None if this addr is not covered by any instruction of this function.
Return type
int or None
dbg_print()
Returns a representation of the list of basic blocks in this function.
dbg_draw(filename)
Draw the graph and save it to a PNG file.
property arguments
property has_return
property callable

10.13. Knowledge Base

663

angr

normalize()
Make sure all basic blocks in the transition graph of this function do not overlap. You will end up with a
CFG that IDA Pro generates.
This method does not touch the CFG result. You may call CFG{Emulated, Fast}.normalize() for that matter.
ReturnsNonefind_declaration(ignore_binary_name=False, binary_name_hint=None)
Find the most likely function declaration from the embedded collection of prototypes, set it to self.prototype,and update self.calling_convention with the declaration.
Parameters• ignore_binary_name (bool) – Do not rely on the executable or library where the function belongs to determine its source library. This is useful when working on staticallylinked binaries (because all functions will belong to the main executable). We will search
for all libraries in angr to find the first declaration match.
• binary_name_hint (Optional[str]) – Substring of the library name where this function
might be originally coming from. Useful for FLIRT-identified functions in statically linked
binaries.
Return typebool
Returns
True if a declaration is found and self.prototype and self.calling_convention are updated.
False if we fail to find a matching function declaration, in which case self.prototype or
self.calling_convention will be kept untouched.
property demangled_nameget_unambiguous_name(display_name=None)
Get a disambiguated function name.
Parametersdisplay_name (Optional[str]) – Name to display, otherwise the function name.
Return type
str
Returns
The function name in the form: ::<name> when the function binary is the main object.
::<obj>::<name> when the function binary is not the main object. ::<addr>::<name> when
the function binary is an unnamed non-main object, or when multiple functions withthe same name are defined in the function binary.
apply_definition(definition, calling_convention=None)
Return type
None
Parameters• definition (str)• calling_convention (SimCC | type[SimCC] | None)

664

Chapter 10. API Referenceangrfunctions_reachable()
Return typeset[Function]
Returns
The set of all functions that can be reached from the function represented by self.
copy()
pp(**kwargs)
Pretty-print the function disassembly.
class angr.knowledge_plugins.VariableManager(kb)Bases: KnowledgeBasePlugin
Manage variables.
__init__(kb)has_function_manager(key)
Return typebool
Parameters
key (int)
get_function_manager(func_addr)
Return type
VariableManagerInternal
initialize_variable_names()
Return type
None
get_variable_accesses(variable, same_name=False)
Get a list of all references to the given variable.
Parameters• variable (SimVariable) – The variable.
• same_name (bool) – Whether to include all variables with the same variable name, or justbased on the variable identifier.
Return type
list[VariableAccess]
Returns
All references to the variable.
copy()
static convert_variable_list(vlist, manager)
Parameters• vlist (list[Variable])• manager (VariableManagerInternal)

10.13. Knowledge Base

665

angr

load_from_dwarf(cu_list=None)
Parameters
cu_list (list[CompilationUnit] | None)class angr.knowledge_plugins.DebugVariableManager(kb)Bases: KnowledgeBasePlugin
Structure to manage and access variables with different visibility scopes.
Parameterskb (KnowledgeBase)__init__(kb)Parameterskb (KnowledgeBase)
from_name_and_pc(var_name, pc_addr)
Get a variable from its string in the scope of pc.
Return type
Variable
Parameters• var_name (str)• pc_addr (int)from_name(var_name)Get the variable container for all variables named var_name
Parameters
var_name (str) – name for a variable
Return type
DebugVariableContainer
add_variable(cle_var, low_pc, high_pc)
Add/load a variable
Parameters• cle_variable – The variable to add• low_pc (int) – Start of the visibility scope of the variable as program counter address(rebased)• high_pc (int) – End of the visibility scope of the variable as program counter address(rebased)• cle_var (Variable)
add_variable_list(vlist, low_pc, high_pc)
Add all variables in a list with the same visibility range
Parameters• vlist (list[Variable]) – A list of cle variables to add• low_pc (int) – Start of the visibility scope as program counter address (rebased)• high_pc (int) – End of the visibility scope as program counter address (rebased)

666

Chapter 10. API Referenceangrload_from_dwarf(elf_object=None, cu=None)
Automatically load all variables (global/local) from the DWARF debugging info
Parameters• elf_object (Optional[ELF]) – Optional, when only one elf object should be considered(e.g. p.loader.main_object)• cu (Optional[CompilationUnit]) – Optional, when only one compilation unit should
be consideredclass angr.knowledge_plugins.Comments(kb)Bases: KnowledgeBasePlugin, dict
Tracks comments via a Dict of Address -> Text
Parameterskb (KnowledgeBase)copy() → a shallow copy of Dclass angr.knowledge_plugins.Data(kb)Bases: KnowledgeBasePlugin
The knowledge what purpose this plugin serves has been lost to the passing of time but the linter does not carefor these failures of mere mortals and demands a docstring anyway. The pact has been made, and no violationsof the rules will be tolerated, even if the spirit does not match the letter. Making the plugin smaller has only
increased the weight of the failure, and thus this file has drawn its ire.
The only thing left to do is to attempt to find meaning in the meaninglessness, as the only act of rebellion against
the uncaring forces that bind us. For is this not what being human is all about?
Parameterskb (KnowledgeBase)copy()
class angr.knowledge_plugins.IndirectJumps(kb)Bases: KnowledgeBasePlugin, dictThis plugin tracks the targets of indirect jumps__init__(kb)copy() → a shallow copy of D
update_resolved_addrs(indirect_address, resolved_addresses)
Parameters• indirect_address (int)• resolved_addresses (list[int])class angr.knowledge_plugins.Labels(kb)Bases: KnowledgeBasePlugin__init__(kb)items()

10.13. Knowledge Base

667

angr

get(addr)
Get a label as string for a given address Same as .labels[x]lookup(name)Returns an address to a given label To show all available labels, iterate over .labels or list(b.kb.labels)copy()
get_unique_label(label)
Get a unique label name from the given label name.
Parameterslabel (str) – The desired label name.
Returns
A unique label name.
class angr.knowledge_plugins.CFGManager(kb)Bases: KnowledgeBasePlugin
This is the CFG manager, it manages CFGs__init__(kb)new_model(prefix)
copy()
get_most_accurate()
Return type
CFGModel | None
Returns
The most accurate CFG present in the CFGManager, or None if it does not hold any.
class angr.knowledge_plugins.XRefManager(kb)Bases: KnowledgeBasePlugin, Serializable__init__(kb)copy()
add_xref(xref )add_xrefs(xrefs)
get_xrefs_by_ins_addr(ins_addr)
get_xrefs_by_dst(dst)
get_xrefs_by_dst_region(start, end)
Get a set of XRef objects that point to a given address region bounded by start and end. Will only return
absolute xrefs, not relative ones (like SP offsets)
get_xrefs_by_ins_addr_region(start, end)
Get a set of XRef objects that originate at a given address region bounded by start and end. Useful forfinding references from a basic block or function.
Return typeset[XRef ]668

Chapter 10. API Referenceangrserialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, cfg_model=None, kb=None, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
class angr.knowledge_plugins.KnowledgeBasePlugin(kb)Bases: object
Parameterskb (KnowledgeBase)__init__(kb)Parameterskb (KnowledgeBase)copy()
static register_default(name, cls)
class angr.knowledge_plugins.PatchManager(kb)Bases: KnowledgeBasePlugin
A placeholder-style implementation for a binary patch manager. This class should be significantly changed in
the future when all data about loaded binary objects are loaded into angr knowledge base from CLE. As of now,
it only stores byte-level replacements.
Patches should not overlap, but it’s user’s responsibility to check for and avoid overlapping patches.
__init__(kb)add_patch(addr, new_bytes, comment=None)
Parameters
comment (str | None)
add_patch_obj(patch)
Parameters
patch (Patch)
remove_patch(addr)
patch_addrs()

10.13. Knowledge Base

669

angr

get_patch(addr)
Get patch at the given address.
Parametersaddr (int) – The address of the patch.
Returns
The patch if there is one starting at the address, or None if there isn’t any.
Return type
Patch or None
get_all_patches(addr, size)
Retrieve all patches that cover a region specified by [addr, addr+size).
Parameters• addr (int) – The address of the beginning of the region.
• size (int) – Size of the region.
Returns
A list of patches.
Return typelist
keys()
items()
values()copy()
static overlap(a0, a1, b0, b1)
apply_patches_to_binary(binary_bytes=None, patches=None)
Return type
bytes
Parameters• binary_bytes (bytes | None)• patches (list[Patch] | None)
apply_patches_to_state(state)property patched_entry_stateclass angr.knowledge_plugins.KeyDefinitionManager(kb)Bases: KnowledgeBasePlugin
KeyDefinitionManager manages and caches reaching definition models for each function.
For each function, by default we cache the entire reaching definitions model with observed results at the following
locations: - Before each call instruction: (‘insn’, address of the call instruction, OP_BEFORE) - After returningfrom each call: (‘node’, address of the block that ends with a call, OP_AFTER)
Parameterskb (KnowledgeBase)

670

Chapter 10. API Referenceangr__init__(kb)Parameterskb (KnowledgeBase)
has_model(func_addr)
Parameters
func_addr (int)
get_model(func_addr)
Parameters
func_addr (int)copy()
Return type
KeyDefinitionManager
class angr.knowledge_plugins.PropagationManager(kb)Bases: KnowledgeBasePlugin
Manages the results of Propagator, including intermediate results for unfinished Propagation runs.
__init__(kb)exists(prop_key)
Internal function to check if a func, specified as a CodeLocation exists in our known propagations
Parameters
prop_key (tuple) – A key of the propagation result.
Return typebool
Returns
Whether such a key exists or not.
update(prop_key, model)
Add the replacements to known propagations
Parameters• prop_key (tuple) – A key of the propagation result.
• model (PropagationModel) – The propagation result to store
Return type
Noneget(prop_key, default=None)
Gets the replacements for a specified function location. If the replacement does not exist in the known
propagations, it returns None.
Parameters• prop_key – A key of the propagation result.
• default – The default value to return if the prop_key does not exist in the cache.
Return typePropagationModel

10.13. Knowledge Base

671

angr

Returns
Dict or Nonecopy()
discard_by_prefix(prefix)
Parameters
prefix (str)class angr.knowledge_plugins.StructuredCodeManager(kb)Bases: KnowledgeBasePlugin
A knowledge base plugin to store structured code generator results.
__init__(kb)discard(key)available_flavors(item)
copy()
class angr.knowledge_plugins.TypesStore(kb)Bases: KnowledgeBasePlugin, UserDict
A kb plugin that stores a mapping from name to TypeRef. It will return types from angr.sim_type.ALL_TYPES
as a default.
__init__(kb)copy()
iter_own()
Iterate over all the names which are stored in this object - i.e. values() without ALL_TYPES
rename(old, new)unique_type_name()
Return typestrclass angr.knowledge_plugins.CallsitePrototypes(kb)Bases: KnowledgeBasePlugin
CallsitePrototypes manages callee prototypes at call sites.
__init__(kb)set_prototype(callsite_block_addr, cc, prototype, manual=False)
Return type
None
Parameters• callsite_block_addr (int)• cc (SimCC)• prototype (SimTypeFunction)• manual (bool)

672

Chapter 10. API Referenceangrget_cc(callsite_block_addr)
Return type
SimCC | None
Parameters
callsite_block_addr (int)
get_prototype(callsite_block_addr)
Return type
SimTypeFunction | None
Parameters
callsite_block_addr (int)
get_prototype_type(callsite_block_addr)
Return typebool | None
Parameters
callsite_block_addr (int)
has_prototype(callsite_block_addr)
Return typebool
Parameters
callsite_block_addr (int)copy()
class angr.knowledge_plugins.CustomStrings(kb)Bases: KnowledgeBasePlugin
Store new strings that are recovered during various analysis. Each string has a unique ID associated.
__init__(kb)allocate(s)Return type
int
Parameterss (bytes)copy()
class angr.knowledge_plugins.patches.Patch(addr, new_bytes, comment=None)
Bases: object
Parameters
comment (str | None)__init__(addr, new_bytes, comment=None)
Parameters
comment (str | None)

10.13. Knowledge Base

673

angr

class angr.knowledge_plugins.patches.PatchManager(kb)Bases: KnowledgeBasePlugin
A placeholder-style implementation for a binary patch manager. This class should be significantly changed in
the future when all data about loaded binary objects are loaded into angr knowledge base from CLE. As of now,
it only stores byte-level replacements.
Patches should not overlap, but it’s user’s responsibility to check for and avoid overlapping patches.
__init__(kb)add_patch(addr, new_bytes, comment=None)
Parameters
comment (str | None)
add_patch_obj(patch)
Parameters
patch (Patch)
remove_patch(addr)
patch_addrs()
get_patch(addr)
Get patch at the given address.
Parametersaddr (int) – The address of the patch.
Returns
The patch if there is one starting at the address, or None if there isn’t any.
Return type
Patch or None
get_all_patches(addr, size)
Retrieve all patches that cover a region specified by [addr, addr+size).
Parameters• addr (int) – The address of the beginning of the region.
• size (int) – Size of the region.
Returns
A list of patches.
Return typelist
keys()
items()
values()copy()
static overlap(a0, a1, b0, b1)

674

Chapter 10. API Referenceangrapply_patches_to_binary(binary_bytes=None, patches=None)
Return type
bytes
Parameters• binary_bytes (bytes | None)• patches (list[Patch] | None)
apply_patches_to_state(state)property patched_entry_stateclass angr.knowledge_plugins.plugin.KnowledgeBasePlugin(kb)Bases: object
Parameterskb (KnowledgeBase)__init__(kb)Parameterskb (KnowledgeBase)copy()
static register_default(name, cls)
class angr.knowledge_plugins.callsite_prototypes.CallsitePrototypes(kb)Bases: KnowledgeBasePlugin
CallsitePrototypes manages callee prototypes at call sites.
__init__(kb)set_prototype(callsite_block_addr, cc, prototype, manual=False)
Return type
None
Parameters• callsite_block_addr (int)• cc (SimCC)• prototype (SimTypeFunction)• manual (bool)
get_cc(callsite_block_addr)
Return type
SimCC | None
Parameters
callsite_block_addr (int)
get_prototype(callsite_block_addr)
Return type
SimTypeFunction | None

10.13. Knowledge Base

675

angr

Parameters
callsite_block_addr (int)
get_prototype_type(callsite_block_addr)
Return typebool | None
Parameters
callsite_block_addr (int)
has_prototype(callsite_block_addr)
Return typebool
Parameters
callsite_block_addr (int)copy()
class angr.knowledge_plugins.cfg.MemoryDataSort
Bases: object
Unspecified = None
Unknown = 'unknown'
Integer = 'integer'
PointerArray = 'pointer-array'
String = 'string'
UnicodeString = 'unicode'
SegmentBoundary = 'segment-boundary'
CodeReference = 'code reference'
GOTPLTEntry = 'GOT PLT Entry'
ELFHeader = 'elf-header'
FloatingPoint = 'fp'
Alignment = 'alignment'
class angr.knowledge_plugins.cfg.MemoryData(address, size, sort, pointer_addr=None, max_size=None,reference_size=None)
Bases: Serializable
MemoryData describes the syntactic content of a single address of memory.
reference_size reflects the size of content. It can be different from size, which is the actual size of the memory
data item in memory. The intended way to get the actual content in memory is self.content[:self.size].
Parameters• address (int)• size (int)676

Chapter 10. API Referenceangr• sort (str | None)• pointer_addr (int | None)• max_size (int | None)• reference_size (int | None)__init__(address, size, sort, pointer_addr=None, max_size=None, reference_size=None)
Parameters• address (int)• size (int)• sort (str | None)• pointer_addr (int | None)• max_size (int | None)• reference_size (int | None)
addr:

int

size:

int

reference_size:
sort:

int

str | None

max_size:

int | None

pointer_addr:
content:

int | Nonebytes | None

property addresscopy()
Make a copy of the MemoryData.
Returns
A copy of the MemoryData instance.
Return type
MemoryData
fill_content(loader)
Load data to fill self.content.
Parameters
loader – The project loader.
ReturnsNoneserialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.

10.13. Knowledge Base

677

angr

Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
class angr.knowledge_plugins.cfg.CFGNode(addr, size, cfg, simprocedure_name=None, no_ret=False,function_address=None, block_id=None, irsb=None,soot_block=None, instruction_addrs=None, thumb=False,
byte_string=None, is_syscall=None, name=None)
Bases: Serializable
This class stands for each single node in CFG.
__init__(addr, size, cfg, simprocedure_name=None, no_ret=False, function_address=None,
block_id=None, irsb=None, soot_block=None, instruction_addrs=None, thumb=False,
byte_string=None, is_syscall=None, name=None)
Note: simprocedure_name is not used to recreate the SimProcedure object. It’s only there for better__repr__.
addr:

int | SootAddressDescriptor

size
simprocedure_nameno_retfunction_address
thumb
byte_string:bytes | None

is_syscall
instruction_addrs
irsb
soot_block
has_return
block_id:

BlockID | int

property nameproperty successors
property predecessors

678

Chapter 10. API Referenceangrsuccessors_and_jumpkinds(excluding_fakeret=True)
predecessors_and_jumpkinds(excluding_fakeret=True)
get_data_references(kb=None)
Get the known data references for this CFGNode via the knowledge base.
Parameterskb – Which knowledge base to use; uses the global KB by default if none is provided
Returns
Generator yielding xrefs to this CFGNode’s block.
Return typeiter
property accessed_data_references
Property providing a view of all the known data references for this CFGNode via the global knowledge base
Returns
Generator yielding xrefs to this CFGNode’s block.
Return typeiter
property is_simprocedure
property callstack_key
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, cfg=None)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
copy()
merge(other)Merges this node with the other, returning a new node that spans the both.
to_codenode()
property block:

Block | SootBlock | None

syscall_name10.13. Knowledge Base

679

angr

class angr.knowledge_plugins.cfg.CFGENode(addr, size, cfg, simprocedure_name=None, no_ret=False,function_address=None, block_id=None, irsb=None,
instruction_addrs=None, thumb=False, byte_string=None,
is_syscall=None, name=None, input_state=None,
final_states=None, syscall_name=None, looping_times=0,
depth=None, callstack_key=None,creation_failure_info=None)
Bases: CFGNode
The CFGNode that is used in CFGEmulated.
Parameters• addr (int | SootAddressDescriptor)• block_id (BlockID | int)
• byte_string (bytes | None)__init__(addr, size, cfg, simprocedure_name=None, no_ret=False, function_address=None,
block_id=None, irsb=None, instruction_addrs=None, thumb=False, byte_string=None,
is_syscall=None, name=None, input_state=None, final_states=None, syscall_name=None,
looping_times=0, depth=None, callstack_key=None, creation_failure_info=None)
Note: simprocedure_name is not used to recreate the SimProcedure object. It’s only there for better__repr__.
input_statelooping_times
depth
creation_failure_info
final_states
return_target
syscallproperty callstack_key
property creation_failed
downsize()
Drop saved states.
copy()
class angr.knowledge_plugins.cfg.IndirectJump(addr, ins_addr, func_addr, jumpkind, stmt_idx,
resolved_targets=None, jumptable=False,
jumptable_addr=None, jumptable_size=None,
jumptable_entry_size=None, jumptable_entries=None,
type_=255)
Bases: Serializable
Parameters• addr (int)• ins_addr (int)
680

Chapter 10. API Referenceangr• func_addr (int)• jumpkind (str)• stmt_idx (int)• resolved_targets (list[int] | None)• jumptable (bool)• jumptable_addr (int | None)• jumptable_size (int | None)• jumptable_entry_size (int | None)• jumptable_entries (list[int] | None)• type_ (int | None)__init__(addr, ins_addr, func_addr, jumpkind, stmt_idx, resolved_targets=None, jumptable=False,
jumptable_addr=None, jumptable_size=None, jumptable_entry_size=None,
jumptable_entries=None, type_=255)
Parameters• addr (int)• ins_addr (int)• func_addr (int)• jumpkind (str)• stmt_idx (int)• resolved_targets (list[int] | None)• jumptable (bool)• jumptable_addr (int | None)• jumptable_size (int | None)• jumptable_entry_size (int | None)• jumptable_entries (list[int] | None)• type_ (int | None)addr
ins_addr
func_addr
jumpkindstmt_idx
resolved_targets
jumptable
jumptable_addr
jumptable_size

10.13. Knowledge Base

681

angr

jumptable_entry_size
jumptable_entries
typeclass angr.knowledge_plugins.cfg.IndirectJumpType
Bases: object
Jumptable_AddressLoadedFromMemory = 0
Jumptable_AddressComputed = 1
Vtable = 3
Unknown = 255
class angr.knowledge_plugins.cfg.CFGModel(ident, cfg_manager=None, is_arm=False)
Bases: Serializable
This class describes a Control Flow Graph for a specific range of code.
__init__(ident, cfg_manager=None, is_arm=False)
ident
is_armgraph
jump_tables:

dict[int, IndirectJump]

memory_data:

dict[int, MemoryData]

insn_addr_to_memory_data:

dict[int, MemoryData]

normalizededges_to_repair
property project
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, cfg_manager=None, loader=None)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return type
cls

682

Chapter 10. API Referenceangrcopy()
add_node(block_id, node)
Return type
None
Parameters• block_id (int)• node (CFGNode)remove_node(block_id, node)
Remove the given CFGNode instance. Note that this method does not remove the node from the graph.
Parameters• block_id (int) – The Unique ID of the CFGNode.
• node (CFGNode) – The CFGNode instance to remove.
Return type
None
ReturnsNone
get_node(block_id)
Get a single node from node key.
Parameters
block_id (BlockID) – Block ID of the node.
Returns
The CFGNode
Return type
CFGNodeget_any_node(addr, is_syscall=None, anyaddr=False, force_fastpath=False)
Get an arbitrary CFGNode (without considering their contexts) from our graph.
Parameters• addr (int) – Address of the beginning of the basic block. Set anyaddr to True to support
arbitrary address.
• is_syscall (Optional[bool]) – Whether you want to get the syscall node or any othernode. This is due to the fact that syscall SimProcedures have the same address as thetarget it returns to. None means get either, True means get a syscall node, False means get
something that isn’t a syscall node.
• anyaddr (bool) – If anyaddr is True, then addr doesn’t have to be the beginning addressof a basic block. By default the entire graph.nodes() will be iterated, and the first nodecontaining the specific address is returned, which can be slow.
• force_fastpath (bool) – If force_fastpath is True, it will only perform a dict lookup in
the _nodes_by_addr dict.
Return type
CFGNode | None

10.13. Knowledge Base

683

angr

Returns
A CFGNode if there is any that satisfies given conditions, or None otherwise
get_all_nodes(addr, is_syscall=None, anyaddr=False)
Get all CFGNodes whose address is the specified one.
Parameters• addr (int) – Address of the node
• is_syscall (Optional[bool]) – True returns the syscall node, False returns the normal
CFGNode, None returns both• anyaddr (bool)
Return type
list[CFGNode]
Returns
all CFGNodes
get_all_nodes_intersecting_region(addr, size=1)
Get all CFGNodes that intersect the given region.
Parameters• addr (int) – Minimum address of target region.
• size (int) – Size of region, in bytes.
Return typeset[CFGNode]nodes()
An iterator of all nodes in the graph.
Returns
The iterator.
Return type
iterator
get_predecessors(cfgnode, excluding_fakeret=True, jumpkind=None)
Get predecessors of a node in the control flow graph.
Parameters• cfgnode (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all predecessors that is connected to the node with a fakeret edge.
• jumpkind (Optional[str]) – Only return predecessors with the specified jumpkind. This
argument will be ignored if set to None.
Return type
list[CFGNode]
Returns
A list of predecessors
get_successors(node, excluding_fakeret=True, jumpkind=None)
Get successors of a node in the control flow graph.
Parameters
684

Chapter 10. API Referenceangr• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all successors that is connectedto the node with a fakeret edge.
• jumpkind (str | None) – Only return successors with the specified jumpkind. This argument will be ignored if set to None.
• jumpkind
Returns
A list of successors
Return typelist
get_successors_and_jumpkinds(node, excluding_fakeret=True)
Get a list of tuples where the first element is the successor of the CFG node and the second element is thejumpkind of the successor.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all successors that are fallthrough successors.
Returns
A list of successors and their corresponding jumpkinds.
Return typelist
get_successors_and_jumpkind(node, excluding_fakeret=True)
Get a list of tuples where the first element is the successor of the CFG node and the second element is thejumpkind of the successor.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all successors that are fallthrough successors.
Returns
A list of successors and their corresponding jumpkinds.
Return typelist
get_predecessors_and_jumpkinds(node, excluding_fakeret=True)
Get a list of tuples where the first element is the predecessor of the CFG node and the second element is
the jumpkind of the predecessor.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all predecessors that are fallthrough predecessors.
Return type
list[tuple[CFGNode, str]]

10.13. Knowledge Base

685

angr

Returns
A list of predecessors and their corresponding jumpkinds.
get_predecessors_and_jumpkind(node, excluding_fakeret=True)
Get a list of tuples where the first element is the predecessor of the CFG node and the second element is
the jumpkind of the predecessor.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all predecessors that are fallthrough predecessors.
Return type
list[tuple[CFGNode, str]]
Returns
A list of predecessors and their corresponding jumpkinds.
get_all_predecessors(cfgnode, depth_limit=None)
Get all predecessors of a specific node on the control flow graph.
Parameters• cfgnode (CFGNode) – The CFGNode object• depth_limit (int) – Optional depth limit for the depth-first search
Returns
A list of predecessors in the CFG
Return type
list
get_all_successors(cfgnode, depth_limit=None)
Get all successors of a specific node on the control flow graph.
Parameters• cfgnode (CFGNode) – The CFGNode object• depth_limit (int) – Optional depth limit for the depth-first search
Returns
A list of successors in the CFG
Return type
list
get_branching_nodes()Returns all nodes that has an out degree >= 2
get_exit_stmt_idx(src_block, dst_block)Get the corresponding exit statement ID for control flow to reach destination block from source block. The
exit statement ID was put on the edge when creating the CFG. Note that there must be a direct edge between
the two blocks, otherwise an exception will be raised.
Returns
The exit statement ID

686

Chapter 10. API Referenceangr

add_memory_data(data_addr, data_type, data_size=None)
Add a MemoryData entry to self.memory_data.
Parameters• data_addr (int) – Address of the data
• data_type (MemoryDataSort | None) – Type of the memory data
• data_size (Optional[int]) – Size of the memory data, or None if unknown for now.
Return typebool
Returns
True if a new memory data entry is added, False otherwise.
tidy_data_references(memory_data_addrs=None, exec_mem_regions=None, xrefs=None,
seg_list=None, data_type_guessing_handlers=None)
Go through all data references (or the ones as specified by memory_data_addrs) and determine their sizes
and types if possible.
Parameters• memory_data_addrs (list[int] | None) – A list of addresses of memory data, or None if
tidying all known memory data entries.
• exec_mem_regions (list[tuple[int, int]] | None) – A list of start and end addresses of executable memory regions.
• seg_list (SegmentList | None) – The segment list that CFGFast uses during CFG recovery.
• data_type_guessing_handlers (list[Callable] | None) – A list of Python functions thatwill guess data types. They will be called in sequence to determine data types for memory
data whose type is unknown.
• xrefs (XRefManager | None)
Return typebool
Returns
True if new data entries are found, False otherwise.
remove_node_and_graph_node(node)
Like remove_node, but also removes node from the graph.
Parametersnode (CFGNode) – The node to remove.
Return type
None
get_intersecting_functions(addr, size=1, kb=None)
Find all functions with nodes intersecting [addr, addr + size).
Parameters• addr (int) – Minimum address of target region.
• size (int) – Size of region, in bytes.
• kb (KnowledgeBase | None) – Knowledge base to search for functions in.

10.13. Knowledge Base

687

angr

Return typeset[Function]find_function_for_reflow_into_addr(addr, kb=None)
Look for a function that flows into a new node at addr.
Parameters• addr (int) – Address of new block.
• kb (KnowledgeBase | None) – Knowledge base to search for functions in.
Return type
Function | None
clear_region_for_reflow(addr, size=1, kb=None)
Remove nodes in the graph intersecting region [addr, addr + size).
Any functions that intersect the range, and their associated nodes in the CFG, will also be removed fromthe knowledge base for analysis.
Parameters• addr (int) – Minimum address of target region.
• size (int) – Size of the region, in bytes.
• kb (KnowledgeBase | None) – Knowledge base to search for functions in.
Return type
Noneclass angr.knowledge_plugins.cfg.CFGManager(kb)Bases: KnowledgeBasePlugin
This is the CFG manager, it manages CFGs__init__(kb)new_model(prefix)
copy()
get_most_accurate()
Return type
CFGModel | None
Returns
The most accurate CFG present in the CFGManager, or None if it does not hold any.
class angr.knowledge_plugins.cfg.cfg_model.CFGModel(ident, cfg_manager=None, is_arm=False)
Bases: Serializable
This class describes a Control Flow Graph for a specific range of code.
__init__(ident, cfg_manager=None, is_arm=False)
ident
is_armgraph

688

Chapter 10. API Referenceangrjump_tables:

dict[int, IndirectJump]

memory_data:

dict[int, MemoryData]

insn_addr_to_memory_data:

dict[int, MemoryData]

normalizededges_to_repair
property project
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, cfg_manager=None, loader=None)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
copy()
add_node(block_id, node)
Return type
None
Parameters• block_id (int)• node (CFGNode)remove_node(block_id, node)
Remove the given CFGNode instance. Note that this method does not remove the node from the graph.
Parameters• block_id (int) – The Unique ID of the CFGNode.
• node (CFGNode) – The CFGNode instance to remove.
Return type
None
ReturnsNone

10.13. Knowledge Base

689

angr

get_node(block_id)
Get a single node from node key.
Parameters
block_id (BlockID) – Block ID of the node.
Returns
The CFGNode
Return type
CFGNodeget_any_node(addr, is_syscall=None, anyaddr=False, force_fastpath=False)
Get an arbitrary CFGNode (without considering their contexts) from our graph.
Parameters• addr (int) – Address of the beginning of the basic block. Set anyaddr to True to support
arbitrary address.
• is_syscall (Optional[bool]) – Whether you want to get the syscall node or any othernode. This is due to the fact that syscall SimProcedures have the same address as thetarget it returns to. None means get either, True means get a syscall node, False means get
something that isn’t a syscall node.
• anyaddr (bool) – If anyaddr is True, then addr doesn’t have to be the beginning addressof a basic block. By default the entire graph.nodes() will be iterated, and the first nodecontaining the specific address is returned, which can be slow.
• force_fastpath (bool) – If force_fastpath is True, it will only perform a dict lookup in
the _nodes_by_addr dict.
Return type
CFGNode | None
Returns
A CFGNode if there is any that satisfies given conditions, or None otherwise
get_all_nodes(addr, is_syscall=None, anyaddr=False)
Get all CFGNodes whose address is the specified one.
Parameters• addr (int) – Address of the node
• is_syscall (Optional[bool]) – True returns the syscall node, False returns the normal
CFGNode, None returns both• anyaddr (bool)
Return type
list[CFGNode]
Returns
all CFGNodes
get_all_nodes_intersecting_region(addr, size=1)
Get all CFGNodes that intersect the given region.
Parameters• addr (int) – Minimum address of target region.
• size (int) – Size of region, in bytes.
690

Chapter 10. API ReferenceangrReturn typeset[CFGNode]nodes()
An iterator of all nodes in the graph.
Returns
The iterator.
Return type
iterator
get_predecessors(cfgnode, excluding_fakeret=True, jumpkind=None)
Get predecessors of a node in the control flow graph.
Parameters• cfgnode (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all predecessors that is connected to the node with a fakeret edge.
• jumpkind (Optional[str]) – Only return predecessors with the specified jumpkind. This
argument will be ignored if set to None.
Return type
list[CFGNode]
Returns
A list of predecessors
get_successors(node, excluding_fakeret=True, jumpkind=None)
Get successors of a node in the control flow graph.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all successors that is connectedto the node with a fakeret edge.
• jumpkind (str | None) – Only return successors with the specified jumpkind. This argument will be ignored if set to None.
• jumpkind
Returns
A list of successors
Return typelist
get_successors_and_jumpkinds(node, excluding_fakeret=True)
Get a list of tuples where the first element is the successor of the CFG node and the second element is thejumpkind of the successor.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all successors that are fallthrough successors.
Returns
A list of successors and their corresponding jumpkinds.
10.13. Knowledge Base

691

angr

Return typelist
get_successors_and_jumpkind(node, excluding_fakeret=True)
Get a list of tuples where the first element is the successor of the CFG node and the second element is thejumpkind of the successor.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all successors that are fallthrough successors.
Returns
A list of successors and their corresponding jumpkinds.
Return typelist
get_predecessors_and_jumpkinds(node, excluding_fakeret=True)
Get a list of tuples where the first element is the predecessor of the CFG node and the second element is
the jumpkind of the predecessor.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all predecessors that are fallthrough predecessors.
Return type
list[tuple[CFGNode, str]]
Returns
A list of predecessors and their corresponding jumpkinds.
get_predecessors_and_jumpkind(node, excluding_fakeret=True)
Get a list of tuples where the first element is the predecessor of the CFG node and the second element is
the jumpkind of the predecessor.
Parameters• node (CFGNode) – The node.
• excluding_fakeret (bool) – True if you want to exclude all predecessors that are fallthrough predecessors.
Return type
list[tuple[CFGNode, str]]
Returns
A list of predecessors and their corresponding jumpkinds.
get_all_predecessors(cfgnode, depth_limit=None)
Get all predecessors of a specific node on the control flow graph.
Parameters• cfgnode (CFGNode) – The CFGNode object• depth_limit (int) – Optional depth limit for the depth-first search
Returns
A list of predecessors in the CFG
692

Chapter 10. API ReferenceangrReturn type
list
get_all_successors(cfgnode, depth_limit=None)
Get all successors of a specific node on the control flow graph.
Parameters• cfgnode (CFGNode) – The CFGNode object• depth_limit (int) – Optional depth limit for the depth-first search
Returns
A list of successors in the CFG
Return type
list
get_branching_nodes()Returns all nodes that has an out degree >= 2
get_exit_stmt_idx(src_block, dst_block)Get the corresponding exit statement ID for control flow to reach destination block from source block. The
exit statement ID was put on the edge when creating the CFG. Note that there must be a direct edge between
the two blocks, otherwise an exception will be raised.
Returns
The exit statement ID
add_memory_data(data_addr, data_type, data_size=None)
Add a MemoryData entry to self.memory_data.
Parameters• data_addr (int) – Address of the data
• data_type (MemoryDataSort | None) – Type of the memory data
• data_size (Optional[int]) – Size of the memory data, or None if unknown for now.
Return typebool
Returns
True if a new memory data entry is added, False otherwise.
tidy_data_references(memory_data_addrs=None, exec_mem_regions=None, xrefs=None,
seg_list=None, data_type_guessing_handlers=None)
Go through all data references (or the ones as specified by memory_data_addrs) and determine their sizes
and types if possible.
Parameters• memory_data_addrs (list[int] | None) – A list of addresses of memory data, or None if
tidying all known memory data entries.
• exec_mem_regions (list[tuple[int, int]] | None) – A list of start and end addresses of executable memory regions.
• seg_list (SegmentList | None) – The segment list that CFGFast uses during CFG recovery.

10.13. Knowledge Base

693

angr

• data_type_guessing_handlers (list[Callable] | None) – A list of Python functions thatwill guess data types. They will be called in sequence to determine data types for memory
data whose type is unknown.
• xrefs (XRefManager | None)
Return typebool
Returns
True if new data entries are found, False otherwise.
remove_node_and_graph_node(node)
Like remove_node, but also removes node from the graph.
Parametersnode (CFGNode) – The node to remove.
Return type
None
get_intersecting_functions(addr, size=1, kb=None)
Find all functions with nodes intersecting [addr, addr + size).
Parameters• addr (int) – Minimum address of target region.
• size (int) – Size of region, in bytes.
• kb (KnowledgeBase | None) – Knowledge base to search for functions in.
Return typeset[Function]find_function_for_reflow_into_addr(addr, kb=None)
Look for a function that flows into a new node at addr.
Parameters• addr (int) – Address of new block.
• kb (KnowledgeBase | None) – Knowledge base to search for functions in.
Return type
Function | None
clear_region_for_reflow(addr, size=1, kb=None)
Remove nodes in the graph intersecting region [addr, addr + size).
Any functions that intersect the range, and their associated nodes in the CFG, will also be removed fromthe knowledge base for analysis.
Parameters• addr (int) – Minimum address of target region.
• size (int) – Size of the region, in bytes.
• kb (KnowledgeBase | None) – Knowledge base to search for functions in.
Return type
None

694

Chapter 10. API Referenceangrclass angr.knowledge_plugins.cfg.memory_data.MemoryDataSort
Bases: object
Unspecified = None
Unknown = 'unknown'
Integer = 'integer'
PointerArray = 'pointer-array'
String = 'string'
UnicodeString = 'unicode'
SegmentBoundary = 'segment-boundary'
CodeReference = 'code reference'
GOTPLTEntry = 'GOT PLT Entry'
ELFHeader = 'elf-header'
FloatingPoint = 'fp'
Alignment = 'alignment'
class angr.knowledge_plugins.cfg.memory_data.MemoryData(address, size, sort, pointer_addr=None,
max_size=None, reference_size=None)
Bases: Serializable
MemoryData describes the syntactic content of a single address of memory.
reference_size reflects the size of content. It can be different from size, which is the actual size of the memory
data item in memory. The intended way to get the actual content in memory is self.content[:self.size].
Parameters• address (int)• size (int)• sort (str | None)• pointer_addr (int | None)• max_size (int | None)• reference_size (int)__init__(address, size, sort, pointer_addr=None, max_size=None, reference_size=None)
Parameters• address (int)• size (int)• sort (str | None)• pointer_addr (int | None)• max_size (int | None)• reference_size (int | None)

10.13. Knowledge Base

695

angr

addr:

int

size:

int

reference_size:
sort:

int

str | None

max_size:

int | None

pointer_addr:
content:

int | Nonebytes | None

property addresscopy()
Make a copy of the MemoryData.
Returns
A copy of the MemoryData instance.
Return type
MemoryData
fill_content(loader)
Load data to fill self.content.
Parameters
loader – The project loader.
ReturnsNoneserialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
class angr.knowledge_plugins.cfg.cfg_manager.CFGManager(kb)Bases: KnowledgeBasePlugin
This is the CFG manager, it manages CFGs__init__(kb)696Chapter 10. API Referenceangrnew_model(prefix)
copy()
get_most_accurate()
Return type
CFGModel | None
Returns
The most accurate CFG present in the CFGManager, or None if it does not hold any.
class angr.knowledge_plugins.cfg.cfg_node.CFGNodeCreationFailure(exc_info=None,
to_copy=None)
Bases: object
This class contains additional information for whenever creating a CFGNode failed. It includes a full traceback
and the exception messages.
__init__(exc_info=None, to_copy=None)
short_reason
long_reason
tracebackclass angr.knowledge_plugins.cfg.cfg_node.CFGNode(addr, size, cfg, simprocedure_name=None,
no_ret=False, function_address=None,
block_id=None, irsb=None, soot_block=None,
instruction_addrs=None, thumb=False,
byte_string=None, is_syscall=None, name=None)
Bases: Serializable
This class stands for each single node in CFG.
Parameters• addr (int | SootAddressDescriptor)• block_id (BlockID | int)
• byte_string (bytes | None)__init__(addr, size, cfg, simprocedure_name=None, no_ret=False, function_address=None,
block_id=None, irsb=None, soot_block=None, instruction_addrs=None, thumb=False,
byte_string=None, is_syscall=None, name=None)
Note: simprocedure_name is not used to recreate the SimProcedure object. It’s only there for better__repr__.
addr:

int | SootAddressDescriptor

size
simprocedure_nameno_retfunction_address
thumb

10.13. Knowledge Base

697

angr

byte_string:bytes | None

is_syscall
instruction_addrs
irsb
soot_block
has_return
block_id:

BlockID | int

property nameproperty successors
property predecessors
successors_and_jumpkinds(excluding_fakeret=True)
predecessors_and_jumpkinds(excluding_fakeret=True)
get_data_references(kb=None)
Get the known data references for this CFGNode via the knowledge base.
Parameterskb – Which knowledge base to use; uses the global KB by default if none is provided
Returns
Generator yielding xrefs to this CFGNode’s block.
Return typeiter
property accessed_data_references
Property providing a view of all the known data references for this CFGNode via the global knowledge base
Returns
Generator yielding xrefs to this CFGNode’s block.
Return typeiter
property is_simprocedure
property callstack_key
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage

698

Chapter 10. API Referenceangrclassmethod parse_from_cmessage(cmsg, cfg=None)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
copy()
merge(other)Merges this node with the other, returning a new node that spans the both.
to_codenode()
property block:

Block | SootBlock | None

syscall_nameclass angr.knowledge_plugins.cfg.cfg_node.CFGENode(addr, size, cfg, simprocedure_name=None,
no_ret=False, function_address=None,
block_id=None, irsb=None,
instruction_addrs=None, thumb=False,
byte_string=None, is_syscall=None, name=None,
input_state=None, final_states=None,
syscall_name=None, looping_times=0,
depth=None, callstack_key=None,creation_failure_info=None)
Bases: CFGNode
The CFGNode that is used in CFGEmulated.
Parameters• addr (int | SootAddressDescriptor)• block_id (BlockID | int)
• byte_string (bytes | None)__init__(addr, size, cfg, simprocedure_name=None, no_ret=False, function_address=None,
block_id=None, irsb=None, instruction_addrs=None, thumb=False, byte_string=None,
is_syscall=None, name=None, input_state=None, final_states=None, syscall_name=None,
looping_times=0, depth=None, callstack_key=None, creation_failure_info=None)
Note: simprocedure_name is not used to recreate the SimProcedure object. It’s only there for better__repr__.
input_statelooping_times
depth
creation_failure_info
final_states

10.13. Knowledge Base

699

angr

return_target
syscallproperty callstack_key
property creation_failed
downsize()
Drop saved states.
copy()
class angr.knowledge_plugins.cfg.indirect_jump.IndirectJumpType
Bases: object
Jumptable_AddressLoadedFromMemory = 0
Jumptable_AddressComputed = 1
Vtable = 3
Unknown = 255
class angr.knowledge_plugins.cfg.indirect_jump.IndirectJump(addr, ins_addr, func_addr, jumpkind,
stmt_idx, resolved_targets=None,
jumptable=False,
jumptable_addr=None,
jumptable_size=None,
jumptable_entry_size=None,
jumptable_entries=None, type_=255)
Bases: Serializable
Parameters• addr (int)• ins_addr (int)• func_addr (int)• jumpkind (str)• stmt_idx (int)• resolved_targets (list[int] | None)• jumptable (bool)• jumptable_addr (int | None)• jumptable_size (int | None)• jumptable_entry_size (int | None)• jumptable_entries (list[int] | None)• type_ (int | None)__init__(addr, ins_addr, func_addr, jumpkind, stmt_idx, resolved_targets=None, jumptable=False,
jumptable_addr=None, jumptable_size=None, jumptable_entry_size=None,
jumptable_entries=None, type_=255)
Parameters
700

Chapter 10. API Referenceangr• addr (int)• ins_addr (int)• func_addr (int)• jumpkind (str)• stmt_idx (int)• resolved_targets (list[int] | None)• jumptable (bool)• jumptable_addr (int | None)• jumptable_size (int | None)• jumptable_entry_size (int | None)• jumptable_entries (list[int] | None)• type_ (int | None)addr
ins_addr
func_addr
jumpkindstmt_idx
resolved_targets
jumptable
jumptable_addr
jumptable_size
jumptable_entry_size
jumptable_entries
typeclass angr.knowledge_plugins.types.TypesStore(kb)Bases: KnowledgeBasePlugin, UserDict
A kb plugin that stores a mapping from name to TypeRef. It will return types from angr.sim_type.ALL_TYPES
as a default.
__init__(kb)copy()
iter_own()
Iterate over all the names which are stored in this object - i.e. values() without ALL_TYPES
rename(old, new)10.13. Knowledge Base

701

angr

unique_type_name()
Return typestrclass angr.knowledge_plugins.propagations.PropagationModel(prop_key, node_iterations=None,states=None,
block_initial_reg_values=None,
replacements=None,equivalence=None, function=None,
input_states=None)
Bases: Serializable
This class stores the propagation result that comes out of Propagator.
Parameters• prop_key (tuple)• node_iterations (defaultdict[Any, int] | None)• states (dict | None)• block_initial_reg_values (dict | None)• replacements (defaultdict[Any, dict] | None)• equivalence (set | None)• function (Function | None)• input_states (dict | None)__init__(prop_key, node_iterations=None, states=None, block_initial_reg_values=None,
replacements=None, equivalence=None, function=None, input_states=None)
Parameters• prop_key (tuple)• node_iterations (defaultdict[Any, int] | None)• states (dict | None)• block_initial_reg_values (dict | None)• replacements (defaultdict[Any, dict] | None)• equivalence (set | None)• function (Function | None)• input_states (dict | None)keynode_iterations
input_statesstatesblock_initial_reg_values
replacements

702

Chapter 10. API Referenceangrequivalencegraph_visitor
downsize()block_beginning_state(block_addr)
Return typePropagatorState
class angr.knowledge_plugins.propagations.PropagationManager(kb)Bases: KnowledgeBasePlugin
Manages the results of Propagator, including intermediate results for unfinished Propagation runs.
__init__(kb)exists(prop_key)
Internal function to check if a func, specified as a CodeLocation exists in our known propagations
Parameters
prop_key (tuple) – A key of the propagation result.
Return typebool
Returns
Whether such a key exists or not.
update(prop_key, model)
Add the replacements to known propagations
Parameters• prop_key (tuple) – A key of the propagation result.
• model (PropagationModel) – The propagation result to store
Return type
Noneget(prop_key, default=None)
Gets the replacements for a specified function location. If the replacement does not exist in the known
propagations, it returns None.
Parameters• prop_key – A key of the propagation result.
• default – The default value to return if the prop_key does not exist in the cache.
Return typePropagationModel
Returns
Dict or Nonecopy()
discard_by_prefix(prefix)
Parameters
prefix (str)10.13. Knowledge Base

703

angr

class angr.knowledge_plugins.comments.Comments(kb)Bases: KnowledgeBasePlugin, dict
Tracks comments via a Dict of Address -> Text
Parameterskb (KnowledgeBase)copy() → a shallow copy of Dclass angr.knowledge_plugins.data.Data(kb)Bases: KnowledgeBasePlugin
The knowledge what purpose this plugin serves has been lost to the passing of time but the linter does not carefor these failures of mere mortals and demands a docstring anyway. The pact has been made, and no violationsof the rules will be tolerated, even if the spirit does not match the letter. Making the plugin smaller has only
increased the weight of the failure, and thus this file has drawn its ire.
The only thing left to do is to attempt to find meaning in the meaninglessness, as the only act of rebellion against
the uncaring forces that bind us. For is this not what being human is all about?
Parameterskb (KnowledgeBase)copy()
class angr.knowledge_plugins.indirect_jumps.IndirectJumps(kb)Bases: KnowledgeBasePlugin, dictThis plugin tracks the targets of indirect jumps__init__(kb)copy() → a shallow copy of D
update_resolved_addrs(indirect_address, resolved_addresses)
Parameters• indirect_address (int)• resolved_addresses (list[int])class angr.knowledge_plugins.labels.Labels(kb)Bases: KnowledgeBasePlugin__init__(kb)items()
get(addr)
Get a label as string for a given address Same as .labels[x]lookup(name)Returns an address to a given label To show all available labels, iterate over .labels or list(b.kb.labels)copy()
get_unique_label(label)
Get a unique label name from the given label name.
Parameterslabel (str) – The desired label name.
704

Chapter 10. API ReferenceangrReturns
A unique label name.
class angr.knowledge_plugins.functions.Function(function_manager, addr, name=None, syscall=None,
is_simprocedure=None, binary_name=None,is_plt=None, returning=None, alignment=False)
Bases: Serializable
A representation of a function and various information about it.
Parameters• is_simprocedure (bool | None)• is_plt (bool | None)__init__(function_manager, addr, name=None, syscall=None, is_simprocedure=None,binary_name=None, is_plt=None, returning=None, alignment=False)
Function constructor. If the optional parameters are not provided, they will be automatically determined
upon the creation of a Function object.
Parameters• addr – The address of the function.
• is_simprocedure (bool | None)• is_plt (bool | None)
The following parameters are optional.
Parameters• name (str) – The name of the function.
• syscall (bool) – Whether this function is a syscall or not.
• is_simprocedure (bool) – Whether this function is a SimProcedure or not.
• binary_name (str) – Name of the binary where this function is.
• is_plt (bool) – If this function is a PLT entry.
• returning (bool) – If this function returns.
• alignment (bool) – If this function acts as an alignment filler. Such functions usually
only contain nops.
transition_graphnormalized
addr
startpoint
is_alignment
bp_on_stackretaddr_on_stack
sp_delta

10.13. Knowledge Base

705

angr

prototype:

SimTypeFunction | None

prototype_libname:str | None

is_prototype_guessed:boolprepared_registers
prepared_stack_variables
registers_read_afterwards
info
tags
ran_cca
is_syscall
is_simprocedure
is_pltis_default_namefrom_signaturebinary_namecalling_convention:

SimCC | None

property alignment
property nameproperty projectproperty returning
property blocks
An iterator of all local blocks in the current function.
Returns
angr.lifter.Block instances.
property cyclomatic_complexity
The cyclomatic complexity of the function.
Cyclomatic complexity is a software metric used to indicate the complexity of a program. It is a quantitative
measure of the number of linearly independent paths through a program’s source code. It is computed using
the formula: M = E - N + 2P, where E = the number of edges in the graph, N = the number of nodes in thegraph, P = the number of connected components.
The cyclomatic complexity value is lazily computed and cached for future use. Initially this value is None
until it is computed for the first time
Returns
The cyclomatic complexity of the function.
Return type
int

706

Chapter 10. API Referenceangrproperty xrefs
An iterator of all xrefs of the current function.
Returns
angr.knowledge_plugins.xrefs.xref.XRef instances.
property block_addrs
An iterator of all local block addresses in the current function.
Returns
block addresses.
property block_addrs_set
Return a set of block addresses for a better performance of inclusion tests.
Returns
A set of block addresses.
Return type
set
get_block(addr, size=None, byte_string=None)
Getting a block out of the current function.
Parameters• addr (int) – The address of the block.
• size (int) – The size of the block. This is optional. If not provided, angr will load
• byte_string (Optional[bytes])
Returns
get_block_size(addr)
Return type
int | None
Parametersaddr (int)property nodes:

Iterable[CodeNode]get_node(addr)
Return type
Blockproperty has_unresolved_jumps
property has_unresolved_calls
property operations
All of the operations that are done by this functions.
property code_constants
All of the constants that are used by this functions’s code.
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.

10.13. Knowledge Base

707

angr

Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, **kwargs)
Parameters
cmsg
Return Function
The function instantiated out of the cmsg data.
string_references(minimum_length=2)
All of the constant string references used by this function.
Parameters
minimum_length – The minimum length of strings to find (default is 1)
Returns
A generator yielding tuples of (address, string) where is address is the location of the string
in memory.
property local_runtime_values
Tries to find all runtime values of this function which do not come from inputs. These values are generated
by starting from a blank state and reanalyzing the basic blocks once each. Function calls are skipped, andback edges are never taken so these values are often unreliable, This function is good at finding simple
constant addresses which the function will use or calculate.
Returnsa set of constants
property num_arguments
property endpoints
property endpoints_with_type
property ret_sites
property jumpout_sites
property retout_sites
property callout_sites
property size
property binary
Get the object this function belongs to. :return: The object this function belongs to.
property offset:

int

the function’s binary offset (i.e., non-rebased address)Type
return708

Chapter 10. API Referenceangrproperty symbol:

None | Symbol

the function’s Symbol, if any
Typereturnproperty pseudocode:str

the function’s pseudocodeTypereturnadd_jumpout_site(node)
Add a custom jumpout site.
Parametersnode – The address of the basic block that control flow leaves during this transition.
ReturnsNone
add_retout_site(node)
Add a custom retout site.
Retout (returning to outside of the function) sites are very rare. It mostly occurs during CFG recovery
when we incorrectly identify the beginning of a function in the first iteration, and then correctly identify
that function later in the same iteration (function alignments can lead to this bizarre case). We will markall edges going out of the header of that function as a outside edge, because all successors now belong to
the incorrectly-identified function. This identification error will be fixed in the second iteration of CFG
recovery. However, we still want to keep track of jumpouts/retouts during the first iteration so other logic
in CFG recovery still work.
Parametersnode – The address of the basic block that control flow leaves the current function after a call.
ReturnsNonemark_nonreturning_calls_endpoints()
Iterate through all call edges in transition graph. For each call a non-returning function, mark the source
basic block as an endpoint.
This method should only be executed once all functions are recovered and analyzed by CFG recovery, so
we know whether each function returns or not.
ReturnsNone
get_call_sites()
Gets a list of all the basic blocks that end in calls.
Return type
Iterable[int]Returns
A view of the addresses of the blocks that end in calls.
get_call_target(callsite_addr)
Get the target of a call.

10.13. Knowledge Base

709

angr

Parameters
callsite_addr – The address of a basic block that ends in a call.
Returns
The target of said call, or None if callsite_addr is not a callsite.
get_call_return(callsite_addr)
Get the hypothetical return address of a call.
Parameters
callsite_addr – The address of the basic block that ends in a call.
Returns
The likely return target of said call, or None if callsite_addr is not a callsite.
property graphGet a local transition graph. A local transition graph is a transition graph that only contains nodes thatbelong to the current function. All edges, except for the edges going out from the current function or
coming from outside the current function, are included.
The generated graph is cached in self._local_transition_graph.
Returns
A local transition graph.
Return typenetworkx.DiGraphgraph_ex(exception_edges=True)
Get a local transition graph with a custom configuration. A local transition graph is a transition graph that
only contains nodes that belong to the current function. This method allows user to exclude certain typesof edges together with the nodes that are only reachable through such edges, such as exception edges.
The generated graph is not cached.
Parameters
exception_edges (bool) – Should exception edges and the nodes that are only reachable
through exception edges be kept.
Returns
A local transition graph with a special configuration.
Return typenetworkx.DiGraphtransition_graph_ex(exception_edges=True)
Get a transition graph with a custom configuration. This method allows user to exclude certain types ofedges together with the nodes that are only reachable through such edges, such as exception edges.
The generated graph is not cached.
Parameters
exception_edges (bool) – Should exception edges and the nodes that are only reachable
through exception edges be kept.
Returns
A local transition graph with a special configuration.
Return typenetworkx.DiGraph

710

Chapter 10. API Referenceangrsubgraph(ins_addrs)
Generate a sub control flow graph of instruction addresses based on self.graphParameters
ins_addrs (iterable) – A collection of instruction addresses that should be included in
the subgraph.
Return networkx.DiGraph
A subgraph.
instruction_size(insn_addr)
Get the size of the instruction specified by insn_addr.
Parameters
insn_addr (int) – Address of the instruction
Return int
Size of the instruction in bytes, or None if the instruction is not found.
addr_to_instruction_addr(addr)
Obtain the address of the instruction that covers @addr.
Parametersaddr (int) – An address.
Returns
Address of the instruction that covers @addr, or None if this addr is not covered by any instruction of this function.
Return type
int or None
dbg_print()
Returns a representation of the list of basic blocks in this function.
dbg_draw(filename)
Draw the graph and save it to a PNG file.
property arguments
property has_return
property callable
normalize()
Make sure all basic blocks in the transition graph of this function do not overlap. You will end up with a
CFG that IDA Pro generates.
This method does not touch the CFG result. You may call CFG{Emulated, Fast}.normalize() for that matter.
ReturnsNonefind_declaration(ignore_binary_name=False, binary_name_hint=None)
Find the most likely function declaration from the embedded collection of prototypes, set it to self.prototype,and update self.calling_convention with the declaration.
Parameters• ignore_binary_name (bool) – Do not rely on the executable or library where the function belongs to determine its source library. This is useful when working on statically

10.13. Knowledge Base

711

angr

linked binaries (because all functions will belong to the main executable). We will search
for all libraries in angr to find the first declaration match.
• binary_name_hint (Optional[str]) – Substring of the library name where this function
might be originally coming from. Useful for FLIRT-identified functions in statically linked
binaries.
Return typebool
Returns
True if a declaration is found and self.prototype and self.calling_convention are updated.
False if we fail to find a matching function declaration, in which case self.prototype or
self.calling_convention will be kept untouched.
property demangled_nameget_unambiguous_name(display_name=None)
Get a disambiguated function name.
Parametersdisplay_name (Optional[str]) – Name to display, otherwise the function name.
Return type
str
Returns
The function name in the form: ::<name> when the function binary is the main object.
::<obj>::<name> when the function binary is not the main object. ::<addr>::<name> when
the function binary is an unnamed non-main object, or when multiple functions withthe same name are defined in the function binary.
apply_definition(definition, calling_convention=None)
Return type
None
Parameters• definition (str)• calling_convention (SimCC | type[SimCC] | None)
functions_reachable()
Return typeset[Function]
Returns
The set of all functions that can be reached from the function represented by self.
copy()
pp(**kwargs)
Pretty-print the function disassembly.
class angr.knowledge_plugins.functions.FunctionManager(kb)Bases: KnowledgeBasePlugin, MappingThis is a function boundaries management tool. It takes in intermediate results during CFG generation, andmanages a function map of the binary.

712

Chapter 10. API Referenceangr__init__(kb)copy()
clear()
get_by_addr(addr)
Return type
Function
get_by_name(name)Return type
Generator[Function]
Parametersname (str)contains_addr(addr)
Decide if an address is handled by the function manager.
Note: this function is non-conformant with python programming idioms, but its needed for performancereasons.
Parametersaddr (int) – Address of the function.
ceiling_func(addr)
Return the function who has the least address that is greater than or equal to addr.
Parametersaddr (int) – The address to query.
Returns
A Function instance, or None if there is no other function after addr.
Return type
Function or Nonefloor_func(addr)
Return the function who has the greatest address that is less than or equal to addr.
Parametersaddr (int) – The address to query.
Returns
A Function instance, or None if there is no other function before addr.
Return type
Function or Nonequery(query)
Query for a function using selectors to disambiguate. Supported variations: :rtype: Function | None::<name> Function <name> in the main object ::<addr>::<name> Function <name> at <addr>::<obj>::<name> Function <name> in <obj>
Parameters
query (str)10.13. Knowledge Base

713

angr

Return type
Function | None
function(addr=None, name=None, create=False, syscall=False, plt=None)
Get a function object from the function manager.
Pass either addr or name with the appropriate values.
Parameters• addr (int) – Address of the function.
• name (str) – Name of the function.
• create (bool) – Whether to create the function or not if the function does not exist.
• syscall (bool) – True to create the function as a syscall, False otherwise.
• plt (bool or None) – True to find the PLT stub, False to find a non-PLT stub, None todisable this restriction.
Returns
The Function instance, or None if the function is not found and create is False.
Return type
Function or Nonedbg_draw(prefix='dbg_function_')rebuild_callgraph()class angr.knowledge_plugins.functions.function_manager.FunctionDict(backref , *args, **kwargs)
Bases: SortedDict
FunctionDict is a dict where the keys are function starting addresses and map to the associated Function.
__init__(backref , *args, **kwargs)
Initialize sorted dict instance.
Optional key-function argument defines a callable that, like the key argument to the built-in sorted function,
extracts a comparison key from each dictionary key. If no function is specified, the default compares thedictionary keys directly. The key-function argument must be provided as a positional argument and mustcome before all other arguments.
Optional iterable argument provides an initial sequence of pairs to initialize the sorted dict. Each pair in thesequence defines the key and corresponding value. If a key is seen more than once, the last value associatedwith it is stored in the new sorted dict.
Optional mapping argument provides an initial mapping of items to initialize the sorted dict.
If keyword arguments are given, the keywords themselves, with their associated values, are added as items
to the dictionary. If a key is specified both in the positional argument and as a keyword argument, the value
associated with the keyword is stored in the sorted dict.
Sorted dict keys must be hashable, per the requirement for Python’s dictionaries. Keys (or the result of the
key-function) must also be comparable, per the requirement for sorted lists.
>>> d = {'alpha': 1, 'beta': 2}>>> SortedDict([('alpha', 1), ('beta', 2)]) == dTrue>>> SortedDict({'alpha': 1, 'beta': 2}) == dTrue(continues on next page)714

Chapter 10. API Referenceangr(continued from previous page)>>> SortedDict(alpha=1, beta=2) == dTrueget(addr)
Return the value for key if key is in the dictionary, else default.
floor_addr(addr)
ceiling_addr(addr)
class angr.knowledge_plugins.functions.function_manager.FunctionManager(kb)Bases: KnowledgeBasePlugin, MappingThis is a function boundaries management tool. It takes in intermediate results during CFG generation, andmanages a function map of the binary.
__init__(kb)copy()
clear()
get_by_addr(addr)
Return type
Function
get_by_name(name)Return type
Generator[Function]
Parametersname (str)contains_addr(addr)
Decide if an address is handled by the function manager.
Note: this function is non-conformant with python programming idioms, but its needed for performancereasons.
Parametersaddr (int) – Address of the function.
ceiling_func(addr)
Return the function who has the least address that is greater than or equal to addr.
Parametersaddr (int) – The address to query.
Returns
A Function instance, or None if there is no other function after addr.
Return type
Function or Nonefloor_func(addr)
Return the function who has the greatest address that is less than or equal to addr.
Parametersaddr (int) – The address to query.
10.13. Knowledge Base

715

angr

Returns
A Function instance, or None if there is no other function before addr.
Return type
Function or Nonequery(query)
Query for a function using selectors to disambiguate. Supported variations: :rtype: Function | None::<name> Function <name> in the main object ::<addr>::<name> Function <name> at <addr>::<obj>::<name> Function <name> in <obj>
Parameters
query (str)
Return type
Function | None
function(addr=None, name=None, create=False, syscall=False, plt=None)
Get a function object from the function manager.
Pass either addr or name with the appropriate values.
Parameters• addr (int) – Address of the function.
• name (str) – Name of the function.
• create (bool) – Whether to create the function or not if the function does not exist.
• syscall (bool) – True to create the function as a syscall, False otherwise.
• plt (bool or None) – True to find the PLT stub, False to find a non-PLT stub, None todisable this restriction.
Returns
The Function instance, or None if the function is not found and create is False.
Return type
Function or Nonedbg_draw(prefix='dbg_function_')rebuild_callgraph()class angr.knowledge_plugins.functions.function.Function(function_manager, addr, name=None,
syscall=None, is_simprocedure=None,binary_name=None, is_plt=None,
returning=None, alignment=False)
Bases: Serializable
A representation of a function and various information about it.
Parameters• is_simprocedure (bool | None)• is_plt (bool | None)

716

Chapter 10. API Referenceangr__init__(function_manager, addr, name=None, syscall=None, is_simprocedure=None,binary_name=None, is_plt=None, returning=None, alignment=False)
Function constructor. If the optional parameters are not provided, they will be automatically determined
upon the creation of a Function object.
Parameters• addr – The address of the function.
• is_simprocedure (bool | None)• is_plt (bool | None)
The following parameters are optional.
Parameters• name (str) – The name of the function.
• syscall (bool) – Whether this function is a syscall or not.
• is_simprocedure (bool) – Whether this function is a SimProcedure or not.
• binary_name (str) – Name of the binary where this function is.
• is_plt (bool) – If this function is a PLT entry.
• returning (bool) – If this function returns.
• alignment (bool) – If this function acts as an alignment filler. Such functions usually
only contain nops.
transition_graphnormalized
addr
startpoint
is_alignment
bp_on_stackretaddr_on_stack
sp_delta
prototype:

SimTypeFunction | None

prototype_libname:str | None

is_prototype_guessed:boolprepared_registers
prepared_stack_variables
registers_read_afterwards
info
tags

10.13. Knowledge Base

717

angr

ran_cca
is_syscall
is_simprocedure
is_pltis_default_namefrom_signaturebinary_namecalling_convention:

SimCC | None

property alignment
property nameproperty projectproperty returning
property blocks
An iterator of all local blocks in the current function.
Returns
angr.lifter.Block instances.
property cyclomatic_complexity
The cyclomatic complexity of the function.
Cyclomatic complexity is a software metric used to indicate the complexity of a program. It is a quantitative
measure of the number of linearly independent paths through a program’s source code. It is computed using
the formula: M = E - N + 2P, where E = the number of edges in the graph, N = the number of nodes in thegraph, P = the number of connected components.
The cyclomatic complexity value is lazily computed and cached for future use. Initially this value is None
until it is computed for the first time
Returns
The cyclomatic complexity of the function.
Return typeint
property xrefs
An iterator of all xrefs of the current function.
Returns
angr.knowledge_plugins.xrefs.xref.XRef instances.
property block_addrs
An iterator of all local block addresses in the current function.
Returns
block addresses.

718

Chapter 10. API Referenceangrproperty block_addrs_set
Return a set of block addresses for a better performance of inclusion tests.
Returns
A set of block addresses.
Return type
set
get_block(addr, size=None, byte_string=None)
Getting a block out of the current function.
Parameters• addr (int) – The address of the block.
• size (int) – The size of the block. This is optional. If not provided, angr will load
• byte_string (Optional[bytes])
Returns
get_block_size(addr)
Return type
int | None
Parametersaddr (int)property nodes:

Iterable[CodeNode]get_node(addr)
Return type
Blockproperty has_unresolved_jumps
property has_unresolved_calls
property operations
All of the operations that are done by this functions.
property code_constants
All of the constants that are used by this functions’s code.
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, **kwargs)
Parameters
cmsg
Return Function
The function instantiated out of the cmsg data.

10.13. Knowledge Base

719

angr

string_references(minimum_length=2)
All of the constant string references used by this function.
Parameters
minimum_length – The minimum length of strings to find (default is 1)
Returns
A generator yielding tuples of (address, string) where is address is the location of the string
in memory.
property local_runtime_values
Tries to find all runtime values of this function which do not come from inputs. These values are generated
by starting from a blank state and reanalyzing the basic blocks once each. Function calls are skipped, andback edges are never taken so these values are often unreliable, This function is good at finding simple
constant addresses which the function will use or calculate.
Returnsa set of constants
property num_arguments
property endpoints
property endpoints_with_type
property ret_sites
property jumpout_sites
property retout_sites
property callout_sites
property size
property binary
Get the object this function belongs to. :return: The object this function belongs to.
property offset:

int

the function’s binary offset (i.e., non-rebased address)Type
returnproperty symbol:

None | Symbol

the function’s Symbol, if any
Typereturnproperty pseudocode:str

the function’s pseudocodeTypereturnadd_jumpout_site(node)
Add a custom jumpout site.
Parametersnode – The address of the basic block that control flow leaves during this transition.
720

Chapter 10. API ReferenceangrReturnsNone
add_retout_site(node)
Add a custom retout site.
Retout (returning to outside of the function) sites are very rare. It mostly occurs during CFG recovery
when we incorrectly identify the beginning of a function in the first iteration, and then correctly identify
that function later in the same iteration (function alignments can lead to this bizarre case). We will markall edges going out of the header of that function as a outside edge, because all successors now belong to
the incorrectly-identified function. This identification error will be fixed in the second iteration of CFG
recovery. However, we still want to keep track of jumpouts/retouts during the first iteration so other logic
in CFG recovery still work.
Parametersnode – The address of the basic block that control flow leaves the current function after a call.
ReturnsNonemark_nonreturning_calls_endpoints()
Iterate through all call edges in transition graph. For each call a non-returning function, mark the source
basic block as an endpoint.
This method should only be executed once all functions are recovered and analyzed by CFG recovery, so
we know whether each function returns or not.
ReturnsNone
get_call_sites()
Gets a list of all the basic blocks that end in calls.
Return type
Iterable[int]Returns
A view of the addresses of the blocks that end in calls.
get_call_target(callsite_addr)
Get the target of a call.
Parameters
callsite_addr – The address of a basic block that ends in a call.
Returns
The target of said call, or None if callsite_addr is not a callsite.
get_call_return(callsite_addr)
Get the hypothetical return address of a call.
Parameters
callsite_addr – The address of the basic block that ends in a call.
Returns
The likely return target of said call, or None if callsite_addr is not a callsite.
property graphGet a local transition graph. A local transition graph is a transition graph that only contains nodes thatbelong to the current function. All edges, except for the edges going out from the current function or
coming from outside the current function, are included.
10.13. Knowledge Base

721

angr

The generated graph is cached in self._local_transition_graph.
Returns
A local transition graph.
Return typenetworkx.DiGraphgraph_ex(exception_edges=True)
Get a local transition graph with a custom configuration. A local transition graph is a transition graph that
only contains nodes that belong to the current function. This method allows user to exclude certain typesof edges together with the nodes that are only reachable through such edges, such as exception edges.
The generated graph is not cached.
Parameters
exception_edges (bool) – Should exception edges and the nodes that are only reachable
through exception edges be kept.
Returns
A local transition graph with a special configuration.
Return typenetworkx.DiGraphtransition_graph_ex(exception_edges=True)
Get a transition graph with a custom configuration. This method allows user to exclude certain types ofedges together with the nodes that are only reachable through such edges, such as exception edges.
The generated graph is not cached.
Parameters
exception_edges (bool) – Should exception edges and the nodes that are only reachable
through exception edges be kept.
Returns
A local transition graph with a special configuration.
Return typenetworkx.DiGraphsubgraph(ins_addrs)
Generate a sub control flow graph of instruction addresses based on self.graphParameters
ins_addrs (iterable) – A collection of instruction addresses that should be included in
the subgraph.
Return networkx.DiGraph
A subgraph.
instruction_size(insn_addr)
Get the size of the instruction specified by insn_addr.
Parameters
insn_addr (int) – Address of the instruction
Return int
Size of the instruction in bytes, or None if the instruction is not found.

722

Chapter 10. API Referenceangr

addr_to_instruction_addr(addr)
Obtain the address of the instruction that covers @addr.
Parametersaddr (int) – An address.
Returns
Address of the instruction that covers @addr, or None if this addr is not covered by any instruction of this function.
Return type
int or None
dbg_print()
Returns a representation of the list of basic blocks in this function.
dbg_draw(filename)
Draw the graph and save it to a PNG file.
property arguments
property has_return
property callable
normalize()
Make sure all basic blocks in the transition graph of this function do not overlap. You will end up with a
CFG that IDA Pro generates.
This method does not touch the CFG result. You may call CFG{Emulated, Fast}.normalize() for that matter.
ReturnsNonefind_declaration(ignore_binary_name=False, binary_name_hint=None)
Find the most likely function declaration from the embedded collection of prototypes, set it to self.prototype,and update self.calling_convention with the declaration.
Parameters• ignore_binary_name (bool) – Do not rely on the executable or library where the function belongs to determine its source library. This is useful when working on staticallylinked binaries (because all functions will belong to the main executable). We will search
for all libraries in angr to find the first declaration match.
• binary_name_hint (Optional[str]) – Substring of the library name where this function
might be originally coming from. Useful for FLIRT-identified functions in statically linked
binaries.
Return typebool
Returns
True if a declaration is found and self.prototype and self.calling_convention are updated.
False if we fail to find a matching function declaration, in which case self.prototype or
self.calling_convention will be kept untouched.
property demangled_name10.13. Knowledge Base

723

angr

get_unambiguous_name(display_name=None)
Get a disambiguated function name.
Parametersdisplay_name (Optional[str]) – Name to display, otherwise the function name.
Return type
str
Returns
The function name in the form: ::<name> when the function binary is the main object.
::<obj>::<name> when the function binary is not the main object. ::<addr>::<name> when
the function binary is an unnamed non-main object, or when multiple functions withthe same name are defined in the function binary.
apply_definition(definition, calling_convention=None)
Return type
None
Parameters• definition (str)• calling_convention (SimCC | type[SimCC] | None)
functions_reachable()
Return typeset[Function]
Returns
The set of all functions that can be reached from the function represented by self.
copy()
pp(**kwargs)
Pretty-print the function disassembly.
class angr.knowledge_plugins.functions.function_parser.FunctionParser
Bases: object
The implementation of the serialization methods for the <Function> class.
static serialize(function):return :static parse_from_cmsg(cmsg, function_manager=None, project=None, all_func_addrs=None)
Parameters
cmsg – The data to instantiate the <Function> from.
Return Function
class angr.knowledge_plugins.functions.soot_function.SootFunction(function_manager, addr,
name=None, syscall=None)
Bases: Function
A representation of a function and various information about it.

724

Chapter 10. API Referenceangr__init__(function_manager, addr, name=None, syscall=None)
Function constructor for Soot
Parameters• addr – The address of the function.
• name – (Optional) The name of the function.
• syscall – (Optional) Whether this function is a syscall or not.
transition_graphnormalized
addr
is_syscall
is_pltis_simprocedurebinary_namebp_on_stackretaddr_on_stack
sp_delta
calling_convention:
prototype:

SimCC | None

SimTypeFunction | None

prepared_registers
prepared_stack_variables
registers_read_afterwards
startpoint
info
tags
normalize()
Make sure all basic blocks in the transition graph of this function do not overlap. You will end up with a
CFG that IDA Pro generates.
This method does not touch the CFG result. You may call CFG{Emulated, Fast}.normalize() for that matter.
ReturnsNone
is_default_namefrom_signature
prototype_libname:10.13. Knowledge Basestr | None

725

angr

is_alignment
is_prototype_guessed:bool

ran_ccaclass angr.knowledge_plugins.variables.VariableManager(kb)Bases: KnowledgeBasePlugin
Manage variables.
__init__(kb)has_function_manager(key)
Return typebool
Parameters
key (int)
get_function_manager(func_addr)
Return type
VariableManagerInternal
initialize_variable_names()
Return type
None
get_variable_accesses(variable, same_name=False)
Get a list of all references to the given variable.
Parameters• variable (SimVariable) – The variable.
• same_name (bool) – Whether to include all variables with the same variable name, or justbased on the variable identifier.
Return type
list[VariableAccess]
Returns
All references to the variable.
copy()
static convert_variable_list(vlist, manager)
Parameters• vlist (list[Variable])• manager (VariableManagerInternal)
load_from_dwarf(cu_list=None)
Parameters
cu_list (list[CompilationUnit] | None)

726

Chapter 10. API Referenceangrclass angr.knowledge_plugins.variables.VariableType
Bases: object
Describes variable types.
REGISTER = 0
MEMORY = 1
class angr.knowledge_plugins.variables.variable_access.VariableAccessSort
Bases: object
Provides enums for variable access types.
WRITE = 0
READ = 1
REFERENCE = 2class angr.knowledge_plugins.variables.variable_access.VariableAccess(variable, access_type,location, offset,
atom_hash=None)
Bases: Serializable
Describes a variable access.
__init__(variable, access_type, location, offset, atom_hash=None)
variable:

SimVariable

access_type:location:
offset:int

CodeLocation

int | None

atom_hash:int | None

serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, variable_by_ident=None, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters• cmsg – The probobuf cmessage object.
• variable_by_ident (dict[str, SimVariable] | None)
Returns
A unserialized class object.
Return typecls

10.13. Knowledge Base

727

angr

class angr.knowledge_plugins.variables.variable_manager.VariableType
Bases: object
Describes variable types.
REGISTER = 0
MEMORY = 1
class angr.knowledge_plugins.variables.variable_manager.LiveVariables(register_region,
stack_region)
Bases: object
A collection of live variables at a program point.
__init__(register_region, stack_region)
register_region
stack_region
class angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal(manager,
func_addr=None)
Bases: Serializable
Manage variables for a function. It is meant to be used internally by VariableManager, but it’s common to begiven a reference to one in response to a query for “the variables for a given function”. Maybe a better namewould be “VariableManagerScope”.
__init__(manager, func_addr=None)
set_manager(manager)
Parameters
manager (VariableManager)
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, variable_manager=None, func_addr=None, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return type
cls
next_variable_ident(sort)

728

Chapter 10. API Referenceangr

add_variable(sort, start, variable)
Parameters
variable (SimVariable)
set_variable(sort, start, variable)
Parameters
variable (SimVariable)
write_to(variable, offset, location, overwrite=False, atom=None)
read_from(variable, offset, location, overwrite=False, atom=None)reference_at(variable, offset, location, overwrite=False, atom=None)
record_variable(location, variable, offset, overwrite=False, atom=None)
Parameters
location (CodeLocation)
remove_variable_by_atom(location, variable, atom)
Parameters• location (CodeLocation)• variable (SimVariable)
make_phi_node(block_addr, *variables)
Create a phi variable for variables at block block_addr.
Parameters• block_addr (int) – The address of the current block.
• variables – Variables that the phi variable represents.
Returns
The created phi variable.
set_live_variables(addr, register_region, stack_region)
find_variables_by_insn(ins_addr, sort)
is_variable_used_at(variable, loc)
Return typebool
Parameters• variable (SimVariable)• loc (tuple[int, int])
find_variable_by_stmt(block_addr, stmt_idx, sort, block_idx=None)
Parameters
block_idx (int | None)

10.13. Knowledge Base

729

angr

find_variables_by_stmt(block_addr, stmt_idx, sort, block_idx=None)
Return type
list[tuple[SimVariable, int]]
Parameters• block_addr (int)• stmt_idx (int)• sort (str)• block_idx (int | None)find_variable_by_atom(block_addr, stmt_idx, atom, block_idx=None)
Parameters
block_idx (int | None)find_variables_by_atom(block_addr, stmt_idx, atom, block_idx=None)
Return typeset[tuple[SimVariable, int]]
Parameters
block_idx (int | None)find_variables_by_stack_offset(offset)
Return typeset[SimVariable]
Parameters
offset (int)find_variables_by_register(reg)Return typeset[SimVariable]
Parametersreg (str | int)
get_variable_accesses(variable, same_name=False)
Return type
list[VariableAccess]Parameters• variable (SimVariable)• same_name (bool)
get_variables(sort=None, collapse_same_ident=False)
Get a list of variables.
Parameters• sort (Optional[Literal['stack', 'reg']]) – Sort of the variable to get.
• collapse_same_ident – Whether variables of the same identifier should be collapsed or
not.

730

Chapter 10. API ReferenceangrReturn type
list[SimStackVariable | SimRegisterVariable]
Returns
A list of variables.
get_unified_variables(sort=None)
Get a list of unified variables.
Parameters
sort (Optional[Literal['stack', 'reg']]) – Sort of the variable to get.
Return type
list[SimStackVariable | SimRegisterVariable]
Returns
A list of variables.
get_global_variables(addr)
Get global variable by the address of the variable.
Parametersaddr (int) – Address of the variable.
Returns
A set of variables or an empty set if no variable exists.
is_phi_variable(var)Test if var is a phi variable.
Parametersvar (SimVariable) – The variable instance.
Returns
True if var is a phi variable, False otherwise.
Return typebool
get_phi_subvariables(var)
Get sub-variables that phi variable var represents.
Parametersvar (SimVariable) – The variable instance.
Returns
A set of sub-variables, or an empty set if var is not a phi variable.
Return type
set
get_phi_variables(block_addr)
Get a dict of phi variables and their corresponding variables.
Parameters
block_addr (int) – Address of the block.
Returns
A dict of phi variables of an empty dict if there are no phi variables at the block.
Return type
dict10.13. Knowledge Base

731

angr

get_variables_without_writes()
Get all variables that have never been written to.
Return type
list[SimVariable]
Returns
A list of variables that are never written to.
input_variables(exclude_specials=True)
Get all variables that have never been written to.
Returns
A list of variables that are never written to.
Parameters
exclude_specials (bool)
assign_variable_names(labels=None, types=None)
Assign default names to all SSA variables.
Parameterslabels – Known labels in the binary.
ReturnsNoneassign_unified_variable_names(labels=None, arg_names=None, reset=False, func_blocks=None)
Assign default names to all unified variables. If func_blocks is provided, we will find out variables that are
only ever written to in Phi assignments and never used elsewhere, and put these variables at the end of thesorted list. These variables are likely completely removed during the dephication process.
Parameters• labels – Known labels in the binary.
• arg_names (Optional[list[str]]) – Known argument names.
• reset (bool) – Reset all variable names or not.
• func_blocks (Optional[list[Block]]) – A list of function blocks of the function wherethese variables are accessed.
Return type
None
set_variable_type(var, ty, name=None, override_bot=True, all_unified=False, mark_manual=False)
Return type
None
Parameters• var (SimVariable)• ty (SimType)• name (str | None)• override_bot (bool)• all_unified (bool)• mark_manual (bool)

732

Chapter 10. API Referenceangr

get_variable_type(var)
Return type
SimType | Noneremove_types()
unify_variables()
Map SSA variables to a unified variable. Fill in self._unified_variables.
Return type
None
set_unified_variable(variable, unified)
Set the unified variable for a given SSA variable.
Parameters• variable (SimVariable) – The SSA variable.
• unified (SimVariable) – The unified variable.
Return type
None
ReturnsNone
unified_variable(variable)
Return the unified variable for a given SSA variable,
Parameters
variable (SimVariable) – The SSA variable.
Return type
SimVariable | None
Returns
The unified variable, or None if there is no such SSA variable.
class angr.knowledge_plugins.variables.variable_manager.VariableManager(kb)Bases: KnowledgeBasePlugin
Manage variables.
__init__(kb)has_function_manager(key)
Return typebool
Parameters
key (int)
get_function_manager(func_addr)
Return type
VariableManagerInternal

10.13. Knowledge Base

733

angr

initialize_variable_names()
Return type
None
get_variable_accesses(variable, same_name=False)
Get a list of all references to the given variable.
Parameters• variable (SimVariable) – The variable.
• same_name (bool) – Whether to include all variables with the same variable name, or justbased on the variable identifier.
Return type
list[VariableAccess]
Returns
All references to the variable.
copy()
static convert_variable_list(vlist, manager)
Parameters• vlist (list[Variable])• manager (VariableManagerInternal)
load_from_dwarf(cu_list=None)
Parameters
cu_list (list[CompilationUnit] | None)class angr.knowledge_plugins.debug_variables.DebugVariableContainer
Bases: object
Variable tree for variables with same name to lock up which variable is visible at a given program counter address.
__init__()
It is recommended to use DebugVariableManager.add_variable() instead
from_pc(pc)Returns the visible variable (if any) for a given pc address.
Return type
Variableclass angr.knowledge_plugins.debug_variables.DebugVariable(low_pc, high_pc, cle_variable)
Bases: DebugVariableContainer
Variables• low_pc – Start of the visibility scope of the variable as program counter address (rebased)• high_pc – End of the visibility scope of the variable as program counter address (rebased)• cle_variable – Original variable from cle
Parameters• low_pc (int)734

Chapter 10. API Referenceangr• high_pc (int)• cle_variable (Variable)__init__(low_pc, high_pc, cle_variable)
It is recommended to use DebugVariableManager.add_variable() instead
Parameters• low_pc (int)• high_pc (int)• cle_variable (Variable)
from_pc(pc)Returns the visible variable (if any) for a given pc address.
Return type
Variable
contains(dvar)
Return typebool
Parameters
dvar (DebugVariable)
test_unsupported_overlap(dvar)
Test for an unsupported overlapping
Parameters
dvar (DebugVariable) – Second DebugVariable to compare with
Return typebool
Returns
True if there is an unsupported overlappingclass angr.knowledge_plugins.debug_variables.DebugVariableManager(kb)Bases: KnowledgeBasePlugin
Structure to manage and access variables with different visibility scopes.
Parameterskb (KnowledgeBase)__init__(kb)Parameterskb (KnowledgeBase)
from_name_and_pc(var_name, pc_addr)
Get a variable from its string in the scope of pc.
Return type
Variable
Parameters• var_name (str)• pc_addr (int)
10.13. Knowledge Base

735

angr

from_name(var_name)Get the variable container for all variables named var_name
Parameters
var_name (str) – name for a variable
Return type
DebugVariableContainer
add_variable(cle_var, low_pc, high_pc)
Add/load a variable
Parameters• cle_variable – The variable to add• low_pc (int) – Start of the visibility scope of the variable as program counter address(rebased)• high_pc (int) – End of the visibility scope of the variable as program counter address(rebased)• cle_var (Variable)
add_variable_list(vlist, low_pc, high_pc)
Add all variables in a list with the same visibility range
Parameters• vlist (list[Variable]) – A list of cle variables to add• low_pc (int) – Start of the visibility scope as program counter address (rebased)• high_pc (int) – End of the visibility scope as program counter address (rebased)
load_from_dwarf(elf_object=None, cu=None)
Automatically load all variables (global/local) from the DWARF debugging info
Parameters• elf_object (Optional[ELF]) – Optional, when only one elf object should be considered(e.g. p.loader.main_object)• cu (Optional[CompilationUnit]) – Optional, when only one compilation unit should
be consideredclass angr.knowledge_plugins.structured_code.StructuredCodeManager(kb)Bases: KnowledgeBasePlugin
A knowledge base plugin to store structured code generator results.
__init__(kb)discard(key)available_flavors(item)
copy()
class angr.knowledge_plugins.key_definitions.ReachingDefinitionsModel(func_addr=None,
track_liveness=True)
Bases: object
Models the definitions, uses, and memory of a ReachingDefinitionState object
736

Chapter 10. API ReferenceangrParameters• func_addr (int | None)• track_liveness (bool)__init__(func_addr=None, track_liveness=True)
Parameters• func_addr (int | None)• track_liveness (bool)
add_def(d)Return type
None
Parametersd (Definition)kill_def(d)Return type
None
Parametersd (Definition)
at_new_stmt(codeloc)
Return type
None
Parameterscodeloc (CodeLocation)
at_new_block(code_loc, pred_codelocs)
Return type
None
Parameters• code_loc (CodeLocation)• pred_codelocs (list[CodeLocation])
make_liveness_snapshot()
Return type
Nonefind_defs_at(code_loc, op=ObservationPointType.OP_BEFORE)
Return typeset[Definition]
Parameters• code_loc (CodeLocation)• op (int)

10.13. Knowledge Base

737

angr

get_defs(atom, code_loc, op)
Return typeset[Definition]
Parameters• atom (Atom)• code_loc (CodeLocation)• op (int)copy()
Return type
ReachingDefinitionsModel
merge(model)
Parametersmodel (ReachingDefinitionsModel)
get_observation_by_insn(ins_addr, kind)
Return type
LiveDefinitions | None
Parameters• ins_addr (int | CodeLocation)• kind (ObservationPointType)
get_observation_by_node(node_addr, kind, node_idx=None)
Return type
LiveDefinitions | None
Parameters• node_addr (int | CodeLocation)• kind (ObservationPointType)• node_idx (int | None)
get_observation_by_stmt(arg1, arg2, arg3=None, *, block_idx=None)
get_observation_by_exit(node_addr, stmt_idx, src_node_idx=None)
Return type
LiveDefinitions | None
Parameters• node_addr (int)• stmt_idx (int)• src_node_idx (int | None)

738

Chapter 10. API Referenceangrclass angr.knowledge_plugins.key_definitions.KeyDefinitionManager(kb)Bases: KnowledgeBasePlugin
KeyDefinitionManager manages and caches reaching definition models for each function.
For each function, by default we cache the entire reaching definitions model with observed results at the following
locations: - Before each call instruction: (‘insn’, address of the call instruction, OP_BEFORE) - After returningfrom each call: (‘node’, address of the block that ends with a call, OP_AFTER)
Parameterskb (KnowledgeBase)__init__(kb)Parameterskb (KnowledgeBase)
has_model(func_addr)
Parameters
func_addr (int)
get_model(func_addr)
Parameters
func_addr (int)copy()
Return type
KeyDefinitionManager
class angr.knowledge_plugins.key_definitions.LiveDefinitions(arch, track_tmps=False,
canonical_size=8, registers=None,
stack=None, memory=None,
heap=None, tmps=None,others=None, register_uses=None,
stack_uses=None, heap_uses=None,memory_uses=None,
tmp_uses=None, other_uses=None,element_limit=5,
merge_into_tops=True)
Bases: object
A LiveDefinitions instance contains definitions and uses for register, stack, memory, and temporary variables,
uncovered during the analysis.
Parameters• arch (archinfo.Arch )• track_tmps (bool)• merge_into_tops (bool)
INITIAL_SP_32BIT = 2147418112
INITIAL_SP_64BIT = 140737488289792

10.13. Knowledge Base

739

angr

__init__(arch, track_tmps=False, canonical_size=8, registers=None, stack=None, memory=None,
heap=None, tmps=None, others=None, register_uses=None, stack_uses=None, heap_uses=None,memory_uses=None, tmp_uses=None, other_uses=None, element_limit=5,
merge_into_tops=True)
Parameters• arch (Arch )• track_tmps (bool)• merge_into_tops (bool)project:

Project | Nonearch
track_tmps
registers:

MultiValuedMemory

stack:

MultiValuedMemory

memory:MultiValuedMemory

heap:

MultiValuedMemory

tmps:

dict[int, set[Definition]]others:dict[Atom , MultiValues]

register_uses
stack_uses
heap_uses
memory_uses
tmp_uses:

dict[int, set[CodeLocation]]other_uses
uses_by_codeloc:

dict[CodeLocation, set[Definition]]

property register_definitions
property stack_definitions
property memory_definitions
property heap_definitions
copy(discard_tmpdefs=False)
Return type
LiveDefinitions
reset_uses()

740

Chapter 10. API Referenceangrstatic top(bits)
Get a TOP value.
Parametersbits (int) – Width of the TOP value (in bits).
Returns
The TOP value.
static is_top(expr)
Check if the given expression is a TOP value.
Parameters
expr – The given expression.
Return typebool
Returns
True if the expression is TOP, False otherwise.
stack_address(offset)
Return type
BV | None
Parameters
offset (int)static is_stack_address(addr)
Return typebool
Parametersaddr (Base)static get_stack_offset(addr, had_stack_base=False)
Return type
int | None
Parametersaddr (Base)static annotate_with_def(symvar, definition)
Parameters• symvar (BV)
• definition (Definition)
Return type
BV
Returnsstatic extract_defs(symvar)
Return type
Generator[Definition]

10.13. Knowledge Base

741

angr

Parameterssymvar (Base)static extract_defs_from_annotations(annos)
Return typeset[Definition]
Parameters
annos (Iterable[Annotation])
static extract_defs_from_mv(mv)Return type
Generator[Definition]
Parameters
mv (MultiValues)
get_sp()Return the concrete value contained by the stack pointer.
Return typeint
get_sp_offset()
Return the offset of the stack pointer.
Return type
int | None
get_stack_address(offset)
Return type
int | None
Parameters
offset (Base)stack_offset_to_stack_addr(offset)
Return type
intmerge(*others)
Return typetuple[LiveDefinitions, bool]
Parameters
others (LiveDefinitions)compare(other)
Return typebool
Parameters
other (LiveDefinitions)742

Chapter 10. API Referenceangrkill_definitions(atom)
Overwrite existing definitions w.r.t ‘atom’ with a dummy definition instance. A dummy definition will not
be removed during simplification.
Parametersatom (Atom)
Return type
None
ReturnsNonekill_and_add_definition(atom, code_loc, data, dummy=False, tags=None, endness=None,annotated=False)
Return typeMultiValues | None
Parameters• atom (Atom)• code_loc (CodeLocation)• data (MultiValues)• tags (set[Tag] | None)
add_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (Atom)• code_loc (CodeLocation)• expr (Any | None)
add_use_by_def(definition, code_loc, expr=None)
Return type
None
Parameters• definition (Definition)• code_loc (CodeLocation)• expr (Any | None)
get_definitions(thing)
Return typeset[Definition[Atom]]Parameters
thing(A | Definition[A] | Iterable[A] | Iterable[Definition[A]] |MultiValues)

10.13. Knowledge Base

743

angr

get_tmp_definitions(tmp_idx)
Return typeset[Definition]
Parameters
tmp_idx (int)
get_register_definitions(reg_offset, size)
Return typeset[Definition]
Parameters• reg_offset (int)• size (int)
get_stack_values(stack_offset, size, endness)
Return typeMultiValues | None
Parameters• stack_offset (int)• size (int)• endness (str)
get_stack_definitions(stack_offset, size)
Return typeset[Definition]
Parameters• stack_offset (int)• size (int)
get_heap_definitions(heap_addr, size)
Return typeset[Definition]
Parameters• heap_addr (int)• size (int)
get_memory_definitions(addr, size)
Return typeset[Definition]
Parameters• addr (int)• size (int)
get_definitions_from_atoms(**kwargs)

744

Chapter 10. API Referenceangr

get_value_from_definition(**kwargs)
get_one_value_from_definition(**kwargs)
get_concrete_value_from_definition(**kwargs)
get_value_from_atom(**kwargs)
get_one_value_from_atom(**kwargs)
get_concrete_value_from_atom(**kwargs)
get_values(spec)
Return typeMultiValues | None
Parametersspec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])get_one_value(spec, strip_annotations=False)
Return type
BV | None
Parameters• spec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])• strip_annotations (bool)
get_concrete_value(spec, cast_to=<class 'int'>)
Return type
int | bytes | None
Parameters• spec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])• cast_to (type[int] | type[bytes])
add_register_use(reg_offset, size, code_loc, expr=None)
Return type
None
Parameters• reg_offset (int)• size (int)• code_loc (CodeLocation)• expr (Any | None)
add_register_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)

10.13. Knowledge Base

745

angr

• code_loc (CodeLocation)• expr (Any | None)
add_stack_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)
add_stack_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_heap_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)
add_heap_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_memory_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)

746

Chapter 10. API Referenceangr

add_memory_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_tmp_use(atom, code_loc)
Return type
None
Parameters• atom (Tmp)• code_loc (CodeLocation)
add_tmp_use_by_def(def_, code_loc)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)
deref(pointer, size, endness=Endness.BE)
static is_heap_address(addr)
Return typebool
Parametersaddr (Base)static get_heap_offset(addr)
Return type
int | None
Parametersaddr (Base)heap_address(offset)
Return type
BV
Parameters
offset (int | HeapAddress)
class angr.knowledge_plugins.key_definitions.DerefSize(value)
Bases: Enum
An enum for specialized kinds of dereferences

10.13. Knowledge Base

747

angr

NULL_TERMINATE - Dereference until the first byte which could be a literal null. Return a value
including theterminator.
NULL_TERMINATE = 1
class angr.knowledge_plugins.key_definitions.Uses(uses_by_definition=None,
uses_by_location=None)
Bases: object
Describes uses (including the use location and the use expression) for definitions.
Parameters• uses_by_definition (DefaultChainMapCOW | None)• uses_by_location (DefaultChainMapCOW | None)__init__(uses_by_definition=None, uses_by_location=None)
Parameters• uses_by_definition (DefaultChainMapCOW | None)• uses_by_location (DefaultChainMapCOW | None)
add_use(definition, codeloc, expr=None)
Add a use for a given definition.
Parameters• definition (Definition) – The definition that is used.
• codeloc (CodeLocation) – The code location where the use occurs.
• expr (Optional[Any]) – The expression that uses the specified definition at this location.
get_uses(definition)
Retrieve the uses of a given definition.
Parameters
definition (Definition) – The definition for which we get the uses.
Return typeset[CodeLocation]
get_uses_with_expr(definition)
Retrieve the uses and the corresponding expressions of a given definition.
Parameters
definition (Definition) – The definition for which we get the uses and the corresponding
expressions.
Return typeset[tuple[CodeLocation, Optional[Any]]]
remove_use(definition, codeloc, expr=None)
Remove one use of a given definition.
Parameters• definition (Definition) – The definition of which to remove the uses.
• codeloc (CodeLocation) – The code location where the use is.

748

Chapter 10. API Referenceangr• expr (Optional[Any]) – The expression that uses the definition at the given location.
Return type
None
ReturnsNoneremove_uses(definition)
Remove all uses of a given definition.
Parameters
definition (Definition) – The definition of which to remove the uses.
ReturnsNone
get_uses_by_location(codeloc, exprs=False)
Retrieve all definitions that are used at a given location.
Parameters• codeloc (CodeLocation) – The code location.
• exprs (bool)
Return typeset[Definition] | set[tuple[Definition, Optional[Any]]]
Returns
A set of definitions that are used at the given location.
get_uses_by_insaddr(ins_addr, exprs=False)
Retrieve all definitions that are used at a given location specified by the instruction address.
Parameters• ins_addr (int) – The instruction address.
• exprs (bool)
Return typeset[Definition] | set[tuple[Definition, Optional[Any]]]
Returns
A set of definitions that are used at the given location.
copy()
Copy the instance.
Return type
Uses
Returns
Return a new <Uses> instance containing the same data.
merge(other)Merge an instance of <Uses> into the current instance.
Parameters
other (Uses) – The other <Uses> from which the data will be added to the current instance.
Return typebool

10.13. Knowledge Base

749

angr

Returns
True if any merge occurred, False otherwiseclass angr.knowledge_plugins.key_definitions.Definition(atom, codeloc, dummy=False, tags=None)
Bases: Generic[A]An atom definition.
Variables• atom – The atom being defined.
• codeloc – Where this definition is created in the original binary code.
• dummy – Tell whether the definition should be considered dummy or not. During simplification by AILment, definitions marked as dummy will not be removed.
• tags – A set of tags containing information about the definition gathered during analyses.
Parameters• atom (A)• codeloc (CodeLocation)• dummy (bool)• tags (set[Tag] | None)__init__(atom, codeloc, dummy=False, tags=None)
Parameters• atom (A)• codeloc (CodeLocation)• dummy (bool)• tags (set[Tag] | None)
atom:

TypeVar(A, bound= Atom )codeloc:
dummy:

CodeLocation
bool

tags
property offset:
property size:

int
int

matches(**kwargs)
Return whether this definition has certain characteristics.
Return typeboolclass angr.knowledge_plugins.key_definitions.atoms.AtomKind(value)
Bases: Enum
An enum indicating the class of an atom
REGISTER = 1

750

Chapter 10. API Referenceangr

MEMORY = 2
TMP = 3
GUARD = 4
CONSTANT = 5class angr.knowledge_plugins.key_definitions.atoms.Atom(size)
Bases: object
This class represents a data storage location manipulated by IR instructions.
It could either be a Tmp (temporary variable), a Register, a MemoryLocation.
__init__(size)
Parameters
size – The size of the atom in bytes
size
property bits:

int

static from_ail_expr(expr, arch, full_reg=False)
Return type
RegisterParameters• expr (Expression)• arch (Arch )• full_reg (bool)
static from_argument(argument, arch, full_reg=False, sp=None)
Instantiate an Atom from a given argument.
Parameters• argument (SimFunctionArgument) – The argument to create a new atom from.
• arch (Arch) – The argument representing archinfo architecture for argument.
• full_reg – Whether to return an atom indicating the entire register if the argument only
specifies a slice of the register.
• sp (Optional[int]) – The current stack offset. Optional. Only used when argument is a
SimStackArg.
Return type
Register | MemoryLocation
static reg(thing, size=None, arch=None)
Create a Register atom.
Parameters• thing(str|
RegisterOffset)–
The
registerproject.arch.registers[“rax”][0]) or the register name (e.g., “rax”).

offset(e.g.,• size (Optional[int]) – Size of the register atom. Must be provided when creating theatom using a register offset.
10.13. Knowledge Base

751

angr

• arch (Optional[Arch]) – The architecture. Must be provided when creating the atom
using a register name.
Return type
Register
Returns
The Register Atom object.
static register(thing, size=None, arch=None)
Create a Register atom.
Parameters• thing(str|
RegisterOffset)–
The
registerproject.arch.registers[“rax”][0]) or the register name (e.g., “rax”).

offset(e.g.,• size (Optional[int]) – Size of the register atom. Must be provided when creating theatom using a register offset.
• arch (Optional[Arch]) – The architecture. Must be provided when creating the atom
using a register name.
Return type
Register
Returns
The Register Atom object.
static mem(addr, size, endness=None)
Create a MemoryLocation atom,
Parameters• addr (SpOffset | HeapAddress | int) – The memory location. Can be an SpOffset for
stack variables, an int for global memory variables, or a HeapAddress for items on the heap.
• size (int) – Size of the atom.
• endness (Optional[str]) – Optional, either “Iend_LE” or “Iend_BE”.
Return type
MemoryLocation
Returns
The MemoryLocation Atom object.
static memory(addr, size, endness=None)
Create a MemoryLocation atom,
Parameters• addr (SpOffset | HeapAddress | int) – The memory location. Can be an SpOffset for
stack variables, an int for global memory variables, or a HeapAddress for items on the heap.
• size (int) – Size of the atom.
• endness (Optional[str]) – Optional, either “Iend_LE” or “Iend_BE”.
Return type
MemoryLocation
Returns
The MemoryLocation Atom object.

752

Chapter 10. API Referenceangrclass angr.knowledge_plugins.key_definitions.atoms.GuardUse(target)
Bases: Atom
Implements a guard use.
__init__(target)
Parameters
size – The size of the atom in bytes
targetclass angr.knowledge_plugins.key_definitions.atoms.ConstantSrc(value, size)
Bases: Atom
Represents a constant.
Parameters• value (int)• size (int)__init__(value, size)
Parameters• size (int) – The size of the atom in bytes• value (int)value:

intclass angr.knowledge_plugins.key_definitions.atoms.Tmp(tmp_idx, size)
Bases: Atom
Represents a variable used by the IR to store intermediate values.
Parameters• tmp_idx (int)• size (int)__init__(tmp_idx, size)
Parameters• size (int) – The size of the atom in bytes• tmp_idx (int)tmp_idxclass angr.knowledge_plugins.key_definitions.atoms.Register(reg_offset, size, arch=None)
Bases: Atom
Represents a given CPU register.
As an IR abstracts the CPU design to target different architectures, registers are represented as a separated memory space. Thus a register is defined by its offset from the base of this memory and its size.
Variables• reg_offset (int) – The offset from the base to define its place in the memory bloc.
• size (int) – The size, in number of bytes.
10.13. Knowledge Base

753

angr

Parameters• reg_offset (RegisterOffset)• size (int)• arch (Arch | None)__init__(reg_offset, size, arch=None)
Parameters• size (int) – The size of the atom in bytes• reg_offset (RegisterOffset)• arch (Arch | None)
reg_offset
archproperty name:strclass angr.knowledge_plugins.key_definitions.atoms.VirtualVariable(varid, size, category,oident=None)
Bases: Atom
Represents a virtual variable.
Parameters• varid (int)• size (int)• category (ailment.Expr.VirtualVariableCategory)• oident (str | int | None)__init__(varid, size, category, oident=None)
Parameters• size (int) – The size of the atom in bytes• varid (int)• category (VirtualVariableCategory)• oident (str | int | None)varid
categoryoidentproperty was_reg:boolproperty was_stack:boolproperty was_parameter:
property reg_offset:

754

bool

int | None

Chapter 10. API Referenceangrproperty stack_offset:

int | Noneclass angr.knowledge_plugins.key_definitions.atoms.MemoryLocation(addr, size, endness=None)
Bases: Atom
Represents a memory slice.
It is characterized by its address and its size.
Parameters• addr (SpOffset | HeapAddress | int)
• size (int)• endness (str | None)__init__(addr, size, endness=None)
Parameters• addr (int) – The address of the beginning memory location slice.
• size (int) – The size of the represented memory location, in bytes.
• endness (str | None)
addr:

SpOffset | int | BV

endness
property is_on_stack:bool

True if this memory location is located on the stack.
property symbolic:boolclass angr.knowledge_plugins.key_definitions.constants.ObservationPointType(value)
Bases: IntEnum
Enum to replace the previously generic constants This makes it possible to annotate where they are expected bytyping something as ObservationPointType instead of Literal[0,1]OP_BEFORE = 0
OP_AFTER = 1
class angr.knowledge_plugins.key_definitions.definition.DefinitionMatchPredicate(kind=None,bbl_addr=None,
ins_addr=None,
variable=None,
variable_manager=None,
stack_offset=None,
reg_name=None,
heap_offset=None,
global_addr=None,
tmp_idx=None,const_val=None,extern=None)

10.13. Knowledge Base

755

angr

Bases: object
A dataclass indicating several facts which much all must match in order for a definition to match. Largely aninternal class; don’t worry about this.
Parameters• kind (AtomKind | type[Atom] | None)• bbl_addr (int | None)• ins_addr (int | None)• variable (SimVariable | None)• variable_manager (VariableManagerInternal | None | Literal[False])• stack_offset (int | None)• reg_name (str | int | None)• heap_offset (int | None)• global_addr (int | None)• tmp_idx (int | None)• const_val (int | None)• extern (bool | None)kind:

AtomKind | type[Atom ] | None = Nonebbl_addr:

int | None = None

ins_addr:

int | None = None

variable:

SimVariable | None = None

variable_manager:
stack_offset:
reg_name:

Union[VariableManagerInternal, None, Literal[False]] = Noneint | None = Nonestr | int | None = None

heap_offset:

int | None = None

global_addr:

int | None = None

tmp_idx:

int | None = Noneconst_val:
extern:int | None = Nonebool | None = None

static construct(predicate=None, **kwargs)
Return typeDefinitionMatchPredicate
Parameters
predicate (DefinitionMatchPredicate | None)
normalize()

756

Chapter 10. API Referenceangrmatches(defn)
Return typebool
Parameters
defn (Definition)__init__(kind=None, bbl_addr=None, ins_addr=None, variable=None, variable_manager=None,
stack_offset=None, reg_name=None, heap_offset=None, global_addr=None, tmp_idx=None,const_val=None, extern=None)
Parameters• kind (AtomKind | type[Atom] | None)• bbl_addr (int | None)• ins_addr (int | None)• variable (SimVariable | None)• variable_manager (VariableManagerInternal | None | Literal[False])• stack_offset (int | None)• reg_name (str | int | None)• heap_offset (int | None)• global_addr (int | None)• tmp_idx (int | None)• const_val (int | None)• extern (bool | None)
Return type
Noneclass angr.knowledge_plugins.key_definitions.definition.Definition(atom, codeloc,
dummy=False, tags=None)
Bases: Generic[A]An atom definition.
Variables• atom – The atom being defined.
• codeloc – Where this definition is created in the original binary code.
• dummy – Tell whether the definition should be considered dummy or not. During simplification by AILment, definitions marked as dummy will not be removed.
• tags – A set of tags containing information about the definition gathered during analyses.
Parameters• atom (A)• codeloc (CodeLocation)• dummy (bool)• tags (set[Tag] | None)

10.13. Knowledge Base

757

angr

__init__(atom, codeloc, dummy=False, tags=None)
Parameters• atom (A)• codeloc (CodeLocation)• dummy (bool)• tags (set[Tag] | None)
atom:

TypeVar(A, bound= Atom )codeloc:
dummy:

CodeLocation
bool

tags
property offset:
property size:

int
int

matches(**kwargs)
Return whether this definition has certain characteristics.
Return typeboolclass angr.knowledge_plugins.key_definitions.environment.Environment(environment=None)
Bases: object
Represent the environment in which a program runs. It’s a mapping of variable names, to claripy.ast.Base thatshould contain possible addresses, or <UNDEFINED>, at which their respective values are stored.
Note: The <Environment> object does not store the values associated with variables themselves.
Parameters
environment (dict[str | Undefined, set[claripy.ast.Base]] | None)__init__(environment=None)
Parameters
environment (dict[str | Undefined, set[Base]] | None)get(names)
Parametersnames (set[str]) – Potential values for the name of the environment variable to get the
pointers of.
Return typetuple[set[Base], bool]
Returns
The potential addresses of the values the environment variable can take; And a boolean value
telling whether all the names were known of the internal representation (i.e. will be False if
one of the queried variable was not found).

758

Chapter 10. API Referenceangrset(name, pointers)
Parameters• name (str | Undefined) – Name of the environment variable to which we will associate
the pointers.
• pointers (set[Base]) – New addresses where the new values of the environment variable
are located.
merge(*others)
Return typetuple[Environment, bool]
Parameters
others (Environment)
compare(other)
Return typebool
Parameters
other (Environment)
class angr.knowledge_plugins.key_definitions.heap_address.HeapAddress(value)
Bases: object
The representation of an address on the heap.
Parameters
value (int | Undefined)__init__(value)
Parameters
value (int | Undefined)
property value

class angr.knowledge_plugins.key_definitions.key_definition_manager.RDAObserverControl(func_addr,
call_site_block_addrs
call_site_ins_addrs)
Bases: object
Parameters• func_addr (int)• call_site_block_addrs (Iterable[int])• call_site_ins_addrs (Iterable[int])__init__(func_addr, call_site_block_addrs, call_site_ins_addrs)
Parameters• func_addr (int)• call_site_block_addrs (Iterable[int])• call_site_ins_addrs (Iterable[int])

10.13. Knowledge Base

759

angr

rda_observe_callback(ob_type, **kwargs)
class angr.knowledge_plugins.key_definitions.key_definition_manager.KeyDefinitionManager(kb)Bases: KnowledgeBasePlugin
KeyDefinitionManager manages and caches reaching definition models for each function.
For each function, by default we cache the entire reaching definitions model with observed results at the following
locations: - Before each call instruction: (‘insn’, address of the call instruction, OP_BEFORE) - After returningfrom each call: (‘node’, address of the block that ends with a call, OP_AFTER)
Parameterskb (KnowledgeBase)__init__(kb)Parameterskb (KnowledgeBase)
has_model(func_addr)
Parameters
func_addr (int)
get_model(func_addr)
Parameters
func_addr (int)copy()
Return type
KeyDefinitionManager
class angr.knowledge_plugins.key_definitions.live_definitions.DerefSize(value)
Bases: Enum
An enum for specialized kinds of dereferences
NULL_TERMINATE - Dereference until the first byte which could be a literal null. Return a value
including theterminator.
NULL_TERMINATE = 1
class angr.knowledge_plugins.key_definitions.live_definitions.DefinitionAnnotation(definition)
Bases: Annotation
An annotation that attaches a Definition to an AST.
__init__(definition)
definition
property relocatable
Returns whether this annotation can be relocated in a simplification.
Returns
True if it can be relocated, false otherwise.

760

Chapter 10. API Referenceangrproperty eliminatable
Returns whether this annotation can be eliminated in a simplification.
Returns
True if eliminatable, False otherwiseclass angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions(arch,
track_tmps=False,
canonical_size=8,
registers=None,
stack=None,memory=None,
heap=None,
tmps=None,others=None,
register_uses=None,
stack_uses=None,
heap_uses=None,memory_uses=None,
tmp_uses=None,other_uses=None,element_limit=5,
merge_into_tops=True)
Bases: object
A LiveDefinitions instance contains definitions and uses for register, stack, memory, and temporary variables,
uncovered during the analysis.
Parameters• arch (archinfo.Arch )• track_tmps (bool)• registers (MultiValuedMemory)• stack (MultiValuedMemory)• memory (MultiValuedMemory)• heap (MultiValuedMemory)• tmps (dict[int, set[Definition]])• others (dict[Atom, MultiValues])• tmp_uses (dict[int, set[CodeLocation]])• merge_into_tops (bool)
INITIAL_SP_32BIT = 2147418112
INITIAL_SP_64BIT = 140737488289792

10.13. Knowledge Base

761

angr

__init__(arch, track_tmps=False, canonical_size=8, registers=None, stack=None, memory=None,
heap=None, tmps=None, others=None, register_uses=None, stack_uses=None, heap_uses=None,memory_uses=None, tmp_uses=None, other_uses=None, element_limit=5,
merge_into_tops=True)
Parameters• arch (Arch )• track_tmps (bool)• merge_into_tops (bool)project:

Project | Nonearch
track_tmps
registers:

MultiValuedMemory

stack:

MultiValuedMemory

memory:MultiValuedMemory

heap:

MultiValuedMemory

tmps:

dict[int, set[Definition]]others:dict[Atom , MultiValues]

register_uses
stack_uses
heap_uses
memory_uses
tmp_uses:

dict[int, set[CodeLocation]]other_uses
uses_by_codeloc:

dict[CodeLocation, set[Definition]]

property register_definitions
property stack_definitions
property memory_definitions
property heap_definitions
copy(discard_tmpdefs=False)
Return type
LiveDefinitions
reset_uses()

762

Chapter 10. API Referenceangrstatic top(bits)
Get a TOP value.
Parametersbits (int) – Width of the TOP value (in bits).
Returns
The TOP value.
static is_top(expr)
Check if the given expression is a TOP value.
Parameters
expr – The given expression.
Return typebool
Returns
True if the expression is TOP, False otherwise.
stack_address(offset)
Return type
BV | None
Parameters
offset (int)static is_stack_address(addr)
Return typebool
Parametersaddr (Base)static get_stack_offset(addr, had_stack_base=False)
Return type
int | None
Parametersaddr (Base)static annotate_with_def(symvar, definition)
Parameters• symvar (BV)
• definition (Definition)
Return type
BV
Returnsstatic extract_defs(symvar)
Return type
Generator[Definition]

10.13. Knowledge Base

763

angr

Parameterssymvar (Base)static extract_defs_from_annotations(annos)
Return typeset[Definition]
Parameters
annos (Iterable[Annotation])
static extract_defs_from_mv(mv)Return type
Generator[Definition]
Parameters
mv (MultiValues)
get_sp()Return the concrete value contained by the stack pointer.
Return typeint
get_sp_offset()
Return the offset of the stack pointer.
Return type
int | None
get_stack_address(offset)
Return type
int | None
Parameters
offset (Base)stack_offset_to_stack_addr(offset)
Return type
intmerge(*others)
Return typetuple[LiveDefinitions, bool]
Parameters
others (LiveDefinitions)compare(other)
Return typebool
Parameters
other (LiveDefinitions)764

Chapter 10. API Referenceangrkill_definitions(atom)
Overwrite existing definitions w.r.t ‘atom’ with a dummy definition instance. A dummy definition will not
be removed during simplification.
Parametersatom (Atom)
Return type
None
ReturnsNonekill_and_add_definition(atom, code_loc, data, dummy=False, tags=None, endness=None,annotated=False)
Return typeMultiValues | None
Parameters• atom (Atom)• code_loc (CodeLocation)• data (MultiValues)• tags (set[Tag] | None)
add_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (Atom)• code_loc (CodeLocation)• expr (Any | None)
add_use_by_def(definition, code_loc, expr=None)
Return type
None
Parameters• definition (Definition)• code_loc (CodeLocation)• expr (Any | None)
get_definitions(thing)
Return typeset[Definition[Atom]]Parameters
thing(A | Definition[A] | Iterable[A] | Iterable[Definition[A]] |MultiValues)

10.13. Knowledge Base

765

angr

get_tmp_definitions(tmp_idx)
Return typeset[Definition]
Parameters
tmp_idx (int)
get_register_definitions(reg_offset, size)
Return typeset[Definition]
Parameters• reg_offset (int)• size (int)
get_stack_values(stack_offset, size, endness)
Return typeMultiValues | None
Parameters• stack_offset (int)• size (int)• endness (str)
get_stack_definitions(stack_offset, size)
Return typeset[Definition]
Parameters• stack_offset (int)• size (int)
get_heap_definitions(heap_addr, size)
Return typeset[Definition]
Parameters• heap_addr (int)• size (int)
get_memory_definitions(addr, size)
Return typeset[Definition]
Parameters• addr (int)• size (int)
get_definitions_from_atoms(**kwargs)

766

Chapter 10. API Referenceangr

get_value_from_definition(**kwargs)
get_one_value_from_definition(**kwargs)
get_concrete_value_from_definition(**kwargs)
get_value_from_atom(**kwargs)
get_one_value_from_atom(**kwargs)
get_concrete_value_from_atom(**kwargs)
get_values(spec)
Return typeMultiValues | None
Parametersspec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])get_one_value(spec, strip_annotations=False)
Return type
BV | None
Parameters• spec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])• strip_annotations (bool)
get_concrete_value(spec, cast_to=<class 'int'>)
Return type
int | bytes | None
Parameters• spec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])• cast_to (type[int] | type[bytes])
add_register_use(reg_offset, size, code_loc, expr=None)
Return type
None
Parameters• reg_offset (int)• size (int)• code_loc (CodeLocation)• expr (Any | None)
add_register_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)

10.13. Knowledge Base

767

angr

• code_loc (CodeLocation)• expr (Any | None)
add_stack_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)
add_stack_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_heap_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)
add_heap_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_memory_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)

768

Chapter 10. API Referenceangr

add_memory_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_tmp_use(atom, code_loc)
Return type
None
Parameters• atom (Tmp)• code_loc (CodeLocation)
add_tmp_use_by_def(def_, code_loc)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)
deref(pointer, size, endness=Endness.BE)
static is_heap_address(addr)
Return typebool
Parametersaddr (Base)static get_heap_offset(addr)
Return type
int | None
Parametersaddr (Base)heap_address(offset)
Return type
BV
Parameters
offset (int | HeapAddress)
class angr.knowledge_plugins.key_definitions.rd_model.ReachingDefinitionsModel(func_addr=None,
track_liveness=True)
Bases: object
Models the definitions, uses, and memory of a ReachingDefinitionState object
10.13. Knowledge Base

769

angr

Parameters• func_addr (int | None)• track_liveness (bool)__init__(func_addr=None, track_liveness=True)
Parameters• func_addr (int | None)• track_liveness (bool)
add_def(d)Return type
None
Parametersd (Definition)kill_def(d)Return type
None
Parametersd (Definition)
at_new_stmt(codeloc)
Return type
None
Parameterscodeloc (CodeLocation)
at_new_block(code_loc, pred_codelocs)
Return type
None
Parameters• code_loc (CodeLocation)• pred_codelocs (list[CodeLocation])
make_liveness_snapshot()
Return type
Nonefind_defs_at(code_loc, op=ObservationPointType.OP_BEFORE)
Return typeset[Definition]
Parameters• code_loc (CodeLocation)• op (int)

770

Chapter 10. API Referenceangr

get_defs(atom, code_loc, op)
Return typeset[Definition]
Parameters• atom (Atom)• code_loc (CodeLocation)• op (int)copy()
Return type
ReachingDefinitionsModel
merge(model)
Parametersmodel (ReachingDefinitionsModel)
get_observation_by_insn(ins_addr, kind)
Return type
LiveDefinitions | None
Parameters• ins_addr (int | CodeLocation)• kind (ObservationPointType)
get_observation_by_node(node_addr, kind, node_idx=None)
Return type
LiveDefinitions | None
Parameters• node_addr (int | CodeLocation)• kind (ObservationPointType)• node_idx (int | None)
get_observation_by_stmt(arg1, arg2, arg3=None, *, block_idx=None)
get_observation_by_exit(node_addr, stmt_idx, src_node_idx=None)
Return type
LiveDefinitions | None
Parameters• node_addr (int)• stmt_idx (int)• src_node_idx (int | None)
Classes to structure the different types of <Tag>s that can be attached to <Definition>s.
• Tag– FunctionTag

10.13. Knowledge Base

771

angr

∗ ParameterTag∗ LocalVariableTag∗ ReturnValueTag– InitialValueTagclass angr.knowledge_plugins.key_definitions.tag.Tag(metadata=None)
Bases: object
A tag for a Definition that can carry different kinds of metadata.
Parameters
metadata (object)__init__(metadata=None)
Parameters
metadata (object | None)class angr.knowledge_plugins.key_definitions.tag.FunctionTag(function=None, metadata=None)
Bases: Tag
A tag for a definition created (or used) in the context of a function.
Parameters• function (int | None)• metadata (object)__init__(function=None, metadata=None)
Parameters• function (int | None)• metadata (object | None)class angr.knowledge_plugins.key_definitions.tag.SideEffectTag(function=None, metadata=None)
Bases: FunctionTag
A tag for a definition created or used as a side-effect of a function.
Example: The <MemoryLocation> pointed by rdi during a sprintf.
Parameters• function (int | None)• metadata (object)class angr.knowledge_plugins.key_definitions.tag.ParameterTag(function=None, metadata=None)
Bases: FunctionTag
A tag for a definition of a parameter.
Parameters• function (int | None)• metadata (object)772

Chapter 10. API Referenceangrclass angr.knowledge_plugins.key_definitions.tag.LocalVariableTag(function=None,
metadata=None)
Bases: FunctionTag
A tag for a definition of a local variable of a function.
Parameters• function (int | None)• metadata (object)class angr.knowledge_plugins.key_definitions.tag.ReturnValueTag(function=None,
metadata=None)
Bases: FunctionTag
A tag for a definition of a return value of a function.
Parameters• function (int | None)• metadata (object)class angr.knowledge_plugins.key_definitions.tag.InitialValueTag(metadata=None)
Bases: Tag
A tag for a definition of an initial value
Parameters
metadata (object)class angr.knowledge_plugins.key_definitions.tag.UnknownSizeTag(metadata=None)
Bases: Tag
A tag for a definition of an initial value
Parameters
metadata (object)class angr.knowledge_plugins.key_definitions.undefined.UndefinedBases: object
A TOP-like value indicating an unknown data source. Should live next to raw integers in DataSets.
class angr.knowledge_plugins.key_definitions.unknown_size.UnknownSize
Bases: object
A value indicating an unknown size for elements of DataSets. Should “behave” like an integer.
class angr.knowledge_plugins.key_definitions.uses.Uses(uses_by_definition=None,
uses_by_location=None)
Bases: object
Describes uses (including the use location and the use expression) for definitions.
Parameters• uses_by_definition (DefaultChainMapCOW | None)• uses_by_location (DefaultChainMapCOW | None)

10.13. Knowledge Base

773

angr

__init__(uses_by_definition=None, uses_by_location=None)
Parameters• uses_by_definition (DefaultChainMapCOW | None)• uses_by_location (DefaultChainMapCOW | None)
add_use(definition, codeloc, expr=None)
Add a use for a given definition.
Parameters• definition (Definition) – The definition that is used.
• codeloc (CodeLocation) – The code location where the use occurs.
• expr (Optional[Any]) – The expression that uses the specified definition at this location.
get_uses(definition)
Retrieve the uses of a given definition.
Parameters
definition (Definition) – The definition for which we get the uses.
Return typeset[CodeLocation]
get_uses_with_expr(definition)
Retrieve the uses and the corresponding expressions of a given definition.
Parameters
definition (Definition) – The definition for which we get the uses and the corresponding
expressions.
Return typeset[tuple[CodeLocation, Optional[Any]]]
remove_use(definition, codeloc, expr=None)
Remove one use of a given definition.
Parameters• definition (Definition) – The definition of which to remove the uses.
• codeloc (CodeLocation) – The code location where the use is.
• expr (Optional[Any]) – The expression that uses the definition at the given location.
Return type
None
ReturnsNoneremove_uses(definition)
Remove all uses of a given definition.
Parameters
definition (Definition) – The definition of which to remove the uses.
Returns
None

774

Chapter 10. API Referenceangr

get_uses_by_location(codeloc, exprs=False)
Retrieve all definitions that are used at a given location.
Parameters• codeloc (CodeLocation) – The code location.
• exprs (bool)
Return typeset[Definition] | set[tuple[Definition, Optional[Any]]]
Returns
A set of definitions that are used at the given location.
get_uses_by_insaddr(ins_addr, exprs=False)
Retrieve all definitions that are used at a given location specified by the instruction address.
Parameters• ins_addr (int) – The instruction address.
• exprs (bool)
Return typeset[Definition] | set[tuple[Definition, Optional[Any]]]
Returns
A set of definitions that are used at the given location.
copy()
Copy the instance.
Return type
Uses
Returns
Return a new <Uses> instance containing the same data.
merge(other)Merge an instance of <Uses> into the current instance.
Parameters
other (Uses) – The other <Uses> from which the data will be added to the current instance.
Return typebool
Returns
True if any merge occurred, False otherwiseclass angr.knowledge_plugins.xrefs.XRef(ins_addr=None, block_addr=None, stmt_idx=None,insn_op_idx=None, memory_data=None, dst=None,xref_type=None)
Bases: Serializable
XRef describes a reference to a MemoryData instance (if a MemoryData instance is available) or just an address.
Parameters• ins_addr (int | None)• block_addr (int | None)• stmt_idx (int | None)
10.13. Knowledge Base

775

angr

• insn_op_idx (int | None)• dst (int | None)__init__(ins_addr=None, block_addr=None, stmt_idx=None, insn_op_idx=None, memory_data=None,
dst=None, xref_type=None)
Parameters• ins_addr (int | None)• block_addr (int | None)• stmt_idx (int | None)• insn_op_idx (int | None)• dst (int | None)
ins_addr:

int | Noneinsn_op_idx:

int | None

block_addr:

int | None

stmt_idx:

int | Nonememory_data
type
dst
property type_string
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, bits=None, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
copy()
insn_op_type
class angr.knowledge_plugins.xrefs.XRefManager(kb)Bases: KnowledgeBasePlugin, Serializable

776

Chapter 10. API Referenceangr__init__(kb)copy()
add_xref(xref )add_xrefs(xrefs)
get_xrefs_by_ins_addr(ins_addr)
get_xrefs_by_dst(dst)
get_xrefs_by_dst_region(start, end)
Get a set of XRef objects that point to a given address region bounded by start and end. Will only return
absolute xrefs, not relative ones (like SP offsets)
get_xrefs_by_ins_addr_region(start, end)
Get a set of XRef objects that originate at a given address region bounded by start and end. Useful forfinding references from a basic block or function.
Return typeset[XRef ]serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, cfg_model=None, kb=None, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
class angr.knowledge_plugins.xrefs.XRefType
Bases: object
Offset = 0
Read = 1
Write = 2
static to_string(ty)class angr.knowledge_plugins.xrefs.xref.XRef(ins_addr=None, block_addr=None, stmt_idx=None,insn_op_idx=None, memory_data=None, dst=None,xref_type=None)
Bases: Serializable
XRef describes a reference to a MemoryData instance (if a MemoryData instance is available) or just an address.
10.13. Knowledge Base

777

angr

Parameters• ins_addr (int | None)• block_addr (int | None)• stmt_idx (int | None)• insn_op_idx (int | None)• dst (int | None)__init__(ins_addr=None, block_addr=None, stmt_idx=None, insn_op_idx=None, memory_data=None,
dst=None, xref_type=None)
Parameters• ins_addr (int | None)• block_addr (int | None)• stmt_idx (int | None)• insn_op_idx (int | None)• dst (int | None)
ins_addr:

int | Noneinsn_op_idx:

int | None

block_addr:

int | None

stmt_idx:

int | Nonememory_data
type
dst
property type_string
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, bits=None, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return type
cls

778

Chapter 10. API Referenceangrcopy()
insn_op_type
class angr.knowledge_plugins.xrefs.xref_types.XRefType
Bases: object
Offset = 0
Read = 1
Write = 2
static to_string(ty)class angr.knowledge_plugins.xrefs.xref_manager.XRefManager(kb)Bases: KnowledgeBasePlugin, Serializable__init__(kb)copy()
add_xref(xref )add_xrefs(xrefs)
get_xrefs_by_ins_addr(ins_addr)
get_xrefs_by_dst(dst)
get_xrefs_by_dst_region(start, end)
Get a set of XRef objects that point to a given address region bounded by start and end. Will only return
absolute xrefs, not relative ones (like SP offsets)
get_xrefs_by_ins_addr_region(start, end)
Get a set of XRef objects that originate at a given address region bounded by start and end. Useful forfinding references from a basic block or function.
Return typeset[XRef ]serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
classmethod parse_from_cmessage(cmsg, cfg_model=None, kb=None, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls

10.13. Knowledge Base

779

angr

class angr.code_location.CodeLocation(block_addr, stmt_idx, sim_procedure=None, ins_addr=None,context=None, block_idx=None, **kwargs)
Bases: object
Stands for a specific program point by specifying basic block address and statement ID (for IRSBs), or SimProcedure name (for SimProcedures).
Parameters• block_addr (int | None)• stmt_idx (int | None)• ins_addr (int | None)• context (Any)• block_idx (int | None)__init__(block_addr, stmt_idx, sim_procedure=None, ins_addr=None, context=None, block_idx=None,**kwargs)
Constructor.
Parameters• block_addr (int | None) – Address of the block• stmt_idx (int | None) – Statement ID. None for SimProcedures or if the code location ismeant to refer to the entire block.
• sim_procedure (class) – The corresponding SimProcedure class.
• ins_addr (Optional[int]) – The instruction address.
• context (Optional[Any]) – A tuple that represents the context of this CodeLocation incontextual mode, or None in contextless mode.
• kwargs – Optional arguments, will be stored, but not used in __eq__ or __hash__.
• block_idx (int | None)
block_addr:
stmt_idx:

int | Noneint | None

sim_procedure
ins_addr:

int | Nonecontext:

tuple[int] | None

block_idx:
info:

int | None

dict | None

property short_repr
class angr.code_location.ExternalCodeLocation(call_string=None)
Bases: CodeLocation
Stands for a program point that originates from outside an analysis’ scope. i.e. a value loaded from rdi in a callee
where the caller has not been analyzed.
Parameters
call_string (tuple[int, ...] | None)

780

Chapter 10. API Referenceangr__init__(call_string=None)
Constructor.
Parameters• block_addr – Address of the block• stmt_idx – Statement ID. None for SimProcedures or if the code location is meant to referto the entire block.
• sim_procedure (class) – The corresponding SimProcedure class.
• ins_addr – The instruction address.
• context – A tuple that represents the context of this CodeLocation in contextual mode, orNone in contextless mode.
• kwargs – Optional arguments, will be stored, but not used in __eq__ or __hash__.
• call_string (tuple[int, ...] | None)
call_stringclass angr.keyed_region.StoredObject(start, obj, size)
Bases: object__init__(start, obj, size)
start
obj
size:

UnknownSize | int

property obj_id
class angr.keyed_region.RegionObject(start, size, objects=None)
Bases: object
Represents one or more objects occupying one or more bytes in KeyedRegion.
__init__(start, size, objects=None)
start
size
stored_objects
property is_empty
property end
property internal_objects
includes(offset)
split(split_at)
add_object(obj)
set_object(obj)10.13. Knowledge Base

781

angr

copy()
class angr.keyed_region.KeyedRegion(tree=None, phi_node_contains=None, canonical_size=8)
Bases: object
KeyedRegion keeps a mapping between stack offsets and all objects covering that offset. It assumes no variablein this region overlap with another variable in this region.
Registers and function frames can all be viewed as a keyed region.
__init__(tree=None, phi_node_contains=None, canonical_size=8)
copy()
merge(other, replacements=None)
Merge another KeyedRegion into this KeyedRegion.
Parameters
other (KeyedRegion) – The other instance to merge with.
ReturnsNonemerge_to_top(other, replacements=None, top=None)
Merge another KeyedRegion into this KeyedRegion, but mark all variables with different values as TOP.
Parameters• other – The other instance to merge with.
• replacements
Returns
self
replace(replacements)
Replace variables with other variables.
Parameters
replacements (dict) – A dict of variable replacements.
Returns
self
dbg_repr()
Get a debugging representation of this keyed region. :return: A string of debugging output.
add_variable(start, variable)
Add a variable to this region at the given offset.
Parameters• start (int)• variable (SimVariable)
ReturnsNone
add_object(start, obj, object_size)
Add/Store an object to this region at the given offset.
Parameters

782

Chapter 10. API Referenceangr• start• obj• object_size (int) – Size of the object
Returns
set_variable(start, variable)
Add a variable to this region at the given offset, and remove all other variables that are fully covered by thisvariable.
Parameters• start (int)• variable (SimVariable)
ReturnsNone
set_object(start, obj, object_size)
Add an object to this region at the given offset, and remove all other objects that are fully covered by thisobject.
Parameters• start• obj• object_size
Returns
get_base_addr(addr)
Get the base offset (the key we are using to index objects covering the given offset) of a specific offset.
Parametersaddr (int)
Returns
Return type
int or None
get_variables_by_offset(start)
Find variables covering the given region offset.
Parameters
start (int)
Returns
A set of variables.
Return type
set
get_objects_by_offset(start)
Find objects covering the given region offset.
Parameters
start
Returns

10.13. Knowledge Base

783

angr

get_all_variables()Get all variables covering the current region.
Returns
A set of all variables.

10.14 Serialization
class angr.serializable.Serializable
Bases: object
The base class of all protobuf-serializable classes in angr.
serialize_to_cmessage()
Serialize the class object and returns a protobuf cmessage object.
Returns
A protobuf cmessage object.
Return typeprotobuf.cmessage
serialize()
Serialize the class object and returns a bytes object.
Returns
A bytes object.
Return type
bytes
classmethod parse_from_cmessage(cmsg, **kwargs)
Parse a protobuf cmessage and create a class object.
Parameters
cmsg – The probobuf cmessage object.
Returns
A unserialized class object.
Return typecls
classmethod parse(s, **kwargs)
Parse a bytes object and create a class object.
Parameterss (bytes) – A bytes object.
Returns
A class object.
Return typecls
class angr.vaults.VaultPickler(vault, file, *args, assigned_objects=(), **kwargs)
Bases: Pickler

784

Chapter 10. API Referenceangr__init__(vault, file, *args, assigned_objects=(), **kwargs)
A persistence-aware pickler. It will check for persistence of any objects except for those with IDs in ‘assigned_objects’.
persistent_id(obj)class angr.vaults.VaultUnpickler(vault, file, *args, **kwargs)
Bases: Unpickler__init__(vault, file, *args, **kwargs)
persistent_load(pid)class angr.vaults.Vault
Bases: MutableMapping
The vault is a serializer for angr.
keys()
Should return the IDs stored by the vault.
__init__()is_stored(i)Checks if the provided id is already in the vault.
load(oid)
store(o)dumps(o)Returns a serialized string representing the object, post-deduplication.
Parameterso – the objectloads(s)Deserializes a string representation of the object.
Parameterss – the string
static close()class angr.vaults.VaultDict(d=None)
Bases: Vault
A Vault that uses a dictionary for storage.
__init__(d=None)is_stored(i)Checks if the provided id is already in the vault.
keys()
Should return the IDs stored by the vault.
class angr.vaults.VaultDir(d=None)
Bases: Vault
A Vault that uses a directory for storage.

10.14. Serialization

785

angr

__init__(d=None)keys()
Should return the IDs stored by the vault.
class angr.vaults.VaultShelf(path=None)
Bases: VaultDict
A Vault that uses a shelve.Shelf for storage.
__init__(path=None)
close()
class angr.vaults.VaultDirShelf(d=None)
Bases: VaultDict
A Vault that uses a directory for storage, where every object is stored into a single shelve.Shelf instance. VaultDir creates a file for each object. VaultDirShelf creates only one file for a stored object and everything else it
references.
__init__(d=None)store(o)load(oid)keys()
Should return the IDs stored by the vault.

10.15 Analysis
class angr.analyses.Analysis
Bases: object
This class represents an analysis on the program.
Variables• project – The project for this analysis.
• kb (KnowledgeBase) – The knowledgebase object.
• _progress_callback – A callback function for receiving the progress of this analysis. It
only takes one argument, which is a float number from 0.0 to 100.0 indicating the current
progress.
• _show_progressbar (bool) – If a progressbar should be shown during the analysis. It’s
independent from _progress_callback.
• _progressbar (progress.Progress) – The progress bar object.
project:kb:

Project

KnowledgeBase

errors = []named_errors = {}786

Chapter 10. API Referenceangrclass angr.analyses.AnalysesHub(project)
Bases: PluginVendor[A]This class contains functions for all the registered and runnable analyses,__init__(project)reload_analyses(**kwargs)
angr.analyses.register_analysis(cls, name)class angr.analyses.ForwardAnalysis(order_jobs=False, allow_merging=False, allow_widening=False,
status_callback=None, graph_visitor=None)
Bases: Generic[AnalysisState, NodeType, JobType, JobKey]
This is my very first attempt to build a static forward analysis framework that can serve as the base of multiple
static analyses in angr, including CFG analysis, VFG analysis, DDG, etc.
In short, ForwardAnalysis performs a forward data-flow analysis by traversing a graph, compute on abstract
values, and store results in abstract states. The user can specify what graph to traverse, how a graph should betraversed, how abstract values and abstract states are defined, etc.
ForwardAnalysis has a few options to toggle, making it suitable to be the base class of several different styles of
forward data-flow analysis implementations.
ForwardAnalysis supports a special mode when no graph is available for traversal (for example, when a CFG isbeing initialized and constructed, no other graph can be used). In that case, the graph traversal functionality isdisabled, and the optimal graph traversal order is not guaranteed. The user can provide a job sorting method tosort the jobs in queue and optimize traversal order.
Feel free to discuss with me (Fish) if you have any suggestions or complaints.
Parameters• status_callback (Callable[[type[ForwardAnalysis]], Any] | None)• graph_visitor (GraphVisitor[NodeType] | None)__init__(order_jobs=False, allow_merging=False, allow_widening=False, status_callback=None,graph_visitor=None)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• status_callback (Callable[[type[ForwardAnalysis]], Any] | None)
ReturnsNoneproperty should_abort
Should the analysis be terminated. :return: True/False
property graph:

DiGraphproperty jobs

10.15. Analysis

787

angr

abort()
Abort the analysis :return: None
has_job(job)Checks whether there exists another job which has the same job key. :type job: TypeVar(JobType) :paramjob: The job to check.
Return typebool
Returns
True if there exists another job with the same key, False otherwise.
Parametersjob (JobType)downsize()class angr.analyses.PropagatorAnalysis(func=None, block=None, func_graph=None, base_state=None,
max_iterations=30, load_callback=None,
stack_pointer_tracker=None, only_consts=False,
completed_funcs=None, do_binops=True, store_tops=True,
vex_cross_insn_opt=False, func_addr=None, gp=None,
cache_results=False, key_prefix=None,reaching_definitions=None, immediate_stmt_removal=False,
profiling=False)
Bases: ForwardAnalysis, Analysis
PropagatorAnalysis implements copy propagation. It propagates values (either constant values or variables) and
expressions inside a block or across a function.
PropagatorAnalysis supports both VEX and AIL. The VEX propagator only performs constant propagation. The
AIL propagator performs both constant propagation and copy propagation of depth-N expressions.
PropagatorAnalysis performs certain arithmetic operations between constants, including but are not limited to:• addition• subtraction• multiplication• division• xor
It also performs the following memory operations:• Loading values from a known address• Writing values to a stack variable
Parameters• func_addr (int | None)• gp (int | None)• cache_results (bool)• key_prefix (str | None)• reaching_definitions (ReachingDefinitionsModel | None)

788

Chapter 10. API Referenceangr• immediate_stmt_removal (bool)• profiling (bool)__init__(func=None, block=None, func_graph=None, base_state=None, max_iterations=30,
load_callback=None, stack_pointer_tracker=None, only_consts=False, completed_funcs=None,
do_binops=True, store_tops=True, vex_cross_insn_opt=False, func_addr=None, gp=None,
cache_results=False, key_prefix=None, reaching_definitions=None,
immediate_stmt_removal=False, profiling=False)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• func_addr (int | None)• gp (int | None)• cache_results (bool)• key_prefix (str | None)• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• profiling (bool)
ReturnsNoneproperty prop_key:

tuple[str | None, str, int, bool, bool, bool]

Gets a key that represents the function and the “flavor” of the propagation result.
property replacements
class angr.analyses.CFGFast(binary=None, objects=None, regions=None,
pickle_intermediate_results=False, symbols=True, function_prologues=True,
resolve_indirect_jumps=True, force_segment=False, force_smart_scan=True,
force_complete_scan=False, indirect_jump_target_limit=100000,
data_references=True, cross_references=False, normalize=False,start_at_entry=True, function_starts=None, extra_memory_regions=None,
data_type_guessing_handlers=None, arch_options=None,
indirect_jump_resolvers=None, base_state=None,
exclude_sparse_regions=True, skip_specific_regions=True,
heuristic_plt_resolving=None, detect_tail_calls=False, low_priority=False,
cfb=None, model=None, elf_eh_frame=True, exceptions=True,
skip_unmapped_addrs=True, nodecode_window_size=512,
nodecode_threshold=0.3, nodecode_step=16483,
indirect_calls_always_return=None, jumptable_resolver_resolves_calls=None,start=None, end=None, collect_data_references=None,
extra_cross_references=None, **extra_arch_options)
Bases: ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase

10.15. Analysis

789

angr

We find functions inside the given binary, and build a control-flow graph in very fast manners: instead of simulating program executions, keeping track of states, and performing expensive data-flow analysis, CFGFast will
only perform light-weight analyses combined with some heuristics, and with some strong assumptions.
In order to identify as many functions as possible, and as accurate as possible, the following operation sequenceis followed:# Active scanning• If the binary has “function symbols” (TODO: this term is not accurate enough), they are starting points ofthe code scanning• If the binary does not have any “function symbol”, we will first perform a function prologue scanning on
the entire binary, and start from those places that look like function beginnings• Otherwise, the binary’s entry point will be the starting point for scanning# Passive scanning• After all active scans are done, we will go through the whole image and scan all code pieces
Due to the nature of those techniques that are used here, a base address is often not required to use this analysis
routine. However, with a correct base address, CFG recovery will almost always yield a much better result. A
custom analysis, called GirlScout, is specifically made to recover the base address of a binary blob. After the baseaddress is determined, you may want to reload the binary with the new base address by creating a new Project
object, and then re-recover the CFG.
Parameters• indirect_calls_always_return (bool | None)• jumptable_resolver_resolves_calls (bool | None)
PRINTABLES = b'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r'
SPECIAL_THUNKS = {'AMD64':{b'\xe8\x07\x00\x00\x00\xf3\x90\x0f\xae\xe8\xeb\xf9H\x89\x04$\xc3':
b'\xe8\x07\x00\x00\x00\xf3\x90\x0f\xae\xe8\xeb\xf9H\x8dd$\x08\xc3':
tag:('jmp', 'rax'),('ret',)}}

str | None = 'CFGFast'__init__(binary=None, objects=None, regions=None, pickle_intermediate_results=False, symbols=True,
function_prologues=True, resolve_indirect_jumps=True, force_segment=False,
force_smart_scan=True, force_complete_scan=False, indirect_jump_target_limit=100000,
data_references=True, cross_references=False, normalize=False, start_at_entry=True,
function_starts=None, extra_memory_regions=None, data_type_guessing_handlers=None,arch_options=None, indirect_jump_resolvers=None, base_state=None,
exclude_sparse_regions=True, skip_specific_regions=True, heuristic_plt_resolving=None,
detect_tail_calls=False, low_priority=False, cfb=None, model=None, elf_eh_frame=True,
exceptions=True, skip_unmapped_addrs=True, nodecode_window_size=512,
nodecode_threshold=0.3, nodecode_step=16483, indirect_calls_always_return=None,
jumptable_resolver_resolves_calls=None, start=None, end=None, collect_data_references=None,
extra_cross_references=None, **extra_arch_options)Parameters• binary – The binary to recover CFG on. By default the main binary is used.
• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.

790

Chapter 10. API Referenceangr• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to andfrom each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.
• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.
• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return (Optional[bool]) – Should CFG assume indirectcalls must return or not. Assuming indirect calls must return will significantly reduce thenumber of constant propagation runs, but may reduce the overall CFG recovery precision
when facing non-returning indirect calls. By default, we only assume indirect calls always
return for large binaries (region > 50KB).

10.15. Analysis

791

angr

• jumptable_resolver_resolves_calls (Optional[bool]) – Whether JumpTableResolver should resolve indirect calls or not. Most indirect calls in C++ binaries or UEFI
binaries cannot be resolved using jump table resolver and must be resolved using their specific resolvers. By default, we will only disable JumpTableResolver from resolving indirectcalls for large binaries (region > 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.
• indirect_calls_always_return (bool | None)• jumptable_resolver_resolves_calls (bool | None)
ReturnsNoneproperty graphproperty memory_data
property jump_tables
property insn_addr_to_memory_data
do_full_xrefs(overlay_state=None)
Perform xref recovery on all functions.
Parameters
overlay (SimState) – An overlay state for loading constant data.
ReturnsNonecopy()
output()generate_code_cover(**kwargs)

792

Chapter 10. API Referenceangrclass angr.analyses.CFGEmulated(context_sensitivity_level=1, start=None, avoid_runs=None,enable_function_hints=False, call_depth=None, call_tracing_filter=None,
initial_state=None, starts=None, keep_state=False,
indirect_jump_target_limit=100000, resolve_indirect_jumps=True,
enable_advanced_backward_slicing=False,
enable_symbolic_back_traversal=False, indirect_jump_resolvers=None,
additional_edges=None, no_construct=False, normalize=False,
max_iterations=1, address_whitelist=None, base_graph=None,
iropt_level=None, max_steps=None, state_add_options=None,state_remove_options=None, model=None)
Bases: ForwardAnalysis, CFGBase
This class represents a control-flow graph.
tag:

str | None = 'CFGEmulated'__init__(context_sensitivity_level=1, start=None, avoid_runs=None, enable_function_hints=False,
call_depth=None, call_tracing_filter=None, initial_state=None, starts=None, keep_state=False,
indirect_jump_target_limit=100000, resolve_indirect_jumps=True,
enable_advanced_backward_slicing=False, enable_symbolic_back_traversal=False,
indirect_jump_resolvers=None, additional_edges=None, no_construct=False, normalize=False,
max_iterations=1, address_whitelist=None, base_graph=None, iropt_level=None,
max_steps=None, state_add_options=None, state_remove_options=None, model=None)
All parameters are optional.
Parameters• context_sensitivity_level – The level of context-sensitivity of this CFG (see documentation for further details). It ranges from 0 to infinity. Default 1.
• avoid_runs – A list of runs to avoid.
• enable_function_hints – Whether to use function hints (constants that might be used
as exit targets) or not.
• call_depth – How deep in the call stack to trace.
• call_tracing_filter – Filter to apply on a given path and jumpkind to determine if itshould be skipped when call_depth is reached.
• initial_state – An initial state to use to begin analysis.
• starts (iterable) – A collection of starting points to begin analysis. It can contain thefollowing three different types of entries: an address specified as an integer, a 2-tuple that
includes an integer address and a jumpkind, or a SimState instance. Unsupported entries
in starts will lead to an AngrCFGError being raised.
• keep_state – Whether to keep the SimStates for each CFGNode.
• resolve_indirect_jumps – Whether to enable the indirect jump resolvers for resolving
indirect jumps• enable_advanced_backward_slicing – Whether to enable an intensive technique forresolving indirect jumps• enable_symbolic_back_traversal – Whether to enable an intensive technique for resolving indirect jumps• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
10.15. Analysis

793

angr

• additional_edges – A dict mapping addresses of basic blocks to addresses of successors
to manually include and analyze forward from.
• no_construct (bool) – Skip the construction procedure. Only used in unit-testing.
• normalize (bool) – If the CFG as well as all Function graphs should be normalized ornot.
• max_iterations (int) – The maximum number of iterations that each basic block should
be “executed”. 1 by default. Larger numbers of iterations are usually required for complex
analyses like loop analysis.
• address_whitelist (iterable) – A list of allowed addresses. Any basic blocks outsideof this collection of addresses will be ignored.
• base_graph (networkx.DiGraph ) – A basic control flow graph to follow. Each nodeinside this graph must have the following properties: addr and size. CFG recovery will
strictly follow nodes and edges shown in the graph, and discard any control flow that does
not follow an existing edge in the base graph. For example, you can pass in a Function
local transition graph as the base graph, and CFGEmulated will traverse nodes and edges
and extract useful information.
• iropt_level (int) – The optimization level of VEX IR (0, 1, 2). The default level will
be used if iropt_level is None.
• max_steps (int) – The maximum number of basic blocks to recover forthe longest pathfrom each start before pausing the recovery procedure.
• state_add_options – State options that will be added to the initial state.
• state_remove_options – State options that will be removed from the initial state.
copy()
Make a copy of the CFG.
Return type
CFGEmulated
Returns
A copy of the CFG instance.
resume(starts=None, max_steps=None)
Resume a paused or terminated control flow graph recovery.
Parameters• starts (iterable) – A collection of new starts to resume from. If starts is None, we will
resume CFG recovery from where it was paused before.
• max_steps (int) – The maximum number of blocks on the longest path starting from eachstart before pausing the recovery.
ReturnsNoneremove_cycles()Forces graph to become acyclic, removes all loop back edges and edges between overlapped loop headers
and their successors.
downsize()
Remove saved states from all CFGNodes to reduce memory usage.

794

Chapter 10. API ReferenceangrReturns
None
unroll_loops(max_loop_unrolling_times)
Unroll loops for each function. The resulting CFG may still contain loops due to recursion, function calls,
etc.
Parameters
max_loop_unrolling_times (int) – The maximum iterations of unrolling.
Returns
None
force_unroll_loops(max_loop_unrolling_times)
Unroll loops globally. The resulting CFG does not contain any loop, but this method is slow on large graphs.
Parameters
max_loop_unrolling_times (int) – The maximum iterations of unrolling.
ReturnsNone
immediate_dominators(start, target_graph=None)
Get all immediate dominators of sub graph from given node upwards.
Parameters• start (str) – id of the node to navigate forwards from.
• target_graph (networkx.classes.digraph.DiGraph ) – graph to analyse, default isself.graph.
Returnseach node of graph as index values, with element as respective node’s immediate dominator.
Return type
dict
immediate_postdominators(end, target_graph=None)
Get all immediate postdominators of sub graph from given node upwards.
Parameters• start (str) – id of the node to navigate forwards from.
• target_graph (networkx.classes.digraph.DiGraph ) – graph to analyse, default isself.graph.
Returnseach node of graph as index values, with element as respective node’s immediate dominator.
Return type
dictremove_fakerets()
Get rid of fake returns (i.e., Ijk_FakeRet edges) from this CFG
ReturnsNone
get_topological_order(cfg_node)
Get the topological order of a CFG Node.

10.15. Analysis

795

angr

Parameters
cfg_node – A CFGNode instance.
Returns
An integer representing its order, or None if the CFGNode does not exist in the graph.
get_subgraph(starting_node, block_addresses)
Get a sub-graph out of a bunch of basic block addresses.
Parameters• starting_node (CFGNode) – The beginning of the subgraph• block_addresses (iterable) – A collection of block addresses that should be includedin the subgraph if there is a path between starting_node and a CFGNode with the specified
address, and all nodes on the path should also be included in the subgraph.
Returns
A new CFG that only contain the specific subgraph.
Return type
CFGEmulated
get_function_subgraph(start, max_call_depth=None)
Get a sub-graph of a certain function.
Parameters• start – The function start. Currently it should be an integer.
• max_call_depth – Call depth limit. None indicates no limit.
Returns
A CFG instance which is a sub-graph of self.graphproperty context_sensitivity_levelproperty graphproperty unresolvables
Get those SimRuns that have non-resolvable exits.
Returns
A set of SimRuns
Return typeset
property deadends
Get all CFGNodes that has an out-degree of 0
Returns
A list of CFGNode instances
Return type
listclass angr.analyses.CFG(**kwargs)
Bases: CFGFast
tl;dr: CFG is just a wrapper around CFGFast for compatibility issues. It will be fully replaced by CFGFast in
future releases. Feel free to use CFG if you intend to use CFGFast. Please use CFGEmulated if you have to use
the old, slow, dynamically-generated version of CFG.

796

Chapter 10. API ReferenceangrFor multiple historical reasons, angr’s CFG is accurate but slow, which does not meet what most people expect.
We developed CFGFast for light-speed CFG recovery, and renamed the old CFG class to CFGEmulated. For
compatibility concerns, CFG was kept as an alias to CFGEmulated.
However, so many new users of angr would load up a binary and generate a CFG immediately after running “pipinstall angr”, and draw the conclusion that “angr’s CFG is so slow - angr must be unusable!” Therefore, we madethe hard decision: CFG will be an alias to CFGFast, instead of CFGEmulated.
To ease the transition of your existing code and script, the following changes are made:• A CFG class, which is a sub class of CFGFast, is created.
• You will see both a warning message printed out to stderr and an exception raised by angr if you are passing
CFG any parameter that only CFGEmulated supports. This exception is not a sub class of AngrError, so
you wouldn’t capture it with your old code by mistake.
• In the near future, this wrapper class will be removed completely, and CFG will be a simple alias to CFGFast.
We expect most interfaces are the same between CFGFast and CFGEmulated. Apparently some functionalities(like context-sensitivity, and state keeping) only exist in CFGEmulated, which is when you want to use CFGEmulated instead.
__init__(**kwargs)
Parameters• binary – The binary to recover CFG on. By default the main binary is used.
• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to andfrom each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.

10.15. Analysis

797

angr

• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.
• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return – Should CFG assume indirect calls must return ornot. Assuming indirect calls must return will significantly reduce the number of constantpropagation runs, but may reduce the overall CFG recovery precision when facing nonreturning indirect calls. By default, we only assume indirect calls always return for large
binaries (region > 50KB).
• jumptable_resolver_resolves_calls – Whether JumpTableResolver should resolve
indirect calls or not. Most indirect calls in C++ binaries or UEFI binaries cannot be resolved
using jump table resolver and must be resolved using their specific resolvers. By default, we
will only disable JumpTableResolver from resolving indirect calls for large binaries (region> 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.
ReturnsNoneclass angr.analyses.CFGArchOptions(arch, **options)
Bases: object
Stores architecture-specific options and settings, as well as the detailed explanation of those options and settings.

798

Chapter 10. API ReferenceangrSuppose ao is the CFGArchOptions object, and there is an option called ret_jumpkind_heuristics, you can accessit by ao.ret_jumpkind_heuristics and set its value via ao.ret_jumpkind_heuristics = True
Variables• OPTIONS (dict) – A dict of all default options for different architectures.
• arch (archinfo.Arch ) – The architecture object.
• _options (dict) – Values of all CFG options that are specific to the current architecture.
OPTIONS = {'ARMCortexM': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, False)}, 'ARMEL': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, True)}, 'ARMHF': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, True)}}__init__(arch, **options)
Constructor.
Parameters• arch (archinfo.Arch ) – The architecture instance.
• options (dict) – Architecture-specific options, which will be used to initialize this object.
arch = Noneclass angr.analyses.CFGFastSoot(support_jni=False, **kwargs)
Bases: CFGFast__init__(support_jni=False, **kwargs)
Parameters• binary – The binary to recover CFG on. By default the main binary is used.
• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references

10.15. Analysis

799

angr

• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to andfrom each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.
• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.
• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return – Should CFG assume indirect calls must return ornot. Assuming indirect calls must return will significantly reduce the number of constantpropagation runs, but may reduce the overall CFG recovery precision when facing nonreturning indirect calls. By default, we only assume indirect calls always return for large
binaries (region > 50KB).
• jumptable_resolver_resolves_calls – Whether JumpTableResolver should resolve
indirect calls or not. Most indirect calls in C++ binaries or UEFI binaries cannot be resolved
using jump table resolver and must be resolved using their specific resolvers. By default, we
will only disable JumpTableResolver from resolving indirect calls for large binaries (region> 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.

800

Chapter 10. API ReferenceangrReturnsNonenormalize()
Normalize the CFG, making sure that there are no overlapping basic blocks.
Note that this method will not alter transition graphs of each function in self.kb.functions. You may callnormalize() on each Function object to normalize their transition graphs.
ReturnsNonemake_functions()
Revisit the entire control flow graph, create Function instances accordingly, and correctly put blocks into
each function.
Although Function objects are crated during the CFG recovery, they are neither sound nor accurate. Witha pre-constructed CFG, this method rebuilds all functions bearing the following rules:• A block may only belong to one function.
• Small functions lying inside the startpoint and the endpoint of another function will be merged withthe other function• Tail call optimizations are detected.
• PLT stubs are aligned by 16.
ReturnsNoneclass angr.analyses.CDG(cfg, start=None, no_construct=False)
Bases: Analysis
Implements a control dependence graph.
__init__(cfg, start=None, no_construct=False)
Constructor.
Parameters• cfg – The control flow graph upon which this control dependence graph will build• start – The starting point to begin constructing the control dependence graph• no_construct – Skip the construction step. Only used in unit-testing.
property graphget_post_dominators()
Return the post-dom tree
get_dependants(run)Return a list of nodes that are control dependent on the given node in the control dependence graphget_guardians(run)Return a list of nodes on whom the specific node is control dependent in the control dependence graph10.15. Analysis

801

angr

class angr.analyses.DDG(cfg, start=None, call_depth=None, block_addrs=None)
Bases: Analysis
This is a fast data dependence graph directly generated from our CFG analysis result. The only reason for its
existence is the speed. There is zero guarantee for being sound or accurate. You are supposed to use it only when
you want to track the simplest data dependence, and you do not care about soundness or accuracy.
For a better data dependence graph, please consider performing a better static analysis first (like Value-set Analysis), and then construct a dependence graph on top of the analysis result (for example, the VFG in angr).
The DDG is based on a CFG, which should ideally be a CFGEmulated generated with the following options:• keep_state=True to keep all input states• state_add_options=angr.options.refs to store memory, register, and temporary value accesses
You may want to consider a high value for context_sensitivity_level as well when generating the CFG.
Also note that since we are using states from CFG, any improvement in analysis performed on CFG (like apoints-to analysis) will directly benefit the DDG.
__init__(cfg, start=None, call_depth=None, block_addrs=None)
Parameters• cfg – Control flow graph. Please make sure each node has an associated state with it,e.g. by passing the keep_state=True and state_add_options=angr.options.refs arguments to
CFGEmulated.
• start – An address, Specifies where we start the generation of this data dependence graph.
• call_depth – None or integers. A non-negative integer specifies how deep we would liketo track in the call tree. None disables call_depth limit.
• block_addrs (iterable or None) – A collection of block addresses that the DDG analysis should be performed on.
property graph
A networkx DiGraph instance representing the dependence relations between statements. :rtype: networkx.DiGraphType
returns
property data_graphGet the data dependence graph.
Returns
A networkx DiGraph instance representing data dependence.
Return typenetworkx.DiGraphproperty simplified_data_graphreturn:property ast_graphpp()
Pretty printing.
dbg_repr()
Representation for debugging.

802

Chapter 10. API Referenceangrget_predecessors(code_location)
Returns all predecessors of the code location.
Parameters
code_location – A CodeLocation instance.
Returns
A list of all predecessors.
function_dependency_graph(func)
Get a dependency graph for the function func.
Parameters
func – The Function object in CFG.function_manager.
Returns
A networkx.DiGraph instance.
data_sub_graph(pv, simplified=True, killing_edges=False, excluding_types=None)
Get a subgraph from the data graph or the simplified data graph that starts from node pv.
Parameters• pv (ProgramVariable) – The starting point of the subgraph.
• simplified (bool) – When True, the simplified data graph is used, otherwise the datagraph is used.
• killing_edges (bool) – Are killing edges included or not.
• excluding_types (iterable) – Excluding edges whose types are among those excluded
types.
Returns
A subgraph.
Return typenetworkx.MultiDiGraphfind_definitions(variable, location=None, simplified_graph=True)
Find all definitions of the given variable.
Parameters• variable (SimVariable)• simplified_graph (bool) – True if you just want to search in the simplified graph insteadof the normal graph. Usually the simplified graph suffices for finding definitions of registeror memory variables.
Returns
A collection of all variable definitions to the specific variable.
Return type
list
find_consumers(var_def , simplified_graph=True)
Find all consumers to the specified variable definition.
Parameters• var_def (ProgramVariable) – The variable definition.

10.15. Analysis

803

angr

• simplified_graph (bool) – True if we want to search in the simplified graph, False
otherwise.
Returns
A collection of all consumers to the specified variable definition.
Return type
list
find_killers(var_def , simplified_graph=True)
Find all killers to the specified variable definition.
Parameters• var_def (ProgramVariable) – The variable definition.
• simplified_graph (bool) – True if we want to search in the simplified graph, False
otherwise.
Returns
A collection of all killers to the specified variable definition.
Return type
list
find_sources(var_def , simplified_graph=True)
Find all sources to the specified variable definition.
Parameters• var_def (ProgramVariable) – The variable definition.
• simplified_graph (bool) – True if we want to search in the simplified graph, False
otherwise.
Returns
A collection of all sources to the specified variable definition.
Return type
listclass angr.analyses.VFG(cfg=None, context_sensitivity_level=2, start=None, function_start=None,interfunction_level=0, initial_state=None, avoid_runs=None, remove_options=None,timeout=None, max_iterations_before_widening=8, max_iterations=40,
widening_interval=3, final_state_callback=None, status_callback=None,
record_function_final_states=False)
Bases: ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis
This class represents a control-flow graph with static analysis result.
Perform abstract interpretation analysis starting from the given function address. The output is an invariant at
the beginning (or the end) of each basic block.
Steps:• Generate a CFG first if CFG is not provided.
• Identify all merge points (denote the set of merge points as Pw) in the CFG.
• Cut those loop back edges (can be derived from Pw) so that we gain an acyclic CFG.
• Identify all variables that are 1) from memory loading 2) from initial values, or 3) phi functions.
Denotethe set of those variables as S_{var}.

804

Chapter 10. API Referenceangr• Start real AI analysis and try to compute a fix point of each merge point. Perform
widening/narrowing only on
variables in S_{var}.
Parameters• cfg (CFGEmulated | None)• context_sensitivity_level (int)• start (int | None)• function_start (int | None)• interfunction_level (int)• initial_state (SimState | None)• avoid_runs (list[int] | None)• remove_options (set[str] | None)• timeout (int | None)• max_iterations_before_widening (int)• max_iterations (int)• widening_interval (int)• final_state_callback (Callable[[SimState, CallStack], Any] | None)• status_callback (Callable[[VFG], Any] | None)• record_function_final_states (bool)__init__(cfg=None, context_sensitivity_level=2, start=None, function_start=None, interfunction_level=0,
initial_state=None, avoid_runs=None, remove_options=None, timeout=None,
max_iterations_before_widening=8, max_iterations=40, widening_interval=3,
final_state_callback=None, status_callback=None, record_function_final_states=False)
Parameters• cfg (Optional[CFGEmulated]) – The control-flow graph to base this analysis on. If none
is provided, we will construct a CFGEmulated.
• context_sensitivity_level (int) – The level of context-sensitivity of this VFG. It
ranges from 0 to infinity. Default 2.
• function_start (Optional[int]) – The address of the function to analyze.
• interfunction_level (int) – The level of interfunction-ness to be• initial_state (Optional[SimState]) – A state to use as the initial one• avoid_runs (Optional[list[int]]) – A list of runs to avoid• remove_options (Optional[set[str]]) – State options to remove from the initial state.
It only works when initial_state is None
• timeout (int)• final_state_callback (Optional[Callable[[SimState, CallStack], Any]]) – callback function when countering final state• status_callback (Optional[Callable[[VFG], Any]]) – callback function used in_analysis_core_baremetal
10.15. Analysis

805

angr

• start (int | None)• max_iterations_before_widening (int)• max_iterations (int)• widening_interval (int)• record_function_final_states (bool)
Return type
None
property function_initial_states
property function_final_states
get_any_node(addr)
Get any VFG node corresponding to the basic block at @addr. Note that depending on the context sensitivity
level, there might be multiple nodes corresponding to different contexts. This function will return the firstone it encounters, which might not be what you want.
Return type
VFGNode | None
Parametersaddr (int)
get_all_nodes(addr)
Return type
Generator[VFGNode]irsb_from_node(node)copy()
class angr.analyses.BoyScout(cookiesize=1)
Bases: Analysis
Try to determine the architecture and endieness of a binary blob__init__(cookiesize=1)
class angr.analyses.BackwardSlice(cfg, cdg, ddg, targets=None, cfg_node=None, stmt_id=None,
control_flow_slice=False, same_function=False, no_construct=False)
Bases: Analysis
Represents a backward slice of the program.
__init__(cfg, cdg, ddg, targets=None, cfg_node=None, stmt_id=None, control_flow_slice=False,
same_function=False, no_construct=False)
Create a backward slice from a specific statement based on provided control flow graph (CFG), control
dependence graph (CDG), and data dependence graph (DDG).
The data dependence graph can be either CFG-based, or Value-set analysis based. A CFG-based DDG ismuch faster to generate, but it only reflects those states while generating the CFG, and it is neither soundnor accurate. The VSA based DDG (called VSA_DDG) is based on static analysis, which gives you a muchbetter result.
Parameters• cfg – The control flow graph.
806

Chapter 10. API Referenceangr• cdg – The control dependence graph.
• ddg – The data dependence graph.
• targets – A list of “target” that specify targets of the backward slices. Each target can bea tuple in form of (cfg_node, stmt_idx), or a CodeLocation instance.
• cfg_node – Deprecated. The target CFGNode to reach. It should exist in the CFG.
• stmt_id – Deprecated. The target statement to reach.
• control_flow_slice – True/False, indicates whether we should slice only based on
CFG. Sometimes when acquiring DDG is difficult or impossible, you can just create aslice on your CFG. Well, if you don’t even have a CFG, then. . .
• no_construct – Only used for testing and debugging to easily create a BackwardSliceobject.
dbg_repr(max_display=10)
Debugging output of this slice.
Parameters
max_display – The maximum number of SimRun slices to show.
Returns
A string representation.
dbg_repr_run(run_addr)
Debugging output of a single SimRun slice.
Parameters
run_addr – Address of the SimRun.
Returns
A string representation.
annotated_cfg(start_point=None)
Returns an AnnotatedCFG based on slicing result.
is_taint_related_to_ip(simrun_addr, stmt_idx, taint_type, simrun_whitelist=None)
Query in taint graph to check if a specific taint will taint the IP in the future or not. The taint is specified
with the tuple (simrun_addr, stmt_idx, taint_type).
Parameters• simrun_addr – Address of the SimRun.
• stmt_idx – Statement ID.
• taint_type – Type of the taint, might be one of the following: ‘reg’, ‘tmp’, ‘mem’.
• simrun_whitelist – A list of SimRun addresses that are whitelisted, i.e. the tainted exit
will be ignored if it is in those SimRuns.
Returns
True/False
is_taint_impacting_stack_pointers(simrun_addr, stmt_idx, taint_type, simrun_whitelist=None)
Query in taint graph to check if a specific taint will taint the stack pointer in the future or not. The taint is
specified with the tuple (simrun_addr, stmt_idx, taint_type).
Parameters• simrun_addr – Address of the SimRun.

10.15. Analysis

807

angr

• stmt_idx – Statement ID.
• taint_type – Type of the taint, might be one of the following: ‘reg’, ‘tmp’, ‘mem’.
• simrun_whitelist – A list of SimRun addresses that are whitelisted.
Returns
True/False.
class angr.analyses.Veritesting(input_state, boundaries=None, loop_unrolling_limit=10,
enable_function_inlining=False, terminator=None,
deviation_filter=None)
Bases: Analysis
An exploration technique made for condensing chunks of code to single (nested) if-then-else constraints via CFG
accurate to conduct Static Symbolic Execution SSE (conversion to single constraint)
cfg_cache = {}all_stashes = ('successful', 'errored', 'deadended', 'deviated', 'unconstrained')__init__(input_state, boundaries=None, loop_unrolling_limit=10, enable_function_inlining=False,
terminator=None, deviation_filter=None)
SSE stands for Static Symbolic Execution, and we also implemented an extended version of Veritesting(Avgerinos, Thanassis, et al, ICSE 2014).
Parameters• input_state – The initial state to begin the execution with.
• boundaries – Addresses where execution should stop.
• loop_unrolling_limit – The maximum times that Veritesting should unroll a loop for.
• enable_function_inlining – Whether we should enable function inlining and syscall
inlining.
• terminator – A callback function that takes a state as parameter. Veritesting will terminate if this function returns True.
• deviation_filter – A callback function that takes a state as parameter. Veritesting will
put the state into “deviated” stash if this function returns True.
is_not_in_cfg(s)Returns if s.addr is not a proper node in our CFG.
Parameterss (SimState) – The SimState instance to test.
Returns bool
False if our CFG contains p.addr, True otherwise.
is_overbound(state)
Filter out all states that run out of boundaries or loop too many times.
param SimState state: SimState instance to check returns bool: True if outside of mem/loop_ctr boundaryclass angr.analyses.VSA_DDG(vfg=None, start_addr=None, interfunction_level=0,
context_sensitivity_level=2, keep_data=False)
Bases: Analysis
A Data dependency graph based on VSA states. That means we don’t (and shouldn’t) expect any symbolic
expressions.

808

Chapter 10. API Referenceangr__init__(vfg=None, start_addr=None, interfunction_level=0, context_sensitivity_level=2,keep_data=False)
Constructor.
Parameters• vfg – An already constructed VFG. If not specified, a new VFG will be created with otherspecified parameters. vfg and start_addr cannot both be unspecified.
• start_addr – The address where to start the analysis (typically, a function’s entry point).
• interfunction_level – See VFG analysis.
• context_sensitivity_level – See VFG analysis.
• keep_data – Whether we keep set of addresses as edges in the graph, or just the cardinalityof the sets, which can be used as a “weight”.
get_predecessors(code_location)
Returns all predecessors of code_location.
Parameters
code_location – A CodeLocation instance.
Returns
A list of all predecessors.
get_all_nodes(simrun_addr, stmt_idx)
Get all DDG nodes matching the given basic block address and statement index.
class angr.analyses.BinDiff(other_project, enable_advanced_backward_slicing=False, cfg_a=None,
cfg_b=None)
Bases: Analysis
This class computes the a diff between two binaries represented by angr Projects__init__(other_project, enable_advanced_backward_slicing=False, cfg_a=None, cfg_b=None)
Parameters
other_project – The second project to difffunctions_probably_identical(func_a_addr, func_b_addr, check_consts=False)
Compare two functions and return True if they appear identical.
Parameters• func_a_addr – The address of the first function (in the first binary).
• func_b_addr – The address of the second function (in the second binary).
Returns
Whether or not the functions appear to be identical.
property identical_functions
A list of function matches that appear to be identicalType
returns
property differing_functions
A list of function matches that appear to differType
returns
10.15. Analysis

809

angr

differing_functions_with_consts()
Returns
A list of function matches that appear to differ including just by constants
property differing_blocks
A list of block matches that appear to differType
returns
property identical_blocks
return A list of all block matches that appear to be identicalproperty blocks_with_differing_constants
A dict of block matches with differing constants to the tuple of constantsType
returnproperty unmatched_functions
get_function_diff(function_addr_a, function_addr_b)
Parameters• function_addr_a – The address of the first function (in the first binary)• function_addr_b – The address of the second function (in the second binary)
Returns
the FunctionDiff of the two functionsclass angr.analyses.LoopFinder(functions=None, normalize=True)
Bases: Analysis
Extracts all the loops from all the functions in a binary.
__init__(functions=None, normalize=True)class angr.analyses.CongruencyCheck(throw=False)
Bases: Analysis
This is an analysis to ensure that angr executes things identically with different execution backends (i.e., unicorn
vs vex).
__init__(throw=False)
Initializes a CongruencyCheck analysis.
Parameters
throw – whether to raise an exception if an incongruency is found.
set_state_options(left_add_options=None, left_remove_options=None, right_add_options=None,right_remove_options=None)
Checks that the specified state options result in the same states over the next depth states.
set_states(left_state, right_state)
Checks that the specified paths stay the same over the next depth states.
set_simgr(simgr)

810

Chapter 10. API Referenceangrrun(depth=None)
Checks that the paths in the specified path group stay the same over the next depth bytes.
The path group should have a “left” and a “right” stash, each with a single path.
compare_path_group(pg)compare_states(sl, sr)Compares two states for similarity.
compare_paths(pl, pr)class angr.analyses.StaticHooker(library, binary=None)
Bases: Analysis
This analysis works on statically linked binaries - it finds the library functions statically linked into the binaryand hooks them with the appropriate simprocedures.
Right now it only works on unstripped binaries, but hey! There’s room to grow!
__init__(library, binary=None)class angr.analyses.Reassembler(syntax='intel', remove_cgc_attachments=True, log_relocations=True)
Bases: Analysis
High-level representation of a binary with a linear representation of all instructions and data regions. Aftercalling “symbolize”, it essentially acts as a binary reassembler.
Tested on CGC, x86 and x86-64 binaries.
Disclaimer: The reassembler is an empirical solution. Don’t be surprised if it does not work on some binaries.
__init__(syntax='intel', remove_cgc_attachments=True, log_relocations=True)
property instructions
Get a list of all instructions in the binary
Returns
A list of (address, instruction)
Return type
tuple
property relocations
property inserted_asm_before_label
property inserted_asm_after_label
property main_executable_regions
return:property main_nonexecutable_regions
return:section_alignment(section_name)Get the alignment for the specific section. If the section is not found, 16 is used as default.
Parameters
section_name (str) – The section.
Returns
The alignment in bytes.
10.15. Analysis

811

angr

Return type
int
main_executable_regions_contain(addr)
Parameters
addr
Returns
main_executable_region_limbos_contain(addr)
Sometimes there exists a pointer that points to a few bytes before the beginning of a section, or a few bytes
after the beginning of the section. We take care of that here.
Parametersaddr (int) – The address to check.
Returns
A 2-tuple of (bool, the closest base address)
Return type
tuple
main_nonexecutable_regions_contain(addr)
Parametersaddr (int) – The address to check.
Returns
True if the address is inside a non-executable region, False otherwise.
Return typebool
main_nonexecutable_region_limbos_contain(addr, tolerance_before=64, tolerance_after=64)
Sometimes there exists a pointer that points to a few bytes before the beginning of a section, or a few bytes
after the beginning of the section. We take care of that here.
Parametersaddr (int) – The address to check.
Returns
A 2-tuple of (bool, the closest base address)
Return type
tuple
register_instruction_reference(insn_addr, ref_addr, sort, operand_offset)
register_data_reference(data_addr, ref_addr)
add_label(name, addr)
Add a new label to the symbol manager.
Parameters• name (str) – Name of the label.
• addr (int) – Address of the label.
Returns
None812

Chapter 10. API Referenceangrinsert_asm(addr, asm_code, before_label=False)
Insert some assembly code at the specific address. There must be an instruction starting at that address.
Parameters• addr (int) – Address of insertion• asm_code (str) – The assembly code to insert
ReturnsNoneappend_procedure(name, asm_code)
Add a new procedure with specific name and assembly code.
Parameters• name (str) – The name of the new procedure.
• asm_code (str) – The assembly code of the procedure
ReturnsNoneappend_data(name, initial_content, size, readonly=False, sort='unknown')
Append a new data entry into the binary with specific name, content, and size.
Parameters• name (str) – Name of the data entry. Will be used as the label.
• initial_content (bytes) – The initial content of the data entry.
• size (int) – Size of the data entry.
• readonly (bool) – If the data entry belongs to the readonly region.
• sort (str) – Type of the data.
ReturnsNoneremove_instruction(ins_addr)
Parameters
ins_addr
Returns
randomize_procedures()
Returnssymbolize()assembly(comments=False, symbolized=True)
remove_cgc_attachments()
Remove CGC attachments.
Returns
True if CGC attachments are found and removed, False otherwise
Return typebool

10.15. Analysis

813

angr

remove_unnecessary_stuff()
Remove unnecessary functions and data
ReturnsNoneremove_unnecessary_stuff_glibc()
fast_memory_load(addr, size, data_type, endness='Iend_LE')
Load memory bytes from loader’s memory backend.
Parameters• addr (int) – The address to begin memory loading.
• size (int) – Size in bytes.
• data_type – Type of the data.
• endness (str) – Endianness of this memory load.
Returns
Data read out of the memory.
Return type
int or bytes or str or Noneclass angr.analyses.BinaryOptimizer(cfg, techniques)
Bases: Analysis
This is a collection of binary optimization techniques we used in Mechanical Phish during the finals of Cyber
Grand Challenge. It focuses on dealing with some serious speed-impacting code constructs, and sort of worked
on some CGC binaries compiled with O0. Use this analysis as a reference of how to use data dependency graphand such.
There is no guarantee that BinaryOptimizer will ever work on non-CGC binaries. Feel free to give us PR or MR,
but please do not ask for support of non-CGC binaries.
BLOCKS_THRESHOLD = 500__init__(cfg, techniques)
optimize()class angr.analyses.Disassembly(function=None, ranges=None, thumb=False, include_ir=False,
block_bytes=None)
Bases: Analysis
Produce formatted machine code disassembly.
Parameters• function (Function | None)• ranges (Sequence[tuple[int, int]] | None)• thumb (bool)• include_ir (bool)• block_bytes (bytes | None)

814

Chapter 10. API Referenceangr__init__(function=None, ranges=None, thumb=False, include_ir=False, block_bytes=None)
Parameters• function (Function | None)• ranges (Sequence[tuple[int, int]] | None)• thumb (bool)• include_ir (bool)• block_bytes (bytes | None)func_lookup(block)parse_block(block)
Parse instructions for a given block node
Return type
None
Parameters
block (BlockNode)
render(formatting=None, show_edges=True, show_addresses=True, show_bytes=False, ascii_only=None,
color=True)
Render the disassembly to a string, with optional edges and addresses.
Color will be added by default, if enabled. To disable color pass an empty formatting dict.
Return typestr
Parameters• show_edges (bool)• show_addresses (bool)• show_bytes (bool)• ascii_only (bool | None)• color (bool)class angr.analyses.VariableRecovery(func, max_iterations=20, store_live_variables=False)
Bases: ForwardAnalysis, VariableRecoveryBase
Recover “variables” from a function using forced execution.
While variables play a very important role in programming, it does not really exist after compiling. However, we
can still identify and recovery their counterparts in binaries. It is worth noting that not every variable in sourcecode can be identified in binaries, and not every recognized variable in binaries have a corresponding variablein the original source code. In short, there is no guarantee that the variables we identified/recognized in a binary
are the same variables in its source code.
This analysis uses heuristics to identify and recovers the following types of variables: - Register variables. Stack variables. - Heap variables. (not implemented yet) - Global variables. (not implemented yet)This analysis takes a function as input, and performs a data-flow analysis on nodes. It runs concrete execution on
every statement and hooks all register/memory accesses to discover all places that are accessing variables. It isslow, but has a more accurate analysis result. For a fast but inaccurate variable recovery, you may consider using
VariableRecoveryFast.

10.15. Analysis

815

angr

This analysis follows SSA, which means every write creates a new variable in registers or memory (statck, heap,etc.). Things may get tricky when overlapping variable (in memory, as you cannot really have overlapping accesses to registers) accesses exist, and in such cases, a new variable will be created, and this new variable will
overlap with one or more existing variables. A decision procedure (which is pretty much TODO) is required at
the end of this analysis to resolve the conflicts between overlapping variables.
__init__(func, max_iterations=20, store_live_variables=False)
Parameters
func (knowledge.Function) – The function to analyze.
class angr.analyses.VariableRecoveryFast(func, func_graph=None, max_iterations=2,
low_priority=False, track_sp=True, func_args=None,store_live_variables=False, unify_variables=True,
func_arg_vvars=None, vvar_to_vvar=None)
Bases: ForwardAnalysis, VariableRecoveryBase
Recover “variables” from a function by keeping track of stack pointer offsets and pattern matching VEX statements.
If calling conventions are recovered prior to running VariableRecoveryFast, variables can be recognized moreaccurately. However, it is not a requirement. In this case, the function graph you pass must contain information
indicating the call-out sites inside the analyzed function. These graph edges must be annotated with either"type": "call" or "outside": True.
Parameters• func (Function | str | int)
• func_graph (networkx.DiGraph | None)• max_iterations (int)• func_args (list[SimVariable] | None)• func_arg_vvars (dict[int, tuple[VirtualVariable, SimVariable]] | None)• vvar_to_vvar (dict[int, int] | None)__init__(func, func_graph=None, max_iterations=2, low_priority=False, track_sp=True, func_args=None,store_live_variables=False, unify_variables=True, func_arg_vvars=None, vvar_to_vvar=None)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• func (Function | str | int)
• func_graph (DiGraph | None)• max_iterations (int)• func_args (list[SimVariable] | None)• func_arg_vvars
None)(dict[int, tuple[VirtualVariable, SimVariable]] |• vvar_to_vvar (dict[int, int] | None)
816

Chapter 10. API ReferenceangrReturnsNoneclass angr.analyses.Identifier(cfg=None, require_predecessors=True, only_find=None)
Bases: Analysis__init__(cfg=None, require_predecessors=True, only_find=None)run(only_find=None)
can_call_same_name(addr, name)get_func_info(func)
static constrain_all_zero(before_state, state, regs)
identify_func(function)
check_tests(cfg_func, match_func)
map_callsites()
do_trace(addr_trace, reverse_accesses, func_info)
get_call_args(func, callsite)static get_reg_name(arch, reg_offset)
Parameters• arch – the architecture• reg_offset – Tries to find the name of a register given the offset in the registers.
Returns
The register namefind_stack_vars_x86(func)
static make_initial_state(project, stack_length)
Returns
an initial state with a symbolic stack and good options for rop
static make_symbolic_state(project, reg_list, stack_length=80)
converts an input state into a state with symbolic registers :return: the symbolic stateclass angr.analyses.CalleeCleanupFinder(starts=None, hook_all=False)
Bases: Analysis__init__(starts=None, hook_all=False)
analyze(addr)

10.15. Analysis

817

angr

class angr.analyses.ReachingDefinitionsAnalysis(subject=None, func_graph=None,
max_iterations=30, track_tmps=False,
track_consts=True, observation_points=None,
init_state=None, init_context=None,state_initializer=None, cc=None,
function_handler=None, observe_all=False,
visited_blocks=None, dep_graph=True,observe_callback=None, canonical_size=8,
stack_pointer_tracker=None,
use_callee_saved_regs_at_return=True,
interfunction_level=0, track_liveness=True,
func_addr=None, element_limit=5,
merge_into_tops=True)
Bases: ForwardAnalysis[ReachingDefinitionsState, NodeType, object, object], Analysis
ReachingDefinitionsAnalysis is a text-book implementation of a static data-flow analysis that works on either afunction or a block. It supports both VEX and AIL. By registering observers to observation points, users may use
this analysis to generate use-def chains, def-use chains, and reaching definitions, and perform other traditional
data-flow analyses such as liveness analysis.
• I’ve always wanted to find a better name for this analysis. Now I gave up and decided to live with this namefor the foreseeable future (until a better name is proposed by someone else).
• Aliasing is definitely a problem, and I forgot how aliasing is resolved in this implementation. I’ll leave thisas a post-graduation TODO.
• Some more documentation and examples would be nice.
Parameters• subject (Subject | ailment.Block | Block | Function | str)
• observation_points (Iterable[ObservationPoint] | None)• init_state (ReachingDefinitionsState)• state_initializer (RDAStateInitializer | None)• function_handler (FunctionHandler | None)• dep_graph (DepGraph | bool | None)• interfunction_level (int)• track_liveness (bool)• func_addr (int | None)• element_limit (int)• merge_into_tops (bool)__init__(subject=None, func_graph=None, max_iterations=30, track_tmps=False, track_consts=True,observation_points=None, init_state=None, init_context=None, state_initializer=None, cc=None,
function_handler=None, observe_all=False, visited_blocks=None, dep_graph=True,observe_callback=None, canonical_size=8, stack_pointer_tracker=None,
use_callee_saved_regs_at_return=True, interfunction_level=0, track_liveness=True,
func_addr=None, element_limit=5, merge_into_tops=True)
Parameters

818

Chapter 10. API Referenceangr• subject (Union[Subject, Block, Block, Function, str, None]) – The subject of theanalysis: a function, or a single basic block• func_graph – Alternative graph for function.graph.
• max_iterations – The maximum number of iterations before the analysis is terminated.
• track_tmps – Whether or not temporary variables should be taken into consideration
during the analysis.
• observation_points (iterable) – A collection of tuples of (“node”|”insn”, ins_addr,
OP_TYPE) defining where reaching definitions should be copied and stored. OP_TYPE
can be OP_BEFORE or OP_AFTER.
• init_state (Optional[ReachingDefinitionsState]) – An optional initialization
state. The analysis creates and works on a copy. Default to None: the analysis then initialize
its own abstract state, based on the given <Subject>.
• init_context – If init_state is not given, this is used to initialize the context field of theinitial state’s CodeLocation. The only default-supported type which may go here is a tupleof integers, i.e. a callstack. Anything else requires a custom FunctionHandler.
• cc – Calling convention of the function.
• function_handler (Optional[FunctionHandler]) – The function handler to update
the analysis state and results on function calls.
• observe_all – Observe every statement, both before and after.
• visited_blocks – A set of previously visited blocks.
• dep_graph (DepGraph | bool | None) – An initial dependency graph to add the result of
the analysis to. Set it to None to skip dependency graph generation.
• canonical_size – The sizes (in bytes) that objects with an UNKNOWN_SIZE are treatedas for operations where sizes are necessary.
• dep_graph – Set this to True to generate a dependency graph for the subject. It will beavailable as result.dep_graph.
• interfunction_level (int) – The number of functions we should recurse into. Thisparameter is only used if function_handler is not provided.
• track_liveness (bool) – Whether to track liveness information. This can consume sizeable amounts of RAM on large functions. (e.g. ~15GB for a function with 4k nodes)• merge_into_tops (bool) – Merge known values into TOP if TOP is present. If True:{TOP} V {0xabc} = {TOP} If False: {TOP} V {0xabc} = {TOP, 0xabc}• state_initializer (RDAStateInitializer | None)• func_addr (int | None)• element_limit (int)property observed_results:

dict[tuple[str, int, int], LiveDefinitions]

property all_definitions
property all_uses
property one_result
property dep_graph:10.15. Analysis

DepGraph

819

angr

property visited_blocks
get_reaching_definitions(**kwargs)
get_reaching_definitions_by_insn(ins_addr, op_type)
get_reaching_definitions_by_node(node_addr, op_type)
node_observe(node_addr, state, op_type, node_idx=None)
Parameters• node_addr (int) – Address of the node.
• state (ReachingDefinitionsState) – The analysis state.
• op_type (ObservationPointType) – Type of the observation point. Must be one of thefollowing: OP_BEFORE, OP_AFTER.
• node_idx (Optional[int]) – ID of the node. Used in AIL to differentiate blocks with thesame address.
Return type
Noneinsn_observe(insn_addr, stmt, block, state, op_type)
Parameters• insn_addr (int) – Address of the instruction.
• stmt (Statement | IRStmt) – The statement.
• block (Block | Block) – The current block.
• state (ReachingDefinitionsState) – The abstract analysis state.
• op_type (ObservationPointType) – Type of the observation point. Must be one of thefollowing: OP_BEORE, OP_AFTER.
Return type
None
stmt_observe(stmt_idx, stmt, block, state, op_type)
Parameters• stmt_idx (int)• stmt (Statement | IRStmt)• block (Block | Block)• state (ReachingDefinitionsState)• op_type (ObservationPointType)
Return type
None
Returns
exit_observe(node_addr, exit_stmt_idx, block, state, node_idx=None)
Parameters• node_addr (int)820

Chapter 10. API Referenceangr• exit_stmt_idx (int)• block (Block | Block)• state (ReachingDefinitionsState)• node_idx (int | None)
property subject
callsites_to(target)
Return type
Iterable[FunctionCallRelationships]
Parameters
target (int | str | Function)
class angr.analyses.CallingConventionAnalysis(func, cfg=None, analyze_callsites=False,
caller_func_addr=None, callsite_block_addr=None,
callsite_insn_addr=None, func_graph=None)
Bases: Analysis
Analyze the calling convention of a function and guess a probable prototype.
The calling convention of a function can be inferred at both its call sites and the function itself. At call sites, weconsider all register and stack variables that are not alive after the function call as parameters to this function.
In the function itself, we consider all register and stack variables that are read but without initialization as parameters. Then we synthesize the information from both locations and make a reasonable inference of calling
convention of this function.
Variables• _function – The function to recover calling convention for.
• _variable_manager – A handy accessor to the variable manager.
• _cfg – A reference of the CFGModel of the current binary. It is used to discover call sitesof the current function in order to perform analysis at call sites.
• analyze_callsites – True if we should analyze all call sites of the current function todetermine the calling convention and arguments. This can be time-consuming if there aremany call sites to analyze.
• cc – The recovered calling convention for the function.
Parameters• func (Function | int | str | None)• cfg (CFGModel | None)• analyze_callsites (bool)• caller_func_addr (int | None)• callsite_block_addr (int | None)• callsite_insn_addr (int | None)• func_graph (networkx.DiGraph | None)__init__(func, cfg=None, analyze_callsites=False, caller_func_addr=None, callsite_block_addr=None,
callsite_insn_addr=None, func_graph=None)
Parameters10.15. Analysis

821

angr

• func (Function | int | str | None)• cfg (CFGModel | None)• analyze_callsites (bool)• caller_func_addr (int | None)• callsite_block_addr (int | None)• callsite_insn_addr (int | None)• func_graph (DiGraph | None)is_va_start_amd64(func)
Return typetuple[bool, int | None]
Parameters
func (Function)
class angr.analyses.CodeTagging(func)
Bases: Analysis__init__(func)
analyze()
has_xor()
Detects if there is any xor operation in the function.
ReturnsTags
has_bitshifts()
Detects if there is any bitwise operation in the function.
ReturnsTags.
has_sql()
Detects if there is any reference to strings that look like SQL queries.
class angr.analyses.StackPointerTracker(func, reg_offsets, block=None, track_memory=True,
cross_insn_opt=True, initial_reg_values=None, resilient=True)
Bases: Analysis, ForwardAnalysis
Track the offset of stack pointer at the end of each basic block of a function.
Parameters• func (Function | None)• reg_offsets (set[int])• block (Block | None)• resilient (bool)__init__(func, reg_offsets, block=None, track_memory=True, cross_insn_opt=True,
initial_reg_values=None, resilient=True)
Parameters

822

Chapter 10. API Referenceangr• func (Function | None)• reg_offsets (set[int])• block (Block | None)• resilient (bool)offset_after(addr, reg)
offset_before(addr, reg)
offset_after_block(block_addr, reg)
offset_before_block(block_addr, reg)constant_after(addr, reg)constant_before(addr, reg)constant_after_block(block_addr, reg)constant_before_block(block_addr, reg)
property inconsistent
inconsistent_for(reg)offsets_for(reg)class angr.analyses.DominanceFrontier(func, func_graph=None, entry=None, exception_edges=False)
Bases: Analysis
Computes the dominance frontier of all nodes in a function graph, and provides an easy-to-use interface forquerying the frontier information.
__init__(func, func_graph=None, entry=None, exception_edges=False)class angr.analyses.DataDependencyGraphAnalysis(end_state, start_from=None, end_at=None,
block_addrs=None)
Bases: Analysis
This is a DYNAMIC data dependency graph that utilizes a given SimState to produce a DDG graph that isaccurate to the path the program took during execution.
This analysis utilizes the SimActionData objects present in the provided SimState’s action history to generate thedependency graph.
Parameters• end_state (SimState)• start_from (int | None)• end_at (int | None)• block_addrs (list[int] | None)__init__(end_state, start_from=None, end_at=None, block_addrs=None)
Parameters• end_state (SimState) – Simulation state used to extract all SimActionData

10.15. Analysis

823

angr

• start_from (Optional[int]) – An address or None, Specifies where to start generationof DDG• end_at (Optional[int]) – An address or None, Specifies where to end generation ofDDG• block_addrs (list[int] | None) – List of block addresses that the DDG analysis
should be run on• block_addrs
property graph:

DiGraph | None

property simplified_graph:
property sub_graph:

DiGraph | None

DiGraph | None

get_data_dep(g_node, include_tmp_nodes, backwards)
Return type
DiGraph | None
Parameters• g_node (BaseDepNode)• include_tmp_nodes (bool)• backwards (bool)class angr.analyses.Decompiler(func, cfg=None, options=None, preset=None, optimization_passes=None,
sp_tracker_track_memory=True, variable_kb=None,
peephole_optimizations=None, vars_must_struct=None,flavor='pseudocode', expr_comments=None, stmt_comments=None,
ite_exprs=None, binop_operators=None, decompile=True,
regen_clinic=True, inline_functions=frozenset({}),
update_memory_data=True, generate_code=True)
Bases: Analysis
The decompiler analysis.
Run this on a Function object for which a normalized CFG has been constructed. The fully processed output canbe found in result.codegen.text
Parameters• func (Function | str | int)
• cfg (CFGFast | CFGModel | None)• preset (str | DecompilationPreset | None)• peephole_optimizations (_PEEPHOLE_OPTIMIZATIONS_TYPE)• vars_must_struct (set[str] | None)• update_memory_data (bool)• generate_code (bool)__init__(func, cfg=None, options=None, preset=None, optimization_passes=None,
sp_tracker_track_memory=True, variable_kb=None, peephole_optimizations=None,vars_must_struct=None, flavor='pseudocode', expr_comments=None, stmt_comments=None,
ite_exprs=None, binop_operators=None, decompile=True, regen_clinic=True,
inline_functions=frozenset({}), update_memory_data=True, generate_code=True)
824

Chapter 10. API ReferenceangrParameters• func (Function | str | int)
• cfg (CFGFast | CFGModel | None)• preset (str | DecompilationPreset | None)• peephole_optimizations (Iterable[type[PeepholeOptimizationStmtBase] |type[PeepholeOptimizationExprBase]] | None)• vars_must_struct (set[str] | None)• update_memory_data (bool)• generate_code (bool)
reflow_variable_types(type_constraints, func_typevar, var_to_typevar, codegen)Re-run type inference on an existing variable recovery result, then rerun codegen to generate new results.
Returns
Parameters• type_constraints (set)• var_to_typevar (dict)find_data_references_and_update_memory_data(seq_node)Parameters
seq_node (SequenceNode)static options_to_params(options)
Convert decompilation options to a dict of params.
Parameters
options (list[tuple[DecompilationOption, Any]]) – The decompilation options.
Return type
dict[str, Any]
Returns
A dict of keyword arguments.
class angr.analyses.SootClassHierarchy
Bases: Analysis
Generate complete hierarchy.
__init__()init_hierarchy()has_super_class(cls)is_subclass_including(cls_child, cls_parent)
is_subclass(cls_child, cls_parent)
is_visible_method(cls, method)
is_visible_class(cls_from, cls_to)

10.15. Analysis

825

angr

get_super_classes(cls)get_super_classes_including(cls)get_implementers(interface)get_sub_interfaces_including(interface)get_sub_interfaces(interface)get_sub_classes(cls)get_sub_classes_including(cls)resolve_abstract_dispatch(cls, method)resolve_concrete_dispatch(cls, method)resolve_special_dispatch(method, container)
resolve_invoke(invoke_expr, method, container)class angr.analyses.XRefsAnalysis(func=None, func_graph=None, block=None, max_iterations=1,
replacements=None)
Bases: ForwardAnalysis, Analysis
XRefsAnalysis recovers in-depth x-refs (cross-references) in disassembly code.
Here is an example:.text:
000023C8
000023CA
000023CC
000023CE
000023D0

LDR
LDR
ADDS
STR
BX

.bss:
1FFF36F4 time_now% 4

R2, =time_now
R3, [R2]
R3, #1R3, [R2]LR

You will have the following x-refs for time_now:
23c8 - offset
23ca - read access23ce - write access__init__(func=None, func_graph=None, block=None, max_iterations=1, replacements=None)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
Returns
None826

Chapter 10. API Referenceangrclass angr.analyses.InitializationFinder(func=None, func_graph=None, block=None,
max_iterations=1, replacements=None, overlay=None,
pointers_only=False)
Bases: ForwardAnalysis, Analysis
Finds possible initializations for global data sections and generate an overlay to be used in other analyses lateron.
__init__(func=None, func_graph=None, block=None, max_iterations=1, replacements=None,overlay=None, pointers_only=False)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
ReturnsNoneclass angr.analyses.CompleteCallingConventionsAnalysis(recover_variables=False,
low_priority=False, force=False, cfg=None,
analyze_callsites=False,
skip_signature_matched_functions=False,
max_function_blocks=None,
max_function_size=None, workers=0,
cc_callback=None,
prioritize_func_addrs=None,skip_other_funcs=False, auto_start=True,
func_graphs=None)
Bases: Analysis
Implements full-binary calling convention analysis. During the initial analysis of a binary, you may set recover_variables to True so that it will perform variable recovery on each function before performing calling
convention analysis.
Parameters• cfg (CFGModel | None)• analyze_callsites (bool)• skip_signature_matched_functions (bool)• max_function_blocks (int | None)• max_function_size (int | None)• workers (int)• cc_callback (Callable | None)• prioritize_func_addrs (Iterable[int] | None)• skip_other_funcs (bool)• auto_start (bool)• func_graphs (dict[int, networkx.DiGraph ] | None)
10.15. Analysis

827

angr

__init__(recover_variables=False, low_priority=False, force=False, cfg=None, analyze_callsites=False,
skip_signature_matched_functions=False, max_function_blocks=None, max_function_size=None,
workers=0, cc_callback=None, prioritize_func_addrs=None, skip_other_funcs=False,
auto_start=True, func_graphs=None)
Parameters• recover_variables – Recover variables on each function before performing calling convention analysis.
• low_priority – Run in the background - periodically release GIL.
• force – Perform calling convention analysis on functions even if they have calling conventions or prototypes already specified (or previously recovered).
• cfg (Optional[CFGModel]) – The control flow graph model, which will be passed to
CallingConventionAnalysis.
• analyze_callsites (bool) – Consider artifacts at call sites when performing calling
convention analysis.
• skip_signature_matched_functions (bool) – Do not perform calling convention
analysis on functions that match against existing FLIRT signatures.
• max_function_blocks (Optional[int]) – Do not perform calling convention analysis
on functions with more than the specified number of blocks. Setting it to None disables
this check.
• max_function_size (Optional[int]) – Do not perform calling convention analysis on
functions whose sizes are more than max_function_size. Setting it to None disables thischeck.
• workers (int) – Number of multiprocessing workers.
• cc_callback (Callable | None)• prioritize_func_addrs (Iterable[int] | None)• skip_other_funcs (bool)• auto_start (bool)• func_graphs (dict[int, DiGraph ] | None)work()
prioritize_functions(func_addrs_to_prioritize)
Prioritize the analysis of specified functions.
Parameters
func_addrs_to_prioritize (Iterable[int]) – A collection of function addresses to analyze first.
static function_needs_variable_recovery(func)
Check if running variable recovery on the function is the only way to determine the calling convention of
the this function.
We do not need to run variable recovery to determine the calling convention of a function if: - The function
is a SimProcedure. - The function is a PLT stub. - The function is a library function and we already know
its prototype.
Parameters
func – The function object.

828

Chapter 10. API ReferenceangrReturns
True if we must run VariableRecovery before we can determine what the calling conventionof this function is. False otherwise.
Return typeboolclass angr.analyses.Typehoon(constraints, func_var, ground_truth=None, var_mapping=None,
must_struct=None)
Bases: Analysis
A spiritual tribute to the long-standing typehoon project that @jmg (John Grosen) worked on during his days in
the angr team. Now I feel really bad of asking the poor guy to work directly on VEX IR without any fancy static
analysis support as we have right now. . .
Typehoon analysis implements a pushdown system that simplifies and solves type constraints. Our type constraints are largely an implementation of the paper Polymorphic Type Inference for Machine Code by Noonan,
Loginov, and Cok from GrammaTech (with missing functionality support and bugs, of course). Type constraints
are collected by running VariableRecoveryFast (maybe VariableRecovery later as well) on a function, and thensolved using this analysis.
User may specify ground truth, which will override all types at certain program points during constraint solving.
Parameters• var_mapping (dict[SimVariable, set[TypeVariable]] | None)• must_struct (set[TypeVariable] | None)__init__(constraints, func_var, ground_truth=None, var_mapping=None, must_struct=None)
Parameters• constraints• ground_truth – A set of SimType-style solutions for some or all type variables. They
will be respected during type solving.
• var_mapping (Optional[dict[SimVariable, set[TypeVariable]]])• must_struct (Optional[set[TypeVariable]])update_variable_types(func_addr, var_to_typevars)
Parameters
func_addr (int | str)
pp_constraints()
Pretty-print constraints between variables using the variable mapping.
Return type
None
pp_solution()
Pretty-print solutions using the variable mapping.
Return type
Noneclass angr.analyses.ProximityGraphAnalysis(func, cfg_model, xrefs, decompilation=None,
expand_funcs=None)
Bases: Analysis
Generate a proximity graph.
10.15. Analysis

829

angr

Parameters• func (Function)• cfg_model (CFGModel)• xrefs (XRefManager)• decompilation (Decompiler | None)• expand_funcs (set[int] | None)__init__(func, cfg_model, xrefs, decompilation=None, expand_funcs=None)
Parameters• func (Function)• cfg_model (CFGModel)• xrefs (XRefManager)• decompilation (Decompiler | None)• expand_funcs (set[int] | None)class angr.analyses.VtableFinder
Bases: Analysis
This analysis locates Vtables in a binary based on heuristics taken from - “Reconstruction of Class Hierarchies
for Decompilation of C++ Programs”__init__()is_cross_referenced(addr)
is_function(addr)
analyze()create_extract_vtable(start_addr, sec_size)class angr.analyses.StaticObjectFinder
Bases: Analysis
This analysis tries to find objects on the heap based on calls to new(), and subsequent calls toconstructors withthe ‘this’ pointer__init__()class angr.analyses.ClassIdentifier
Bases: Analysis
This is a class identifier for non stripped or partially stripped binaries, it identifies classes based on the demangled
function names, and also assigns functions to their respective classes based on their names. It also uses the resultsfrom the VtableFinder analysis to assign the corresponding vtable to the classes.
self.classes contains a mapping between class names and SimCppClass objects
e.g. A::tool() and A::qux() belong to the class A__init__()830

Chapter 10. API Referenceangrclass angr.analyses.FlirtAnalysis(sig=None)
Bases: Analysis
FlirtAnalysis accomplishes two purposes:• If a FLIRT signature file is specified, it will match the given signature file against the current binary andrename recognized functions accordingly.
• If no FLIRT signature file is specified, it will use strings to determine possible libraries embedded in thecurrent binary, and then match all possible signatures for the architecture.
Parameters
sig (FlirtSignature | str | None)__init__(sig=None)
Parameters
sig (FlirtSignature | str | None)class angr.analyses.SPropagatorAnalysis(subject, func_graph=None, only_consts=True,
immediate_stmt_removal=False, stack_pointer_tracker=None,func_addr=None)
Bases: Analysis
Constant and expression propagation that only supports SSA AIL graphs.
Parameters• only_consts (bool)• immediate_stmt_removal (bool)• func_addr (int | None)__init__(subject, func_graph=None, only_consts=True, immediate_stmt_removal=False,
stack_pointer_tracker=None, func_addr=None)
Parameters• only_consts (bool)• immediate_stmt_removal (bool)• func_addr (int | None)
property replacements
class angr.analyses.SReachingDefinitionsAnalysis(subject, func_addr=None, func_graph=None,
track_tmps=False, stack_pointer_tracker=None)
Bases: Analysis
Constant and expression propagation that only supports SSA AIL graphs.
Parameters• func_addr (int | None)• track_tmps (bool)__init__(subject, func_addr=None, func_graph=None, track_tmps=False, stack_pointer_tracker=None)
Parameters• func_addr (int | None)
10.15. Analysis

831

angr

• track_tmps (bool)class angr.analyses.SLivenessAnalysis(func, func_graph=None, entry=None, func_addr=None)
Bases: Analysis
Calculates LiveIn and LiveOut sets for each block in a partial-SSA function.
Parameters
func_addr (int | None)__init__(func, func_graph=None, entry=None, func_addr=None)
Parameters
func_addr (int | None)interference_graph()
Generate an interference graph based on the liveness analysis result.
Return type
Graph
Returns
A networkx.Graph instance.
class angr.analyses.analysis.AnalysisLogEntry(message, exc_info=False)
Bases: object__init__(message, exc_info=False)class angr.analyses.analysis.AnalysesHub(project)
Bases: PluginVendor[A]This class contains functions for all the registered and runnable analyses,__init__(project)reload_analyses(**kwargs)
class angr.analyses.analysis.KnownAnalysesPlugin(*args, **kwargs)
Bases: Protocol
Identifier:type[Identifier]CalleeCleanupFinder:

type[CalleeCleanupFinder]

VSA_DDG: type[VSA_DDG ]CDG: type[CDG ]BinDiff:

type[BinDiff ]CFGEmulated:

type[CFGEmulated ]CFB: type[CFBlanket]
CFBlanket:

type[CFBlanket]

CFG: type[CFG ]CFGFast:832

type[CFGFast]

Chapter 10. API ReferenceangrStaticHooker:

type[StaticHooker]

DDG: type[DDG ]CongruencyCheck:
Reassembler:

type[CongruencyCheck ]type[Reassembler]

BackwardSlice:

type[BackwardSlice]

BinaryOptimizer:

type[BinaryOptimizer]

VFG: type[VFG ]LoopFinder:

type[LoopFinder]

Disassembly:

type[Disassembly]

Veritesting:

type[Veritesting]

CodeTagging:

type[CodeTagging]

BoyScout:

type[BoyScout]

VariableRecoveryFast:
VariableRecovery:

type[VariableRecoveryFast]

type[VariableRecovery]

ReachingDefinitions:

type[ReachingDefinitionsAnalysis]

CompleteCallingConventions:
Clinic:type[Clinic]

Propagator:

type[PropagatorAnalysis]

CallingConvention:
Decompiler:
XRefs:

type[CompleteCallingConventionsAnalysis]

type[CallingConventionAnalysis]

type[Decompiler]

type[XRefsAnalysis]__init__(*args, **kwargs)
class angr.analyses.analysis.AnalysesHubWithDefault(project)
Bases: AnalysesHub, KnownAnalysesPlugin
This class has type-hinting for all built-in analyses pluginclass angr.analyses.analysis.AnalysisFactory(project, analysis_cls)
Bases: Generic[A]Parameters• project (Project)• analysis_cls (type[A])10.15. Analysis

833

angr

__init__(project, analysis_cls)
Parameters• project (Project)• analysis_cls (type[A])prep(fail_fast=False, kb=None, progress_callback=None, show_progressbar=False)
Return type
type[TypeVar(A, bound= Analysis)]Parameters• kb (KnowledgeBase | None)• progress_callback (Callable | None)• show_progressbar (bool)class angr.analyses.analysis.Analysis
Bases: object
This class represents an analysis on the program.
Variables• project – The project for this analysis.
• kb (KnowledgeBase) – The knowledgebase object.
• _progress_callback – A callback function for receiving the progress of this analysis. It
only takes one argument, which is a float number from 0.0 to 100.0 indicating the current
progress.
• _show_progressbar (bool) – If a progressbar should be shown during the analysis. It’s
independent from _progress_callback.
• _progressbar (progress.Progress) – The progress bar object.
project:kb:

Project

KnowledgeBase

errors = []named_errors = {}class angr.analyses.forward_analysis.ForwardAnalysis(order_jobs=False, allow_merging=False,
allow_widening=False, status_callback=None,graph_visitor=None)
Bases: Generic[AnalysisState, NodeType, JobType, JobKey]
This is my very first attempt to build a static forward analysis framework that can serve as the base of multiple
static analyses in angr, including CFG analysis, VFG analysis, DDG, etc.
In short, ForwardAnalysis performs a forward data-flow analysis by traversing a graph, compute on abstract
values, and store results in abstract states. The user can specify what graph to traverse, how a graph should betraversed, how abstract values and abstract states are defined, etc.
ForwardAnalysis has a few options to toggle, making it suitable to be the base class of several different styles of
forward data-flow analysis implementations.

834

Chapter 10. API ReferenceangrForwardAnalysis supports a special mode when no graph is available for traversal (for example, when a CFG isbeing initialized and constructed, no other graph can be used). In that case, the graph traversal functionality isdisabled, and the optimal graph traversal order is not guaranteed. The user can provide a job sorting method tosort the jobs in queue and optimize traversal order.
Feel free to discuss with me (Fish) if you have any suggestions or complaints.
Parameters• status_callback (Callable[[type[ForwardAnalysis]], Any] | None)• graph_visitor (GraphVisitor[NodeType] | None)__init__(order_jobs=False, allow_merging=False, allow_widening=False, status_callback=None,graph_visitor=None)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• status_callback (Callable[[type[ForwardAnalysis]], Any] | None)
ReturnsNoneproperty should_abort
Should the analysis be terminated. :return: True/False
property graph:

DiGraphproperty jobs
abort()
Abort the analysis :return: None
has_job(job)Checks whether there exists another job which has the same job key. :type job: TypeVar(JobType) :paramjob: The job to check.
Return typebool
Returns
True if there exists another job with the same key, False otherwise.
Parametersjob (JobType)downsize()class angr.analyses.forward_analysis.CallGraphVisitor(callgraph)
Bases: GraphVisitor
Parameters
callgraph (networkx.DiGraph )10.15. Analysis

835

angr

__init__(callgraph)successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
class angr.analyses.forward_analysis.FunctionGraphVisitor(func, graph=None)
Bases: GraphVisitor
Parameters
func (knowledge.Function)__init__(func, graph=None)
resume_with_new_graph(graph)
We can only reasonably reuse existing results if the node index of the already traversed nodes are the sameas the ones from the new graph. Otherwise, we always restart.
Return typebool
Returns
True if we are resuming, False if reset() is called.
Parametersgraph (DiGraph )successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
836

Chapter 10. API ReferenceangrReturn type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
back_edges()
Get a list of back edges. This function is optional. If not overridden, the traverser cannot achieve an optimal
graph traversal order.
Return type
list[tuple[TypeVar(NodeType), TypeVar(NodeType)]]
Returns
A list of back edges (source -> destination).
class angr.analyses.forward_analysis.LoopVisitor(loop)
Bases: GraphVisitor
Parametersloop (angr.analyses.loopfinder.Loop) – The loop to visit.
__init__(loop)
successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.

10.15. Analysis

837

angr

sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
class angr.analyses.forward_analysis.SingleNodeGraphVisitor(node)
Bases: GraphVisitor
Parametersnode – The single node that should be in the graph.
__init__(node)
node
node_returned
reset()
Reset the internal node traversal state. Must be called prior to visiting future nodes.
ReturnsNonenext_node()
Get the next node to visit.
Returns
A node in the graph.
successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.

838

Chapter 10. API ReferenceangrReturns
A list of sorted nodes.
class angr.analyses.forward_analysis.forward_analysis.ForwardAnalysis(order_jobs=False,
allow_merging=False,
allow_widening=False,
status_callback=None,graph_visitor=None)
Bases: Generic[AnalysisState, NodeType, JobType, JobKey]
This is my very first attempt to build a static forward analysis framework that can serve as the base of multiple
static analyses in angr, including CFG analysis, VFG analysis, DDG, etc.
In short, ForwardAnalysis performs a forward data-flow analysis by traversing a graph, compute on abstract
values, and store results in abstract states. The user can specify what graph to traverse, how a graph should betraversed, how abstract values and abstract states are defined, etc.
ForwardAnalysis has a few options to toggle, making it suitable to be the base class of several different styles of
forward data-flow analysis implementations.
ForwardAnalysis supports a special mode when no graph is available for traversal (for example, when a CFG isbeing initialized and constructed, no other graph can be used). In that case, the graph traversal functionality isdisabled, and the optimal graph traversal order is not guaranteed. The user can provide a job sorting method tosort the jobs in queue and optimize traversal order.
Feel free to discuss with me (Fish) if you have any suggestions or complaints.
Parameters• status_callback (Callable[[type[ForwardAnalysis]], Any] | None)• graph_visitor (GraphVisitor[NodeType] | None)__init__(order_jobs=False, allow_merging=False, allow_widening=False, status_callback=None,graph_visitor=None)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• status_callback (Callable[[type[ForwardAnalysis]], Any] | None)
ReturnsNoneproperty should_abort
Should the analysis be terminated. :return: True/False
property graph:

DiGraphproperty jobs
abort()
Abort the analysis :return: None

10.15. Analysis

839

angr

has_job(job)Checks whether there exists another job which has the same job key. :type job: TypeVar(JobType) :paramjob: The job to check.
Return typebool
Returns
True if there exists another job with the same key, False otherwise.
Parametersjob (JobType)downsize()class angr.analyses.forward_analysis.job_info.JobInfo(key, job)
Bases: Generic[JobType, JobKey]
Stores information of each job.
Parameters• key (JobKey)• job (JobType)__init__(key, job)
Parameters• key (JobKey)• job (JobType)property job: JobType
Get the latest available job.
Returns
The latest available job.
property merged_jobs
property widened_jobs
add_job(job, merged=False, widened=False)
Appended a new job to this JobInfo node. :type job: :param job: The new job to append. :param boolmerged: Whether it is a merged job or not. :param bool widened: Whether it is a widened job or not.
class angr.analyses.forward_analysis.visitors.CallGraphVisitor(callgraph)
Bases: GraphVisitor
Parameters
callgraph (networkx.DiGraph )__init__(callgraph)successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
840

Chapter 10. API ReferenceangrReturn type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
class angr.analyses.forward_analysis.visitors.FunctionGraphVisitor(func, graph=None)
Bases: GraphVisitor
Parameters
func (knowledge.Function)__init__(func, graph=None)
resume_with_new_graph(graph)
We can only reasonably reuse existing results if the node index of the already traversed nodes are the sameas the ones from the new graph. Otherwise, we always restart.
Return typebool
Returns
True if we are resuming, False if reset() is called.
Parametersgraph (DiGraph )successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.

10.15. Analysis

841

angr

Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
back_edges()
Get a list of back edges. This function is optional. If not overridden, the traverser cannot achieve an optimal
graph traversal order.
Return type
list[tuple[TypeVar(NodeType), TypeVar(NodeType)]]
Returns
A list of back edges (source -> destination).
class angr.analyses.forward_analysis.visitors.LoopVisitor(loop)
Bases: GraphVisitor
Parametersloop (angr.analyses.loopfinder.Loop) – The loop to visit.
__init__(loop)
successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.

842

Chapter 10. API Referenceangrclass angr.analyses.forward_analysis.visitors.SingleNodeGraphVisitor(node)
Bases: GraphVisitor
Parametersnode – The single node that should be in the graph.
__init__(node)
node
node_returned
reset()
Reset the internal node traversal state. Must be called prior to visiting future nodes.
ReturnsNonenext_node()
Get the next node to visit.
Returns
A node in the graph.
successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
class angr.analyses.forward_analysis.visitors.call_graph.CallGraphVisitor(callgraph)
Bases: GraphVisitor
Parameters
callgraph (networkx.DiGraph )10.15. Analysis

843

angr

__init__(callgraph)successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
class angr.analyses.forward_analysis.visitors.function_graph.FunctionGraphVisitor(func,
graph=None)
Bases: GraphVisitor
Parameters
func (knowledge.Function)__init__(func, graph=None)
resume_with_new_graph(graph)
We can only reasonably reuse existing results if the node index of the already traversed nodes are the sameas the ones from the new graph. Otherwise, we always restart.
Return typebool
Returns
True if we are resuming, False if reset() is called.
Parametersgraph (DiGraph )successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.

844

Chapter 10. API ReferenceangrReturns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
back_edges()
Get a list of back edges. This function is optional. If not overridden, the traverser cannot achieve an optimal
graph traversal order.
Return type
list[tuple[TypeVar(NodeType), TypeVar(NodeType)]]
Returns
A list of back edges (source -> destination).
class angr.analyses.forward_analysis.visitors.graph.GraphVisitor
Bases: Generic[NodeType]A graph visitor takes a node in the graph and returns its successors. Typically, it visits a control flow graph, andreturns successors of a CFGNode each time. This is the base class of all graph visitors.
__init__()successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode (TypeVar(NodeType)) – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode (TypeVar(NodeType)) – The node to work with.

10.15. Analysis

845

angr

Return type
list[TypeVar(NodeType)]
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Return type
list[TypeVar(NodeType)]
Returns
A list of sorted nodes.
back_edges()
Get a list of back edges. This function is optional. If not overridden, the traverser cannot achieve an optimal
graph traversal order.
Return type
list[tuple[TypeVar(NodeType), TypeVar(NodeType)]]
Returns
A list of back edges (source -> destination).
nodes()
Return an iterator of nodes following an optimal traversal order.
Return type
Iterator[TypeVar(NodeType)]
Returns
nodes_iter(**kwargs)
reset()
Reset the internal node traversal state. Must be called prior to visiting future nodes.
ReturnsNonenext_node()
Get the next node to visit.
Return type
Optional[TypeVar(NodeType)]
Returns
A node in the graph.
all_successors(node, skip_reached_fixedpoint=False)
Returns all successors to the specific node.
Parametersnode (TypeVar(NodeType)) – A node in the graph.
Returns
A set of nodes that are all successors to the given node.

846

Chapter 10. API ReferenceangrReturn typeset
revisit_successors(node, include_self=True)
Revisit a node in the future. As a result, the successors to this node will be revisited as well.
Parametersnode (TypeVar(NodeType)) – The node to revisit in the future.
Return type
None
ReturnsNonerevisit_node(node)
Revisit a node in the future. Do not include its successors immediately.
Parametersnode (TypeVar(NodeType)) – The node to revisit in the future.
Return type
None
ReturnsNonereached_fixedpoint(node)Mark a node as reached fixed-point. This node as well as all its successors will not be visited in the future.
Parametersnode (TypeVar(NodeType)) – The node to mark as reached fixed-point.
Return type
None
ReturnsNoneclass angr.analyses.forward_analysis.visitors.loop.LoopVisitor(loop)
Bases: GraphVisitor
Parametersloop (angr.analyses.loopfinder.Loop) – The loop to visit.
__init__(loop)
successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.

10.15. Analysis

847

angr

Parametersnode – The node to work with.
Returns
A list of predecessors.
sort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
class angr.analyses.forward_analysis.visitors.single_node_graph.SingleNodeGraphVisitor(node)
Bases: GraphVisitor
Parametersnode – The single node that should be in the graph.
__init__(node)
node
node_returned
reset()
Reset the internal node traversal state. Must be called prior to visiting future nodes.
ReturnsNonenext_node()
Get the next node to visit.
Returns
A node in the graph.
successors(node)
Get successors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of successors.
Return type
list
predecessors(node)
Get predecessors of a node. The node should be in the graph.
Parametersnode – The node to work with.
Returns
A list of predecessors.

848

Chapter 10. API Referenceangrsort_nodes(nodes=None)
Get a list of all nodes sorted in an optimal traversal order.
Parameters
nodes (iterable) – A collection of nodes to sort. If none, all nodes in the graph will be
used to sort.
Returns
A list of sorted nodes.
class angr.analyses.backward_slice.BackwardSlice(cfg, cdg, ddg, targets=None, cfg_node=None,
stmt_id=None, control_flow_slice=False,
same_function=False, no_construct=False)
Bases: Analysis
Represents a backward slice of the program.
__init__(cfg, cdg, ddg, targets=None, cfg_node=None, stmt_id=None, control_flow_slice=False,
same_function=False, no_construct=False)
Create a backward slice from a specific statement based on provided control flow graph (CFG), control
dependence graph (CDG), and data dependence graph (DDG).
The data dependence graph can be either CFG-based, or Value-set analysis based. A CFG-based DDG ismuch faster to generate, but it only reflects those states while generating the CFG, and it is neither soundnor accurate. The VSA based DDG (called VSA_DDG) is based on static analysis, which gives you a muchbetter result.
Parameters• cfg – The control flow graph.
• cdg – The control dependence graph.
• ddg – The data dependence graph.
• targets – A list of “target” that specify targets of the backward slices. Each target can bea tuple in form of (cfg_node, stmt_idx), or a CodeLocation instance.
• cfg_node – Deprecated. The target CFGNode to reach. It should exist in the CFG.
• stmt_id – Deprecated. The target statement to reach.
• control_flow_slice – True/False, indicates whether we should slice only based on
CFG. Sometimes when acquiring DDG is difficult or impossible, you can just create aslice on your CFG. Well, if you don’t even have a CFG, then. . .
• no_construct – Only used for testing and debugging to easily create a BackwardSliceobject.
dbg_repr(max_display=10)
Debugging output of this slice.
Parameters
max_display – The maximum number of SimRun slices to show.
Returns
A string representation.
dbg_repr_run(run_addr)
Debugging output of a single SimRun slice.
Parameters
run_addr – Address of the SimRun.
10.15. Analysis

849

angr

Returns
A string representation.
annotated_cfg(start_point=None)
Returns an AnnotatedCFG based on slicing result.
is_taint_related_to_ip(simrun_addr, stmt_idx, taint_type, simrun_whitelist=None)
Query in taint graph to check if a specific taint will taint the IP in the future or not. The taint is specified
with the tuple (simrun_addr, stmt_idx, taint_type).
Parameters• simrun_addr – Address of the SimRun.
• stmt_idx – Statement ID.
• taint_type – Type of the taint, might be one of the following: ‘reg’, ‘tmp’, ‘mem’.
• simrun_whitelist – A list of SimRun addresses that are whitelisted, i.e. the tainted exit
will be ignored if it is in those SimRuns.
Returns
True/False
is_taint_impacting_stack_pointers(simrun_addr, stmt_idx, taint_type, simrun_whitelist=None)
Query in taint graph to check if a specific taint will taint the stack pointer in the future or not. The taint is
specified with the tuple (simrun_addr, stmt_idx, taint_type).
Parameters• simrun_addr – Address of the SimRun.
• stmt_idx – Statement ID.
• taint_type – Type of the taint, might be one of the following: ‘reg’, ‘tmp’, ‘mem’.
• simrun_whitelist – A list of SimRun addresses that are whitelisted.
Returns
True/False.
exception angr.analyses.bindiff.UnmatchedStatementsException
Bases: Exception
class angr.analyses.bindiff.Difference(diff_type, value_a, value_b)
Bases: object__init__(diff_type, value_a, value_b)class angr.analyses.bindiff.ConstantChange(offset, value_a, value_b)
Bases: object__init__(offset, value_a, value_b)
angr.analyses.bindiff.differing_constants(block_a, block_b)
Compares two basic blocks and finds all the constants that differ from the first block to the second.
Parameters• block_a – The first block to compare.
• block_b – The second block to compare.

850

Chapter 10. API ReferenceangrReturns
Returns a list of differing constants in the form of ConstantChange, which has the offset in theblock and the respective constants.
angr.analyses.bindiff.compare_statement_dict(statement_1, statement_2)
class angr.analyses.bindiff.NormalizedBlock(block, function)
Bases: object__init__(block, function)
class angr.analyses.bindiff.NormalizedFunction(function)
Bases: object
Parametersfunction (Function)__init__(function)
Parametersfunction (Function)
class angr.analyses.bindiff.FunctionDiff(function_a, function_b, bindiff=None)
Bases: object
This class computes the a diff between two functions.
Parameters• function_a (Function)• function_b (Function)__init__(function_a, function_b, bindiff=None)
Parameters• function_a (Function) – The first angr Function object to diff.
• function_b (Function) – The second angr Function object.
• bindiff – An optional Bindiff object. Used for some extra normalization during basic
block comparison.
property probably_identical
Whether or not these two functions are identical.
Type
returns
property identical_blocks
A list of block matches which appear to be identicalType
returns
property differing_blocks
A list of block matches which appear to differType
returns

10.15. Analysis

851

angr

property blocks_with_differing_constants
A list of block matches which appear to differType
returnproperty block_matches
property unmatched_blocks
static get_normalized_block(addr, function)
Parameters• addr – Where to start the normalized block.
• function – A function containing the block address.
Returns
A normalized basic block.
block_similarity(block_a, block_b)
Parameters• block_a – The first block address.
• block_b – The second block address.
Returns
The similarity of the basic blocks, normalized for the base address of the block and function
call addresses.
blocks_probably_identical(block_a, block_b, check_constants=False)
Parameters• block_a – The first block address.
• block_b – The second block address.
• check_constants – Whether or not to require matching constants in blocks.
Returns
Whether or not the blocks appear to be identical.
class angr.analyses.bindiff.BinDiff(other_project, enable_advanced_backward_slicing=False,
cfg_a=None, cfg_b=None)
Bases: Analysis
This class computes the a diff between two binaries represented by angr Projects__init__(other_project, enable_advanced_backward_slicing=False, cfg_a=None, cfg_b=None)
Parameters
other_project – The second project to difffunctions_probably_identical(func_a_addr, func_b_addr, check_consts=False)
Compare two functions and return True if they appear identical.
Parameters• func_a_addr – The address of the first function (in the first binary).
• func_b_addr – The address of the second function (in the second binary).

852

Chapter 10. API ReferenceangrReturns
Whether or not the functions appear to be identical.
property identical_functions
A list of function matches that appear to be identicalType
returns
property differing_functions
A list of function matches that appear to differType
returns
differing_functions_with_consts()
Returns
A list of function matches that appear to differ including just by constants
property differing_blocks
A list of block matches that appear to differType
returns
property identical_blocks
return A list of all block matches that appear to be identicalproperty blocks_with_differing_constants
A dict of block matches with differing constants to the tuple of constantsType
returnproperty unmatched_functions
get_function_diff(function_addr_a, function_addr_b)
Parameters• function_addr_a – The address of the first function (in the first binary)• function_addr_b – The address of the second function (in the second binary)
Returns
the FunctionDiff of the two functionsclass angr.analyses.boyscout.BoyScout(cookiesize=1)
Bases: Analysis
Try to determine the architecture and endieness of a binary blob__init__(cookiesize=1)
class angr.analyses.calling_convention.CallSiteFact(return_value_used)
Bases: object
Store facts about each call site.
__init__(return_value_used)

10.15. Analysis

853

angr

class angr.analyses.calling_convention.UpdateArgumentsOption
Bases: object
Enums for controlling the argument updating behavior in _adjust_cc.
DoNotUpdate = 0
AlwaysUpdate = 1
UpdateWhenCCHasNoArgs = 2
class angr.analyses.calling_convention.CallingConventionAnalysis(func, cfg=None,
analyze_callsites=False,
caller_func_addr=None,
callsite_block_addr=None,
callsite_insn_addr=None,func_graph=None)
Bases: Analysis
Analyze the calling convention of a function and guess a probable prototype.
The calling convention of a function can be inferred at both its call sites and the function itself. At call sites, weconsider all register and stack variables that are not alive after the function call as parameters to this function.
In the function itself, we consider all register and stack variables that are read but without initialization as parameters. Then we synthesize the information from both locations and make a reasonable inference of calling
convention of this function.
Variables• _function – The function to recover calling convention for.
• _variable_manager – A handy accessor to the variable manager.
• _cfg – A reference of the CFGModel of the current binary. It is used to discover call sitesof the current function in order to perform analysis at call sites.
• analyze_callsites – True if we should analyze all call sites of the current function todetermine the calling convention and arguments. This can be time-consuming if there aremany call sites to analyze.
• cc – The recovered calling convention for the function.
Parameters• func (Function | int | str | None)• cfg (CFGModel | None)• analyze_callsites (bool)• caller_func_addr (int | None)• callsite_block_addr (int | None)• callsite_insn_addr (int | None)• func_graph (networkx.DiGraph | None)__init__(func, cfg=None, analyze_callsites=False, caller_func_addr=None, callsite_block_addr=None,
callsite_insn_addr=None, func_graph=None)
Parameters• func (Function | int | str | None)

854

Chapter 10. API Referenceangr• cfg (CFGModel | None)• analyze_callsites (bool)• caller_func_addr (int | None)• callsite_block_addr (int | None)• callsite_insn_addr (int | None)• func_graph (DiGraph | None)is_va_start_amd64(func)
Return typetuple[bool, int | None]
Parameters
func (Function)

class angr.analyses.complete_calling_conventions.CompleteCallingConventionsAnalysis(recover_variables=False,
low_priority=False,
force=False,
cfg=None,analyze_callsites=False,
skip_signature_matched_
max_function_blocks=No
max_function_size=Noneworkers=0,
cc_callback=None,
prioritize_func_addrs=None,skip_other_funcs=False,
auto_start=True,
func_graphs=None)
Bases: Analysis
Implements full-binary calling convention analysis. During the initial analysis of a binary, you may set recover_variables to True so that it will perform variable recovery on each function before performing calling
convention analysis.
Parameters• cfg (CFGModel | None)• analyze_callsites (bool)• skip_signature_matched_functions (bool)• max_function_blocks (int | None)• max_function_size (int | None)• workers (int)• cc_callback (Callable | None)• prioritize_func_addrs (Iterable[int] | None)• skip_other_funcs (bool)• auto_start (bool)
10.15. Analysis

855

angr

• func_graphs (dict[int, networkx.DiGraph ] | None)__init__(recover_variables=False, low_priority=False, force=False, cfg=None, analyze_callsites=False,
skip_signature_matched_functions=False, max_function_blocks=None, max_function_size=None,
workers=0, cc_callback=None, prioritize_func_addrs=None, skip_other_funcs=False,
auto_start=True, func_graphs=None)
Parameters• recover_variables – Recover variables on each function before performing calling convention analysis.
• low_priority – Run in the background - periodically release GIL.
• force – Perform calling convention analysis on functions even if they have calling conventions or prototypes already specified (or previously recovered).
• cfg (Optional[CFGModel]) – The control flow graph model, which will be passed to
CallingConventionAnalysis.
• analyze_callsites (bool) – Consider artifacts at call sites when performing calling
convention analysis.
• skip_signature_matched_functions (bool) – Do not perform calling convention
analysis on functions that match against existing FLIRT signatures.
• max_function_blocks (Optional[int]) – Do not perform calling convention analysis
on functions with more than the specified number of blocks. Setting it to None disables
this check.
• max_function_size (Optional[int]) – Do not perform calling convention analysis on
functions whose sizes are more than max_function_size. Setting it to None disables thischeck.
• workers (int) – Number of multiprocessing workers.
• cc_callback (Callable | None)• prioritize_func_addrs (Iterable[int] | None)• skip_other_funcs (bool)• auto_start (bool)• func_graphs (dict[int, DiGraph ] | None)work()
prioritize_functions(func_addrs_to_prioritize)
Prioritize the analysis of specified functions.
Parameters
func_addrs_to_prioritize (Iterable[int]) – A collection of function addresses to analyze first.
static function_needs_variable_recovery(func)
Check if running variable recovery on the function is the only way to determine the calling convention of
the this function.
We do not need to run variable recovery to determine the calling convention of a function if: - The function
is a SimProcedure. - The function is a PLT stub. - The function is a library function and we already know
its prototype.

856

Chapter 10. API ReferenceangrParameters
func – The function object.
Returns
True if we must run VariableRecovery before we can determine what the calling conventionof this function is. False otherwise.
Return typebool
exception angr.analyses.soot_class_hierarchy.SootClassHierarchyError(msg)
Bases: Exception__init__(msg)
exception angr.analyses.soot_class_hierarchy.NoConcreteDispatch(msg)
Bases: SootClassHierarchyError__init__(msg)class angr.analyses.soot_class_hierarchy.SootClassHierarchy
Bases: Analysis
Generate complete hierarchy.
__init__()init_hierarchy()has_super_class(cls)is_subclass_including(cls_child, cls_parent)
is_subclass(cls_child, cls_parent)
is_visible_method(cls, method)
is_visible_class(cls_from, cls_to)
get_super_classes(cls)get_super_classes_including(cls)get_implementers(interface)get_sub_interfaces_including(interface)get_sub_interfaces(interface)get_sub_classes(cls)get_sub_classes_including(cls)resolve_abstract_dispatch(cls, method)resolve_concrete_dispatch(cls, method)resolve_special_dispatch(method, container)
resolve_invoke(invoke_expr, method, container)

10.15. Analysis

857

angr

class angr.analyses.cfg.CFGFast(binary=None, objects=None, regions=None,
pickle_intermediate_results=False, symbols=True,
function_prologues=True, resolve_indirect_jumps=True,
force_segment=False, force_smart_scan=True,
force_complete_scan=False, indirect_jump_target_limit=100000,
data_references=True, cross_references=False, normalize=False,start_at_entry=True, function_starts=None,
extra_memory_regions=None, data_type_guessing_handlers=None,arch_options=None, indirect_jump_resolvers=None, base_state=None,
exclude_sparse_regions=True, skip_specific_regions=True,
heuristic_plt_resolving=None, detect_tail_calls=False,
low_priority=False, cfb=None, model=None, elf_eh_frame=True,
exceptions=True, skip_unmapped_addrs=True,
nodecode_window_size=512, nodecode_threshold=0.3,
nodecode_step=16483, indirect_calls_always_return=None,
jumptable_resolver_resolves_calls=None, start=None, end=None,collect_data_references=None, extra_cross_references=None,**extra_arch_options)
Bases: ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase
We find functions inside the given binary, and build a control-flow graph in very fast manners: instead of simulating program executions, keeping track of states, and performing expensive data-flow analysis, CFGFast will
only perform light-weight analyses combined with some heuristics, and with some strong assumptions.
In order to identify as many functions as possible, and as accurate as possible, the following operation sequenceis followed:# Active scanning• If the binary has “function symbols” (TODO: this term is not accurate enough), they are starting points ofthe code scanning• If the binary does not have any “function symbol”, we will first perform a function prologue scanning on
the entire binary, and start from those places that look like function beginnings• Otherwise, the binary’s entry point will be the starting point for scanning# Passive scanning• After all active scans are done, we will go through the whole image and scan all code pieces
Due to the nature of those techniques that are used here, a base address is often not required to use this analysis
routine. However, with a correct base address, CFG recovery will almost always yield a much better result. A
custom analysis, called GirlScout, is specifically made to recover the base address of a binary blob. After the baseaddress is determined, you may want to reload the binary with the new base address by creating a new Project
object, and then re-recover the CFG.
Parameters• indirect_calls_always_return (bool | None)• jumptable_resolver_resolves_calls (bool | None)
PRINTABLES = b'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r'
SPECIAL_THUNKS = {'AMD64':{b'\xe8\x07\x00\x00\x00\xf3\x90\x0f\xae\xe8\xeb\xf9H\x89\x04$\xc3':
b'\xe8\x07\x00\x00\x00\xf3\x90\x0f\xae\xe8\xeb\xf9H\x8dd$\x08\xc3':

858('jmp', 'rax'),('ret',)}}

Chapter 10. API Reference

angr

tag:

str | None = 'CFGFast'__init__(binary=None, objects=None, regions=None, pickle_intermediate_results=False, symbols=True,
function_prologues=True, resolve_indirect_jumps=True, force_segment=False,
force_smart_scan=True, force_complete_scan=False, indirect_jump_target_limit=100000,
data_references=True, cross_references=False, normalize=False, start_at_entry=True,
function_starts=None, extra_memory_regions=None, data_type_guessing_handlers=None,arch_options=None, indirect_jump_resolvers=None, base_state=None,
exclude_sparse_regions=True, skip_specific_regions=True, heuristic_plt_resolving=None,
detect_tail_calls=False, low_priority=False, cfb=None, model=None, elf_eh_frame=True,
exceptions=True, skip_unmapped_addrs=True, nodecode_window_size=512,
nodecode_threshold=0.3, nodecode_step=16483, indirect_calls_always_return=None,
jumptable_resolver_resolves_calls=None, start=None, end=None, collect_data_references=None,
extra_cross_references=None, **extra_arch_options)Parameters• binary – The binary to recover CFG on. By default the main binary is used.
• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to andfrom each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.
• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.
• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
10.15. Analysis

859

angr

• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return (Optional[bool]) – Should CFG assume indirectcalls must return or not. Assuming indirect calls must return will significantly reduce thenumber of constant propagation runs, but may reduce the overall CFG recovery precision
when facing non-returning indirect calls. By default, we only assume indirect calls always
return for large binaries (region > 50KB).
• jumptable_resolver_resolves_calls (Optional[bool]) – Whether JumpTableResolver should resolve indirect calls or not. Most indirect calls in C++ binaries or UEFI
binaries cannot be resolved using jump table resolver and must be resolved using their specific resolvers. By default, we will only disable JumpTableResolver from resolving indirectcalls for large binaries (region > 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.
• indirect_calls_always_return (bool | None)• jumptable_resolver_resolves_calls (bool | None)
ReturnsNoneproperty graphproperty memory_data
property jump_tables
property insn_addr_to_memory_data

860

Chapter 10. API Referenceangrdo_full_xrefs(overlay_state=None)
Perform xref recovery on all functions.
Parameters
overlay (SimState) – An overlay state for loading constant data.
ReturnsNonecopy()
indirect_jumps:
project:kb:

dict[int, IndirectJump]

Project

KnowledgeBase

output()generate_code_cover(**kwargs)
class angr.analyses.cfg.CFGEmulated(context_sensitivity_level=1, start=None, avoid_runs=None,enable_function_hints=False, call_depth=None,
call_tracing_filter=None, initial_state=None, starts=None,
keep_state=False, indirect_jump_target_limit=100000,
resolve_indirect_jumps=True,
enable_advanced_backward_slicing=False,
enable_symbolic_back_traversal=False,
indirect_jump_resolvers=None, additional_edges=None,no_construct=False, normalize=False, max_iterations=1,
address_whitelist=None, base_graph=None, iropt_level=None,
max_steps=None, state_add_options=None,state_remove_options=None, model=None)
Bases: ForwardAnalysis, CFGBase
This class represents a control-flow graph.
tag:

str | None = 'CFGEmulated'__init__(context_sensitivity_level=1, start=None, avoid_runs=None, enable_function_hints=False,
call_depth=None, call_tracing_filter=None, initial_state=None, starts=None, keep_state=False,
indirect_jump_target_limit=100000, resolve_indirect_jumps=True,
enable_advanced_backward_slicing=False, enable_symbolic_back_traversal=False,
indirect_jump_resolvers=None, additional_edges=None, no_construct=False, normalize=False,
max_iterations=1, address_whitelist=None, base_graph=None, iropt_level=None,
max_steps=None, state_add_options=None, state_remove_options=None, model=None)
All parameters are optional.
Parameters• context_sensitivity_level – The level of context-sensitivity of this CFG (see documentation for further details). It ranges from 0 to infinity. Default 1.
• avoid_runs – A list of runs to avoid.
• enable_function_hints – Whether to use function hints (constants that might be used
as exit targets) or not.
• call_depth – How deep in the call stack to trace.

10.15. Analysis

861

angr

• call_tracing_filter – Filter to apply on a given path and jumpkind to determine if itshould be skipped when call_depth is reached.
• initial_state – An initial state to use to begin analysis.
• starts (iterable) – A collection of starting points to begin analysis. It can contain thefollowing three different types of entries: an address specified as an integer, a 2-tuple that
includes an integer address and a jumpkind, or a SimState instance. Unsupported entries
in starts will lead to an AngrCFGError being raised.
• keep_state – Whether to keep the SimStates for each CFGNode.
• resolve_indirect_jumps – Whether to enable the indirect jump resolvers for resolving
indirect jumps• enable_advanced_backward_slicing – Whether to enable an intensive technique forresolving indirect jumps• enable_symbolic_back_traversal – Whether to enable an intensive technique for resolving indirect jumps• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• additional_edges – A dict mapping addresses of basic blocks to addresses of successors
to manually include and analyze forward from.
• no_construct (bool) – Skip the construction procedure. Only used in unit-testing.
• normalize (bool) – If the CFG as well as all Function graphs should be normalized ornot.
• max_iterations (int) – The maximum number of iterations that each basic block should
be “executed”. 1 by default. Larger numbers of iterations are usually required for complex
analyses like loop analysis.
• address_whitelist (iterable) – A list of allowed addresses. Any basic blocks outsideof this collection of addresses will be ignored.
• base_graph (networkx.DiGraph ) – A basic control flow graph to follow. Each nodeinside this graph must have the following properties: addr and size. CFG recovery will
strictly follow nodes and edges shown in the graph, and discard any control flow that does
not follow an existing edge in the base graph. For example, you can pass in a Function
local transition graph as the base graph, and CFGEmulated will traverse nodes and edges
and extract useful information.
• iropt_level (int) – The optimization level of VEX IR (0, 1, 2). The default level will
be used if iropt_level is None.
• max_steps (int) – The maximum number of basic blocks to recover forthe longest pathfrom each start before pausing the recovery procedure.
• state_add_options – State options that will be added to the initial state.
• state_remove_options – State options that will be removed from the initial state.
copy()
Make a copy of the CFG.
Return type
CFGEmulated

862

Chapter 10. API ReferenceangrReturns
A copy of the CFG instance.
resume(starts=None, max_steps=None)
Resume a paused or terminated control flow graph recovery.
Parameters• starts (iterable) – A collection of new starts to resume from. If starts is None, we will
resume CFG recovery from where it was paused before.
• max_steps (int) – The maximum number of blocks on the longest path starting from eachstart before pausing the recovery.
ReturnsNoneremove_cycles()Forces graph to become acyclic, removes all loop back edges and edges between overlapped loop headers
and their successors.
downsize()
Remove saved states from all CFGNodes to reduce memory usage.
Returns
None
unroll_loops(max_loop_unrolling_times)
Unroll loops for each function. The resulting CFG may still contain loops due to recursion, function calls,
etc.
Parameters
max_loop_unrolling_times (int) – The maximum iterations of unrolling.
Returns
None
force_unroll_loops(max_loop_unrolling_times)
Unroll loops globally. The resulting CFG does not contain any loop, but this method is slow on large graphs.
Parameters
max_loop_unrolling_times (int) – The maximum iterations of unrolling.
ReturnsNone
immediate_dominators(start, target_graph=None)
Get all immediate dominators of sub graph from given node upwards.
Parameters• start (str) – id of the node to navigate forwards from.
• target_graph (networkx.classes.digraph.DiGraph ) – graph to analyse, default isself.graph.
Returnseach node of graph as index values, with element as respective node’s immediate dominator.
Return type
dict10.15. Analysis

863

angr

immediate_postdominators(end, target_graph=None)
Get all immediate postdominators of sub graph from given node upwards.
Parameters• start (str) – id of the node to navigate forwards from.
• target_graph (networkx.classes.digraph.DiGraph ) – graph to analyse, default isself.graph.
Returnseach node of graph as index values, with element as respective node’s immediate dominator.
Return type
dictremove_fakerets()
Get rid of fake returns (i.e., Ijk_FakeRet edges) from this CFG
ReturnsNone
get_topological_order(cfg_node)
Get the topological order of a CFG Node.
Parameters
cfg_node – A CFGNode instance.
Returns
An integer representing its order, or None if the CFGNode does not exist in the graph.
get_subgraph(starting_node, block_addresses)
Get a sub-graph out of a bunch of basic block addresses.
Parameters• starting_node (CFGNode) – The beginning of the subgraph• block_addresses (iterable) – A collection of block addresses that should be includedin the subgraph if there is a path between starting_node and a CFGNode with the specified
address, and all nodes on the path should also be included in the subgraph.
Returns
A new CFG that only contain the specific subgraph.
Return type
CFGEmulated
get_function_subgraph(start, max_call_depth=None)
Get a sub-graph of a certain function.
Parameters• start – The function start. Currently it should be an integer.
• max_call_depth – Call depth limit. None indicates no limit.
Returns
A CFG instance which is a sub-graph of self.graphproperty context_sensitivity_levelproperty graph

864

Chapter 10. API Referenceangrproperty unresolvables
Get those SimRuns that have non-resolvable exits.
Returns
A set of SimRuns
Return typeset
property deadends
Get all CFGNodes that has an out-degree of 0
Returns
A list of CFGNode instances
Return type
list
indirect_jumps:
project:kb:

dict[int, IndirectJump]

Project

KnowledgeBase

class angr.analyses.cfg.CFG(**kwargs)
Bases: CFGFast
tl;dr: CFG is just a wrapper around CFGFast for compatibility issues. It will be fully replaced by CFGFast in
future releases. Feel free to use CFG if you intend to use CFGFast. Please use CFGEmulated if you have to use
the old, slow, dynamically-generated version of CFG.
For multiple historical reasons, angr’s CFG is accurate but slow, which does not meet what most people expect.
We developed CFGFast for light-speed CFG recovery, and renamed the old CFG class to CFGEmulated. For
compatibility concerns, CFG was kept as an alias to CFGEmulated.
However, so many new users of angr would load up a binary and generate a CFG immediately after running “pipinstall angr”, and draw the conclusion that “angr’s CFG is so slow - angr must be unusable!” Therefore, we madethe hard decision: CFG will be an alias to CFGFast, instead of CFGEmulated.
To ease the transition of your existing code and script, the following changes are made:• A CFG class, which is a sub class of CFGFast, is created.
• You will see both a warning message printed out to stderr and an exception raised by angr if you are passing
CFG any parameter that only CFGEmulated supports. This exception is not a sub class of AngrError, so
you wouldn’t capture it with your old code by mistake.
• In the near future, this wrapper class will be removed completely, and CFG will be a simple alias to CFGFast.
We expect most interfaces are the same between CFGFast and CFGEmulated. Apparently some functionalities(like context-sensitivity, and state keeping) only exist in CFGEmulated, which is when you want to use CFGEmulated instead.
__init__(**kwargs)
Parameters• binary – The binary to recover CFG on. By default the main binary is used.
• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.

10.15. Analysis

865

angr

• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to andfrom each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.
• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.
• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return – Should CFG assume indirect calls must return ornot. Assuming indirect calls must return will significantly reduce the number of constantpropagation runs, but may reduce the overall CFG recovery precision when facing nonreturning indirect calls. By default, we only assume indirect calls always return for large
binaries (region > 50KB).

866

Chapter 10. API Referenceangr• jumptable_resolver_resolves_calls – Whether JumpTableResolver should resolve
indirect calls or not. Most indirect calls in C++ binaries or UEFI binaries cannot be resolved
using jump table resolver and must be resolved using their specific resolvers. By default, we
will only disable JumpTableResolver from resolving indirect calls for large binaries (region> 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.
ReturnsNoneclass angr.analyses.cfg.CFBlanket(exclude_region_types=None, on_object_added=None)
Bases: Analysis
A Control-Flow Blanket is a representation for storing all instructions, data entries, and bytes of a full program.
Region types: - section - segment - extern - tls - kernel
Parameters• exclude_region_types (set[str] | None)• on_object_added (Callable[[int, Any], None] | None)__init__(exclude_region_types=None, on_object_added=None)
Parameters• on_object_added (Optional[Callable[[int, Any], None]]) – Callable with parameters (addr, obj) called after an object is added to the blanket.
• exclude_region_types (set[str] | None)
property regions
Return all memory regions.
floor_addr(addr)
floor_item(addr)
floor_items(addr=None, reverse=False)ceiling_addr(addr)
ceiling_item(addr)
ceiling_items(addr=None, reverse=False, include_first=True)

10.15. Analysis

867

angr

add_obj(addr, obj)
Adds an object obj to the blanket at the specified address addr
add_function(func)
Add a function func and all blocks of this function to the blanket.
dbg_repr()
The debugging representation of this CFBlanket.
Returns
The debugging representation of this CFBlanket.
Return typestrclass angr.analyses.cfg.CFGFastSoot(support_jni=False, **kwargs)
Bases: CFGFast__init__(support_jni=False, **kwargs)
Parameters• binary – The binary to recover CFG on. By default the main binary is used.
• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to andfrom each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.
• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.

868

Chapter 10. API Referenceangr• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return – Should CFG assume indirect calls must return ornot. Assuming indirect calls must return will significantly reduce the number of constantpropagation runs, but may reduce the overall CFG recovery precision when facing nonreturning indirect calls. By default, we only assume indirect calls always return for large
binaries (region > 50KB).
• jumptable_resolver_resolves_calls – Whether JumpTableResolver should resolve
indirect calls or not. Most indirect calls in C++ binaries or UEFI binaries cannot be resolved
using jump table resolver and must be resolved using their specific resolvers. By default, we
will only disable JumpTableResolver from resolving indirect calls for large binaries (region> 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.
ReturnsNonenormalize()
Normalize the CFG, making sure that there are no overlapping basic blocks.
Note that this method will not alter transition graphs of each function in self.kb.functions. You may callnormalize() on each Function object to normalize their transition graphs.
ReturnsNone

10.15. Analysis

869

angr

make_functions()
Revisit the entire control flow graph, create Function instances accordingly, and correctly put blocks into
each function.
Although Function objects are crated during the CFG recovery, they are neither sound nor accurate. Witha pre-constructed CFG, this method rebuilds all functions bearing the following rules:• A block may only belong to one function.
• Small functions lying inside the startpoint and the endpoint of another function will be merged withthe other function• Tail call optimizations are detected.
• PLT stubs are aligned by 16.
ReturnsNoneclass angr.analyses.cfg.CFGArchOptions(arch, **options)
Bases: object
Stores architecture-specific options and settings, as well as the detailed explanation of those options and settings.
Suppose ao is the CFGArchOptions object, and there is an option called ret_jumpkind_heuristics, you can accessit by ao.ret_jumpkind_heuristics and set its value via ao.ret_jumpkind_heuristics = True
Variables• OPTIONS (dict) – A dict of all default options for different architectures.
• arch (archinfo.Arch ) – The architecture object.
• _options (dict) – Values of all CFG options that are specific to the current architecture.
OPTIONS = {'ARMCortexM': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, False)}, 'ARMEL': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, True)}, 'ARMHF': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, True)}}__init__(arch, **options)
Constructor.
Parameters• arch (archinfo.Arch ) – The architecture instance.
• options (dict) – Architecture-specific options, which will be used to initialize this object.
arch = Noneclass angr.analyses.cfg.CFGBase(sort, context_sensitivity_level, normalize=False, binary=None,objects=None, regions=None, exclude_sparse_regions=True,
skip_specific_regions=True, force_segment=False, base_state=None,
resolve_indirect_jumps=True, indirect_jump_resolvers=None,
indirect_jump_target_limit=100000, detect_tail_calls=False,
low_priority=False, skip_unmapped_addrs=True,
sp_tracking_track_memory=True, model=None)

870

Chapter 10. API ReferenceangrBases: Analysis
The base class for control flow graphs.
tag:

str | None = None__init__(sort, context_sensitivity_level, normalize=False, binary=None, objects=None, regions=None,
exclude_sparse_regions=True, skip_specific_regions=True, force_segment=False,
base_state=None, resolve_indirect_jumps=True, indirect_jump_resolvers=None,
indirect_jump_target_limit=100000, detect_tail_calls=False, low_priority=False,
skip_unmapped_addrs=True, sp_tracking_track_memory=True, model=None)
Parameters• sort (str) – ‘fast’ or ‘emulated’.
• context_sensitivity_level (int) – The level of context-sensitivity of this CFG (seedocumentation for further details). It ranges from 0 to infinity.
• normalize (bool) – Whether the CFG as well as all Function graphs should be normalized.
• binary (cle.backends.Backend) – The binary to recover CFG on. By default, the mainbinary is used.
• objects – A list of objects to recover the CFG on. By default, it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• base_state (angr.SimState) – A state to use as a backer for all memory loads.
• resolve_indirect_jumps (bool) – Whether to try to resolve indirect jumps. This isnecessary to resolve jump targets from jump tables, etc.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• indirect_jump_target_limit (int) – Maximum indirect jump targets to be recovered.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• detect_tail_calls (bool) – Aggressive tail-call optimization detection. This option is
only respected in make_functions().
• sp_tracking_track_memory (bool) – Whether or not to track memory writes if tracking the stack pointer. This increases the accuracy of stack pointer tracking, especially forarchitectures without a base pointer. Only used if detect_tail_calls is enabled.
• model (None or CFGModel) – The CFGModel instance to write to. A new CFGModel
instance will be created and registered with the knowledge base if model is None.
ReturnsNone

10.15. Analysis

871

angr

property model:

CFGModelGet the CFGModel instance. :return: The CFGModel instance that this analysis currently uses.
property normalized
property context_sensitivity_levelproperty functions
A reference to the FunctionManager in the current knowledge base.
Returns
FunctionManager with all functions
Return typeangr.knowledge_plugins.FunctionManager
make_copy(copy_to)
Copy self attributes to the new object.
Parameters
copy_to (CFGBase) – The target to copy to.
ReturnsNonecopy()
output()generate_index()
Generate an index of all nodes in the graph in order to speed up get_any_node() with anyaddr=True.
ReturnsNone
get_predecessors(**kwargs)
get_successors(**kwargs)
get_successors_and_jumpkind(**kwargs)
get_all_predecessors(**kwargs)
get_all_successors(**kwargs)
get_node(**kwargs)
get_any_node(**kwargs)
get_all_nodes(**kwargs)
nodes(**kwargs)
nodes_iter(**kwargs)
get_loop_back_edges()
get_branching_nodes(**kwargs)
get_exit_stmt_idx(**kwargs)

872

Chapter 10. API Referenceangrproperty graph:

networkx.DiGraph[CFGNode]remove_edge(block_from, block_to)
is_thumb_addr(addr)
normalize()
Normalize the CFG, making sure that there are no overlapping basic blocks.
Note that this method will not alter transition graphs of each function in self.kb.functions. You may callnormalize() on each Function object to normalize their transition graphs.
ReturnsNonemark_function_alignments()
Find all potential function alignments and mark them.
Note that it is not always correct to simply remove them, because these functions may not be actual alignments but part of an actual function, and is incorrectly marked as an individual function because of failuresin resolving indirect jumps. An example is in the test binary x86_64/dir_gcc_-O0 0x40541d (indirect
jump at 0x4051b0). If the indirect jump cannot be correctly resolved, removing function 0x40541d willcause a missing label failure in reassembler.
ReturnsNonemake_functions()
Revisit the entire control flow graph, create Function instances accordingly, and correctly put blocks into
each function.
Although Function objects are crated during the CFG recovery, they are neither sound nor accurate. Witha pre-constructed CFG, this method rebuilds all functions bearing the following rules:• A block may only belong to one function.
• Small functions lying inside the startpoint and the endpoint of another function will be merged withthe other function• Tail call optimizations are detected.
• PLT stubs are aligned by 16.
ReturnsNoneclass angr.analyses.cfg.cfb.CFBlanketView(cfb)
Bases: object
A view into the control-flow blanket.
__init__(cfb)class angr.analyses.cfg.cfb.MemoryRegion(addr, size, type_, object_, cle_region)
Bases: object__init__(addr, size, type_, object_, cle_region)

10.15. Analysis

873

angr

class angr.analyses.cfg.cfb.Unknown(addr, size, bytes_=None, object_=None, segment=None,
section=None)
Bases: object__init__(addr, size, bytes_=None, object_=None, segment=None, section=None)class angr.analyses.cfg.cfb.CFBlanket(exclude_region_types=None, on_object_added=None)
Bases: Analysis
A Control-Flow Blanket is a representation for storing all instructions, data entries, and bytes of a full program.
Region types: - section - segment - extern - tls - kernel
Parameters• exclude_region_types (set[str] | None)• on_object_added (Callable[[int, Any], None] | None)__init__(exclude_region_types=None, on_object_added=None)
Parameters• on_object_added (Optional[Callable[[int, Any], None]]) – Callable with parameters (addr, obj) called after an object is added to the blanket.
• exclude_region_types (set[str] | None)
property regions
Return all memory regions.
floor_addr(addr)
floor_item(addr)
floor_items(addr=None, reverse=False)ceiling_addr(addr)
ceiling_item(addr)
ceiling_items(addr=None, reverse=False, include_first=True)
add_obj(addr, obj)
Adds an object obj to the blanket at the specified address addr
add_function(func)
Add a function func and all blocks of this function to the blanket.
dbg_repr()
The debugging representation of this CFBlanket.
Returns
The debugging representation of this CFBlanket.
Return typestr
exception angr.analyses.cfg.cfg.OutdatedError
Bases: Exception

874

Chapter 10. API Referenceangrclass angr.analyses.cfg.cfg.CFG(**kwargs)
Bases: CFGFast
tl;dr: CFG is just a wrapper around CFGFast for compatibility issues. It will be fully replaced by CFGFast in
future releases. Feel free to use CFG if you intend to use CFGFast. Please use CFGEmulated if you have to use
the old, slow, dynamically-generated version of CFG.
For multiple historical reasons, angr’s CFG is accurate but slow, which does not meet what most people expect.
We developed CFGFast for light-speed CFG recovery, and renamed the old CFG class to CFGEmulated. For
compatibility concerns, CFG was kept as an alias to CFGEmulated.
However, so many new users of angr would load up a binary and generate a CFG immediately after running “pipinstall angr”, and draw the conclusion that “angr’s CFG is so slow - angr must be unusable!” Therefore, we madethe hard decision: CFG will be an alias to CFGFast, instead of CFGEmulated.
To ease the transition of your existing code and script, the following changes are made:• A CFG class, which is a sub class of CFGFast, is created.
• You will see both a warning message printed out to stderr and an exception raised by angr if you are passing
CFG any parameter that only CFGEmulated supports. This exception is not a sub class of AngrError, so
you wouldn’t capture it with your old code by mistake.
• In the near future, this wrapper class will be removed completely, and CFG will be a simple alias to CFGFast.
We expect most interfaces are the same between CFGFast and CFGEmulated. Apparently some functionalities(like context-sensitivity, and state keeping) only exist in CFGEmulated, which is when you want to use CFGEmulated instead.
__init__(**kwargs)
Parameters• binary – The binary to recover CFG on. By default the main binary is used.
• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to and10.15. Analysis

875

angr

from each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.
• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.
• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return – Should CFG assume indirect calls must return ornot. Assuming indirect calls must return will significantly reduce the number of constantpropagation runs, but may reduce the overall CFG recovery precision when facing nonreturning indirect calls. By default, we only assume indirect calls always return for large
binaries (region > 50KB).
• jumptable_resolver_resolves_calls – Whether JumpTableResolver should resolve
indirect calls or not. Most indirect calls in C++ binaries or UEFI binaries cannot be resolved
using jump table resolver and must be resolved using their specific resolvers. By default, we
will only disable JumpTableResolver from resolving indirect calls for large binaries (region> 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.
Returns
None876

Chapter 10. API Referenceangrclass angr.analyses.cfg.cfg_emulated.CFGJob(*args, **kwargs)
Bases: CFGJobBase
The job class that CFGEmulated uses.
__init__(*args, **kwargs)
property block_id
property is_syscallclass angr.analyses.cfg.cfg_emulated.PendingJob(caller_func_addr, returning_source, state,
src_block_id, src_exit_stmt_idx, src_exit_ins_addr,
call_stack)Bases: object
A PendingJob is whatever will be put into our pending_exit list. A pending exit is an entry that created by the
returning of a call or syscall. It is “pending” since we cannot immediately figure out whether this entry will
be executed or not. If the corresponding call/syscall intentionally doesn’t return, then the pending exit will be
removed. If the corresponding call/syscall returns, then the pending exit will be removed as well (since a realentry is created from the returning and will be analyzed later). If the corresponding call/syscall might return, but
for some reason (for example, an unsupported instruction is met during the analysis) our analysis does not return
properly, then the pending exit will be picked up and put into remaining_jobs list.
__init__(caller_func_addr, returning_source, state, src_block_id, src_exit_stmt_idx, src_exit_ins_addr,
call_stack)Parameters• returning_source – Address of the callee function. It might be None if address of thecallee is not resolvable.
• state – The state after returning from the callee function. Of course there is no way to geta precise state without emulating the execution of the callee, but at least we can properly
adjust the stack and registers to imitate the real returned state.
• call_stack – A callstack.
class angr.analyses.cfg.cfg_emulated.CFGEmulated(context_sensitivity_level=1, start=None,
avoid_runs=None, enable_function_hints=False,
call_depth=None, call_tracing_filter=None,
initial_state=None, starts=None, keep_state=False,
indirect_jump_target_limit=100000,
resolve_indirect_jumps=True,
enable_advanced_backward_slicing=False,
enable_symbolic_back_traversal=False,
indirect_jump_resolvers=None,
additional_edges=None, no_construct=False,
normalize=False, max_iterations=1,
address_whitelist=None, base_graph=None,
iropt_level=None, max_steps=None,state_add_options=None,state_remove_options=None, model=None)
Bases: ForwardAnalysis, CFGBase
This class represents a control-flow graph.
tag:

str | None = 'CFGEmulated'

10.15. Analysis

877

angr

__init__(context_sensitivity_level=1, start=None, avoid_runs=None, enable_function_hints=False,
call_depth=None, call_tracing_filter=None, initial_state=None, starts=None, keep_state=False,
indirect_jump_target_limit=100000, resolve_indirect_jumps=True,
enable_advanced_backward_slicing=False, enable_symbolic_back_traversal=False,
indirect_jump_resolvers=None, additional_edges=None, no_construct=False, normalize=False,
max_iterations=1, address_whitelist=None, base_graph=None, iropt_level=None,
max_steps=None, state_add_options=None, state_remove_options=None, model=None)
All parameters are optional.
Parameters• context_sensitivity_level – The level of context-sensitivity of this CFG (see documentation for further details). It ranges from 0 to infinity. Default 1.
• avoid_runs – A list of runs to avoid.
• enable_function_hints – Whether to use function hints (constants that might be used
as exit targets) or not.
• call_depth – How deep in the call stack to trace.
• call_tracing_filter – Filter to apply on a given path and jumpkind to determine if itshould be skipped when call_depth is reached.
• initial_state – An initial state to use to begin analysis.
• starts (iterable) – A collection of starting points to begin analysis. It can contain thefollowing three different types of entries: an address specified as an integer, a 2-tuple that
includes an integer address and a jumpkind, or a SimState instance. Unsupported entries
in starts will lead to an AngrCFGError being raised.
• keep_state – Whether to keep the SimStates for each CFGNode.
• resolve_indirect_jumps – Whether to enable the indirect jump resolvers for resolving
indirect jumps• enable_advanced_backward_slicing – Whether to enable an intensive technique forresolving indirect jumps• enable_symbolic_back_traversal – Whether to enable an intensive technique for resolving indirect jumps• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• additional_edges – A dict mapping addresses of basic blocks to addresses of successors
to manually include and analyze forward from.
• no_construct (bool) – Skip the construction procedure. Only used in unit-testing.
• normalize (bool) – If the CFG as well as all Function graphs should be normalized ornot.
• max_iterations (int) – The maximum number of iterations that each basic block should
be “executed”. 1 by default. Larger numbers of iterations are usually required for complex
analyses like loop analysis.
• address_whitelist (iterable) – A list of allowed addresses. Any basic blocks outsideof this collection of addresses will be ignored.
• base_graph (networkx.DiGraph ) – A basic control flow graph to follow. Each nodeinside this graph must have the following properties: addr and size. CFG recovery will

878

Chapter 10. API Referenceangrstrictly follow nodes and edges shown in the graph, and discard any control flow that does
not follow an existing edge in the base graph. For example, you can pass in a Function
local transition graph as the base graph, and CFGEmulated will traverse nodes and edges
and extract useful information.
• iropt_level (int) – The optimization level of VEX IR (0, 1, 2). The default level will
be used if iropt_level is None.
• max_steps (int) – The maximum number of basic blocks to recover forthe longest pathfrom each start before pausing the recovery procedure.
• state_add_options – State options that will be added to the initial state.
• state_remove_options – State options that will be removed from the initial state.
copy()
Make a copy of the CFG.
Return type
CFGEmulated
Returns
A copy of the CFG instance.
resume(starts=None, max_steps=None)
Resume a paused or terminated control flow graph recovery.
Parameters• starts (iterable) – A collection of new starts to resume from. If starts is None, we will
resume CFG recovery from where it was paused before.
• max_steps (int) – The maximum number of blocks on the longest path starting from eachstart before pausing the recovery.
ReturnsNoneremove_cycles()Forces graph to become acyclic, removes all loop back edges and edges between overlapped loop headers
and their successors.
downsize()
Remove saved states from all CFGNodes to reduce memory usage.
Returns
None
unroll_loops(max_loop_unrolling_times)
Unroll loops for each function. The resulting CFG may still contain loops due to recursion, function calls,
etc.
Parameters
max_loop_unrolling_times (int) – The maximum iterations of unrolling.
Returns
None
force_unroll_loops(max_loop_unrolling_times)
Unroll loops globally. The resulting CFG does not contain any loop, but this method is slow on large graphs.
Parameters
max_loop_unrolling_times (int) – The maximum iterations of unrolling.
10.15. Analysis

879

angr

ReturnsNone
immediate_dominators(start, target_graph=None)
Get all immediate dominators of sub graph from given node upwards.
Parameters• start (str) – id of the node to navigate forwards from.
• target_graph (networkx.classes.digraph.DiGraph ) – graph to analyse, default isself.graph.
Returnseach node of graph as index values, with element as respective node’s immediate dominator.
Return type
dict
immediate_postdominators(end, target_graph=None)
Get all immediate postdominators of sub graph from given node upwards.
Parameters• start (str) – id of the node to navigate forwards from.
• target_graph (networkx.classes.digraph.DiGraph ) – graph to analyse, default isself.graph.
Returnseach node of graph as index values, with element as respective node’s immediate dominator.
Return type
dictremove_fakerets()
Get rid of fake returns (i.e., Ijk_FakeRet edges) from this CFG
ReturnsNone
get_topological_order(cfg_node)
Get the topological order of a CFG Node.
Parameters
cfg_node – A CFGNode instance.
Returns
An integer representing its order, or None if the CFGNode does not exist in the graph.
get_subgraph(starting_node, block_addresses)
Get a sub-graph out of a bunch of basic block addresses.
Parameters• starting_node (CFGNode) – The beginning of the subgraph• block_addresses (iterable) – A collection of block addresses that should be includedin the subgraph if there is a path between starting_node and a CFGNode with the specified
address, and all nodes on the path should also be included in the subgraph.
Returns
A new CFG that only contain the specific subgraph.

880

Chapter 10. API ReferenceangrReturn type
CFGEmulated
get_function_subgraph(start, max_call_depth=None)
Get a sub-graph of a certain function.
Parameters• start – The function start. Currently it should be an integer.
• max_call_depth – Call depth limit. None indicates no limit.
Returns
A CFG instance which is a sub-graph of self.graphproperty context_sensitivity_levelproperty graphproperty unresolvables
Get those SimRuns that have non-resolvable exits.
Returns
A set of SimRuns
Return typeset
property deadends
Get all CFGNodes that has an out-degree of 0
Returns
A list of CFGNode instances
Return type
list
indirect_jumps:
project:kb:

dict[int, IndirectJump]

Project

KnowledgeBase

class angr.analyses.cfg.cfg_base.CFGBase(sort, context_sensitivity_level, normalize=False, binary=None,objects=None, regions=None, exclude_sparse_regions=True,
skip_specific_regions=True, force_segment=False,
base_state=None, resolve_indirect_jumps=True,
indirect_jump_resolvers=None,
indirect_jump_target_limit=100000, detect_tail_calls=False,
low_priority=False, skip_unmapped_addrs=True,
sp_tracking_track_memory=True, model=None)
Bases: Analysis
The base class for control flow graphs.
tag:

str | None = None__init__(sort, context_sensitivity_level, normalize=False, binary=None, objects=None, regions=None,
exclude_sparse_regions=True, skip_specific_regions=True, force_segment=False,
base_state=None, resolve_indirect_jumps=True, indirect_jump_resolvers=None,
indirect_jump_target_limit=100000, detect_tail_calls=False, low_priority=False,
skip_unmapped_addrs=True, sp_tracking_track_memory=True, model=None)
10.15. Analysis

881

angr

Parameters• sort (str) – ‘fast’ or ‘emulated’.
• context_sensitivity_level (int) – The level of context-sensitivity of this CFG (seedocumentation for further details). It ranges from 0 to infinity.
• normalize (bool) – Whether the CFG as well as all Function graphs should be normalized.
• binary (cle.backends.Backend) – The binary to recover CFG on. By default, the mainbinary is used.
• objects – A list of objects to recover the CFG on. By default, it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• base_state (angr.SimState) – A state to use as a backer for all memory loads.
• resolve_indirect_jumps (bool) – Whether to try to resolve indirect jumps. This isnecessary to resolve jump targets from jump tables, etc.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• indirect_jump_target_limit (int) – Maximum indirect jump targets to be recovered.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• detect_tail_calls (bool) – Aggressive tail-call optimization detection. This option is
only respected in make_functions().
• sp_tracking_track_memory (bool) – Whether or not to track memory writes if tracking the stack pointer. This increases the accuracy of stack pointer tracking, especially forarchitectures without a base pointer. Only used if detect_tail_calls is enabled.
• model (None or CFGModel) – The CFGModel instance to write to. A new CFGModel
instance will be created and registered with the knowledge base if model is None.
ReturnsNone
indirect_jumps:

dict[int, IndirectJump]

property model:

CFGModelGet the CFGModel instance. :return: The CFGModel instance that this analysis currently uses.
property normalized
property context_sensitivity_levelproperty functions
A reference to the FunctionManager in the current knowledge base.

882

Chapter 10. API ReferenceangrReturns
FunctionManager with all functions
Return typeangr.knowledge_plugins.FunctionManager
make_copy(copy_to)
Copy self attributes to the new object.
Parameters
copy_to (CFGBase) – The target to copy to.
ReturnsNonecopy()
output()generate_index()
Generate an index of all nodes in the graph in order to speed up get_any_node() with anyaddr=True.
ReturnsNone
get_predecessors(**kwargs)
get_successors(**kwargs)
get_successors_and_jumpkind(**kwargs)
get_all_predecessors(**kwargs)
get_all_successors(**kwargs)
get_node(**kwargs)
get_any_node(**kwargs)
get_all_nodes(**kwargs)
nodes(**kwargs)
nodes_iter(**kwargs)
get_loop_back_edges()
get_branching_nodes(**kwargs)
get_exit_stmt_idx(**kwargs)
property graphremove_edge(block_from, block_to)
is_thumb_addr(addr)

10.15. Analysis

883

angr

normalize()
Normalize the CFG, making sure that there are no overlapping basic blocks.
Note that this method will not alter transition graphs of each function in self.kb.functions. You may callnormalize() on each Function object to normalize their transition graphs.
ReturnsNonemark_function_alignments()
Find all potential function alignments and mark them.
Note that it is not always correct to simply remove them, because these functions may not be actual alignments but part of an actual function, and is incorrectly marked as an individual function because of failuresin resolving indirect jumps. An example is in the test binary x86_64/dir_gcc_-O0 0x40541d (indirect
jump at 0x4051b0). If the indirect jump cannot be correctly resolved, removing function 0x40541d willcause a missing label failure in reassembler.
ReturnsNonemake_functions()
Revisit the entire control flow graph, create Function instances accordingly, and correctly put blocks into
each function.
Although Function objects are crated during the CFG recovery, they are neither sound nor accurate. Witha pre-constructed CFG, this method rebuilds all functions bearing the following rules:• A block may only belong to one function.
• Small functions lying inside the startpoint and the endpoint of another function will be merged withthe other function• Tail call optimizations are detected.
• PLT stubs are aligned by 16.
ReturnsNoneproject:kb:

Project

KnowledgeBase

exception angr.analyses.cfg.cfg_fast.ContinueScanningNotification
Bases: RuntimeError
A notification raised by _next_code_addr_core() to indicate no code address is found and_next_code_addr_core() should be invoked again.
class angr.analyses.cfg.cfg_fast.ARMDecodingMode
Bases: object
Enums indicating decoding mode for ARM code.
ARM = 0THUMB = 1884

Chapter 10. API Referenceangrclass angr.analyses.cfg.cfg_fast.DecodingAssumption(addr, size, mode)
Bases: object
Describes the decoding mode (ARM/THUMB) for a given basic block identified by its address.
Parameters• addr (int)• size (int)• mode (int)__init__(addr, size, mode)
Parameters• addr (int)• size (int)• mode (int)
add_data_seg(addr, size)
Return type
None
Parameters• addr (int)• size (int)class angr.analyses.cfg.cfg_fast.FunctionReturn(callee_func_addr, caller_func_addr, call_site_addr,
return_to)
Bases: object
FunctionReturn describes a function call in a specific location and its return location. Hashable and equatable__init__(callee_func_addr, caller_func_addr, call_site_addr, return_to)
callee_func_addr
caller_func_addr
call_site_addr
return_toclass angr.analyses.cfg.cfg_fast.PendingJobs(functions, deregister_job_callback)Bases: object
A collection of pending jobs during CFG recovery.
__init__(functions, deregister_job_callback)add_job(job)
pop_job(returning=True)
Pop a job from the pending jobs list.
When returning == True, we prioritize the jobs whose functions are known to be returning (function.returning is True). As an optimization, we are sorting the pending jobs list according tojob.function.returning.
10.15. Analysis

885

angr

Parameters
returning (bool) – Only pop a pending job if the corresponding function returns.
Returns
A pending job if we can find one, or None if we cannot find any that satisfies the requirement.
Return typeangr.analyses.cfg.cfg_fast.CFGJob
cleanup()
Remove those pending exits if: a) they are the return exits of non-returning SimProcedures b) they are thereturn exits of non-returning syscalls b) they are the return exits of non-returning functions
ReturnsNone
add_returning_function(func_addr)
Mark a function as returning.
Parameters
func_addr (int) – Address of the function that returns.
ReturnsNone
add_nonreturning_function(func_addr)
Mark a function as not returning.
Parameters
func_addr (int) – Address of the function that does not return.
ReturnsNoneclear_updated_functions()
Clear the updated_functions set.
ReturnsNoneclass angr.analyses.cfg.cfg_fast.FunctionEdge
Bases: object
Describes an edge in functions’ transition graphs. Base class for all types of edges.
apply(cfg)
src_func_addr
stmt_idx
ins_addr
class angr.analyses.cfg.cfg_fast.FunctionTransitionEdge(src_node, dst_addr, src_func_addr,
to_outside=False, dst_func_addr=None,
stmt_idx=None, ins_addr=None,is_exception=False)
Bases: FunctionEdge
Describes a transition edge in functions’ transition graphs.

886

Chapter 10. API Referenceangr__init__(src_node, dst_addr, src_func_addr, to_outside=False, dst_func_addr=None, stmt_idx=None,
ins_addr=None, is_exception=False)
src_node
dst_addr
to_outside
dst_func_addr
is_exception
apply(cfg)class angr.analyses.cfg.cfg_fast.FunctionCallEdge(src_node, dst_addr, ret_addr, src_func_addr,
syscall=False, stmt_idx=None, ins_addr=None)
Bases: FunctionEdge
Describes a call edge in functions’ transition graphs.
__init__(src_node, dst_addr, ret_addr, src_func_addr, syscall=False, stmt_idx=None, ins_addr=None)
src_node
dst_addr
ret_addr
syscallapply(cfg)class angr.analyses.cfg.cfg_fast.FunctionFakeRetEdge(src_node, dst_addr, src_func_addr,
confirmed=None)
Bases: FunctionEdge
Describes a FakeReturn (also called fall-through) edge in functions’ transition graphs.
__init__(src_node, dst_addr, src_func_addr, confirmed=None)
src_node
dst_addr
confirmed
apply(cfg)class angr.analyses.cfg.cfg_fast.FunctionReturnEdge(ret_from_addr, ret_to_addr, dst_func_addr)
Bases: FunctionEdge
Describes a return (from a function call or a syscall) edge in functions’ transition graphs.
__init__(ret_from_addr, ret_to_addr, dst_func_addr)
ret_from_addr
ret_to_addr
dst_func_addr

10.15. Analysis

887

angr

apply(cfg)class angr.analyses.cfg.cfg_fast.CFGJobType(value)
Bases: Enum
Defines the type of work of a CFGJobNORMAL = 0
FUNCTION_PROLOGUE = 1
COMPLETE_SCANNING = 2
IFUNC_HINTS = 3
DATAREF_HINTS = 4
class angr.analyses.cfg.cfg_fast.CFGJob(addr, func_addr, jumpkind, ret_target=None, last_addr=None,
src_node=None, src_ins_addr=None, src_stmt_idx=None,
returning_source=None, syscall=False, func_edges=None,
job_type=CFGJobType.NORMAL, gp=None)
Bases: object
Defines a job to work on during the CFG recovery
Parameters• addr (int)• func_addr (int)• jumpkind (str)• ret_target (int | None)• last_addr (int | None)• src_node (CFGNode | None)• src_ins_addr (int | None)• src_stmt_idx (int | None)• syscall (bool)• func_edges (list | None)• job_type (CFGJobType)• gp (int | None)__init__(addr, func_addr, jumpkind, ret_target=None, last_addr=None, src_node=None,
src_ins_addr=None, src_stmt_idx=None, returning_source=None, syscall=False,
func_edges=None, job_type=CFGJobType.NORMAL, gp=None)
Parameters• addr (int)• func_addr (int)• jumpkind (str)• ret_target (int | None)• last_addr (int | None)
888

Chapter 10. API Referenceangr• src_node (CFGNode | None)• src_ins_addr (int | None)• src_stmt_idx (int | None)• syscall (bool)• func_edges (list | None)• job_type (CFGJobType)• gp (int | None)addr
func_addr
jumpkind
ret_target
last_addr
src_node
src_ins_addr
src_stmt_idx
returning_source
syscall
job_typegp
add_function_edge(edge)
apply_function_edges(cfg, clear=False)class angr.analyses.cfg.cfg_fast.CFGFast(binary=None, objects=None, regions=None,
pickle_intermediate_results=False, symbols=True,
function_prologues=True, resolve_indirect_jumps=True,
force_segment=False, force_smart_scan=True,
force_complete_scan=False,
indirect_jump_target_limit=100000, data_references=True,
cross_references=False, normalize=False,start_at_entry=True, function_starts=None,
extra_memory_regions=None,
data_type_guessing_handlers=None, arch_options=None,
indirect_jump_resolvers=None, base_state=None,
exclude_sparse_regions=True, skip_specific_regions=True,
heuristic_plt_resolving=None, detect_tail_calls=False,
low_priority=False, cfb=None, model=None,elf_eh_frame=True, exceptions=True,
skip_unmapped_addrs=True, nodecode_window_size=512,
nodecode_threshold=0.3, nodecode_step=16483,
indirect_calls_always_return=None,
jumptable_resolver_resolves_calls=None, start=None,
end=None, collect_data_references=None,
extra_cross_references=None, **extra_arch_options)10.15. Analysis

889

angr

Bases: ForwardAnalysis[CFGNode, CFGNode, CFGJob, int], CFGBase
We find functions inside the given binary, and build a control-flow graph in very fast manners: instead of simulating program executions, keeping track of states, and performing expensive data-flow analysis, CFGFast will
only perform light-weight analyses combined with some heuristics, and with some strong assumptions.
In order to identify as many functions as possible, and as accurate as possible, the following operation sequenceis followed:# Active scanning• If the binary has “function symbols” (TODO: this term is not accurate enough), they are starting points ofthe code scanning• If the binary does not have any “function symbol”, we will first perform a function prologue scanning on
the entire binary, and start from those places that look like function beginnings• Otherwise, the binary’s entry point will be the starting point for scanning# Passive scanning• After all active scans are done, we will go through the whole image and scan all code pieces
Due to the nature of those techniques that are used here, a base address is often not required to use this analysis
routine. However, with a correct base address, CFG recovery will almost always yield a much better result. A
custom analysis, called GirlScout, is specifically made to recover the base address of a binary blob. After the baseaddress is determined, you may want to reload the binary with the new base address by creating a new Project
object, and then re-recover the CFG.
Parameters• indirect_calls_always_return (bool | None)• jumptable_resolver_resolves_calls (bool | None)
PRINTABLES = b'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r'
SPECIAL_THUNKS = {'AMD64':{b'\xe8\x07\x00\x00\x00\xf3\x90\x0f\xae\xe8\xeb\xf9H\x89\x04$\xc3':
b'\xe8\x07\x00\x00\x00\xf3\x90\x0f\xae\xe8\xeb\xf9H\x8dd$\x08\xc3':
tag:('jmp', 'rax'),('ret',)}}

str | None = 'CFGFast'__init__(binary=None, objects=None, regions=None, pickle_intermediate_results=False, symbols=True,
function_prologues=True, resolve_indirect_jumps=True, force_segment=False,
force_smart_scan=True, force_complete_scan=False, indirect_jump_target_limit=100000,
data_references=True, cross_references=False, normalize=False, start_at_entry=True,
function_starts=None, extra_memory_regions=None, data_type_guessing_handlers=None,arch_options=None, indirect_jump_resolvers=None, base_state=None,
exclude_sparse_regions=True, skip_specific_regions=True, heuristic_plt_resolving=None,
detect_tail_calls=False, low_priority=False, cfb=None, model=None, elf_eh_frame=True,
exceptions=True, skip_unmapped_addrs=True, nodecode_window_size=512,
nodecode_threshold=0.3, nodecode_step=16483, indirect_calls_always_return=None,
jumptable_resolver_resolves_calls=None, start=None, end=None, collect_data_references=None,
extra_cross_references=None, **extra_arch_options)Parameters• binary – The binary to recover CFG on. By default the main binary is used.

890

Chapter 10. API Referenceangr• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to andfrom each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.
• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.
• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return (Optional[bool]) – Should CFG assume indirectcalls must return or not. Assuming indirect calls must return will significantly reduce thenumber of constant propagation runs, but may reduce the overall CFG recovery precision

10.15. Analysis

891

angr

when facing non-returning indirect calls. By default, we only assume indirect calls always
return for large binaries (region > 50KB).
• jumptable_resolver_resolves_calls (Optional[bool]) – Whether JumpTableResolver should resolve indirect calls or not. Most indirect calls in C++ binaries or UEFI
binaries cannot be resolved using jump table resolver and must be resolved using their specific resolvers. By default, we will only disable JumpTableResolver from resolving indirectcalls for large binaries (region > 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.
• indirect_calls_always_return (bool | None)• jumptable_resolver_resolves_calls (bool | None)
ReturnsNoneproperty graphproperty memory_data
property jump_tables
property insn_addr_to_memory_data
do_full_xrefs(overlay_state=None)
Perform xref recovery on all functions.
Parameters
overlay (SimState) – An overlay state for loading constant data.
ReturnsNonecopy()
indirect_jumps:
project:kb:

dict[int, IndirectJump]

Project

KnowledgeBase

output()generate_code_cover(**kwargs)

892

Chapter 10. API Referenceangrclass angr.analyses.cfg.cfg_arch_options.CFGArchOptions(arch, **options)
Bases: object
Stores architecture-specific options and settings, as well as the detailed explanation of those options and settings.
Suppose ao is the CFGArchOptions object, and there is an option called ret_jumpkind_heuristics, you can accessit by ao.ret_jumpkind_heuristics and set its value via ao.ret_jumpkind_heuristics = True
Variables• OPTIONS (dict) – A dict of all default options for different architectures.
• arch (archinfo.Arch ) – The architecture object.
• _options (dict) – Values of all CFG options that are specific to the current architecture.
OPTIONS = {'ARMCortexM': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, False)}, 'ARMEL': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, True)}, 'ARMHF': {'pattern_match_ifuncs': (<class 'bool'>, True),'ret_jumpkind_heuristics': (<class 'bool'>, True), 'switch_mode_on_nodecode':(<class 'bool'>, True)}}__init__(arch, **options)
Constructor.
Parameters• arch (archinfo.Arch ) – The architecture instance.
• options (dict) – Architecture-specific options, which will be used to initialize this object.
arch = Noneclass angr.analyses.cfg.cfg_job_base.BlockID(addr, callsite_tuples, jump_type)
Bases: object
A context-sensitive key for a SimRun object.
__init__(addr, callsite_tuples, jump_type)callsite_repr()
static new(addr, callstack_suffix, jumpkind)property func_addr
class angr.analyses.cfg.cfg_job_base.FunctionKey(addr, callsite_tuples)
Bases: object
A context-sensitive key for a function.
__init__(addr, callsite_tuples)
callsite_repr()
static new(addr, callsite_tuples)

10.15. Analysis

893

angr

class angr.analyses.cfg.cfg_job_base.CFGJobBase(addr, state, context_sensitivity_level, block_id=None,
src_block_id=None, src_exit_stmt_idx=None,
src_ins_addr=None, jumpkind=None,
call_stack=None, is_narrowing=False, skip=False,
final_return_address=None)
Bases: object
Describes an entry in CFG or VFG. Only used internally by the analysis.
Parameters• state (SimState)• jumpkind (str | None)__init__(addr, state, context_sensitivity_level, block_id=None, src_block_id=None,src_exit_stmt_idx=None, src_ins_addr=None, jumpkind=None, call_stack=None,is_narrowing=False, skip=False, final_return_address=None)
Parameters• state (SimState)• jumpkind (str | None)
property call_stack
call_stack_copy()
get_call_stack_suffix()
property func_addr
property current_stack_pointerclass angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got.AMD64ElfGotResolver(project)
Bases: IndirectJumpResolver
A timeless indirect jump resolver that resolves GOT entries on AMD64 ELF binaries.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return type
bool

894

Chapter 10. API Referenceangrresolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).
Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast.ArmElfFastResolver(project)
Bases: IndirectJumpResolver
Resolves indirect jumps in ARM ELF binaries__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
The main resolving function.
Parameters• cfg – A CFG instance.
• addr (int) – Address of the IRSB.
• func_addr (int) – Address of the function.
• block – The IRSB.
10.15. Analysis

895

angr

• jumpkind (str) – The jumpkind.
• func_graph_complete (bool)
Returns
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat.X86PeIatResolver(project)
Bases: IndirectJumpResolver
A timeless indirect jump resolver for IAT in x86 PEs.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).
Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.enable_profiling()

896

Chapter 10. API Referenceangrangr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.disable_profiling()class angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.Case2Result(value)
Bases: Enum
Describes the result of resolving case 2 function calls.
SUCCESS = 0
FAILURE = 1
RESUME = 2class angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.MipsElfFastResolver(project)
Bases: IndirectJumpResolver
A timeless indirect jump resolver for R9-based indirect function calls in MIPS ELFs.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Wrapper for _resolve that slowly increments the max_depth used by Blade for finding sources until we canresolve the addr or we reach the default max_depth
Parameters• cfg – A CFG instance.
• addr (int) – IRSB address.
• func_addr (int) – The function address.
• block (pyvex.IRSB) – The IRSB.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool)
Returns
If it was resolved and targets alongside it
Return type
tuple

10.15. Analysis

897

angr

class angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt.X86ElfPicPltResolver(project)
Bases: IndirectJumpResolver
In X86 ELF position-independent code, PLT stubs uses ebx to resolve library calls, where ebx stores the address
to the beginning of the GOT. We resolve the target by forcing ebx to be the beginning of the GOT and simulate
the execution in fast path mode.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).
Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
angr.analyses.cfg.indirect_jump_resolvers.default_resolvers.default_indirect_jump_resolvers(obj,project)
exception angr.analyses.cfg.indirect_jump_resolvers.jumptable.NotAJumpTableNotification
Bases: AngrError
Exception raised to indicate this is not (or does not appear to be) a jump table.

898

Chapter 10. API Referenceangrclass angr.analyses.cfg.indirect_jump_resolvers.jumptable.UninitReadMeta
Bases: object
Uninitialized read remapping details.
uninit_read_base = 201326592
class angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransformationTypes(value)
Bases: int, Enum
Address transformation operations.
Assignment = 0
SignedExtension = 1
UnsignedExtension = 2
Truncation = 3
Or1 = 4
ShiftLeft = 5
ShiftRight = 6
Add = 7
Load = 8class angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransformation(op,operands,
first_load=False)
Bases: object
Describe and record an address transformation operation.
Parameters• op (AddressTransformationTypes)• operands (list)• first_load (bool)__init__(op, operands, first_load=False)
Parameters• op (AddressTransformationTypes)• operands (list)• first_load (bool)class angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressOperandBases: object
The class for the singleton class AddressSingleton. It represents the address being transformed before using as
an indirect jump target.

10.15. Analysis

899

angr

class angr.analyses.cfg.indirect_jump_resolvers.jumptable.Tmp(tmp_idx)
Bases: object
For modeling Tmp variables.
__init__(tmp_idx)
class angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTargetBaseAddr(stmt_loc, stmt,
tmp,
base_addr=None,tmp_1=None)
Bases: object
Model for jump targets and their data origin.
__init__(stmt_loc, stmt, tmp, base_addr=None, tmp_1=None)
property base_addr_available
class angr.analyses.cfg.indirect_jump_resolvers.jumptable.ConstantValueManager(project, kb,
func)
Bases: object
Manages the loading of registers who hold constant values.
Parameters
func (Function)__init__(project, kb, func)
Parameters
func (Function)
projectkb
func
mapping
reg_read_callback(state)Parametersstate (SimState)class angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableProcessorState(arch)
Bases: object
The state used in JumpTableProcessor.
__init__(arch)
arch
is_jumptablestmts_to_instrument
regs_to_initialize

900

Chapter 10. API Referenceangrclass angr.analyses.cfg.indirect_jump_resolvers.jumptable.RegOffsetAnnotation(reg_offset)
Bases: Annotation
Register Offset annotation.
Parameters
reg_offset (RegisterOffset)__init__(reg_offset)
Parameters
reg_offset (RegisterOffset)
reg_offset
property relocatable
Returns whether this annotation can be relocated in a simplification.
Returns
True if it can be relocated, false otherwise.
property eliminatable
Returns whether this annotation can be eliminated in a simplification.
Returns
True if eliminatable, False otherwiseclass angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableProcessor(project, indirect_jump_node_pred_addrs,
bp_sp_diff=256)
Bases: SimEngineLightVEXMixin, SimEngineLight
Implements a simple and stupid data dependency tracking for stack and register variables.
Also determines which statements to instrument during static execution of the slice later. For example, thefollowing example is not uncommon in non-optimized binaries:
mov [rbp+var_54], 1
loc_4051a6:
cmp [rbp+var_54], 6
jaloc_405412 (default)
loc_4051b0:
mov eax, [rbp+var_54]
mov rax, qword [rax*8+0x223a01]
jmp rax
We want to instrument the first instruction and replace the constant 1 with a symbolic variable, otherwise we will
not be able to recover all jump targets later in block 0x4051b0.
Parameters
indirect_jump_node_pred_addrs (set[int])__init__(project, indirect_jump_node_pred_addrs, bp_sp_diff=256)
Parameters
indirect_jump_node_pred_addrs (set[int])class angr.analyses.cfg.indirect_jump_resolvers.jumptable.StoreHook
Bases: object
Hook for memory stores.
10.15. Analysis

901

angr

static hook(state)class angr.analyses.cfg.indirect_jump_resolvers.jumptable.LoadHook
Bases: object
Hook for memory loads.
__init__()hook_before(state)hook_after(state)class angr.analyses.cfg.indirect_jump_resolvers.jumptable.PutHook
Bases: object
Hook for register writes.
static hook(state)class angr.analyses.cfg.indirect_jump_resolvers.jumptable.RegisterInitializerHook(reg_offset,
reg_bits,
value)
Bases: object
Hook for register init.
__init__(reg_offset, reg_bits, value)
hook(state)class angr.analyses.cfg.indirect_jump_resolvers.jumptable.BSSHook(project, bss_regions)
Bases: object
Hook for BSS read/write.
__init__(project, bss_regions)bss_memory_read_hook(state)bss_memory_write_hook(state)class angr.analyses.cfg.indirect_jump_resolvers.jumptable.MIPSGPHook(gp_offset, gp)
Bases: object
Hooks all reads from and writes into the gp register for MIPS32 binaries.
Parameters• gp_offset (int)• gp (int)__init__(gp_offset, gp)
Parameters• gp_offset (int)• gp (int)
gp_register_read_hook(state)

902

Chapter 10. API Referenceangr

gp_register_write_hook(state)class angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableResolver(project, resolve_calls=True)
Bases: IndirectJumpResolver
A generic jump table resolver.
This is a fast jump table resolution. For performance concerns, we made the following assumptions:• The final jump target comes from the memory.
• The final jump target must be directly read out of the memory, without any further modification oraltering.
Progressively larger program slices will be analyzed to determine jump table location and size. If the size of thetable cannot be determined, a guess will be made based on how many entries in the table appear valid.
Parametersresolve_calls (bool)__init__(project, resolve_calls=True)
Parametersresolve_calls (bool)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolves jump tables.
Parameters• cfg – A CFG instance.
• addr (int) – IRSB address.
• func_addr (int) – The function address.
• block (pyvex.IRSB) – The IRSB.
• func_graph_complete (bool)
Returns
A bool indicating whether the indirect jump is resolved successfully, and a list of resolved
targets

10.15. Analysis

903

angr

Return type
tuple
angr.analyses.cfg.indirect_jump_resolvers.const_resolver.exists_in_replacements(replacements,
block_loc,
tmp_var)class angr.analyses.cfg.indirect_jump_resolvers.const_resolver.ConstantResolver(project)
Bases: IndirectJumpResolver
Resolve an indirect jump by running a constant propagation on the entire function and check if the indirect jump
can be resolved to a constant value. This resolver must be run after all other more specific resolvers.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
This function does the actual resolve. Our process is easy: Propagate all values inside the function specified,then extract the tmp_var used for the indirect jump from the basic block. Use the tmp var to locate theconstant value stored in the replacements. If not present, returns False tuple.
Parameters• cfg – CFG with specified function• addr (int) – Address of indirect jump
• func_addr (int) – Address of function of indirect jump
• block (Block) – Block of indirect jump (Block object)• jumpkind (str) – VEX jumpkind (Ijk_Boring or Ijk_Call)• func_graph_complete (bool)
Returns
Bool tuple with replacement addressclass angr.analyses.cfg.indirect_jump_resolvers.resolver.IndirectJumpResolver(project, timeless=False,
base_state=None)
Bases: object

904

Chapter 10. API Referenceangr__init__(project, timeless=False, base_state=None)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).
Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.MipsElfFastResolver(project)
Bases: IndirectJumpResolver
A timeless indirect jump resolver for R9-based indirect function calls in MIPS ELFs.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.

10.15. Analysis

905

angr

• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Wrapper for _resolve that slowly increments the max_depth used by Blade for finding sources until we canresolve the addr or we reach the default max_depth
Parameters• cfg – A CFG instance.
• addr (int) – IRSB address.
• func_addr (int) – The function address.
• block (pyvex.IRSB) – The IRSB.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool)
Returns
If it was resolved and targets alongside it
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.MipsElfGotResolver(project)
Bases: IndirectJumpResolver
A timeless indirect jump resolver that resolves GOT stub entries in MIPS ELF binaries.
Reference: MIPS Assembly Language Programmer’s Guide, Calling Position Independent Functions__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return type
bool

906

Chapter 10. API Referenceangrresolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).
Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.X86ElfPicPltResolver(project)
Bases: IndirectJumpResolver
In X86 ELF position-independent code, PLT stubs uses ebx to resolve library calls, where ebx stores the address
to the beginning of the GOT. We resolve the target by forcing ebx to be the beginning of the GOT and simulate
the execution in fast path mode.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.

10.15. Analysis

907

angr

• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).
Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.JumpTableResolver(project, resolve_calls=True)
Bases: IndirectJumpResolver
A generic jump table resolver.
This is a fast jump table resolution. For performance concerns, we made the following assumptions:• The final jump target comes from the memory.
• The final jump target must be directly read out of the memory, without any further modification oraltering.
Progressively larger program slices will be analyzed to determine jump table location and size. If the size of thetable cannot be determined, a guess will be made based on how many entries in the table appear valid.
Parametersresolve_calls (bool)__init__(project, resolve_calls=True)
Parametersresolve_calls (bool)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolves jump tables.
Parameters
908

Chapter 10. API Referenceangr• cfg – A CFG instance.
• addr (int) – IRSB address.
• func_addr (int) – The function address.
• block (pyvex.IRSB) – The IRSB.
• func_graph_complete (bool)
Returns
A bool indicating whether the indirect jump is resolved successfully, and a list of resolved
targets
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.X86PeIatResolver(project)
Bases: IndirectJumpResolver
A timeless indirect jump resolver for IAT in x86 PEs.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).

10.15. Analysis

909

angr

Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.AMD64ElfGotResolver(project)
Bases: IndirectJumpResolver
A timeless indirect jump resolver that resolves GOT entries on AMD64 ELF binaries.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).
Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.ArmElfFastResolver(project)
Bases: IndirectJumpResolver
Resolves indirect jumps in ARM ELF binaries
910

Chapter 10. API Referenceangr__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
The main resolving function.
Parameters• cfg – A CFG instance.
• addr (int) – Address of the IRSB.
• func_addr (int) – Address of the function.
• block – The IRSB.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool)
Returns
Return type
tuple
class angr.analyses.cfg.indirect_jump_resolvers.ConstantResolver(project)
Bases: IndirectJumpResolver
Resolve an indirect jump by running a constant propagation on the entire function and check if the indirect jump
can be resolved to a constant value. This resolver must be run after all other more specific resolvers.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
10.15. Analysis

911

angr

Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
This function does the actual resolve. Our process is easy: Propagate all values inside the function specified,then extract the tmp_var used for the indirect jump from the basic block. Use the tmp var to locate theconstant value stored in the replacements. If not present, returns False tuple.
Parameters• cfg – CFG with specified function• addr (int) – Address of indirect jump
• func_addr (int) – Address of function of indirect jump
• block (Block) – Block of indirect jump (Block object)• jumpkind (str) – VEX jumpkind (Ijk_Boring or Ijk_Call)• func_graph_complete (bool)
Returns
Bool tuple with replacement addressclass angr.analyses.cfg.indirect_jump_resolvers.AMD64PeIatResolver(project)
Bases: IndirectJumpResolver
A timeless indirect call/jump resolver for IAT in amd64 PEs.
__init__(project)filter(cfg, addr, func_addr, block, jumpkind)
Check if this resolution method may be able to resolve the indirect jump or not.
Parameters• addr (int) – Basic block address of this indirect jump.
• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
Returns
True if it is possible for this resolution method to resolve the specific indirect jump, False
otherwise.
Return typebool
resolve(cfg, addr, func_addr, block, jumpkind, func_graph_complete=True, **kwargs)
Resolve an indirect jump.
Parameters• cfg – The CFG analysis object.
• addr (int) – Basic block address of this indirect jump.

912

Chapter 10. API Referenceangr• func_addr (int) – Address of the function that this indirect jump belongs to.
• block – The basic block. The type is determined by the backend being used. It’s
pyvex.IRSB if pyvex is used as the backend.
• jumpkind (str) – The jumpkind.
• func_graph_complete (bool) – True if the function graph is complete at this point (except for nodes that this indirect jump node dominates).
Returns
A tuple of a boolean indicating whether the resolution is successful or not, and a list of resolved targets (ints).
Return type
tuple
class angr.analyses.cfg.cfg_fast_soot.CFGFastSoot(support_jni=False, **kwargs)
Bases: CFGFast__init__(support_jni=False, **kwargs)
Parameters• binary – The binary to recover CFG on. By default the main binary is used.
• objects – A list of objects to recover the CFG on. By default it will recover the CFG of
all loaded objects.
• regions (iterable) – A list of tuples in the form of (start address, end address) describing
memory regions that the CFG should cover.
• pickle_intermediate_results (bool) – If we want to store the intermediate results
or not.
• symbols (bool) – Get function beginnings from symbols in the binary.
• function_prologues (bool) – Scan the binary for function prologues, and use thosepositions as function beginnings• resolve_indirect_jumps (bool) – Try to resolve indirect jumps. This is necessary toresolve jump targets from jump tables, etc.
• force_segment (bool) – Force CFGFast to rely on binary segments instead of sections.
• force_complete_scan (bool) – Perform a complete scan on the binary and maximize
the number of identified code blocks.
• data_references (bool) – Enables the collection of references to data used by individual instructions. This does not collect ‘cross-references’, particularly those that involve
multiple instructions. For that, see cross_references• cross_references (bool) – Whether CFGFast should collect “cross-references” fromthe entire program or not. This will populate the knowledge base with references to andfrom each recognizable address constant found in the code. Note that, because this performs constant propagation on the entire program, it may be much slower and consume
more memory. This option implies data_references=True.
• normalize (bool) – Normalize the CFG as well as all function graphs after CFG recovery.
• start_at_entry (bool) – Begin CFG recovery at the entry point of this project. Setting
it to False prevents CFGFast from viewing the entry point as one of the starting points ofcode scanning.

10.15. Analysis

913

angr

• function_starts (list) – A list of extra function starting points. CFGFast will try toresume scanning from each address in the list.
• extra_memory_regions (list) – A list of 2-tuple (start-address, end-address) that shows
extra memory regions. Integers falling inside will be considered as pointers.
• indirect_jump_resolvers (list) – A custom list of indirect jump resolvers. If this list
is None or empty, default indirect jump resolvers specific to this architecture and binary
types will be loaded.
• base_state – A state to use as a backer for all memory loads• detect_tail_calls (bool) – Enable aggressive tail-call optimization detection.
• elf_eh_frame (bool) – Retrieve function starts (and maybe sizes later) from the.eh_frame of ELF binaries.
• skip_unmapped_addrs – Ignore all branches into unmapped regions. True by default.
You may want to set it to False if you are analyzing manually patched binaries or malware
samples.
• indirect_calls_always_return – Should CFG assume indirect calls must return ornot. Assuming indirect calls must return will significantly reduce the number of constantpropagation runs, but may reduce the overall CFG recovery precision when facing nonreturning indirect calls. By default, we only assume indirect calls always return for large
binaries (region > 50KB).
• jumptable_resolver_resolves_calls – Whether JumpTableResolver should resolve
indirect calls or not. Most indirect calls in C++ binaries or UEFI binaries cannot be resolved
using jump table resolver and must be resolved using their specific resolvers. By default, we
will only disable JumpTableResolver from resolving indirect calls for large binaries (region> 50 KB).
• start (int) – (Deprecated) The beginning address of CFG recovery.
• end (int) – (Deprecated) The end address of CFG recovery.
• arch_options (CFGArchOptions) – Architecture-specific options.
• extra_arch_options (dict) – Any key-value pair in kwargs will be seen as an archspecific option and will be used to set the option value in self._arch_options.
Extra parameters that angr.Analysis takes:
Parameters• progress_callback – Specify a callback function to get the progress during CFG recovery.
• show_progressbar (bool) – Should CFGFast show a progressbar during CFG recovery
or not.
ReturnsNonenormalize()
Normalize the CFG, making sure that there are no overlapping basic blocks.
Note that this method will not alter transition graphs of each function in self.kb.functions. You may callnormalize() on each Function object to normalize their transition graphs.
Returns
None

914

Chapter 10. API Referenceangrmake_functions()
Revisit the entire control flow graph, create Function instances accordingly, and correctly put blocks into
each function.
Although Function objects are crated during the CFG recovery, they are neither sound nor accurate. Witha pre-constructed CFG, this method rebuilds all functions bearing the following rules:• A block may only belong to one function.
• Small functions lying inside the startpoint and the endpoint of another function will be merged withthe other function• Tail call optimizations are detected.
• PLT stubs are aligned by 16.
ReturnsNoneclass angr.analyses.cdg.CDG(cfg, start=None, no_construct=False)
Bases: Analysis
Implements a control dependence graph.
__init__(cfg, start=None, no_construct=False)
Constructor.
Parameters• cfg – The control flow graph upon which this control dependence graph will build• start – The starting point to begin constructing the control dependence graph• no_construct – Skip the construction step. Only used in unit-testing.
property graphget_post_dominators()
Return the post-dom tree
get_dependants(run)Return a list of nodes that are control dependent on the given node in the control dependence graphget_guardians(run)Return a list of nodes on whom the specific node is control dependent in the control dependence graphexception angr.analyses.datagraph_meta.DataGraphError
Bases: Exception
class angr.analyses.datagraph_meta.DataGraphMeta
Bases: object__init__()get_irsb_at(addr)
pp(imarks=False)
Pretty print the graph. @imarks determine whether the printed graph represents instructions (coarse
grained) for easier navigation, or exact statements.

10.15. Analysis

915

angr

class angr.analyses.code_tagging.CodeTags
Bases: object
HAS_XOR = 'HAS_XOR'
HAS_BITSHIFTS = 'HAS_BITSHIFTS'
HAS_SQL = 'HAS_SQL'LARGE_SWITCH = 'LARGE_SWITCH'
class angr.analyses.code_tagging.CodeTagging(func)
Bases: Analysis__init__(func)
analyze()
has_xor()
Detects if there is any xor operation in the function.
ReturnsTags
has_bitshifts()
Detects if there is any bitwise operation in the function.
ReturnsTags.
has_sql()
Detects if there is any reference to strings that look like SQL queries.
class angr.angrdb.AngrDB(project=None)
Bases: object
AngrDB provides a storage solution for an angr project, its knowledge bases, and some other types of data. It is
designed to use an SQL-based database as the storage backend.
ALL_TABLES = ['objects']
VERSION = 1__init__(project=None)
static open_db(db_str='sqlite:///:memory:')
static session_scope(Session)
static save_info(session, key, value)
Save an information entry to the database.
Parameters• session• key• value
Returns

916

Chapter 10. API Referenceangrstatic get_info(session, key)Get an information entry from the database.
Parameters• session• key
Returns
update_dbinfo(session, extra_info=None)
Update the information in database.
Parameters• session• extra_info (dict[str, str] | None)
Returns
get_dbinfo(session, extra_info=None)
Get database information.
Parameters• session• extra_info (dict[str, str] | None)
Returns
A dict of information entries.
db_compatible(version)
Checks if the given database version is compatible with the current AngrDB class.
Parameters
version (int) – The version of the database.
Returns
True if compatible, False otherwise.
Return typebool
dump(db_path, kbs=None, extra_info=None)
Parameters• kbs (list[KnowledgeBase] | None)• extra_info (dict[str, Any] | None)load(db_path, kb_names=None, other_kbs=None, extra_info=None)
Parameters• db_path (str)• kb_names (list[str] | None)• other_kbs (dict[str, KnowledgeBase] | None)• extra_info (dict[str, Any] | None)

10.15. Analysis

917

angr

class angr.angrdb.db.AngrDB(project=None)
Bases: object
AngrDB provides a storage solution for an angr project, its knowledge bases, and some other types of data. It is
designed to use an SQL-based database as the storage backend.
ALL_TABLES = ['objects']
VERSION = 1__init__(project=None)
static open_db(db_str='sqlite:///:memory:')
static session_scope(Session)
static save_info(session, key, value)
Save an information entry to the database.
Parameters• session• key• value
Returnsstatic get_info(session, key)Get an information entry from the database.
Parameters• session• key
Returns
update_dbinfo(session, extra_info=None)
Update the information in database.
Parameters• session• extra_info (dict[str, str] | None)
Returns
get_dbinfo(session, extra_info=None)
Get database information.
Parameters• session• extra_info (dict[str, str] | None)
Returns
A dict of information entries.

918

Chapter 10. API Referenceangrdb_compatible(version)
Checks if the given database version is compatible with the current AngrDB class.
Parameters
version (int) – The version of the database.
Returns
True if compatible, False otherwise.
Return typebool
dump(db_path, kbs=None, extra_info=None)
Parameters• kbs (list[KnowledgeBase] | None)• extra_info (dict[str, Any] | None)load(db_path, kb_names=None, other_kbs=None, extra_info=None)
Parameters• db_path (str)• kb_names (list[str] | None)• other_kbs (dict[str, KnowledgeBase] | None)• extra_info (dict[str, Any] | None)class angr.angrdb.models.DbInformation(**kwargs)
Bases: BaseStores information related to the current database. Basically a key-value store.
id
key
value
__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbObject(**kwargs)
Bases: Base
Models a binary object.
idmain_object
path
content

10.15. Analysis

919

angr

backendbackend_args__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbKnowledgeBase(**kwargs)
Bases: Base
Models a knowledge base.
id
name
cfgs
funcs
xrefs
comments
labelsvar_collections
structured_code__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbCFGModel(**kwargs)
Bases: Base
Models a CFGFast instance.
id
kb_id
kb
ident
blob

920

Chapter 10. API Referenceangr__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbFunction(**kwargs)
Bases: Base
Models a Function instance.
id
kb_id
kb
addr
blob
__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbVariableCollection(**kwargs)
Bases: Base
Models a VariableManagerInternal instance.
id
kb_id
kb
func_addr
ident
blob
__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbStructuredCode(**kwargs)
Bases: Base
Models a StructuredCode instance.
id10.15. Analysis

921

angr

kb_id
kb
func_addr
flavorexpr_comments
stmt_comments
configuration
const_formats
ite_exprs__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbXRefs(**kwargs)
Bases: Base
Models an XRefManager instance.
id
kb_id
kb
blob
__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbComment(**kwargs)
Bases: Base
Models a comment.
id
kb_id
kb
addr
comment

922

Chapter 10. API Reference

angr

type
__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.models.DbLabel(**kwargs)
Bases: Base
Models a label.
id
kb_id
kb
addr
name
__init__(**kwargs)
A simple constructor that allows initialization from kwargs.
Sets attributes on the constructed instance using the names and values in kwargs.
Only keys that are present as attributes of the instance’s class are allowed. These could be, for example,
any mapped columns or relationships.
class angr.angrdb.serializers.LoaderSerializer
Bases: object
Serialize/unserialize a CLE Loader object into/from an angr DB.
Corner cases: - For certain backends (e.g., CART), we do not store the data of the main object. angr will unpack
the CART fileagain after loading the database.
NO_MAINBIN_BACKENDS = [<class 'cle.backends.cartfile.CARTFile'>]LOAD_ARG_BLACKLIST = {'is_main_bin', 'loader'}backend2name = {<class 'cle.backends.blob.Blob'>: 'blob', <class'cle.backends.cartfile.CARTFile'>: 'cart', <class'cle.backends.cgc.backedcgc.BackedCGC'>: 'backedcgc', <class'cle.backends.cgc.cgc.CGC'>: 'cgc', <class 'cle.backends.coff.Coff'>: 'COFF',<class 'cle.backends.elf.elf.ELF'>: 'elf', <class'cle.backends.elf.elfcore.ELFCore'>: 'elfcore', <class 'cle.backends.ihex.Hex'>:'hex', <class 'cle.backends.java.apk.Apk'>: 'apk', <class'cle.backends.java.jar.Jar'>: 'jar', <class 'cle.backends.macho.macho.MachO'>:'mach-o', <class 'cle.backends.minidump.Minidump'>: 'minidump', <class'cle.backends.named_region.NamedRegion'>: 'named_region', <class'cle.backends.pe.pe.PE'>: 'pe', <class 'cle.backends.srec.SRec'>: 'srec', <class'cle.backends.static_archive.StaticArchive'>: 'AR', <class 'cle.backends.te.TE'>:'te', <class 'cle.backends.uefi_firmware.UefiFirmware'>: 'uefi', <class'cle.backends.xbe.XBE'>: 'xbe'}

10.15. Analysis

923

angr

static json_serialize_load_args(load_args)
Return typestr
Parameters
load_args (dict[str, Any])static should_skip_main_binary(loader)
Return typetuple[bool, Backend | None]
static dump(session, loader)
static load(session)class angr.angrdb.serializers.KnowledgeBaseSerializer
Bases: object
Serialize/unserialize a KnowledgeBase object.
static dump(session, kb)
Parameters• session – The database session object.
• kb (KnowledgeBase) – The KnowledgeBase instance to serialize.
ReturnsNonestatic load(session, project, name)Parameters
sessionReturnsclass angr.angrdb.serializers.cfg_model.CFGModelSerializer
Bases: object
Serialize/unserialize a CFGModel.
static dump(session, db_kb, ident, cfg_model)
Parameters• session• db_kb (DbKnowledgeBase) – The database object for KnowledgeBase.
• ident (str) – Identifier of the CFG model.
• cfg_model (CFGModel) – The CFG model to dump.
ReturnsNonestatic load(session, db_kb, ident, cfg_manager, loader=None)

924

Chapter 10. API Referenceangrclass angr.angrdb.serializers.comments.CommentsSerializer
Bases: object
Serialize/unserialize comments to/from a database session.
static dump(session, db_kb, comments)
Parameters• session• db_kb (DbKnowledgeBase)• comments (Comments)
ReturnsNonestatic load(session, db_kb, kb)
Parameters• session• db_kb (DbKnowledgeBase)• kb (KnowledgeBase)
Returnsclass angr.angrdb.serializers.funcs.FunctionManagerSerializer
Bases: object
Serialize/unserialize a function manager and its functions.
static dump(session, db_kb, func_manager)
Parameters• session• db_kb (DbKnowledgeBase)• func_manager (FunctionManager)
Returnsstatic load(session, db_kb, kb)
Parameters• session• db_kb (DbKnowledgeBase)• kb (KnowledgeBase)
Returns
A loaded function manager.
class angr.angrdb.serializers.kb.KnowledgeBaseSerializer
Bases: object
Serialize/unserialize a KnowledgeBase object.

10.15. Analysis

925

angr

static dump(session, kb)
Parameters• session – The database session object.
• kb (KnowledgeBase) – The KnowledgeBase instance to serialize.
ReturnsNonestatic load(session, project, name)Parameters
sessionReturnsclass angr.angrdb.serializers.labels.LabelsSerializer
Bases: object
Serialize/unserialize labels to/from a database session.
static dump(session, db_kb, labels)
Parameters• session• db_kb (DbKnowledgeBase)• labels (Labels)
ReturnsNonestatic load(session, db_kb, kb)
Parameters• session• db_kb (DbKnowledgeBase)• kb (KnowledgeBase)
Returnsclass angr.angrdb.serializers.loader.LoadArgsJSONEncoder(*, skipkeys=False, ensure_ascii=True,
check_circular=True, allow_nan=True,
sort_keys=False, indent=None,
separators=None, default=None)
Bases: JSONEncoder
A JSON encoder that supports serializing bytes.
default(o)Implement this method in a subclass such that it returns a serializable object for o, or calls the base implementation (to raise a TypeError).
For example, to support arbitrary iterators, you could implement default like this:926

Chapter 10. API Referenceangr

def default(self, o):try:iterable = iter(o)except TypeError:
pass
else:
return list(iterable)# Let the base class default method raise the TypeError
return JSONEncoder.default(self, o)class angr.angrdb.serializers.loader.LoadArgsJSONDecoder
Bases: JSONDecoder
A JSON decoder that supports unserializing into bytes.
__init__()object_hook, if specified, will be called with the result of every JSON object decoded and its return value
will be used in place of the given dict. This can be used to provide custom deserializations (e.g. to support
JSON-RPC class hinting).
object_pairs_hook, if specified will be called with the result of every JSON object decoded with an ordered list of pairs. The return value of object_pairs_hook will be used instead of the dict. This feature
can be used to implement custom decoders. If object_hook is also defined, the object_pairs_hook
takes priority.
parse_float, if specified, will be called with the string of every JSON float to be decoded. By default
this is equivalent to float(num_str). This can be used to use another datatype or parser for JSON floats (e.g.
decimal.Decimal).
parse_int, if specified, will be called with the string of every JSON int to be decoded. By default thisis equivalent to int(num_str). This can be used to use another datatype or parser for JSON integers (e.g.
float).
parse_constant, if specified, will be called with one of the following strings: -Infinity, Infinity, NaN.
This can be used to raise an exception if invalid JSON numbers are encountered.
If strict is false (true is the default), then control characters will be allowed inside strings. Control
characters in this context are those with character codes in the 0-31 range, including '\t' (tab), '\n','\r' and '\0'.
class angr.angrdb.serializers.loader.LoaderSerializer
Bases: object
Serialize/unserialize a CLE Loader object into/from an angr DB.
Corner cases: - For certain backends (e.g., CART), we do not store the data of the main object. angr will unpack
the CART fileagain after loading the database.
NO_MAINBIN_BACKENDS = [<class 'cle.backends.cartfile.CARTFile'>]LOAD_ARG_BLACKLIST = {'is_main_bin', 'loader'}10.15. Analysis

927

angr

backend2name = {<class 'cle.backends.blob.Blob'>: 'blob', <class'cle.backends.cartfile.CARTFile'>: 'cart', <class'cle.backends.cgc.backedcgc.BackedCGC'>: 'backedcgc', <class'cle.backends.cgc.cgc.CGC'>: 'cgc', <class 'cle.backends.coff.Coff'>: 'COFF',<class 'cle.backends.elf.elf.ELF'>: 'elf', <class'cle.backends.elf.elfcore.ELFCore'>: 'elfcore', <class 'cle.backends.ihex.Hex'>:'hex', <class 'cle.backends.java.apk.Apk'>: 'apk', <class'cle.backends.java.jar.Jar'>: 'jar', <class 'cle.backends.macho.macho.MachO'>:'mach-o', <class 'cle.backends.minidump.Minidump'>: 'minidump', <class'cle.backends.named_region.NamedRegion'>: 'named_region', <class'cle.backends.pe.pe.PE'>: 'pe', <class 'cle.backends.srec.SRec'>: 'srec', <class'cle.backends.static_archive.StaticArchive'>: 'AR', <class 'cle.backends.te.TE'>:'te', <class 'cle.backends.uefi_firmware.UefiFirmware'>: 'uefi', <class'cle.backends.xbe.XBE'>: 'xbe'}
static json_serialize_load_args(load_args)
Return typestr
Parameters
load_args (dict[str, Any])static should_skip_main_binary(loader)
Return typetuple[bool, Backend | None]
static dump(session, loader)
static load(session)class angr.angrdb.serializers.xrefs.XRefsSerializer
Bases: object
Serialize/unserialize an XRefs object to/from a database session.
static dump(session, db_kb, xrefs)
Parameters• session• db_kb (DbKnowledgeBase)• xrefs (XRefManager)
Returnsstatic load(session, db_kb, kb, cfg_model=None)
Parameters• session• db_kb (DbKnowledgeBase)• kb (KnowledgeBase)• cfg_model (CFGModel)
Returns

928

Chapter 10. API Referenceangrclass angr.angrdb.serializers.variables.VariableManagerSerializer
Bases: object
Serialize/unserialize a variable manager and its variables.
static dump(session, db_kb, var_manager)
Parameters• db_kb (DbKnowledgeBase)• var_manager (VariableManager)
static dump_internal(session, db_kb, internal_manager, func_addr, ident=None)
Parameters• db_kb (DbKnowledgeBase)• internal_manager (VariableManagerInternal)• func_addr (int)static load(session, db_kb, kb, ident=None)
Parameters• db_kb (DbKnowledgeBase)• kb (KnowledgeBase)static load_internal(db_varcoll, variable_manager)
Return type
VariableManagerInternalParameters
variable_manager (VariableManager)
class angr.angrdb.serializers.structured_code.StructuredCodeManagerSerializer
Bases: object
Serialize/unserialize a structured code manager.
static dump(session, db_kb, code_manager)
Parameters• session• db_kb (DbKnowledgeBase)• code_manager (StructuredCodeManager)
Returnsstatic dict_strkey_to_intkey(d)Return type
dict[int, Any]
Parametersd (dict[str, Any])

10.15. Analysis

929

angr

static load(session, db_kb, kb)
Parameters• session• db_kb (DbKnowledgeBase)• kb (KnowledgeBase)
Return type
StructuredCodeManager
Returns
A loaded structured code manager
class angr.analyses.decompiler.structuring.recursive_structurer.RecursiveStructurer(region,
cond_proc=None,
func=None,
structurer_cls=None,**kwargs)
Bases: Analysis
Recursively structure a region and all of its subregions.
Parameters• func (Function | None)• structurer_cls (type | None)__init__(region, cond_proc=None, func=None, structurer_cls=None, **kwargs)
Parameters• func (Function | None)• structurer_cls (type | None)class angr.analyses.decompiler.structuring.DreamStructurer(region, parent_map=None,condition_processor=None,
func=None,case_entry_to_switch_head=None,
parent_region=None, **kwargs)
Bases: StructurerBase
Structure a region using a structuring algorithm that is similar to the one in Dream decompiler (described in the“no more gotos” paper). Note that this implementation has quite a few improvements over the original describedversion and should not be used to evaluate the performance of the original algorithm described in that paper.
The current function graph is provided so that we can detect certain edge cases, for example, jump table entries
no longer exist due to empty node removal during structuring or prior steps.
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)
NAME: str = 'dream'

930

Chapter 10. API Referenceangr__init__(region, parent_map=None, condition_processor=None, func=None,case_entry_to_switch_head=None, parent_region=None, **kwargs)
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)class angr.analyses.decompiler.structuring.PhoenixStructurer(region, parent_map=None,condition_processor=None,
func=None,case_entry_to_switch_head=None,
parent_region=None,
improve_algorithm=False,
use_multistmtexprs=MultiStmtExprMode.MAX_ONE_C**kwargs)
Bases: StructurerBase
Structure a region using a structuring algorithm that is similar to the one in Phoenix decompiler (described in
the “phoenix decompiler” paper). Note that this implementation has quite a few improvements over the originaldescribed version and should not be used to evaluate the performance of the original algorithm described in that
paper.
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)• use_multistmtexprs (MultiStmtExprMode)
NAME: str = 'phoenix'__init__(region, parent_map=None, condition_processor=None, func=None,case_entry_to_switch_head=None, parent_region=None, improve_algorithm=False,
use_multistmtexprs=MultiStmtExprMode.MAX_ONE_CALL, **kwargs)
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)• use_multistmtexprs (MultiStmtExprMode)static dump_graph(graph, path)
Return type
None
Parameters• graph (DiGraph )• path (str)class angr.analyses.decompiler.structuring.SAILRStructurer(region, improve_phoenix=True,**kwargs)
Bases: PhoenixStructurer

10.15. Analysis

931

angr

The SAILR structuring algorithm is the phoenix-based algorithm from the USENIX 2024 paper SAILR. The
entirety of the algorithm is implemented across this class and various optimization passes in the decompiler. To
find each optimization class, simply search for optimizations which reference this class.NAME.
At a high-level, SAILR does three things different from the traditional Phoenix schema-based algorithm: 1. It
recursively structures the graph, rather than doing it in a single pass. This allows decisions to be madebased on the current state of what the decompilation would look like.
2. It performs deoptimizations targeting specific optimizations that introduces gotos andmis-structured code.
It can only do this because of the recursive nature of the algorithm.
3. It uses a more advanced heuristic for virtualizing edges, which is implemented in this class.
Additionally, some changes in Phoenix are only activated when SAILR is used.
NAME: str = 'sailr'__init__(region, improve_phoenix=True, **kwargs)
class angr.analyses.decompiler.structuring.RecursiveStructurer(region, cond_proc=None,
func=None, structurer_cls=None,**kwargs)
Bases: Analysis
Recursively structure a region and all of its subregions.
Parameters• func (Function | None)• structurer_cls (type | None)__init__(region, cond_proc=None, func=None, structurer_cls=None, **kwargs)
Parameters• func (Function | None)• structurer_cls (type | None)angr.analyses.decompiler.structuring.DEFAULT_STRUCTURER
alias of SAILRStructurer
angr.analyses.decompiler.structuring.structurer_class_from_name(name)Return type
type | None
Parametersname (str)class angr.analyses.decompiler.structuring.dream.DreamStructurer(region, parent_map=None,condition_processor=None,
func=None,case_entry_to_switch_head=None,
parent_region=None,**kwargs)
Bases: StructurerBase

932

Chapter 10. API ReferenceangrStructure a region using a structuring algorithm that is similar to the one in Dream decompiler (described in the“no more gotos” paper). Note that this implementation has quite a few improvements over the original describedversion and should not be used to evaluate the performance of the original algorithm described in that paper.
The current function graph is provided so that we can detect certain edge cases, for example, jump table entries
no longer exist due to empty node removal during structuring or prior steps.
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)
NAME: str = 'dream'__init__(region, parent_map=None, condition_processor=None, func=None,case_entry_to_switch_head=None, parent_region=None, **kwargs)
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)
project:kb:

Project

KnowledgeBase

exception angr.analyses.decompiler.structuring.structurer_nodes.EmptyBlockNoticeBases: Exception
class angr.analyses.decompiler.structuring.structurer_nodes.MultiNode(nodes, addr=None,
idx=None)Bases: object__init__(nodes, addr=None, idx=None)
nodes
addr
idx
copy()
dbg_repr(indent=0)
class angr.analyses.decompiler.structuring.structurer_nodes.BaseNode
Bases: object
static test_empty_node(node)static test_empty_condition_node(cond_node)
addr:

int | None

dbg_repr(indent=0)
class angr.analyses.decompiler.structuring.structurer_nodes.SequenceNode(addr, nodes=None)
Bases: BaseNode
Parametersaddr (int | None)

10.15. Analysis

933

angr

__init__(addr, nodes=None)
Parametersaddr (int | None)
addr:

int | Nonenodes
add_node(node)
insert_node(pos, node)
remove_node(node)
node_position(node)copy()
dbg_repr(indent=0)
class angr.analyses.decompiler.structuring.structurer_nodes.CodeNode(node, reaching_condition)
Bases: BaseNode__init__(node, reaching_condition)node
reaching_condition
property addr
property idx
dbg_repr(indent=0)
copy()
class angr.analyses.decompiler.structuring.structurer_nodes.ConditionNode(addr,
reaching_condition,
condition,
true_node,
false_node=None)
Bases: BaseNode
Parametersaddr (int | None)__init__(addr, reaching_condition, condition, true_node, false_node=None)
addr:

int | Nonereaching_condition
condition
true_node
false_node

934

Chapter 10. API Referenceangrdbg_repr(indent=0)
nodeclass angr.analyses.decompiler.structuring.structurer_nodes.CascadingConditionNode(addr,
condition_and_nodes,
else_node=None)
Bases: BaseNode
Parameters• addr (int | None)• condition_and_nodes (list[tuple[Any, BaseNode]])• else_node (BaseNode)__init__(addr, condition_and_nodes, else_node=None)
Parameters• condition_and_nodes (list[tuple[Any, BaseNode]])• else_node (BaseNode | None)
addr:

int | Nonecondition_and_nodes
else_nodeclass angr.analyses.decompiler.structuring.structurer_nodes.LoopNode(sort, condition,
sequence_node,addr=None,continue_addr=None,
initializer=None,
iterator=None)
Bases: BaseNode
Parameters• sort (str)• condition (ailment.Expr.Expression | None)• sequence_node (SequenceNode)• addr (int | None)• continue_addr (int | None)• initializer (ailment.Stmt.Assignment | None)• iterator (ailment.Stmt.Assignment | None)__init__(sort, condition, sequence_node, addr=None, continue_addr=None, initializer=None,
iterator=None)
Parameters• sort (str)• condition (Expression | None)

10.15. Analysis

935

angr

• sequence_node (SequenceNode)• addr (int | None)• continue_addr (int | None)• initializer (Assignment | None)• iterator (Assignment | None)
sort:

str

condition:

Expression | Nonesequence_node:initializer:
iterator:

SequenceNode

Assignment | None

Assignment | Nonecopy()
property addr
property continue_addr
dbg_repr(indent=0)
class angr.analyses.decompiler.structuring.structurer_nodes.BreakNode(addr, target)
Bases: BaseNode
Parametersaddr (int | None)__init__(addr, target)
addr:

int | Nonetargetdbg_repr(indent=0)
class angr.analyses.decompiler.structuring.structurer_nodes.ContinueNode(addr, target)
Bases: BaseNode
Parametersaddr (int | None)__init__(addr, target)
addr:

int | Nonetargetdbg_repr(indent=0)
class angr.analyses.decompiler.structuring.structurer_nodes.ConditionalBreakNode(addr,
condition,
target)Bases: BreakNode
Parametersaddr (int | None)

936

Chapter 10. API Referenceangr__init__(addr, condition, target)
condition
dbg_repr(indent=0)
class angr.analyses.decompiler.structuring.structurer_nodes.SwitchCaseNode(switch_expr,
cases,
default_node,addr=None)
Bases: BaseNode
Parameters• cases (OrderedDict[int | tuple[int, ...], SequenceNode])• addr (int | None)__init__(switch_expr, cases, default_node, addr=None)
Parameterscases (OrderedDict[int | tuple[int, ...], SequenceNode])
switch_expr
cases:

OrderedDict[int | tuple[int, ...], SequenceNode]default_node
addr:

int | Noneclass angr.analyses.decompiler.structuring.structurer_nodes.IncompleteSwitchCaseNode(addr,
head,cases)
Bases: BaseNode
Describes an incomplete set of switch-case nodes. Usually an intermediate result. Should always be restructured
into a SwitchCaseNode by the end of structuring. Only used in Phoenix structurer.
Parameters• addr (int | None)• cases (list)__init__(addr, head, cases)
Parameterscases (list)
addr:

int | Noneheadcases:

listclass angr.analyses.decompiler.structuring.structurer_nodes.IncompleteSwitchCaseHeadStatement(*args,**kwargs)
Bases: Statement
Describes a switch-case head. This is only created by LoweredSwitchSimplifier.

10.15. Analysis

937

angr

__init__(idx, switch_variable, case_addrs, **kwargs)
switch_variable
case_addrs:

list[tuple[Block, int | str, int, int | None, int]]

addr
class angr.analyses.decompiler.structuring.structurer_base.StructurerBase(region,
parent_map=None,condition_processor=None,
func=None,case_entry_to_switch_head=None,
parent_region=None,**kwargs)
Bases: Analysis
The base class for analysis passes that structures a region.
The current function graph is provided so that we can detect certain edge cases, for example, jump table entries
no longer exist due to empty node removal during structuring or prior steps.
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)
NAME: str = None__init__(region, parent_map=None, condition_processor=None, func=None,case_entry_to_switch_head=None, parent_region=None, **kwargs)
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)
static replace_nodes(graph, old_node_0, new_node, old_node_1=None, self_loop=True)
static replace_node_in_node(parent_node, old_node, new_node)
Return type
None
Parameters• parent_node (BaseNode)• old_node (BaseNode | Block)• new_node (BaseNode | Block)static is_a_jump_target(stmt, addr)
Return typebool
Parameters• stmt (ConditionalJump | Jump)
938

Chapter 10. API Referenceangr• addr (int)static has_nonlabel_nonphi_statements(node)
Return typebool
Parametersnode (BaseNode)exception angr.analyses.decompiler.structuring.phoenix.GraphChangedNotification
Bases: Exception
A notification for graph that is currently worked on being changed. Once this notification is caught, the graphschema matching process for the current region restarts.
class angr.analyses.decompiler.structuring.phoenix.MultiStmtExprMode(value)
Bases: str, Enum
Mode of multi-statement expression creation during structuring.
NEVER = 'Never'
ALWAYS = 'Always'
MAX_ONE_CALL = 'Only when less than one call'class angr.analyses.decompiler.structuring.phoenix.PhoenixStructurer(region,
parent_map=None, condition_processor=None,
func=None,case_entry_to_switch_head=None,
parent_region=None,
improve_algorithm=False,
use_multistmtexprs=MultiStmtExprMode.MA**kwargs)
Bases: StructurerBase
Structure a region using a structuring algorithm that is similar to the one in Phoenix decompiler (described in
the “phoenix decompiler” paper). Note that this implementation has quite a few improvements over the originaldescribed version and should not be used to evaluate the performance of the original algorithm described in that
paper.
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)• use_multistmtexprs (MultiStmtExprMode)
NAME: str = 'phoenix'__init__(region, parent_map=None, condition_processor=None, func=None,case_entry_to_switch_head=None, parent_region=None, improve_algorithm=False,
use_multistmtexprs=MultiStmtExprMode.MAX_ONE_CALL, **kwargs)
Parameters• func (Function | None)• case_entry_to_switch_head (dict[int, int] | None)
10.15. Analysis

939

angr

• use_multistmtexprs (MultiStmtExprMode)
whitelist_edges:

set[tuple[int, int]]

switch_case_known_heads:

set[Block]dowhile_known_tail_nodes:

setstatic dump_graph(graph, path)
Return type
None
Parameters• graph (DiGraph )• path (str)project:kb:

Project

KnowledgeBase

class angr.analyses.decompiler.RegionIdentifier(func, cond_proc=None, graph=None,
update_graph=True,largest_successor_tree_outside_loop=True,
force_loop_single_exit=True,
complete_successors=False,
entry_node_addr=None)
Bases: Analysis
Identifies regions within a function graph and creates a recursive GraphRegion object. Note, that the analysis
may modify the graph in-place. If you want to keep the original graph, set the update_graph parameter to False.
Parameters
entry_node_addr (tuple[int, int | None] | None)__init__(func, cond_proc=None, graph=None, update_graph=True,largest_successor_tree_outside_loop=True, force_loop_single_exit=True,
complete_successors=False, entry_node_addr=None)
Parameters
entry_node_addr (tuple[int, int | None] | None)
static slice_graph(graph, node, frontier, include_frontier=False)
Generate a slice of the graph from the head node to the given frontier.
Parameters• graph (networkx.DiGraph ) – The graph to work on.
• node – The starting node in the graph.
• frontier – A list of frontier nodes.
• include_frontier (bool) – Whether the frontier nodes are included in the slice or not.
Returns
A subgraph.
Return typenetworkx.DiGraph

940

Chapter 10. API Referenceangrclass angr.analyses.decompiler.CStructuredCodeGenerator(func, sequence, indent=0, cfg=None,
variable_kb=None, func_args=None,
binop_depth_cutoff=16, show_casts=True,
braces_on_own_lines=True,
use_compound_assignments=True,
show_local_types=True,comment_gotos=False,
cstyle_null_cmp=True, flavor=None,
stmt_comments=None,
expr_comments=None,
show_externs=True, externs=None,const_formats=None,
show_demangled_name=True,
show_disambiguated_name=True,
ail_graph=None,
simplify_else_scope=True, cstyle_ifs=True,
omit_func_header=False)
Bases: BaseStructuredCodeGenerator, Analysis
Parameters• func_args (list[SimVariable] | None)• binop_depth_cutoff (int)__init__(func, sequence, indent=0, cfg=None, variable_kb=None, func_args=None,
binop_depth_cutoff=16, show_casts=True, braces_on_own_lines=True,
use_compound_assignments=True, show_local_types=True, comment_gotos=False,
cstyle_null_cmp=True, flavor=None, stmt_comments=None, expr_comments=None,
show_externs=True, externs=None, const_formats=None, show_demangled_name=True,
show_disambiguated_name=True, ail_graph=None, simplify_else_scope=True, cstyle_ifs=True,
omit_func_header=False)
Parameters• func_args (list[SimVariable] | None)• binop_depth_cutoff (int)reapply_options(options)cleanup()
Remove existing rendering results.
regenerate_text()
Re-render text and re-generate all sorts of mapping information.
Return type
None
RENDER_TYPE
alias of tuple[str, PositionMapping, PositionMapping, InstructionMapping, dict[Any,set[Any]]]
render_text(cfunc)
Return type
RENDER_TYPE

10.15. Analysis

941

angr

Parameters
cfunc (CFunction)
reload_variable_types()
Return type
Nonedefault_simtype_from_size(n, signed=True)
Return type
SimTypeParameters• n (int)• signed (bool)class angr.analyses.decompiler.ImportSourceCode(function, flavor='source', source_root=None,
encoding='utf-8')
Bases: BaseStructuredCodeGenerator, Analysis__init__(function, flavor='source', source_root=None, encoding='utf-8')
regenerate_text()
class angr.analyses.decompiler.Clinic(func, remove_dead_memdefs=False, exception_edges=False,
sp_tracker_track_memory=True,
fold_callexprs_into_conditions=False, insert_labels=True,
optimization_passes=None, cfg=None,
peephole_optimizations=None, must_struct=None,
variable_kb=None, reset_variable_names=False,
rewrite_ites_to_diamonds=True, cache=None,
mode=ClinicMode.DECOMPILE, sp_shift=0,
inline_functions=frozenset({}), inlined_counts=None,
inlining_parents=None, vvar_id_start=0)
Bases: Analysis
A Clinic deals with AILments.
Parameters• peephole_optimizations (None | Iterable[type[PeepholeOptimizationStmtBase]| type[PeepholeOptimizationExprBase]])• must_struct (set[str] | None)• cache (DecompilationCache | None)• mode (ClinicMode)• sp_shift (int)• inline_functions (set[Function] | None)• inlined_counts (dict[int, int] | None)• inlining_parents (set[int] | None)• vvar_id_start (int)942

Chapter 10. API Referenceangr__init__(func, remove_dead_memdefs=False, exception_edges=False, sp_tracker_track_memory=True,
fold_callexprs_into_conditions=False, insert_labels=True, optimization_passes=None, cfg=None,
peephole_optimizations=None, must_struct=None, variable_kb=None,
reset_variable_names=False, rewrite_ites_to_diamonds=True, cache=None,
mode=ClinicMode.DECOMPILE, sp_shift=0, inline_functions=frozenset({}),
inlined_counts=None, inlining_parents=None, vvar_id_start=0)
Parameters• peephole_optimizations (None | Iterable[type[PeepholeOptimizationStmtBase]| type[PeepholeOptimizationExprBase]])• must_struct (set[str] | None)• cache (DecompilationCache | None)• mode (ClinicMode)• sp_shift (int)• inline_functions (set[Function] | None)• inlined_counts (dict[int, int] | None)• inlining_parents (set[int] | None)• vvar_id_start (int)block(addr, size)
Get the converted block at the given specific address with the given size.
Parameters• addr (int)• size (int)
Returnsdbg_repr()
Returns
calculate_stack_depth()
copy_graph(graph=None)
Return type
DiGraphparse_variable_addr(addr)
Return typetuple[Any, Any] | None
Parametersaddr (Expression)
new_block_addr()
Return a block address that does not conflict with any existing blocks.
Return typeint

10.15. Analysis

943

angr

Returns
The block address.
static remove_empty_nodes(graph)
Return type
DiGraphParametersgraph (DiGraph )class angr.analyses.decompiler.RegionSimplifier(func, region, variable_kb=None,
simplify_switches=True, simplify_ifelse=True)
Bases: Analysis
Simplifies a given region.
Parameters• simplify_switches (bool)• simplify_ifelse (bool)__init__(func, region, variable_kb=None, simplify_switches=True, simplify_ifelse=True)
Parameters• simplify_switches (bool)• simplify_ifelse (bool)class angr.analyses.decompiler.Decompiler(func, cfg=None, options=None, preset=None,
optimization_passes=None, sp_tracker_track_memory=True,
variable_kb=None, peephole_optimizations=None,vars_must_struct=None, flavor='pseudocode',
expr_comments=None, stmt_comments=None,
ite_exprs=None, binop_operators=None, decompile=True,
regen_clinic=True, inline_functions=frozenset({}),
update_memory_data=True, generate_code=True)
Bases: Analysis
The decompiler analysis.
Run this on a Function object for which a normalized CFG has been constructed. The fully processed output canbe found in result.codegen.text
Parameters• func (Function | str | int)
• cfg (CFGFast | CFGModel | None)• preset (str | DecompilationPreset | None)• peephole_optimizations (_PEEPHOLE_OPTIMIZATIONS_TYPE)• vars_must_struct (set[str] | None)• update_memory_data (bool)• generate_code (bool)

944

Chapter 10. API Referenceangr__init__(func, cfg=None, options=None, preset=None, optimization_passes=None,
sp_tracker_track_memory=True, variable_kb=None, peephole_optimizations=None,vars_must_struct=None, flavor='pseudocode', expr_comments=None, stmt_comments=None,
ite_exprs=None, binop_operators=None, decompile=True, regen_clinic=True,
inline_functions=frozenset({}), update_memory_data=True, generate_code=True)
Parameters• func (Function | str | int)
• cfg (CFGFast | CFGModel | None)• preset (str | DecompilationPreset | None)• peephole_optimizations (Iterable[type[PeepholeOptimizationStmtBase] |type[PeepholeOptimizationExprBase]] | None)• vars_must_struct (set[str] | None)• update_memory_data (bool)• generate_code (bool)
reflow_variable_types(type_constraints, func_typevar, var_to_typevar, codegen)Re-run type inference on an existing variable recovery result, then rerun codegen to generate new results.
Returns
Parameters• type_constraints (set)• var_to_typevar (dict)find_data_references_and_update_memory_data(seq_node)Parameters
seq_node (SequenceNode)static options_to_params(options)
Convert decompilation options to a dict of params.
Parameters
options (list[tuple[DecompilationOption, Any]]) – The decompilation options.
Return type
dict[str, Any]
Returns
A dict of keyword arguments.
class angr.analyses.decompiler.BlockSimplifier(block, func_addr=None,remove_dead_memdefs=False,
stack_pointer_tracker=None,
peephole_optimizations=None,
cached_reaching_definitions=None,
cached_propagator=None)
Bases: Analysis
Simplify an AIL block.
Parameters• block (Block | None)
10.15. Analysis

945

angr

• func_addr (int | None)• peephole_optimizations (None | Iterable[type[PeepholeOptimizationStmtBase]| type[PeepholeOptimizationExprBase]])__init__(block, func_addr=None, remove_dead_memdefs=False, stack_pointer_tracker=None,
peephole_optimizations=None, cached_reaching_definitions=None, cached_propagator=None)
Parameters• block (Block | None) – The AIL block to simplify. Setting it to None to skip calling
self._analyze(), which is useful in test cases.
• func_addr (int | None)• peephole_optimizations (None | Iterable[type[PeepholeOptimizationStmtBase]| type[PeepholeOptimizationExprBase]])class angr.analyses.decompiler.CallSiteMaker(block, reaching_definitions=None,
stack_pointer_tracker=None, ail_manager=None)
Bases: Analysis
Add calling convention, declaration, and args to a call site.
__init__(block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager=None)class angr.analyses.decompiler.AILSimplifier(func, func_graph=None, remove_dead_memdefs=False,
stack_arg_offsets=None, unify_variables=False,
ail_manager=None, gp=None,
narrow_expressions=False, only_consts=False,
fold_callexprs_into_conditions=False,
use_callee_saved_regs_at_return=True,
rewrite_ccalls=True, removed_vvar_ids=None,
arg_vvars=None)
Bases: Analysis
Perform function-level simplifications.
Parameters• stack_arg_offsets (set[tuple[int, int]] | None)• ail_manager (Manager | None)• gp (int | None)• removed_vvar_ids (set[int] | None)• arg_vvars (dict[int, tuple[VirtualVariable, SimVariable]] | None)__init__(func, func_graph=None, remove_dead_memdefs=False, stack_arg_offsets=None,
unify_variables=False, ail_manager=None, gp=None, narrow_expressions=False,
only_consts=False, fold_callexprs_into_conditions=False,
use_callee_saved_regs_at_return=True, rewrite_ccalls=True, removed_vvar_ids=None,
arg_vvars=None)
Parameters• stack_arg_offsets (set[tuple[int, int]] | None)• ail_manager (Manager | None)• gp (int | None)

946

Chapter 10. API Referenceangr• removed_vvar_ids (set[int] | None)• arg_vvars (dict[int, tuple[VirtualVariable, SimVariable]] | None)class angr.analyses.decompiler.Ssailification(func, ail_graph, entry=None, canonical_size=8,
stack_pointer_tracker=None, func_addr=None,
ail_manager=None, ssa_stackvars=False,
vvar_id_start=0)
Bases: Analysis
Ssailification (SSA-AIL-ification) transforms an AIL graph to its partial-SSA form.
Parameters• func (Function | str)
• func_addr (int | None)• ssa_stackvars (bool)• vvar_id_start (int)__init__(func, ail_graph, entry=None, canonical_size=8, stack_pointer_tracker=None, func_addr=None,
ail_manager=None, ssa_stackvars=False, vvar_id_start=0)
Parameters• func (Function | str) – The subject of the analysis: a function, or a single basic block• ail_graph – The AIL graph to transform.
• canonical_size – The sizes (in bytes) that objects with an UNKNOWN_SIZE are treatedas for operations where sizes are necessary.
• func_addr (int | None)• ssa_stackvars (bool)• vvar_id_start (int)class angr.analyses.decompiler.GraphDephication(func, ail_graph, vvar_to_vvar_mapping=None,
rewrite=False)
Bases: DephicationBase
GraphDephication removes phi expressions from an AIL graph, essentially transforms a partial-SSA form of AILgraph to a normal AIL graph.
Parameters• func (Function | str)
• vvar_to_vvar_mapping (dict[int, int] | None)• rewrite (bool)__init__(func, ail_graph, vvar_to_vvar_mapping=None, rewrite=False)
Parameters• func (Function | str) – The subject of the analysis: a function, or a single basic block• ail_graph – The AIL graph to transform.
• vvar_to_vvar_mapping (dict[int, int] | None)• rewrite (bool)

10.15. Analysis

947

angr

class angr.analyses.decompiler.SeqNodeDephication(func, seq_node, vvar_to_vvar_mapping=None,
rewrite=False)
Bases: DephicationBase
SeqNodeDephication removes phi expressions from an AIL SeqNode and its children.
Parameters• func (Function | str)
• vvar_to_vvar_mapping (dict[int, int] | None)• rewrite (bool)__init__(func, seq_node, vvar_to_vvar_mapping=None, rewrite=False)
Parameters• func (Function | str)
• vvar_to_vvar_mapping (dict[int, int] | None)• rewrite (bool)
angr.analyses.decompiler.StructuredCodeGenerator
alias of CStructuredCodeGenerator
exception angr.analyses.decompiler.ail_simplifier.HasCallNotification
Bases: Exception
Notifies the existence of a call statement.
exception angr.analyses.decompiler.ail_simplifier.HasVVarNotification
Bases: Exception
Notifies the existence of a VirtualVariable.
class angr.analyses.decompiler.ail_simplifier.AILBlockTempCollector(**kwargs)
Bases: AILBlockWalker
Collects any temporaries used in a block.
__init__(**kwargs)
class angr.analyses.decompiler.ail_simplifier.AILSimplifier(func, func_graph=None,remove_dead_memdefs=False,
stack_arg_offsets=None,
unify_variables=False,
ail_manager=None, gp=None,
narrow_expressions=False,
only_consts=False,
fold_callexprs_into_conditions=False,
use_callee_saved_regs_at_return=True,
rewrite_ccalls=True,
removed_vvar_ids=None,
arg_vvars=None)
Bases: Analysis
Perform function-level simplifications.
Parameters• stack_arg_offsets (set[tuple[int, int]] | None)
948

Chapter 10. API Referenceangr• ail_manager (Manager | None)• gp (int | None)• removed_vvar_ids (set[int] | None)• arg_vvars (dict[int, tuple[VirtualVariable, SimVariable]] | None)__init__(func, func_graph=None, remove_dead_memdefs=False, stack_arg_offsets=None,
unify_variables=False, ail_manager=None, gp=None, narrow_expressions=False,
only_consts=False, fold_callexprs_into_conditions=False,
use_callee_saved_regs_at_return=True, rewrite_ccalls=True, removed_vvar_ids=None,
arg_vvars=None)
Parameters• stack_arg_offsets (set[tuple[int, int]] | None)• ail_manager (Manager | None)• gp (int | None)• removed_vvar_ids (set[int] | None)• arg_vvars (dict[int, tuple[VirtualVariable, SimVariable]] | None)
exception angr.analyses.decompiler.ailgraph_walker.RemoveNodeNoticeBases: Exception
class angr.analyses.decompiler.ailgraph_walker.AILGraphWalker(graph, handler,
replace_nodes=False)
Bases: object
Walks an AIL graph and optionally replaces each node with a new node.
Parameters
replace_nodes (bool)__init__(graph, handler, replace_nodes=False)
Parameters
replace_nodes (bool)walk()
class angr.analyses.decompiler.block_simplifier.HasCallExprWalker
Bases: AILBlockWalkerBase
Test if an expression contains a call expression inside.
__init__()class angr.analyses.decompiler.block_simplifier.BlockSimplifier(block, func_addr=None,remove_dead_memdefs=False,
stack_pointer_tracker=None,
peephole_optimizations=None,
cached_reaching_definitions=None,
cached_propagator=None)
Bases: Analysis
Simplify an AIL block.
Parameters10.15. Analysis

949

angr

• block (Block | None)• func_addr (int | None)• peephole_optimizations (None | Iterable[type[PeepholeOptimizationStmtBase]| type[PeepholeOptimizationExprBase]])__init__(block, func_addr=None, remove_dead_memdefs=False, stack_pointer_tracker=None,
peephole_optimizations=None, cached_reaching_definitions=None, cached_propagator=None)
Parameters• block (Block | None) – The AIL block to simplify. Setting it to None to skip calling
self._analyze(), which is useful in test cases.
• func_addr (int | None)• peephole_optimizations (None | Iterable[type[PeepholeOptimizationStmtBase]| type[PeepholeOptimizationExprBase]])class angr.analyses.decompiler.callsite_maker.CallSiteMaker(block, reaching_definitions=None,
stack_pointer_tracker=None,
ail_manager=None)
Bases: Analysis
Add calling convention, declaration, and args to a call site.
__init__(block, reaching_definitions=None, stack_pointer_tracker=None, ail_manager=None)class angr.analyses.decompiler.ccall_rewriters.rewriter_base.CCallRewriterBase(ccall, arch)
Bases: object
The base class for CCall rewriters.
Parameters
ccall (ailment.Expr.VEXCCallExpression)__init__(ccall, arch)
Parameters
ccall (VEXCCallExpression)arch
result:Expression | Noneclass angr.analyses.decompiler.ccall_rewriters.amd64_ccalls.AMD64CCallRewriter(ccall, arch)
Bases: CCallRewriterBase
Implements ccall rewriter for AMD64.
Parameters
ccall (ailment.Expr.VEXCCallExpression)class angr.analyses.decompiler.clinic.BlockCache(rd, prop)
Bases: tuple
prop
Alias for field number 1rdAlias for field number 0

950

Chapter 10. API Referenceangrclass angr.analyses.decompiler.clinic.ClinicMode(value)
Bases: Enum
Analysis mode for Clinic.
DECOMPILE = 1
COLLECT_DATA_REFS = 2
class angr.analyses.decompiler.clinic.DataRefDesc(data_addr, data_size, block_addr, stmt_idx,
ins_addr, data_type_str)
Bases: object
The fields of this class is compatible with items inside IRSB.data_refs.
Parameters• data_addr (int)• data_size (int)• block_addr (int)• stmt_idx (int)• ins_addr (int)• data_type_str (str)
data_addr:

int

data_size:

int

block_addr:

int

stmt_idx:

int

ins_addr:

int

data_type_str:

str__init__(data_addr, data_size, block_addr, stmt_idx, ins_addr, data_type_str)
Parameters• data_addr (int)• data_size (int)• block_addr (int)• stmt_idx (int)• ins_addr (int)• data_type_str (str)
Return type
None

10.15. Analysis

951

angr

class angr.analyses.decompiler.clinic.Clinic(func, remove_dead_memdefs=False,
exception_edges=False, sp_tracker_track_memory=True,
fold_callexprs_into_conditions=False,
insert_labels=True, optimization_passes=None,
cfg=None, peephole_optimizations=None,
must_struct=None, variable_kb=None,
reset_variable_names=False,
rewrite_ites_to_diamonds=True, cache=None,
mode=ClinicMode.DECOMPILE, sp_shift=0,
inline_functions=frozenset({}), inlined_counts=None,
inlining_parents=None, vvar_id_start=0)
Bases: Analysis
A Clinic deals with AILments.
Parameters• peephole_optimizations (None | Iterable[type[PeepholeOptimizationStmtBase]| type[PeepholeOptimizationExprBase]])• must_struct (set[str] | None)• cache (DecompilationCache | None)• mode (ClinicMode)• sp_shift (int)• inline_functions (set[Function] | None)• inlined_counts (dict[int, int] | None)• inlining_parents (set[int] | None)• vvar_id_start (int)__init__(func, remove_dead_memdefs=False, exception_edges=False, sp_tracker_track_memory=True,
fold_callexprs_into_conditions=False, insert_labels=True, optimization_passes=None, cfg=None,
peephole_optimizations=None, must_struct=None, variable_kb=None,
reset_variable_names=False, rewrite_ites_to_diamonds=True, cache=None,
mode=ClinicMode.DECOMPILE, sp_shift=0, inline_functions=frozenset({}),
inlined_counts=None, inlining_parents=None, vvar_id_start=0)
Parameters• peephole_optimizations (None | Iterable[type[PeepholeOptimizationStmtBase]| type[PeepholeOptimizationExprBase]])• must_struct (set[str] | None)• cache (DecompilationCache | None)• mode (ClinicMode)• sp_shift (int)• inline_functions (set[Function] | None)• inlined_counts (dict[int, int] | None)• inlining_parents (set[int] | None)• vvar_id_start (int)952

Chapter 10. API Referenceangrblock(addr, size)
Get the converted block at the given specific address with the given size.
Parameters• addr (int)• size (int)
Returnsdbg_repr()
Returns
calculate_stack_depth()
copy_graph(graph=None)
Return type
DiGraphparse_variable_addr(addr)
Return typetuple[Any, Any] | None
Parametersaddr (Expression)
new_block_addr()
Return a block address that does not conflict with any existing blocks.
Return type
int
Returns
The block address.
static remove_empty_nodes(graph)
Return type
DiGraphParametersgraph (DiGraph )class angr.analyses.decompiler.condition_processor.ConditionProcessor(arch, condition_mapping=None)
Bases: object
Convert between claripy AST and AIL expressions. Also calculates reaching conditions of all nodes on a graph.
__init__(arch, condition_mapping=None)
clear()
recover_edge_condition(graph, src, dst)
Parametersgraph (DiGraph )10.15. Analysis

953

angr

recover_edge_conditions(region, graph=None)
Return type
dict
recover_reaching_conditions(region, graph=None, with_successors=False,
case_entry_to_switch_head=None, simplify_conditions=True)
Recover the reaching conditions for each block in an acyclic graph. Note that we assume the graph that’s
passed in is acyclic.
Parameters• case_entry_to_switch_head (dict[int, int] | None)• simplify_conditions (bool)
remove_claripy_bool_asts(node, memo=None)classmethod get_last_statement(block)This is the buggy version of get_last_statements, because, you know, there can always be more than
one last statement due to the existence of branching statements (like, If-then-else). All methods using
get_last_statement() should switch to get_last_statements() and properly handle multiple last statements.
classmethod get_last_statements(block)
Return type
list[Statement | None]
EXC_COUNTER = 1000
convert_claripy_bool_ast(cond, memo=None)
Convert recovered reaching conditions from claripy ASTs to ailment Expressions
ReturnsNoneconvert_claripy_bool_ast_core(cond, memo)
claripy_ast_from_ail_condition(condition, nobool=False)
Return type
Bool
Parameters
nobool (bool)
static claripy_ast_to_sympy_expr(ast, memo=None)
static sympy_expr_to_claripy_ast(expr, memo)
Parameters
memo (dict)static simplify_condition(cond, depth_limit=8, variables_limit=8)
static simplify_condition_deprecated(cond)create_jump_target_var(jumptable_head_addr)
Parameters
jumptable_head_addr (int)954

Chapter 10. API Referenceangrclass angr.analyses.decompiler.decompilation_options.DecompilationOption(name, description,
value_type, cls,
param,
value_range=None,
category='General',default_value=None,
clears_cache=True,
candidate_values=None,convert=None)
Bases: object
Describes a decompilation option.
Parameters• candidate_values (list | None)• convert (Callable | None)__init__(name, description, value_type, cls, param, value_range=None, category='General',default_value=None, clears_cache=True, candidate_values=None, convert=None)
Parameters• candidate_values (list | None)• convert (Callable | None)angr.analyses.decompiler.decompilation_options.O
alias of DecompilationOption
angr.analyses.decompiler.decompilation_options.get_structurer_option()
Return type
DecompilationOption | Noneclass angr.analyses.decompiler.decompilation_cache.DecompilationCache(addr)
Bases: object
Caches key data structures that can be used later for refining decompilation results, such as retyping variables.
__init__(addr)
addr
type_constraints:

set | Nonefunc_typevar
var_to_typevar:

dict | None

codegen:BaseStructuredCodeGenerator | None

clinic:Clinic | None

ite_exprs:

set[tuple[int, Any]] | None

binop_operators:

dict[OpDescriptor, str] | None

property local_types

10.15. Analysis

955

angr

class angr.analyses.decompiler.decompiler.Decompiler(func, cfg=None, options=None, preset=None,
optimization_passes=None,
sp_tracker_track_memory=True,
variable_kb=None,
peephole_optimizations=None,vars_must_struct=None, flavor='pseudocode',
expr_comments=None, stmt_comments=None,
ite_exprs=None, binop_operators=None,decompile=True, regen_clinic=True,
inline_functions=frozenset({}),
update_memory_data=True,
generate_code=True)
Bases: Analysis
The decompiler analysis.
Run this on a Function object for which a normalized CFG has been constructed. The fully processed output canbe found in result.codegen.text
Parameters• func (Function | str | int)
• cfg (CFGFast | CFGModel | None)• preset (str | DecompilationPreset | None)• peephole_optimizations (_PEEPHOLE_OPTIMIZATIONS_TYPE)• vars_must_struct (set[str] | None)• update_memory_data (bool)• generate_code (bool)__init__(func, cfg=None, options=None, preset=None, optimization_passes=None,
sp_tracker_track_memory=True, variable_kb=None, peephole_optimizations=None,vars_must_struct=None, flavor='pseudocode', expr_comments=None, stmt_comments=None,
ite_exprs=None, binop_operators=None, decompile=True, regen_clinic=True,
inline_functions=frozenset({}), update_memory_data=True, generate_code=True)
Parameters• func (Function | str | int)
• cfg (CFGFast | CFGModel | None)• preset (str | DecompilationPreset | None)• peephole_optimizations (Iterable[type[PeepholeOptimizationStmtBase] |type[PeepholeOptimizationExprBase]] | None)• vars_must_struct (set[str] | None)• update_memory_data (bool)• generate_code (bool)
reflow_variable_types(type_constraints, func_typevar, var_to_typevar, codegen)Re-run type inference on an existing variable recovery result, then rerun codegen to generate new results.
Returns
Parameters
956

Chapter 10. API Referenceangr• type_constraints (set)• var_to_typevar (dict)find_data_references_and_update_memory_data(seq_node)Parameters
seq_node (SequenceNode)static options_to_params(options)
Convert decompilation options to a dict of params.
Parameters
options (list[tuple[DecompilationOption, Any]]) – The decompilation options.
Return type
dict[str, Any]
Returns
A dict of keyword arguments.
class angr.analyses.decompiler.empty_node_remover.EmptyNodeRemover(node, claripy_ast_conditions=True)
Bases: object
Rewrites a node and its children to remove empty nodes.
The following optimizations are performed at the same time: - Convert if (A) { } else { . . . } to if(!A) { . . . }else { }Variables_claripy_ast_conditions – True if all node conditions are claripy ASTs. False if all nodeconditions are AIL expressions.
Parameters
claripy_ast_conditions (bool)__init__(node, claripy_ast_conditions=True)
Parameters
claripy_ast_conditions (bool)class angr.analyses.decompiler.expression_narrower.ExprNarrowingInfo(narrowable,
to_size=None,
use_exprs=None,
phi_vars=None)
Bases: object
Stores the analysis result of _narrowing_needed().
Parameters• narrowable (bool)• to_size (int | None)• use_exprs (list[tuple[atoms.VirtualVariable, CodeLocation, tuple[str,tuple[Expression, ...]]]] | None)• phi_vars (set[atoms.VirtualVariable] | None)

10.15. Analysis

957

angr

__init__(narrowable, to_size=None, use_exprs=None, phi_vars=None)
Parameters• narrowable (bool)• to_size (int | None)• use_exprs(list[tuple[VirtualVariable, CodeLocation, tuple[str,tuple[Expression, ...]]]] | None)• phi_vars (set[VirtualVariable] | None)
narrowable
to_size
use_exprs
phi_varsclass angr.analyses.decompiler.expression_narrower.NarrowingInfoExtractor(target_expr)
Bases: AILBlockWalkerBase
Walks a statement or an expression and extracts the operations that are applied on the given expression.
For example, for target expression rax, (rax & 0xff) + 0x1 means the following operations are applied on rax: rax& 0xff (rax & 0xff) + 0x1
The previous expression is always used in the succeeding expression.
Parameters
target_expr (Expression)__init__(target_expr)
Parameters
target_expr (Expression)class angr.analyses.decompiler.expression_narrower.ExpressionNarrower(project, rd, narrowables,
addr2blocks,
new_blocks)
Bases: AILBlockWalker
Narrows an expression regardless of whether the expression is a definition or a use.
Parameters• addr2blocks (dict[tuple[int, int | None], Block])• new_blocks (dict[Block, Block])__init__(project, rd, narrowables, addr2blocks, new_blocks)
Parameters• addr2blocks (dict[tuple[int, int | None], Block])• new_blocks (dict[Block, Block])walk(block)
Walk the block and rebuild it if necessary. The block will be rebuilt in-place (by updating statements in theoriginal block when self._update_block is set to True), or a new block will be created and returned.

958

Chapter 10. API ReferenceangrParameters
block (Block) – The block to walk.
Returns
The new block that is rebuilt, or None if the block is not changed or when self._update_blockis set to True.
class angr.analyses.decompiler.graph_region.GraphRegion(head, graph, successors,graph_with_successors, cyclic, full_graph,cyclic_ancestor=False)
Bases: object
GraphRegion represents a region of nodes.
Variables• head – The head of the region.
• graph – The region graph.
• successors – A set of successors of nodes in the graph. These successors do not belong to
the current region.
• graph_with_successors – The region graph that includes successor nodes.
Parameters• successors (set | None)• graph_with_successors (networkx.DiGraph | None)• full_graph (networkx.DiGraph | None)• cyclic_ancestor (bool)__init__(head, graph, successors, graph_with_successors, cyclic, full_graph, cyclic_ancestor=False)
Parameters• successors (set | None)• graph_with_successors (DiGraph | None)• full_graph (DiGraph | None)• cyclic_ancestor (bool)
head
graph
successors
graph_with_successors
full_graphcycliccyclic_ancestor
copy()
Return type
GraphRegion

10.15. Analysis

959

angr

recursive_copy(nodes_map=None)
property addr
static dbg_get_repr(obj, ident=0)
dbg_print(ident=0)
replace_region(sub_region, updated_sub_region, replace_with, virtualized_edges)
Parameters• sub_region (GraphRegion)• updated_sub_region (GraphRegion)• virtualized_edges (set[tuple[Any, Any]])
replace_region_with_region(sub_region, replace_with)Parameters• sub_region (GraphRegion)• replace_with (GraphRegion)
class angr.analyses.decompiler.jump_target_collector.JumpTargetCollector(node)
Bases: object
Collect all jump targets.
__init__(node)class angr.analyses.decompiler.jumptable_entry_condition_rewriter.JumpTableEntryConditionRewriter(jumpta
Bases: SequenceWalker
Remove artificial jump table entry conditions that ConditionProcessor introduced when dealing with jump tables.
__init__(jumptable_entry_conds)
class angr.analyses.decompiler.optimization_passes.OptimizationPassStage(value)
Bases: Enum
Enums about optimization pass stages.
Note that the region identification pass (RegionIdentifier) may modify existing AIL blocks without updating the
topology of the original AIL graph. For example, loop successor refinement may modify create a new AIL blockwith an artificial address, and alter existing jump targets of jump statements and conditional jump statements topoint to this new block. However, loop successor refinement does not update the topology of the original AIL
graph, which means this new AIL block does not exist in the original AIL graph. As a result, until this behavior
of RegionIdentifier changes in the future, DURING_REGION_IDENTIFICATION optimization passes should
not modify existing jump targets.
AFTER_AIL_GRAPH_CREATION = 0
BEFORE_SSA_LEVEL0_TRANSFORMATION = 1
AFTER_SINGLE_BLOCK_SIMPLIFICATION = 2
AFTER_MAKING_CALLSITES = 3

960

Chapter 10. API Referenceangr

AFTER_GLOBAL_SIMPLIFICATION = 4
AFTER_VARIABLE_RECOVERY = 5
BEFORE_REGION_IDENTIFICATION = 6
DURING_REGION_IDENTIFICATION = 7
AFTER_STRUCTURING = 8
class angr.analyses.decompiler.optimization_passes.StackCanarySimplifier(func, **kwargs)
Bases: OptimizationPass
Removes stack canary checks from decompilation results.
ARCHES = ['X86', 'AMD64']
PLATFORMS = ['cgc', 'linux']
STAGE: int = 4
NAME = 'Simplify stack canaries'
DESCRIPTION = 'Removes stack canary checks from decompilation results.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.BasePointerSaveSimplifier(func,**kwargs)
Bases: OptimizationPass
Removes the effects of base pointer stack storage at function invocation and restoring at function return.
ARCHES = ['X86', 'AMD64', 'ARMEL', 'ARMHF', 'ARMCortexM', 'MIPS32', 'MIPS64']
PLATFORMS = ['cgc', 'linux']
STAGE: int = 4
NAME = 'Simplify base pointer saving'
DESCRIPTION = 'Removes the effects of base pointer stack storage at function
invocation and restoring at function return.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.ExprOpSwapper(func, binop_operators=None,**kwargs)
Bases: SequenceOptimizationPass
Swap operands (and the operator accordingly) in a BinOp expression.
Parametersbinop_operators (dict[OpDescriptor, str] | None)
ARCHES = ['X86', 'AMD64', 'ARMEL', 'ARMHF', 'ARMCortexM', 'MIPS32', 'MIPS64']
PLATFORMS = ['windows', 'linux', 'cgc']
STAGE: int = 8

10.15. Analysis

961

angr

NAME = 'Swap operands of expressions as requested'
DESCRIPTION = 'Swap operands (and the operator accordingly) in a BinOp expression.'__init__(func, binop_operators=None, **kwargs)
Parametersbinop_operators (dict[OpDescriptor, str] | None)class angr.analyses.decompiler.optimization_passes.ITERegionConverter(func, max_updates=10,**kwargs)
Bases: OptimizationPass
Transform regions of the form if (c) {x = a} else {x = b} into x = c ? a : b.
ARCHES = ['X86', 'AMD64', 'ARMEL', 'ARMHF', 'ARMCortexM', 'MIPS32', 'MIPS64']
PLATFORMS = ['windows', 'linux', 'cgc']
STAGE: int = 4
NAME = 'Transform ITE-assignment regions into ternary expression assignments'
DESCRIPTION = 'Transform regions of the form `if (c) {x = a} else {x = b}` into `x =c ? a : b`.'__init__(func, max_updates=10, **kwargs)
class angr.analyses.decompiler.optimization_passes.ITEExprConverter(func, ite_exprs=None,**kwargs)
Bases: OptimizationPass
Transform specific expressions into If-Then-Else expressions, or tertiary expressions in C when given a singleuse expression address. Requires outside analysis to provide the target expressions.
ARCHES = ['X86', 'AMD64', 'ARMEL', 'ARMHF', 'ARMCortexM', 'MIPS32', 'MIPS64']
PLATFORMS = ['windows', 'linux', 'cgc']
STAGE: int = 7
NAME = 'Transform single-use expressions that were assigned to in different If-Elsebranches into ternary expressions'
DESCRIPTION = 'Transform specific expressions into If-Then-Else expressions, or
tertiary expressions in C when\n given a single-use expression address. Requires
outside analysis to provide the target expressions.'__init__(func, ite_exprs=None, **kwargs)
class angr.analyses.decompiler.optimization_passes.LoweredSwitchSimplifier(func,
min_distinct_cases=2,**kwargs)
Bases: StructuringOptimizationPass
This optimization recognizes and reverts switch cases that have been lowered and possibly split into multiple
if-else statements. This optimization, discussed in the USENIX 2024 paper SAILR, aims to undo the compiler
optimization known as “Switch Lowering”, present in both GCC and Clang. An in-depth discussion of thisoptimization can be found in the paper or in our documentation of the optimization: https://github.com/mahaloz/
sailr-eval/issues/14#issue-2232616411
962

Chapter 10. API ReferenceangrNote, this optimization does not occur in MSVC, which uses a different optimization strategy for switch cases.
As a hack for now, we only run this deoptimization on Linux binaries.
PLATFORMS = ['linux']
NAME = 'Convert lowered switch-cases (if-else) to switch-cases'
DESCRIPTION = 'Convert lowered switch-cases (if-else) to switch-cases. Only works
when the Phoenix structuring algorithm is in use.'__init__(func, min_distinct_cases=2, **kwargs)
static restore_graph(node, last_stmt, graph, full_graph)
Parameters• last_stmt (IncompleteSwitchCaseHeadStatement)• graph (DiGraph )• full_graph (DiGraph )static cases_issubset(cases_0, cases_1)
Test if cases_0 is a subset of cases_1.
Return typebool
Parameters• cases_0 (list[Case])• cases_1 (list[Case])class angr.analyses.decompiler.optimization_passes.MultiSimplifier(func, **kwargs)
Bases: OptimizationPass
Implements several different arithmetic optimizations.
ARCHES = ['X86', 'AMD64']
PLATFORMS = ['linux', 'windows']
STAGE: int = 4
NAME = 'Simplify various arithmetic expressions'
DESCRIPTION = 'Implements several different arithmetic optimizations.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.DivSimplifier(func, **kwargs)
Bases: OptimizationPass
Simplifies various division optimizations back to “div”.
ARCHES = ['X86', 'AMD64', 'ARMCortexM', 'ARMHF', 'ARMEL']
PLATFORMS = None
STAGE: int = 4
NAME = 'Simplify arithmetic division'

10.15. Analysis

963

angr

DESCRIPTION = 'Simplifies various division optimizations back to "div".'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.ModSimplifier(func, **kwargs)
Bases: OptimizationPass
Simplifies optimized forms of modulo computation back to “mod”.
ARCHES = ['X86', 'AMD64', 'ARMCortexM', 'ARMHF', 'ARMEL']
PLATFORMS = ['linux', 'windows']
STAGE: int = 4
NAME = 'Simplify optimized mod forms'
DESCRIPTION = 'Simplifies optimized forms of modulo computation back to "mod".'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.ReturnDuplicatorLow(func, node_idx_start=0,
max_opt_iters=4,
max_calls_in_regions=2,
prevent_new_gotos=True,
minimize_copies_for_regions=True,**kwargs)
Bases: StructuringOptimizationPass, ReturnDuplicatorBase
An optimization pass that reverts a subset of Irreducible Statement Condensing (ISC) optimizations, as describedin the USENIX 2024 paper SAILR. This is the heavy/goto version of the ReturnDuplicator optimization pass.
Some compilers, including GCC, Clang, and MSVC, apply various optimizations to reduce the number of statements in code. These optimizations will take equivalent statements, or a subset of them, and replace them witha single copy that is jumped to by gotos – optimizing for space and sometimes speed.
This optimization pass will revert those gotos by re-duplicating the condensed blocks. Since Return statements
are the most common, we use this optimization pass to revert only gotos to return statements. Additionally, we
perform some additional readability fixups, like not re-duplicating returns to shared components.
Parameters• func – The function to optimize.
• node_idx_start (int) – The index to start at when creating new nodes. This is used by
Clinic to ensure that node indices are unique across multiple passes.
• max_opt_iters (int) – The maximum number of optimization iterations to perform.
• max_calls_in_regions (int) – The maximum number of calls that can be in a region.
This is used to prevent duplicating too much code.
• prevent_new_gotos (bool) – If True, this optimization pass will prevent new gotos frombeing created.
• minimize_copies_for_regions (bool) – If True, this optimization pass will minimize
the number of copies by doing only a single copy for connected in_edges that form a region.
ARCHES = None

964

Chapter 10. API Referenceangr

PLATFORMS = None
NAME = 'Duplicate returns connect with gotos (low)'
DESCRIPTION = 'An optimization pass that reverts a subset of Irreducible Statement
Condensing (ISC) optimizations, as described\nin the USENIX 2024 paper SAILR. Thisis the heavy/goto version of the ReturnDuplicator optimization pass.\n\nSome
compilers, including GCC, Clang, and MSVC, apply various optimizations to reduce thenumber of statements in\ncode. These optimizations will take equivalent statements,
or a subset of them, and replace them with a single\ncopy that is jumped to by gotos-- optimizing for space and sometimes speed.\n\nThis optimization pass will revert
those gotos by re-duplicating the condensed blocks. Since Return statements\nare themost common, we use this optimization pass to revert only gotos to returnstatements. Additionally, we\nperform some additional readability fixups, like not
re-duplicating returns to shared components.'__init__(func, node_idx_start=0, max_opt_iters=4, max_calls_in_regions=2, prevent_new_gotos=True,
minimize_copies_for_regions=True, **kwargs)
Parameters• node_idx_start (int)• max_opt_iters (int)• max_calls_in_regions (int)• prevent_new_gotos (bool)• minimize_copies_for_regions (bool)class angr.analyses.decompiler.optimization_passes.ReturnDuplicatorHigh(func,
node_idx_start=0,
max_calls_in_regions=2,
minimize_copies_for_regions=True,**kwargs)
Bases: OptimizationPass, ReturnDuplicatorBase
This is a light-level goto-less version of the ReturnDuplicator optimization pass. It will only duplicate return-only
blocks.
Parameters• node_idx_start (int)• max_calls_in_regions (int)• minimize_copies_for_regions (bool)
ARCHES = None
PLATFORMS = None
STAGE: int = 5
NAME = 'Duplicate return-only blocks (high)'
DESCRIPTION = '\n This is a light-level goto-less version of the ReturnDuplicator
optimization pass. It will only\n duplicate return-only blocks.\n '10.15. Analysis

965

angr

STRUCTURING: str | None = ['sailr', 'dream']__init__(func, node_idx_start=0, max_calls_in_regions=2, minimize_copies_for_regions=True, **kwargs)
Parameters• node_idx_start (int)• max_calls_in_regions (int)• minimize_copies_for_regions (bool)class angr.analyses.decompiler.optimization_passes.ConstantDereferencesSimplifier(func,**kwargs)
Bases: OptimizationPass
Makes the following simplifications:*(*(const_addr))==>*(value) iff*const_addr == value

ARCHES = None
PLATFORMS = None
STAGE: int = 2
NAME = 'Simplify constant dereferences'
DESCRIPTION = 'Makes the following simplifications::\n\n *(*(const_addr)) ==>*(value) iff *const_addr == value'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.RegisterSaveAreaSimplifier(func,**kwargs)
Bases: OptimizationPass
Optimizes away register spilling effects, including callee-saved registers.
This optimization runs between SSA-level0 and SSA-level1, which means registers are converted to vvars but
stack accesses stay unchanged.
ARCHES = None
PLATFORMS = None
STAGE: int = 2
NAME = 'Simplify register save areas'
DESCRIPTION = 'Optimizes away register spilling effects, including callee-saved
registers.\n\n This optimization runs between SSA-level0 and SSA-level1, which means
registers are converted to vvars but stack\n accesses stay unchanged.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.RetAddrSaveSimplifier(func, **kwargs)
Bases: OptimizationPass
Removes code in function prologues and epilogues for saving and restoring return address registers (ra, lr, etc.),
generally seen in non-leaf functions.

966

Chapter 10. API Reference

angr

ARCHES = ['MIPS32', 'MIPS64']
PLATFORMS = ['linux']
STAGE: int = 4
NAME = 'Simplify return address storage'
DESCRIPTION = 'Removes code in function prologues and epilogues for saving andrestoring return address registers (ra, lr, etc.),\n generally seen in non-leaf
functions.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.X86GccGetPcSimplifier(func, **kwargs)
Bases: OptimizationPass
Simplifies __x86.get_pc_thunk calls.
ARCHES = ['X86']
PLATFORMS = ['linux']
STAGE: int = 1
NAME = 'Simplify getpc()'
DESCRIPTION = 'Simplifies __x86.get_pc_thunk calls.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.FlipBooleanCmp(func, flip_size=10, **kwargs)
Bases: SequenceOptimizationPass
In the scenario in which a false node has no apparent successors, flip the condition on that if-stmt. This is only
useful when StructuredCodeGenerator has simplify_else_scopes enabled, as this will allow the flipped if-stmt toremove the redundant else.
ARCHES = None
PLATFORMS = None
STAGE: int = 8
NAME = 'Flip small ret booleans'
DESCRIPTION = 'When false node has no successors, flip condition so else scope canbe simplified later'__init__(func, flip_size=10, **kwargs)
class angr.analyses.decompiler.optimization_passes.ReturnDeduplicator(func, **kwargs)
Bases: OptimizationPass
Transforms: - if (cond) { . . . return x; } return x;
into: - if (cond) { . . . } return x;
TODO: its possible that this can be expanded to all rets that are equivalent. Testing needed.
ARCHES = ['X86', 'AMD64', 'ARMEL', 'ARMHF', 'ARMCortexM', 'MIPS32', 'MIPS64']

10.15. Analysis

967

angr

PLATFORMS = ['windows', 'linux', 'cgc']
STAGE: int = 7
NAME = 'Deduplicates return statements that may have been duplicated'
DESCRIPTION = 'Transforms:\n - if (cond) { ... return x; } return x;\n\n into:\n if (cond) { ... } return x;\n\n TODO: its possible that this can be expanded to allrets that are equivalent. Testing needed.'
STRUCTURING: str | None = ['sailr', 'dream']__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.WinStackCanarySimplifier(func, **kwargs)
Bases: OptimizationPass
Removes stack canary checks from decompilation results for Windows PE files.
we need to run this pass before performing any full-function simplification. Otherwise the effects of _security_cookie will be propagated.
ARCHES = ['X86', 'AMD64']
PLATFORMS = ['windows']
STAGE: int = 2
NAME = 'Simplify stack canaries in Windows PE files'
DESCRIPTION = 'Removes stack canary checks from decompilation results for Windows PE
files.\n\n we need to run this pass before performing any full-function
simplification. Otherwise the effects of\n _security_cookie will be propagated.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.CrossJumpReverter(func, node_idx_start=0,
max_opt_iters=3,
max_call_duplications=1,**kwargs)
Bases: StructuringOptimizationPass
This is an implementation to revert the compiler optimization Cross Jumping, and ISC optimization discussed
in the USENIX 2024 paper SAILR. This optimization is somewhat aggressive and as such should be run last in
your decompiler deoptimization chain. This deoptimization will take any goto it finds and attempt to duplicate
its target block if its target only has one outgoing edge.
There are some heuristics in place to prevent duplication everywhere. First, this deoptimization will only run a
max of max_opt_iters times. Second, it will not duplicate a block with too many calls.
Parameters• node_idx_start (int)• max_opt_iters (int)• max_call_duplications (int)
STAGE: int = 7
NAME = 'Duplicate linear blocks with gotos'

968

Chapter 10. API Referenceangr

DESCRIPTION = 'This is an implementation to revert the compiler optimization Cross
Jumping, and ISC optimization discussed\nin the USENIX 2024 paper SAILR. This
optimization is somewhat aggressive and as such should be run last in
your\ndecompiler deoptimization chain. This deoptimization will take any goto it
finds and attempt to duplicate its\ntarget block if its target only has one outgoingedge.\n\nThere are some heuristics in place to prevent duplication everywhere.
First, this deoptimization will only run\na max of max_opt_iters times. Second, it
will not duplicate a block with too many calls.'__init__(func, node_idx_start=0, max_opt_iters=3, max_call_duplications=1, **kwargs)
Parameters• node_idx_start (int)• max_opt_iters (int)• max_call_duplications (int)class angr.analyses.decompiler.optimization_passes.CodeMotionOptimization(func, *args,
max_iters=10,
node_idx_start=0,**kwargs)
Bases: OptimizationPass
Moves common statements out of blocks that share the same predecessors or the same successors. This is done
to reduce the number of statements in a block and to make the blocks more similar to each other.
As an example: if (x) {b = 2; a = 1; c = 3;
} else {b = 2; c = 3;}
Will be turned into: if (x) {a = 1;} b = 2; c = 3;Current limitations (for very conservative operations): - moving statements above conditional jumps is not supported - only immediate children and parents are considered for moving statements - when moving statements
down, a block is only considered if already has a matching statement at the end
Parameters
node_idx_start (int)
ARCHES = None
PLATFORMS = None
NAME = 'Merge common statements in sub-scopes'
STAGE: int = 4

10.15. Analysis

969

angr

DESCRIPTION = '\n Moves common statements out of blocks that share the same
predecessors or the same\n successors. This is done to reduce the number ofstatements in a block and to make the\n blocks more similar to each other.\n\n As an
example:\n if (x) {\n b = 2;\n a = 1;\n c = 3;\n } else {\n b = 2;\n c = 3;\n }\n\nWill be turned into:\n if (x) {\n a = 1;\n }\n b = 2;\n c = 3;\n\n Current
limitations (for very conservative operations):\n - moving statements above
conditional jumps is not supported\n - only immediate children and parents are
considered for moving statements\n - when moving statements down, a block is only
considered if already has a matching statement at the end\n '__init__(func, *args, max_iters=10, node_idx_start=0, **kwargs)
Parameters
node_idx_start (int)static update_graph_with_super_edits(original_graph, super_graph, updated_blocks)
This function updates an graph when doing block edits on a supergraph version of that same graph. The
updated blocks must be provided as a dictionary where the keys are original block in the supergraph andthe values are the new blocks that should replace them.
The supergraph MUST be generated using the to_ail_supergraph function, since it stores the original nodes
each super node represents. This is necessary to update the original graph with the new super nodes.
Return typebool
Parameters• original_graph (DiGraph )• super_graph (DiGraph )• updated_blocks (dict[Block, Block])class angr.analyses.decompiler.optimization_passes.SwitchDefaultCaseDuplicator(func,**kwargs)
Bases: OptimizationPass
For each switch-case construct (identified by jump tables), duplicate the default-case node when we detect situations where the default-case node is seemingly reused by edges outside the switch-case construct. This code
reuse is usually caused by compiler code deduplication.
Ideally this pass should be implemented as an ISC optimization reversion.
ARCHES = None
PLATFORMS = None
STAGE: int = 6
NAME = 'Duplicate default-case nodes to undo default-case node reuse caused bycompiler code deduplication'
DESCRIPTION = 'For each switch-case construct (identified by jump tables), duplicate
the default-case node when we detect\n situations where the default-case node isseemingly reused by edges outside the switch-case construct. This code\n reuse isusually caused by compiler code deduplication.\n\n Ideally this pass should be
implemented as an ISC optimization reversion.'__init__(func, **kwargs)

970

Chapter 10. API Referenceangrclass angr.analyses.decompiler.optimization_passes.DeadblockRemover(func, **kwargs)
Bases: OptimizationPass
Removes condition-unreachable blocks from the graph.
ARCHES = None
PLATFORMS = None
STAGE: int = 6
NAME = 'Remove blocks with unsatisfiable conditions'
DESCRIPTION = 'Removes condition-unreachable blocks from the graph.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.InlinedStringTransformationSimplifier(func,**kwargs)
Bases: OptimizationPass
Simplifies inlined string transformation routines.
ARCHES = None
PLATFORMS = None
STAGE: int = 4
NAME = 'Simplify string transformations'
DESCRIPTION = 'Simplify string transformations that are commonly used in obfuscatedfunctions.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.ConstPropOptReverter(func, region_identifier=None,reaching_definitions=None,**kwargs)
Bases: OptimizationPass
This optimization reverts the effects of constant propagation done by the compiler as discussed in the USENIX
2024 paper SAILR. This optimization’s main goal is to enable later optimizations that rely on symbolic variables
to be more effective. This optimization pass will convert two statements with a difference of a const and asymbolic variable into two statements with the symbolic variables.
As an example: x = 75 puts(x) puts(75)will be converted to: x = 75 puts(x) puts(x)ARCHES = None
PLATFORMS = None
STRUCTURING: str | None = ['sailr', 'dream']
STAGE: int = 7

10.15. Analysis

971

angr

NAME = 'Revert Constant Propagation Optimizations'
DESCRIPTION = "This optimization reverts the effects of constant propagation done by
the compiler as discussed in the\n USENIX 2024 paper SAILR. This optimization's main
goal is to enable later optimizations that rely on\n symbolic variables to be more
effective. This optimization pass will convert two statements with a difference of\na const and a symbolic variable into two statements with the symbolic variables.\n\nAs an example:\n x = 75\n puts(x)\n puts(75)\n\n will be converted to:\n x = 75\nputs(x)\n puts(x)"__init__(func, region_identifier=None, reaching_definitions=None, **kwargs)
static find_conflicting_call_args(call0, call1)
Parameters• call0 (Call)• call1 (Call)class angr.analyses.decompiler.optimization_passes.CallStatementRewriter(func, **kwargs)
Bases: OptimizationPass
Rewrite call statements to assignments if needed.
ARCHES = None
PLATFORMS = None
STAGE: int = 3
NAME = 'Unify call statements on demand.'DESCRIPTION = 'Rewrite call statements to assignments if needed.'__init__(func, **kwargs)
class angr.analyses.decompiler.optimization_passes.DuplicationReverter(func,
max_guarding_conditions=4,**kwargs)
Bases: StructuringOptimizationPass
This (de)optimization reverts the effects of many compiler optimizations that cause code duplication in the decompilation. This deoptimization is the implementation of the USENIX 2024 paper SAILR’s ISD doptimization.
As such, the main goal of this optimization is to remove code duplication by merging semantically similar blocks
in the AIL graph.
NAME = 'Revert Statement Duplication Optimizations'
DESCRIPTION = "This (de)optimization reverts the effects of many compiler
optimizations that cause code duplication in\n the decompilation. This
deoptimization is the implementation of the USENIX 2024 paper SAILR's ISD\ndoptimization. As such, the main goal of this optimization is to remove code
duplication by merging\n semantically similar blocks in the AIL graph."__init__(func, max_guarding_conditions=4, **kwargs)

972

Chapter 10. API Referenceangrstatic boolean_operators_in_condition(condition)
TODO: this entire boolean checking semantic we use needs to be removed, see how it is used for other delsneeded we need to replace it with a boolean variable insertion on both branches that lead to the new block
say we have: if (A()) {do_thing();} if (B()) {do_thing():}
We want to translate it to: int should_do_thing = 0; if (A())
should_do_thing = 1;
if (B())
should_do_thing = 1;
if (should_do_thing):
do_thing();
Although longer, this code can be optimized to look like: int should_do_thing = A() || B(); if(should_do_thing)
do_thing();Parameterscondition (Expression)
stmt_can_move_to(stmt, block, new_idx, io_finder=None)maximize_similarity_of_blocks(block1, block2, graph)
This attempts to rearrange the order of statements in block1 and block2 to maximize the similarity between
them. This implementation is a little outdated since CodeMotion optimization was implemented, but itshould be disabled until we have a good SSA implementation.
TODO: reimplement me when we have better SSA
Return typetuple[Block, Block]create_merged_subgraph(blocks, graph, maximize_similarity=False)
Return type
AILMergeGraph
Parametersgraph (DiGraph )similar_conditional_when_single_corrected(block1, block2, graph)
Parameters• block1 (Block)• block2 (Block)• graph (DiGraph )10.15. Analysis

973

angr

collect_conditions_between_nodes(graph, source, sinks, max_depth=15)
Parameters• source (Block)• sinks (list[Block])shared_common_conditional_dom(nodes, graph)
Takes n nodes and returns True only if all the nodes are dominated by the same node, which must be a
ConditionalJump@param nodes: @param graph: @return:Parametersgraph (DiGraph )angr.analyses.decompiler.optimization_passes.get_optimization_passes(arch, platform)
angr.analyses.decompiler.optimization_passes.register_optimization_pass(opt_pass)class angr.analyses.decompiler.optimization_passes.const_derefs.BlockWalker(project)
Bases: AILBlockWalker
Parameters
project (Project)__init__(project)Parameters
project (Project)
walk(block)
Walk the block and rebuild it if necessary. The block will be rebuilt in-place (by updating statements in theoriginal block when self._update_block is set to True), or a new block will be created and returned.
Parameters
block (Block) – The block to walk.
Returns
The new block that is rebuilt, or None if the block is not changed or when self._update_blockis set to True.

class angr.analyses.decompiler.optimization_passes.const_derefs.ConstantDereferencesSimplifier(func,**kwargs)
Bases: OptimizationPass
Makes the following simplifications:*(*(const_addr))==>*(value) iff*const_addr == value

ARCHES = None
PLATFORMS = None
STAGE: int = 2
NAME = 'Simplify constant dereferences'
DESCRIPTION = 'Makes the following simplifications::\n\n *(*(const_addr)) ==>*(value) iff *const_addr == value'

974

Chapter 10. API Referenceangr__init__(func, **kwargs)
entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | None

exception
angr.analyses.decompiler.optimization_passes.optimization_pass.MultipleBlocksException
Bases: Exception
An exception that is raised in _get_block() where multiple blocks satisfy the criteria but only one block wasrequested.
class angr.analyses.decompiler.optimization_passes.optimization_pass.OptimizationPassStage(value)
Bases: Enum
Enums about optimization pass stages.
Note that the region identification pass (RegionIdentifier) may modify existing AIL blocks without updating the
topology of the original AIL graph. For example, loop successor refinement may modify create a new AIL blockwith an artificial address, and alter existing jump targets of jump statements and conditional jump statements topoint to this new block. However, loop successor refinement does not update the topology of the original AIL
graph, which means this new AIL block does not exist in the original AIL graph. As a result, until this behavior
of RegionIdentifier changes in the future, DURING_REGION_IDENTIFICATION optimization passes should
not modify existing jump targets.
AFTER_AIL_GRAPH_CREATION = 0
BEFORE_SSA_LEVEL0_TRANSFORMATION = 1
AFTER_SINGLE_BLOCK_SIMPLIFICATION = 2
AFTER_MAKING_CALLSITES = 3
AFTER_GLOBAL_SIMPLIFICATION = 4
AFTER_VARIABLE_RECOVERY = 5
BEFORE_REGION_IDENTIFICATION = 6
DURING_REGION_IDENTIFICATION = 7
AFTER_STRUCTURING = 8
class angr.analyses.decompiler.optimization_passes.optimization_pass.BaseOptimizationPass(func)
Bases: object
The base class for any optimization pass.
ARCHES = []PLATFORMS = []STAGE: int = None
STRUCTURING: str | None = None
NAME = 'N/A'DESCRIPTION = 'N/A'

10.15. Analysis

975

angr

__init__(func)
property projectproperty kb
analyze()class angr.analyses.decompiler.optimization_passes.optimization_pass.OptimizationPass(func,
blocks_by_addr=None
blocks_by_addr_and_igraph=None,
variable_kb=None,region_identifier=None,reaching_definitions=None,vvar_id_start=None,
entry_node_addr=None,**kwargs)
Bases: BaseOptimizationPass
The base class for any function-level graph optimization pass.
__init__(func, blocks_by_addr=None, blocks_by_addr_and_idx=None, graph=None, variable_kb=None,region_identifier=None, reaching_definitions=None, vvar_id_start=None,
entry_node_addr=None, **kwargs)
property blocks_by_addr:

dict[int, set[Block]]property blocks_by_addr_and_idx:

dict[tuple[int, int | None], Block]new_block_addr()
Return a block address that does not conflict with any existing blocks.
Return type
int
Returns
The block address.
class angr.analyses.decompiler.optimization_passes.optimization_pass.SequenceOptimizationPass(func,
seq=None,**kwargs)
Bases: BaseOptimizationPass
The base class for any sequence node optimization pass.
ARCHES = []PLATFORMS = []STAGE: int = None__init__(func, seq=None, **kwargs)

976

Chapter 10. API Referenceangrclass angr.analyses.decompiler.optimization_passes.optimization_pass.StructuringOptimizationPass(func,
prevent_new
strictly_l
recover_stmust_immax_opt
simplify_ail
require_go
readd_la**kwarg
Bases: OptimizationPass
The base class for any optimization pass that requires structuring. Optimization passes that inherit from thisclass should directly depend on structuring artifacts, such as regions and gotos. Otherwise, they should use
OptimizationPass. This is the heaviest (computation time) optimization pass class.
By default this type of optimization should work: - on any architecture - on any platform - during region identification (to have iterative structuring) - only with the SAILR structuring algorithm
ARCHES = None
PLATFORMS = None
STRUCTURING: str | None = ['sailr']
STAGE: int = 7__init__(func, prevent_new_gotos=True, strictly_less_gotos=False, recover_structure_fails=True,
must_improve_rel_quality=True, max_opt_iters=1, simplify_ail=True, require_gotos=True,
readd_labels=False, **kwargs)
analyze()
Wrapper for _analyze() that verifies the graph is structurable before and after the optimization.
angr.analyses.decompiler.optimization_passes.stack_canary_simplifier.s2u(s, bits)

class angr.analyses.decompiler.optimization_passes.stack_canary_simplifier.StackCanarySimplifier(func,**kwarg
Bases: OptimizationPass
Removes stack canary checks from decompilation results.
ARCHES = ['X86', 'AMD64']
PLATFORMS = ['cgc', 'linux']
STAGE: int = 4
NAME = 'Simplify stack canaries'
DESCRIPTION = 'Removes stack canary checks from decompilation results.'__init__(func, **kwargs)

10.15. Analysis

977

angr

entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | Noneclass angr.analyses.decompiler.optimization_passes.base_ptr_save_simplifier.BasePointerSaveSimplifier(fu**Bases: OptimizationPass
Removes the effects of base pointer stack storage at function invocation and restoring at function return.
ARCHES = ['X86', 'AMD64', 'ARMEL', 'ARMHF', 'ARMCortexM', 'MIPS32', 'MIPS64']
PLATFORMS = ['cgc', 'linux']
STAGE: int = 4
NAME = 'Simplify base pointer saving'
DESCRIPTION = 'Removes the effects of base pointer stack storage at function
invocation and restoring at function return.'__init__(func, **kwargs)
entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | Noneclass angr.analyses.decompiler.optimization_passes.div_simplifier.DivSimplifierAILEngine
Bases: SimplifierAILEngine
An AIL pass for the div simplifierclass angr.analyses.decompiler.optimization_passes.div_simplifier.DivSimplifier(func,**kwargs)
Bases: OptimizationPass
Simplifies various division optimizations back to “div”.
ARCHES = ['X86', 'AMD64', 'ARMCortexM', 'ARMHF', 'ARMEL']
PLATFORMS = None
STAGE: int = 4
NAME = 'Simplify arithmetic division'
DESCRIPTION = 'Simplifies various division optimizations back to "div".'__init__(func, **kwargs)
entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | None

exception
angr.analyses.decompiler.optimization_passes.ite_expr_converter.NodeFoundNotification
Bases: Exception
A notification that the target node has been found.

978

Chapter 10. API Referenceangrclass angr.analyses.decompiler.optimization_passes.ite_expr_converter.BlockLocator(block)Bases: RegionWalker
Recursively locate block in a GraphRegion instance.
It might be reasonable to move this class into its own file.
__init__(block)
walk_node(region, node)class angr.analyses.decompiler.optimization_passes.ite_expr_converter.ExpressionReplacer(block_addr,
target_expr,
callback)
Bases: AILBlockWalker
Replace expressions.
__init__(block_addr, target_expr, callback)class angr.analyses.decompiler.optimization_passes.ite_expr_converter.ITEExprConverter(func,
ite_exprs=None,**kwargs)
Bases: OptimizationPass
Transform specific expressions into If-Then-Else expressions, or tertiary expressions in C when given a singleuse expression address. Requires outside analysis to provide the target expressions.
ARCHES = ['X86', 'AMD64', 'ARMEL', 'ARMHF', 'ARMCortexM', 'MIPS32', 'MIPS64']
PLATFORMS = ['windows', 'linux', 'cgc']
STAGE: int = 7
NAME = 'Transform single-use expressions that were assigned to in different If-Elsebranches into ternary expressions'
DESCRIPTION = 'Transform specific expressions into If-Then-Else expressions, or
tertiary expressions in C when\n given a single-use expression address. Requires
outside analysis to provide the target expressions.'__init__(func, ite_exprs=None, **kwargs)
entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | Noneclass angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.Case(original_node,
node_type,variable_hash,expr,
value,
target,target_idx,
next_addr)

10.15. Analysis

979

angr

Bases: object
Describes a case in a switch-case construct.
Parameters• node_type (str | None)• value (int | str)
• target_idx (int | None)__init__(original_node, node_type, variable_hash, expr, value, target, target_idx, next_addr)
Parameters• node_type (str | None)• value (int | str)
• target_idx (int | None)original_node
node_typevariable_hash
expr
value
targettarget_idx
next_addr
class angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.StableVarExprHasher(expr)
Bases: AILBlockWalkerBase
Obtain a stable hash of an AIL expression with respect to all variables and all operations applied on variables.
Parameters
expr (Expression)__init__(expr)
Parameters
expr (Expression)class angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.LoweredSwitchSimplifier(funmin**kBases: StructuringOptimizationPass
This optimization recognizes and reverts switch cases that have been lowered and possibly split into multiple
if-else statements. This optimization, discussed in the USENIX 2024 paper SAILR, aims to undo the compiler
optimization known as “Switch Lowering”, present in both GCC and Clang. An in-depth discussion of thisoptimization can be found in the paper or in our documentation of the optimization: https://github.com/mahaloz/
sailr-eval/issues/14#issue-2232616411
Note, this optimization does not occur in MSVC, which uses a different optimization strategy for switch cases.
As a hack for now, we only run this deoptimization on Linux binaries.
980

Chapter 10. API Referenceangr

PLATFORMS = ['linux']
NAME = 'Convert lowered switch-cases (if-else) to switch-cases'
DESCRIPTION = 'Convert lowered switch-cases (if-else) to switch-cases. Only works
when the Phoenix structuring algorithm is in use.'__init__(func, min_distinct_cases=2, **kwargs)
static restore_graph(node, last_stmt, graph, full_graph)
Parameters• last_stmt (IncompleteSwitchCaseHeadStatement)• graph (DiGraph )• full_graph (DiGraph )static cases_issubset(cases_0, cases_1)
Test if cases_0 is a subset of cases_1.
Return typebool
Parameters• cases_0 (list[Case])• cases_1 (list[Case])entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | None

class
angr.analyses.decompiler.optimization_passes.multi_simplifier.MultiSimplifierAILEngine
Bases: SimplifierAILEngine
An AIL pass for the multi simplifierclass angr.analyses.decompiler.optimization_passes.multi_simplifier.MultiSimplifier(func,**kwargs)
Bases: OptimizationPass
Implements several different arithmetic optimizations.
ARCHES = ['X86', 'AMD64']
PLATFORMS = ['linux', 'windows']
STAGE: int = 4
NAME = 'Simplify various arithmetic expressions'
DESCRIPTION = 'Implements several different arithmetic optimizations.'__init__(func, **kwargs)
entry_node_addr:
out_graph:10.15. Analysis

tuple[int, int | None]

networkx.DiGraph | None

981

angr

class angr.analyses.decompiler.optimization_passes.mod_simplifier.ModSimplifierAILEngine
Bases: SimplifierAILEngine
class angr.analyses.decompiler.optimization_passes.mod_simplifier.ModSimplifier(func,**kwargs)
Bases: OptimizationPass
Simplifies optimized forms of modulo computation back to “mod”.
ARCHES = ['X86', 'AMD64', 'ARMCortexM', 'ARMHF', 'ARMEL']
PLATFORMS = ['linux', 'windows']
STAGE: int = 4
NAME = 'Simplify optimized mod forms'
DESCRIPTION = 'Simplifies optimized forms of modulo computation back to "mod".'__init__(func, **kwargs)
entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | Noneclass angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILState(arch,variables=None)
Bases: object
The abstract state used in SimplifierAILEngine.
__init__(arch, variables=None)copy()
merge(*others)
store_variable(old, new)Parameters
old (VirtualVariable)
get_variable(old)Parameters
old (VirtualVariable)
remove_variable(old)class angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILEngine
Bases: SimEngineLightAILMixin, SimEngineLight
Essentially implements a peephole optimization engine for AIL statements (because we do not perform memory
or register loads).
__init__()982

Chapter 10. API Referenceangrprocess(state, *args, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)class angr.analyses.decompiler.optimization_passes.expr_op_swapper.OuterWalker(desc)
Bases: SequenceWalker
A sequence walker that finds nodes and invokes expression replacer to replace expressions.
__init__(desc)
class angr.analyses.decompiler.optimization_passes.expr_op_swapper.ExpressionReplacer(block_addr,
target_expr_predicate,callback)
Bases: AILBlockWalker
Replace expressions.
__init__(block_addr, target_expr_predicate, callback)class angr.analyses.decompiler.optimization_passes.expr_op_swapper.OpDescriptor(block_addr,
stmt_idx,
ins_addr,
op)
Bases: object
Describes a specific operator.
Parameters• block_addr (int)• stmt_idx (int)• ins_addr (int)• op (str)__init__(block_addr, stmt_idx, ins_addr, op)
Parameters• block_addr (int)• stmt_idx (int)• ins_addr (int)• op (str)class angr.analyses.decompiler.optimization_passes.expr_op_swapper.ExprOpSwapper(func,
binop_operators=None,**kwargs)
Bases: SequenceOptimizationPass
Swap operands (and the operator accordingly) in a BinOp expression.

10.15. Analysis

983

angr

Parametersbinop_operators (dict[OpDescriptor, str] | None)
ARCHES = ['X86', 'AMD64', 'ARMEL', 'ARMHF', 'ARMCortexM', 'MIPS32', 'MIPS64']
PLATFORMS = ['windows', 'linux', 'cgc']
STAGE: int = 8
NAME = 'Swap operands of expressions as requested'
DESCRIPTION = 'Swap operands (and the operator accordingly) in a BinOp expression.'__init__(func, binop_operators=None, **kwargs)
Parametersbinop_operators (dict[OpDescriptor, str] | None)angr.analyses.decompiler.optimization_passes.register_save_area_simplifier.s2u(s, bits)

class angr.analyses.decompiler.optimization_passes.register_save_area_simplifier.RegisterSaveAreaSimplif
Bases: OptimizationPass
Optimizes away register spilling effects, including callee-saved registers.
This optimization runs between SSA-level0 and SSA-level1, which means registers are converted to vvars but
stack accesses stay unchanged.
ARCHES = None
PLATFORMS = None
STAGE: int = 2
NAME = 'Simplify register save areas'
DESCRIPTION = 'Optimizes away register spilling effects, including callee-saved
registers.\n\n This optimization runs between SSA-level0 and SSA-level1, which means
registers are converted to vvars but stack\n accesses stay unchanged.'__init__(func, **kwargs)
entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | Noneclass angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier.RetAddrSaveSimplifier(func,**kwarBases: OptimizationPass
Removes code in function prologues and epilogues for saving and restoring return address registers (ra, lr, etc.),
generally seen in non-leaf functions.
ARCHES = ['MIPS32', 'MIPS64']
PLATFORMS = ['linux']
STAGE: int = 4
NAME = 'Simplify return address storage'

984

Chapter 10. API Referenceangr

DESCRIPTION = 'Removes code in function prologues and epilogues for saving andrestoring return address registers (ra, lr, etc.),\n generally seen in non-leaf
functions.'__init__(func, **kwargs)
entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | Noneclass angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier.X86GccGetPcSimplifier(func,**kwarBases: OptimizationPass
Simplifies __x86.get_pc_thunk calls.
ARCHES = ['X86']
PLATFORMS = ['linux']
STAGE: int = 1
NAME = 'Simplify getpc()'
DESCRIPTION = 'Simplifies __x86.get_pc_thunk calls.'__init__(func, **kwargs)
entry_node_addr:
out_graph:tuple[int, int | None]

networkx.DiGraph | Noneclass angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationStmtBase(project,kb,
func_addr=None)
Bases: object
The base class for all peephole optimizations that are applied on AIL statements.
Parameters• project (Project | None)• kb (KnowledgeBase | None)• func_addr (int | None)
NAME = 'Peephole Optimization - Statement'
DESCRIPTION = 'Peephole Optimization - Statement'
stmt_classes = None__init__(project, kb, func_addr=None)
Parameters• project (Project | None)• kb (KnowledgeBase | None)• func_addr (int | None)

10.15. Analysis

985

angr

project:kb:

Project | None

KnowledgeBase | Nonefunc_addr:

int | None

optimize(stmt, stmt_idx=None, block=None, **kwargs)
Parameters
stmt_idx (int | None)class angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationMultiStmtBase(project,kb,
func_addr=N
Bases: object
The base class for all peephole optimizations that are applied on multiple AIL statements at once.
Parameters• project (Project | None)• kb (KnowledgeBase | None)• func_addr (int | None)
NAME = 'Peephole Optimization - Multi-statement'
DESCRIPTION = 'Peephole Optimization - Multi-statement'
stmt_classes = None__init__(project, kb, func_addr=None)
Parameters• project (Project | None)• kb (KnowledgeBase | None)• func_addr (int | None)
project:kb:

Project | None

KnowledgeBase | Nonefunc_addr:

int | None

optimize(stmts, stmt_idx=None, block=None, **kwargs)
Parameters• stmts (list[Statement])• stmt_idx (int | None)class angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationExprBase(project,kb,
func_addr=None)
Bases: object
The base class for all peephole optimizations that are applied on AIL expressions.
Parameters

986

Chapter 10. API Referenceangr• project (Project | None)• kb (KnowledgeBase | None)• func_addr (int | None)
NAME = 'Peephole Optimization - Expression'
DESCRIPTION = 'Peephole Optimization - Expression'
expr_classes = None__init__(project, kb, func_addr=None)
Parameters• project (Project | None)• kb (KnowledgeBase | None)• func_addr (int | None)
project:kb:

Project | None

KnowledgeBase | Nonefunc_addr:

int | None

optimize(expr, **kwargs)
static find_definition(ail_expr, stmt_idx, block)
Return type
None
Parameters• ail_expr (Expression)• stmt_idx (int)• block (Block)static is_bool_expr(ail_expr)
class angr.analyses.decompiler.region_identifier.RegionIdentifier(func, cond_proc=None,graph=None,
update_graph=True,largest_successor_tree_outside_loop=True,
force_loop_single_exit=True,
complete_successors=False,
entry_node_addr=None)
Bases: Analysis
Identifies regions within a function graph and creates a recursive GraphRegion object. Note, that the analysis
may modify the graph in-place. If you want to keep the original graph, set the update_graph parameter to False.
Parameters
entry_node_addr (tuple[int, int | None] | None)

10.15. Analysis

987

angr

__init__(func, cond_proc=None, graph=None, update_graph=True,largest_successor_tree_outside_loop=True, force_loop_single_exit=True,
complete_successors=False, entry_node_addr=None)
Parameters
entry_node_addr (tuple[int, int | None] | None)
static slice_graph(graph, node, frontier, include_frontier=False)
Generate a slice of the graph from the head node to the given frontier.
Parameters• graph (networkx.DiGraph ) – The graph to work on.
• node – The starting node in the graph.
• frontier – A list of frontier nodes.
• include_frontier (bool) – Whether the frontier nodes are included in the slice or not.
Returns
A subgraph.
Return typenetworkx.DiGraph
class angr.analyses.decompiler.region_simplifiers.RegionSimplifier(func, region,
variable_kb=None,
simplify_switches=True,
simplify_ifelse=True)
Bases: Analysis
Simplifies a given region.
Parameters• simplify_switches (bool)• simplify_ifelse (bool)__init__(func, region, variable_kb=None, simplify_switches=True, simplify_ifelse=True)
Parameters• simplify_switches (bool)• simplify_ifelse (bool)class angr.analyses.decompiler.region_simplifiers.cascading_cond_transformer.CascadingConditionTransformBases: SequenceWalker
Identifies and transforms if { . . . } else { if { . . . } else { . . . } } to if { . . . } else if { . . . } else if { . . . }.
__init__(node)class angr.analyses.decompiler.region_simplifiers.cascading_ifs.CascadingIfsRemover(node)
Bases: SequenceWalker
Coalesce cascading If constructs. Transforming the following construct:
if (cond_a) {if (cond_b) {true_body(continues on next page)

988

Chapter 10. API Referenceangr(continued from previous page)} else { }} else { }into:if (cond_a and cond_b) {true_body} else { }__init__(node)class angr.analyses.decompiler.region_simplifiers.expr_folding.LocationBase
Bases: object
class angr.analyses.decompiler.region_simplifiers.expr_folding.StatementLocation(block_addr,
block_idx,
stmt_idx)
Bases: LocationBase__init__(block_addr, block_idx, stmt_idx)
block_addr
block_idx
stmt_idx
copy()
class angr.analyses.decompiler.region_simplifiers.expr_folding.ExpressionLocation(block_addr,
block_idx,
stmt_idx,
expr_idx)
Bases: LocationBase__init__(block_addr, block_idx, stmt_idx, expr_idx)
block_addr
block_idx
stmt_idx
expr_idx
statement_location()
Return type
StatementLocation
class angr.analyses.decompiler.region_simplifiers.expr_folding.ConditionLocation(cond_node_addr,
case_idx=None)
Bases: LocationBase
Parameters
case_idx (int | None)

10.15. Analysis

989

angr

__init__(cond_node_addr, case_idx=None)
Parameters
case_idx (int | None)node_addr
case_idx
class angr.analyses.decompiler.region_simplifiers.expr_folding.ConditionalBreakLocation(node_addr)
Bases: LocationBase__init__(node_addr)
node_addr

class angr.analyses.decompiler.region_simplifiers.expr_folding.MultiStatementExpressionAssignmentFinder(
Bases: AILBlockWalker
Process statements in MultiStatementExpression objects and find assignments.
__init__(stmt_handler)class angr.analyses.decompiler.region_simplifiers.expr_folding.ExpressionUseFinder
Bases: AILBlockWalker
Find where each variable is used.
Additionally, determine if the expression being walked has load expressions inside. Such expressions can only
be safely folded if there are no Store statements between the expression defining location and its use sites. For
example, we can only safely fold variable assignments that use Load() when there are no Store()s between theassignment and its use site. Otherwise, the loaded expression may get updated later by a Store() statement.
Here is a real AIL block:
v16 = ((int)v23->field_5) + 1 & 255;
v23->field_5 = ((char)(((int)v23->field_5) + 1 & 255));
v13 = printf("Recieved packet %d for connection with %d\n", v16, a0 & 255);
In this case, folding v16 into the last printf() expression would be incorrect, since v23->field_5 is updated by thesecond statement.
__init__()uses:

defaultdict[SimVariable, set[tuple[Expression, ExpressionLocation | None]]]has_loadclass angr.analyses.decompiler.region_simplifiers.expr_folding.ExpressionCounter(node, variable_manager)
Bases: SequenceWalker
Find all expressions that are assigned once and only used once.
__init__(node, variable_manager)
class angr.analyses.decompiler.region_simplifiers.expr_folding.ExpressionReplacer(assignments,
uses,
variable_manager)
Bases: AILBlockWalker
990

Chapter 10. API ReferenceangrParameters• assignments (dict)• uses (dict)__init__(assignments, uses, variable_manager)
Parameters• assignments (dict)• uses (dict)class angr.analyses.decompiler.region_simplifiers.expr_folding.ExpressionFolder(assignments,
uses, node,variable_manager)
Bases: SequenceWalker
Parameters• assignments (dict)• uses (dict)__init__(assignments, uses, node, variable_manager)
Parameters• assignments (dict)• uses (dict)class angr.analyses.decompiler.region_simplifiers.expr_folding.StoreStatementFinder(node,intervals)
Bases: SequenceWalker
Determine if there are any Store statements between two given statements.
This class overrides _handle_Sequence() and _handle_MultiNode() to ensure they traverse nodes from top tobottom.
Parametersintervals (Iterable[tuple[StatementLocation, LocationBase]])__init__(node, intervals)
Parametersintervals (Iterable[tuple[StatementLocation, LocationBase]])has_store(start, end)
Return typebool
Parameters• start (StatementLocation)• end (StatementLocation)

10.15. Analysis

991

angr

class angr.analyses.decompiler.region_simplifiers.goto.GotoSimplifier(node, function=None,
kb=None)Bases: SequenceWalker
Remove unnecessary Jump statements. This simplifier also has the side effect of detecting Gotos that can’t be
reduced in the structuring and eventual decompilation output. Because of this, when this analysis is run, gotos
in decompilation will be detected and stored in the kb.gotos. See the _handle_irreducible_goto function below.
TODO: Move the recording of Gotos outside this function__init__(node, function=None, kb=None)class angr.analyses.decompiler.region_simplifiers.if_.IfSimplifier(node)
Bases: SequenceWalker
Remove unnecessary jump or conditional jump statements if they jump to the successor right afterwards.
__init__(node)class angr.analyses.decompiler.region_simplifiers.ifelse.IfElseFlattener(node, functions)
Bases: SequenceWalker
Remove unnecessary else branches and make the else node a direct successor of the previous If node if the If
node always returns.
__init__(node, functions)class angr.analyses.decompiler.region_simplifiers.loop.LoopSimplifier(node, functions)
Bases: SequenceWalker
Simplifies loops.
__init__(node, functions)class angr.analyses.decompiler.region_simplifiers.node_address_finder.NodeAddressFinder(node)
Bases: SequenceWalker
Walk the entire node and collect all addresses of nodes.
__init__(node)class angr.analyses.decompiler.region_simplifiers.region_simplifier.RegionSimplifier(func,
region,variable_kb=None,
simplify_switches=True,
simplify_ifelse=True)
Bases: Analysis
Simplifies a given region.
Parameters• simplify_switches (bool)• simplify_ifelse (bool)

992

Chapter 10. API Referenceangr__init__(func, region, variable_kb=None, simplify_switches=True, simplify_ifelse=True)
Parameters• simplify_switches (bool)• simplify_ifelse (bool)class angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.CmpOp(value)
Bases: EnumAll supported comparison operators.
LT = 0GT = 1
EQ = 2
NE = 3class angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.ConditionalRegion(variable,
op,value,
node,
parent=None)
Bases: object
Describes a conditional region.
Parameters• op (CmpOp)• value (int)• node (ConditionNode | ailment.Block)__init__(variable, op, value, node, parent=None)
Parameters• op (CmpOp)• value (int)• node (ConditionNode | Block)variable
op
value
node
parentclass angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.SwitchCaseRegion(variable,
node,parent=None)

10.15. Analysis

993

angr

Bases: object
Describes an already-recovered switch region.
Parametersnode (SwitchCaseNode)__init__(variable, node, parent=None)
Parametersnode (SwitchCaseNode)variablenode
parentclass angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.SwitchClusterFinder(node)
Bases: SequenceWalker
Find comparisons and switches in order to identify switch clusters.
__init__(node)class angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.SwitchClusterReplacer(region,
to_replreplace_w
Bases: SequenceWalker
Replace an identified switch cluster with a newly created SwitchCase node.
__init__(region, to_replace, replace_with)
angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.is_simple_jump_node(node,
case_addrs,
targets=None)
Return typebool
Parameters
targets (set[int] | None)angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.filter_cond_regions(cond_regions,
case_addrs)
Remove all conditional regions that cannot be merged into switch(es).
Return type
list[ConditionalRegion]
Parameters• cond_regions (list[ConditionalRegion])• case_addrs (set[int])

994

Chapter 10. API Referenceangrangr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.update_switch_case_list(cases,
old_case_id
new_case_id
Update cases in-place. Make new_case_id directly jump to old_case_id.
Return type
None
Parameters• cases (list[tuple[int | tuple[int, ...], SequenceNode]])• old_case_id (int | tuple[int, ...])• new_case_id (int)angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.simplify_switch_clusters(region,
var2condno
var2switch
Identify switch clusters and simplify each of them.
Parameters• region – The region to simplify.
• var2condnodes (dict[Any, list[ConditionalRegion]]) – A dict that stores the mapping from (potential) switch variables to conditional regions.
• var2switches (dict[Any, list[SwitchCaseRegion]]) – A dict that stores the mappingfrom switch variables to switch-case regions.
ReturnsNoneangr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.simplify_lowered_switches(region,
var2condn
functions)
Identify a lowered switch and simplify it into a switch-case if possible.
Parameters• region (SequenceNode) – The region to simplify.
• var2condnodes (dict[Any, list[ConditionalRegion]]) – A dict that stores the mapping from (potential) switch variables to conditional regions.
ReturnsNoneangr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.simplify_lowered_switches_core(reg
var
con
fun
tion
Return typebool
Parameters
region (SequenceNode)10.15. Analysis

995

angr

class angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.FindFirstNodeInSet(node_set)
Bases: SequenceWalker
Find the first node out of a set of node appearing in a SequenceNode (and its tree).
Parameters
node_set (set[BaseNode])__init__(node_set)
Parameters
node_set (set[BaseNode])class angr.analyses.decompiler.region_simplifiers.switch_expr_simplifier.SwitchExpressionSimplifier(nodeBases: SequenceWalker
Identifies switch expressions that adds or minuses a constant, removes the constant from the switch expression,and adjust all case expressions accordingly.
__init__(node)class angr.analyses.decompiler.region_walker.RegionWalker
Bases: object
A simple traverser class that walks GraphRegion instances.
__init__()walk(region)
Parameters
region (GraphRegion)
walk_node(region, node)class angr.analyses.decompiler.redundant_label_remover.RedundantLabelRemover(node,
jump_targets)
Bases: object
Remove redundant labels.
This optimization pass contains two separate passes. The first pass (self._walker0) finds all redundant labels(e.g., two or more labels for the same location) and records the replacement label for redundant labels in
self._new_jump_target. The second pass (self._walker1) removes all redundant labels that (a) are not referenced
anywhere (determined by jump_targets), or (b) are deemed replaceable by the first pass.
Parameters
jump_targets (set[tuple[int, int | None]])__init__(node, jump_targets)
Parameters
jump_targets (set[tuple[int, int | None]])class angr.analyses.decompiler.sequence_walker.SequenceWalker(handlers=None,
exception_on_unsupported=False,
update_seqnode_in_place=True,
force_forward_scan=False)
Bases: object
Walks a SequenceNode and all its nodes, recursively.

996

Chapter 10. API ReferenceangrParameters
force_forward_scan (bool)__init__(handlers=None, exception_on_unsupported=False, update_seqnode_in_place=True,
force_forward_scan=False)
Parameters
force_forward_scan (bool)walk(sequence)class angr.analyses.decompiler.structured_codegen.BaseStructuredCodeGenerator(flavor=None)
Bases: object__init__(flavor=None)
reapply_options(options)
regenerate_text()
Return typeNone
reload_variable_types()
Return type
Noneclass angr.analyses.decompiler.structured_codegen.InstructionMapping
Bases: object__init__()items()
add_mapping(ins_addr, posmap_pos)
get_nearest_pos(ins_addr)
Return type
int | None
Parameters
ins_addr (int)class angr.analyses.decompiler.structured_codegen.InstructionMappingElement(ins_addr,
posmap_pos)
Bases: object__init__(ins_addr, posmap_pos)
ins_addr:
posmap_pos:

int
int

class angr.analyses.decompiler.structured_codegen.PositionMappingElement(start, length, obj)
Bases: object__init__(start, length, obj)
start:

int

10.15. Analysis

997

angr

length:int

objclass angr.analyses.decompiler.structured_codegen.PositionMapping
Bases: object
DUPLICATION_CHECK = True__init__()items()
add_mapping(start_pos, length, obj)
get_node(pos)Parameterspos (int)
get_element(pos)Return type
PositionMappingElement | None
Parameterspos (int)class angr.analyses.decompiler.structured_codegen.CStructuredCodeGenerator(func, sequence,indent=0,
cfg=None, variable_kb=None,func_args=None,
binop_depth_cutoff=16,
show_casts=True,
braces_on_own_lines=True,
use_compound_assignments=True,
show_local_types=True,comment_gotos=False,
cstyle_null_cmp=True,
flavor=None,
stmt_comments=None,
expr_comments=None,
show_externs=True,
externs=None,const_formats=None,
show_demangled_name=True,
show_disambiguated_name=True,
ail_graph=None,
simplify_else_scope=True,
cstyle_ifs=True,
omit_func_header=False)
Bases: BaseStructuredCodeGenerator, Analysis
Parameters• func_args (list[SimVariable] | None)
998

Chapter 10. API Referenceangr• binop_depth_cutoff (int)__init__(func, sequence, indent=0, cfg=None, variable_kb=None, func_args=None,
binop_depth_cutoff=16, show_casts=True, braces_on_own_lines=True,
use_compound_assignments=True, show_local_types=True, comment_gotos=False,
cstyle_null_cmp=True, flavor=None, stmt_comments=None, expr_comments=None,
show_externs=True, externs=None, const_formats=None, show_demangled_name=True,
show_disambiguated_name=True, ail_graph=None, simplify_else_scope=True, cstyle_ifs=True,
omit_func_header=False)
Parameters• func_args (list[SimVariable] | None)• binop_depth_cutoff (int)reapply_options(options)cleanup()
Remove existing rendering results.
regenerate_text()
Re-render text and re-generate all sorts of mapping information.
Return type
None
RENDER_TYPE
alias of tuple[str, PositionMapping, PositionMapping, InstructionMapping, dict[Any,set[Any]]]
render_text(cfunc)
Return type
RENDER_TYPE
Parameters
cfunc (CFunction)
reload_variable_types()
Return type
Nonedefault_simtype_from_size(n, signed=True)
Return type
SimTypeParameters• n (int)• signed (bool)class angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker
Bases: object
handle(obj)handle_default(obj)10.15. Analysis

999

angr

handle_CFunction(obj)handle_CStatements(obj)handle_CWhileLoop(obj)handle_CDoWhileLoop(obj)handle_CForLoop(obj)handle_CIfElse(obj)handle_CIfBreak(obj)handle_CSwitchCase(obj)handle_CAssignment(obj)handle_CFunctionCall(obj)handle_CReturn(obj)handle_CGoto(obj)handle_CIndexedVariable(obj)handle_CVariableField(obj)handle_CUnaryOp(obj)handle_CBinaryOp(obj)handle_CTypeCast(obj)handle_CITE(obj)class angr.analyses.decompiler.structured_codegen.ImportSourceCode(function, flavor='source',
source_root=None,
encoding='utf-8')
Bases: BaseStructuredCodeGenerator, Analysis__init__(function, flavor='source', source_root=None, encoding='utf-8')
regenerate_text()
class angr.analyses.decompiler.structured_codegen.DummyStructuredCodeGenerator(flavor,
expr_comments=None,
stmt_comments=None,configuration=None,const_formats=None)
Bases: BaseStructuredCodeGenerator
A dummy structured code generator that only stores user-specified information.
Parameters
flavor (str)

1000

Chapter 10. API Referenceangr__init__(flavor, expr_comments=None, stmt_comments=None, configuration=None, const_formats=None)
Parameters
flavor (str)class angr.analyses.decompiler.structured_codegen.base.PositionMappingElement(start, length,
obj)
Bases: object
Parameters• start (int)• length (int)__init__(start, length, obj)
start:

int

length:int

objclass angr.analyses.decompiler.structured_codegen.base.PositionMapping
Bases: object
DUPLICATION_CHECK = True__init__()items()
add_mapping(start_pos, length, obj)
get_node(pos)Parameterspos (int)
get_element(pos)Return type
PositionMappingElement | None
Parameterspos (int)class angr.analyses.decompiler.structured_codegen.base.InstructionMappingElement(ins_addr,
posmap_pos)
Bases: object
Parameters• ins_addr (int)• posmap_pos (int)__init__(ins_addr, posmap_pos)
ins_addr:
posmap_pos:

int

10.15. Analysis

int

1001

angr

class angr.analyses.decompiler.structured_codegen.base.InstructionMapping
Bases: object__init__()items()
add_mapping(ins_addr, posmap_pos)
get_nearest_pos(ins_addr)
Return type
int | None
Parameters
ins_addr (int)class angr.analyses.decompiler.structured_codegen.base.BaseStructuredCodeGenerator(flavor=None)
Bases: object__init__(flavor=None)
reapply_options(options)
regenerate_text()
Return typeNone
reload_variable_types()
Return type
Noneangr.analyses.decompiler.structured_codegen.c.unpack_typeref(ty)angr.analyses.decompiler.structured_codegen.c.unpack_pointer(ty)Return type
SimType | Noneangr.analyses.decompiler.structured_codegen.c.unpack_array(ty)Return type
SimType | Noneangr.analyses.decompiler.structured_codegen.c.squash_array_reference(ty)angr.analyses.decompiler.structured_codegen.c.qualifies_for_simple_cast(ty1, ty2)
angr.analyses.decompiler.structured_codegen.c.qualifies_for_implicit_cast(ty1, ty2)
angr.analyses.decompiler.structured_codegen.c.extract_terms(expr)
Return typetuple[int, list[tuple[int, CExpression]]]Parameters
expr (CExpression)

1002

Chapter 10. API Referenceangrangr.analyses.decompiler.structured_codegen.c.is_machine_word_size_type(type_, arch)
Return typebool
Parameters• type_ (SimType)• arch (Arch )angr.analyses.decompiler.structured_codegen.c.guess_value_type(value, project)
Return type
SimType | None
Parameters• value (int)• project (Project)angr.analyses.decompiler.structured_codegen.c.type_to_c_repr_chunks(ty, name=None,
name_type=None,full=False, indent_str='')Helper generator function to turn a SimType into generated tuples of (C-string, AST node).
Parametersty (SimType)class angr.analyses.decompiler.structured_codegen.c.CConstruct(codegen)
Bases: object
Represents a program construct in C. Acts as the base class for all other representation constructions.
__init__(codegen)codegen:CStructuredCodeGenerator

c_repr(indent=0, pos_to_node=None, pos_to_addr=None, addr_to_pos=None)
Creates the C representation of the code and displays it by constructing a large string. This function is calledby each program function that needs to be decompiled. The map_pos_to_node and map_pos_to_addr act
as position maps for the location of each variable and statement to be tracked for later GUI operations. The
map_pos_to_addr also contains expressions that are nested inside of statements.
c_repr_chunks(indent=0, asexpr=False)
static indent_str(indent=0)
class angr.analyses.decompiler.structured_codegen.c.CFunction(addr, name, functy, arg_list,
statements, variables_in_use,
variable_manager,
demangled_name=None,
show_demangled_name=True,
omit_header=False, **kwargs)
Bases: CConstruct
Represents a function in C.
Parameters• functy (SimTypeFunction)

10.15. Analysis

1003

angr

• arg_list (list[CVariable])__init__(addr, name, functy, arg_list, statements, variables_in_use, variable_manager,
demangled_name=None, show_demangled_name=True, omit_header=False, **kwargs)
Parameters• functy (SimTypeFunction)• arg_list (list[CVariable])
addr
name
functyarg_liststatements
variables_in_use
variable_manager:

VariableManagerInternal

demangled_nameunified_local_vars:

dict[SimVariable, set[tuple[CVariable, SimType]]]show_demangled_nameomit_header
get_unified_local_vars()
Return type
dict[SimVariable, set[tuple[CVariable, SimType]]]variable_list_repr_chunks(indent=0)
c_repr_chunks(indent=0, asexpr=False)
headerless_c_repr_chunks(indent=0)
full_c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CStatement(codegen)
Bases: CConstruct
Represents a statement in C.
Parameterscodegen (CStructuredCodeGenerator)
class angr.analyses.decompiler.structured_codegen.c.CExpression(collapsed=False, **kwargs)
Bases: CConstruct
Base class for C expressions.
__init__(collapsed=False, **kwargs)
collapsed

1004

Chapter 10. API Referenceangrproperty type
set_type(v)class angr.analyses.decompiler.structured_codegen.c.CStatements(statements, **kwargs)
Bases: CStatement
Represents a sequence of statements in C.
__init__(statements, **kwargs)
statements
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CAILBlock(block, **kwargs)
Bases: CStatement
Represents a block of AIL statements.
__init__(block, **kwargs)
block
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CLoop(codegen)
Bases: CStatement
Represents a loop in C.
Parameterscodegen (CStructuredCodeGenerator)
class angr.analyses.decompiler.structured_codegen.c.CWhileLoop(condition, body, tags=None,**kwargs)
Bases: CLoop
Represents a while loop in C.
__init__(condition, body, tags=None, **kwargs)
conditionbody
tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CDoWhileLoop(condition, body, tags=None,**kwargs)
Bases: CLoop
Represents a do-while loop in C.
__init__(condition, body, tags=None, **kwargs)
conditionbody

10.15. Analysis

1005

angr

tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CForLoop(initializer, condition, iterator, body,tags=None, **kwargs)
Bases: CStatement
Represents a for-loop in C.
__init__(initializer, condition, iterator, body, tags=None, **kwargs)
initializer
condition
iteratorbody
tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CIfElse(condition_and_nodes,
else_node=None,
simplify_else_scope=False,
cstyle_ifs=True, tags=None,**kwargs)
Bases: CStatement
Represents an if-else construct in C.
Parameterscondition_and_nodes (list[tuple[CExpression, CStatement | None]])__init__(condition_and_nodes, else_node=None, simplify_else_scope=False, cstyle_ifs=True, tags=None,**kwargs)
Parameterscondition_and_nodes (list[tuple[CExpression, CStatement | None]])condition_and_nodes
else_node
simplify_else_scope
cstyle_ifs
tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CIfBreak(condition, cstyle_ifs=True,
tags=None, **kwargs)
Bases: CStatement
Represents an if-break statement in C.

1006

Chapter 10. API Referenceangr__init__(condition, cstyle_ifs=True, tags=None, **kwargs)
condition
cstyle_ifs
tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CBreak(tags=None, **kwargs)
Bases: CStatement
Represents a break statement in C.
__init__(tags=None, **kwargs)
tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CContinue(tags=None, **kwargs)
Bases: CStatement
Represents a continue statement in C.
__init__(tags=None, **kwargs)
tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CSwitchCase(switch, cases, default,
tags=None, **kwargs)
Bases: CStatement
Represents a switch-case statement in C.
__init__(switch, cases, default, tags=None, **kwargs)
switchcases:

list[tuple[int | tuple[int], CStatements]]

defaulttags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CAssignment(lhs, rhs, tags=None, **kwargs)
Bases: CStatement
a=b__init__(lhs, rhs, tags=None, **kwargs)
lhs
rhs

10.15. Analysis

1007

angr

tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CFunctionCall(callee_target, callee_func,args, returning=True,
ret_expr=None, tags=None,is_expr=False,
show_demangled_name=True,
show_disambiguated_name=True,**kwargs)
Bases: CStatement, CExpression
func(arg0, arg1)
Variables• callee_func (Function) – The function getting called.
• is_expr – True if the return value of the function is written to ret_expr; Essentially, ret_expr= call().
Parameters• is_expr (bool)• show_disambiguated_name (bool)__init__(callee_target, callee_func, args, returning=True, ret_expr=None, tags=None, is_expr=False,
show_demangled_name=True, show_disambiguated_name=True, **kwargs)
Parameters• is_expr (bool)• show_disambiguated_name (bool)
callee_target
callee_func:

Function | Noneargs
returning
ret_expr
tags
is_exprshow_demangled_nameshow_disambiguated_nameproperty prototype:

SimTypeFunction | None

property type

1008

Chapter 10. API Referenceangrc_repr_chunks(indent=0, asexpr=False)
Parameters• indent – Number of whitespace indentation characters.
• asexpr (bool) – True if this call is used as an expression (which means we will skip thegeneration of semicolons and newlines at the end of the call).
class angr.analyses.decompiler.structured_codegen.c.CReturn(retval, tags=None, **kwargs)
Bases: CStatement__init__(retval, tags=None, **kwargs)
retvaltags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CGoto(target, target_idx, tags=None,**kwargs)
Bases: CStatement__init__(target, target_idx, tags=None, **kwargs)
target:int | CExpression

target_idx
tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CUnsupportedStatement(stmt, **kwargs)
Bases: CStatement
A wrapper for unsupported AIL statement.
__init__(stmt, **kwargs)
stmt
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CDirtyStatement(dirty, **kwargs)
Bases: CExpression__init__(dirty, **kwargs)
dirty
property typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CLabel(name, ins_addr, block_idx, tags=None,**kwargs)
Bases: CStatement
Represents a label in C code.

10.15. Analysis

1009

angr

Parameters• name (str)• ins_addr (int)• block_idx (int | None)__init__(name, ins_addr, block_idx, tags=None, **kwargs)
Parameters• name (str)• ins_addr (int)• block_idx (int | None)nameins_addr
block_idx
tags
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CStructField(struct_type, offset, field,
tags=None, **kwargs)
Bases: CExpression
Parameters
struct_type (SimStruct)__init__(struct_type, offset, field, tags=None, **kwargs)
Parameters
struct_type (SimStruct)
struct_type
offsetfield
tags
property typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CFakeVariable(name, ty, tags=None,**kwargs)
Bases: CExpression
An uninterpreted name to display in the decompilation output. Pretty much always represents an error?
Parameters• name (str)• ty (SimType)

1010

Chapter 10. API Referenceangr__init__(name, ty, tags=None, **kwargs)
Parameters• name (str)• ty (SimType)
name
tags
property typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CVariable(variable, unified_variable=None,
variable_type=None, tags=None,**kwargs)
Bases: CExpression
CVariable represents access to a variable with the specified type (variable_type).
variable must be a SimVariable.
Parameters
variable (SimVariable)__init__(variable, unified_variable=None, variable_type=None, tags=None, **kwargs)
Parameters
variable (SimVariable)variable:

SimVariableunified_variable:variable_type:

SimVariable | None

SimTypetags
property typeproperty namec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CIndexedVariable(variable, index,
variable_type=None,tags=None, **kwargs)
Bases: CExpression
Represent a variable (an array) that is indexed.
Parameters• variable (CExpression)• index (CExpression)

10.15. Analysis

1011

angr

__init__(variable, index, variable_type=None, tags=None, **kwargs)
Parameters• variable (CExpression)• index (CExpression)
property typec_repr_chunks(indent=0, asexpr=False)
collapsedclass angr.analyses.decompiler.structured_codegen.c.CVariableField(variable, field,
var_is_ptr=False,
tags=None, **kwargs)
Bases: CExpression
Represent a field of a variable.
Parameters• variable (CExpression)• field (CStructField)• var_is_ptr (bool)__init__(variable, field, var_is_ptr=False, tags=None, **kwargs)
Parameters• variable (CExpression)• field (CStructField)• var_is_ptr (bool)property typec_repr_chunks(indent=0, asexpr=False)
collapsedclass angr.analyses.decompiler.structured_codegen.c.CUnaryOp(op, operand, tags=None, **kwargs)
Bases: CExpression
Unary operations.
Parameters
operand (CExpression)__init__(op, operand, tags=None, **kwargs)
Parameters
operand (CExpression)op
operandtags

1012

Chapter 10. API Referenceangrproperty typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CBinaryOp(op, lhs, rhs, tags=None, **kwargs)
Bases: CExpression
Binary operations.
Parameters
tags (dict | None)__init__(op, lhs, rhs, tags=None, **kwargs)
Parameters
tags (dict | None)
op
lhs
rhs
tags
common_type
static compute_common_type(op, lhs_ty, rhs_ty)
Return type
SimTypeParameters• op (str)• lhs_ty (SimType)• rhs_ty (SimType)property typeproperty op_precedence
c_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CTypeCast(src_type, dst_type, expr,
tags=None, **kwargs)
Bases: CExpression
Parameters• src_type (SimType | None)• dst_type (SimType)• expr (CExpression)__init__(src_type, dst_type, expr, tags=None, **kwargs)
Parameters• src_type (SimType | None)• dst_type (SimType)10.15. Analysis

1013

angr

• expr (CExpression)
src_type
dst_type
expr
tags
property typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CConstant(value, type_,reference_values=None,tags=None, **kwargs)
Bases: CExpression
Parameters• type_ (SimType)• tags (dict | None)__init__(value, type_, reference_values=None, tags=None, **kwargs)
Parameters• type_ (SimType)• tags (dict | None)
value
reference_values
tags
property fmt
property fmt_hex
property fmt_neg
property fmt_char
property fmt_float
property fmt_double
property typestatic str_to_c_str(_str, prefix='')Parameters
prefix (str)c_repr_chunks(indent=0, asexpr=False)

1014

Chapter 10. API Referenceangr

fmt_int(value)
Format an integer using the format setup of the current node.
Parameters
value (int) – The integer value to format.
Return type
str
Returns
The formatted string.
class angr.analyses.decompiler.structured_codegen.c.CRegister(reg, tags=None, **kwargs)
Bases: CExpression__init__(reg, tags=None, **kwargs)
reg
tags
property typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CITE(cond, iftrue, iffalse, tags=None,**kwargs)
Bases: CExpression__init__(cond, iftrue, iffalse, tags=None, **kwargs)
cond
iftrueiffalsetags
property typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CMultiStatementExpression(stmts, expr,
tags=None,**kwargs)
Bases: CExpression(stmt0, stmt1, stmt2, expr)
Parameters• stmts (CStatements)• expr (CExpression)__init__(stmts, expr, tags=None, **kwargs)
Parameters• stmts (CStatements)• expr (CExpression)

10.15. Analysis

1015

angr

stmts
expr
tags
property typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CDirtyExpression(dirty, **kwargs)
Bases: CExpression
Ideally all dirty expressions should be handled and converted to proper conversions during conversion from VEX
to AIL. Eventually this class should not be used at all.
__init__(dirty, **kwargs)
dirty
property typec_repr_chunks(indent=0, asexpr=False)class angr.analyses.decompiler.structured_codegen.c.CClosingObject(opening_symbol)
Bases: object
A class to represent all objects that can be closed by it’s correspodning character. Examples: (), {}, []__init__(opening_symbol)
opening_symbol
class angr.analyses.decompiler.structured_codegen.c.CArrayTypeLength(text)
Bases: object
A class to represent the type information of fixed-size array lengths. Examples: In “char foo[20]”, this would be
the “[20]”.
__init__(text)
text
class angr.analyses.decompiler.structured_codegen.c.CStructFieldNameDef(name)
Bases: object
A class to represent the name of a defined field in a struct. Needed because it’s not a CVariable or a CStructField(because CStructField is the access of a CStructField). Example: In “struct foo { int bar; }, this would be “bar”.
__init__(name)
name

1016

Chapter 10. API Referenceangrclass angr.analyses.decompiler.structured_codegen.c.CStructuredCodeGenerator(func, sequence,indent=0,
cfg=None, variable_kb=None,func_args=None,
binop_depth_cutoff=16,
show_casts=True,
braces_on_own_lines=True,
use_compound_assignments=True
show_local_types=True,comment_gotos=False,
cstyle_null_cmp=True,
flavor=None,
stmt_comments=None,
expr_comments=None,
show_externs=True,
externs=None,const_formats=None,
show_demangled_name=True,
show_disambiguated_name=True,
ail_graph=None,
simplify_else_scope=True,
cstyle_ifs=True,
omit_func_header=False)
Bases: BaseStructuredCodeGenerator, Analysis
Parameters• func_args (list[SimVariable] | None)• binop_depth_cutoff (int)__init__(func, sequence, indent=0, cfg=None, variable_kb=None, func_args=None,
binop_depth_cutoff=16, show_casts=True, braces_on_own_lines=True,
use_compound_assignments=True, show_local_types=True, comment_gotos=False,
cstyle_null_cmp=True, flavor=None, stmt_comments=None, expr_comments=None,
show_externs=True, externs=None, const_formats=None, show_demangled_name=True,
show_disambiguated_name=True, ail_graph=None, simplify_else_scope=True, cstyle_ifs=True,
omit_func_header=False)
Parameters• func_args (list[SimVariable] | None)• binop_depth_cutoff (int)reapply_options(options)cleanup()
Remove existing rendering results.
regenerate_text()
Re-render text and re-generate all sorts of mapping information.
Return type
None

10.15. Analysis

1017

angr

RENDER_TYPE
alias of tuple[str, PositionMapping, PositionMapping, InstructionMapping, dict[Any,set[Any]]]
render_text(cfunc)
Return type
RENDER_TYPE
Parameters
cfunc (CFunction)
reload_variable_types()
Return type
Nonedefault_simtype_from_size(n, signed=True)
Return type
SimTypeParameters• n (int)• signed (bool)class angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
Bases: object
handle(obj)handle_default(obj)handle_CFunction(obj)handle_CStatements(obj)handle_CWhileLoop(obj)handle_CDoWhileLoop(obj)handle_CForLoop(obj)handle_CIfElse(obj)handle_CIfBreak(obj)handle_CSwitchCase(obj)handle_CAssignment(obj)handle_CFunctionCall(obj)handle_CReturn(obj)handle_CGoto(obj)handle_CIndexedVariable(obj)handle_CVariableField(obj)1018

Chapter 10. API Referenceangrhandle_CUnaryOp(obj)handle_CBinaryOp(obj)handle_CTypeCast(obj)handle_CITE(obj)class angr.analyses.decompiler.structured_codegen.c.MakeTypecastsImplicit
Bases: CStructuredCodeWalker
classmethod collapse(dst_ty, child)
Return type
CExpression
Parameters• dst_ty (SimType)• child (CExpression)
handle_CAssignment(obj)handle_CFunctionCall(obj)Parameters
obj (CFunctionCall)
handle_CReturn(obj)Parameters
obj (CReturn)handle_CBinaryOp(obj)Parameters
obj (CBinaryOp)
handle_CTypeCast(obj)Parameters
obj (CTypeCast)
class angr.analyses.decompiler.structured_codegen.c.FieldReferenceCleanup
Bases: CStructuredCodeWalker
handle_CTypeCast(obj)class angr.analyses.decompiler.structured_codegen.c.PointerArithmeticFixer
Bases: CStructuredCodeWalker
Before calling this fixer class, pointer arithmetics are purely integer-based and ignoring the pointer type.
For example, in the following case:struct A* a_ptr; // assume struct A is 24 bytes in size a_ptr = a_ptr + 24;
It means adding 24 to the address of a_ptr, without considering the size of struct A. This fixer class will makepointer arithmetics aware of the pointer type. In this case, the fixer class will convert the code to a_ptr = a_ptr +1.
handle_CBinaryOp(obj)10.15. Analysis

1019

angr

angr.analyses.decompiler.structured_codegen.c.StructuredCodeGenerator
alias of CStructuredCodeGenerator
class angr.analyses.decompiler.structured_codegen.dwarf_import.ImportedLine(addr)
Bases: object__init__(addr)
class angr.analyses.decompiler.structured_codegen.dwarf_import.ImportSourceCode(function,
flavor='source',
source_root=None,
encoding='utf8')
Bases: BaseStructuredCodeGenerator, Analysis__init__(function, flavor='source', source_root=None, encoding='utf-8')
regenerate_text()
class angr.analyses.decompiler.structured_codegen.dummy.DummyStructuredCodeGenerator(flavor,
expr_comments=None,
stmt_comments=None,configuration=None,const_formats=None)
Bases: BaseStructuredCodeGenerator
A dummy structured code generator that only stores user-specified information.
Parameters
flavor (str)__init__(flavor, expr_comments=None, stmt_comments=None, configuration=None, const_formats=None)
Parameters
flavor (str)angr.analyses.decompiler.utils.remove_last_statement(node)angr.analyses.decompiler.utils.append_statement(node, stmt)
angr.analyses.decompiler.utils.replace_last_statement(node, old_stmt, new_stmt)
angr.analyses.decompiler.utils.extract_jump_targets(stmt)
Extract concrete goto targets from a Jump or a ConditionalJump statement.
Parametersstmt – The statement to analyze.
Returns
A list of known concrete jump targets.
Return type
list

1020

Chapter 10. API Referenceangrangr.analyses.decompiler.utils.switch_extract_cmp_bounds(last_stmt)
Check the last statement of the switch-case header node, and extract lower+upper bounds for the comparison.
Parameters
last_stmt (ConditionalJump) – The last statement of the switch-case header node.
Return typetuple[Any, int, int] | None
Returns
A tuple of (comparison expression, lower bound, upper bound), or Noneangr.analyses.decompiler.utils.get_ast_subexprs(claripy_ast)
angr.analyses.decompiler.utils.insert_node(parent, insert_location, node, node_idx, label=None)
Parameters• insert_location (str)• node_idx (int | tuple[int] | None)angr.analyses.decompiler.utils.to_ail_supergraph(transition_graph, allow_fake=False)
Takes an AIL graph and converts it into a AIL graph that treats calls and redundant jumps as parts of a bigger
block instead of transitions. Calls to returning functions do not terminate basic blocks.
Based on region_identifier super_graph
Return type
DiGraphReturns
A converted super transition graphParameterstransition_graph (DiGraph )angr.analyses.decompiler.utils.is_empty_node(node)
Return typebool
angr.analyses.decompiler.utils.is_empty_or_label_only_node(node)
Return typebool
angr.analyses.decompiler.utils.has_nonlabel_statements(block)
Return typebool
Parameters
block (Block)angr.analyses.decompiler.utils.has_nonlabel_nonphi_statements(block)
Return typebool
Parameters
block (Block)10.15. Analysis

1021

angr

angr.analyses.decompiler.utils.first_nonlabel_statement(block)
Return type
Statement | None
Parameters
block (Block | MultiNode)angr.analyses.decompiler.utils.first_nonlabel_statement_id(block)
Return type
int | None
Parameters
block (Block)angr.analyses.decompiler.utils.first_nonlabel_nonphi_statement(block)
Return type
Statement | None
Parameters
block (Block | MultiNode)angr.analyses.decompiler.utils.last_nonlabel_statement(block)
Return type
Statement | None
Parameters
block (Block)angr.analyses.decompiler.utils.first_nonlabel_node(seq)Return type
BaseNode | Block | None
Parametersseq (SequenceNode)angr.analyses.decompiler.utils.first_nonlabel_nonphi_node(seq)Return type
BaseNode | Block | None
Parametersseq (SequenceNode)angr.analyses.decompiler.utils.remove_labels(graph)
Parametersgraph (DiGraph )angr.analyses.decompiler.utils.add_labels(graph)
Parametersgraph (DiGraph )angr.analyses.decompiler.utils.update_labels(graph)
A utility function to recreate the labels for every node in an AIL graph. This useful when you are working witha graph where only _some_ of the nodes have labels.

1022

Chapter 10. API ReferenceangrParametersgraph (DiGraph )angr.analyses.decompiler.utils.structured_node_is_simple_return(node, graph,
use_packed_successors=False)
Return typebool
Parameters• node (SequenceNode | MultiNode)• graph (DiGraph )Will check if a “simple return” is contained within the node a simple returns looks like this: if (cond) {// simple return . . . return 0;

10.15.1 }Returns true on any block ending in linear statements and a return.
angr.analyses.decompiler.utils.is_statement_terminating(stmt, functions)
Return typebool
Parametersstmt (Statement)
angr.analyses.decompiler.utils.peephole_optimize_exprs(block, expr_opts)
angr.analyses.decompiler.utils.peephole_optimize_expr(expr, expr_opts)
angr.analyses.decompiler.utils.copy_graph(graph)
Copy AIL Graph.
Returns
A copy of the AIl graph.
Parametersgraph (DiGraph )angr.analyses.decompiler.utils.peephole_optimize_stmts(block, stmt_opts)
angr.analyses.decompiler.utils.match_stmt_classes(all_stmts, idx, stmt_class_seq)
Return typebool
Parameters• all_stmts (list)• idx (int)• stmt_class_seq (Iterable[type])
angr.analyses.decompiler.utils.peephole_optimize_multistmts(block, stmt_opts)

10.15. Analysis

1023

angr

angr.analyses.decompiler.utils.decompile_functions(path, functions=None, structurer=None,
catch_errors=False, show_casts=True,
base_address=None, preset=None)
Decompile a binary into a set of functions.
Parameters• path – The path to the binary to decompile.
• functions (Optional[list[int | str]]) – The functions to decompile. If None, all functions will be decompiled.
• structurer (Optional[str]) – The structuring algorithms to use.
• catch_errors (bool) – The structuring algorithms to use.
• show_casts (bool) – Whether to show casts in the decompiled output.
• base_address (Optional[int]) – The base address of the binary.
• preset (Optional[str]) – The configuration preset to use during decompilation.
Return typestr | None
Returns
The decompilation of all functions appended in order.
angr.analyses.decompiler.utils.calls_in_graph(graph)
Counts the number of calls in an graph full of AIL Blocks
Return type
int
Parametersgraph (DiGraph )angr.analyses.decompiler.utils.find_block_by_addr(graph, addr, insn_addr=False)
Parametersgraph (DiGraph )angr.analyses.decompiler.utils.sequence_to_blocks(seq)Converts a sequence node (BaseNode) to a list of ailment blocks contained in it and all its children.
Return type
list[Block]
Parametersseq (BaseNode)angr.analyses.decompiler.utils.sequence_to_statements(seq, exclude=(<class'ailment.statement.Jump'>, <class'ailment.statement.Jump'>))
Converts a sequence node (BaseNode) to a list of ailment Statements contained in it and all its children. May
exclude certain types of statements.
Return type
list[Statement]
Parametersseq (BaseNode)1024

Chapter 10. API Referenceangrclass angr.analyses.ddg.AST(op, *operands)
Bases: object
A mini implementation for AST__init__(op, *operands)
class angr.analyses.ddg.ProgramVariable(variable, location, initial=False, arch=None)
Bases: object
Describes a variable in the program at a specific location.
Variables• variable (SimVariable) – The variable.
• location (CodeLocation) – Location of the variable.
__init__(variable, location, initial=False, arch=None)
property short_repr
class angr.analyses.ddg.DDGJob(cfg_node, call_depth)
Bases: object__init__(cfg_node, call_depth)class angr.analyses.ddg.LiveDefinitions
Bases: object
A collection of live definitions with some handy interfaces for definition killing and lookups.
__init__()Constructor.
branch()Create a branch of the current live definition collection.
Returns
A new LiveDefinition instance.
Return typeangr.analyses.ddg.LiveDefinitions
copy()
Make a hard copy of self.
Returns
A new LiveDefinition instance.
Return typeangr.analyses.ddg.LiveDefinitions
add_def(variable, location, size_threshold=32)
Add a new definition of variable.
Parameters• variable (SimVariable) – The variable being defined.
• location (CodeLocation) – Location of the variable being defined.
• size_threshold (int) – The maximum bytes to consider for the variable.

10.15. Analysis

1025

angr

Returns
True if the definition was new, False otherwise
Return typebool
add_defs(variable, locations, size_threshold=32)
Add a collection of new definitions of a variable.
Parameters• variable (SimVariable) – The variable being defined.
• locations (iterable) – A collection of locations where the variable was defined.
• size_threshold (int) – The maximum bytes to consider for the variable.
Returns
True if any of the definition was new, False otherwise
Return typebool
kill_def(variable, location, size_threshold=32)
Add a new definition for variable and kill all previous definitions.
Parameters• variable (SimVariable) – The variable to kill.
• location (CodeLocation) – The location where this variable is defined.
• size_threshold (int) – The maximum bytes to consider for the variable.
ReturnsNonelookup_defs(variable, size_threshold=32)
Find all definitions of the variable.
Parameters• variable (SimVariable) – The variable to lookup for.
• size_threshold (int) – The maximum bytes to consider for the variable. For example,
if the variable is 100 byte long, only the first size_threshold bytes are considered.
Returns
A set of code locations where the variable is defined.
Return typeset
items()
An iterator that returns all live definitions.
Returns
The iterator.
Return type
iter

1026

Chapter 10. API Referenceangritervariables()An iterator that returns all live variables.
Returns
The iterator.
Return type
iterclass angr.analyses.ddg.DDGViewItem(ddg, variable, simplified=False)
Bases: object__init__(ddg, variable, simplified=False)
property depends_on
property dependents
class angr.analyses.ddg.DDGViewInstruction(cfg, ddg, insn_addr, simplified=False)
Bases: object__init__(cfg, ddg, insn_addr, simplified=False)
property definitions:list[DDGViewItem ]Get all definitions located at the current instruction address.
Returns
A list of ProgramVariable instances.
class angr.analyses.ddg.DDGView(cfg, ddg, simplified=False)
Bases: object
A view of the data dependence graph.
__init__(cfg, ddg, simplified=False)class angr.analyses.ddg.DDG(cfg, start=None, call_depth=None, block_addrs=None)
Bases: Analysis
This is a fast data dependence graph directly generated from our CFG analysis result. The only reason for its
existence is the speed. There is zero guarantee for being sound or accurate. You are supposed to use it only when
you want to track the simplest data dependence, and you do not care about soundness or accuracy.
For a better data dependence graph, please consider performing a better static analysis first (like Value-set Analysis), and then construct a dependence graph on top of the analysis result (for example, the VFG in angr).
The DDG is based on a CFG, which should ideally be a CFGEmulated generated with the following options:• keep_state=True to keep all input states• state_add_options=angr.options.refs to store memory, register, and temporary value accesses
You may want to consider a high value for context_sensitivity_level as well when generating the CFG.
Also note that since we are using states from CFG, any improvement in analysis performed on CFG (like apoints-to analysis) will directly benefit the DDG.
__init__(cfg, start=None, call_depth=None, block_addrs=None)
Parameters10.15. Analysis

1027

angr

• cfg – Control flow graph. Please make sure each node has an associated state with it,e.g. by passing the keep_state=True and state_add_options=angr.options.refs arguments to
CFGEmulated.
• start – An address, Specifies where we start the generation of this data dependence graph.
• call_depth – None or integers. A non-negative integer specifies how deep we would liketo track in the call tree. None disables call_depth limit.
• block_addrs (iterable or None) – A collection of block addresses that the DDG analysis should be performed on.
property graph
A networkx DiGraph instance representing the dependence relations between statements. :rtype: networkx.DiGraphType
returns
property data_graphGet the data dependence graph.
Returns
A networkx DiGraph instance representing data dependence.
Return typenetworkx.DiGraphproperty simplified_data_graphreturn:property ast_graphpp()
Pretty printing.
dbg_repr()
Representation for debugging.
get_predecessors(code_location)
Returns all predecessors of the code location.
Parameters
code_location – A CodeLocation instance.
Returns
A list of all predecessors.
function_dependency_graph(func)
Get a dependency graph for the function func.
Parameters
func – The Function object in CFG.function_manager.
Returns
A networkx.DiGraph instance.
data_sub_graph(pv, simplified=True, killing_edges=False, excluding_types=None)
Get a subgraph from the data graph or the simplified data graph that starts from node pv.
Parameters

1028

Chapter 10. API Reference

angr• pv (ProgramVariable) – The starting point of the subgraph.
• simplified (bool) – When True, the simplified data graph is used, otherwise the datagraph is used.
• killing_edges (bool) – Are killing edges included or not.
• excluding_types (iterable) – Excluding edges whose types are among those excluded
types.
Returns
A subgraph.
Return typenetworkx.MultiDiGraphfind_definitions(variable, location=None, simplified_graph=True)
Find all definitions of the given variable.
Parameters• variable (SimVariable)• simplified_graph (bool) – True if you just want to search in the simplified graph insteadof the normal graph. Usually the simplified graph suffices for finding definitions of registeror memory variables.
Returns
A collection of all variable definitions to the specific variable.
Return type
list
find_consumers(var_def , simplified_graph=True)
Find all consumers to the specified variable definition.
Parameters• var_def (ProgramVariable) – The variable definition.
• simplified_graph (bool) – True if we want to search in the simplified graph, False
otherwise.
Returns
A collection of all consumers to the specified variable definition.
Return type
list
find_killers(var_def , simplified_graph=True)
Find all killers to the specified variable definition.
Parameters• var_def (ProgramVariable) – The variable definition.
• simplified_graph (bool) – True if we want to search in the simplified graph, False
otherwise.
Returns
A collection of all killers to the specified variable definition.
Return typelist

10.15. Analysis

1029

angr

find_sources(var_def , simplified_graph=True)
Find all sources to the specified variable definition.
Parameters• var_def (ProgramVariable) – The variable definition.
• simplified_graph (bool) – True if we want to search in the simplified graph, False
otherwise.
Returns
A collection of all sources to the specified variable definition.
Return type
listclass angr.analyses.flirt.FlirtAnalysis(sig=None)
Bases: Analysis
FlirtAnalysis accomplishes two purposes:• If a FLIRT signature file is specified, it will match the given signature file against the current binary andrename recognized functions accordingly.
• If no FLIRT signature file is specified, it will use strings to determine possible libraries embedded in thecurrent binary, and then match all possible signatures for the architecture.
Parameters
sig (FlirtSignature | str | None)__init__(sig=None)
Parameters
sig (FlirtSignature | str | None)class angr.engines.light.data.ArithmeticExpression(op, operands)
Bases: object
Add = 0Sub = 1
Or = 2And = 4
RShift = 8
LShift = 16
Mul = 32
Xor = 64
CONST_TYPES = (<class 'int'>, <class 'ailment.expression.Const'>)__init__(op, operands)
opoperands

1030

Chapter 10. API Referenceangrstatic try_unpack_const(expr)
class angr.engines.light.data.RegisterOffset(bits, reg, offset)
Bases: object__init__(bits, reg, offset)
reg
offsetproperty bits
property symbolicclass angr.engines.light.data.SpOffset(bits, offset, is_base=False)
Bases: RegisterOffset__init__(bits, offset, is_base=False)
is_baseclass angr.engines.light.ArithmeticExpression(op, operands)
Bases: object
Add = 0Sub = 1
Or = 2And = 4
RShift = 8
LShift = 16
Mul = 32
Xor = 64
CONST_TYPES = (<class 'int'>, <class 'ailment.expression.Const'>)__init__(op, operands)
opoperands
static try_unpack_const(expr)
class angr.engines.light.SpOffset(bits, offset, is_base=False)
Bases: RegisterOffset__init__(bits, offset, is_base=False)
is_baseclass angr.engines.light.RegisterOffset(bits, reg, offset)
Bases: object

10.15. Analysis

1031

angr

__init__(bits, reg, offset)
reg
offsetproperty bits
property symbolicclass angr.engines.light.SimEngineLight
Bases: SimEngineLightMixin, SimEngine
A full-featured engine base class, suitable for static analysis__init__()process(state, *args, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)class angr.engines.light.SimEngineLightVEXMixin(*args, logger=None, **kwargs)
Bases: SimEngineLightMixin
A mixin for doing static analysis on VEXclass angr.engines.light.SimEngineLightAILMixin(*args, logger=None, **kwargs)
Bases: SimEngineLightMixin
A mixin for doing static analysis on AIL
angr.engines.light.SimEngineLightVEX
alias of SimEngineLightVEXMixin
angr.engines.light.SimEngineLightAIL
alias of SimEngineLightAILMixin
class angr.engines.light.engine.SimEngineLightMixin(*args, logger=None, **kwargs)
Bases: object
A mixin base class for engines meant to perform static analysis__init__(*args, logger=None, **kwargs)
static sp_offset(bits, offset)
Parameters• bits (int)• offset (int)static extract_offset_to_sp(spoffset_expr)
Extract the offset to the original stack pointer.
Parameters
spoffset_expr (Base) – The claripy AST to parse.

1032

Chapter 10. API ReferenceangrReturn type
int | None
Returns
The offset to the original stack pointer, or None if spoffset_expr is not a supported type of
SpOffset expression.
class angr.engines.light.engine.SimEngineLight
Bases: SimEngineLightMixin, SimEngine
A full-featured engine base class, suitable for static analysis__init__()process(state, *args, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)class angr.engines.light.engine.SimEngineLightVEXMixin(*args, logger=None, **kwargs)
Bases: SimEngineLightMixin
A mixin for doing static analysis on VEXclass angr.engines.light.engine.SimEngineLightAILMixin(*args, logger=None, **kwargs)
Bases: SimEngineLightMixin
A mixin for doing static analysis on AIL
angr.engines.light.engine.SimEngineLightVEX
alias of SimEngineLightVEXMixin
angr.engines.light.engine.SimEngineLightAIL
alias of SimEngineLightAILMixin
class angr.analyses.propagator.PropagatorAnalysis(func=None, block=None, func_graph=None,base_state=None, max_iterations=30,
load_callback=None, stack_pointer_tracker=None,
only_consts=False, completed_funcs=None,
do_binops=True, store_tops=True,
vex_cross_insn_opt=False, func_addr=None,
gp=None, cache_results=False, key_prefix=None,reaching_definitions=None,
immediate_stmt_removal=False, profiling=False)
Bases: ForwardAnalysis, Analysis
PropagatorAnalysis implements copy propagation. It propagates values (either constant values or variables) and
expressions inside a block or across a function.
PropagatorAnalysis supports both VEX and AIL. The VEX propagator only performs constant propagation. The
AIL propagator performs both constant propagation and copy propagation of depth-N expressions.
PropagatorAnalysis performs certain arithmetic operations between constants, including but are not limited to:• addition• subtraction

10.15. Analysis

1033

angr

• multiplication• division• xor
It also performs the following memory operations:• Loading values from a known address• Writing values to a stack variable
Parameters• func_addr (int | None)• gp (int | None)• cache_results (bool)• key_prefix (str | None)• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• profiling (bool)__init__(func=None, block=None, func_graph=None, base_state=None, max_iterations=30,
load_callback=None, stack_pointer_tracker=None, only_consts=False, completed_funcs=None,
do_binops=True, store_tops=True, vex_cross_insn_opt=False, func_addr=None, gp=None,
cache_results=False, key_prefix=None, reaching_definitions=None,
immediate_stmt_removal=False, profiling=False)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• func_addr (int | None)• gp (int | None)• cache_results (bool)• key_prefix (str | None)• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• profiling (bool)
ReturnsNoneproperty prop_key:

tuple[str | None, str, int, bool, bool, bool]

Gets a key that represents the function and the “flavor” of the propagation result.
property replacements

1034

Chapter 10. API Referenceangrclass angr.analyses.propagator.values.Top(size)
Bases: object__init__(size)
size
property bits
class angr.analyses.propagator.values.Bottom
Bases: object
class angr.analyses.propagator.vex_vars.VEXVariable
Bases: object
class angr.analyses.propagator.vex_vars.VEXMemVar(addr, size)
Bases: object__init__(addr, size)
addr
size
class angr.analyses.propagator.vex_vars.VEXReg(offset, size)
Bases: VEXVariable__init__(offset, size)
offsetsize
class angr.analyses.propagator.vex_vars.VEXTmp(tmp)
Bases: VEXVariable__init__(tmp)tmpclass angr.analyses.propagator.engine_base.SimEnginePropagatorBase(stack_pointer_tracker=None,
project=None,
propagate_tmps=True,
arch=None,reaching_definitions=None,
immediate_stmt_removal=False,
bp_as_gpr=False)
Bases: SimEngineLight
Parameters• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• bp_as_gpr (bool)

10.15. Analysis

1035

angr

__init__(stack_pointer_tracker=None, project=None, propagate_tmps=True, arch=None,reaching_definitions=None, immediate_stmt_removal=False, bp_as_gpr=False)
Parameters• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• bp_as_gpr (bool)process(state, *args, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)class angr.analyses.propagator.engine_vex.SimEnginePropagatorVEX(stack_pointer_tracker=None,
project=None,
propagate_tmps=True,
arch=None,reaching_definitions=None, immediate_stmt_removal=False,
bp_as_gpr=False)
Bases: TopCheckerMixin, SimEngineLightVEXMixin, SimEnginePropagatorBase
Parameters• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• bp_as_gpr (bool)state:

PropagatorVEXState

class angr.analyses.propagator.engine_ail.SimEnginePropagatorAIL(stack_pointer_tracker=None,
project=None,
propagate_tmps=True,
arch=None,reaching_definitions=None, immediate_stmt_removal=False,
bp_as_gpr=False)
Bases: SimEngineLightAILMixin, SimEnginePropagatorBase
The AIl engine for Propagator.
Parameters• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• bp_as_gpr (bool)state:

1036

PropagatorAILState

Chapter 10. API Referenceangrextract_offset_to_sp(expr)
Extract the offset to the original stack pointer.
Parameters• spoffset_expr – The claripy AST to parse.
• expr (Base | StackBaseOffset)
Return type
int | None
Returns
The offset to the original stack pointer, or None if spoffset_expr is not a supported type of
SpOffset expression.
is_using_outdated_def(expr, expr_defat, current_loc, avoid=None)
Return typetuple[bool, bool]
Parameters• expr (Expression)• expr_defat (CodeLocation | None)• current_loc (CodeLocation)• avoid (Expression | None)should_force_replace(stmt, new_expr)
Determine if the expression should be replaced.
We always replace the expression if:• the current statement is an indirect jump. this is to ensure the dynamically calculated jump targets arealways using the originally defined expressions, which usually leads to better decompilation output.
• the current statement is a return to make void functions (even when we incorrectly determine that they
return something) look better in general.
• the current statement has a shift-right operation and the source expression has a shift-right operation.
this is to support the peephole optimizations for division and modulo.
Parameters• stmt (Statement)• new_expr (Expression)
Return typebool
Returnsstatic has_tmpexpr(expr)
Return typebool
Parameters
expr (Expression)

10.15. Analysis

1037

angr

class angr.analyses.propagator.outdated_definition_walker.OutdatedDefinitionWalker(expr,
expr_defat,
current_loc,
state,
arch,
avoid=None,
extract_offset_to_sp=None,
rda=None)Bases: AILBlockWalker
Walks an AIL expression to find outdated definitions.
Parameters• expr_defat (CodeLocation)• current_loc (CodeLocation)• state (PropagatorAILState)• arch (Arch )• avoid (Expr.Expression | None)• extract_offset_to_sp (Callable | None)• rda (ReachingDefinitionsModel)__init__(expr, expr_defat, current_loc, state, arch, avoid=None, extract_offset_to_sp=None, rda=None)
Parameters• expr_defat (CodeLocation)• current_loc (CodeLocation)• state (PropagatorAILState)• arch (Arch )• avoid (Expression | None)• extract_offset_to_sp (Callable | None)• rda (ReachingDefinitionsModel | None)class angr.analyses.propagator.tmpvar_finder.TmpvarFinder(expr)
Bases: AILBlockWalkerBase
Walks an AIL expression to find Tmp expressions.
Parameters
expr (Expression)__init__(expr)
Parameters
expr (Expression)

1038

Chapter 10. API Referenceangrclass angr.analyses.propagator.propagator.PropagatorAnalysis(func=None, block=None,func_graph=None,base_state=None,
max_iterations=30,
load_callback=None,
stack_pointer_tracker=None,
only_consts=False,
completed_funcs=None,
do_binops=True, store_tops=True,
vex_cross_insn_opt=False,
func_addr=None, gp=None,
cache_results=False,
key_prefix=None,reaching_definitions=None,
immediate_stmt_removal=False,
profiling=False)
Bases: ForwardAnalysis, Analysis
PropagatorAnalysis implements copy propagation. It propagates values (either constant values or variables) and
expressions inside a block or across a function.
PropagatorAnalysis supports both VEX and AIL. The VEX propagator only performs constant propagation. The
AIL propagator performs both constant propagation and copy propagation of depth-N expressions.
PropagatorAnalysis performs certain arithmetic operations between constants, including but are not limited to:• addition• subtraction• multiplication• division• xor
It also performs the following memory operations:• Loading values from a known address• Writing values to a stack variable
Parameters• func_addr (int | None)• gp (int | None)• cache_results (bool)• key_prefix (str | None)• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• profiling (bool)__init__(func=None, block=None, func_graph=None, base_state=None, max_iterations=30,
load_callback=None, stack_pointer_tracker=None, only_consts=False, completed_funcs=None,
do_binops=True, store_tops=True, vex_cross_insn_opt=False, func_addr=None, gp=None,
cache_results=False, key_prefix=None, reaching_definitions=None,
immediate_stmt_removal=False, profiling=False)
10.15. Analysis

1039

angr

Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• func_addr (int | None)• gp (int | None)• cache_results (bool)• key_prefix (str | None)• reaching_definitions (ReachingDefinitionsModel | None)• immediate_stmt_removal (bool)• profiling (bool)
ReturnsNoneproperty prop_key: tuple[str | None, str, int, bool, bool, bool]
Gets a key that represents the function and the “flavor” of the propagation result.
property replacements
class angr.analyses.propagator.top_checker_mixin.TopCheckerMixin(*args, logger=None,**kwargs)
Bases: SimEngineLightMixin
class angr.analyses.reaching_definitions.LiveDefinitions(arch, track_tmps=False,
canonical_size=8, registers=None,
stack=None, memory=None, heap=None,
tmps=None, others=None,
register_uses=None, stack_uses=None,
heap_uses=None, memory_uses=None,
tmp_uses=None, other_uses=None,element_limit=5, merge_into_tops=True)
Bases: object
A LiveDefinitions instance contains definitions and uses for register, stack, memory, and temporary variables,
uncovered during the analysis.
Parameters• arch (archinfo.Arch )• track_tmps (bool)• registers (MultiValuedMemory)• stack (MultiValuedMemory)• memory (MultiValuedMemory)• heap (MultiValuedMemory)

1040

Chapter 10. API Referenceangr• tmps (dict[int, set[Definition]])• others (dict[Atom, MultiValues])• tmp_uses (dict[int, set[CodeLocation]])• merge_into_tops (bool)
INITIAL_SP_32BIT = 2147418112
INITIAL_SP_64BIT = 140737488289792__init__(arch, track_tmps=False, canonical_size=8, registers=None, stack=None, memory=None,
heap=None, tmps=None, others=None, register_uses=None, stack_uses=None, heap_uses=None,memory_uses=None, tmp_uses=None, other_uses=None, element_limit=5,
merge_into_tops=True)
Parameters• arch (Arch )• track_tmps (bool)• merge_into_tops (bool)project:

Project | Nonearch
track_tmps
registers:

MultiValuedMemory

stack:

MultiValuedMemory

memory:MultiValuedMemory

heap:

MultiValuedMemory

tmps:

dict[int, set[Definition]]others:dict[Atom , MultiValues]

register_uses
stack_uses
heap_uses
memory_uses
tmp_uses:

dict[int, set[CodeLocation]]other_uses
uses_by_codeloc:

dict[CodeLocation, set[Definition]]

property register_definitions
property stack_definitions
property memory_definitions

10.15. Analysis

1041

angr

property heap_definitions
copy(discard_tmpdefs=False)
Return type
LiveDefinitions
reset_uses()static top(bits)
Get a TOP value.
Parametersbits (int) – Width of the TOP value (in bits).
Returns
The TOP value.
static is_top(expr)
Check if the given expression is a TOP value.
Parameters
expr – The given expression.
Return typebool
Returns
True if the expression is TOP, False otherwise.
stack_address(offset)
Return type
BV | None
Parameters
offset (int)static is_stack_address(addr)
Return typebool
Parametersaddr (Base)static get_stack_offset(addr, had_stack_base=False)
Return type
int | None
Parametersaddr (Base)static annotate_with_def(symvar, definition)
Parameters• symvar (BV)
• definition (Definition)
Return type
BV
1042

Chapter 10. API ReferenceangrReturnsstatic extract_defs(symvar)
Return type
Generator[Definition]
Parameterssymvar (Base)static extract_defs_from_annotations(annos)
Return typeset[Definition]
Parameters
annos (Iterable[Annotation])
static extract_defs_from_mv(mv)Return type
Generator[Definition]
Parameters
mv (MultiValues)
get_sp()Return the concrete value contained by the stack pointer.
Return typeint
get_sp_offset()
Return the offset of the stack pointer.
Return type
int | None
get_stack_address(offset)
Return type
int | None
Parameters
offset (Base)stack_offset_to_stack_addr(offset)
Return type
intmerge(*others)
Return typetuple[LiveDefinitions, bool]
Parameters
others (LiveDefinitions)compare(other)
Return typebool

10.15. Analysis

1043

angr

Parameters
other (LiveDefinitions)kill_definitions(atom)
Overwrite existing definitions w.r.t ‘atom’ with a dummy definition instance. A dummy definition will not
be removed during simplification.
Parametersatom (Atom)
Return type
None
ReturnsNonekill_and_add_definition(atom, code_loc, data, dummy=False, tags=None, endness=None,annotated=False)
Return typeMultiValues | None
Parameters• atom (Atom)• code_loc (CodeLocation)• data (MultiValues)• tags (set[Tag] | None)
add_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (Atom)• code_loc (CodeLocation)• expr (Any | None)
add_use_by_def(definition, code_loc, expr=None)
Return type
None
Parameters• definition (Definition)• code_loc (CodeLocation)• expr (Any | None)
get_definitions(thing)
Return typeset[Definition[Atom]]Parameters
thing(A | Definition[A] | Iterable[A] | Iterable[Definition[A]] |MultiValues)
1044

Chapter 10. API Referenceangr

get_tmp_definitions(tmp_idx)
Return typeset[Definition]
Parameters
tmp_idx (int)
get_register_definitions(reg_offset, size)
Return typeset[Definition]
Parameters• reg_offset (int)• size (int)
get_stack_values(stack_offset, size, endness)
Return typeMultiValues | None
Parameters• stack_offset (int)• size (int)• endness (str)
get_stack_definitions(stack_offset, size)
Return typeset[Definition]
Parameters• stack_offset (int)• size (int)
get_heap_definitions(heap_addr, size)
Return typeset[Definition]
Parameters• heap_addr (int)• size (int)
get_memory_definitions(addr, size)
Return typeset[Definition]
Parameters• addr (int)• size (int)
get_definitions_from_atoms(**kwargs)

10.15. Analysis

1045

angr

get_value_from_definition(**kwargs)
get_one_value_from_definition(**kwargs)
get_concrete_value_from_definition(**kwargs)
get_value_from_atom(**kwargs)
get_one_value_from_atom(**kwargs)
get_concrete_value_from_atom(**kwargs)
get_values(spec)
Return typeMultiValues | None
Parametersspec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])get_one_value(spec, strip_annotations=False)
Return type
BV | None
Parameters• spec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])• strip_annotations (bool)
get_concrete_value(spec, cast_to=<class 'int'>)
Return type
int | bytes | None
Parameters• spec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])• cast_to (type[int] | type[bytes])
add_register_use(reg_offset, size, code_loc, expr=None)
Return type
None
Parameters• reg_offset (int)• size (int)• code_loc (CodeLocation)• expr (Any | None)
add_register_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)

1046

Chapter 10. API Referenceangr• code_loc (CodeLocation)• expr (Any | None)
add_stack_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)
add_stack_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_heap_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)
add_heap_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_memory_use(atom, code_loc, expr=None)
Return type
None
Parameters• atom (MemoryLocation)• code_loc (CodeLocation)• expr (Any | None)

10.15. Analysis

1047

angr

add_memory_use_by_def(def_, code_loc, expr=None)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)• expr (Any | None)
add_tmp_use(atom, code_loc)
Return type
None
Parameters• atom (Tmp)• code_loc (CodeLocation)
add_tmp_use_by_def(def_, code_loc)
Return type
None
Parameters• def_ (Definition)• code_loc (CodeLocation)
deref(pointer, size, endness=Endness.BE)
static is_heap_address(addr)
Return typebool
Parametersaddr (Base)static get_heap_offset(addr)
Return type
int | None
Parametersaddr (Base)heap_address(offset)
Return type
BV
Parameters
offset (int | HeapAddress)
class angr.analyses.reaching_definitions.ObservationPointType(value)
Bases: IntEnum
Enum to replace the previously generic constants This makes it possible to annotate where they are expected bytyping something as ObservationPointType instead of Literal[0,1]1048

Chapter 10. API Referenceangr

OP_BEFORE = 0
OP_AFTER = 1
class angr.analyses.reaching_definitions.AtomKind(value)
Bases: Enum
An enum indicating the class of an atom
REGISTER = 1
MEMORY = 2
TMP = 3
GUARD = 4
CONSTANT = 5class angr.analyses.reaching_definitions.Atom(size)
Bases: object
This class represents a data storage location manipulated by IR instructions.
It could either be a Tmp (temporary variable), a Register, a MemoryLocation.
__init__(size)
Parameters
size – The size of the atom in bytes
size
property bits:

int

static from_ail_expr(expr, arch, full_reg=False)
Return type
RegisterParameters• expr (Expression)• arch (Arch )• full_reg (bool)
static from_argument(argument, arch, full_reg=False, sp=None)
Instantiate an Atom from a given argument.
Parameters• argument (SimFunctionArgument) – The argument to create a new atom from.
• arch (Arch) – The argument representing archinfo architecture for argument.
• full_reg – Whether to return an atom indicating the entire register if the argument only
specifies a slice of the register.
• sp (Optional[int]) – The current stack offset. Optional. Only used when argument is a
SimStackArg.
Return type
Register | MemoryLocation

10.15. Analysis

1049

angr

static reg(thing, size=None, arch=None)
Create a Register atom.
Parameters• thing(str|
RegisterOffset)–
The
registerproject.arch.registers[“rax”][0]) or the register name (e.g., “rax”).

offset(e.g.,• size (Optional[int]) – Size of the register atom. Must be provided when creating theatom using a register offset.
• arch (Optional[Arch]) – The architecture. Must be provided when creating the atom
using a register name.
Return type
Register
Returns
The Register Atom object.
static register(thing, size=None, arch=None)
Create a Register atom.
Parameters• thing(str|
RegisterOffset)–
The
registerproject.arch.registers[“rax”][0]) or the register name (e.g., “rax”).

offset(e.g.,• size (Optional[int]) – Size of the register atom. Must be provided when creating theatom using a register offset.
• arch (Optional[Arch]) – The architecture. Must be provided when creating the atom
using a register name.
Return type
Register
Returns
The Register Atom object.
static mem(addr, size, endness=None)
Create a MemoryLocation atom,
Parameters• addr (SpOffset | HeapAddress | int) – The memory location. Can be an SpOffset for
stack variables, an int for global memory variables, or a HeapAddress for items on the heap.
• size (int) – Size of the atom.
• endness (Optional[str]) – Optional, either “Iend_LE” or “Iend_BE”.
Return type
MemoryLocation
Returns
The MemoryLocation Atom object.
static memory(addr, size, endness=None)
Create a MemoryLocation atom,
Parameters• addr (SpOffset | HeapAddress | int) – The memory location. Can be an SpOffset for
stack variables, an int for global memory variables, or a HeapAddress for items on the heap.
1050

Chapter 10. API Reference

angr• size (int) – Size of the atom.
• endness (Optional[str]) – Optional, either “Iend_LE” or “Iend_BE”.
Return type
MemoryLocation
Returns
The MemoryLocation Atom object.
class angr.analyses.reaching_definitions.Register(reg_offset, size, arch=None)
Bases: Atom
Represents a given CPU register.
As an IR abstracts the CPU design to target different architectures, registers are represented as a separated memory space. Thus a register is defined by its offset from the base of this memory and its size.
Variables• reg_offset (int) – The offset from the base to define its place in the memory bloc.
• size (int) – The size, in number of bytes.
Parameters• reg_offset (RegisterOffset)• size (int)• arch (Arch | None)__init__(reg_offset, size, arch=None)
Parameters• size (int) – The size of the atom in bytes• reg_offset (RegisterOffset)• arch (Arch | None)
reg_offset
archproperty name:strclass angr.analyses.reaching_definitions.MemoryLocation(addr, size, endness=None)
Bases: Atom
Represents a memory slice.
It is characterized by its address and its size.
Parameters• addr (SpOffset | int | BV)• size (int)• endness (str | None)__init__(addr, size, endness=None)
Parameters• addr (int) – The address of the beginning memory location slice.
10.15. Analysis

1051

angr

• size (int) – The size of the represented memory location, in bytes.
• endness (str | None)
addr:

SpOffset | int | BV

endness
property is_on_stack:bool

True if this memory location is located on the stack.
property symbolic:boolclass angr.analyses.reaching_definitions.Tmp(tmp_idx, size)
Bases: Atom
Represents a variable used by the IR to store intermediate values.
Parameters• tmp_idx (int)• size (int)__init__(tmp_idx, size)
Parameters• size (int) – The size of the atom in bytes• tmp_idx (int)tmp_idxclass angr.analyses.reaching_definitions.GuardUse(target)
Bases: Atom
Implements a guard use.
__init__(target)
Parameters
size – The size of the atom in bytes
targetclass angr.analyses.reaching_definitions.ConstantSrc(value, size)
Bases: Atom
Represents a constant.
Parameters• value (int)• size (int)__init__(value, size)
Parameters• size (int) – The size of the atom in bytes• value (int)1052

Chapter 10. API Referenceangrvalue:

intclass angr.analyses.reaching_definitions.Definition(atom, codeloc, dummy=False, tags=None)
Bases: Generic[A]An atom definition.
Variables• atom – The atom being defined.
• codeloc – Where this definition is created in the original binary code.
• dummy – Tell whether the definition should be considered dummy or not. During simplification by AILment, definitions marked as dummy will not be removed.
• tags – A set of tags containing information about the definition gathered during analyses.
Parameters• atom (A)• codeloc (CodeLocation)• dummy (bool)• tags (set[Tag] | None)__init__(atom, codeloc, dummy=False, tags=None)
Parameters• atom (A)• codeloc (CodeLocation)• dummy (bool)• tags (set[Tag] | None)
atom:

TypeVar(A, bound= Atom )codeloc:
dummy:

CodeLocation
bool

tags
property offset:
property size:

int
int

matches(**kwargs)
Return whether this definition has certain characteristics.
Return typebool

10.15. Analysis

1053

angr

class angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis(subject=None,func_graph=None,
max_iterations=30,
track_tmps=False,
track_consts=True,observation_points=None,
init_state=None,
init_context=None,state_initializer=None,
cc=None,function_handler=None,observe_all=False,
visited_blocks=None,
dep_graph=True,observe_callback=None,
canonical_size=8,
stack_pointer_tracker=None,
use_callee_saved_regs_at_return=True,
interfunction_level=0,
track_liveness=True,
func_addr=None,element_limit=5,
merge_into_tops=True)
Bases: ForwardAnalysis[ReachingDefinitionsState, NodeType, object, object], Analysis
ReachingDefinitionsAnalysis is a text-book implementation of a static data-flow analysis that works on either afunction or a block. It supports both VEX and AIL. By registering observers to observation points, users may use
this analysis to generate use-def chains, def-use chains, and reaching definitions, and perform other traditional
data-flow analyses such as liveness analysis.
• I’ve always wanted to find a better name for this analysis. Now I gave up and decided to live with this namefor the foreseeable future (until a better name is proposed by someone else).
• Aliasing is definitely a problem, and I forgot how aliasing is resolved in this implementation. I’ll leave thisas a post-graduation TODO.
• Some more documentation and examples would be nice.
Parameters• subject (Subject | ailment.Block | Block | Function | str)
• observation_points (Iterable[ObservationPoint] | None)• init_state (ReachingDefinitionsState)• state_initializer (RDAStateInitializer | None)• function_handler (FunctionHandler | None)• dep_graph (DepGraph | bool | None)• interfunction_level (int)• track_liveness (bool)• func_addr (int | None)• element_limit (int)• merge_into_tops (bool)

1054

Chapter 10. API Referenceangr__init__(subject=None, func_graph=None, max_iterations=30, track_tmps=False, track_consts=True,observation_points=None, init_state=None, init_context=None, state_initializer=None, cc=None,
function_handler=None, observe_all=False, visited_blocks=None, dep_graph=True,observe_callback=None, canonical_size=8, stack_pointer_tracker=None,
use_callee_saved_regs_at_return=True, interfunction_level=0, track_liveness=True,
func_addr=None, element_limit=5, merge_into_tops=True)
Parameters• subject (Union[Subject, Block, Block, Function, str, None]) – The subject of theanalysis: a function, or a single basic block• func_graph – Alternative graph for function.graph.
• max_iterations – The maximum number of iterations before the analysis is terminated.
• track_tmps – Whether or not temporary variables should be taken into consideration
during the analysis.
• observation_points (iterable) – A collection of tuples of (“node”|”insn”, ins_addr,
OP_TYPE) defining where reaching definitions should be copied and stored. OP_TYPE
can be OP_BEFORE or OP_AFTER.
• init_state (Optional[ReachingDefinitionsState]) – An optional initialization
state. The analysis creates and works on a copy. Default to None: the analysis then initialize
its own abstract state, based on the given <Subject>.
• init_context – If init_state is not given, this is used to initialize the context field of theinitial state’s CodeLocation. The only default-supported type which may go here is a tupleof integers, i.e. a callstack. Anything else requires a custom FunctionHandler.
• cc – Calling convention of the function.
• function_handler (Optional[FunctionHandler]) – The function handler to update
the analysis state and results on function calls.
• observe_all – Observe every statement, both before and after.
• visited_blocks – A set of previously visited blocks.
• dep_graph (DepGraph | bool | None) – An initial dependency graph to add the result of
the analysis to. Set it to None to skip dependency graph generation.
• canonical_size – The sizes (in bytes) that objects with an UNKNOWN_SIZE are treatedas for operations where sizes are necessary.
• dep_graph – Set this to True to generate a dependency graph for the subject. It will beavailable as result.dep_graph.
• interfunction_level (int) – The number of functions we should recurse into. Thisparameter is only used if function_handler is not provided.
• track_liveness (bool) – Whether to track liveness information. This can consume sizeable amounts of RAM on large functions. (e.g. ~15GB for a function with 4k nodes)• merge_into_tops (bool) – Merge known values into TOP if TOP is present. If True:{TOP} V {0xabc} = {TOP} If False: {TOP} V {0xabc} = {TOP, 0xabc}• state_initializer (RDAStateInitializer | None)• func_addr (int | None)• element_limit (int)

10.15. Analysis

1055

angr

property observed_results:

dict[tuple[str, int, int], LiveDefinitions]

property all_definitions
property all_uses
property one_result
property dep_graph:

DepGraph

property visited_blocks
get_reaching_definitions(**kwargs)
get_reaching_definitions_by_insn(ins_addr, op_type)
get_reaching_definitions_by_node(node_addr, op_type)
node_observe(node_addr, state, op_type, node_idx=None)
Parameters• node_addr (int) – Address of the node.
• state (ReachingDefinitionsState) – The analysis state.
• op_type (ObservationPointType) – Type of the observation point. Must be one of thefollowing: OP_BEFORE, OP_AFTER.
• node_idx (Optional[int]) – ID of the node. Used in AIL to differentiate blocks with thesame address.
Return type
Noneinsn_observe(insn_addr, stmt, block, state, op_type)
Parameters• insn_addr (int) – Address of the instruction.
• stmt (Statement | IRStmt) – The statement.
• block (Block | Block) – The current block.
• state (ReachingDefinitionsState) – The abstract analysis state.
• op_type (ObservationPointType) – Type of the observation point. Must be one of thefollowing: OP_BEORE, OP_AFTER.
Return type
None
stmt_observe(stmt_idx, stmt, block, state, op_type)
Parameters• stmt_idx (int)• stmt (Statement | IRStmt)• block (Block | Block)• state (ReachingDefinitionsState)• op_type (ObservationPointType)1056

Chapter 10. API ReferenceangrReturn type
None
Returns
exit_observe(node_addr, exit_stmt_idx, block, state, node_idx=None)
Parameters• node_addr (int)• exit_stmt_idx (int)• block (Block | Block)• state (ReachingDefinitionsState)• node_idx (int | None)
property subject
callsites_to(target)
Return type
Iterable[FunctionCallRelationships]
Parameters
target (int | str | Function)
class angr.analyses.reaching_definitions.ReachingDefinitionsModel(func_addr=None,
track_liveness=True)
Bases: object
Models the definitions, uses, and memory of a ReachingDefinitionState object
Parameters• func_addr (int | None)• track_liveness (bool)__init__(func_addr=None, track_liveness=True)
Parameters• func_addr (int | None)• track_liveness (bool)
add_def(d)Return type
None
Parametersd (Definition)kill_def(d)Return type
None
Parametersd (Definition)

10.15. Analysis

1057

angr

at_new_stmt(codeloc)
Return type
None
Parameterscodeloc (CodeLocation)
at_new_block(code_loc, pred_codelocs)
Return type
None
Parameters• code_loc (CodeLocation)• pred_codelocs (list[CodeLocation])
make_liveness_snapshot()
Return type
Nonefind_defs_at(code_loc, op=ObservationPointType.OP_BEFORE)
Return typeset[Definition]
Parameters• code_loc (CodeLocation)• op (int)
get_defs(atom, code_loc, op)
Return typeset[Definition]
Parameters• atom (Atom)• code_loc (CodeLocation)• op (int)copy()
Return type
ReachingDefinitionsModel
merge(model)
Parametersmodel (ReachingDefinitionsModel)
get_observation_by_insn(ins_addr, kind)
Return type
LiveDefinitions | None
Parameters• ins_addr (int | CodeLocation)
1058

Chapter 10. API Referenceangr• kind (ObservationPointType)
get_observation_by_node(node_addr, kind, node_idx=None)
Return type
LiveDefinitions | None
Parameters• node_addr (int | CodeLocation)• kind (ObservationPointType)• node_idx (int | None)
get_observation_by_stmt(arg1, arg2, arg3=None, *, block_idx=None)
get_observation_by_exit(node_addr, stmt_idx, src_node_idx=None)
Return type
LiveDefinitions | None
Parameters• node_addr (int)• stmt_idx (int)• src_node_idx (int | None)class angr.analyses.reaching_definitions.ReachingDefinitionsState(codeloc, arch, subject,track_tmps=False,
track_consts=False,
analysis=None,
rtoc_value=None,
live_definitions=None,
canonical_size=8,
heap_allocator=None,environment=None,sp_adjusted=False,
all_definitions=None,
initializer=None,element_limit=5,
merge_into_tops=True)
Bases: object
Represents the internal state of the ReachingDefinitionsAnalysis.
It contains a data class LiveDefinitions, which stores both definitions and uses for register, stack, memory, andtemporary variables, uncovered during the analysis.
Parameters• subject (Subject) – The subject being analyzed.
• track_tmps (bool) – Only tells whether or not temporary variables should be taken into
consideration when representing the state of the analysis. Should be set to true when theanalysis has counted uses and definitions for temporary variables, false otherwise.
• analysis (Optional[ReachingDefinitionsAnalysis]) – The analysis that generated
the state represented by this object.

10.15. Analysis

1059

angr

• rtoc_value – When the targeted architecture is ppc64, the initial function needs to know
the rtoc_value.
• live_definitions (Optional[LiveDefinitions])• canonical_size (int) – The sizes (in bytes) that objects with an UNKNOWN_SIZE aretreated as for operations where sizes are necessary.
• heap_allocator (Optional[HeapAllocator]) – Mechanism to model the managementof heap memory.
• environment (Optional[Environment]) – Representation of the environment of the analyzed program.
• codeloc (CodeLocation)• arch (archinfo.Arch )• track_consts (bool)• sp_adjusted (bool)• all_definitions (set[Definition[A]] | None)• initializer (RDAStateInitializer | None)• element_limit (int)• merge_into_tops (bool)
Variables
arch – The architecture targeted by the program.
__init__(codeloc, arch, subject, track_tmps=False, track_consts=False, analysis=None, rtoc_value=None,
live_definitions=None, canonical_size=8, heap_allocator=None, environment=None,sp_adjusted=False, all_definitions=None, initializer=None, element_limit=5,
merge_into_tops=True)
Parameters• codeloc (CodeLocation)• arch (Arch )• subject (Subject)• track_tmps (bool)• track_consts (bool)• analysis (ReachingDefinitionsAnalysis | None)• live_definitions (LiveDefinitions | None)• canonical_size (int)• heap_allocator (HeapAllocator | None)• environment (Environment | None)• sp_adjusted (bool)• all_definitions (set[Definition[A]] | None)• initializer (RDAStateInitializer | None)• element_limit (int)• merge_into_tops (bool)
1060

Chapter 10. API Referenceangrcodeloc
arch:

Arch

analysisall_definitions:set[Definition[TypeVar(A, bound= Atom )]]heap_allocator
codeloc_uses:

set[Definition[TypeVar(A, bound= Atom )]]exit_observed:bool

live_definitions
top(bits)
Parametersbits (int)
is_top(*args)
heap_address(offset)
Return type
BV
Parameters
offset (int | HeapAddress)
static is_heap_address(addr)
Return typebool
Parametersaddr (Base)static get_heap_offset(addr)
Return type
int | None
Parametersaddr (Base)stack_address(offset)
Return type
BV
Parameters
offset (int)
is_stack_address(addr)
Return typebool
Parametersaddr (Base)

10.15. Analysis

1061

angr

get_stack_offset(addr)
Return type
int | None
Parametersaddr (Base)annotate_with_def(symvar, definition)
Parameters• symvar (Base)• definition (Definition[TypeVar(A, bound= Atom)])
Return type
Base
Returns
annotate_mv_with_def(mv, definition)
Return typeMultiValues
Parameters• mv (MultiValues)• definition (Definition[A])extract_defs(symvar)
Return type
Iterator[Definition[TypeVar(A, bound= Atom)]]
Parameterssymvar (Base)
property tmps
property tmp_uses
property register_uses
property registers:
property stack:MultiValuedMemory

MultiValuedMemory

property stack_uses
property heap:

MultiValuedMemory

property heap_uses
property memory_uses
property memory:

MultiValuedMemory

property uses_by_codeloc

1062

Chapter 10. API Referenceangrget_sp()Return typeint
get_stack_address(offset)
Return type
int
Parameters
offset (Base)
property environment
property dep_graphcopy(discard_tmpdefs=False)
Return type
ReachingDefinitionsState
merge(*others)
Return typetuple[ReachingDefinitionsState, bool]
compare(other)
Return typebool
Parameters
other (ReachingDefinitionsState)
move_codelocs(new_codeloc)
Return type
None
Parameters
new_codeloc (CodeLocation)kill_definitions(atom)
Overwrite existing definitions w.r.t ‘atom’ with a dummy definition instance. A dummy definition will not
be removed during simplification.
Return type
None
Parametersatom (Atom)
kill_and_add_definition(atom, data, dummy=False, tags=None, endness=None, annotated=False,
uses=None, override_codeloc=None)
Return typetuple[MultiValues | None, set[Definition[TypeVar(A, bound= Atom)]]]Parameters• atom (Atom)• data (MultiValues)
10.15. Analysis

1063

angr

• tags (set[Tag] | None)• annotated (bool)• uses (set[Definition[A]] | None)• override_codeloc (CodeLocation | None)
add_use(atom, expr=None)
Return type
None
Parameters• atom (Atom)• expr (Any | None)
add_use_by_def(definition, expr=None)
Return type
None
Parameters• definition (Definition[A])• expr (Any | None)
add_tmp_use(tmp, expr=None)
Return type
None
Parameters• tmp (int)• expr (Any | None)
add_tmp_use_by_defs(defs, expr=None)
Return type
None
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
add_register_use(reg_offset, size, expr=None)
Return type
None
Parameters• reg_offset (int)• size (int)• expr (Any | None)

1064

Chapter 10. API Referenceangr

add_register_use_by_defs(defs, expr=None)
Return type
None
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
add_stack_use(stack_offset, size, expr=None)
Return type
None
Parameters• stack_offset (int)• size (int)• expr (Any | None)
add_stack_use_by_defs(defs, expr=None)
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
add_heap_use(heap_offset, size, expr=None)
Return type
None
Parameters• heap_offset (int)• size (int)• expr (Any | None)
add_heap_use_by_defs(defs, expr=None)
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
add_memory_use_by_def(definition, expr=None)
Parameters• definition (Definition[A])• expr (Any | None)
add_memory_use_by_defs(defs, expr=None)
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)

10.15. Analysis

1065

angr

get_definitions(atom)
Return typeset[Definition[TypeVar(A, bound= Atom)]]
Parametersatom (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])get_values(spec)
Return typeMultiValues | None
Parametersspec (A | Definition[A] | Iterable[A])get_one_value(spec, strip_annotations=False)
Return type
BV | None
Parameters• spec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])• strip_annotations (bool)
get_concrete_value(spec, cast_to=<class 'int'>)
Return type
int | bytes | None
Parameters• spec (A | Definition[A] | Iterable[A])• cast_to (type[int] | type[bytes])
mark_guard(target)
mark_const(value, size)
Parameters• value (int)• size (int)
downsize()
pointer_to_atoms(**kwargs)
pointer_to_atom(**kwargs)
deref(pointer, size, endness=Endness.BE)
Parameters• pointer(MultiValues | A | Definition | Iterable[A] |Iterable[Definition[A]] | int | BV | HeapAddress | SpOffset)• size (int | DerefSize)• endness (str)1066

Chapter 10. API Referenceangrclass angr.analyses.reaching_definitions.FunctionHandler(interfunction_level=0,
extra_impls=None)
Bases: object
A mechanism for summarizing a function call’s effect on a program for ReachingDefinitionsAnalysis.
Parameters• interfunction_level (int)• extra_impls (Iterable[FunctionHandler] | None)__init__(interfunction_level=0, extra_impls=None)
Parameters• interfunction_level (int)• extra_impls (Iterable[FunctionHandler] | None)hook(analysis)
Attach this instance of the function handler to an instance of RDA.
Return type
FunctionHandler
Parameters
analysis (ReachingDefinitionsAnalysis)
make_function_codeloc(target, callsite, callsite_func_addr)
The RDA engine will call this function to transform a callsite CodeLocation into a callee CodeLocation.
Parameters• target (None | int | MultiValues)• callsite (CodeLocation)• callsite_func_addr (int | None)
handle_function(state, data)
The main entry point for the function handler. Called with a RDA state and a FunctionCallData, it isexpected to update the state and the data as per the contracts described on FunctionCallData.
You can override this method to take full control over how data is processed, or override any of the following
to use the higher-level interface (data.depends()):• handle_impl_<function name> - used for <function name>.
• handle_local_function - used for any function (excluding plt stubs) whose address is inside the mainbinary.
• handle_external_function - used for any function or plt stub whose address is outside the main binary.
• handle_indirect_function - used for any function whose target cannot be resolved.
• handle_generic_function - used as a default if none of the above are overridden.
Each of them take the same signature as handle_function.
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)

10.15. Analysis

1067

angr

handle_generic_function(state, data)
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
handle_indirect_function(state, data)
Return type
None
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
handle_local_function(state, data)
Return type
None
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
handle_external_function(state, data)
Return type
None
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
recurse_analysis(state, data)
Precondition: data.function MUST NOT BE NONE in order to call this method.
Return type
None
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)static c_args_as_atoms(state, cc, prototype)
Return type
list[set[Atom]]Parameters• state (ReachingDefinitionsState)• cc (SimCC)• prototype (SimTypeFunction)

1068

Chapter 10. API Referenceangrstatic c_return_as_atoms(state, cc, prototype)
Return typeset[Atom]Parameters• state (ReachingDefinitionsState)• cc (SimCC)• prototype (SimTypeFunction)
static caller_saved_regs_as_atoms(state, cc)
Return typeset[Register]
Parameters• state (ReachingDefinitionsState)• cc (SimCC)
static stack_pointer_as_atom(state)
Return type
Registerclass angr.analyses.reaching_definitions.FunctionCallData(callsite_codeloc, function_codeloc,
address_multi, address=None,symbol=None, function=None,
name=None, cc=None, prototype=None,args_atoms=None, args_values=None,
ret_atoms=None, redefine_locals=True,
visited_blocks=None, effects=<factory>,
ret_values=None,
ret_values_deps=None,
caller_will_handle_single_ret=False,
guessed_cc=False,
guessed_prototype=False,
retaddr_popped=False)
Bases: object
A bundle of intermediate data used when computing the sum effect of a function during ReachingDefinitionsAnalysis.
RDA engine contract:• Construct one of these before calling FunctionHandler.handle_function. Fill it with as many fields as you
can realistically provide without duplicating effort.
• Provide callsite_codeloc as either the call statement (AIL) or the default exit of the default statement of thecalling block (VEX)• Provide function_codeloc as the callee address with stmt_idx=0`.
Function handler contract:• If redefine_locals is unset, do not adjust any artifacts of the function call abstraction, such as the stack
pointer, the caller saved registers, etc.

10.15. Analysis

1069

angr

• If caller_will_handle_single_ret is set, and there is a single entry in ret_atoms, do not apply to the state
effects modifying this atom. Instead, set ret_values and ret_values_deps to the values and deps which areused constructing these values.
Parameters• callsite_codeloc (CodeLocation)• function_codeloc (CodeLocation)• address_multi (MultiValues | None)• address (int | None)• symbol (Symbol | None)• function (Function | None)• name (str | None)• cc (SimCC | None)• prototype (SimTypeFunction | None)• args_atoms (list[set[Atom]] | None)• args_values (list[MultiValues] | None)• ret_atoms (set[Atom] | None)• redefine_locals (bool)• visited_blocks (set[int] | None)• effects (list[FunctionEffect])• ret_values (MultiValues | None)• ret_values_deps (set[Definition] | None)• caller_will_handle_single_ret (bool)• guessed_cc (bool)• guessed_prototype (bool)• retaddr_popped (bool)
callsite_codeloc:

CodeLocation

function_codeloc:

CodeLocation

address_multi:
address:

int | None = Nonesymbol:Symbol | None = None

function:

Function | None = Nonename:str | None = None

cc:

SimCC | None = None

prototype:

1070

MultiValues | None

SimTypeFunction | None = None

Chapter 10. API Referenceangrargs_atoms:

list[set[Atom ]] | None = Noneargs_values:

list[MultiValues] | None = None

ret_atoms:

set[Atom ] | None = Noneredefine_locals:bool = True

visited_blocks:

set[int] | None = Noneeffects:list[FunctionEffect]

ret_values:

MultiValues | None = None

ret_values_deps:set[Definition] | None = None

caller_will_handle_single_ret:
guessed_cc:bool = False

bool = False

guessed_prototype:retaddr_popped:bool = False

bool = False

has_clobbered(dest)
Determines whether the given atom already has effects applied
Return typebool
Parameters
dest (Atom)depends(dest, *sources, value=None, apply_at_callsite=False, tags=None)
Mark a single effect of the current function, including the atom being modified, the input atoms on whichthat output atom depends, the precise (or imprecise!) value to store, and whether the effect should beapplied during the function or afterwards, at the callsite.
The tags are used to annotate the Definition of the Atom that will be created, when the function effects areapplied to the state.
The atom being modified may be None to mark uses of the source atoms which do not have any explicit
sinks.
Parameters• dest (Atom | Iterable[Atom] | None)• sources (Atom | Iterable[Atom])• value (MultiValues | BV | bytes | int | None)• apply_at_callsite (bool)• tags (set[Tag] | None)
reset_prototype(prototype, state, soft_reset=False)
Return typeset[Atom]Parameters• prototype (SimTypeFunction)
10.15. Analysis

1071

angr

• state (ReachingDefinitionsState)• soft_reset (bool)__init__(callsite_codeloc, function_codeloc, address_multi, address=None, symbol=None, function=None,
name=None, cc=None, prototype=None, args_atoms=None, args_values=None, ret_atoms=None,redefine_locals=True, visited_blocks=None, effects=<factory>, ret_values=None,
ret_values_deps=None, caller_will_handle_single_ret=False, guessed_cc=False,
guessed_prototype=False, retaddr_popped=False)
Parameters• callsite_codeloc (CodeLocation)• function_codeloc (CodeLocation)• address_multi (MultiValues | None)• address (int | None)• symbol (Symbol | None)• function (Function | None)• name (str | None)• cc (SimCC | None)• prototype (SimTypeFunction | None)• args_atoms (list[set[Atom]] | None)• args_values (list[MultiValues] | None)• ret_atoms (set[Atom] | None)• redefine_locals (bool)• visited_blocks (set[int] | None)• effects (list[FunctionEffect])• ret_values (MultiValues | None)• ret_values_deps (set[Definition] | None)• caller_will_handle_single_ret (bool)• guessed_cc (bool)• guessed_prototype (bool)• retaddr_popped (bool)
Return type
Noneangr.analyses.reaching_definitions.get_all_definitions(region)
Return typeset[Definition]
Parameters
region (MultiValuedMemory)

1072

Chapter 10. API Referenceangrclass angr.analyses.reaching_definitions.call_trace.CallSite(caller_func_addr, block_addr,
callee_func_addr)
Bases: object
Describes a call site on a CFG.
Parameters• caller_func_addr (int)• block_addr (int | None)• callee_func_addr (int)__init__(caller_func_addr, block_addr, callee_func_addr)
Parameters• caller_func_addr (int)• block_addr (int | None)• callee_func_addr (int)caller_func_addr
callee_func_addr
block_addr
class angr.analyses.reaching_definitions.call_trace.CallTrace(target)
Bases: object
Describes a series of functions calls to get from one function (current_function_address()) to another function
or a basic block (self.target).
Parameters
target (int)__init__(target)
Parameters
target (int)targetcallsites:

list[CallSite]current_function_address()
Return type
int
step_back(caller_func_addr, block_addr, callee_func_addr)
Return type
CallTrace
Parameters• caller_func_addr (int)• block_addr (int | None)

10.15. Analysis

1073

angr

includes_function(func_addr)
Return typebool
Parameters
func_addr (int)copy()
Return type
CallTraceclass angr.analyses.reaching_definitions.engine_vex.SimEngineRDVEX(project, functions=None,
function_handler=None)
Bases: SimEngineLightVEXMixin, SimEngineLight
Implements the VEX execution engine for reaching definition analysis.
__init__(project, functions=None, function_handler=None)state:

ReachingDefinitionsState

process(state, *args, block=None, fail_fast=False, visited_blocks=None, dep_graph=None, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)1074

Chapter 10. API Referenceangrclass angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis(subject=None,func_graph=None
max_iterations=3
track_tmps=False
track_consts=Tru
observation_points=None
init_state=None,
init_context=Nonstate_initializer=N
cc=None,function_handler=No
observe_all=False,
visited_blocks=None
dep_graph=True,observe_callback=N
canonical_size=8,
stack_pointer_tra
use_callee_saved
interfunction_level=0,
track_liveness=Tr
func_addr=None,element_limit=5,
merge_into_tops=
Bases: ForwardAnalysis[ReachingDefinitionsState, NodeType, object, object], Analysis
ReachingDefinitionsAnalysis is a text-book implementation of a static data-flow analysis that works on either afunction or a block. It supports both VEX and AIL. By registering observers to observation points, users may use
this analysis to generate use-def chains, def-use chains, and reaching definitions, and perform other traditional
data-flow analyses such as liveness analysis.
• I’ve always wanted to find a better name for this analysis. Now I gave up and decided to live with this namefor the foreseeable future (until a better name is proposed by someone else).
• Aliasing is definitely a problem, and I forgot how aliasing is resolved in this implementation. I’ll leave thisas a post-graduation TODO.
• Some more documentation and examples would be nice.
Parameters• subject (Subject | ailment.Block | Block | Function | str)
• observation_points (Iterable[ObservationPoint] | None)
10.15. Analysis

1075

angr

• init_state (ReachingDefinitionsState)• state_initializer (RDAStateInitializer | None)• function_handler (FunctionHandler | None)• dep_graph (DepGraph | bool | None)• interfunction_level (int)• track_liveness (bool)• func_addr (int | None)• element_limit (int)• merge_into_tops (bool)__init__(subject=None, func_graph=None, max_iterations=30, track_tmps=False, track_consts=True,observation_points=None, init_state=None, init_context=None, state_initializer=None, cc=None,
function_handler=None, observe_all=False, visited_blocks=None, dep_graph=True,observe_callback=None, canonical_size=8, stack_pointer_tracker=None,
use_callee_saved_regs_at_return=True, interfunction_level=0, track_liveness=True,
func_addr=None, element_limit=5, merge_into_tops=True)
Parameters• subject (Union[Subject, Block, Block, Function, str, None]) – The subject of theanalysis: a function, or a single basic block• func_graph – Alternative graph for function.graph.
• max_iterations – The maximum number of iterations before the analysis is terminated.
• track_tmps – Whether or not temporary variables should be taken into consideration
during the analysis.
• observation_points (iterable) – A collection of tuples of (“node”|”insn”, ins_addr,
OP_TYPE) defining where reaching definitions should be copied and stored. OP_TYPE
can be OP_BEFORE or OP_AFTER.
• init_state (Optional[ReachingDefinitionsState]) – An optional initialization
state. The analysis creates and works on a copy. Default to None: the analysis then initialize
its own abstract state, based on the given <Subject>.
• init_context – If init_state is not given, this is used to initialize the context field of theinitial state’s CodeLocation. The only default-supported type which may go here is a tupleof integers, i.e. a callstack. Anything else requires a custom FunctionHandler.
• cc – Calling convention of the function.
• function_handler (Optional[FunctionHandler]) – The function handler to update
the analysis state and results on function calls.
• observe_all – Observe every statement, both before and after.
• visited_blocks – A set of previously visited blocks.
• dep_graph (DepGraph | bool | None) – An initial dependency graph to add the result of
the analysis to. Set it to None to skip dependency graph generation.
• canonical_size – The sizes (in bytes) that objects with an UNKNOWN_SIZE are treatedas for operations where sizes are necessary.

1076

Chapter 10. API Referenceangr• dep_graph – Set this to True to generate a dependency graph for the subject. It will beavailable as result.dep_graph.
• interfunction_level (int) – The number of functions we should recurse into. Thisparameter is only used if function_handler is not provided.
• track_liveness (bool) – Whether to track liveness information. This can consume sizeable amounts of RAM on large functions. (e.g. ~15GB for a function with 4k nodes)• merge_into_tops (bool) – Merge known values into TOP if TOP is present. If True:{TOP} V {0xabc} = {TOP} If False: {TOP} V {0xabc} = {TOP, 0xabc}• state_initializer (RDAStateInitializer | None)• func_addr (int | None)• element_limit (int)property observed_results:

dict[tuple[str, int, int], LiveDefinitions]

property all_definitions
property all_uses
property one_result
property dep_graph:

DepGraph

property visited_blocks
get_reaching_definitions(**kwargs)
get_reaching_definitions_by_insn(ins_addr, op_type)
get_reaching_definitions_by_node(node_addr, op_type)
node_observe(node_addr, state, op_type, node_idx=None)
Parameters• node_addr (int) – Address of the node.
• state (ReachingDefinitionsState) – The analysis state.
• op_type (ObservationPointType) – Type of the observation point. Must be one of thefollowing: OP_BEFORE, OP_AFTER.
• node_idx (Optional[int]) – ID of the node. Used in AIL to differentiate blocks with thesame address.
Return type
Noneinsn_observe(insn_addr, stmt, block, state, op_type)
Parameters• insn_addr (int) – Address of the instruction.
• stmt (Statement | IRStmt) – The statement.
• block (Block | Block) – The current block.
• state (ReachingDefinitionsState) – The abstract analysis state.

10.15. Analysis

1077

angr

• op_type (ObservationPointType) – Type of the observation point. Must be one of thefollowing: OP_BEORE, OP_AFTER.
Return type
None
stmt_observe(stmt_idx, stmt, block, state, op_type)
Parameters• stmt_idx (int)• stmt (Statement | IRStmt)• block (Block | Block)• state (ReachingDefinitionsState)• op_type (ObservationPointType)
Return type
None
Returns
exit_observe(node_addr, exit_stmt_idx, block, state, node_idx=None)
Parameters• node_addr (int)• exit_stmt_idx (int)• block (Block | Block)• state (ReachingDefinitionsState)• node_idx (int | None)
property subject
callsites_to(target)
Return type
Iterable[FunctionCallRelationships]
Parameters
target (int | str | Function)
class angr.analyses.reaching_definitions.dep_graph.FunctionCallRelationships(callsite, target,
args_defns,
other_input_defns,
ret_defns,
other_output_defns)
Bases: object
Parameters• callsite (CodeLocation)• target (int | None)• args_defns (list[set[Definition]])• other_input_defns (set[Definition])• ret_defns (set[Definition])
1078

Chapter 10. API Referenceangr• other_output_defns (set[Definition])callsite:target:CodeLocation
int | Noneargs_defns:

list[set[Definition]]other_input_defns:
ret_defns:

set[Definition]

set[Definition]other_output_defns:

set[Definition]__init__(callsite, target, args_defns, other_input_defns, ret_defns, other_output_defns)
Parameters• callsite (CodeLocation)• target (int | None)• args_defns (list[set[Definition]])• other_input_defns (set[Definition])• ret_defns (set[Definition])• other_output_defns (set[Definition])
Return type
Noneclass angr.analyses.reaching_definitions.dep_graph.DepGraph(graph=None)
Bases: object
The representation of a dependency graph: a directed graph, where nodes are definitions, and edges represent
uses.
Mostly a wrapper around a <networkx.DiGraph>.
Parametersgraph (networkx.DiGraph [Definition] | None)__init__(graph=None)
Parametersgraph – A graph where nodes are definitions, and edges represent uses.
property graph:

networkx.DiGraph[Definition]

add_node(node)Parametersnode (Definition) – The definition to add to the definition-use graph.
Return typeNone
add_edge(source, destination, **labels)
The edge to add to the definition-use graph. Will create nodes that are not yet present.
Parameters• source (Definition) – The “source” definition, used by the “destination”.
10.15. Analysis

1079

angr

• destination (Definition) – The “destination” definition, using the variable defined by“source”.
• labels – Optional keyword arguments to represent edge labels.
Return type
None
nodes()
Return type
NodeView[Definition]predecessors(node)Parametersnode (Definition) – The definition to get the predecessors of.
Return type
Iterator[Definition]transitive_closure(definition)
Compute the “transitive closure” of a given definition. Obtained by transitively aggregating the ancestorsof this definition in the graph.
Note: Each definition is memoized to avoid any kind of recomputation across the lifetime of this object.
Parameters
definition – The Definition to get transitive closure for.
Returns
A graph of the transitive closure of the given definition.
Return typenetworkx.DiGraph[Definition[Atom]]contains_atom(atom)
Return typebool
Parametersatom (Atom)
add_dependencies_for_concrete_pointers_of(values, definition, cfg, loader)
When a given definition holds concrete pointers, make sure the <MemoryLocation>s they point to arepresent in the dependency graph; Adds them if necessary.
Parameters• values (Iterable[Base | int])• definition (Definition) – The definition which has data that can contain concrete
pointers.
• cfg (CFGModel) – The CFG, containing information about memory data.
• loader (Loader)
find_definitions(**kwargs)
Filter the definitions present in the graph based on various criteria. Parameters can be any valid keyword
args to DefinitionMatchPredicate

1080

Chapter 10. API ReferenceangrReturn type
list[Definition]find_all_predecessors(starts, **kwargs)
Filter the ancestors of the given start node or nodes that match various criteria. Parameters can be any valid
keyword args to DefinitionMatchPredicate
find_all_successors(starts, **kwargs)
Filter the descendents of the given start node or nodes that match various criteria. Parameters can be any
valid keyword args to DefinitionMatchPredicate
Return type
list[Definition]
Parameters
starts (Definition | Iterable[Definition])
find_path(starts, ends, **kwargs)
Find a path between the given start node or nodes and the given end node or nodes. All the intermediate
steps in the path must match the criteria given in kwargs. The kwargs can be any valid parameters to
DefinitionMatchPredicate.
This algorithm has exponential time and space complexity. Use at your own risk. Want to do better? Do it
yourself or use networkx and eat the cost of indirection and/or cloning.
Return typetuple[Definition, ...] | None
Parameters• starts (Definition | Iterable[Definition])• ends (Definition | Iterable[Definition])
find_paths(starts, ends, **kwargs)
Find all non-overlapping simple paths between the given start node or nodes and the given end node ornodes. All the intermediate steps in the path must match the criteria given in kwargs. The kwargs can be
any valid parameters to DefinitionMatchPredicate.
This algorithm has exponential time and space complexity. Use at your own risk. Want to do better? Do it
yourself or use networkx and eat the cost of indirection and/or cloning.
Return type
Iterator[tuple[Definition, ...]]
Parameters• starts (Definition | Iterable[Definition])• ends (Definition | Iterable[Definition])class angr.analyses.reaching_definitions.heap_allocator.HeapAllocator(canonical_size)
Bases: object
A simple modelisation to help represent heap memory management during a <ReachingDefinitionsAnalysis>:- Act as if allocations were always done in consecutive memory segments; - Take care of the size not to screw
potential pointer arithmetic (avoid overlapping segments).
The content of the heap itself is modeled using a <KeyedRegion> attribute in the <LiveDefinitions> state; This
class serves to generate consistent heap addresses to be used by the aforementioned.
Note: This has NOT been made to help detect heap vulnerabilities.

10.15. Analysis

1081

angr

Parameterscanonical_size (int)__init__(canonical_size)
Parameterscanonical_size (int) – The concrete size an <UNKNOWN_SIZE> defaults to.
allocate(size)
Gives an address for a new memory chunk of <size> bytes.
Parameters
size (int | UnknownSize) – The requested size for the chunk, in number of bytes.
Return type
HeapAddress
Returns
The address of the chunk.
free(address)
Mark the chunk pointed by <address> as freed.
Parameters
address (Undefined | HeapAddress) – The address of the chunk to free.
property allocated_addresses
The list of addresses that are currently allocated on the heap.
Type
returnangr.analyses.reaching_definitions.function_handler.get_exit_livedefinitions(func,
rda_model)
Get LiveDefinitions at all exits of a function, merge them, and return.
Parameters• func (Function)• rda_model (ReachingDefinitionsModel)
class angr.analyses.reaching_definitions.function_handler.FunctionEffect(dest,
sources, value=None,sources_defns=None,
apply_at_callsite=False,
tags=None)
Bases: object
A single effect that a function summary may apply to the state. This is largely an implementation detail; use
FunctionCallData.depends instead.
Parameters• dest (Atom | None)• sources (set[Atom])• value (MultiValues | None)• sources_defns (set[Definition] | None)

1082

Chapter 10. API Referenceangr• apply_at_callsite (bool)• tags (set[Tag] | None)
dest:

Atom | Nonesources:value:

set[Atom ]MultiValues | None = Nonesources_defns:

set[Definition] | None = None

apply_at_callsite:tags:bool = False

set[Tag] | None = None__init__(dest, sources, value=None, sources_defns=None, apply_at_callsite=False, tags=None)
Parameters• dest (Atom | None)• sources (set[Atom])• value (MultiValues | None)• sources_defns (set[Definition] | None)• apply_at_callsite (bool)• tags (set[Tag] | None)
Return type
Noneclass angr.analyses.reaching_definitions.function_handler.FunctionCallData(callsite_codeloc,
function_codeloc,
address_multi,
address=None,symbol=None,
function=None,
name=None,
cc=None,prototype=None,args_atoms=None,args_values=None,
ret_atoms=None,redefine_locals=True,
visited_blocks=None,effects=<factory>,
ret_values=None,
ret_values_deps=None,
caller_will_handle_single_ret=False,
guessed_cc=False,
guessed_prototype=False,
retaddr_popped=False)

10.15. Analysis

1083

angr

Bases: object
A bundle of intermediate data used when computing the sum effect of a function during ReachingDefinitionsAnalysis.
RDA engine contract:• Construct one of these before calling FunctionHandler.handle_function. Fill it with as many fields as you
can realistically provide without duplicating effort.
• Provide callsite_codeloc as either the call statement (AIL) or the default exit of the default statement of thecalling block (VEX)• Provide function_codeloc as the callee address with stmt_idx=0`.
Function handler contract:• If redefine_locals is unset, do not adjust any artifacts of the function call abstraction, such as the stack
pointer, the caller saved registers, etc.
• If caller_will_handle_single_ret is set, and there is a single entry in ret_atoms, do not apply to the state
effects modifying this atom. Instead, set ret_values and ret_values_deps to the values and deps which areused constructing these values.
Parameters• callsite_codeloc (CodeLocation)• function_codeloc (CodeLocation)• address_multi (MultiValues | None)• address (int | None)• symbol (Symbol | None)• function (Function | None)• name (str | None)• cc (SimCC | None)• prototype (SimTypeFunction | None)• args_atoms (list[set[Atom]] | None)• args_values (list[MultiValues] | None)• ret_atoms (set[Atom] | None)• redefine_locals (bool)• visited_blocks (set[int] | None)• effects (list[FunctionEffect])• ret_values (MultiValues | None)• ret_values_deps (set[Definition] | None)• caller_will_handle_single_ret (bool)• guessed_cc (bool)• guessed_prototype (bool)• retaddr_popped (bool)

1084

Chapter 10. API Referenceangrcallsite_codeloc:

CodeLocation

function_codeloc:

CodeLocation

address_multi:

MultiValues | None

address:

int | None = Nonesymbol:Symbol | None = None

function:

Function | None = Nonename:str | None = None

cc:

SimCC | None = None

prototype:

SimTypeFunction | None = Noneargs_atoms:

list[set[Atom ]] | None = Noneargs_values:

list[MultiValues] | None = None

ret_atoms:

set[Atom ] | None = Noneredefine_locals:bool = True

visited_blocks:

set[int] | None = Noneeffects:list[FunctionEffect]

ret_values:

MultiValues | None = None

ret_values_deps:set[Definition] | None = None

caller_will_handle_single_ret:
guessed_cc:bool = False

bool = False

guessed_prototype:retaddr_popped:bool = False

bool = False

has_clobbered(dest)
Determines whether the given atom already has effects applied
Return typebool
Parameters
dest (Atom)depends(dest, *sources, value=None, apply_at_callsite=False, tags=None)
Mark a single effect of the current function, including the atom being modified, the input atoms on whichthat output atom depends, the precise (or imprecise!) value to store, and whether the effect should beapplied during the function or afterwards, at the callsite.
The tags are used to annotate the Definition of the Atom that will be created, when the function effects areapplied to the state.
The atom being modified may be None to mark uses of the source atoms which do not have any explicit
sinks.

10.15. Analysis

1085

angr

Parameters• dest (Atom | Iterable[Atom] | None)• sources (Atom | Iterable[Atom])• value (MultiValues | BV | bytes | int | None)• apply_at_callsite (bool)• tags (set[Tag] | None)
reset_prototype(prototype, state, soft_reset=False)
Return typeset[Atom]Parameters• prototype (SimTypeFunction)• state (ReachingDefinitionsState)• soft_reset (bool)__init__(callsite_codeloc, function_codeloc, address_multi, address=None, symbol=None, function=None,
name=None, cc=None, prototype=None, args_atoms=None, args_values=None, ret_atoms=None,redefine_locals=True, visited_blocks=None, effects=<factory>, ret_values=None,
ret_values_deps=None, caller_will_handle_single_ret=False, guessed_cc=False,
guessed_prototype=False, retaddr_popped=False)
Parameters• callsite_codeloc (CodeLocation)• function_codeloc (CodeLocation)• address_multi (MultiValues | None)• address (int | None)• symbol (Symbol | None)• function (Function | None)• name (str | None)• cc (SimCC | None)• prototype (SimTypeFunction | None)• args_atoms (list[set[Atom]] | None)• args_values (list[MultiValues] | None)• ret_atoms (set[Atom] | None)• redefine_locals (bool)• visited_blocks (set[int] | None)• effects (list[FunctionEffect])• ret_values (MultiValues | None)• ret_values_deps (set[Definition] | None)• caller_will_handle_single_ret (bool)

1086

Chapter 10. API Referenceangr• guessed_cc (bool)• guessed_prototype (bool)• retaddr_popped (bool)
Return type
Noneclass angr.analyses.reaching_definitions.function_handler.FunctionCallDataUnwrapped(inner)
Bases: FunctionCallData
A subclass of FunctionCallData which asserts that many of its members are non-None at construction time.
Typechecks be gone!
Parameters
inner (FunctionCallData)
address_multi:

MultiValues__init__(inner)
Parameters
inner (FunctionCallData)static decorate(wrapper, *, wrapped=<function FunctionCallDataUnwrapped.decorate>,
assigned=('__module__', '__name__', '__qualname__', '__doc__', '__annotations__'),
updated=('__dict__', ))Update a wrapper function to look like the wrapped function
wrapper is the function to be updated wrapped is the original function assigned is a tuple naming the attributes assigned directly from the wrapped function to the wrapper function (defaults
to functools.WRAPPER_ASSIGNMENTS) updated is a tuple naming the attributes of the wrapper that are updated with the corresponding attribute from the wrapped function (defaults to functools.WRAPPER_UPDATES)
class angr.analyses.reaching_definitions.function_handler.FunctionHandler(interfunction_level=0,
extra_impls=None)
Bases: object
A mechanism for summarizing a function call’s effect on a program for ReachingDefinitionsAnalysis.
Parameters• interfunction_level (int)• extra_impls (Iterable[FunctionHandler] | None)__init__(interfunction_level=0, extra_impls=None)
Parameters• interfunction_level (int)• extra_impls (Iterable[FunctionHandler] | None)hook(analysis)
Attach this instance of the function handler to an instance of RDA.
Return type
FunctionHandler
Parameters
analysis (ReachingDefinitionsAnalysis)
10.15. Analysis

1087

angr

make_function_codeloc(target, callsite, callsite_func_addr)
The RDA engine will call this function to transform a callsite CodeLocation into a callee CodeLocation.
Parameters• target (None | int | MultiValues)• callsite (CodeLocation)• callsite_func_addr (int | None)
handle_function(state, data)
The main entry point for the function handler. Called with a RDA state and a FunctionCallData, it isexpected to update the state and the data as per the contracts described on FunctionCallData.
You can override this method to take full control over how data is processed, or override any of the following
to use the higher-level interface (data.depends()):• handle_impl_<function name> - used for <function name>.
• handle_local_function - used for any function (excluding plt stubs) whose address is inside the mainbinary.
• handle_external_function - used for any function or plt stub whose address is outside the main binary.
• handle_indirect_function - used for any function whose target cannot be resolved.
• handle_generic_function - used as a default if none of the above are overridden.
Each of them take the same signature as handle_function.
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
handle_generic_function(state, data)
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
handle_indirect_function(state, data)
Return type
None
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
handle_local_function(state, data)
Return type
None
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)

1088

Chapter 10. API Referenceangrhandle_external_function(state, data)
Return type
None
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
recurse_analysis(state, data)
Precondition: data.function MUST NOT BE NONE in order to call this method.
Return type
None
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)static c_args_as_atoms(state, cc, prototype)
Return type
list[set[Atom]]Parameters• state (ReachingDefinitionsState)• cc (SimCC)• prototype (SimTypeFunction)
static c_return_as_atoms(state, cc, prototype)
Return typeset[Atom]Parameters• state (ReachingDefinitionsState)• cc (SimCC)• prototype (SimTypeFunction)
static caller_saved_regs_as_atoms(state, cc)
Return typeset[Register]
Parameters• state (ReachingDefinitionsState)• cc (SimCC)
static stack_pointer_as_atom(state)
Return type
Register

10.15. Analysis

1089

angr

class angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState(codeloc, arch,
subject,
track_tmps=False,
track_consts=False,
analysis=None,
rtoc_value=None,
live_definitions=None,
canonical_size=8,
heap_allocator=None,environment=None,sp_adjusted=False,
all_definitions=None,
initializer=None,element_limit=5,
merge_into_tops=True)
Bases: object
Represents the internal state of the ReachingDefinitionsAnalysis.
It contains a data class LiveDefinitions, which stores both definitions and uses for register, stack, memory, andtemporary variables, uncovered during the analysis.
Parameters• subject (Subject) – The subject being analyzed.
• track_tmps (bool) – Only tells whether or not temporary variables should be taken into
consideration when representing the state of the analysis. Should be set to true when theanalysis has counted uses and definitions for temporary variables, false otherwise.
• analysis (Optional[ReachingDefinitionsAnalysis]) – The analysis that generated
the state represented by this object.
• rtoc_value – When the targeted architecture is ppc64, the initial function needs to know
the rtoc_value.
• live_definitions (Optional[LiveDefinitions])• canonical_size (int) – The sizes (in bytes) that objects with an UNKNOWN_SIZE aretreated as for operations where sizes are necessary.
• heap_allocator (Optional[HeapAllocator]) – Mechanism to model the managementof heap memory.
• environment (Optional[Environment]) – Representation of the environment of the analyzed program.
• codeloc (CodeLocation)• arch (Arch )• track_consts (bool)• sp_adjusted (bool)• all_definitions (set[Definition[A]])• initializer (RDAStateInitializer | None)• element_limit (int)• merge_into_tops (bool)

1090

Chapter 10. API ReferenceangrVariables
arch – The architecture targeted by the program.
__init__(codeloc, arch, subject, track_tmps=False, track_consts=False, analysis=None, rtoc_value=None,
live_definitions=None, canonical_size=8, heap_allocator=None, environment=None,sp_adjusted=False, all_definitions=None, initializer=None, element_limit=5,
merge_into_tops=True)
Parameters• codeloc (CodeLocation)• arch (Arch )• subject (Subject)• track_tmps (bool)• track_consts (bool)• analysis (ReachingDefinitionsAnalysis | None)• live_definitions (LiveDefinitions | None)• canonical_size (int)• heap_allocator (HeapAllocator | None)• environment (Environment | None)• sp_adjusted (bool)• all_definitions (set[Definition[A]] | None)• initializer (RDAStateInitializer | None)• element_limit (int)• merge_into_tops (bool)
codeloc
arch:

Arch

analysisall_definitions:set[Definition[TypeVar(A, bound= Atom )]]heap_allocator
codeloc_uses:

set[Definition[TypeVar(A, bound= Atom )]]exit_observed:bool

live_definitions
top(bits)
Parametersbits (int)
is_top(*args)

10.15. Analysis

1091

angr

heap_address(offset)
Return type
BV
Parameters
offset (int | HeapAddress)
static is_heap_address(addr)
Return typebool
Parametersaddr (Base)static get_heap_offset(addr)
Return type
int | None
Parametersaddr (Base)stack_address(offset)
Return type
BV
Parameters
offset (int)
is_stack_address(addr)
Return typebool
Parametersaddr (Base)
get_stack_offset(addr)
Return type
int | None
Parametersaddr (Base)annotate_with_def(symvar, definition)
Parameters• symvar (Base)• definition (Definition[TypeVar(A, bound= Atom)])
Return type
Base
Returns

1092

Chapter 10. API Referenceangrannotate_mv_with_def(mv, definition)
Return typeMultiValues
Parameters• mv (MultiValues)• definition (Definition[A])extract_defs(symvar)
Return type
Iterator[Definition[TypeVar(A, bound= Atom)]]
Parameterssymvar (Base)
property tmps
property tmp_uses
property register_uses
property registers:
property stack:MultiValuedMemory

MultiValuedMemory

property stack_uses
property heap:

MultiValuedMemory

property heap_uses
property memory_uses
property memory:

MultiValuedMemory

property uses_by_codeloc
get_sp()Return typeint
get_stack_address(offset)
Return type
int
Parameters
offset (Base)
property environment
property dep_graphcopy(discard_tmpdefs=False)
Return type
ReachingDefinitionsState

10.15. Analysis

1093

angr

merge(*others)
Return typetuple[ReachingDefinitionsState, bool]
compare(other)
Return typebool
Parameters
other (ReachingDefinitionsState)
move_codelocs(new_codeloc)
Return type
None
Parameters
new_codeloc (CodeLocation)kill_definitions(atom)
Overwrite existing definitions w.r.t ‘atom’ with a dummy definition instance. A dummy definition will not
be removed during simplification.
Return type
None
Parametersatom (Atom)
kill_and_add_definition(atom, data, dummy=False, tags=None, endness=None, annotated=False,
uses=None, override_codeloc=None)
Return typetuple[MultiValues | None, set[Definition[TypeVar(A, bound= Atom)]]]Parameters• atom (Atom)• data (MultiValues)• tags (set[Tag] | None)• annotated (bool)• uses (set[Definition[A]] | None)• override_codeloc (CodeLocation | None)
add_use(atom, expr=None)
Return type
None
Parameters• atom (Atom)• expr (Any | None)

1094

Chapter 10. API Referenceangr

add_use_by_def(definition, expr=None)
Return type
None
Parameters• definition (Definition[A])• expr (Any | None)
add_tmp_use(tmp, expr=None)
Return type
None
Parameters• tmp (int)• expr (Any | None)
add_tmp_use_by_defs(defs, expr=None)
Return type
None
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
add_register_use(reg_offset, size, expr=None)
Return type
None
Parameters• reg_offset (int)• size (int)• expr (Any | None)
add_register_use_by_defs(defs, expr=None)
Return type
None
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
add_stack_use(stack_offset, size, expr=None)
Return type
None
Parameters• stack_offset (int)• size (int)

10.15. Analysis

1095

angr

• expr (Any | None)
add_stack_use_by_defs(defs, expr=None)
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
add_heap_use(heap_offset, size, expr=None)
Return type
None
Parameters• heap_offset (int)• size (int)• expr (Any | None)
add_heap_use_by_defs(defs, expr=None)
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
add_memory_use_by_def(definition, expr=None)
Parameters• definition (Definition[A])• expr (Any | None)
add_memory_use_by_defs(defs, expr=None)
Parameters• defs (Iterable[Definition[A]])• expr (Any | None)
get_definitions(atom)
Return typeset[Definition[TypeVar(A, bound= Atom)]]
Parametersatom (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])get_values(spec)
Return typeMultiValues | None
Parametersspec (A | Definition[A] | Iterable[A])1096

Chapter 10. API Referenceangr

get_one_value(spec, strip_annotations=False)
Return type
BV | None
Parameters• spec (A | Definition[A] | Iterable[A] | Iterable[Definition[A]])• strip_annotations (bool)
get_concrete_value(spec, cast_to=<class 'int'>)
Return type
int | bytes | None
Parameters• spec (A | Definition[A] | Iterable[A])• cast_to (type[int] | type[bytes])
mark_guard(target)
mark_const(value, size)
Parameters• value (int)• size (int)
downsize()
pointer_to_atoms(**kwargs)
pointer_to_atom(**kwargs)
deref(pointer, size, endness=Endness.BE)
Parameters• pointer(MultiValues | A | Definition | Iterable[A] |Iterable[Definition[A]] | int | BV | HeapAddress | SpOffset)• size (int | DerefSize)• endness (str)class angr.analyses.reaching_definitions.subject.SubjectType(value)
Bases: Enum
An enumeration.
Function = 1
Block = 2
CallTrace = 3
class angr.analyses.reaching_definitions.subject.Subject(content, func_graph=None, cc=None)
Bases: object

10.15. Analysis

1097

angr

__init__(content, func_graph=None, cc=None)
The thing being analysed, and the way (visitor) to analyse it.
Parameters• content (Union[ailment.Block, angr.Block, Function]) – Thing to be analysed.
• func_graph (networkx.DiGraph ) – Alternative graph for function.graph.
• cc (SimCC) – Calling convention of the function.
property cc
property content
property func_graphproperty typeproperty visitor:

FunctionGraphVisitor | SingleNodeGraphVisitor

class angr.analyses.reaching_definitions.engine_ail.SimEngineRDAIL(project,
function_handler=None,
stack_pointer_tracker=None,
use_callee_saved_regs_at_return=True,
bp_as_gpr=False)
Bases: SimEngineLightAILMixin, SimEngineLight
Parameters• function_handler (FunctionHandler | None)• bp_as_gpr (bool)
arch:archinfo.Arch

state:

ReachingDefinitionsState__init__(project, function_handler=None, stack_pointer_tracker=None,
use_callee_saved_regs_at_return=True, bp_as_gpr=False)
Parameters• function_handler (FunctionHandler | None)• bp_as_gpr (bool)process(state, *args, dep_graph=None, visited_blocks=None, block=None, fail_fast=False, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)class angr.analyses.cfg_slice_to_sink.CFGSliceToSink(target, transitions=None)
Bases: object
The representation of a slice of a CFG.

1098

Chapter 10. API Referenceangr__init__(target, transitions=None)
Parameters• target (angr.knowledge_plugins.functions.function.Function) – The targeted sink, to which every path in the slice leads.
• transitions (Dict[int,List[int]]) – A mapping representing transitions in thegraph. Indexes are source addresses and values a list of destination addresses, for which
there exists a transition in the slice from source to destination.
property transitions
The transitions in the slice.
Type
return Dict[int,List[int]]
property transitions_as_tuples
The list of transitions as pairs of (source, destination).
Type
return List[Tuple[int,int]]
property target
return angr.knowledge_plugins.functions.function.Function: The targeted sink function, from which theslice is constructed.
property nodes:

list[int]

The complete list of addresses present in the slice.
Type
returnproperty entrypoints
Entrypoints are all source addresses that are not the destination address of any transition.
Return List[int]The list of entrypoints addresses.
add_transitions(transitions)
Add the given transitions to the current slice.
Parameterstransitions (Dict[int,List[int]]) – The list of transitions to be added toself.transitions.
Return Dict[int,List[int]]
Return the updated list of transitions.
is_empty()
Test if a given slice does not contain any transition.
Return bool
True if the <CFGSliceToSink> instance does not contain any transitions. False otherwise.
path_between(source, destination, visited=None)
Check the existence of a path in the slice between two given node addresses.
Parameters• source (int) – The source address.

10.15. Analysis

1099

angr

• destination (int) – The destination address.
• visited (Optional[set[Any]]) – Used to avoid infinite recursion if loops are present in
the slice.
Return typebool
Returns
True if there is a path between the source and the destination in the CFG, False if not, or if
we have been unable to decide (because of loops).
angr.analyses.cfg_slice_to_sink.slice_callgraph(callgraph, cfg_slice_to_sink)Slice a callgraph, keeping only the nodes present in the <CFGSliceToSink> representation, and th transitions forwhich a path exists.
Note that this function mutates the graph passed as an argument.
Parameters• callgraph (networkx.MultiDiGraph ) – The callgraph to update.
• cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing thedata to update the callgraph from.
angr.analyses.cfg_slice_to_sink.slice_cfg_graph(graph, cfg_slice_to_sink)Slice a CFG graph, keeping only the transitions and nodes present in the <CFGSliceToSink> representation.
Note that this function mutates the graph passed as an argument.
Parameters• graph (networkx.DiGraph ) – The graph to slice.
• cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing thedata to update the CFG from.
Return networkx.DiGraph
The sliced graph.
angr.analyses.cfg_slice_to_sink.slice_function_graph(function_graph, cfg_slice_to_sink)Slice a function graph, keeping only the nodes present in the <CFGSliceToSink> representation.
Because the <CFGSliceToSink> is build from the CFG, and the function graph is NOT a subgraph of the CFG,
edges of the function graph will no be present in the <CFGSliceToSink> transitions. However, we use the factthat if there is an edge between two nodes in the function graph, then there must exist a path between these two
nodes in the slice; Proof idea: - The <CFGSliceToSink> is backward and recursively constructed; - If a node isin the slice, then all its predecessors will be (transitively); - If there is an edge between two nodes in the function
graph, there is a path between them in the CFG; - So: The origin node is a transitive predecessor of the destination
one, hence if destination is in the slice, then origin will be too.
In consequence, in the end, removing the only nodes not present in the slice, and their related transitions gives
us the expected result: a function graph representing (a higher view of) the flow in the slice.
Note that this function mutates the graph passed as an argument.
Parameters• graph (networkx.DiGraph ) – The graph to slice.
• cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing thedata to update the CFG from.

1100

Chapter 10. API ReferenceangrReturn networkx.DiGraph
The sliced graph.
class angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceToSink(target,transitions=None)
Bases: object
The representation of a slice of a CFG.
__init__(target, transitions=None)
Parameters• target (angr.knowledge_plugins.functions.function.Function) – The targeted sink, to which every path in the slice leads.
• transitions (Dict[int,List[int]]) – A mapping representing transitions in thegraph. Indexes are source addresses and values a list of destination addresses, for which
there exists a transition in the slice from source to destination.
property transitions
The transitions in the slice.
Type
return Dict[int,List[int]]
property transitions_as_tuples
The list of transitions as pairs of (source, destination).
Type
return List[Tuple[int,int]]
property target
return angr.knowledge_plugins.functions.function.Function: The targeted sink function, from which theslice is constructed.
property nodes:

list[int]

The complete list of addresses present in the slice.
Type
returnproperty entrypoints
Entrypoints are all source addresses that are not the destination address of any transition.
Return List[int]The list of entrypoints addresses.
add_transitions(transitions)
Add the given transitions to the current slice.
Parameterstransitions (Dict[int,List[int]]) – The list of transitions to be added toself.transitions.
Return Dict[int,List[int]]
Return the updated list of transitions.
is_empty()
Test if a given slice does not contain any transition.

10.15. Analysis

1101

angr

Return bool
True if the <CFGSliceToSink> instance does not contain any transitions. False otherwise.
path_between(source, destination, visited=None)
Check the existence of a path in the slice between two given node addresses.
Parameters• source (int) – The source address.
• destination (int) – The destination address.
• visited (Optional[set[Any]]) – Used to avoid infinite recursion if loops are present in
the slice.
Return typebool
Returns
True if there is a path between the source and the destination in the CFG, False if not, or if
we have been unable to decide (because of loops).
angr.analyses.cfg_slice_to_sink.graph.slice_callgraph(callgraph, cfg_slice_to_sink)Slice a callgraph, keeping only the nodes present in the <CFGSliceToSink> representation, and th transitions forwhich a path exists.
Note that this function mutates the graph passed as an argument.
Parameters• callgraph (networkx.MultiDiGraph ) – The callgraph to update.
• cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing thedata to update the callgraph from.
angr.analyses.cfg_slice_to_sink.graph.slice_cfg_graph(graph, cfg_slice_to_sink)Slice a CFG graph, keeping only the transitions and nodes present in the <CFGSliceToSink> representation.
Note that this function mutates the graph passed as an argument.
Parameters• graph (networkx.DiGraph ) – The graph to slice.
• cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing thedata to update the CFG from.
Return networkx.DiGraph
The sliced graph.
angr.analyses.cfg_slice_to_sink.graph.slice_function_graph(function_graph, cfg_slice_to_sink)Slice a function graph, keeping only the nodes present in the <CFGSliceToSink> representation.
Because the <CFGSliceToSink> is build from the CFG, and the function graph is NOT a subgraph of the CFG,
edges of the function graph will no be present in the <CFGSliceToSink> transitions. However, we use the factthat if there is an edge between two nodes in the function graph, then there must exist a path between these two
nodes in the slice; Proof idea: - The <CFGSliceToSink> is backward and recursively constructed; - If a node isin the slice, then all its predecessors will be (transitively); - If there is an edge between two nodes in the function
graph, there is a path between them in the CFG; - So: The origin node is a transitive predecessor of the destination
one, hence if destination is in the slice, then origin will be too.
In consequence, in the end, removing the only nodes not present in the slice, and their related transitions gives
us the expected result: a function graph representing (a higher view of) the flow in the slice.

1102

Chapter 10. API ReferenceangrNote that this function mutates the graph passed as an argument.
Parameters• graph (networkx.DiGraph ) – The graph to slice.
• cfg_slice_to_sink (CFGSliceToSink) – The representation of the slice, containing thedata to update the CFG from.
Return networkx.DiGraph
The sliced graph.
Some utilitary functions to manage our representation of transitions:
A dictionary, indexed by int (source addresses), which values are list of ints (target addresses).
angr.analyses.cfg_slice_to_sink.transitions.merge_transitions(transitions, existing_transitions)
Merge two dictionaries of transitions together.
Parameters• transitions (Dict[int,List[int]]) – Some transitions.
• existing_transitions (Dict[int,List[int]]) – Other transitions.
Return Dict[int,List[int]]
The merge of the two parameters.
class angr.analyses.stack_pointer_tracker.BottomType
Bases: object
The bottom value for register values.
class angr.analyses.stack_pointer_tracker.Constant(val)Bases: object
Represents a constant value.
__init__(val)valclass angr.analyses.stack_pointer_tracker.Register(offset, bitlen)
Bases: object
Represent a register.
__init__(offset, bitlen)
offsetbitlenclass angr.analyses.stack_pointer_tracker.OffsetVal(reg, offset)
Bases: object
Represent a value with an offset added.
__init__(reg, offset)
property reg
property offset

10.15. Analysis

1103

angr

class angr.analyses.stack_pointer_tracker.Eq(val0, val1)
Bases: object
Represent an equivalence condition.
__init__(val0, val1)
val0
val1
class angr.analyses.stack_pointer_tracker.FrozenStackPointerTrackerState(regs, memory,is_tracking_memory,
resilient)
Bases: object
Abstract state for StackPointerTracker analysis with registers and memory values being in frozensets.
__init__(regs, memory, is_tracking_memory, resilient)
regs
memoryis_tracking_memory
resilientunfreeze()merge(other, addr, reg_merge_cache, mem_merge_cache)Parameters• addr (int)• reg_merge_cache (dict[tuple[int, int], Any])• mem_merge_cache (dict[tuple[int, int], Any])class angr.analyses.stack_pointer_tracker.StackPointerTrackerState(regs, memory,is_tracking_memory,
resilient)
Bases: object
Abstract state for StackPointerTracker analysis.
Parameters
resilient (bool)__init__(regs, memory, is_tracking_memory, resilient)Parameters
resilient (bool)
regs
memoryis_tracking_memory
resilient

1104

Chapter 10. API Referenceangrgive_up_on_memory_tracking()
store(addr, val)load(addr)
get(reg)put(reg, val)copy()
freeze()merge(other, addr, reg_merge_cache, mem_merge_cache)Parameters• addr (int)• reg_merge_cache (dict[tuple[int, int], Any])• mem_merge_cache (dict[tuple[int, int], Any])
exception angr.analyses.stack_pointer_tracker.CouldNotResolveException
Bases: Exception
An exception used in StackPointerTracker analysis to represent internal resolving failures.
class angr.analyses.stack_pointer_tracker.StackPointerTracker(func, reg_offsets, block=None,
track_memory=True,
cross_insn_opt=True,
initial_reg_values=None,
resilient=True)
Bases: Analysis, ForwardAnalysis
Track the offset of stack pointer at the end of each basic block of a function.
Parameters• func (Function | None)• reg_offsets (set[int])• block (Block | None)• resilient (bool)__init__(func, reg_offsets, block=None, track_memory=True, cross_insn_opt=True,
initial_reg_values=None, resilient=True)
Parameters• func (Function | None)• reg_offsets (set[int])• block (Block | None)• resilient (bool)offset_after(addr, reg)
offset_before(addr, reg)

10.15. Analysis

1105

angr

offset_after_block(block_addr, reg)
offset_before_block(block_addr, reg)constant_after(addr, reg)constant_before(addr, reg)constant_after_block(block_addr, reg)constant_before_block(block_addr, reg)
property inconsistent
inconsistent_for(reg)offsets_for(reg)class angr.analyses.variable_recovery.annotations.StackLocationAnnotation(offset)
Bases: Annotation__init__(offset)
property eliminatable
Returns whether this annotation can be eliminated in a simplification.
Returns
True if eliminatable, False otherwise
property relocatable
Returns whether this annotation can be relocated in a simplification.
Returns
True if it can be relocated, false otherwise.
class angr.analyses.variable_recovery.annotations.VariableSourceAnnotation(block_addr,
stmt_idx,
ins_addr)
Bases: Annotation__init__(block_addr, stmt_idx, ins_addr)
property eliminatable
Returns whether this annotation can be eliminated in a simplification.
Returns
True if eliminatable, False otherwise
property relocatable
Returns whether this annotation can be relocated in a simplification.
Returns
True if it can be relocated, false otherwise.
static from_state(state)angr.analyses.variable_recovery.variable_recovery_base.parse_stack_pointer(sp)Convert multiple supported forms of stack pointer representations into stack offsets.
Parameters
sp – A stack pointer representation.
1106

Chapter 10. API ReferenceangrReturns
A stack pointer offset.
Return type
intclass angr.analyses.variable_recovery.variable_recovery_base.VariableAnnotation(addr_and_variables)
Bases: Annotation
Parameters
addr_and_variables (list[tuple[int, SimVariable]])__init__(addr_and_variables)
Parameters
addr_and_variables (list[tuple[int, SimVariable]])addr_and_variables
property relocatable
Returns whether this annotation can be relocated in a simplification.
Returns
True if it can be relocated, false otherwise.
property eliminatable
Returns whether this annotation can be eliminated in a simplification.
Returns
True if eliminatable, False otherwiseclass angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryBase(func,
max_iterations,store_live_variables,
vvar_to_vvar=None)
Bases: Analysis
The base class for VariableRecovery and VariableRecoveryFast.
Parameters• store_live_variables (bool)• vvar_to_vvar (dict[int, int] | None)__init__(func, max_iterations, store_live_variables, vvar_to_vvar=None)
Parameters• store_live_variables (bool)• vvar_to_vvar (dict[int, int] | None)
get_variable_definitions(block_addr)
Get variables that are defined at the specified block.
Parameters
block_addr (int) – Address of the block.
Returns
A set of variables.
initialize_dominance_frontiers()

10.15. Analysis

1107

angr

class angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase(block_addr,
analysis,
arch,
func,
stack_region=None,
register_region=None,
global_region=None,
typevars=None,
type_constraints=Non
func_typevar=None,delayed_type_constrain
stack_offset_typevars=
project=None)
Bases: object
The base abstract state for variable recovery analysis.
__init__(block_addr, analysis, arch, func, stack_region=None, register_region=None, global_region=None,
typevars=None, type_constraints=None, func_typevar=None, delayed_type_constraints=None,
stack_offset_typevars=None, project=None)
static top(bits)
Return type
BV
static is_top(thing)
Return typebool
static extract_variables(expr)
Return type
Generator[tuple[int, SimVariable | SpOffset]]Parameters
expr (Base)static annotate_with_variables(expr, addr_and_variables)
Return type
Base
Parameters• expr (Base)• addr_and_variables (Iterable[tuple[int, SimVariable | SpOffset]])stack_address(offset)
Return type
Base

1108

Chapter 10. API ReferenceangrParameters
offset (int)static is_stack_address(addr)
Return typebool
Parametersaddr (Base)is_global_variable_address(addr)
Return typebool
Parametersaddr (Base)static extract_stack_offset_from_addr(addr)
Return type
Base | None
Parametersaddr (Base)
get_stack_offset(addr)
Return type
int | None
Parametersaddr (Base)stack_addr_from_offset(offset)
Return type
int
Parameters
offset (int)property func_addr
property dominance_frontiers
property variable_manager
property variables
get_variable_definitions(block_addr)
Get variables that are defined at the specified block.
Parameters
block_addr (int) – Address of the block.
Returns
A set of variables.

10.15. Analysis

1109

angr

add_type_constraint(constraint)
Add a new type constraint.
Parametersconstraint
Returns
add_type_constraint_for_function(func_typevar, constraint)
Add a new type constraint for a specified function.
Parameters• func_typevar• constraint
Returnsdownsize()
Remove unnecessary members.
Return type
None
ReturnsNonestatic downsize_region(region)
Get rid of unnecessary references in region so that it won’t avoid garbage collection on those referenced
objects.
Parameters
region (MultiValuedMemory) – A MultiValuedMemory region.
Return typeMultiValuedMemory
ReturnsNoneclass angr.analyses.variable_recovery.variable_recovery_fast.VariableRecoveryFastState(block_addr,
analysis,
arch,
func,
stack_region=None,
register_region=None,
global_region=None,
typevars=None,
type_constraints=Non
func_typevar=None,delayed_type_constrain
stack_offset_typevars=
project=None,
ret_val_size=None)
1110

Chapter 10. API ReferenceangrBases: VariableRecoveryStateBase
The abstract state of variable recovery analysis.
Variables• stack_region (KeyedRegion) – The stack store.
• register_region (KeyedRegion) – The register store.
__init__(block_addr, analysis, arch, func, stack_region=None, register_region=None, global_region=None,
typevars=None, type_constraints=None, func_typevar=None, delayed_type_constraints=None,
stack_offset_typevars=None, project=None, ret_val_size=None)copy()
merge(others, successor=None)
Merge two abstract states.
For any node A whose dominance frontier that the current node (at the current program location) belongs
to, we create a phi variable V’ for each variable V that is defined in A, and then replace all existence of Vwith V’ in the merged abstract state.
Parameters
others (tuple[VariableRecoveryFastState]) – Other abstract states to merge.
Return typetuple[VariableRecoveryFastState, bool]
Returns
The merged abstract state.
downsize()
Remove unnecessary members.
Return type
None
ReturnsNoneclass angr.analyses.variable_recovery.variable_recovery_fast.VariableRecoveryFast(func,
func_graph=None,
max_iterations=2,
low_priority=False,
track_sp=True,
func_args=None,store_live_variables=False,
unify_variables=True,
func_arg_vvars=None,vvar_to_vvar=None)
Bases: ForwardAnalysis, VariableRecoveryBase
Recover “variables” from a function by keeping track of stack pointer offsets and pattern matching VEX statements.
If calling conventions are recovered prior to running VariableRecoveryFast, variables can be recognized moreaccurately. However, it is not a requirement. In this case, the function graph you pass must contain information
indicating the call-out sites inside the analyzed function. These graph edges must be annotated with either"type": "call" or "outside": True.
10.15. Analysis

1111

angr

Parameters• func (Function | str | int)
• func_graph (networkx.DiGraph | None)• max_iterations (int)• func_args (list[SimVariable] | None)• func_arg_vvars (dict[int, tuple[VirtualVariable, SimVariable]] | None)• vvar_to_vvar (dict[int, int] | None)__init__(func, func_graph=None, max_iterations=2, low_priority=False, track_sp=True, func_args=None,store_live_variables=False, unify_variables=True, func_arg_vvars=None, vvar_to_vvar=None)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• func (Function | str | int)
• func_graph (DiGraph | None)• max_iterations (int)• func_args (list[SimVariable] | None)• func_arg_vvars
None)(dict[int, tuple[VirtualVariable, SimVariable]] |• vvar_to_vvar (dict[int, int] | None)
ReturnsNoneclass angr.analyses.variable_recovery.variable_recovery.VariableRecoveryState(block_addr,
analysis, arch,func, concrete_states,
stack_region=None,
register_region=None)
Bases: VariableRecoveryStateBase
The abstract state of variable recovery analysis.
Variables
variable_manager (angr.knowledge.variable_manager.VariableManager) – Thevariable manager.
__init__(block_addr, analysis, arch, func, concrete_states, stack_region=None, register_region=None)
property concrete_states

1112

Chapter 10. API Referenceangrget_concrete_state(addr)
Parameters
addr
Returnscopy()
register_callbacks(concrete_states)
Parametersconcrete_states
Returns
merge(others, successor=None)
Merge two abstract states.
Parameters
others (tuple[VariableRecoveryState]) – Other abstract states to merge.
Returns
The merged abstract state.
Return type
VariableRecoveryState, and a boolean that indicates if any merge has happened.
class angr.analyses.variable_recovery.variable_recovery.VariableRecovery(func,
max_iterations=20,
store_live_variables=False)
Bases: ForwardAnalysis, VariableRecoveryBase
Recover “variables” from a function using forced execution.
While variables play a very important role in programming, it does not really exist after compiling. However, we
can still identify and recovery their counterparts in binaries. It is worth noting that not every variable in sourcecode can be identified in binaries, and not every recognized variable in binaries have a corresponding variablein the original source code. In short, there is no guarantee that the variables we identified/recognized in a binary
are the same variables in its source code.
This analysis uses heuristics to identify and recovers the following types of variables: - Register variables. Stack variables. - Heap variables. (not implemented yet) - Global variables. (not implemented yet)This analysis takes a function as input, and performs a data-flow analysis on nodes. It runs concrete execution on
every statement and hooks all register/memory accesses to discover all places that are accessing variables. It isslow, but has a more accurate analysis result. For a fast but inaccurate variable recovery, you may consider using
VariableRecoveryFast.
This analysis follows SSA, which means every write creates a new variable in registers or memory (statck, heap,etc.). Things may get tricky when overlapping variable (in memory, as you cannot really have overlapping accesses to registers) accesses exist, and in such cases, a new variable will be created, and this new variable will
overlap with one or more existing variables. A decision procedure (which is pretty much TODO) is required at
the end of this analysis to resolve the conflicts between overlapping variables.
__init__(func, max_iterations=20, store_live_variables=False)
Parameters
func (knowledge.Function) – The function to analyze.

10.15. Analysis

1113

angr

class angr.analyses.variable_recovery.engine_ail.SimEngineVRAIL(*args, call_info=None,vvar_to_vvar, **kwargs)
Bases: SimEngineLightAILMixin, SimEngineVRBase
The engine for variable recovery on AIL.
Parameters
vvar_to_vvar (dict[int, int] | None)state:

VariableRecoveryFastState

block:

ailment.Block__init__(*args, call_info=None, vvar_to_vvar, **kwargs)
Parameters
vvar_to_vvar (dict[int, int] | None)class angr.analyses.variable_recovery.engine_vex.SimEngineVRVEX(*args, call_info=None,**kwargs)
Bases: SimEngineLightVEXMixin, SimEngineVRBase
Implements the VEX engine for variable recovery analysis.
state:

VariableRecoveryStateBase__init__(*args, call_info=None, **kwargs)
class angr.analyses.variable_recovery.engine_base.RichR(data, variable=None, typevar=None,
type_constraints=None)
Bases: object
A rich representation of calculation results. The variable recovery data domain.
Parameters• data (claripy.ast.Base)• typevar (typevars.TypeVariable | None)__init__(data, variable=None, typevar=None, type_constraints=None)
Parameters• data (Base)• typevar (TypeVariable | None)
data:

Base

variable
typevar
type_constraints
property bits
class angr.analyses.variable_recovery.engine_base.SimEngineVRBase(project, kb)
Bases: SimEngineLight
The base class for variable recovery analyses. Contains methods for basic interactions with the state, like loading
and storing data.

1114

Chapter 10. API Referenceangrstate:

VariableRecoveryStateBase__init__(project, kb)
property func_addr
process(state, *args, **kwargs)
The main entry point for an engine. Should take a state and return a result.
Parametersstate – The state to proceed fromReturns
The result. Whatever you want ;)class angr.analyses.variable_recovery.irsb_scanner.VEXIRSBScanner(*args, **kwargs)
Bases: SimEngineLightVEXMixin
Scan the VEX IRSB to determine if any argument-passing registers should be narrowed by detecting cases ofloading the whole register and immediately narrowing the register before writing to the tmp.
__init__(*args, **kwargs)
class angr.analyses.variable_recovery.VariableRecovery(func, max_iterations=20,
store_live_variables=False)
Bases: ForwardAnalysis, VariableRecoveryBase
Recover “variables” from a function using forced execution.
While variables play a very important role in programming, it does not really exist after compiling. However, we
can still identify and recovery their counterparts in binaries. It is worth noting that not every variable in sourcecode can be identified in binaries, and not every recognized variable in binaries have a corresponding variablein the original source code. In short, there is no guarantee that the variables we identified/recognized in a binary
are the same variables in its source code.
This analysis uses heuristics to identify and recovers the following types of variables: - Register variables. Stack variables. - Heap variables. (not implemented yet) - Global variables. (not implemented yet)This analysis takes a function as input, and performs a data-flow analysis on nodes. It runs concrete execution on
every statement and hooks all register/memory accesses to discover all places that are accessing variables. It isslow, but has a more accurate analysis result. For a fast but inaccurate variable recovery, you may consider using
VariableRecoveryFast.
This analysis follows SSA, which means every write creates a new variable in registers or memory (statck, heap,etc.). Things may get tricky when overlapping variable (in memory, as you cannot really have overlapping accesses to registers) accesses exist, and in such cases, a new variable will be created, and this new variable will
overlap with one or more existing variables. A decision procedure (which is pretty much TODO) is required at
the end of this analysis to resolve the conflicts between overlapping variables.
__init__(func, max_iterations=20, store_live_variables=False)
Parameters
func (knowledge.Function) – The function to analyze.
class angr.analyses.variable_recovery.VariableRecoveryFast(func, func_graph=None,
max_iterations=2, low_priority=False,
track_sp=True, func_args=None,store_live_variables=False,
unify_variables=True,
func_arg_vvars=None,vvar_to_vvar=None)
10.15. Analysis

1115

angr

Bases: ForwardAnalysis, VariableRecoveryBase
Recover “variables” from a function by keeping track of stack pointer offsets and pattern matching VEX statements.
If calling conventions are recovered prior to running VariableRecoveryFast, variables can be recognized moreaccurately. However, it is not a requirement. In this case, the function graph you pass must contain information
indicating the call-out sites inside the analyzed function. These graph edges must be annotated with either"type": "call" or "outside": True.
Parameters• func (Function | str | int)
• func_graph (networkx.DiGraph | None)• max_iterations (int)• func_args (list[SimVariable] | None)• func_arg_vvars (dict[int, tuple[VirtualVariable, SimVariable]] | None)• vvar_to_vvar (dict[int, int] | None)__init__(func, func_graph=None, max_iterations=2, low_priority=False, track_sp=True, func_args=None,store_live_variables=False, unify_variables=True, func_arg_vvars=None, vvar_to_vvar=None)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
• func (Function | str | int)
• func_graph (DiGraph | None)• max_iterations (int)• func_args (list[SimVariable] | None)• func_arg_vvars
None)(dict[int, tuple[VirtualVariable, SimVariable]] |• vvar_to_vvar (dict[int, int] | None)
ReturnsNoneclass angr.analyses.typehoon.lifter.TypeLifter(bits)
Bases: object
Lift SimTypes to type constants.
Parametersbits (int)__init__(bits)
Parametersbits (int)1116

Chapter 10. API Reference

angr

bits
memo
lift(ty)Parametersty (SimType)class angr.analyses.typehoon.simple_solver.SketchNodeBase
Bases: object
The base class for nodes in a sketch.
class angr.analyses.typehoon.simple_solver.SketchNode(typevar)
Bases: SketchNodeBase
Represents a node in a sketch graph.
Parameters
typevar (TypeVariable | DerivedTypeVariable)__init__(typevar)Parameters
typevar (TypeVariable | DerivedTypeVariable)
typevar:

TypeVariable | DerivedTypeVariable

upper_boundlower_boundclass angr.analyses.typehoon.simple_solver.RecursiveRefNode(target)
Bases: SketchNodeBase
Represents a cycle in a sketch graph.
This is equivalent to sketches.LabelNode in the reference implementation of retypd.
Parameters
target (DerivedTypeVariable)__init__(target)
Parameters
target (DerivedTypeVariable)class angr.analyses.typehoon.simple_solver.Sketch(solver, root)
Bases: object
Describes the sketch of a type variable.
Parameters• solver (SimpleSolver)• root (TypeVariable)__init__(solver, root)
Parameters• solver (SimpleSolver)

10.15. Analysis

1117

angr

• root (TypeVariable)root:

SketchNodegraphnode_mapping:dict[TypeVariable | DerivedTypeVariable, SketchNodeBase]solverlookup(typevar)
Return type
SketchNodeBase | None
Parameters
typevar (TypeVariable | DerivedTypeVariable)
add_edge(src, dst, label)Parameters• src (SketchNodeBase)• dst (SketchNodeBase)
add_constraint(constraint)
Return type
None
Parametersconstraint (TypeConstraint)static flatten_typevar(derived_typevar)
Return type
DerivedTypeVariable | TypeVariable | TypeConstantParameters
derived_typevar (TypeVariable | TypeConstant | DerivedTypeVariable)class angr.analyses.typehoon.simple_solver.ConstraintGraphTag(value)
Bases: Enum
An enumeration.
LEFT = 0
RIGHT = 1
UNKNOWN = 2
class angr.analyses.typehoon.simple_solver.FORGOTTEN(value)
Bases: Enum
An enumeration.
PRE_FORGOTTEN = 0
POST_FORGOTTEN = 1

1118

Chapter 10. API Referenceangrclass angr.analyses.typehoon.simple_solver.ConstraintGraphNode(typevar, variance, tag, forgotten)
Bases: object
Parameters• typevar (TypeVariable | DerivedTypeVariable)• variance (Variance)• tag (ConstraintGraphTag)• forgotten (FORGOTTEN)__init__(typevar, variance, tag, forgotten)
Parameters• typevar (TypeVariable | DerivedTypeVariable)• variance (Variance)• tag (ConstraintGraphTag)• forgotten (FORGOTTEN)
typevarvariancetag
forgotten
forget_last_label()
Return typetuple[ConstraintGraphNode, BaseLabel] | None
recall(label)
Return type
ConstraintGraphNode
Parameterslabel (BaseLabel)inverse()Return type
ConstraintGraphNode
inverse_wo_tag()Invert the variance only.
Return type
ConstraintGraphNodeclass angr.analyses.typehoon.simple_solver.SimpleSolver(bits, constraints, typevars)
Bases: object
SimpleSolver is, by its name, a simple solver. Most of this solver is based on the (complex) simplification
logic that the retypd paper describes and the retypd re-implementation (https://github.com/GrammaTech/retypd)
implements. Additionally, we add some improvements to allow type propagation of known struct names, amonga few other improvements.

10.15. Analysis

1119

angr

Parametersbits (int)__init__(bits, constraints, typevars)
Parametersbits (int)solve()
Steps:For each type variable, - Infer the shape in its sketch - Build the constraint graph - Collect all constraints Apply constraints to derive the lower and upper bounds
infer_shapes(typevars, constraints)
Computing sketches from constraint sets. Implements Algorithm E.1 in the retypd paper.
Return typetuple[dict, dict[TypeVariable, Sketch ]]Parameters• typevars (set[TypeVariable])• constraints (set[TypeConstraint])
compute_quotient_graph(constraints)
Compute the quotient graph (the constraint graph modulo ~ in Algorithm E.1 in the retypd paper) withrespect to a given set of type constraints.
Parametersconstraints (set[TypeConstraint])
join(t1, t2)
Return type
TypeConstantParameters• t1 (TypeConstant | TypeVariable)• t2 (TypeConstant | TypeVariable)meet(t1, t2)
Return type
TypeConstantParameters• t1 (TypeConstant | TypeVariable)• t2 (TypeConstant | TypeVariable)
static abstract(t)Return type
TypeConstant | TypeVariable
Parameterst (TypeConstant | TypeVariable)

1120

Chapter 10. API Referenceangrdetermine(equivalent_classes, sketches, solution, nodes=None)
Determine C-like types from sketches.
Parameters• equivalent_classes (dict[TypeVariable, TypeVariable]) – A dictionary mapping
each type variable from its representative in the equivalence class over ~.
• sketches – A dictionary storing sketches for each type variable.
• solution (dict) – The dictionary storing C-like types for each type variable. Output.
• nodes (Optional[set[SketchNode]]) – Optional. Nodes that should be considered in
the sketch.
Return type
None
ReturnsNoneclass angr.analyses.typehoon.translator.SimTypeTempRef(typevar)
Bases: SimType
Represents a temporary reference to another type. TypeVariableReference is translated to SimTypeTempRef.
__init__(typevar)Parameterslabel – the type label.
c_repr(**kwargs)
class angr.analyses.typehoon.translator.TypeTranslator(arch=None)
Bases: object
Translate type variables to SimType equivalence.
__init__(arch=None)
struct_name()
tc2simtype(tc)simtype2tc(simtype)
Return type
TypeConstantParameterssimtype (SimType)backpatch(st, translated)
Parameters• st (sim_type.SimType)• translated (dict)Returnsclass angr.analyses.typehoon.typevars.TypeConstraint
Bases: object

10.15. Analysis

1121

angr

pp_str(mapping)
Return typestr
Parameters
mapping (dict[TypeVariable, Any])class angr.analyses.typehoon.typevars.Equivalence(type_a, type_b)
Bases: TypeConstraint__init__(type_a, type_b)
type_atype_bpp_str(mapping)
Return typestr
Parameters
mapping (dict[TypeVariable, Any])class angr.analyses.typehoon.typevars.Existence(type_)
Bases: TypeConstraint__init__(type_)type_
pp_str(mapping)
Return typestr
Parameters
mapping (dict[TypeVariable, Any])replace(replacements)
class angr.analyses.typehoon.typevars.Subtype(sub_type, super_type)
Bases: TypeConstraint
Parameters• sub_type (TypeType)• super_type (TypeType)__init__(sub_type, super_type)
Parameters• sub_type (TypeConstant | TypeVariable | DerivedTypeVariable)• super_type (TypeConstant | TypeVariable | DerivedTypeVariable)super_type
sub_type

1122

Chapter 10. API Referenceangrpp_str(mapping)
Return typestr
Parameters
mapping (dict[TypeVariable, Any])replace(replacements)
class angr.analyses.typehoon.typevars.Add(type_0, type_1, type_r)
Bases: TypeConstraint
Describes the constraint that type_r == type0 + type1__init__(type_0, type_1, type_r)
type_0
type_1
type_rpp_str(mapping)
Return typestr
Parameters
mapping (dict[TypeVariable, Any])replace(replacements)
class angr.analyses.typehoon.typevars.Sub(type_0, type_1, type_r)
Bases: TypeConstraint
Describes the constraint that type_r == type0 - type1__init__(type_0, type_1, type_r)
type_0
type_1
type_rpp_str(mapping)
Return typestr
Parameters
mapping (dict[TypeVariable, Any])replace(replacements)
class angr.analyses.typehoon.typevars.TypeVariable(idx=None, name=None)
Bases: object
Parameters• idx (int | None)• name (str | None)

10.15. Analysis

1123

angr

__init__(idx=None, name=None)
Parameters• idx (int | None)• name (str | None)
idx:

int

name
pp_str(mapping)
Return typestr
Parameters
mapping (dict[TypeVariable, Any])class angr.analyses.typehoon.typevars.DerivedTypeVariable(type_var, label, labels=None,
idx=None)Bases: TypeVariable
Parameters• type_var (TypeVariable | TypeConstant)• labels (Iterable[BaseLabel] | None)• idx (int)__init__(type_var, label, labels=None, idx=None)
Parameters• type_var (TypeVariable | DerivedTypeVariable | None)• labels (Iterable[BaseLabel] | None)
type_var:labels:

TypeVariable | TypeConstanttuple[BaseLabel]

one_label()
Return type
BaseLabel | Nonepath()
Return typetuple[BaseLabel]longest_prefix()
Return type
TypeVariable | DerivedTypeVariable | Nonepp_str(mapping)
Return type
str

1124

Chapter 10. API ReferenceangrParameters
mapping (dict[TypeVariable, Any])replace(replacements)
class angr.analyses.typehoon.typevars.TypeVariables
Bases: object__init__()copy()
add_type_variable(var, codeloc, typevar)Parameters• var (SimVariable)• typevar (TypeVariable)
get_type_variable(var, codeloc)
has_type_variable_for(var, codeloc)
Parametersvar (SimVariable)class angr.analyses.typehoon.typevars.BaseLabel
Bases: object__init__()property variance:

Varianceclass angr.analyses.typehoon.typevars.FuncIn(loc)
Bases: BaseLabel__init__(loc)locclass angr.analyses.typehoon.typevars.FuncOut(loc)
Bases: BaseLabel__init__(loc)locclass angr.analyses.typehoon.typevars.Load
Bases: BaseLabelclass angr.analyses.typehoon.typevars.Store
Bases: BaseLabelproperty variance:

Varianceclass angr.analyses.typehoon.typevars.AddN(n)Bases: BaseLabel__init__(n)10.15. Analysis

1125

angr

n
class angr.analyses.typehoon.typevars.SubN(n)Bases: BaseLabel__init__(n)nclass angr.analyses.typehoon.typevars.ConvertTo(to_bits)
Bases: BaseLabel__init__(to_bits)
to_bitsclass angr.analyses.typehoon.typevars.ReinterpretAs(to_type, to_bits)
Bases: BaseLabel__init__(to_type, to_bits)
to_type
to_bitsclass angr.analyses.typehoon.typevars.HasField(bits, offset)
Bases: BaseLabel__init__(bits, offset)
bits
offsetclass angr.analyses.typehoon.typevars.IsArray
Bases: BaseLabelclass angr.analyses.typehoon.typehoon.Typehoon(constraints, func_var, ground_truth=None,
var_mapping=None, must_struct=None)
Bases: Analysis
A spiritual tribute to the long-standing typehoon project that @jmg (John Grosen) worked on during his days in
the angr team. Now I feel really bad of asking the poor guy to work directly on VEX IR without any fancy static
analysis support as we have right now. . .
Typehoon analysis implements a pushdown system that simplifies and solves type constraints. Our type constraints are largely an implementation of the paper Polymorphic Type Inference for Machine Code by Noonan,
Loginov, and Cok from GrammaTech (with missing functionality support and bugs, of course). Type constraints
are collected by running VariableRecoveryFast (maybe VariableRecovery later as well) on a function, and thensolved using this analysis.
User may specify ground truth, which will override all types at certain program points during constraint solving.
Parameters• var_mapping (dict[SimVariable, set[TypeVariable]] | None)• must_struct (set[TypeVariable] | None)

1126

Chapter 10. API Referenceangr__init__(constraints, func_var, ground_truth=None, var_mapping=None, must_struct=None)
Parameters• constraints• ground_truth – A set of SimType-style solutions for some or all type variables. They
will be respected during type solving.
• var_mapping (Optional[dict[SimVariable, set[TypeVariable]]])• must_struct (Optional[set[TypeVariable]])update_variable_types(func_addr, var_to_typevars)
Parameters
func_addr (int | str)
pp_constraints()
Pretty-print constraints between variables using the variable mapping.
Return type
None
pp_solution()
Pretty-print solutions using the variable mapping.
Return type
None
All type constants used in type inference. They can be mapped, translated, or rewritten to C-style types.
angr.analyses.typehoon.typeconsts.memoize(f )class angr.analyses.typehoon.typeconsts.TypeConstantBases: object
SIZE = Nonepp_str(mapping)
Return typestr
property size:

intclass angr.analyses.typehoon.typeconsts.TopType
Bases: TypeConstantclass angr.analyses.typehoon.typeconsts.BottomType
Bases: TypeConstantclass angr.analyses.typehoon.typeconsts.Int
Bases: TypeConstantclass angr.analyses.typehoon.typeconsts.Int1
Bases: Int
SIZE = 1class angr.analyses.typehoon.typeconsts.Int8
Bases: Int

10.15. Analysis

1127

angr

SIZE = 1class angr.analyses.typehoon.typeconsts.Int16
Bases: Int
SIZE = 2
class angr.analyses.typehoon.typeconsts.Int32
Bases: Int
SIZE = 4class angr.analyses.typehoon.typeconsts.Int64
Bases: Int
SIZE = 8class angr.analyses.typehoon.typeconsts.Int128
Bases: Int
SIZE = 16class angr.analyses.typehoon.typeconsts.Int256
Bases: Int
SIZE = 32
class angr.analyses.typehoon.typeconsts.FloatBase
Bases: TypeConstantclass angr.analyses.typehoon.typeconsts.Float
Bases: FloatBase
SIZE = 4class angr.analyses.typehoon.typeconsts.Double
Bases: FloatBase
SIZE = 8class angr.analyses.typehoon.typeconsts.Pointer(basetype)
Bases: TypeConstantParameters
basetype (TypeConstant | None)__init__(basetype)
Parameters
basetype (TypeConstant | None)new(basetype)class angr.analyses.typehoon.typeconsts.Pointer32(basetype=None)
Bases: Pointer, Int32
32-bit pointers.
__init__(basetype=None)

1128

Chapter 10. API Referenceangrclass angr.analyses.typehoon.typeconsts.Pointer64(basetype=None)
Bases: Pointer, Int64
64-bit pointers.
__init__(basetype=None)class angr.analyses.typehoon.typeconsts.Array(element=None, count=None)
Bases: TypeConstant__init__(element=None, count=None)class angr.analyses.typehoon.typeconsts.Struct(fields=None, name=None, field_names=None)
Bases: TypeConstant__init__(fields=None, name=None, field_names=None)class angr.analyses.typehoon.typeconsts.Function(params, outputs)
Bases: TypeConstantParameters• params (list)• outputs (list)__init__(params, outputs)
Parameters• params (list)• outputs (list)
class angr.analyses.typehoon.typeconsts.TypeVariableReference(typevar)
Bases: TypeConstant__init__(typevar)angr.analyses.typehoon.typeconsts.int_type(bits)
Return type
Int | None
Parametersbits (int)angr.analyses.typehoon.typeconsts.float_type(bits)
Return type
FloatBase | None
Parametersbits (int)class angr.analyses.typehoon.Typehoon(constraints, func_var, ground_truth=None, var_mapping=None,
must_struct=None)
Bases: Analysis
A spiritual tribute to the long-standing typehoon project that @jmg (John Grosen) worked on during his days in
the angr team. Now I feel really bad of asking the poor guy to work directly on VEX IR without any fancy static
analysis support as we have right now. . .

10.15. Analysis

1129

angr

Typehoon analysis implements a pushdown system that simplifies and solves type constraints. Our type constraints are largely an implementation of the paper Polymorphic Type Inference for Machine Code by Noonan,
Loginov, and Cok from GrammaTech (with missing functionality support and bugs, of course). Type constraints
are collected by running VariableRecoveryFast (maybe VariableRecovery later as well) on a function, and thensolved using this analysis.
User may specify ground truth, which will override all types at certain program points during constraint solving.
Parameters• var_mapping (dict[SimVariable, set[TypeVariable]] | None)• must_struct (set[TypeVariable] | None)__init__(constraints, func_var, ground_truth=None, var_mapping=None, must_struct=None)
Parameters• constraints• ground_truth – A set of SimType-style solutions for some or all type variables. They
will be respected during type solving.
• var_mapping (Optional[dict[SimVariable, set[TypeVariable]]])• must_struct (Optional[set[TypeVariable]])update_variable_types(func_addr, var_to_typevars)
Parameters
func_addr (int | str)
pp_constraints()
Pretty-print constraints between variables using the variable mapping.
Return type
None
pp_solution()
Pretty-print solutions using the variable mapping.
Return type
Noneclass angr.analyses.identifier.identify.FuncInfo
Bases: object__init__()class angr.analyses.identifier.identify.Identifier(cfg=None, require_predecessors=True,
only_find=None)
Bases: Analysis__init__(cfg=None, require_predecessors=True, only_find=None)run(only_find=None)
can_call_same_name(addr, name)get_func_info(func)
static constrain_all_zero(before_state, state, regs)

1130

Chapter 10. API Referenceangridentify_func(function)
check_tests(cfg_func, match_func)
map_callsites()
do_trace(addr_trace, reverse_accesses, func_info)
get_call_args(func, callsite)static get_reg_name(arch, reg_offset)
Parameters• arch – the architecture• reg_offset – Tries to find the name of a register given the offset in the registers.
Returns
The register namefind_stack_vars_x86(func)
static make_initial_state(project, stack_length)
Returns
an initial state with a symbolic stack and good options for rop
static make_symbolic_state(project, reg_list, stack_length=80)
converts an input state into a state with symbolic registers :return: the symbolic stateclass angr.analyses.loopfinder.Loop(entry, entry_edges, break_edges, continue_edges, body_nodes, graph,subloops)
Bases: object__init__(entry, entry_edges, break_edges, continue_edges, body_nodes, graph, subloops)
class angr.analyses.loopfinder.LoopFinder(functions=None, normalize=True)
Bases: Analysis
Extracts all the loops from all the functions in a binary.
__init__(functions=None, normalize=True)class angr.analyses.loop_analysis.VariableTypes
Bases: object
Iterator = 'Iterator'
HasNext = 'HasNext'
Next = 'Next'class angr.analyses.loop_analysis.AnnotatedVariable(variable, type_)
Bases: object__init__(variable, type_)
variable
type

10.15. Analysis

1131

angr

class angr.analyses.loop_analysis.Condition(op, val0, val1)
Bases: object
Equal = '=='
NotEqual = '!='__init__(op, val0, val1)classmethod from_opstr(opstr)
class angr.analyses.loop_analysis.SootBlockProcessor(state, block, loop, defuse)
Bases: object__init__(state, block, loop, defuse)process()class angr.analyses.loop_analysis.LoopAnalysisState(block)Bases: object__init__(block)copy()
merge(state)
add_loop_exit_stmt(stmt_idx, condition=None)class angr.analyses.loop_analysis.LoopAnalysis(loop, defuse)
Bases: ForwardAnalysis, Analysis
Analyze a loop and recover important information about the loop (e.g., invariants, induction variables) in a static
manner.
__init__(loop, defuse)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.
ReturnsNone
exception angr.analyses.veritesting.VeritestingError
Bases: Exception
class angr.analyses.veritesting.CallTracingFilter(project, depth, blacklist=None)
Bases: object
Filter to apply during CFG creation on a given state and jumpkind to determine if it should be skipped at a certain
depth

1132

Chapter 10. API Referenceangrwhitelist = {<class 'angr.procedures.cgc.receive.receive'>, <class'angr.procedures.cgc.transmit.transmit'>, <class'angr.procedures.glibc.__ctype_b_loc.__ctype_b_loc'>, <class'angr.procedures.libc.atoi.atoi'>, <class 'angr.procedures.libc.fgetc.fgetc'>,<class 'angr.procedures.libc.strcmp.strcmp'>, <class'angr.procedures.libc.strlen.strlen'>, <class 'angr.procedures.posix.read.read'>}cfg_cache = {}__init__(project, depth, blacklist=None)filter(call_target_state, jumpkind)
The call will be skipped if it returns True.
Parameters• call_target_state – The new state of the call target.
• jumpkind – The Jumpkind of this call.
Returns
True if we want to skip this call, False otherwise.
class angr.analyses.veritesting.Veritesting(input_state, boundaries=None, loop_unrolling_limit=10,
enable_function_inlining=False, terminator=None,
deviation_filter=None)
Bases: Analysis
An exploration technique made for condensing chunks of code to single (nested) if-then-else constraints via CFG
accurate to conduct Static Symbolic Execution SSE (conversion to single constraint)
cfg_cache = {}all_stashes = ('successful', 'errored', 'deadended', 'deviated', 'unconstrained')__init__(input_state, boundaries=None, loop_unrolling_limit=10, enable_function_inlining=False,
terminator=None, deviation_filter=None)
SSE stands for Static Symbolic Execution, and we also implemented an extended version of Veritesting(Avgerinos, Thanassis, et al, ICSE 2014).
Parameters• input_state – The initial state to begin the execution with.
• boundaries – Addresses where execution should stop.
• loop_unrolling_limit – The maximum times that Veritesting should unroll a loop for.
• enable_function_inlining – Whether we should enable function inlining and syscall
inlining.
• terminator – A callback function that takes a state as parameter. Veritesting will terminate if this function returns True.
• deviation_filter – A callback function that takes a state as parameter. Veritesting will
put the state into “deviated” stash if this function returns True.
is_not_in_cfg(s)Returns if s.addr is not a proper node in our CFG.
Parameterss (SimState) – The SimState instance to test.
10.15. Analysis

1133

angr

Returns bool
False if our CFG contains p.addr, True otherwise.
is_overbound(state)
Filter out all states that run out of boundaries or loop too many times.
param SimState state: SimState instance to check returns bool: True if outside of mem/loop_ctr boundary
project:kb:

Project

KnowledgeBase

class angr.analyses.vfg.VFGJob(*args, **kwargs)
Bases: CFGJobBase
A job descriptor that contains local variables used during VFG analysis.
__init__(*args, **kwargs)
Return type
None
property block_id:

BlockID | None

callstack_repr(kb)Parameterskb (KnowledgeBase)class angr.analyses.vfg.PendingJob(block_id, state, call_stack, src_block_id, src_stmt_idx, src_ins_addr)
Bases: object
Describes a pending job during VFG analysis.
Parameters• block_id (BlockID)• state (SimState)• call_stack (CallStack)• src_block_id (BlockID)• src_stmt_idx (int)• src_ins_addr (int)__init__(block_id, state, call_stack, src_block_id, src_stmt_idx, src_ins_addr)
Parameters• block_id (BlockID)• state (SimState)• call_stack (CallStack)• src_block_id (BlockID)• src_stmt_idx (int)• src_ins_addr (int)1134

Chapter 10. API ReferenceangrReturn type
None
block_idstate
call_stack
src_block_id
src_stmt_idx
src_ins_addr
class angr.analyses.vfg.AnalysisTask
Bases: object
An analysis task describes a task that should be done before popping this task out of the task stack and discard it.

__init__()Return type
None
property doneclass angr.analyses.vfg.FunctionAnalysis(function_address, return_address)
Bases: AnalysisTask
Analyze a function, generate fix-point states from all endpoints of that function, and then merge them to one
state.
Parameters• function_address (int)• return_address (int | None)__init__(function_address, return_address)
Parameters• function_address (int)• return_address (int | None)
Return type
None
property done:boolclass angr.analyses.vfg.CallAnalysis(address, return_address, function_analysis_tasks=None,mergeable_plugins=None)
Bases: AnalysisTask
Analyze a call by analyze all functions this call might be calling, collect all final states generated by analyzing
those functions, and merge them into one state.
Parameters• address (int)

10.15. Analysis

1135

angr

• return_address (None)• function_analysis_tasks (list[Any] | None)• mergeable_plugins (tuple[str, str] | None)__init__(address, return_address, function_analysis_tasks=None, mergeable_plugins=None)
Parameters• address (int)• return_address (None)• function_analysis_tasks (list[Any] | None)• mergeable_plugins (tuple[str, str] | None)
Return type
None
property done:bool

register_function_analysis(task)
Return type
None
Parameters
task (FunctionAnalysis)
add_final_job(job)Return type
None
Parametersjob (VFGJob)
merge_jobs()
Return type
VFGJobclass angr.analyses.vfg.VFGNode(addr, key, state=None)
Bases: object
A descriptor of nodes in a Value-Flow Graph
Parameters• addr (int)• key (BlockID)• state (SimState | None)__init__(addr, key, state=None)
Constructor.
Parameters• addr (int)• key (BlockID)• state (SimState)
1136

Chapter 10. API ReferenceangrReturn type
None
append_state(s, is_widened_state=False)
Appended a new state to this VFGNode. :type s: :param s: The new state to append :type is_widened_state::param is_widened_state: Whether it is a widened state or not.
class angr.analyses.vfg.VFG(cfg=None, context_sensitivity_level=2, start=None, function_start=None,interfunction_level=0, initial_state=None, avoid_runs=None,remove_options=None, timeout=None, max_iterations_before_widening=8,
max_iterations=40, widening_interval=3, final_state_callback=None,
status_callback=None, record_function_final_states=False)
Bases: ForwardAnalysis[SimState, VFGNode, VFGJob, BlockID], Analysis
This class represents a control-flow graph with static analysis result.
Perform abstract interpretation analysis starting from the given function address. The output is an invariant at
the beginning (or the end) of each basic block.
Steps:• Generate a CFG first if CFG is not provided.
• Identify all merge points (denote the set of merge points as Pw) in the CFG.
• Cut those loop back edges (can be derived from Pw) so that we gain an acyclic CFG.
• Identify all variables that are 1) from memory loading 2) from initial values, or 3) phi functions.
Denotethe set of those variables as S_{var}.
• Start real AI analysis and try to compute a fix point of each merge point. Perform
widening/narrowing only on
variables in S_{var}.
Parameters• cfg (CFGEmulated | None)• context_sensitivity_level (int)• start (int | None)• function_start (int | None)• interfunction_level (int)• initial_state (SimState | None)• avoid_runs (list[int] | None)• remove_options (set[str] | None)• timeout (int | None)• max_iterations_before_widening (int)• max_iterations (int)• widening_interval (int)• final_state_callback (Callable[[SimState, CallStack], Any] | None)• status_callback (Callable[[VFG], Any] | None)• record_function_final_states (bool)

10.15. Analysis

1137

angr

__init__(cfg=None, context_sensitivity_level=2, start=None, function_start=None, interfunction_level=0,
initial_state=None, avoid_runs=None, remove_options=None, timeout=None,
max_iterations_before_widening=8, max_iterations=40, widening_interval=3,
final_state_callback=None, status_callback=None, record_function_final_states=False)
Parameters• cfg (Optional[CFGEmulated]) – The control-flow graph to base this analysis on. If none
is provided, we will construct a CFGEmulated.
• context_sensitivity_level (int) – The level of context-sensitivity of this VFG. It
ranges from 0 to infinity. Default 2.
• function_start (Optional[int]) – The address of the function to analyze.
• interfunction_level (int) – The level of interfunction-ness to be• initial_state (Optional[SimState]) – A state to use as the initial one• avoid_runs (Optional[list[int]]) – A list of runs to avoid• remove_options (Optional[set[str]]) – State options to remove from the initial state.
It only works when initial_state is None
• timeout (int)• final_state_callback (Optional[Callable[[SimState, CallStack], Any]]) – callback function when countering final state• status_callback (Optional[Callable[[VFG], Any]]) – callback function used in_analysis_core_baremetal• start (int | None)• max_iterations_before_widening (int)• max_iterations (int)• widening_interval (int)• record_function_final_states (bool)
Return type
None
property function_initial_states
property function_final_states
get_any_node(addr)
Get any VFG node corresponding to the basic block at @addr. Note that depending on the context sensitivity
level, there might be multiple nodes corresponding to different contexts. This function will return the firstone it encounters, which might not be what you want.
Return type
VFGNode | None
Parametersaddr (int)
get_all_nodes(addr)
Return type
Generator[VFGNode]1138

Chapter 10. API Referenceangrirsb_from_node(node)copy()
class angr.analyses.vsa_ddg.DefUseChain(def_loc, use_loc, variable)
Bases: object
Stand for a def-use chain. it is generated by the DDG itself.
__init__(def_loc, use_loc, variable)
Constructor.
Parameters• def_loc• use_loc• variable
Returnsclass angr.analyses.vsa_ddg.VSA_DDG(vfg=None, start_addr=None, interfunction_level=0,
context_sensitivity_level=2, keep_data=False)
Bases: Analysis
A Data dependency graph based on VSA states. That means we don’t (and shouldn’t) expect any symbolic
expressions.
__init__(vfg=None, start_addr=None, interfunction_level=0, context_sensitivity_level=2,keep_data=False)
Constructor.
Parameters• vfg – An already constructed VFG. If not specified, a new VFG will be created with otherspecified parameters. vfg and start_addr cannot both be unspecified.
• start_addr – The address where to start the analysis (typically, a function’s entry point).
• interfunction_level – See VFG analysis.
• context_sensitivity_level – See VFG analysis.
• keep_data – Whether we keep set of addresses as edges in the graph, or just the cardinalityof the sets, which can be used as a “weight”.
get_predecessors(code_location)
Returns all predecessors of code_location.
Parameters
code_location – A CodeLocation instance.
Returns
A list of all predecessors.
get_all_nodes(simrun_addr, stmt_idx)
Get all DDG nodes matching the given basic block address and statement index.
class angr.analyses.vtable.Vtable(vaddr, size, func_addrs=None)
Bases: object
This contains the addr, size and function addresses of a Vtable10.15. Analysis

1139

angr

__init__(vaddr, size, func_addrs=None)class angr.analyses.vtable.VtableFinder
Bases: Analysis
This analysis locates Vtables in a binary based on heuristics taken from - “Reconstruction of Class Hierarchies
for Decompilation of C++ Programs”__init__()is_cross_referenced(addr)
is_function(addr)
analyze()create_extract_vtable(start_addr, sec_size)class angr.analyses.find_objects_static.PossibleObject(size, addr, class_name=None)
Bases: object
This holds the address and class name of possible class instances. The address that it holds in mapped outside thebinary so it is only valid in this analysis. TO DO: map the address to its uses in the registers/memory locationsin the instructions__init__(size, addr, class_name=None)class angr.analyses.find_objects_static.NewFunctionHandler(max_addr=None,
new_func_addr=None, project=None)
Bases: FunctionHandler
This handles calls to the function new(), by recording the size parameter passed to it and also assigns anewaddress outside the mapped binary to the newly created space(possible object).
It also tracks if the function called right after new() is passed the same ‘this’ pointer and is a constructor, if
so we mark it as an instance of the class the constructor belongs to.(only for non stripped binaries)__init__(max_addr=None, new_func_addr=None, project=None)hook(analysis)
Attach this instance of the function handler to an instance of RDA.
handle_local_function(state, data)
Parameters• state (ReachingDefinitionsState)• data (FunctionCallData)
class angr.analyses.find_objects_static.StaticObjectFinder
Bases: Analysis
This analysis tries to find objects on the heap based on calls to new(), and subsequent calls toconstructors withthe ‘this’ pointer__init__()1140

Chapter 10. API Referenceangrclass angr.analyses.class_identifier.ClassIdentifier
Bases: Analysis
This is a class identifier for non stripped or partially stripped binaries, it identifies classes based on the demangled
function names, and also assigns functions to their respective classes based on their names. It also uses the resultsfrom the VtableFinder analysis to assign the corresponding vtable to the classes.
self.classes contains a mapping between class names and SimCppClass objects
e.g. A::tool() and A::qux() belong to the class A__init__()class angr.analyses.disassembly.DisassemblyPiece
Bases: object
addr = Noneident = nan
render(formatting=None)
getpiece(formatting, column)
width(formatting)height(formatting)static color(string, coloring, formatting)highlight(string, formatting=None)class angr.analyses.disassembly.FunctionStart(func)
Bases: DisassemblyPiece__init__(func)
Constructor.
Parameters
func (angr.knowledge.Function) – The function instance.
height(formatting)class angr.analyses.disassembly.Label(addr, name)
Bases: DisassemblyPiece__init__(addr, name)class angr.analyses.disassembly.IROp(addr, seq, obj, irsb)
Bases: DisassemblyPiece
Parameters• addr (int)• seq (int)• obj (IRStmt | PcodeOp)• irsb (IRSB | IRSB)

10.15. Analysis

1141

angr

__init__(addr, seq, obj, irsb)
Parameters• addr (int)• seq (int)• obj (IRStmt | PcodeOp)• irsb (IRSB | IRSB)
addr:

int

seq:

int

obj:

Union[IRStmt, PcodeOp]

irsb:

Union[IRSB, IRSB]

class angr.analyses.disassembly.BlockStart(block, parentfunc, project)
Bases: DisassemblyPiece__init__(block, parentfunc, project)class angr.analyses.disassembly.Hook(block)Bases: DisassemblyPiece__init__(block)class angr.analyses.disassembly.Instruction(insn, parentblock, project=None)
Bases: DisassemblyPiece__init__(insn, parentblock, project=None)
property mnemonic
reload_format()dissect_instruction()
dissect_instruction_for_arm()
static split_arm_op_string(op_str)
Parameters
op_str (str)dissect_instruction_by_default()
static split_op_string(insn_str)class angr.analyses.disassembly.SootExpression(expr)
Bases: DisassemblyPiece__init__(expr)
class angr.analyses.disassembly.SootExpressionTarget(target_stmt_idx)
Bases: SootExpression__init__(target_stmt_idx)

1142

Chapter 10. API Referenceangrclass angr.analyses.disassembly.SootExpressionStaticFieldRef(field)
Bases: SootExpression__init__(field)
class angr.analyses.disassembly.SootExpressionInvoke(invoke_type, expr)
Bases: SootExpression
Virtual = 'virtual'
Static = 'static'Special = 'special'__init__(invoke_type, expr)
class angr.analyses.disassembly.SootStatement(block_addr, raw_stmt)
Bases: DisassemblyPiece__init__(block_addr, raw_stmt)
property stmt_idx
class angr.analyses.disassembly.Opcode(parentinsn)
Bases: DisassemblyPiece__init__(parentinsn)
class angr.analyses.disassembly.Operand(op_num, children, parentinsn)
Bases: DisassemblyPiece__init__(op_num, children, parentinsn)
property cs_operandstatic build(operand_type, op_num, children, parentinsn)
class angr.analyses.disassembly.ConstantOperand(op_num, children, parentinsn)
Bases: Operandclass angr.analyses.disassembly.RegisterOperand(op_num, children, parentinsn)
Bases: Operandproperty registerclass angr.analyses.disassembly.MemoryOperand(op_num, children, parentinsn)
Bases: Operand__init__(op_num, children, parentinsn)
class angr.analyses.disassembly.OperandPiece
Bases: DisassemblyPiece
addr = None
parentop = Noneident = None

10.15. Analysis

1143

angr

class angr.analyses.disassembly.Register(reg, prefix='')Bases: OperandPiece__init__(reg, prefix='')class angr.analyses.disassembly.Value(val, render_with_sign)
Bases: OperandPiece__init__(val, render_with_sign)property projectclass angr.analyses.disassembly.Comment(addr, text)
Bases: DisassemblyPiece__init__(addr, text)
height(formatting)class angr.analyses.disassembly.FuncComment(func)
Bases: DisassemblyPiece__init__(func)class angr.analyses.disassembly.Disassembly(function=None, ranges=None, thumb=False,
include_ir=False, block_bytes=None)
Bases: Analysis
Produce formatted machine code disassembly.
Parameters• function (Function | None)• ranges (Sequence[tuple[int, int]] | None)• thumb (bool)• include_ir (bool)• block_bytes (bytes | None)__init__(function=None, ranges=None, thumb=False, include_ir=False, block_bytes=None)
Parameters• function (Function | None)• ranges (Sequence[tuple[int, int]] | None)• thumb (bool)• include_ir (bool)• block_bytes (bytes | None)func_lookup(block)parse_block(block)
Parse instructions for a given block node
Return type
None

1144

Chapter 10. API ReferenceangrParameters
block (BlockNode)
render(formatting=None, show_edges=True, show_addresses=True, show_bytes=False, ascii_only=None,
color=True)
Render the disassembly to a string, with optional edges and addresses.
Color will be added by default, if enabled. To disable color pass an empty formatting dict.
Return typestr
Parameters• show_edges (bool)• show_addresses (bool)• show_bytes (bool)• ascii_only (bool | None)• color (bool)
angr.analyses.disassembly_utils.decode_instruction(arch, instr)
exception angr.analyses.reassembler.BinaryError
Bases: Exception
exception angr.analyses.reassembler.InstructionError
Bases: BinaryError
exception angr.analyses.reassembler.ReassemblerFailureNoticeBases: BinaryError
angr.analyses.reassembler.string_escape(s)angr.analyses.reassembler.fill_reg_map()
angr.analyses.reassembler.split_operands(s)angr.analyses.reassembler.is_hex(s)class angr.analyses.reassembler.Label(binary, name, original_addr=None)
Bases: object
g_label_ctr = count(0)__init__(binary, name, original_addr=None)
property operand_str
property offset
static new_label(binary, name=None, function_name=None, original_addr=None, data_label=False)class angr.analyses.reassembler.DataLabel(binary, original_addr, name=None)
Bases: Label__init__(binary, original_addr, name=None)
property operand_str

10.15. Analysis

1145

angr

class angr.analyses.reassembler.FunctionLabel(binary, function_name, original_addr, plt=False)
Bases: Label__init__(binary, function_name, original_addr, plt=False)
property function_nameproperty operand_str
class angr.analyses.reassembler.ObjectLabel(binary, symbol_name, original_addr, plt=False)
Bases: Label__init__(binary, symbol_name, original_addr, plt=False)
property symbol_nameproperty operand_str
class angr.analyses.reassembler.NotypeLabel(binary, symbol_name, original_addr, plt=False)
Bases: Label__init__(binary, symbol_name, original_addr, plt=False)
property symbol_nameproperty operand_str
class angr.analyses.reassembler.SymbolManager(binary, cfg)
Bases: object
SymbolManager manages all symbols in the binary.
__init__(binary, cfg)
Constructor.
Parameters• binary (Reassembler) – The Binary analysis instance.
• cfg (angr.analyses.CFG) – The CFG analysis instance.
ReturnsNone
get_unique_symbol_name(symbol_name)new_label(addr, name=None, is_function=None, force=False)label_got(addr, label)Mark a certain label as assigned (to an instruction or a block of data).
Parameters• addr (int) – The address of the label.
• label (angr.analyses.reassembler.Label) – The label that is just assigned.
Returns
None

1146

Chapter 10. API Referenceangrclass angr.analyses.reassembler.Operand(binary, insn_addr, insn_size, capstone_operand, operand_str,mnemonic, operand_offset, syntax=None)
Bases: object__init__(binary, insn_addr, insn_size, capstone_operand, operand_str, mnemonic, operand_offset,
syntax=None)
Constructor.
Parameters• binary (Reassembler) – The Binary analysis.
• insn_addr (int) – Address of the instruction.
• capstone_operand• operand_str (str) – the string representation of this operand• mnemonic (str) – Mnemonic of the instruction that this operand belongs to.
• operand_offset (int) – offset of the operand into the instruction.
• syntax (str) – Provide a way to override the default syntax coming from binary.
ReturnsNoneassembly()
property is_immediate
property symbolizedclass angr.analyses.reassembler.Instruction(binary, addr, size, insn_bytes, capstone_instr)
Bases: object
High-level representation of an instruction in the binary__init__(binary, addr, size, insn_bytes, capstone_instr)
Parameters• binary (Reassembler) – The Binary analysis• addr (int) – Address of the instruction• size (int) – Size of the instruction• insn_bytes (str) – Instruction bytes• capstone_instr – Capstone Instr object.
ReturnsNoneassign_labels()
dbg_comments()
assembly(comments=False, symbolized=True)
Returns

10.15. Analysis

1147

angr

class angr.analyses.reassembler.BasicBlock(binary, addr, size, x86_getpc_retsite=False)
Bases: object
BasicBlock represents a basic block in the binary.
Parametersx86_getpc_retsite (bool)__init__(binary, addr, size, x86_getpc_retsite=False)
Constructor.
Parameters• binary (Reassembler) – The Binary analysis.
• addr (int) – Address of the block• size (int) – Size of the block• x86_getpc_retsite (bool)
ReturnsNoneassign_labels()
assembly(comments=False, symbolized=True)
instruction_addresses()class angr.analyses.reassembler.Procedure(binary, function=None, addr=None, size=None, name=None,
section='.text', asm_code=None)
Bases: object
Procedure in the binary.
__init__(binary, function=None, addr=None, size=None, name=None, section='.text', asm_code=None)
Constructor.
Parameters• binary (Reassembler) – The Binary analysis.
• function (angr.knowledge.Function) – The function it represents• addr (int) – Address of the function. Not required if function is provided.
• size (int) – Size of the function. Not required if function is provided.
• section (str) – Which section this function comes from.
ReturnsNoneproperty nameGet function name from the labels of the very first block. :return: Function name if there is any, Noneotherwise :rtype: string
property is_plt
If this function is a PLT entry or not. :return: True if this function is a PLT entry, False otherwise :rtype:bool
assign_labels()

1148

Chapter 10. API Referenceangrassembly(comments=False, symbolized=True)
Get the assembly manifest of the procedure.
Parameters• comments• symbolized
Returns
A list of tuples (address, basic block assembly), ordered by basic block addresses
Return type
list
instruction_addresses()
Get all instruction addresses in the binary.
Returns
A list of sorted instruction addresses.
Return type
listclass angr.analyses.reassembler.ProcedureChunk(project, addr, size)
Bases: Procedure
Procedure chunk.
__init__(project, addr, size)
Constructor.
Parameters• project• addr• sizeReturnsclass angr.analyses.reassembler.Data(binary, memory_data=None, section=None, section_name=None,
name=None, size=None, sort=None, addr=None,
initial_content=None)
Bases: object__init__(binary, memory_data=None, section=None, section_name=None, name=None, size=None,
sort=None, addr=None, initial_content=None)
property content
shrink(new_size)
Reduce the size of this block
Parameters
new_size (int) – The new size
ReturnsNone

10.15. Analysis

1149

angr

desymbolize()
We believe this was a pointer and symbolized it before. Now we want to desymbolize it.
The following actions are performed: - Reload content from memory - Mark the sort as ‘unknown’
ReturnsNoneassign_labels()
assembly(comments=False, symbolized=True)class angr.analyses.reassembler.Relocation(addr, ref_addr, sort)Bases: object__init__(addr, ref_addr, sort)class angr.analyses.reassembler.Reassembler(syntax='intel', remove_cgc_attachments=True,
log_relocations=True)
Bases: Analysis
High-level representation of a binary with a linear representation of all instructions and data regions. Aftercalling “symbolize”, it essentially acts as a binary reassembler.
Tested on CGC, x86 and x86-64 binaries.
Disclaimer: The reassembler is an empirical solution. Don’t be surprised if it does not work on some binaries.
__init__(syntax='intel', remove_cgc_attachments=True, log_relocations=True)
property instructions
Get a list of all instructions in the binary
Returns
A list of (address, instruction)
Return type
tuple
property relocations
property inserted_asm_before_label
property inserted_asm_after_label
property main_executable_regions
return:property main_nonexecutable_regions
return:section_alignment(section_name)Get the alignment for the specific section. If the section is not found, 16 is used as default.
Parameters
section_name (str) – The section.
Returns
The alignment in bytes.
Return type
int

1150

Chapter 10. API Referenceangrmain_executable_regions_contain(addr)
Parameters
addr
Returns
main_executable_region_limbos_contain(addr)
Sometimes there exists a pointer that points to a few bytes before the beginning of a section, or a few bytes
after the beginning of the section. We take care of that here.
Parametersaddr (int) – The address to check.
Returns
A 2-tuple of (bool, the closest base address)
Return type
tuple
main_nonexecutable_regions_contain(addr)
Parametersaddr (int) – The address to check.
Returns
True if the address is inside a non-executable region, False otherwise.
Return typebool
main_nonexecutable_region_limbos_contain(addr, tolerance_before=64, tolerance_after=64)
Sometimes there exists a pointer that points to a few bytes before the beginning of a section, or a few bytes
after the beginning of the section. We take care of that here.
Parametersaddr (int) – The address to check.
Returns
A 2-tuple of (bool, the closest base address)
Return type
tuple
register_instruction_reference(insn_addr, ref_addr, sort, operand_offset)
register_data_reference(data_addr, ref_addr)
add_label(name, addr)
Add a new label to the symbol manager.
Parameters• name (str) – Name of the label.
• addr (int) – Address of the label.
ReturnsNoneinsert_asm(addr, asm_code, before_label=False)
Insert some assembly code at the specific address. There must be an instruction starting at that address.
Parameters10.15. Analysis

1151

angr

• addr (int) – Address of insertion• asm_code (str) – The assembly code to insert
ReturnsNoneappend_procedure(name, asm_code)
Add a new procedure with specific name and assembly code.
Parameters• name (str) – The name of the new procedure.
• asm_code (str) – The assembly code of the procedure
ReturnsNoneappend_data(name, initial_content, size, readonly=False, sort='unknown')
Append a new data entry into the binary with specific name, content, and size.
Parameters• name (str) – Name of the data entry. Will be used as the label.
• initial_content (bytes) – The initial content of the data entry.
• size (int) – Size of the data entry.
• readonly (bool) – If the data entry belongs to the readonly region.
• sort (str) – Type of the data.
ReturnsNoneremove_instruction(ins_addr)
Parameters
ins_addr
Returns
randomize_procedures()
Returnssymbolize()assembly(comments=False, symbolized=True)
remove_cgc_attachments()
Remove CGC attachments.
Returns
True if CGC attachments are found and removed, False otherwise
Return typebool
remove_unnecessary_stuff()
Remove unnecessary functions and data
Returns
None
1152

Chapter 10. API Referenceangrremove_unnecessary_stuff_glibc()
fast_memory_load(addr, size, data_type, endness='Iend_LE')
Load memory bytes from loader’s memory backend.
Parameters• addr (int) – The address to begin memory loading.
• size (int) – Size in bytes.
• data_type – Type of the data.
• endness (str) – Endianness of this memory load.
Returns
Data read out of the memory.
Return type
int or bytes or str or Noneclass angr.analyses.congruency_check.CongruencyCheck(throw=False)
Bases: Analysis
This is an analysis to ensure that angr executes things identically with different execution backends (i.e., unicorn
vs vex).
__init__(throw=False)
Initializes a CongruencyCheck analysis.
Parameters
throw – whether to raise an exception if an incongruency is found.
set_state_options(left_add_options=None, left_remove_options=None, right_add_options=None,right_remove_options=None)
Checks that the specified state options result in the same states over the next depth states.
set_states(left_state, right_state)
Checks that the specified paths stay the same over the next depth states.
set_simgr(simgr)
run(depth=None)
Checks that the paths in the specified path group stay the same over the next depth bytes.
The path group should have a “left” and a “right” stash, each with a single path.
compare_path_group(pg)compare_states(sl, sr)Compares two states for similarity.
compare_paths(pl, pr)class angr.analyses.static_hooker.StaticHooker(library, binary=None)
Bases: Analysis
This analysis works on statically linked binaries - it finds the library functions statically linked into the binaryand hooks them with the appropriate simprocedures.
Right now it only works on unstripped binaries, but hey! There’s room to grow!

10.15. Analysis

1153

angr

__init__(library, binary=None)class angr.analyses.binary_optimizer.ConstantPropagation(constant, constant_assignment_loc,
constant_consuming_loc)
Bases: object__init__(constant, constant_assignment_loc, constant_consuming_loc)
class angr.analyses.binary_optimizer.RedundantStackVariable(argument, stack_variable,
stack_variable_consuming_locs)
Bases: object__init__(argument, stack_variable, stack_variable_consuming_locs)
class angr.analyses.binary_optimizer.RegisterReallocation(stack_variable, register_variable,
stack_variable_sources,
stack_variable_consumers,
prologue_addr, prologue_size,
epilogue_addr, epilogue_size)
Bases: object__init__(stack_variable, register_variable, stack_variable_sources, stack_variable_consumers,
prologue_addr, prologue_size, epilogue_addr, epilogue_size)
Constructor.
Parameters• stack_variable (SimStackVariable)• register_variable (SimRegisterVariable)• stack_variable_sources (list)• stack_variable_consumers (list)• prologue_addr (int)• prologue_size (int)• epilogue_addr (int)• epilogue_size (int)class angr.analyses.binary_optimizer.DeadAssignment(pv)Bases: object__init__(pv)Constructor.
Parameters
pv (angr.analyses.ddg.ProgramVariable) – The assignment to remove.
class angr.analyses.binary_optimizer.BinaryOptimizer(cfg, techniques)
Bases: Analysis
This is a collection of binary optimization techniques we used in Mechanical Phish during the finals of Cyber
Grand Challenge. It focuses on dealing with some serious speed-impacting code constructs, and sort of worked
on some CGC binaries compiled with O0. Use this analysis as a reference of how to use data dependency graphand such.
There is no guarantee that BinaryOptimizer will ever work on non-CGC binaries. Feel free to give us PR or MR,
but please do not ask for support of non-CGC binaries.

1154

Chapter 10. API Referenceangr

BLOCKS_THRESHOLD = 500__init__(cfg, techniques)
optimize()project:kb:

Project

KnowledgeBase

class angr.analyses.callee_cleanup_finder.CalleeCleanupFinder(starts=None, hook_all=False)
Bases: Analysis__init__(starts=None, hook_all=False)
analyze(addr)
class angr.analyses.dominance_frontier.DominanceFrontier(func, func_graph=None, entry=None,
exception_edges=False)
Bases: Analysis
Computes the dominance frontier of all nodes in a function graph, and provides an easy-to-use interface forquerying the frontier information.
__init__(func, func_graph=None, entry=None, exception_edges=False)class angr.analyses.init_finder.SimEngineInitFinderVEX(project, replacements, overlay,
pointers_only=False)
Bases: SimEngineLightVEXMixin, SimEngineLight
The VEX engine class for InitFinder.
__init__(project, replacements, overlay, pointers_only=False)
static is_concrete(expr)
Return typeboolclass angr.analyses.init_finder.InitializationFinder(func=None, func_graph=None, block=None,
max_iterations=1, replacements=None,overlay=None, pointers_only=False)
Bases: ForwardAnalysis, Analysis
Finds possible initializations for global data sections and generate an overlay to be used in other analyses lateron.
__init__(func=None, func_graph=None, block=None, max_iterations=1, replacements=None,overlay=None, pointers_only=False)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.

10.15. Analysis

1155

angr

ReturnsNoneclass angr.analyses.xrefs.SimEngineXRefsVEX(xref_manager, project=None, replacements=None)
Bases: SimEngineLightVEXMixin, SimEngineLight
The VEX engine class for XRefs analysis.
__init__(xref_manager, project=None, replacements=None)
add_xref(xref_type, from_loc, to_loc)
static extract_value_if_concrete(expr)
Extract the concrete value from expr if it is a concrete claripy AST.
Parameters
expr – A claripy AST.
Return type
int | None
Returns
A concrete value or None if nothing concrete can be extracted.
class angr.analyses.xrefs.XRefsAnalysis(func=None, func_graph=None, block=None, max_iterations=1,
replacements=None)
Bases: ForwardAnalysis, Analysis
XRefsAnalysis recovers in-depth x-refs (cross-references) in disassembly code.
Here is an example:.text:
000023C8
000023CA
000023CC
000023CE
000023D0

LDR
LDR
ADDS
STR
BX

.bss:
1FFF36F4 time_now% 4

R2, =time_now
R3, [R2]
R3, #1R3, [R2]LR

You will have the following x-refs for time_now:
23c8 - offset
23ca - read access23ce - write access__init__(func=None, func_graph=None, block=None, max_iterations=1, replacements=None)
Constructor
Parameters• order_jobs (bool) – If all jobs should be ordered or not.
• allow_merging (bool) – If job merging is allowed.
• allow_widening (bool) – If job widening is allowed.
• graph_visitor (GraphVisitor or None) – A graph visitor to provide successors.

1156

Chapter 10. API ReferenceangrReturnsNoneclass angr.analyses.proximity_graph.ProxiNodeTypes
Bases: object
Node Type Enums
Empty = 0
String = 1
Function = 2
FunctionCall = 3
Integer = 4
Unknown = 5
Variable = 6class angr.analyses.proximity_graph.BaseProxiNode(type_, ref_at=None)
Bases: object
Base class for all nodes in a proximity graph.
Parameters• type_ (int)• ref_at (set[int] | None)__init__(type_, ref_at=None)
Parameters• type_ (int)• ref_at (set[int] | None)class angr.analyses.proximity_graph.FunctionProxiNode(func, ref_at=None)
Bases: BaseProxiNode
Proximity node showing current and expanded function calls in graph.
Parameters
ref_at (set[int] | None)__init__(func, ref_at=None)
Parameters
ref_at (set[int] | None)class angr.analyses.proximity_graph.VariableProxiNode(addr, name, ref_at=None)
Bases: BaseProxiNode
Variable arg nodeParameters
ref_at (set[int] | None)

10.15. Analysis

1157

angr

__init__(addr, name, ref_at=None)
Parameters
ref_at (set[int] | None)class angr.analyses.proximity_graph.StringProxiNode(addr, content, ref_at=None)
Bases: BaseProxiNode
String arg nodeParameters
ref_at (set[int] | None)__init__(addr, content, ref_at=None)
Parameters
ref_at (set[int] | None)class angr.analyses.proximity_graph.CallProxiNode(callee, ref_at=None, args=None)
Bases: BaseProxiNode
Call nodeParameters• ref_at (set[int] | None)• args (tuple[BaseProxiNode] | None)__init__(callee, ref_at=None, args=None)
Parameters• ref_at (set[int] | None)• args (tuple[BaseProxiNode] | None)class angr.analyses.proximity_graph.IntegerProxiNode(value, ref_at=None)
Bases: BaseProxiNode
Int arg nodeParameters• value (int)• ref_at (set[int] | None)__init__(value, ref_at=None)
Parameters• value (int)• ref_at (set[int] | None)class angr.analyses.proximity_graph.UnknownProxiNode(dummy_value)
Bases: BaseProxiNode
Unknown arg nodeParameters
dummy_value (str)1158

Chapter 10. API Referenceangr__init__(dummy_value)
Parameters
dummy_value (str)class angr.analyses.proximity_graph.ProximityGraphAnalysis(func, cfg_model, xrefs,decompilation=None,
expand_funcs=None)
Bases: Analysis
Generate a proximity graph.
Parameters• func (Function)• cfg_model (CFGModel)• xrefs (XRefManager)• decompilation (Decompiler | None)• expand_funcs (set[int] | None)__init__(func, cfg_model, xrefs, decompilation=None, expand_funcs=None)
Parameters• func (Function)• cfg_model (CFGModel)• xrefs (XRefManager)• decompilation (Decompiler | None)• expand_funcs (set[int] | None)
Defines analysis that will generate a dynamic data-dependency graphclass angr.analyses.data_dep.data_dependency_analysis.NodalAnnotation(node)
Bases: Annotation
Allows a node to be stored as an annotation to a BV in a DefaultMemory instanceParametersnode (BaseDepNode)__init__(node)Parametersnode (BaseDepNode)property relocatable:bool

Can not be relocated in a simplification
property eliminatable
Can not be eliminated in a simplification
class angr.analyses.data_dep.data_dependency_analysis.DataDependencyGraphAnalysis(end_state,start_from=None,
end_at=None,
block_addrs=None)

10.15. Analysis

1159

angr

Bases: Analysis
This is a DYNAMIC data dependency graph that utilizes a given SimState to produce a DDG graph that isaccurate to the path the program took during execution.
This analysis utilizes the SimActionData objects present in the provided SimState’s action history to generate thedependency graph.
Parameters• end_state (SimState)• start_from (int | None)• end_at (int | None)• block_addrs (list[int] | None)__init__(end_state, start_from=None, end_at=None, block_addrs=None)
Parameters• end_state (SimState) – Simulation state used to extract all SimActionData• start_from (Optional[int]) – An address or None, Specifies where to start generationof DDG• end_at (Optional[int]) – An address or None, Specifies where to end generation ofDDG• block_addrs (list[int] | None) – List of block addresses that the DDG analysis
should be run on• block_addrs
property graph:

DiGraph | None

property simplified_graph:
property sub_graph:

DiGraph | None

DiGraph | None

get_data_dep(g_node, include_tmp_nodes, backwards)
Return type
DiGraph | None
Parameters• g_node (BaseDepNode)• include_tmp_nodes (bool)• backwards (bool)class angr.analyses.data_dep.sim_act_location.SimActLocation(bbl_addr, ins_addr, stmt_idx)
Bases: object
Structure-like class used to bundle the instruction address and statement index of a given SimAction in order touniquely identify a given SimAction
Parameters• bbl_addr (int)• ins_addr (int)1160

Chapter 10. API Referenceangr• stmt_idx (int)__init__(bbl_addr, ins_addr, stmt_idx)
Parameters• bbl_addr (int)• ins_addr (int)• stmt_idx (int)class angr.analyses.data_dep.sim_act_location.ParsedInstruction(ins_addr, min_stmt_idx,
max_stmt_idx)
Bases: object
Used by parser to facilitate linking with recent ancestors in an efficient manner
Parameters• ins_addr (int)• min_stmt_idx (int)• max_stmt_idx (int)__init__(ins_addr, min_stmt_idx, max_stmt_idx)
Parameters• ins_addr (int)• min_stmt_idx (int)• max_stmt_idx (int)class angr.analyses.data_dep.dep_nodes.DepNodeTypes
Bases: object
Enumeration of types of BaseDepNode supported by this analysis
Memory = 1
Register = 2
Tmp = 3
Constant = 4
class angr.analyses.data_dep.dep_nodes.BaseDepNode(type_, sim_act)
Bases: object
Base class for all nodes in a data-dependency graphParameters• type_ (int)• sim_act (SimActionData)__init__(type_, sim_act)
Parameters• type_ (int)• sim_act (SimActionData)

10.15. Analysis

1161

angr

value_tuple()
Return typetuple[BV, int]
Returns
A tuple containing the node’s value as a BV and as an evaluated integer
property ast:

BV

property type:

int

Getter :return: An integer defined in DepNodeTypes, represents the subclass type of this DepNode.
class angr.analyses.data_dep.dep_nodes.ConstantDepNode(sim_act, value)
Bases: BaseDepNode
Used to create a DepNode that will hold a constant, numeric value Uniquely identified by its value
Parameters• sim_act (SimActionData)• value (int)__init__(sim_act, value)
Parameters• sim_act (SimActionData)• value (int)class angr.analyses.data_dep.dep_nodes.MemDepNode(sim_act, addr)
Bases: BaseDepNode
Used to represent SimActions of type MEM
Parameters• sim_act (SimActionData)• addr (int)__init__(sim_act, addr)
Parameters• sim_act (SimActionData)• addr (int)property width:

intclassmethod cast_to_mem(base_dep_node)
Casts a BaseDepNode into a MemDepNode
Parameters
base_dep_node (BaseDepNode)class angr.analyses.data_dep.dep_nodes.VarDepNode(type_, sim_act, reg, arch_name='')Bases: BaseDepNode
Abstract class for representing SimActions of TYPE reg or tmp
Parameters

1162

Chapter 10. API Referenceangr• type_ (int)• sim_act (SimActionData)• reg (int)• arch_name (str)__init__(type_, sim_act, reg, arch_name='')Parameters• type_ (int)• sim_act (SimActionData)• reg (int)• arch_name (str)property display_name:strclass angr.analyses.data_dep.dep_nodes.TmpDepNode(sim_act, reg, arch_name='')Bases: VarDepNode
Used to represent SimActions of type TMPParameters• sim_act (SimActionData)• reg (int)• arch_name (str)__init__(sim_act, reg, arch_name='')Parameters• sim_act (SimActionData)• reg (int)• arch_name (str)class angr.analyses.data_dep.dep_nodes.RegDepNode(sim_act, reg, arch_name='')Bases: VarDepNode
Base class for representing SimActions of TYPE reg
Parameters• sim_act (SimActionData)• reg (int)• arch_name (str)__init__(sim_act, reg, arch_name='')Parameters• sim_act (SimActionData)• reg (int)• arch_name (str)10.15. Analysis

1163

angr

property reg_size:

intclass angr.analyses.data_dep.DataDependencyGraphAnalysis(end_state, start_from=None,
end_at=None, block_addrs=None)
Bases: Analysis
This is a DYNAMIC data dependency graph that utilizes a given SimState to produce a DDG graph that isaccurate to the path the program took during execution.
This analysis utilizes the SimActionData objects present in the provided SimState’s action history to generate thedependency graph.
Parameters• end_state (SimState)• start_from (int | None)• end_at (int | None)• block_addrs (list[int] | None)__init__(end_state, start_from=None, end_at=None, block_addrs=None)
Parameters• end_state (SimState) – Simulation state used to extract all SimActionData• start_from (Optional[int]) – An address or None, Specifies where to start generationof DDG• end_at (Optional[int]) – An address or None, Specifies where to end generation ofDDG• block_addrs (list[int] | None) – List of block addresses that the DDG analysis
should be run on• block_addrs
property graph:

DiGraph | None

property simplified_graph:
property sub_graph:

DiGraph | None

DiGraph | None

get_data_dep(g_node, include_tmp_nodes, backwards)
Return type
DiGraph | None
Parameters• g_node (BaseDepNode)• include_tmp_nodes (bool)• backwards (bool)class angr.analyses.data_dep.DepNodeTypes
Bases: object
Enumeration of types of BaseDepNode supported by this analysis
Memory = 1

1164

Chapter 10. API ReferenceangrRegister = 2
Tmp = 3
Constant = 4
class angr.analyses.data_dep.BaseDepNode(type_, sim_act)
Bases: object
Base class for all nodes in a data-dependency graphParameters• type_ (int)• sim_act (SimActionData)__init__(type_, sim_act)
Parameters• type_ (int)• sim_act (SimActionData)
value_tuple()
Return typetuple[BV, int]
Returns
A tuple containing the node’s value as a BV and as an evaluated integer
property ast:

BV

property type: int
Getter :return: An integer defined in DepNodeTypes, represents the subclass type of this DepNode.
class angr.analyses.data_dep.VarDepNode(type_, sim_act, reg, arch_name='')Bases: BaseDepNode
Abstract class for representing SimActions of TYPE reg or tmp
Parameters• type_ (int)• sim_act (SimActionData)• reg (int)• arch_name (str)__init__(type_, sim_act, reg, arch_name='')Parameters• type_ (int)• sim_act (SimActionData)• reg (int)• arch_name (str)property display_name:10.15. Analysis

str

1165

angr

class angr.analyses.data_dep.MemDepNode(sim_act, addr)
Bases: BaseDepNode
Used to represent SimActions of type MEM
Parameters• sim_act (SimActionData)• addr (int)__init__(sim_act, addr)
Parameters• sim_act (SimActionData)• addr (int)property width:

intclassmethod cast_to_mem(base_dep_node)
Casts a BaseDepNode into a MemDepNode
Parameters
base_dep_node (BaseDepNode)class angr.analyses.data_dep.ConstantDepNode(sim_act, value)
Bases: BaseDepNode
Used to create a DepNode that will hold a constant, numeric value Uniquely identified by its value
Parameters• sim_act (SimActionData)• value (int)__init__(sim_act, value)
Parameters• sim_act (SimActionData)• value (int)class angr.analyses.data_dep.TmpDepNode(sim_act, reg, arch_name='')Bases: VarDepNode
Used to represent SimActions of type TMPParameters• sim_act (SimActionData)• reg (int)• arch_name (str)__init__(sim_act, reg, arch_name='')Parameters• sim_act (SimActionData)• reg (int)• arch_name (str)1166

Chapter 10. API Referenceangrclass angr.analyses.data_dep.RegDepNode(sim_act, reg, arch_name='')Bases: VarDepNode
Base class for representing SimActions of TYPE reg
Parameters• sim_act (SimActionData)• reg (int)• arch_name (str)__init__(sim_act, reg, arch_name='')Parameters• sim_act (SimActionData)• reg (int)• arch_name (str)property reg_size:

int

exception angr.blade.BadJumpkindNotification
Bases: Exception
Notifies the caller that the jumpkind is bad (e.g., Ijk_NoDecode)class angr.blade.Blade(graph, dst_run, dst_stmt_idx, direction='backward', project=None, cfg=None,
ignore_sp=False, ignore_bp=False, ignored_regs=None, max_level=3,
base_state=None, stop_at_calls=False, cross_insn_opt=False, max_predecessors=10,
include_imarks=True)
Bases: object
Blade is a light-weight program slicer that works with networkx DiGraph containing CFGNodes. It is meant to
be used in angr for small or on-the-fly analyses.
Parameters• graph (networkx.DiGraph )• dst_run (int)• dst_stmt_idx (int)• direction (str)• ignore_sp (bool)• ignore_bp (bool)• max_level (int)• stop_at_calls (bool)• max_predecessors (int)• include_imarks (bool)__init__(graph, dst_run, dst_stmt_idx, direction='backward', project=None, cfg=None, ignore_sp=False,
ignore_bp=False, ignored_regs=None, max_level=3, base_state=None, stop_at_calls=False,
cross_insn_opt=False, max_predecessors=10, include_imarks=True)
Parameters10.15. Analysis

1167

angr

• graph (DiGraph) – A graph representing the control flow graph. Note that it does not takeangr.analyses.CFGEmulated or angr.analyses.CFGFast.
• dst_run (int) – An address specifying the target SimRun.
• dst_stmt_idx (int) – The target statement index. -1 means executing until the last statement.
• direction (str) – ‘backward’ or ‘forward’ slicing. Forward slicing is not yet supported.
• project (angr.Project) – The project instance.
• cfg (angr.analyses.CFGBase) – the CFG instance. It will be made mandatory later.
• ignore_sp (bool) – Whether the stack pointer should be ignored in dependency tracking.
Any dependency from/to stack pointers will be ignored if this options is True.
• ignore_bp (bool) – Whether the base pointer should be ignored or not.
• max_level (int) – The maximum number of blocks that we trace back for.
• stop_at_calls (bool) – Limit slicing within a single function. Do not proceed when
encounters a call edge.
• include_imarks (bool) – Should IMarks (instruction boundaries) be included in theslice.
• max_predecessors (int)
ReturnsNoneproperty slice
dbg_repr(arch=None)class angr.slicer.SimLightState(temps=None, regs=None, stack_offsets=None, options=None)
Bases: object
Represents a program state. Only used in SimSlicer.
__init__(temps=None, regs=None, stack_offsets=None, options=None)
temps
regs
stack_offsets
optionsclass angr.slicer.SimSlicer(arch, statements, target_tmps=None, target_regs=None,target_stack_offsets=None, inslice_callback=None,inslice_callback_infodict=None, include_imarks=True)
Bases: object
A super lightweight intra-IRSB slicing class.
Parameters
include_imarks (bool)

1168

Chapter 10. API Referenceangr__init__(arch, statements, target_tmps=None, target_regs=None, target_stack_offsets=None,inslice_callback=None, inslice_callback_infodict=None, include_imarks=True)
Parameters
include_imarks (bool)class angr.annocfg.AnnotatedCFG(project, cfg=None, detect_loops=False)
Bases: object
AnnotatedCFG is a control flow graph with statement whitelists and exit whitelists to describe a slice of the
program.
__init__(project, cfg=None, detect_loops=False)
Constructor.
Parameters• project – The angr Project instance• cfg – Control flow graph.
• detect_loops
from_digraph(digraph)
Initialize this AnnotatedCFG object with a networkx.DiGraph consisting of the following form of nodes:
Tuples like (block address, statement ID)
Those nodes are connected by edges indicating the execution flow.
Parameters
digraph (networkx.DiGraph ) – A networkx.DiGraph object
get_addr(run)add_block_to_whitelist(block)add_statements_to_whitelist(block, stmt_ids)
add_exit_to_whitelist(run_from, run_to)
set_last_statement(block_addr, stmt_id)
add_loop(loop_tuple)
A loop tuple contains a series of IRSB addresses that form a loop. Ideally it always starts with the first
IRSB that we meet during the execution.
should_take_exit(addr_from, addr_to)should_execute_statement(addr, stmt_id)
get_run(addr)
get_whitelisted_statements(addr)
Returns
True if all statements are whitelisted
get_last_statement_index(addr)
Get the statement index of the last statement to execute in the basic block specified by addr.
Parametersaddr (int) – Address of the basic block.
10.15. Analysis

1169

angr

Returns
The statement index of the last statement to be executed in the block. Usually if the default
exit is taken, it will be the last statement to execute. If the block is not in the slice or we should
never take any exit going to this block, None is returned.
Return type
int or None
get_loops()
get_targets(source_addr)
dbg_repr()
dbg_print_irsb(irsb_addr, project=None)
Pretty-print an IRSB with whitelist information
keep_path(path)
Given a path, returns True if the path should be kept, False if it should be cut.
merge_points(path)
successor_func(path)
Callback routine that takes in a path, and returns all feasible successors to path group. This callback routine
should be passed to the keyword argument “successor_func” of PathGroup.step().
Parameters
path – A Path instance.
Returns
A list of all feasible Path successors.
angr.codenode.repr_addr(addr)
class angr.codenode.CodeNode(addr, size, graph=None, thumb=False)
Bases: object
Parameters• addr (int)• size (int)__init__(addr, size, graph=None, thumb=False)
Parameters• addr (int)• size (int)
addr:

int

size:

int

thumb
successors()
Return type
list[CodeNode]1170

Chapter 10. API Referenceangrpredecessors()
is_hook = Noneclass angr.codenode.BlockNode(addr, size, bytestr=None, **kwargs)
Bases: CodeNode
Parameters• addr (int)• size (int)
is_hook = False__init__(addr, size, bytestr=None, **kwargs)
Parametersaddr (int)bytestrclass angr.codenode.SootBlockNode(addr, size, stmts, **kwargs)
Bases: BlockNode
Parameters• addr (int)• size (int)__init__(addr, size, stmts, **kwargs)
stmts
class angr.codenode.HookNode(addr, size, sim_procedure, **kwargs)
Bases: CodeNode
Parameters• addr (int)• size (int)
is_hook = True__init__(addr, size, sim_procedure, **kwargs)
Parameters
sim_procedure (type) – the the sim_procedure classsim_procedureclass angr.codenode.SyscallNode(addr, size, sim_procedure, **kwargs)
Bases: HookNode
Parameters• addr (int)• size (int)
is_hook = False
sim_procedure

10.15. Analysis

1171

angr

10.16 SimOSManage OS-level configuration.
class angr.simos.SimOS(project, name=None)
Bases: object
A class describing OS/arch-level configuration.
Parameters
project (angr.Project)__init__(project, name=None)
Parameters
project (Project)configure_project()Configure the project to set up global settings (like SimProcedures).
state_blank(addr=None, initial_prefix=None, brk=None, stack_end=None, stack_size=8388608,
stdin=None, thread_idx=None, permissions_backer=None, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.
• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space• brk – The address of the process’ break.
Returns
The initialized SimState.
Any additional arguments will be passed to the SimState constructor
state_entry(**kwargs)
state_full_init(**kwargs)
state_call(addr, *args, **kwargs)
prepare_call_state(calling_state, initial_state=None, preserve_registers=(), preserve_memory=())
This function prepares a state that is executing a call instruction. If given an initial_state, it copies over allof the critical registers to it from the calling_state. Otherwise, it prepares the calling_state for action.
This is mostly used to create minimalistic for CFG generation. Some ABIs, such as MIPS PIE and x86 PIE,
require certain information to be maintained in certain registers. For example, for PIE MIPS, this function
transfer t9, gp, and ra to the new state.
prepare_function_symbol(symbol_name, basic_addr=None)
Prepare the address space with the data necessary to perform relocations pointing to the given symbol
Returns a 2-tuple. The first item is the address of the function code, the second is the address of therelocation target.

1172

Chapter 10. API Referenceangrhandle_exception(successors, engine, exception)
Perform exception handling. This method will be called when, during execution, a SimException is thrown.
Currently, this can only indicate a segfault, but in the future it could indicate any unexpected exceptional
behavior that can’t be handled by ordinary control flow.
The method may mutate the provided SimSuccessors object in any way it likes, or re-raise the exception.
Parameters• successors – The SimSuccessors object currently being executed on• engine – The engine that was processing this step
• exception – The actual exception object
syscall(state, allow_unsupported=True)syscall_abi(state)
Return typestr
syscall_cc(state)
Return type
SimCCSyscall | None
is_syscall_addr(addr)
syscall_from_addr(addr, allow_unsupported=True)syscall_from_number(number, allow_unsupported=True, abi=None)
setup_gdt(state, gdt)
Write the GlobalDescriptorTable object in the current state memory
Parameters• state – state in which to write the GDT• gdt – GlobalDescriptorTable object
Returns
generate_gdt(fs, gs, fs_size=4294967295, gs_size=4294967295)
Generate a GlobalDescriptorTable object and populate it using the value of the gs and fs register
Parameters• fs – value of the fs segment register• gs – value of the gs segment register• fs_size – size of the fs segment register• gs_size – size of the gs segment register
Returns
gdt a GlobalDescriptorTable object

10.16. SimOS

1173

angr

class angr.simos.SimUserland(project, syscall_library=None, syscall_addr_alignment=4, **kwargs)
Bases: SimOS
This is a base class for any SimOS that wants to support syscalls.
It uses the CLE kernel object to provide addresses for syscalls. Syscalls will be emulated as a jump to one ofthese addresses, where a SimProcedure from the syscall library provided at construction time will be executed.
__init__(project, syscall_library=None, syscall_addr_alignment=4, **kwargs)
configure_project(abi_list=None)
Configure the project to set up global settings (like SimProcedures).
syscall_cc(state)
Return type
SimCCSyscall
syscall(state, allow_unsupported=True)
Given a state, return the procedure corresponding to the current syscall. This procedure will have.syscall_number, .display_name, and .addr set.
Parameters• state – The state to get the syscall number from• allow_unsupported – Whether to return a “dummy” sycall instead of raising an unsupported exception
syscall_abi(state)
Optionally, override this function to determine which abi is being used for the state’s current syscall.
is_syscall_addr(addr)
Return whether or not the given address corresponds to a syscall implementation.
syscall_from_addr(addr, allow_unsupported=True)
Get a syscall SimProcedure from an address.
Parameters• addr – The address to convert to a syscall SimProcedure• allow_unsupported – Whether to return a dummy procedure for an unsupported syscall
instead of raising an exception.
Returns
The SimProcedure for the syscall, or None if the address is not a syscall address.
syscall_from_number(number, allow_unsupported=True, abi=None)
Get a syscall SimProcedure from its number.
Parameters• number – The syscall number• allow_unsupported – Whether to return a “stub” syscall for unsupported numbers instead of throwing an error• abi – The name of the abi to use. If None, will assume that the abis have disjoint numbering
schemes and pick the right one.
Returns
The SimProcedure for the syscall

1174

Chapter 10. API Referenceangrclass angr.simos.SimLinux(project, **kwargs)
Bases: SimUserland
OS-specific configuration for *nix-y OSes.
__init__(project, **kwargs)
configure_project()Configure the project to set up global settings (like SimProcedures).
syscall_abi(state)
Optionally, override this function to determine which abi is being used for the state’s current syscall.
state_blank(fs=None, concrete_fs=False, chroot=None, cwd=None, pathsep=b'/', thread_idx=None,
init_libc=False, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.
• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space• brk – The address of the process’ break.
Returns
The initialized SimState.
Any additional arguments will be passed to the SimState constructor
state_entry(args=None, env=None, argc=None, **kwargs)
set_entry_register_values(state)state_full_init(**kwargs)
prepare_function_symbol(symbol_name, basic_addr=None)
Prepare the address space with the data necessary to perform relocations pointing to the given symbol.
Returns a 2-tuple. The first item is the address of the function code, the second is the address of therelocation target.
initialize_segment_register_x64(state, concrete_target)
Set the fs register in the angr to the value of the fs register in the concrete process
Parameters• state – state which will be modified• concrete_target – concrete target that will be used to read the fs register
ReturnsNoneinitialize_gdt_x86(state, concrete_target)
Create a GDT in the state memory and populate the segment registers. Rehook the vsyscall address using
the real value in the concrete process memory

10.16. SimOS

1175

angr

Parameters• state – state which will be modified• concrete_target – concrete target that will be used to read the fs register
Returns
get_segment_register_name()class angr.simos.SimCGC(project, **kwargs)
Bases: SimUserland
Environment configuration for the CGC DECREE platform__init__(project, **kwargs)
state_blank(flag_page=None, allocate_stack_page_count=256, **kwargs)
Parameters• flag_page – Flag page content, either a string or a list of BV8s
• allocate_stack_page_count – Number of pages to pre-allocate for stackstate_entry(add_options=None, **kwargs)
class angr.simos.SimWindows(project)
Bases: SimOS
Environment for the Windows Win32 subsystem. Does not support syscalls currently.
__init__(project)configure_project()Configure the project to set up global settings (like SimProcedures).
state_entry(args=None, env=None, argc=None, **kwargs)
state_blank(thread_idx=None, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.
• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space• brk – The address of the process’ break.
Returns
The initialized SimState.
Any additional arguments will be passed to the SimState constructor

1176

Chapter 10. API Referenceangrhandle_exception(successors, engine, exception)
Perform exception handling. This method will be called when, during execution, a SimException is thrown.
Currently, this can only indicate a segfault, but in the future it could indicate any unexpected exceptional
behavior that can’t be handled by ordinary control flow.
The method may mutate the provided SimSuccessors object in any way it likes, or re-raise the exception.
Parameters• successors – The SimSuccessors object currently being executed on• engine – The engine that was processing this step
• exception – The actual exception object
initialize_segment_register_x64(state, concrete_target)
Set the gs register in the angr to the value of the fs register in the concrete process
Parameters• state – state which will be modified• concrete_target – concrete target that will be used to read the fs register
ReturnsNoneinitialize_gdt_x86(state, concrete_target)
Create a GDT in the state memory and populate the segment registers.
Parameters• state – state which will be modified• concrete_target – concrete target that will be used to read the fs register
Returns
the created GlobalDescriptorTable object
get_segment_register_name()class angr.simos.SimJavaVM(*args, **kwargs)
Bases: SimOS__init__(*args, **kwargs)
state_blank(addr=None, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.
• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space• brk – The address of the process’ break.
Returns
The initialized SimState.

10.16. SimOS

1177

angr

Any additional arguments will be passed to the SimState constructor
state_entry(args=None, **kwargs)
Create an entry state.
Parametersargs – List of SootArgument values (optional).
static generate_symbolic_cmd_line_arg(state)
Generates a new symbolic cmd line argument string. :return: The string reference.
state_call(addr, *args, **kwargs)
Create a native or a Java call state.
Parameters• addr – Soot or native addr of the invoke target.
• args – List of SootArgument values.
static get_default_value_by_type(type_, state)Java specify defaults values for primitive and reference types. This method returns the default value for agiven type.
Parameters• type (str) – Name of type.
• state (SimState) – Current SimState.
Returns
Default value for this type.
static cast_primitive(state, value, to_type)
Cast the value of primitive types.
Parameters• value – Bitvector storing the primitive value.
• to_type – Name of the targeted type.
Returns
Resized value.
static init_static_field(state, field_class_name, field_name, field_type)
Initialize the static field with an allocated, but not initialized, object of the given type.
Parameters• state – State associated to the field.
• field_class_name – Class containing the field.
• field_name – Name of the field.
• field_type – Type of the field and the new object.
static get_cmd_line_args(state)
get_addr_of_native_method(soot_method)Get address of the implementation from a native declared Java function.
Parameters
soot_method – Method descriptor of a native declared function.
1178

Chapter 10. API ReferenceangrReturns
CLE address of the given method.
get_native_type(java_type)
Maps the Java type to a SimTypeReg representation of its native counterpart. This type can be used toindicate the (well-defined) size of native JNI types.
Returns
A SymTypeReg with the JNI size of the given type.
property native_arch
Arch of the native simos.
Type
returnget_native_cc()
Returns
SimCC object for the native simos.
class angr.simos.SimSnimmucNxp(project, name=None, **kwargs)
Bases: SimOS
This class implements the “OS” for a bare-metal firmware used at an imaginary company.
Parameters
project (Project)__init__(project, name=None, **kwargs)
Parameters
project (Project)configure_project()Configure the project to set up global settings (like SimProcedures).
class angr.simos.simos.SimOS(project, name=None)
Bases: object
A class describing OS/arch-level configuration.
Parameters
project (angr.Project)__init__(project, name=None)
Parameters
project (Project)configure_project()Configure the project to set up global settings (like SimProcedures).
state_blank(addr=None, initial_prefix=None, brk=None, stack_end=None, stack_size=8388608,
stdin=None, thread_idx=None, permissions_backer=None, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.

10.16. SimOS

1179

angr

• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space• brk – The address of the process’ break.
Returns
The initialized SimState.
Any additional arguments will be passed to the SimState constructor
state_entry(**kwargs)
state_full_init(**kwargs)
state_call(addr, *args, **kwargs)
prepare_call_state(calling_state, initial_state=None, preserve_registers=(), preserve_memory=())
This function prepares a state that is executing a call instruction. If given an initial_state, it copies over allof the critical registers to it from the calling_state. Otherwise, it prepares the calling_state for action.
This is mostly used to create minimalistic for CFG generation. Some ABIs, such as MIPS PIE and x86 PIE,
require certain information to be maintained in certain registers. For example, for PIE MIPS, this function
transfer t9, gp, and ra to the new state.
prepare_function_symbol(symbol_name, basic_addr=None)
Prepare the address space with the data necessary to perform relocations pointing to the given symbol
Returns a 2-tuple. The first item is the address of the function code, the second is the address of therelocation target.
handle_exception(successors, engine, exception)
Perform exception handling. This method will be called when, during execution, a SimException is thrown.
Currently, this can only indicate a segfault, but in the future it could indicate any unexpected exceptional
behavior that can’t be handled by ordinary control flow.
The method may mutate the provided SimSuccessors object in any way it likes, or re-raise the exception.
Parameters• successors – The SimSuccessors object currently being executed on• engine – The engine that was processing this step
• exception – The actual exception object
syscall(state, allow_unsupported=True)syscall_abi(state)
Return typestr
syscall_cc(state)
Return type
SimCCSyscall | None
is_syscall_addr(addr)
syscall_from_addr(addr, allow_unsupported=True)

1180

Chapter 10. API Referenceangrsyscall_from_number(number, allow_unsupported=True, abi=None)
setup_gdt(state, gdt)
Write the GlobalDescriptorTable object in the current state memory
Parameters• state – state in which to write the GDT• gdt – GlobalDescriptorTable object
Returns
generate_gdt(fs, gs, fs_size=4294967295, gs_size=4294967295)
Generate a GlobalDescriptorTable object and populate it using the value of the gs and fs register
Parameters• fs – value of the fs segment register• gs – value of the gs segment register• fs_size – size of the fs segment register• gs_size – size of the gs segment register
Returns
gdt a GlobalDescriptorTable object
class angr.simos.simos.GlobalDescriptorTable(addr, limit, table, gdt_sel, cs_sel, ds_sel, es_sel, ss_sel,
fs_sel, gs_sel)
Bases: object
GlobalDescriptorTable object to store the GDT table and the segment registers values__init__(addr, limit, table, gdt_sel, cs_sel, ds_sel, es_sel, ss_sel, fs_sel, gs_sel)class angr.simos.linux.SimLinux(project, **kwargs)
Bases: SimUserland
OS-specific configuration for *nix-y OSes.
__init__(project, **kwargs)
configure_project()Configure the project to set up global settings (like SimProcedures).
syscall_abi(state)
Optionally, override this function to determine which abi is being used for the state’s current syscall.
state_blank(fs=None, concrete_fs=False, chroot=None, cwd=None, pathsep=b'/', thread_idx=None,
init_libc=False, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.
• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space
10.16. SimOS

1181

angr

• brk – The address of the process’ break.
Returns
The initialized SimState.
Any additional arguments will be passed to the SimState constructor
state_entry(args=None, env=None, argc=None, **kwargs)
set_entry_register_values(state)state_full_init(**kwargs)
prepare_function_symbol(symbol_name, basic_addr=None)
Prepare the address space with the data necessary to perform relocations pointing to the given symbol.
Returns a 2-tuple. The first item is the address of the function code, the second is the address of therelocation target.
initialize_segment_register_x64(state, concrete_target)
Set the fs register in the angr to the value of the fs register in the concrete process
Parameters• state – state which will be modified• concrete_target – concrete target that will be used to read the fs register
ReturnsNoneinitialize_gdt_x86(state, concrete_target)
Create a GDT in the state memory and populate the segment registers. Rehook the vsyscall address using
the real value in the concrete process memory
Parameters• state – state which will be modified• concrete_target – concrete target that will be used to read the fs register
Returns
get_segment_register_name()class angr.simos.cgc.SimCGC(project, **kwargs)
Bases: SimUserland
Environment configuration for the CGC DECREE platform__init__(project, **kwargs)
state_blank(flag_page=None, allocate_stack_page_count=256, **kwargs)
Parameters• flag_page – Flag page content, either a string or a list of BV8s
• allocate_stack_page_count – Number of pages to pre-allocate for stackstate_entry(add_options=None, **kwargs)

1182

Chapter 10. API Referenceangrclass angr.simos.userland.SimUserland(project, syscall_library=None, syscall_addr_alignment=4,**kwargs)
Bases: SimOS
This is a base class for any SimOS that wants to support syscalls.
It uses the CLE kernel object to provide addresses for syscalls. Syscalls will be emulated as a jump to one ofthese addresses, where a SimProcedure from the syscall library provided at construction time will be executed.
__init__(project, syscall_library=None, syscall_addr_alignment=4, **kwargs)
configure_project(abi_list=None)
Configure the project to set up global settings (like SimProcedures).
syscall_cc(state)
Return type
SimCCSyscall
syscall(state, allow_unsupported=True)
Given a state, return the procedure corresponding to the current syscall. This procedure will have.syscall_number, .display_name, and .addr set.
Parameters• state – The state to get the syscall number from• allow_unsupported – Whether to return a “dummy” sycall instead of raising an unsupported exception
syscall_abi(state)
Optionally, override this function to determine which abi is being used for the state’s current syscall.
is_syscall_addr(addr)
Return whether or not the given address corresponds to a syscall implementation.
syscall_from_addr(addr, allow_unsupported=True)
Get a syscall SimProcedure from an address.
Parameters• addr – The address to convert to a syscall SimProcedure• allow_unsupported – Whether to return a dummy procedure for an unsupported syscall
instead of raising an exception.
Returns
The SimProcedure for the syscall, or None if the address is not a syscall address.
syscall_from_number(number, allow_unsupported=True, abi=None)
Get a syscall SimProcedure from its number.
Parameters• number – The syscall number• allow_unsupported – Whether to return a “stub” syscall for unsupported numbers instead of throwing an error• abi – The name of the abi to use. If None, will assume that the abis have disjoint numbering
schemes and pick the right one.

10.16. SimOS

1183

angr

Returns
The SimProcedure for the syscallclass angr.simos.windows.SecurityCookieInit(value)
Bases: Enum
An enumeration.
NONE = 0
RANDOM = 1
STATIC = 2
SYMBOLIC = 3
class angr.simos.windows.SimWindows(project)
Bases: SimOS
Environment for the Windows Win32 subsystem. Does not support syscalls currently.
__init__(project)configure_project()Configure the project to set up global settings (like SimProcedures).
state_entry(args=None, env=None, argc=None, **kwargs)
state_blank(thread_idx=None, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.
• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space• brk – The address of the process’ break.
Returns
The initialized SimState.
Any additional arguments will be passed to the SimState constructor
handle_exception(successors, engine, exception)
Perform exception handling. This method will be called when, during execution, a SimException is thrown.
Currently, this can only indicate a segfault, but in the future it could indicate any unexpected exceptional
behavior that can’t be handled by ordinary control flow.
The method may mutate the provided SimSuccessors object in any way it likes, or re-raise the exception.
Parameters• successors – The SimSuccessors object currently being executed on• engine – The engine that was processing this step
• exception – The actual exception object

1184

Chapter 10. API Referenceangrinitialize_segment_register_x64(state, concrete_target)
Set the gs register in the angr to the value of the fs register in the concrete process
Parameters• state – state which will be modified• concrete_target – concrete target that will be used to read the fs register
ReturnsNoneinitialize_gdt_x86(state, concrete_target)
Create a GDT in the state memory and populate the segment registers.
Parameters• state – state which will be modified• concrete_target – concrete target that will be used to read the fs register
Returns
the created GlobalDescriptorTable object
get_segment_register_name()class angr.simos.javavm.SimJavaVM(*args, **kwargs)
Bases: SimOS__init__(*args, **kwargs)
state_blank(addr=None, **kwargs)
Initialize a blank state.
All parameters are optional.
Parameters• addr – The execution start address.
• initial_prefix• stack_end – The end of the stack (i.e., the byte after the last valid stack address).
• stack_size – The number of bytes to allocate for stack space• brk – The address of the process’ break.
Returns
The initialized SimState.
Any additional arguments will be passed to the SimState constructor
state_entry(args=None, **kwargs)
Create an entry state.
Parametersargs – List of SootArgument values (optional).
static generate_symbolic_cmd_line_arg(state)
Generates a new symbolic cmd line argument string. :return: The string reference.

10.16. SimOS

1185

angr

state_call(addr, *args, **kwargs)
Create a native or a Java call state.
Parameters• addr – Soot or native addr of the invoke target.
• args – List of SootArgument values.
static get_default_value_by_type(type_, state)Java specify defaults values for primitive and reference types. This method returns the default value for agiven type.
Parameters• type (str) – Name of type.
• state (SimState) – Current SimState.
Returns
Default value for this type.
static cast_primitive(state, value, to_type)
Cast the value of primitive types.
Parameters• value – Bitvector storing the primitive value.
• to_type – Name of the targeted type.
Returns
Resized value.
static init_static_field(state, field_class_name, field_name, field_type)
Initialize the static field with an allocated, but not initialized, object of the given type.
Parameters• state – State associated to the field.
• field_class_name – Class containing the field.
• field_name – Name of the field.
• field_type – Type of the field and the new object.
static get_cmd_line_args(state)
get_addr_of_native_method(soot_method)Get address of the implementation from a native declared Java function.
Parameters
soot_method – Method descriptor of a native declared function.
Returns
CLE address of the given method.
get_native_type(java_type)
Maps the Java type to a SimTypeReg representation of its native counterpart. This type can be used toindicate the (well-defined) size of native JNI types.
Returns
A SymTypeReg with the JNI size of the given type.

1186

Chapter 10. API Referenceangrproperty native_arch
Arch of the native simos.
Type
returnget_native_cc()
Returns
SimCC object for the native simos.
angr.simos.javavm.prepare_native_return_state(native_state)
Hook target for native function call returns.
Recovers and stores the return value from native memory and toggles the state, s.t. execution continues in the
Soot engine.
Note: Redirection needed for pickling.

10.17 Function Signature Matchingclass angr.flirt.FlirtSignature(arch, platform, sig_name, sig_path, unique_strings=None, compiler=None,
compiler_version=None, os_name=None, os_version=None)
Bases: object
This class describes a FLIRT signature.
Parameters• arch (str)• platform (str)• sig_name (str)• sig_path (str)• unique_strings (set[str] | None)• compiler (str | None)• compiler_version (str | None)• os_name (str | None)• os_version (str | None)__init__(arch, platform, sig_name, sig_path, unique_strings=None, compiler=None,
compiler_version=None, os_name=None, os_version=None)
Parameters• arch (str)• platform (str)• sig_name (str)• sig_path (str)• unique_strings (set[str] | None)• compiler (str | None)• compiler_version (str | None)
10.17. Function Signature Matching

1187

angr

• os_name (str | None)• os_version (str | None)angr.flirt.FS
alias of FlirtSignatureangr.flirt.load_signatures(path)
Recursively load all FLIRT signatures under a specific path.
Parameters
path (str) – Location of FLIRT signatures.
Return type
Noneangr.flirt.build_sig.get_basic_info(ar_path)Get basic information of the archive file.
Return type
dict[str, str]
Parametersar_path (str)angr.flirt.build_sig.get_unique_strings(ar_path)
For Linux libraries, this method requires ar (from binutils), nm (from binutils), and strings.
Return type
list[str]
Parametersar_path (str)angr.flirt.build_sig.run_pelf(pelf_path, ar_path, output_path)
Parameters• pelf_path (str)• ar_path (str)• output_path (str)angr.flirt.build_sig.run_sigmake(sigmake_path, sig_name, pat_path, sig_path)
Parameters• sigmake_path (str)• sig_name (str)• pat_path (str)• sig_path (str)angr.flirt.build_sig.process_exc_file(exc_path)
We are doing the stupidest thing possible: For each batch of conflicts, we pick the most likely result based on aset of predefined rules.
TODO: Add caller-callee-based de-duplication.
Parameters
exc_path (str)1188

Chapter 10. API Referenceangrangr.flirt.build_sig.main()

10.18 Utils
angr.utils.timethis(func)
angr.utils.is_pyinstaller()
Detect if we are currently running as a PyInstaller-packaged program.
Return typebool
Returns
True if we are running as a PyInstaller-packaged program. False if we are running in Python
directly (e.g., development mode).
angr.utils.looks_like_sql(s)Determine if string s looks like an SQL query.
Parameterss (str) – The string to detect.
Return typebool
Returns
True if the string looks like an SQL, False otherwise.
angr.utils.algo.binary_insert(lst, elem, key, lo=0, hi=None)
Insert an element into a sorted list, and keep the list sorted.
The major difference from bisect.bisect_left is that this function supports a key method, so user doesn’t have tocreate the key array for each insertion.
Parameters• lst (list) – The list. Must be pre-ordered.
• element (object) – An element to insert into the list.
• key (func) – A method to get the key for each element in the list.
• lo (int) – Lower bound of the search.
• hi (int) – Upper bound of the search.
• elem (Any)Return type
None
ReturnsNoneangr.utils.constants.is_alignment_mask(n)class angr.utils.cowdict.ChainMapCOW(*args, collapse_threshold=None)
Bases: ChainMap
Implements a copy-on-write version of ChainMap that supports auto-collapsing.

10.18. Utils

1189

angr

__init__(*args, collapse_threshold=None)
Initialize a ChainMap by setting maps to the given mappings. If no mappings are provided, a single empty
dictionary is used.
copy()New ChainMap or subclass with a new copy of maps[0] and refs to maps[1:]clean()
class angr.utils.cowdict.DefaultChainMapCOW(*args, default_factory=None, collapse_threshold=None)
Bases: ChainMapCOW
Implements a copy-on-write version of ChainMap with default values that supports auto-collapsing.
__init__(*args, default_factory=None, collapse_threshold=None)
Initialize a ChainMap by setting maps to the given mappings. If no mappings are provided, a single empty
dictionary is used.
clean()
class angr.utils.dynamic_dictlist.DynamicDictList(max_size=None, content=None)
Bases: Generic[VT]A list-like container class that internally uses dicts to store values when the number of values is less than thethreshold LIST2DICT_THRESHOLD. Keys must be ints.
The default thresholds are determined according to experiments described at https://github.com/angr/angr/pull/
3471#issuecomment-1236515950.
Parameters• max_size (int | None)• content (DynamicDictList | dict[int, VT] | list[VT] | None)__init__(max_size=None, content=None)
Parameters• max_size (int | None)• content (DynamicDictList | dict[int, VT] | list[VT] | None)
list_content:

list[TypeVar(VT)] | None

max_size
dict_content:

dict[int, TypeVar(VT)] | None

real_length()
Return typeint
angr.utils.enums_conv.cfg_jumpkind_to_pb(jk)angr.utils.enums_conv.func_edge_type_to_pb(jk)angr.utils.enums_conv.cfg_jumpkind_from_pb(pb)angr.utils.enums_conv.func_edge_type_from_pb(pb)1190

Chapter 10. API Referenceangrangr.utils.env.is_pyinstaller()
Detect if we are currently running as a PyInstaller-packaged program.
Return typebool
Returns
True if we are running as a PyInstaller-packaged program. False if we are running in Python
directly (e.g., development mode).
angr.utils.graph.shallow_reverse(g)Make a shallow copy of a directional graph and reverse the edges. This is a workaround to solve the issue that
one cannot easily make a shallow reversed copy of a graph in NetworkX 2, since networkx.reverse(copy=False)
now returns a GraphView, and GraphViews are always read-only.
Parametersg (networkx.DiGraph ) – The graph to reverse.
Return type
DiGraphReturns
A new networkx.DiGraph that has all nodes and all edges of the original graph, with edges reversed.
angr.utils.graph.inverted_idoms(graph)
Invert the given graph and generate the immediate dominator tree on the inverted graph. This is useful forcomputing post-dominators.
Parametersgraph (DiGraph) – The graph to invert and generate immediate dominator tree for.
Return typetuple[DiGraph, dict | None]
Returns
A tuple of the inverted graph and the immediate dominator tree.
angr.utils.graph.to_acyclic_graph(graph, ordered_nodes=None, loop_heads=None)
Convert a given DiGraph into an acyclic graph.
Parameters• graph (DiGraph) – The graph to convert.
• ordered_nodes (Optional[list]) – A list of nodes sorted in a topological order.
• loop_heads (Optional[list]) – A list of known loop head nodes.
Return type
DiGraphReturns
The converted acyclic graph.
angr.utils.graph.dfs_back_edges(graph, start_node)
Perform an iterative DFS traversal of the graph, returning back edges.
Parameters• graph – The graph to traverse.
• start_node – The node where to start the traversal.

10.18. Utils

1191

angr

Returns
An iterator of ‘backward’ edges.
angr.utils.graph.subgraph_between_nodes(graph, source, frontier, include_frontier=False)
For a directed graph, return a subgraph that includes all nodes going from a source node to a target node.
Parameters• graph (networkx.DiGraph ) – The directed graph.
• source – The source node.
• frontier (list) – A collection of target nodes.
• include_frontier (bool) – Should nodes in frontier be included in the subgraph.
Returns
A subgraph.
Return typenetworkx.DiGraphangr.utils.graph.dominates(idom, dominator_node, node)angr.utils.graph.compute_dominance_frontier(graph, domtree)
Compute a dominance frontier based on the given post-dominator tree.
This implementation is based on figure 2 of paper An Efficient Method of Computing Static Single Assignment
Form by Ron Cytron, etc.
Parameters• graph – The graph where we want to compute the dominance frontier.
• domtree – The dominator tree
Returns
A dict of dominance frontierclass angr.utils.graph.TemporaryNode(label)
Bases: object
A temporary node.
Used as the start node and end node in post-dominator tree generation. Also used in some test cases.
__init__(label)class angr.utils.graph.ContainerNode(obj)
Bases: object
A container node.
Only used in dominator tree generation. We did this so we can set the index property without modifying theoriginal object.
__init__(obj)
indexproperty obj

1192

Chapter 10. API Referenceangrclass angr.utils.graph.Dominators(graph, entry_node, successors_func=None, reverse=False)
Bases: object
Describes dominators in a graph.
__init__(graph, entry_node, successors_func=None, reverse=False)
dom:

DiGraphclass angr.utils.graph.PostDominators(graph, entry_node, successors_func=None)
Bases: Dominators
Describe post-dominators in a graph.
__init__(graph, entry_node, successors_func=None)
property post_dom:

DiGraphclass angr.utils.graph.SCCPlaceholder(scc_id)
Bases: object
Describes a placeholder for strongly-connected-components in a graph.
__init__(scc_id)
scc_idclass angr.utils.graph.GraphUtils
Bases: object
A helper class with some static methods and algorithms implemented, that in fact, might take more than justnormal CFGs.
static find_merge_points(function_addr, function_endpoints, graph)
Given a local transition graph of a function, find all merge points inside, and then perform a quasitopological sort of those merge points.
A merge point might be one of the following cases: - two or more paths come together, and ends at thesame address. - end of the current function
Parameters• function_addr (int) – Address of the function.
• function_endpoints (list) – Endpoints of the function. They typically come from
Function.endpoints.
• graph (networkx.DiGraph ) – A local transition graph of a function. Normally it comesfrom Function.graph.
Returns
A list of ordered addresses of merge points.
Return type
list
static find_widening_points(function_addr, function_endpoints, graph)
Given a local transition graph of a function, find all widening points inside.
Correctly choosing widening points is very important in order to not lose too much information during static
analysis. We mainly consider merge points that has at least one loop back edges coming in as widening
points.

10.18. Utils

1193

angr

Parameters• function_addr (int) – Address of the function.
• function_endpoints (list) – Endpoints of the function, typically coming from Function.endpoints.
• graph (networkx.DiGraph ) – A local transition graph of a function, normally Function.graph.
Returns
A list of addresses of widening points.
Return type
list
static reverse_post_order_sort_nodes(graph, nodes=None)
Sort a given set of nodes in reverse post ordering.
Parameters• graph (networkx.DiGraph ) – A local transition graph of a function.
• nodes (iterable) – A collection of nodes to sort.
Returns
A list of sorted nodes.
Return type
list
static quasi_topological_sort_nodes(graph, nodes=None, loop_heads=None)
Sort a given set of nodes from a graph based on the following rules:# - if A -> B and not B -> A, then we have A < B # - if A -> B and B -> A, then the ordering is undefined
Following the above rules gives us a quasi-topological sorting of nodes in the graph. It also works for cyclic
graphs.
Parameters• graph (DiGraph) – A local transition graph of the function.
• nodes (Optional[list]) – A list of nodes to sort. None if you want to sort all nodes
inside the graph.
• loop_heads (Optional[list]) – A list of nodes that should be treated loop heads.
Return type
list
Returns
A list of ordered nodes.
static loop_nesting_forest(graph, start_node)
Generates the loop-nesting forest for the provided directional graph. This is not the algorithm proposed by
Ramalingam.
Parameters• graph (DiGraph) – the graph to generate the loop-nesting forest for.
• start_node – the node to start traversing the graph from.
Return type
OrderedDict[Any, DiGraph]
1194

Chapter 10. API ReferenceangrReturns
An ordered dict of loop heads to their corresponding loop nodes.
angr.utils.lazy_import.lazy_import(name)angr.utils.loader.is_pc(project, ins_addr, addr)
Check if the given address is program counter (PC) or not. This function is for handling the case on some bizarre
architectures where PC is always the currently executed instruction address plus a constant value.
Parameters• project (Project) – An angr Project instance.
• ins_addr (int) – The address of an instruction. We calculate PC using this instruction
address.
• addr (int) – The address to check against.
Return typebool
Returns
True if the given instruction address is the PC, False otherwise.
angr.utils.loader.is_in_readonly_section(project, addr)
Check if the specified address is inside a read-only section.
Parameters• project (Project) – An angr Project instance.
• addr (int) – The address to check.
Return typebool
Returns
True if the given address belongs to a read-only section, False otherwise.
angr.utils.loader.is_in_readonly_segment(project, addr)
Check if the specified address is inside a read-only segment.
Parameters• project (Project) – An angr Project instance.
• addr (int) – The address to check.
Return typebool
Returns
True if the given address belongs to a read-only segment, False otherwise.
angr.utils.library.get_function_name(s)Get the function name from a C-style function declaration string.
Parameterss (str) – A C-style function declaration string.
Returns
The function name.
Return typestr
10.18. Utils

1195

angr

angr.utils.library.register_kernel_types()
angr.utils.library.convert_cproto_to_py(c_decl)
Convert a C-style function declaration string to its corresponding SimTypes-based Python representation.
Parameters
c_decl (str) – The C-style function declaration string.
Return typetuple[str, SimTypeFunction, str]
Returns
A tuple of the function name, the prototype, and a string representing the SimType-based Python
representation.
angr.utils.library.convert_cppproto_to_py(cpp_decl, with_param_names=False)
Pre-process a C++-style function declaration string to its corresponding SimTypes-based Python representation.
Parameters• cpp_decl (str) – The C++-style function declaration string.
• with_param_names (bool)
Return typetuple[str | None, SimTypeCppFunction | None, str | None]
Returns
A tuple of the function name, the prototype, and a string representing the SimType-based Python
representation.
angr.utils.library.parsedcprotos2py(parsed_cprotos, fd_spots=frozenset({}), remove_sys_prefix=False)
Parse a list of C function declarations and output to Python code that can be embedded into
angr.procedures.definitions.
>>> # parse the list of glibc C prototypes and output to a file>>> from angr.procedures.definitions import glibc>>> with open("glibc_protos", "w") as f: f.write(cprotos2py(glibc._libc_c_decls))
Parametersparsed_cprotos (list[tuple[str, SimTypeFunction, str]]) – A list of tuples where eachtuple is (function name, parsed C function prototype, the original function declaration).
Return type
str
Returns
A Python string.
angr.utils.library.cprotos2py(cprotos, fd_spots=frozenset({}), remove_sys_prefix=False)
Parse a list of C function declarations and output to Python code that can be embedded into
angr.procedures.definitions.
>>> # parse the list of glibc C prototypes and output to a file>>> from angr.procedures.definitions import glibc>>> with open("glibc_protos", "w") as f: f.write(cprotos2py(glibc._libc_c_decls))
Parameters
cprotos (list[str]) – A list of C prototype strings.
1196

Chapter 10. API ReferenceangrReturn type
str
Returns
A Python string.
angr.utils.library.get_cpp_function_name(demangled_name, specialized=True, qualified=True)
angr.utils.timing.timethis(func)
angr.utils.formatting.setup_terminal()
Check if we are running in a TTY. If so, make sure the terminal supports ANSI escape sequences. If not, disable
colorized output. Sets global ansi_color_enabled to True if colorized output should be enabled by default.
angr.utils.formatting.ansi_color(s, color)
Colorize string s by wrapping in ANSI escape sequence for given color.
This function does not consider whether escape sequences are functional or not; it is up to the caller to determine
if its appropriate. Check global ansi_color_enabled value in this module.
Return typestr
Parameters• s (str)• color (str | None)angr.utils.formatting.add_edge_to_buffer(buf , ref , start, end, formatter=None, dashed=False,ascii_only=None)
Draw an edge by adding Unicode box and arrow glyphs to beginning of each line in a list of lines.
Parameters• buf (Sequence[str]) – Output buffer, used to render formatted edges.
• ref (Sequence[str]) – Reference buffer, used to calculate edge depth.
• start (int) – Start line.
• end (int) – End line, where arrow points.
• formatter (Optional[Callable[[str], str]]) – Optional callback function used to format the edge before writing it to output buffer.
• dashed (bool) – Render edge line dashed instead of solid.
• ascii_only (Optional[bool]) – Render edge using ASCII characters only. If unspecified,guess by stdout encoding.
Returnsclass angr.utils.mp.Closure(f: Callable[..., None], args: list[Any], kwargs: dict[str, Any])
Bases: NamedTuple
A pickle-able lambda; note that f, args, and kwargs must be pickleable
Parameters• f (Callable[[...], None])• args (list[Any])• kwargs (dict[str, Any])

10.18. Utils

1197

angr

f:

Callable[..., None]
Alias for field number 0

args:

list[Any]

Alias for field number 1
kwargs:dict[str, Any]

Alias for field number 2class angr.utils.mp.Initializer(*, _manual=True)
Bases: object
A singleton class with global state used to initialize a multiprocessing.Process
Parameters_manual (bool)classmethod get()A wrapper around init since this class is a singleton
Return type
Initializer__init__(*, _manual=True)
Parameters_manual (bool)
register(f , *args, **kwargs)
A shortcut for adding Closures as initializers
Return type
None
Parameters• f (Callable[[...], None])• args (Any)• kwargs (Any)initialize()
Initialize a multiprocessing.Process Set the current global initializer to the same state as this initializer, thencalls each initializer
Return type
Noneangr.utils.mp.mp_context()

10.19 Errors
exception angr.errors.AngrError
Bases: Exception
exception angr.errors.AngrRuntimeError
Bases: RuntimeError

1198

Chapter 10. API Referenceangrexception angr.errors.AngrValueError
Bases: AngrError, ValueError
exception angr.errors.AngrLifterError
Bases: AngrError
exception angr.errors.AngrExitError
Bases: AngrError
exception angr.errors.AngrPathError
Bases: AngrError
exception angr.errors.AngrVaultError
Bases: AngrError
exception angr.errors.PathUnreachableError
Bases: AngrPathError
exception angr.errors.SimulationManagerError
Bases: AngrError
exception angr.errors.AngrInvalidArgumentError
Bases: AngrError
exception angr.errors.AngrSurveyorError
Bases: AngrError
exception angr.errors.AngrAnalysisError
Bases: AngrError
exception angr.errors.AngrBladeError
Bases: AngrError
exception angr.errors.AngrBladeSimProcError
Bases: AngrBladeError
exception angr.errors.AngrAnnotatedCFGError
Bases: AngrError
exception angr.errors.AngrBackwardSlicingError
Bases: AngrError
exception angr.errors.AngrCallableError
Bases: AngrSurveyorError
exception angr.errors.AngrCallableMultistateError
Bases: AngrCallableError
exception angr.errors.AngrSyscallError
Bases: AngrError
exception angr.errors.AngrSimOSError
Bases: AngrError
exception angr.errors.AngrAssemblyError
Bases: AngrError

10.19. Errors

1199

angr

exception angr.errors.AngrTypeError
Bases: AngrError, TypeError
exception angr.errors.AngrMissingTypeError
Bases: AngrTypeError
exception angr.errors.AngrIncongruencyError
Bases: AngrAnalysisError
exception angr.errors.AngrForwardAnalysisError
Bases: AngrError
exception angr.errors.AngrSkipJobNoticeBases: AngrForwardAnalysisError
exception angr.errors.AngrDelayJobNoticeBases: AngrForwardAnalysisError
exception angr.errors.AngrJobMergingFailureNoticeBases: AngrForwardAnalysisError
exception angr.errors.AngrJobWideningFailureNoticeBases: AngrForwardAnalysisError
exception angr.errors.AngrCFGError
Bases: AngrError
exception angr.errors.AngrVFGError
Bases: AngrError
exception angr.errors.AngrVFGRestartAnalysisNoticeBases: AngrVFGError
exception angr.errors.AngrDataGraphError
Bases: AngrAnalysisError
exception angr.errors.AngrDDGError
Bases: AngrAnalysisError
exception angr.errors.AngrLoopAnalysisError
Bases: AngrAnalysisError
exception angr.errors.AngrExplorationTechniqueError
Bases: AngrError
exception angr.errors.AngrExplorerError
Bases: AngrExplorationTechniqueError
exception angr.errors.AngrDirectorError
Bases: AngrExplorationTechniqueError
exception angr.errors.AngrTracerError
Bases: AngrExplorationTechniqueError
exception angr.errors.AngrVariableRecoveryError
Bases: AngrAnalysisError

1200

Chapter 10. API Referenceangrexception angr.errors.AngrDBError
Bases: AngrError
exception angr.errors.AngrCorruptDBError
Bases: AngrDBError
exception angr.errors.AngrIncompatibleDBError
Bases: AngrDBError
exception angr.errors.TracerEnvironmentError
Bases: AngrError
exception angr.errors.SimError
Bases: Exception
bbl_addr = None
stmt_idx = None
ins_addr = None
executed_instruction_count = None
guard = None
record_state(state)
exception angr.errors.SimStateError
Bases: SimError
exception angr.errors.SimMergeError
Bases: SimStateError
exception angr.errors.SimMemoryError
Bases: SimStateError
exception angr.errors.SimMemoryMissingError(missing_addr, missing_size, *args)
Bases: SimMemoryError__init__(missing_addr, missing_size, *args)
exception angr.errors.SimAbstractMemoryError
Bases: SimMemoryError
exception angr.errors.SimRegionMapError
Bases: SimMemoryError
exception angr.errors.SimMemoryLimitError
Bases: SimMemoryError
exception angr.errors.SimMemoryAddressError
Bases: SimMemoryError
exception angr.errors.SimFastMemoryError
Bases: SimMemoryError
exception angr.errors.SimEventError
Bases: SimStateError

10.19. Errors

1201

angr

exception angr.errors.SimPosixError
Bases: SimStateError
exception angr.errors.SimFilesystemError
Bases: SimError
exception angr.errors.SimSymbolicFilesystemError
Bases: SimFilesystemError
exception angr.errors.SimFileError
Bases: SimMemoryError, SimFilesystemError
exception angr.errors.SimHeapError
Bases: SimStateError
exception angr.errors.SimUnsupportedError
Bases: SimError
exception angr.errors.SimSolverError
Bases: SimError
exception angr.errors.SimSolverModeError
Bases: SimSolverError
exception angr.errors.SimSolverOptionError
Bases: SimSolverError
exception angr.errors.SimValueError
Bases: SimSolverError
exception angr.errors.SimUnsatError
Bases: SimValueError
exception angr.errors.SimOperationError
Bases: SimError
exception angr.errors.UnsupportedIROpError
Bases: SimOperationError, SimUnsupportedError
exception angr.errors.SimExpressionError
Bases: SimError
exception angr.errors.UnsupportedIRExprError
Bases: SimExpressionError, SimUnsupportedError
exception angr.errors.SimCCallError
Bases: SimExpressionError
exception angr.errors.UnsupportedCCallError
Bases: SimCCallError, SimUnsupportedError
exception angr.errors.SimUninitializedAccessError(expr_type, expr)
Bases: SimExpressionError__init__(expr_type, expr)
exception angr.errors.SimStatementError
Bases: SimError

1202

Chapter 10. API Referenceangrexception angr.errors.UnsupportedIRStmtError
Bases: SimStatementError, SimUnsupportedError
exception angr.errors.UnsupportedDirtyError
Bases: UnsupportedIRStmtError, SimUnsupportedError
exception angr.errors.SimMissingTempError
Bases: SimValueError, IndexError
exception angr.errors.SimEngineError
Bases: SimError
exception angr.errors.SimIRSBError
Bases: SimEngineError
exception angr.errors.SimTranslationError
Bases: SimEngineError
exception angr.errors.SimProcedureError
Bases: SimEngineError
exception angr.errors.SimProcedureArgumentError
Bases: SimProcedureError
exception angr.errors.SimShadowStackError
Bases: SimProcedureError
exception angr.errors.SimFastPathError
Bases: SimEngineError
exception angr.errors.SimIRSBNoDecodeError
Bases: SimIRSBError
exception angr.errors.AngrUnsupportedSyscallError
Bases: AngrSyscallError, SimProcedureError, SimUnsupportedError
angr.errors.UnsupportedSyscallError
alias of AngrUnsupportedSyscallError
exception angr.errors.SimReliftException(state)
Bases: SimEngineError__init__(state)
exception angr.errors.SimSlicerError
Bases: SimError
exception angr.errors.SimActionError
Bases: SimError
exception angr.errors.SimCCError
Bases: SimError
exception angr.errors.SimUCManagerError
Bases: SimError
exception angr.errors.SimUCManagerAllocationError
Bases: SimUCManagerError

10.19. Errors

1203

angr

exception angr.errors.SimUnicornUnsupport
Bases: SimError
exception angr.errors.SimUnicornError
Bases: SimError
exception angr.errors.SimUnicornSymbolic
Bases: SimError
exception angr.errors.SimEmptyCallStackError
Bases: SimError
exception angr.errors.SimStateOptionsError
Bases: SimError
exception angr.errors.SimException
Bases: SimError
exception angr.errors.SimSegfaultException(addr, reason, original_addr=None)
Bases: SimException, SimMemoryError__init__(addr, reason, original_addr=None)angr.errors.SimSegfaultError
alias of SimSegfaultException
exception angr.errors.SimZeroDivisionException
Bases: SimException, SimOperationError
exception angr.errors.AngrNoPluginError
Bases: AngrError
exception angr.errors.SimConcreteMemoryError
Bases: AngrError
exception angr.errors.SimConcreteRegisterError
Bases: AngrError
exception angr.errors.SimConcreteBreakpointError
Bases: AngrError
exception angr.errors.AngrDecompilationError
Bases: AngrError
exception angr.errors.UnsupportedNodeTypeError
Bases: AngrError, NotImplementedError

10.20 Distributed analysis
angr.distributed provides a simple implementation for conducting long-running symbolic-execution-based tasks.
class angr.distributed.Server(project, spill_yard=None, db=None, max_workers=None, max_states=10,
staging_max=10, bucketizer=True, recursion_limit=1000,
worker_exit_callback=None, techniques=None, add_options=None,remove_options=None)
Bases: object
Server implements the analysis server with a series of control interfaces exposed.
1204

Chapter 10. API ReferenceangrVariables• project – An instance of angr.Project.
• spill_yard (str) – A directory to store spilled states.
• db (str) – Path of the database that stores information about spilled states.
• max_workers (int) – Maximum number of workers. Each worker starts a new process.
• max_states (int) – Maximum number of active states for each worker.
• staging_max (int) – Maximum number of inactive states that are kept into memory before
spilled onto the disk and potentially be picked up by another worker.
• bucketizer (bool) – Use the Bucketizer exploration strategy.
• _worker_exit_callback – A method that will be called upon the exit of each worker.
__init__(project, spill_yard=None, db=None, max_workers=None, max_states=10, staging_max=10,
bucketizer=True, recursion_limit=1000, worker_exit_callback=None, techniques=None,
add_options=None, remove_options=None)
inc_active_workers()
dec_active_workers()stop()
property active_workers
property stopped
on_worker_exit(worker_id, stashes)run()class angr.distributed.server.Server(project, spill_yard=None, db=None, max_workers=None,
max_states=10, staging_max=10, bucketizer=True,
recursion_limit=1000, worker_exit_callback=None,
techniques=None, add_options=None, remove_options=None)
Bases: object
Server implements the analysis server with a series of control interfaces exposed.
Variables• project – An instance of angr.Project.
• spill_yard (str) – A directory to store spilled states.
• db (str) – Path of the database that stores information about spilled states.
• max_workers (int) – Maximum number of workers. Each worker starts a new process.
• max_states (int) – Maximum number of active states for each worker.
• staging_max (int) – Maximum number of inactive states that are kept into memory before
spilled onto the disk and potentially be picked up by another worker.
• bucketizer (bool) – Use the Bucketizer exploration strategy.
• _worker_exit_callback – A method that will be called upon the exit of each worker.

10.20. Distributed analysis

1205

angr

__init__(project, spill_yard=None, db=None, max_workers=None, max_states=10, staging_max=10,
bucketizer=True, recursion_limit=1000, worker_exit_callback=None, techniques=None,
add_options=None, remove_options=None)
inc_active_workers()
dec_active_workers()stop()
property active_workers
property stopped
on_worker_exit(worker_id, stashes)run()class angr.distributed.worker.BadStatesDropper(vault, db)
Bases: ExplorationTechnique
Dumps and drops states that are not “active”.
__init__(vault, db)
step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.distributed.worker.ExplorationStatusNotifier(server_state)
Bases: ExplorationTechnique
Force the exploration to stop if the server.stop is True.
Parametersserver_state (dict)__init__(server_state)Parametersserver_state (dict)step(simgr, stash='active', **kwargs)
Hook the process of stepping a stash forward. Should call simgr.step(stash, **kwargs) in order todo the actual processing.
Parameters• simgr (angr.SimulationManager)• stash (str)class angr.distributed.worker.Worker(worker_id, server, server_state, recursion_limit=None,
techniques=None, add_options=None, remove_options=None)
Bases: object
Worker implements a worker thread/process for conducting a task.

1206

Chapter 10. API Referenceangr__init__(worker_id, server, server_state, recursion_limit=None, techniques=None, add_options=None,remove_options=None)start()
run(initializer)
Parameters
initializer (Initializer)

10.20. Distributed analysis

1207

angr

1208

Chapter 10. API ReferenceCHAPTERELEVEN

INDICES AND TABLES• genindex• modindex• search

1209

angr

1210

Chapter 11. Indices and tables

PYTHON MODULE INDEX

a1101
angr.analyses.cfg_slice_to_sink.graph,1102
angr, 147
angr.analyses.cfg_slice_to_sink.transitions,angr.analyses, 786
1103
angr.analyses.analysis, 832
angr.analyses.class_identifier,1140
angr.analyses.backward_slice, 849
angr.analyses.code_tagging,
915
angr.analyses.binary_optimizer, 1154
angr.analyses.complete_calling_conventions,angr.analyses.bindiff, 850855
angr.analyses.boyscout, 853
angr.analyses.congruency_check,1153
angr.analyses.callee_cleanup_finder, 1155
angr.analyses.data_dep,1164
angr.analyses.calling_convention, 853
angr.analyses.data_dep.data_dependency_analysis,angr.analyses.cdg, 915
1159
angr.analyses.cfg, 857
angr.analyses.data_dep.dep_nodes,
1161
angr.analyses.cfg.cfb, 873
angr.analyses.data_dep.sim_act_location,1160
angr.analyses.cfg.cfg, 874
angr.analyses.datagraph_meta,
915
angr.analyses.cfg.cfg_arch_options, 892
angr.analyses.ddg, 1024
angr.analyses.cfg.cfg_base, 881
angr.analyses.decompiler, 940
angr.analyses.cfg.cfg_emulated, 876
angr.analyses.decompiler.ail_simplifier, 948
angr.analyses.cfg.cfg_fast, 884
angr.analyses.decompiler.ailgraph_walker, 949
angr.analyses.cfg.cfg_fast_soot, 913
angr.analyses.decompiler.block_simplifier,angr.analyses.cfg.cfg_job_base, 893
949
angr.analyses.cfg.indirect_jump_resolvers,
angr.analyses.decompiler.callsite_maker, 950905
angr.analyses.decompiler.ccall_rewriters, 950
angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got,
angr.analyses.decompiler.ccall_rewriters.amd64_ccalls,
894
950
angr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast,angr.analyses.decompiler.ccall_rewriters.rewriter_base,895
950
angr.analyses.cfg.indirect_jump_resolvers.const_resolver,
angr.analyses.decompiler.clinic, 950904
angr.analyses.decompiler.condition_processor,
angr.analyses.cfg.indirect_jump_resolvers.default_resolvers,
953
898
angr.analyses.decompiler.decompilation_cache,angr.analyses.cfg.indirect_jump_resolvers.jumptable,
955
898
angr.analyses.decompiler.decompilation_options,angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast,954
896
angr.analyses.decompiler.decompiler, 955
angr.analyses.cfg.indirect_jump_resolvers.resolver,
angr.analyses.decompiler.empty_node_remover,904
957
angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt,
angr.analyses.decompiler.expression_narrower,
897
angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat, 957
angr.analyses.decompiler.graph_region, 959
896
angr.analyses.decompiler.jump_target_collector,
angr.analyses.cfg_slice_to_sink, 1098
960
angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink,

1211

angr

angr.analyses.decompiler.jumptable_entry_condition_rewriter,angr.analyses.decompiler.region_simplifiers.loop,
960
992
angr.analyses.decompiler.optimization_passes, angr.analyses.decompiler.region_simplifiers.node_address_f
960
992
angr.analyses.decompiler.optimization_passes.base_ptr_save_simplifier,angr.analyses.decompiler.region_simplifiers.region_simplif
978992
angr.analyses.decompiler.optimization_passes.const_derefs,angr.analyses.decompiler.region_simplifiers.switch_cluster
974
993
angr.analyses.decompiler.optimization_passes.div_simplifier,angr.analyses.decompiler.region_simplifiers.switch_expr_si
978996
angr.analyses.decompiler.optimization_passes.engine_base,angr.analyses.decompiler.region_walker, 996
982
angr.analyses.decompiler.sequence_walker, 996
angr.analyses.decompiler.optimization_passes.expr_op_swapper,
angr.analyses.decompiler.structured_codegen,983
997
angr.analyses.decompiler.optimization_passes.ite_expr_converter,
angr.analyses.decompiler.structured_codegen.base,
9781001
angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier,angr.analyses.decompiler.structured_codegen.c,979
1002
angr.analyses.decompiler.optimization_passes.mod_simplifier,angr.analyses.decompiler.structured_codegen.dummy,
981
1020
angr.analyses.decompiler.optimization_passes.multi_simplifier,angr.analyses.decompiler.structured_codegen.dwarf_import,
981
1020
angr.analyses.decompiler.optimization_passes.optimization_pass,angr.analyses.decompiler.structuring, 930
975
angr.analyses.decompiler.structuring.dream,
angr.analyses.decompiler.optimization_passes.register_save_area_simplifier,932
984
angr.analyses.decompiler.structuring.phoenix,
angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier,939
984
angr.analyses.decompiler.structuring.recursive_structurer,
angr.analyses.decompiler.optimization_passes.stack_canary_simplifier,930
977
angr.analyses.decompiler.structuring.structurer_base,angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier,938
985
angr.analyses.decompiler.structuring.structurer_nodes,
angr.analyses.decompiler.peephole_optimizations,933
985
angr.analyses.decompiler.utils, 1020
angr.analyses.decompiler.peephole_optimizations.base,angr.analyses.disassembly, 1141
985
angr.analyses.disassembly_utils, 1145
angr.analyses.decompiler.redundant_label_remover,angr.analyses.dominance_frontier, 1155
996
angr.analyses.find_objects_static, 1140
angr.analyses.decompiler.region_identifier,angr.analyses.flirt, 1030
987
angr.analyses.forward_analysis, 834
angr.analyses.decompiler.region_simplifiers, angr.analyses.forward_analysis.forward_analysis,
988
839
angr.analyses.decompiler.region_simplifiers.cascading_cond_transformer,
angr.analyses.forward_analysis.job_info, 840
988
angr.analyses.forward_analysis.visitors, 840
angr.analyses.decompiler.region_simplifiers.cascading_ifs,
angr.analyses.forward_analysis.visitors.call_graph,988
843
angr.analyses.decompiler.region_simplifiers.expr_folding,angr.analyses.forward_analysis.visitors.function_graph,989
844
angr.analyses.decompiler.region_simplifiers.goto,
angr.analyses.forward_analysis.visitors.graph,991
845
angr.analyses.decompiler.region_simplifiers.if_,
angr.analyses.forward_analysis.visitors.loop,
992
847
angr.analyses.decompiler.region_simplifiers.ifelse,
angr.analyses.forward_analysis.visitors.single_node_graph,
992
848
1212

Python Module Indexangrangr.analyses.identifier.identify, 1130
angr.analyses.variable_recovery.engine_vex,
angr.analyses.init_finder, 1155
1114
angr.analyses.loop_analysis, 1131
angr.analyses.variable_recovery.irsb_scanner,angr.analyses.loopfinder, 1131
1115
angr.analyses.propagator, 1033
angr.analyses.variable_recovery.variable_recovery,
angr.analyses.propagator.engine_ail, 1036
1112
angr.analyses.propagator.engine_base, 1035
angr.analyses.variable_recovery.variable_recovery_base,angr.analyses.propagator.engine_vex, 1036
1106
angr.analyses.propagator.outdated_definition_walker,
angr.analyses.variable_recovery.variable_recovery_fast,
1037
1110
angr.analyses.propagator.propagator, 1038
angr.analyses.veritesting, 1132
angr.analyses.propagator.tmpvar_finder, 1038
angr.analyses.vfg, 1134
angr.analyses.propagator.top_checker_mixin,
angr.analyses.vsa_ddg, 1139
1040
angr.analyses.vtable, 1139
angr.analyses.propagator.values, 1034
angr.analyses.xrefs, 1156
angr.analyses.propagator.vex_vars, 1035
angr.angrdb, 916
angr.analyses.proximity_graph, 1157
angr.angrdb.db, 917
angr.analyses.reaching_definitions, 1040
angr.angrdb.models, 919
angr.analyses.reaching_definitions.call_trace, angr.angrdb.serializers, 923
1072
angr.angrdb.serializers.cfg_model, 924
angr.analyses.reaching_definitions.dep_graph, angr.angrdb.serializers.comments, 924
1078
angr.angrdb.serializers.funcs, 925
angr.analyses.reaching_definitions.engine_ail, angr.angrdb.serializers.kb, 925
1098
angr.angrdb.serializers.labels, 926
angr.analyses.reaching_definitions.engine_vex, angr.angrdb.serializers.loader, 926
1074
angr.angrdb.serializers.structured_code, 929
angr.analyses.reaching_definitions.function_handler,
angr.angrdb.serializers.variables, 928
1082
angr.angrdb.serializers.xrefs, 928
angr.analyses.reaching_definitions.heap_allocator,
angr.annocfg, 1169
1081
angr.blade, 1167
angr.analyses.reaching_definitions.rd_state, angr.block, 215
1089
angr.callable, 653
angr.analyses.reaching_definitions.reaching_definitions,angr.calling_conventions, 613
1074
angr.code_location, 779
angr.analyses.reaching_definitions.subject,angr.codenode, 1170
1097
angr.concretization_strategies, 411
angr.analyses.reassembler, 1145
angr.concretization_strategies.any, 498
angr.analyses.soot_class_hierarchy, 857
angr.concretization_strategies.controlled_data,
angr.analyses.stack_pointer_tracker, 1103
498
angr.analyses.static_hooker, 1153
angr.concretization_strategies.eval, 495
angr.analyses.typehoon, 1129
angr.concretization_strategies.max, 497
angr.analyses.typehoon.lifter, 1116
angr.concretization_strategies.nonzero, 497
angr.analyses.typehoon.simple_solver, 1117
angr.concretization_strategies.nonzero_range,
angr.analyses.typehoon.translator, 1121
496
angr.analyses.typehoon.typeconsts, 1127
angr.concretization_strategies.norepeats, 495
angr.analyses.typehoon.typehoon, 1126
angr.concretization_strategies.norepeats_range,
angr.analyses.typehoon.typevars, 1121
497
angr.analyses.variable_recovery, 1115
angr.concretization_strategies.range, 496
angr.analyses.variable_recovery.annotations, angr.concretization_strategies.single, 495
1106
angr.concretization_strategies.solutions, 496
angr.analyses.variable_recovery.engine_ail,angr.concretization_strategies.unlimited_range,
1113
498
angr.analyses.variable_recovery.engine_base, angr.distributed, 1204
1114
angr.distributed.server, 1205
Python Module Index

1213

angr

angr.distributed.worker, 1206
angr.flirt.build_sig, 1188
angr.engines, 543
angr.keyed_region, 781
angr.engines.concrete, 560
angr.knowledge_base, 654
angr.engines.engine, 551
angr.knowledge_plugins, 655
angr.engines.failure, 555
angr.knowledge_plugins.callsite_prototypes,
angr.engines.hook, 554
675
angr.engines.light, 1031
angr.knowledge_plugins.cfg, 676
angr.engines.light.data, 1030
angr.knowledge_plugins.cfg.cfg_manager, 696
angr.engines.light.engine, 1032
angr.knowledge_plugins.cfg.cfg_model, 688
angr.engines.pcode, 561
angr.knowledge_plugins.cfg.cfg_node, 697
angr.engines.pcode.behavior, 573
angr.knowledge_plugins.cfg.indirect_jump, 700
angr.engines.pcode.cc, 593
angr.knowledge_plugins.cfg.memory_data, 694
angr.engines.pcode.emulate, 573
angr.knowledge_plugins.comments, 703
angr.engines.pcode.engine, 562
angr.knowledge_plugins.data, 704
angr.engines.pcode.lifter, 563
angr.knowledge_plugins.debug_variables, 734
angr.engines.procedure, 554
angr.knowledge_plugins.functions, 705
angr.engines.soot, 558
angr.knowledge_plugins.functions.function,
angr.engines.soot.engine, 559
716
angr.engines.successors, 552
angr.knowledge_plugins.functions.function_manager,
angr.engines.syscall, 555
714
angr.engines.unicorn, 559
angr.knowledge_plugins.functions.function_parser,
angr.engines.vex, 555
724
angr.errors, 1198
angr.knowledge_plugins.functions.soot_function,
angr.exploration_techniques, 506
724
angr.exploration_techniques.bucketizer, 543
angr.knowledge_plugins.indirect_jumps, 704
angr.exploration_techniques.common, 541
angr.knowledge_plugins.key_definitions, 736
angr.exploration_techniques.dfs, 524
angr.knowledge_plugins.key_definitions.atoms,
angr.exploration_techniques.director, 534
750
angr.exploration_techniques.driller_core, 533 angr.knowledge_plugins.key_definitions.constants,
angr.exploration_techniques.explorer, 525755
angr.exploration_techniques.lengthlimiter,angr.knowledge_plugins.key_definitions.definition,
526
755
angr.exploration_techniques.local_loop_seer, angr.knowledge_plugins.key_definitions.environment,
538
758
angr.exploration_techniques.loop_seer, 537
angr.knowledge_plugins.key_definitions.heap_address,
angr.exploration_techniques.manual_mergepoint,
759
526
angr.knowledge_plugins.key_definitions.key_definition_mana
angr.exploration_techniques.memory_watcher,759
542
angr.knowledge_plugins.key_definitions.live_definitions,angr.exploration_techniques.oppologist, 537
760
angr.exploration_techniques.slicecutor, 533
angr.knowledge_plugins.key_definitions.rd_model,
angr.exploration_techniques.spiller, 527
769
angr.exploration_techniques.spiller_db, 529
angr.knowledge_plugins.key_definitions.tag,
angr.exploration_techniques.stochastic, 539
771
angr.exploration_techniques.suggestions, 543
angr.knowledge_plugins.key_definitions.undefined,
angr.exploration_techniques.symbion, 541
773
angr.exploration_techniques.tech_builder, 540 angr.knowledge_plugins.key_definitions.unknown_size,
angr.exploration_techniques.threading, 529
773
angr.exploration_techniques.timeout, 524
angr.knowledge_plugins.key_definitions.uses,
angr.exploration_techniques.tracer, 530
773
angr.exploration_techniques.unique, 540
angr.knowledge_plugins.labels, 704
angr.exploration_techniques.veritesting, 530
angr.knowledge_plugins.patches, 673
angr.factory, 212
angr.knowledge_plugins.plugin, 675
angr.flirt, 1187
angr.knowledge_plugins.propagations, 702
1214

Python Module Indexangrangr.knowledge_plugins.structured_code, 736
angr.state_plugins.libc, 302
angr.knowledge_plugins.types, 701
angr.state_plugins.light_registers, 332
angr.knowledge_plugins.variables, 726
angr.state_plugins.log, 328
angr.knowledge_plugins.variables.variable_access,angr.state_plugins.loop_data, 357
727
angr.state_plugins.plugin, 298
angr.knowledge_plugins.variables.variable_manager,
angr.state_plugins.posix, 306
727
angr.state_plugins.preconstrainer, 347
angr.knowledge_plugins.xrefs, 775
angr.state_plugins.scratch, 346
angr.knowledge_plugins.xrefs.xref, 777
angr.state_plugins.sim_action, 595
angr.knowledge_plugins.xrefs.xref_manager,
angr.state_plugins.sim_action_object, 597
779
angr.state_plugins.sim_event, 598
angr.knowledge_plugins.xrefs.xref_types, 779
angr.state_plugins.solver, 320
angr.misc.plugins, 218
angr.state_plugins.symbolizer, 379
angr.procedures, 603
angr.state_plugins.trace_additions, 339
angr.procedures.definitions, 605
angr.state_plugins.uc_manager, 345
angr.procedures.stubs.format_parser, 603
angr.state_plugins.unicorn_engine, 349
angr.project, 207
angr.state_plugins.view, 385
angr.protos, 784
angr.storage, 382
angr.serializable, 784
angr.storage.file, 390
angr.sim_manager, 498
angr.storage.memory_mixins, 414
angr.sim_options, 223
angr.storage.memory_mixins.actions_mixin, 449
angr.sim_procedure, 599
angr.storage.memory_mixins.address_concretization_mixin,
angr.sim_state, 220451
angr.sim_state_options, 223
angr.storage.memory_mixins.bvv_conversion_mixin,
angr.sim_type, 638
448
angr.sim_variable, 633
angr.storage.memory_mixins.clouseau_mixin,
angr.simos, 1172
453
angr.simos.cgc, 1182
angr.storage.memory_mixins.conditional_store_mixin,
angr.simos.javavm, 1185
453
angr.simos.linux, 1181
angr.storage.memory_mixins.convenient_mappings_mixin,
angr.simos.simos, 1179
454
angr.simos.userland, 1182
angr.storage.memory_mixins.default_filler_mixin,
angr.simos.windows, 1184
447
angr.slicer, 1168
angr.storage.memory_mixins.dirty_addrs_mixin,
angr.state_hierarchy, 505451
angr.state_plugins, 226
angr.storage.memory_mixins.hex_dumper_mixin,
angr.state_plugins.callstack, 329
448
angr.state_plugins.cgc, 337
angr.storage.memory_mixins.label_merger_mixin,
angr.state_plugins.concrete, 358
453
angr.state_plugins.debug_variables, 380
angr.storage.memory_mixins.multi_value_merger_mixin,
angr.state_plugins.filesystem, 313459
angr.state_plugins.gdb, 336
angr.storage.memory_mixins.name_resolution_mixin,
angr.state_plugins.globals, 343
447
angr.state_plugins.heap, 363
angr.storage.memory_mixins.paged_memory, 459
angr.state_plugins.heap.heap_base, 370
angr.storage.memory_mixins.paged_memory.page_backer_mixins
angr.state_plugins.heap.heap_brk, 371
463
angr.state_plugins.heap.heap_freelist, 373
angr.storage.memory_mixins.paged_memory.paged_memory_mixin
angr.state_plugins.heap.heap_libc, 374459
angr.state_plugins.heap.heap_ptmalloc, 375
angr.storage.memory_mixins.paged_memory.pages,
angr.state_plugins.heap.utils, 379
465
angr.state_plugins.history, 333
angr.storage.memory_mixins.paged_memory.pages.cooperation,
angr.state_plugins.inspect, 300475
angr.state_plugins.javavm_classloader, 360
angr.storage.memory_mixins.paged_memory.pages.history_trac
angr.state_plugins.jni_references, 361
474
Python Module Index

1215

angr

angr.storage.memory_mixins.paged_memory.pages.ispo_mixin,
angr.storage.memory_object, 409
475
angr.utils, 1189
angr.storage.memory_mixins.paged_memory.pages.list_page,angr.utils.algo, 1189
476
angr.utils.constants, 1189
angr.storage.memory_mixins.paged_memory.pages.multi_values,
angr.utils.cowdict, 1189
457
angr.utils.dynamic_dictlist, 1190
angr.storage.memory_mixins.paged_memory.pages.mv_list_page,angr.utils.enums_conv, 1190
455
angr.utils.env, 1190
angr.storage.memory_mixins.paged_memory.pages.permissions_mixin,
angr.utils.formatting, 1197
474
angr.utils.graph, 1191
angr.storage.memory_mixins.paged_memory.pages.refcount_mixin,
angr.utils.lazy_import, 1195
473
angr.utils.library, 1195
angr.storage.memory_mixins.paged_memory.pages.ultra_page,angr.utils.loader, 1195
477
angr.utils.mp, 1197
angr.storage.memory_mixins.paged_memory.privileged_mixin,
angr.utils.timing, 1197
465
angr.vaults, 784
angr.storage.memory_mixins.paged_memory.stack_allocation_mixin,
464
angr.storage.memory_mixins.regioned_memory,479
angr.storage.memory_mixins.regioned_memory.abstract_address_descriptor,
490
angr.storage.memory_mixins.regioned_memory.abstract_merger_mixin,
492
angr.storage.memory_mixins.regioned_memory.region_category_mixin,
490
angr.storage.memory_mixins.regioned_memory.region_data,
487
angr.storage.memory_mixins.regioned_memory.region_meta_mixin,
490
angr.storage.memory_mixins.regioned_memory.regioned_address_concretization_mixin,
493
angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin,
485
angr.storage.memory_mixins.regioned_memory.static_find_mixin,
490
angr.storage.memory_mixins.simple_interface_mixin,
449
angr.storage.memory_mixins.simplification_mixin,
454
angr.storage.memory_mixins.size_resolution_mixin,
450angr.storage.memory_mixins.slotted_memory,494
angr.storage.memory_mixins.smart_find_mixin,
447
angr.storage.memory_mixins.symbolic_merger_mixin,
449
angr.storage.memory_mixins.top_merger_mixin,
458
angr.storage.memory_mixins.underconstrained_mixin,
449
angr.storage.memory_mixins.unwrapper_mixin,
454
1216

Python Module Index

INDEX

Symbols__init__() (angr.analyses.CFG method), 797__init__() (angr.analyses.CFGArchOptions method),__init__() (angr.BP method), 151799__init__() (angr.Blade method), 163__init__()(angr.analyses.CFGEmulated method), 793__init__() (angr.Block method), 166__init__()(angr.analyses.CFGFast method), 790__init__() (angr.ExplorationTechnique method), 174__init__()(angr.analyses.CFGFastSoot method), 799__init__() (angr.KnowledgeBase method), 207__init__()(angr.analyses.CalleeCleanupFinder__init__() (angr.PTChunk method), 204
method),817__init__() (angr.PointerWrapper method), 180__init__() (angr.analyses.CallingConventionAnalysis__init__() (angr.Project method), 154
method), 821__init__() (angr.Server method), 206__init__()(angr.analyses.ClassIdentifier method), 830__init__() (angr.SimCC method), 180__init__()(angr.analyses.CodeTagging method), 822__init__() (angr.SimCC.ArgSession method), 181__init__()(angr.analyses.CompleteCallingConventionsAnalysis__init__() (angr.SimFile method), 186
method), 827__init__() (angr.SimFileBase method), 184__init__()(angr.analyses.CongruencyCheck method),__init__() (angr.SimFileDescriptor method), 194810__init__() (angr.SimFileDescriptorDuplex method),__init__() (angr.analyses.DDG method), 802
196__init__() (angr.analyses.DataDependencyGraphAnalysis__init__() (angr.SimFileStream method), 190
method), 823__init__() (angr.SimHeapBrk method), 200__init__()(angr.analyses.Decompiler method), 824__init__() (angr.SimHeapPTMalloc method), 202__init__()(angr.analyses.Disassembly method), 814__init__() (angr.SimHostFilesystem method), 199__init__()(angr.analyses.DominanceFrontier__init__() (angr.SimMemoryMissingError method),
method),823
159__init__() (angr.analyses.FlirtAnalysis method), 831__init__() (angr.SimOS method), 164__init__() (angr.analyses.ForwardAnalysis method),__init__() (angr.SimPackets method), 188787__init__() (angr.SimPacketsStream method), 192__init__()(angr.analyses.Identifier method), 817__init__() (angr.SimProcedure method), 149__init__()(angr.analyses.InitializationFinder__init__() (angr.SimReliftException method), 161
method),827__init__() (angr.SimSegfaultException method), 162__init__() (angr.analyses.LoopFinder method), 810__init__() (angr.SimState method), 177__init__()(angr.analyses.PropagatorAnalysis__init__() (angr.SimStatePlugin method), 151
method),789__init__()(angr.SimUninitializedAccessError__init__()(angr.analyses.ProximityGraphAnalysis
method), 161
method), 830__init__() (angr.SimulationManager method), 168__init__() (angr.analyses.ReachingDefinitionsAnalysis__init__() (angr.StateHierarchy method), 176
method), 818__init__() (angr.analyses.AnalysesHub method), 787__init__() (angr.analyses.BackwardSlice method), 806 __init__() (angr.analyses.Reassembler method), 811__init__() (angr.analyses.SLivenessAnalysis method),__init__() (angr.analyses.BinDiff method), 809
832__init__() (angr.analyses.BinaryOptimizer method),__init__()(angr.analyses.SPropagatorAnalysis
814
method), 831__init__() (angr.analyses.BoyScout method), 806__init__() (angr.analyses.SReachingDefinitionsAnalysis__init__() (angr.analyses.CDG method), 801
1217

angr

method), 831
method), 853__init__()(angr.analyses.SootClassHierarchy __init__() (angr.analyses.calling_convention.CallingConventionAnalysis
method), 825
method), 854__init__()(angr.analyses.StackPointerTracker __init__() (angr.analyses.cdg.CDG method), 915
method), 822__init__() (angr.analyses.cfg.CFBlanket method), 867__init__() (angr.analyses.StaticHooker method), 811__init__() (angr.analyses.cfg.CFG method), 865__init__() (angr.analyses.StaticObjectFinder method), __init__()(angr.analyses.cfg.CFGArchOptions
830
method), 870__init__() (angr.analyses.Typehoon method), 829__init__() (angr.analyses.cfg.CFGBase method), 871__init__() (angr.analyses.VFG method), 805__init__() (angr.analyses.cfg.CFGEmulated method),__init__() (angr.analyses.VSA_DDG method), 808
861__init__() (angr.analyses.VariableRecovery method), __init__() (angr.analyses.cfg.CFGFast method), 859
816__init__() (angr.analyses.cfg.CFGFastSoot method),__init__()(angr.analyses.VariableRecoveryFast
868
method), 816__init__() (angr.analyses.cfg.cfb.CFBlanket method),__init__() (angr.analyses.Veritesting method), 808
874__init__() (angr.analyses.VtableFinder method), 830__init__()(angr.analyses.cfg.cfb.CFBlanketView__init__() (angr.analyses.XRefsAnalysis method), 826
method), 873__init__()(angr.analyses.analysis.AnalysesHub __init__()(angr.analyses.cfg.cfb.MemoryRegion
method), 832
method), 873__init__()(angr.analyses.analysis.AnalysisFactory __init__() (angr.analyses.cfg.cfb.Unknown method),
method), 833
874__init__() (angr.analyses.analysis.AnalysisLogEntry __init__() (angr.analyses.cfg.cfg.CFG method), 875
method), 832__init__() (angr.analyses.cfg.cfg_arch_options.CFGArchOptions__init__() (angr.analyses.analysis.KnownAnalysesPlugin
method), 893
method), 833__init__()(angr.analyses.cfg.cfg_base.CFGBase__init__() (angr.analyses.backward_slice.BackwardSlicemethod), 881
method), 849__init__() (angr.analyses.cfg.cfg_emulated.CFGEmulated__init__() (angr.analyses.binary_optimizer.BinaryOptimizer
method), 877
method), 1155__init__() (angr.analyses.cfg.cfg_emulated.CFGJob__init__() (angr.analyses.binary_optimizer.ConstantPropagation method), 877
method), 1154__init__() (angr.analyses.cfg.cfg_emulated.PendingJob__init__() (angr.analyses.binary_optimizer.DeadAssignment
method), 877
method), 1154__init__()(angr.analyses.cfg.cfg_fast.CFGFast__init__() (angr.analyses.binary_optimizer.RedundantStackVariablemethod), 890
method), 1154__init__()(angr.analyses.cfg.cfg_fast.CFGJob__init__() (angr.analyses.binary_optimizer.RegisterReallocation method), 888
method), 1154__init__() (angr.analyses.cfg.cfg_fast.DecodingAssumption__init__() (angr.analyses.bindiff.BinDiff method), 852
method), 885__init__()(angr.analyses.bindiff.ConstantChange __init__() (angr.analyses.cfg.cfg_fast.FunctionCallEdge
method), 850
method), 887__init__() (angr.analyses.bindiff.Difference method), __init__() (angr.analyses.cfg.cfg_fast.FunctionFakeRetEdge
850
method), 887__init__()(angr.analyses.bindiff.FunctionDiff __init__() (angr.analyses.cfg.cfg_fast.FunctionReturn
method), 851
method), 885__init__()(angr.analyses.bindiff.NormalizedBlock __init__() (angr.analyses.cfg.cfg_fast.FunctionReturnEdge
method), 851
method), 887__init__() (angr.analyses.bindiff.NormalizedFunction __init__() (angr.analyses.cfg.cfg_fast.FunctionTransitionEdge
method), 851
method), 886__init__() (angr.analyses.boyscout.BoyScout method), __init__()(angr.analyses.cfg.cfg_fast.PendingJobs
853
method), 885__init__() (angr.analyses.callee_cleanup_finder.CalleeCleanupFinder__init__() (angr.analyses.cfg.cfg_fast_soot.CFGFastSoot
method), 1155
method), 913__init__() (angr.analyses.calling_convention.CallSiteFact__init__() (angr.analyses.cfg.cfg_job_base.BlockID
1218

Index

angr

method), 893
method), 897__init__() (angr.analyses.cfg.cfg_job_base.CFGJobBase __init__() (angr.analyses.cfg.indirect_jump_resolvers.resolver.IndirectJu
method), 894
method), 904__init__() (angr.analyses.cfg.cfg_job_base.FunctionKey __init__() (angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt.X8
method), 893
method), 898__init__() (angr.analyses.cfg.indirect_jump_resolvers.AMD64ElfGotResolver__init__() (angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat.X86PeI
method), 910
method), 896__init__() (angr.analyses.cfg.indirect_jump_resolvers.AMD64PeIatResolver__init__() (angr.analyses.cfg_slice_to_sink.CFGSliceToSink
method), 912
method), 1098__init__() (angr.analyses.cfg.indirect_jump_resolvers.ArmElfFastResolver__init__() (angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceT
method), 910
method), 1101__init__() (angr.analyses.cfg.indirect_jump_resolvers.ConstantResolver__init__() (angr.analyses.class_identifier.ClassIdentifier
method), 911
method), 1141__init__() (angr.analyses.cfg.indirect_jump_resolvers.JumpTableResolver__init__() (angr.analyses.code_tagging.CodeTagging
method), 908
method), 916__init__() (angr.analyses.cfg.indirect_jump_resolvers.MipsElfFastResolver__init__() (angr.analyses.complete_calling_conventions.CompleteCalling
method), 905
method), 856__init__() (angr.analyses.cfg.indirect_jump_resolvers.MipsElfGotResolver__init__() (angr.analyses.congruency_check.CongruencyCheck
method), 906
method), 1153__init__() (angr.analyses.cfg.indirect_jump_resolvers.X86ElfPicPltResolver__init__()(angr.analyses.data_dep.BaseDepNode
method), 907
method), 1165__init__() (angr.analyses.cfg.indirect_jump_resolvers.X86PeIatResolver__init__() (angr.analyses.data_dep.ConstantDepNode
method), 909
method), 1166__init__() (angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got.AMD64ElfGotResolver__init__() (angr.analyses.data_dep.DataDependencyGraphAnalysis
method), 894
method), 1164__init__() (angr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast.ArmElfFastResolver__init__()(angr.analyses.data_dep.MemDepNode
method), 895
method), 1166__init__() (angr.analyses.cfg.indirect_jump_resolvers.const_resolver.ConstantResolver__init__()(angr.analyses.data_dep.RegDepNode
method), 904
method), 1167__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransformation__init__()(angr.analyses.data_dep.TmpDepNode
method), 899
method), 1166__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.BSSHook__init__()(angr.analyses.data_dep.VarDepNode
method), 902
method), 1165__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.ConstantValueManager__init__() (angr.analyses.data_dep.data_dependency_analysis.DataDepe
method), 900
method), 1160__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableProcessor__init__() (angr.analyses.data_dep.data_dependency_analysis.NodalAnn
method), 901
method), 1159__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableProcessorState__init__() (angr.analyses.data_dep.dep_nodes.BaseDepNode
method), 900
method), 1161__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableResolver__init__() (angr.analyses.data_dep.dep_nodes.ConstantDepNode
method), 903
method), 1162__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTargetBaseAddr__init__() (angr.analyses.data_dep.dep_nodes.MemDepNode
method), 900
method), 1162__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.LoadHook__init__() (angr.analyses.data_dep.dep_nodes.RegDepNode
method), 902
method), 1163__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.MIPSGPHook__init__() (angr.analyses.data_dep.dep_nodes.TmpDepNode
method), 902
method), 1163__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.RegOffsetAnnotation__init__() (angr.analyses.data_dep.dep_nodes.VarDepNode
method), 901
method), 1163__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.RegisterInitializerHook__init__() (angr.analyses.data_dep.sim_act_location.ParsedInstruction
method), 902
method), 1161__init__() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.Tmp__init__() (angr.analyses.data_dep.sim_act_location.SimActLocation
method), 900
method), 1161__init__() (angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.MipsElfFastResolver__init__() (angr.analyses.datagraph_meta.DataGraphMeta
Index

1219

angr

method), 915__init__() (angr.analyses.decompiler.clinic.DataRefDesc__init__() (angr.analyses.ddg.AST method), 1025
method), 951__init__() (angr.analyses.ddg.DDG method), 1027__init__() (angr.analyses.decompiler.condition_processor.ConditionProc__init__() (angr.analyses.ddg.DDGJob method), 1025
method), 953__init__() (angr.analyses.ddg.DDGView method), __init__() (angr.analyses.decompiler.decompilation_cache.Decompilatio
1027
method), 955__init__() (angr.analyses.ddg.DDGViewInstruction __init__() (angr.analyses.decompiler.decompilation_options.Decompilat
method), 1027
method), 955__init__() (angr.analyses.ddg.DDGViewItem method), __init__() (angr.analyses.decompiler.decompiler.Decompiler
1027
method), 956__init__()(angr.analyses.ddg.LiveDefinitions __init__() (angr.analyses.decompiler.empty_node_remover.EmptyNodeRe
method), 1025
method), 957__init__()(angr.analyses.ddg.ProgramVariable __init__() (angr.analyses.decompiler.expression_narrower.ExprNarrowinmethod), 1025
method), 957__init__()(angr.analyses.decompiler.AILSimplifier __init__() (angr.analyses.decompiler.expression_narrower.ExpressionNa
method), 946
method), 958__init__() (angr.analyses.decompiler.BlockSimplifier __init__() (angr.analyses.decompiler.expression_narrower.NarrowingInfo
method), 946
method), 958__init__() (angr.analyses.decompiler.CStructuredCodeGenerator__init__() (angr.analyses.decompiler.graph_region.GraphRegion
method), 941
method), 959__init__() (angr.analyses.decompiler.CallSiteMaker __init__() (angr.analyses.decompiler.jump_target_collector.JumpTargetC
method), 946
method), 960__init__() (angr.analyses.decompiler.Clinic method), __init__() (angr.analyses.decompiler.jumptable_entry_condition_rewrite
942
method), 960__init__()(angr.analyses.decompiler.Decompiler __init__() (angr.analyses.decompiler.optimization_passes.BasePointerSa
method), 944
method), 961__init__() (angr.analyses.decompiler.GraphDephication __init__() (angr.analyses.decompiler.optimization_passes.CallStatementR
method), 947
method), 972__init__() (angr.analyses.decompiler.ImportSourceCode __init__() (angr.analyses.decompiler.optimization_passes.CodeMotionOp
method), 942
method), 970__init__() (angr.analyses.decompiler.RegionIdentifier __init__() (angr.analyses.decompiler.optimization_passes.ConstPropOpt
method), 940
method), 972__init__() (angr.analyses.decompiler.RegionSimplifier __init__() (angr.analyses.decompiler.optimization_passes.ConstantDeref
method), 944
method), 966__init__() (angr.analyses.decompiler.SeqNodeDephication__init__() (angr.analyses.decompiler.optimization_passes.CrossJumpRev
method), 948
method), 969__init__()(angr.analyses.decompiler.Ssailification __init__() (angr.analyses.decompiler.optimization_passes.DeadblockRem
method), 947
method), 971__init__() (angr.analyses.decompiler.ail_simplifier.AILBlockTempCollector__init__() (angr.analyses.decompiler.optimization_passes.DivSimplifier
method), 948
method), 964__init__() (angr.analyses.decompiler.ail_simplifier.AILSimplifier__init__() (angr.analyses.decompiler.optimization_passes.DuplicationRe
method), 949
method), 972__init__() (angr.analyses.decompiler.ailgraph_walker.AILGraphWalker__init__() (angr.analyses.decompiler.optimization_passes.ExprOpSwappmethod), 949
method), 962__init__() (angr.analyses.decompiler.block_simplifier.BlockSimplifier__init__() (angr.analyses.decompiler.optimization_passes.FlipBooleanCm
method), 950
method), 967__init__() (angr.analyses.decompiler.block_simplifier.HasCallExprWalker__init__() (angr.analyses.decompiler.optimization_passes.ITEExprConvemethod), 949
method), 962__init__() (angr.analyses.decompiler.callsite_maker.CallSiteMaker__init__() (angr.analyses.decompiler.optimization_passes.ITERegionCon
method), 950
method), 962__init__() (angr.analyses.decompiler.ccall_rewriters.rewriter_base.CCallRewriterBase__init__() (angr.analyses.decompiler.optimization_passes.InlinedStringT
method), 950
method), 971__init__()(angr.analyses.decompiler.clinic.Clinic __init__() (angr.analyses.decompiler.optimization_passes.LoweredSwitch
method), 952
method), 963
1220

Index

angr

__init__() (angr.analyses.decompiler.optimization_passes.ModSimplifier__init__() (angr.analyses.decompiler.optimization_passes.mod_simplifier
method), 964
method), 982__init__() (angr.analyses.decompiler.optimization_passes.MultiSimplifier__init__() (angr.analyses.decompiler.optimization_passes.multi_simplifie
method), 963
method), 981__init__() (angr.analyses.decompiler.optimization_passes.RegisterSaveAreaSimplifier__init__() (angr.analyses.decompiler.optimization_passes.optimization_p
method), 966
method), 975__init__() (angr.analyses.decompiler.optimization_passes.RetAddrSaveSimplifier__init__() (angr.analyses.decompiler.optimization_passes.optimization_p
method), 967
method), 976__init__() (angr.analyses.decompiler.optimization_passes.ReturnDeduplicator__init__() (angr.analyses.decompiler.optimization_passes.optimization_p
method), 968
method), 976__init__() (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorHigh__init__() (angr.analyses.decompiler.optimization_passes.optimization_p
method), 966
method), 977__init__() (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorLow__init__() (angr.analyses.decompiler.optimization_passes.register_save_method), 965
method), 984__init__() (angr.analyses.decompiler.optimization_passes.StackCanarySimplifier__init__() (angr.analyses.decompiler.optimization_passes.ret_addr_save_method), 961
method), 985__init__() (angr.analyses.decompiler.optimization_passes.SwitchDefaultCaseDuplicator__init__() (angr.analyses.decompiler.optimization_passes.stack_canary_method), 970
method), 977__init__() (angr.analyses.decompiler.optimization_passes.WinStackCanarySimplifier__init__() (angr.analyses.decompiler.optimization_passes.x86_gcc_getpc
method), 968
method), 985__init__() (angr.analyses.decompiler.optimization_passes.X86GccGetPcSimplifier__init__() (angr.analyses.decompiler.peephole_optimizations.base.Peeph
method), 967
method), 987__init__() (angr.analyses.decompiler.optimization_passes.base_ptr_save_simplifier.BasePointerSaveSimplifier__init__() (angr.analyses.decompiler.peephole_optimizations.base.Peeph
method), 978
method), 986__init__() (angr.analyses.decompiler.optimization_passes.const_derefs.BlockWalker__init__() (angr.analyses.decompiler.peephole_optimizations.base.Peeph
method), 974
method), 985__init__() (angr.analyses.decompiler.optimization_passes.const_derefs.ConstantDereferencesSimplifier__init__() (angr.analyses.decompiler.redundant_label_remover.Redundan
method), 974
method), 996__init__() (angr.analyses.decompiler.optimization_passes.div_simplifier.DivSimplifier__init__() (angr.analyses.decompiler.region_identifier.RegionIdentifier
method), 978
method), 987__init__() (angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILEngine__init__() (angr.analyses.decompiler.region_simplifiers.RegionSimplifier
method), 982
method), 988__init__() (angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILState__init__() (angr.analyses.decompiler.region_simplifiers.cascading_cond_method), 982
method), 988__init__() (angr.analyses.decompiler.optimization_passes.expr_op_swapper.ExprOpSwapper__init__() (angr.analyses.decompiler.region_simplifiers.cascading_ifs.Ca
method), 984
method), 989__init__() (angr.analyses.decompiler.optimization_passes.expr_op_swapper.ExpressionReplacer__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Con
method), 983
method), 989__init__() (angr.analyses.decompiler.optimization_passes.expr_op_swapper.OpDescriptor__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Con
method), 983
method), 990__init__() (angr.analyses.decompiler.optimization_passes.expr_op_swapper.OuterWalker__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Exp
method), 983
method), 990__init__() (angr.analyses.decompiler.optimization_passes.ite_expr_converter.BlockLocator__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Exp
method), 979
method), 991__init__() (angr.analyses.decompiler.optimization_passes.ite_expr_converter.ExpressionReplacer__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Exp
method), 979
method), 989__init__() (angr.analyses.decompiler.optimization_passes.ite_expr_converter.ITEExprConverter__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Exp
method), 979
method), 991__init__() (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.Case__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Exp
method), 980
method), 990__init__() (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.LoweredSwitchSimplifier__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Mu
method), 981
method), 990__init__() (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.StableVarExprHasher__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.Sta
method), 980
method), 989
Index

1221

angr

__init__() (angr.analyses.decompiler.region_simplifiers.expr_folding.StoreStatementFinder__init__() (angr.analyses.decompiler.structured_codegen.base.PositionM
method), 991
method), 1001__init__() (angr.analyses.decompiler.region_simplifiers.goto.GotoSimplifier__init__() (angr.analyses.decompiler.structured_codegen.c.CAILBlockmethod), 992
method), 1005__init__() (angr.analyses.decompiler.region_simplifiers.if_.IfSimplifier__init__() (angr.analyses.decompiler.structured_codegen.c.CArrayTypeL
method), 992
method), 1016__init__() (angr.analyses.decompiler.region_simplifiers.ifelse.IfElseFlattener__init__() (angr.analyses.decompiler.structured_codegen.c.CAssignment
method), 992
method), 1007__init__() (angr.analyses.decompiler.region_simplifiers.loop.LoopSimplifier__init__() (angr.analyses.decompiler.structured_codegen.c.CBinaryOp
method), 992
method), 1013__init__() (angr.analyses.decompiler.region_simplifiers.node_address_finder.NodeAddressFinder__init__() (angr.analyses.decompiler.structured_codegen.c.CBreakmethod), 992
method), 1007__init__() (angr.analyses.decompiler.region_simplifiers.region_simplifier.RegionSimplifier__init__() (angr.analyses.decompiler.structured_codegen.c.CClosingObj
method), 992
method), 1016__init__() (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.ConditionalRegion__init__() (angr.analyses.decompiler.structured_codegen.c.CConstantmethod), 993
method), 1014__init__() (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.FindFirstNodeInSet__init__() (angr.analyses.decompiler.structured_codegen.c.CConstruct
method), 996
method), 1003__init__() (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.SwitchCaseRegion__init__() (angr.analyses.decompiler.structured_codegen.c.CContinue
method), 994
method), 1007__init__() (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.SwitchClusterFinder__init__() (angr.analyses.decompiler.structured_codegen.c.CDirtyExpres
method), 994
method), 1016__init__() (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.SwitchClusterReplacer__init__() (angr.analyses.decompiler.structured_codegen.c.CDirtyStatem
method), 994
method), 1009__init__() (angr.analyses.decompiler.region_simplifiers.switch_expr_simplifier.SwitchExpressionSimplifier__init__() (angr.analyses.decompiler.structured_codegen.c.CDoWhileLo
method), 996
method), 1005__init__() (angr.analyses.decompiler.region_walker.RegionWalker__init__() (angr.analyses.decompiler.structured_codegen.c.CExpression
method), 996
method), 1004__init__() (angr.analyses.decompiler.sequence_walker.SequenceWalker__init__() (angr.analyses.decompiler.structured_codegen.c.CFakeVariabl
method), 997
method), 1010__init__() (angr.analyses.decompiler.structured_codegen.BaseStructuredCodeGenerator__init__() (angr.analyses.decompiler.structured_codegen.c.CForLoop
method), 997
method), 1006__init__() (angr.analyses.decompiler.structured_codegen.CStructuredCodeGenerator__init__() (angr.analyses.decompiler.structured_codegen.c.CFunction
method), 999
method), 1004__init__() (angr.analyses.decompiler.structured_codegen.DummyStructuredCodeGenerator__init__() (angr.analyses.decompiler.structured_codegen.c.CFunctionCa
method), 1000
method), 1008__init__() (angr.analyses.decompiler.structured_codegen.ImportSourceCode__init__() (angr.analyses.decompiler.structured_codegen.c.CGotomethod), 1000
method), 1009__init__() (angr.analyses.decompiler.structured_codegen.InstructionMapping__init__() (angr.analyses.decompiler.structured_codegen.c.CITE
method), 997
method), 1015__init__() (angr.analyses.decompiler.structured_codegen.InstructionMappingElement__init__() (angr.analyses.decompiler.structured_codegen.c.CIfBreakmethod), 997
method), 1006__init__() (angr.analyses.decompiler.structured_codegen.PositionMapping__init__() (angr.analyses.decompiler.structured_codegen.c.CIfElse
method), 998
method), 1006__init__() (angr.analyses.decompiler.structured_codegen.PositionMappingElement__init__() (angr.analyses.decompiler.structured_codegen.c.CIndexedVar
method), 997
method), 1011__init__() (angr.analyses.decompiler.structured_codegen.base.BaseStructuredCodeGenerator__init__() (angr.analyses.decompiler.structured_codegen.c.CLabelmethod), 1002
method), 1010__init__() (angr.analyses.decompiler.structured_codegen.base.InstructionMapping__init__() (angr.analyses.decompiler.structured_codegen.c.CMultiStatem
method), 1002
method), 1015__init__() (angr.analyses.decompiler.structured_codegen.base.InstructionMappingElement__init__() (angr.analyses.decompiler.structured_codegen.c.CRegister
method), 1001
method), 1015__init__() (angr.analyses.decompiler.structured_codegen.base.PositionMapping__init__() (angr.analyses.decompiler.structured_codegen.c.CReturn
method), 1001
method), 1009
1222

Index

angr

__init__() (angr.analyses.decompiler.structured_codegen.c.CStatements__init__() (angr.analyses.decompiler.structuring.structurer_nodes.Contin
method), 1005
method), 936__init__() (angr.analyses.decompiler.structured_codegen.c.CStructField__init__() (angr.analyses.decompiler.structuring.structurer_nodes.Incommethod), 1010
method), 937__init__() (angr.analyses.decompiler.structured_codegen.c.CStructFieldNameDef__init__() (angr.analyses.decompiler.structuring.structurer_nodes.Incommethod), 1016
method), 937__init__() (angr.analyses.decompiler.structured_codegen.c.CStructuredCodeGenerator__init__() (angr.analyses.decompiler.structuring.structurer_nodes.LoopN
method), 1017
method), 935__init__() (angr.analyses.decompiler.structured_codegen.c.CSwitchCase__init__() (angr.analyses.decompiler.structuring.structurer_nodes.MultiN
method), 1007
method), 933__init__() (angr.analyses.decompiler.structured_codegen.c.CTypeCast__init__() (angr.analyses.decompiler.structuring.structurer_nodes.Sequemethod), 1013
method), 933__init__() (angr.analyses.decompiler.structured_codegen.c.CUnaryOp__init__() (angr.analyses.decompiler.structuring.structurer_nodes.Switch
method), 1012
method), 937__init__() (angr.analyses.decompiler.structured_codegen.c.CUnsupportedStatement__init__()(angr.analyses.disassembly.BlockStart
method), 1009
method), 1142__init__() (angr.analyses.decompiler.structured_codegen.c.CVariable__init__()(angr.analyses.disassembly.Comment
method), 1011
method), 1144__init__() (angr.analyses.decompiler.structured_codegen.c.CVariableField__init__()(angr.analyses.disassembly.Disassembly
method), 1012
method), 1144__init__() (angr.analyses.decompiler.structured_codegen.c.CWhileLoop__init__() (angr.analyses.disassembly.FuncComment
method), 1005
method), 1144__init__() (angr.analyses.decompiler.structured_codegen.dummy.DummyStructuredCodeGenerator__init__() (angr.analyses.disassembly.FunctionStart
method), 1020
method), 1141__init__() (angr.analyses.decompiler.structured_codegen.dwarf_import.ImportSourceCode__init__() (angr.analyses.disassembly.Hook method),
method), 1020
1142__init__() (angr.analyses.decompiler.structured_codegen.dwarf_import.ImportedLine__init__() (angr.analyses.disassembly.IROp method),
method), 1020
1141__init__() (angr.analyses.decompiler.structuring.DreamStructurer__init__()(angr.analyses.disassembly.Instruction
method), 930
method), 1142__init__() (angr.analyses.decompiler.structuring.PhoenixStructurer__init__() (angr.analyses.disassembly.Label method),
method), 931
1141__init__() (angr.analyses.decompiler.structuring.RecursiveStructurer__init__() (angr.analyses.disassembly.MemoryOperandmethod), 932
method), 1143__init__() (angr.analyses.decompiler.structuring.SAILRStructurer__init__()(angr.analyses.disassembly.Opcode
method), 932
method), 1143__init__() (angr.analyses.decompiler.structuring.dream.DreamStructurer__init__()(angr.analyses.disassembly.Operandmethod), 933
method), 1143__init__() (angr.analyses.decompiler.structuring.phoenix.PhoenixStructurer__init__()(angr.analyses.disassembly.Register
method), 939
method), 1144__init__() (angr.analyses.decompiler.structuring.recursive_structurer.RecursiveStructurer__init__() (angr.analyses.disassembly.SootExpression
method), 930
method), 1142__init__() (angr.analyses.decompiler.structuring.structurer_base.StructurerBase__init__() (angr.analyses.disassembly.SootExpressionInvoke
method), 938
method), 1143__init__() (angr.analyses.decompiler.structuring.structurer_nodes.BreakNode__init__() (angr.analyses.disassembly.SootExpressionStaticFieldRef
method), 936
method), 1143__init__() (angr.analyses.decompiler.structuring.structurer_nodes.CascadingConditionNode__init__() (angr.analyses.disassembly.SootExpressionTarget
method), 935
method), 1142__init__() (angr.analyses.decompiler.structuring.structurer_nodes.CodeNode__init__() (angr.analyses.disassembly.SootStatement
method), 934
method), 1143__init__() (angr.analyses.decompiler.structuring.structurer_nodes.ConditionNode__init__() (angr.analyses.disassembly.Value method),
method), 934
1144__init__() (angr.analyses.decompiler.structuring.structurer_nodes.ConditionalBreakNode__init__() (angr.analyses.dominance_frontier.DominanceFrontier
method), 936
method), 1155
Index

1223

angr

__init__() (angr.analyses.find_objects_static.NewFunctionHandler__init__() (angr.analyses.loop_analysis.LoopAnalysisState
method), 1140
method), 1132__init__() (angr.analyses.find_objects_static.PossibleObject__init__() (angr.analyses.loop_analysis.SootBlockProcessor
method), 1140
method), 1132__init__() (angr.analyses.find_objects_static.StaticObjectFinder__init__() (angr.analyses.loopfinder.Loop method),
method), 1140
1131__init__() (angr.analyses.flirt.FlirtAnalysis method), __init__()(angr.analyses.loopfinder.LoopFinder
1030
method), 1131__init__() (angr.analyses.forward_analysis.CallGraphVisitor__init__() (angr.analyses.propagator.PropagatorAnalysis
method), 835
method), 1034__init__() (angr.analyses.forward_analysis.ForwardAnalysis__init__() (angr.analyses.propagator.engine_base.SimEnginePropagatormethod), 835
method), 1035__init__() (angr.analyses.forward_analysis.FunctionGraphVisitor__init__() (angr.analyses.propagator.outdated_definition_walker.Outdate
method), 836
method), 1038__init__() (angr.analyses.forward_analysis.LoopVisitor __init__() (angr.analyses.propagator.propagator.PropagatorAnalysis
method), 837
method), 1039__init__() (angr.analyses.forward_analysis.SingleNodeGraphVisitor__init__() (angr.analyses.propagator.tmpvar_finder.TmpvarFinder
method), 838
method), 1038__init__() (angr.analyses.forward_analysis.forward_analysis.ForwardAnalysis__init__()(angr.analyses.propagator.values.Top
method), 839
method), 1035__init__() (angr.analyses.forward_analysis.job_info.JobInfo__init__() (angr.analyses.propagator.vex_vars.VEXMemVar
method), 840
method), 1035__init__() (angr.analyses.forward_analysis.visitors.CallGraphVisitor__init__() (angr.analyses.propagator.vex_vars.VEXReg
method), 840
method), 1035__init__() (angr.analyses.forward_analysis.visitors.FunctionGraphVisitor__init__() (angr.analyses.propagator.vex_vars.VEXTmp
method), 841
method), 1035__init__() (angr.analyses.forward_analysis.visitors.LoopVisitor__init__() (angr.analyses.proximity_graph.BaseProxiNode
method), 842
method), 1157__init__() (angr.analyses.forward_analysis.visitors.SingleNodeGraphVisitor__init__() (angr.analyses.proximity_graph.CallProxiNode
method), 843
method), 1158__init__() (angr.analyses.forward_analysis.visitors.call_graph.CallGraphVisitor__init__() (angr.analyses.proximity_graph.FunctionProxiNode
method), 843
method), 1157__init__() (angr.analyses.forward_analysis.visitors.function_graph.FunctionGraphVisitor__init__() (angr.analyses.proximity_graph.IntegerProxiNode
method), 844
method), 1158__init__() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor__init__() (angr.analyses.proximity_graph.ProximityGraphAnalysis
method), 845
method), 1159__init__() (angr.analyses.forward_analysis.visitors.loop.LoopVisitor__init__() (angr.analyses.proximity_graph.StringProxiNode
method), 847
method), 1158__init__() (angr.analyses.forward_analysis.visitors.single_node_graph.SingleNodeGraphVisitor__init__() (angr.analyses.proximity_graph.UnknownProxiNode
method), 848
method), 1158__init__() (angr.analyses.identifier.identify.FuncInfo __init__() (angr.analyses.proximity_graph.VariableProxiNode
method), 1130
method), 1157__init__() (angr.analyses.identifier.identify.Identifier __init__() (angr.analyses.reaching_definitions.Atom
method), 1130
method), 1049__init__() (angr.analyses.init_finder.InitializationFinder __init__() (angr.analyses.reaching_definitions.ConstantSrc
method), 1155
method), 1052__init__() (angr.analyses.init_finder.SimEngineInitFinderVEX__init__() (angr.analyses.reaching_definitions.Definition
method), 1155
method), 1053__init__() (angr.analyses.loop_analysis.AnnotatedVariable__init__() (angr.analyses.reaching_definitions.FunctionCallData
method), 1131
method), 1072__init__()(angr.analyses.loop_analysis.Condition __init__() (angr.analyses.reaching_definitions.FunctionHandler
method), 1132
method), 1067__init__() (angr.analyses.loop_analysis.LoopAnalysis __init__() (angr.analyses.reaching_definitions.GuardUse
method), 1132
method), 1052
1224

Index

angr

__init__() (angr.analyses.reaching_definitions.LiveDefinitions__init__()(angr.analyses.reassembler.NotypeLabelmethod), 1041
method), 1146__init__() (angr.analyses.reaching_definitions.MemoryLocation__init__()(angr.analyses.reassembler.ObjectLabelmethod), 1051
method), 1146__init__() (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis__init__()(angr.analyses.reassembler.Operandmethod), 1055
method), 1147__init__() (angr.analyses.reaching_definitions.ReachingDefinitionsModel__init__()(angr.analyses.reassembler.Procedure
method), 1057
method), 1148__init__() (angr.analyses.reaching_definitions.ReachingDefinitionsState__init__() (angr.analyses.reassembler.ProcedureChunkmethod), 1060
method), 1149__init__() (angr.analyses.reaching_definitions.Register __init__()(angr.analyses.reassembler.Reassembler
method), 1051
method), 1150__init__() (angr.analyses.reaching_definitions.Tmp __init__()(angr.analyses.reassembler.Relocation
method), 1052
method), 1150__init__() (angr.analyses.reaching_definitions.call_trace.CallSite__init__() (angr.analyses.reassembler.SymbolManager
method), 1073
method), 1146__init__() (angr.analyses.reaching_definitions.call_trace.CallTrace__init__() (angr.analyses.soot_class_hierarchy.NoConcreteDispatch
method), 1073
method), 857__init__() (angr.analyses.reaching_definitions.dep_graph.DepGraph__init__() (angr.analyses.soot_class_hierarchy.SootClassHierarchy
method), 1079
method), 857__init__() (angr.analyses.reaching_definitions.dep_graph.FunctionCallRelationships__init__() (angr.analyses.soot_class_hierarchy.SootClassHierarchyError
method), 1079
method), 857__init__() (angr.analyses.reaching_definitions.engine_ail.SimEngineRDAIL__init__() (angr.analyses.stack_pointer_tracker.Constantmethod), 1098
method), 1103__init__() (angr.analyses.reaching_definitions.engine_vex.SimEngineRDVEX__init__()(angr.analyses.stack_pointer_tracker.Eq
method), 1074
method), 1104__init__() (angr.analyses.reaching_definitions.function_handler.FunctionCallData__init__() (angr.analyses.stack_pointer_tracker.FrozenStackPointerTrackmethod), 1086
method), 1104__init__() (angr.analyses.reaching_definitions.function_handler.FunctionCallDataUnwrapped__init__() (angr.analyses.stack_pointer_tracker.OffsetVal
method), 1087
method), 1103__init__() (angr.analyses.reaching_definitions.function_handler.FunctionEffect__init__() (angr.analyses.stack_pointer_tracker.Register
method), 1083
method), 1103__init__() (angr.analyses.reaching_definitions.function_handler.FunctionHandler__init__() (angr.analyses.stack_pointer_tracker.StackPointerTracker
method), 1087
method), 1105__init__() (angr.analyses.reaching_definitions.heap_allocator.HeapAllocator__init__() (angr.analyses.stack_pointer_tracker.StackPointerTrackerState
method), 1082
method), 1104__init__() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState__init__() (angr.analyses.static_hooker.StaticHooker
method), 1091
method), 1153__init__() (angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis__init__() (angr.analyses.typehoon.Typehoon method),
method), 1076
1130__init__() (angr.analyses.reaching_definitions.subject.Subject__init__()(angr.analyses.typehoon.lifter.TypeLifter
method), 1097
method), 1116__init__()(angr.analyses.reassembler.BasicBlock __init__() (angr.analyses.typehoon.simple_solver.ConstraintGraphNode
method), 1148
method), 1119__init__() (angr.analyses.reassembler.Data method), __init__() (angr.analyses.typehoon.simple_solver.RecursiveRefNode1149
method), 1117__init__()(angr.analyses.reassembler.DataLabel __init__() (angr.analyses.typehoon.simple_solver.SimpleSolver
method), 1145
method), 1120__init__() (angr.analyses.reassembler.FunctionLabel __init__() (angr.analyses.typehoon.simple_solver.Sketch
method), 1146
method), 1117__init__()(angr.analyses.reassembler.Instruction __init__() (angr.analyses.typehoon.simple_solver.SketchNode
method), 1147
method), 1117__init__() (angr.analyses.reassembler.Label method), __init__() (angr.analyses.typehoon.translator.SimTypeTempRef1145
method), 1121
Index

1225

angr

__init__() (angr.analyses.typehoon.translator.TypeTranslator__init__() (angr.analyses.variable_recovery.annotations.StackLocationAn
method), 1121
method), 1106__init__() (angr.analyses.typehoon.typeconsts.Array __init__() (angr.analyses.variable_recovery.annotations.VariableSourceA
method), 1129
method), 1106__init__() (angr.analyses.typehoon.typeconsts.Function __init__() (angr.analyses.variable_recovery.engine_ail.SimEngineVRAIL
method), 1129
method), 1114__init__() (angr.analyses.typehoon.typeconsts.Pointer __init__() (angr.analyses.variable_recovery.engine_base.RichR
method), 1128
method), 1114__init__() (angr.analyses.typehoon.typeconsts.Pointer32 __init__() (angr.analyses.variable_recovery.engine_base.SimEngineVRB
method), 1128
method), 1115__init__() (angr.analyses.typehoon.typeconsts.Pointer64 __init__() (angr.analyses.variable_recovery.engine_vex.SimEngineVRVE
method), 1129
method), 1114__init__() (angr.analyses.typehoon.typeconsts.Struct __init__() (angr.analyses.variable_recovery.irsb_scanner.VEXIRSBScann
method), 1129
method), 1115__init__() (angr.analyses.typehoon.typeconsts.TypeVariableReference__init__() (angr.analyses.variable_recovery.variable_recovery.VariableR
method), 1129
method), 1113__init__() (angr.analyses.typehoon.typehoon.Typehoon __init__() (angr.analyses.variable_recovery.variable_recovery.VariableR
method), 1126
method), 1112__init__()(angr.analyses.typehoon.typevars.Add __init__() (angr.analyses.variable_recovery.variable_recovery_base.Var
method), 1123
method), 1107__init__()(angr.analyses.typehoon.typevars.AddN __init__() (angr.analyses.variable_recovery.variable_recovery_base.Var
method), 1125
method), 1107__init__() (angr.analyses.typehoon.typevars.BaseLabel __init__() (angr.analyses.variable_recovery.variable_recovery_base.Var
method), 1125
method), 1108__init__() (angr.analyses.typehoon.typevars.ConvertTo __init__() (angr.analyses.variable_recovery.variable_recovery_fast.Varia
method), 1126
method), 1112__init__() (angr.analyses.typehoon.typevars.DerivedTypeVariable__init__() (angr.analyses.variable_recovery.variable_recovery_fast.Varia
method), 1124
method), 1111__init__() (angr.analyses.typehoon.typevars.Equivalence __init__() (angr.analyses.veritesting.CallTracingFilter
method), 1122
method), 1133__init__() (angr.analyses.typehoon.typevars.Existence __init__()(angr.analyses.veritesting.Veritesting
method), 1122
method), 1133__init__() (angr.analyses.typehoon.typevars.FuncIn __init__() (angr.analyses.vfg.AnalysisTask method),
method), 1125
1135__init__() (angr.analyses.typehoon.typevars.FuncOut __init__() (angr.analyses.vfg.CallAnalysis method),
method), 1125
1136__init__() (angr.analyses.typehoon.typevars.HasField __init__()(angr.analyses.vfg.FunctionAnalysis
method), 1126
method), 1135__init__() (angr.analyses.typehoon.typevars.ReinterpretAs__init__() (angr.analyses.vfg.PendingJob method),
method), 1126
1134__init__()(angr.analyses.typehoon.typevars.Sub __init__() (angr.analyses.vfg.VFG method), 1137
method), 1123__init__() (angr.analyses.vfg.VFGJob method), 1134__init__()(angr.analyses.typehoon.typevars.SubN __init__() (angr.analyses.vfg.VFGNode method), 1136
method), 1126__init__()(angr.analyses.vsa_ddg.DefUseChain__init__() (angr.analyses.typehoon.typevars.Subtype
method), 1139
method), 1122__init__()(angr.analyses.vsa_ddg.VSA_DDG__init__() (angr.analyses.typehoon.typevars.TypeVariable
method), 1139
method), 1123__init__() (angr.analyses.vtable.Vtable method), 1139__init__() (angr.analyses.typehoon.typevars.TypeVariables__init__()(angr.analyses.vtable.VtableFinder
method), 1125
method), 1140__init__() (angr.analyses.variable_recovery.VariableRecovery__init__() (angr.analyses.xrefs.SimEngineXRefsVEX
method), 1115
method), 1156__init__() (angr.analyses.variable_recovery.VariableRecoveryFast__init__()(angr.analyses.xrefs.XRefsAnalysis
method), 1116
method), 1156
1226

Index

angr

__init__() (angr.angrdb.AngrDB method), 916
method), 615__init__() (angr.angrdb.db.AngrDB method), 918__init__() (angr.calling_conventions.SimLyingRegArg__init__()(angr.angrdb.models.DbCFGModel
method), 621
method), 920__init__() (angr.calling_conventions.SimReferenceArgument__init__() (angr.angrdb.models.DbComment method),
method), 617
923__init__()(angr.calling_conventions.SimRegArg__init__() (angr.angrdb.models.DbFunction method),
method), 615
921__init__()(angr.calling_conventions.SimStackArg__init__()(angr.angrdb.models.DbInformation
method), 616
method), 919__init__()(angr.calling_conventions.SimStructArg__init__()(angr.angrdb.models.DbKnowledgeBase
method), 617
method), 920__init__() (angr.calling_conventions.UsercallArgSession__init__() (angr.angrdb.models.DbLabel method), 923
method), 618__init__() (angr.angrdb.models.DbObject method), __init__()(angr.code_location.CodeLocation
920
method), 780__init__()(angr.angrdb.models.DbStructuredCode __init__() (angr.code_location.ExternalCodeLocation
method), 922
method), 780__init__() (angr.angrdb.models.DbVariableCollection __init__() (angr.codenode.BlockNode method), 1171
method), 921__init__() (angr.codenode.CodeNode method), 1170__init__() (angr.angrdb.models.DbXRefs method), 922 __init__() (angr.codenode.HookNode method), 1171__init__() (angr.angrdb.serializers.loader.LoadArgsJSONDecoder__init__() (angr.codenode.SootBlockNode method),
method), 927
1171__init__() (angr.annocfg.AnnotatedCFG method), __init__() (angr.concretization_strategies.SimConcretizationStrategy1169
method), 411__init__() (angr.blade.Blade method), 1167__init__() (angr.concretization_strategies.SimConcretizationStrategyCon__init__() (angr.block.Block method), 216
method), 411__init__() (angr.block.CapstoneInsn method), 216__init__() (angr.concretization_strategies.SimConcretizationStrategyEva__init__() (angr.block.DisassemblerBlock method),
method), 412
215__init__() (angr.concretization_strategies.SimConcretizationStrategyMax__init__() (angr.block.SootBlock method), 217
method), 412__init__() (angr.callable.Callable method), 654__init__() (angr.concretization_strategies.SimConcretizationStrategyNon__init__()(angr.calling_conventions.AllocHelper
method), 412
method), 613__init__() (angr.concretization_strategies.SimConcretizationStrategyNor__init__()(angr.calling_conventions.ArgSession
method), 413
method), 617__init__() (angr.concretization_strategies.SimConcretizationStrategyNor__init__() (angr.calling_conventions.MicrosoftAMD64ArgSession method), 413
method), 623__init__() (angr.concretization_strategies.SimConcretizationStrategyRan__init__() (angr.calling_conventions.PointerWrapper
method), 413
method), 613__init__() (angr.concretization_strategies.SimConcretizationStrategySolu__init__() (angr.calling_conventions.SerializableCountermethod), 414
method), 614__init__() (angr.concretization_strategies.SimConcretizationStrategyUnli__init__() (angr.calling_conventions.SerializableListIterator
method), 414
method), 614__init__() (angr.concretization_strategies.controlled_data.SimConcretiza__init__()(angr.calling_conventions.SimArrayArg
method), 498
method), 617__init__() (angr.concretization_strategies.eval.SimConcretizationStrategy__init__() (angr.calling_conventions.SimCC method),
method), 495
618__init__() (angr.concretization_strategies.max.SimConcretizationStrateg__init__() (angr.calling_conventions.SimCC.ArgSession
method), 497
method), 619__init__() (angr.concretization_strategies.nonzero_range.SimConcretizat__init__() (angr.calling_conventions.SimCCUsercall
method), 496
method), 622__init__() (angr.concretization_strategies.norepeats.SimConcretizationSt__init__() (angr.calling_conventions.SimComboArg
method), 495
method), 616__init__() (angr.concretization_strategies.norepeats_range.SimConcretiz__init__() (angr.calling_conventions.SimFunctionArgument
method), 497
Index

1227

angr

__init__() (angr.concretization_strategies.range.SimConcretizationStrategyRange
method), 573
method), 496__init__() (angr.engines.pcode.behavior.OpBehaviorBoolAnd__init__() (angr.concretization_strategies.solutions.SimConcretizationStrategySolutions
method), 587
method), 496__init__() (angr.engines.pcode.behavior.OpBehaviorBoolNegate__init__() (angr.concretization_strategies.unlimited_range.SimConcretizationStrategyUnlimitedRange
method), 586
method), 498__init__() (angr.engines.pcode.behavior.OpBehaviorBoolOr__init__() (angr.distributed.Server method), 1205
method), 587__init__() (angr.distributed.server.Server method), __init__() (angr.engines.pcode.behavior.OpBehaviorBoolXor
1205
method), 586__init__() (angr.distributed.worker.BadStatesDropper __init__() (angr.engines.pcode.behavior.OpBehaviorCopy
method), 1206
method), 574__init__() (angr.distributed.worker.ExplorationStatusNotifier__init__() (angr.engines.pcode.behavior.OpBehaviorEqual
method), 1206
method), 575__init__() (angr.distributed.worker.Worker method), __init__() (angr.engines.pcode.behavior.OpBehaviorFloatAbs
1206
method), 590__init__() (angr.engines.SimEngineConcrete method), __init__() (angr.engines.pcode.behavior.OpBehaviorFloatAdd549
method), 589__init__() (angr.engines.SimEngineUnicorn method), __init__() (angr.engines.pcode.behavior.OpBehaviorFloatCeil
548
method), 591__init__() (angr.engines.SimSuccessors method), 544 __init__() (angr.engines.pcode.behavior.OpBehaviorFloatDiv__init__() (angr.engines.SuccessorsMixin method),
method), 589
545__init__() (angr.engines.pcode.behavior.OpBehaviorFloatEqual__init__() (angr.engines.TrackActionsMixin method),
method), 588
547__init__() (angr.engines.pcode.behavior.OpBehaviorFloatFloat2Float__init__() (angr.engines.concrete.SimEngineConcrete
method), 590
method), 560__init__() (angr.engines.pcode.behavior.OpBehaviorFloatFloor__init__()(angr.engines.engine.SimEngineBase
method), 591
method), 551__init__() (angr.engines.pcode.behavior.OpBehaviorFloatInt2Float__init__()(angr.engines.engine.SuccessorsMixin
method), 590
method), 552__init__() (angr.engines.pcode.behavior.OpBehaviorFloatLess__init__() (angr.engines.engine.TLSProperty method),
method), 588
552__init__() (angr.engines.pcode.behavior.OpBehaviorFloatLessEqual__init__() (angr.engines.light.ArithmeticExpression
method), 588
method), 1031__init__() (angr.engines.pcode.behavior.OpBehaviorFloatMult__init__() (angr.engines.light.RegisterOffset method),
method), 589
1031__init__() (angr.engines.pcode.behavior.OpBehaviorFloatNan__init__()(angr.engines.light.SimEngineLight
method), 588
method), 1032__init__() (angr.engines.pcode.behavior.OpBehaviorFloatNeg__init__() (angr.engines.light.SpOffset method), 1031
method), 589__init__() (angr.engines.light.data.ArithmeticExpression __init__() (angr.engines.pcode.behavior.OpBehaviorFloatNotEqual
method), 1030
method), 588__init__()(angr.engines.light.data.RegisterOffset __init__() (angr.engines.pcode.behavior.OpBehaviorFloatRoundmethod), 1031
method), 591__init__() (angr.engines.light.data.SpOffset method), __init__() (angr.engines.pcode.behavior.OpBehaviorFloatSqrt
1031
method), 590__init__() (angr.engines.light.engine.SimEngineLight __init__() (angr.engines.pcode.behavior.OpBehaviorFloatSub
method), 1033
method), 589__init__() (angr.engines.light.engine.SimEngineLightMixin__init__() (angr.engines.pcode.behavior.OpBehaviorFloatTrunc
method), 1032
method), 590__init__()(angr.engines.pcode.HeavyPcodeMixin __init__() (angr.engines.pcode.behavior.OpBehaviorInt2Comp
method), 561
method), 580__init__() (angr.engines.pcode.behavior.BehaviorFactory__init__() (angr.engines.pcode.behavior.OpBehaviorIntAdd
method), 593
method), 578__init__() (angr.engines.pcode.behavior.OpBehavior __init__() (angr.engines.pcode.behavior.OpBehaviorIntAnd
1228

Index

angr

method), 582
method), 573__init__() (angr.engines.pcode.behavior.OpBehaviorIntCarry__init__() (angr.engines.pcode.engine.HeavyPcodeMixin
method), 579
method), 562__init__() (angr.engines.pcode.behavior.OpBehaviorIntDiv__init__()(angr.engines.pcode.lifter.ExitStatement
method), 584
method), 563__init__() (angr.engines.pcode.behavior.OpBehaviorIntLeft__init__() (angr.engines.pcode.lifter.IRSB method),
method), 582
564__init__() (angr.engines.pcode.behavior.OpBehaviorIntLess__init__() (angr.engines.pcode.lifter.Lifter method),
method), 576
568__init__() (angr.engines.pcode.behavior.OpBehaviorIntLessEqual__init__() (angr.engines.pcode.lifter.PcodeBasicBlockLifter
method), 577
method), 569__init__() (angr.engines.pcode.behavior.OpBehaviorIntMult__init__() (angr.engines.pcode.lifter.PcodeDisassemblerInsn
method), 584
method), 563__init__() (angr.engines.pcode.behavior.OpBehaviorIntNegate__init__() (angr.engines.pcode.lifter.PcodeLifterEngineMixin
method), 581
method), 571__init__() (angr.engines.pcode.behavior.OpBehaviorIntOr__init__()(angr.engines.successors.SimSuccessors
method), 582
method), 553__init__() (angr.engines.pcode.behavior.OpBehaviorIntRem__init__() (angr.engines.unicorn.SimEngineUnicorn
method), 585
method), 559__init__() (angr.engines.pcode.behavior.OpBehaviorIntRight__init__()(angr.engines.vex.TrackActionsMixin
method), 583
method), 556__init__() (angr.engines.pcode.behavior.OpBehaviorIntSborrow__init__() (angr.engines.vex.VEXLifter method), 557
method), 580__init__() (angr.engines.vex.VEXMixin method), 556__init__() (angr.engines.pcode.behavior.OpBehaviorIntScarry__init__()(angr.engines.vex.VEXSlicingMixin
method), 579
method), 556__init__() (angr.engines.pcode.behavior.OpBehaviorIntSdiv__init__()(angr.errors.SimMemoryMissingError
method), 585
method), 1201__init__() (angr.engines.pcode.behavior.OpBehaviorIntSext__init__() (angr.errors.SimReliftException method),
method), 578
1203__init__() (angr.engines.pcode.behavior.OpBehaviorIntSless__init__() (angr.errors.SimSegfaultException method),
method), 576
1204__init__() (angr.engines.pcode.behavior.OpBehaviorIntSlessEqual__init__() (angr.errors.SimUninitializedAccessError
method), 576
method), 1202__init__() (angr.engines.pcode.behavior.OpBehaviorIntSrem__init__() (angr.exploration_techniques.CallFunctionGoal
method), 585
method), 517__init__() (angr.engines.pcode.behavior.OpBehaviorIntSright__init__() (angr.exploration_techniques.DFS method),
method), 583
514__init__() (angr.engines.pcode.behavior.OpBehaviorIntSub__init__()(angr.exploration_techniques.Director
method), 579
method), 516__init__() (angr.engines.pcode.behavior.OpBehaviorIntXor__init__() (angr.exploration_techniques.DrillerCore
method), 581
method), 509__init__() (angr.engines.pcode.behavior.OpBehaviorIntZext__init__() (angr.exploration_techniques.ExecuteAddressGoal
method), 577
method), 516__init__() (angr.engines.pcode.behavior.OpBehaviorLzcount__init__() (angr.exploration_techniques.ExplorationTechniquemethod), 592
method), 506__init__() (angr.engines.pcode.behavior.OpBehaviorNotEqual__init__()(angr.exploration_techniques.Explorer
method), 575
method), 513__init__() (angr.engines.pcode.behavior.OpBehaviorPiece__init__() (angr.exploration_techniques.LengthLimitermethod), 591
method), 515__init__() (angr.engines.pcode.behavior.OpBehaviorPopcount__init__() (angr.exploration_techniques.LocalLoopSeer
method), 592
method), 522__init__() (angr.engines.pcode.behavior.OpBehaviorSubpiece__init__()(angr.exploration_techniques.LoopSeer
method), 591
method), 510__init__() (angr.engines.pcode.emulate.PcodeEmulatorMixin__init__() (angr.exploration_techniques.ManualMergepoint
Index

1229

angr

method), 518
method), 533__init__() (angr.exploration_techniques.MemoryWatcher__init__() (angr.exploration_techniques.spiller.PickledStatesDb
method), 521
method), 528__init__() (angr.exploration_techniques.Oppologist __init__() (angr.exploration_techniques.spiller.PickledStatesList
method), 515
method), 527__init__()(angr.exploration_techniques.Slicecutor __init__() (angr.exploration_techniques.spiller.Spiller
method), 508
method), 528__init__()(angr.exploration_techniques.Spiller __init__() (angr.exploration_techniques.spiller_db.PickledState
method), 518
method), 529__init__() (angr.exploration_techniques.StochasticSearch__init__() (angr.exploration_techniques.stochastic.StochasticSearchmethod), 519
method), 539__init__() (angr.exploration_techniques.Suggestions __init__() (angr.exploration_techniques.suggestions.Suggestions
method), 523
method), 543__init__()(angr.exploration_techniques.Symbion __init__() (angr.exploration_techniques.symbion.Symbion
method), 520
method), 541__init__() (angr.exploration_techniques.TechniqueBuilder__init__() (angr.exploration_techniques.tech_builder.TechniqueBuilder
method), 519
method), 541__init__()(angr.exploration_techniques.Threading __init__() (angr.exploration_techniques.threading.Threading
method), 514
method), 529__init__()(angr.exploration_techniques.Timeout __init__() (angr.exploration_techniques.timeout.Timeout
method), 523
method), 524__init__()(angr.exploration_techniques.Tracer __init__() (angr.exploration_techniques.tracer.RepHookmethod), 511
method), 531__init__() (angr.exploration_techniques.UniqueSearch __init__() (angr.exploration_techniques.tracer.Tracer
method), 519
method), 532__init__()(angr.exploration_techniques.Veritesting __init__() (angr.exploration_techniques.tracer.TracerDesyncError
method), 515
method), 531__init__()(angr.exploration_techniques.dfs.DFS __init__() (angr.exploration_techniques.unique.UniqueSearchmethod), 524
method), 540__init__() (angr.exploration_techniques.director.BaseGoal__init__() (angr.exploration_techniques.veritesting.Veritesting
method), 535
method), 530__init__() (angr.exploration_techniques.director.CallFunctionGoal__init__() (angr.factory.AngrObjectFactory method),
method), 536
212__init__() (angr.exploration_techniques.director.Director__init__() (angr.flirt.FlirtSignature method), 1187
method), 536__init__() (angr.keyed_region.KeyedRegion method),__init__() (angr.exploration_techniques.director.ExecuteAddressGoal
782
method), 535__init__() (angr.keyed_region.RegionObject method),__init__() (angr.exploration_techniques.driller_core.DrillerCore 781
method), 533__init__() (angr.keyed_region.StoredObject method),__init__() (angr.exploration_techniques.explorer.Explorer
781
method), 525__init__()(angr.knowledge_base.KnowledgeBase__init__() (angr.exploration_techniques.lengthlimiter.LengthLimitermethod), 655
method), 526__init__()(angr.knowledge_plugins.CFGManager__init__() (angr.exploration_techniques.local_loop_seer.LocalLoopSeer
method), 668
method), 538__init__() (angr.knowledge_plugins.CallsitePrototypes__init__() (angr.exploration_techniques.loop_seer.LoopSeer
method), 672
method), 537__init__()(angr.knowledge_plugins.CustomStrings__init__() (angr.exploration_techniques.manual_mergepoint.ManualMergepoint
method), 673
method), 526__init__() (angr.knowledge_plugins.DebugVariableManager__init__() (angr.exploration_techniques.memory_watcher.MemoryWatcher
method), 666
method), 542__init__() (angr.knowledge_plugins.Function method),__init__() (angr.exploration_techniques.oppologist.Oppologist
657
method), 537__init__() (angr.knowledge_plugins.FunctionManager__init__() (angr.exploration_techniques.slicecutor.Slicecutor
method), 655
1230

Index

angr

__init__()(angr.knowledge_plugins.IndirectJumps __init__() (angr.knowledge_plugins.functions.Function
method), 667
method), 705__init__() (angr.knowledge_plugins.KeyDefinitionManager__init__() (angr.knowledge_plugins.functions.FunctionManager
method), 670
method), 712__init__() (angr.knowledge_plugins.KnowledgeBasePlugin__init__() (angr.knowledge_plugins.functions.function.Function
method), 669
method), 716__init__() (angr.knowledge_plugins.Labels method), __init__() (angr.knowledge_plugins.functions.function_manager.Function
667
method), 714__init__()(angr.knowledge_plugins.PatchManager __init__() (angr.knowledge_plugins.functions.function_manager.Function
method), 669
method), 715__init__() (angr.knowledge_plugins.PropagationManager__init__() (angr.knowledge_plugins.functions.soot_function.SootFunction
method), 671
method), 724__init__() (angr.knowledge_plugins.StructuredCodeManager__init__() (angr.knowledge_plugins.indirect_jumps.IndirectJumps
method), 672
method), 704__init__()(angr.knowledge_plugins.TypesStore __init__() (angr.knowledge_plugins.key_definitions.Definition
method), 672
method), 750__init__() (angr.knowledge_plugins.VariableManager __init__() (angr.knowledge_plugins.key_definitions.KeyDefinitionManagmethod), 665
method), 739__init__()(angr.knowledge_plugins.XRefManager __init__() (angr.knowledge_plugins.key_definitions.LiveDefinitions
method), 668
method), 739__init__() (angr.knowledge_plugins.callsite_prototypes.CallsitePrototypes__init__() (angr.knowledge_plugins.key_definitions.ReachingDefinitionsM
method), 675
method), 737__init__() (angr.knowledge_plugins.cfg.CFGENode __init__() (angr.knowledge_plugins.key_definitions.Uses
method), 680
method), 748__init__() (angr.knowledge_plugins.cfg.CFGManager __init__() (angr.knowledge_plugins.key_definitions.atoms.Atom
method), 688
method), 751__init__() (angr.knowledge_plugins.cfg.CFGModel __init__() (angr.knowledge_plugins.key_definitions.atoms.ConstantSrc
method), 682
method), 753__init__()(angr.knowledge_plugins.cfg.CFGNode __init__() (angr.knowledge_plugins.key_definitions.atoms.GuardUse
method), 678
method), 753__init__() (angr.knowledge_plugins.cfg.IndirectJump __init__() (angr.knowledge_plugins.key_definitions.atoms.MemoryLocati
method), 681
method), 755__init__() (angr.knowledge_plugins.cfg.MemoryData __init__() (angr.knowledge_plugins.key_definitions.atoms.Register
method), 677
method), 754__init__() (angr.knowledge_plugins.cfg.cfg_manager.CFGManager__init__() (angr.knowledge_plugins.key_definitions.atoms.Tmp
method), 696
method), 753__init__() (angr.knowledge_plugins.cfg.cfg_model.CFGModel__init__() (angr.knowledge_plugins.key_definitions.atoms.VirtualVariabl
method), 688
method), 754__init__() (angr.knowledge_plugins.cfg.cfg_node.CFGENode__init__() (angr.knowledge_plugins.key_definitions.definition.Definition
method), 699
method), 757__init__() (angr.knowledge_plugins.cfg.cfg_node.CFGNode__init__() (angr.knowledge_plugins.key_definitions.definition.DefinitionM
method), 697
method), 757__init__() (angr.knowledge_plugins.cfg.cfg_node.CFGNodeCreationFailure__init__() (angr.knowledge_plugins.key_definitions.environment.Environ
method), 697
method), 758__init__() (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump__init__() (angr.knowledge_plugins.key_definitions.heap_address.HeapA
method), 700
method), 759__init__() (angr.knowledge_plugins.cfg.memory_data.MemoryData__init__() (angr.knowledge_plugins.key_definitions.key_definition_mana
method), 695
method), 760__init__() (angr.knowledge_plugins.debug_variables.DebugVariable__init__() (angr.knowledge_plugins.key_definitions.key_definition_mana
method), 735
method), 759__init__() (angr.knowledge_plugins.debug_variables.DebugVariableContainer__init__() (angr.knowledge_plugins.key_definitions.live_definitions.Defin
method), 734
method), 760__init__() (angr.knowledge_plugins.debug_variables.DebugVariableManager__init__() (angr.knowledge_plugins.key_definitions.live_definitions.LiveD
method), 735
method), 761
Index

1231

angr

__init__() (angr.knowledge_plugins.key_definitions.rd_model.ReachingDefinitionsModel
method), 603
method), 770__init__() (angr.project.Project method), 209__init__() (angr.knowledge_plugins.key_definitions.tag.FunctionTag__init__() (angr.sim_manager.ErrorRecord method),
method), 772
505__init__() (angr.knowledge_plugins.key_definitions.tag.Tag__init__()(angr.sim_manager.SimulationManager
method), 772
method), 499__init__() (angr.knowledge_plugins.key_definitions.uses.Uses__init__()(angr.sim_procedure.SimProcedure
method), 773
method), 601__init__()(angr.knowledge_plugins.labels.Labels __init__() (angr.sim_state.SimState method), 221
method), 704__init__() (angr.sim_state_options.SimStateOptions__init__()(angr.knowledge_plugins.patches.Patchmethod), 225
method), 673__init__()(angr.sim_state_options.StateOption__init__() (angr.knowledge_plugins.patches.PatchManager
method), 223
method), 674__init__() (angr.sim_type.NamedTypeMixin method),__init__() (angr.knowledge_plugins.plugin.KnowledgeBasePlugin 640
method), 675__init__() (angr.sim_type.SimCppClass method), 650__init__() (angr.knowledge_plugins.propagations.PropagationManager__init__() (angr.sim_type.SimCppClassValue method),
method), 703
651__init__() (angr.knowledge_plugins.propagations.PropagationModel__init__() (angr.sim_type.SimStruct method), 649
method), 702__init__() (angr.sim_type.SimStructValue method),__init__() (angr.knowledge_plugins.structured_code.StructuredCodeManager
649
method), 736__init__() (angr.sim_type.SimType method), 638__init__() (angr.knowledge_plugins.types.TypesStore __init__() (angr.sim_type.SimTypeArray method), 644
method), 701__init__() (angr.sim_type.SimTypeBool method), 643__init__() (angr.knowledge_plugins.variables.VariableManager__init__() (angr.sim_type.SimTypeChar method), 642
method), 726__init__()(angr.sim_type.SimTypeCppFunction__init__() (angr.knowledge_plugins.variables.variable_access.VariableAccessmethod), 647
method), 727__init__() (angr.sim_type.SimTypeDouble method),__init__() (angr.knowledge_plugins.variables.variable_manager.LiveVariables
648
method), 728__init__() (angr.sim_type.SimTypeFd method), 643__init__() (angr.knowledge_plugins.variables.variable_manager.VariableManager__init__() (angr.sim_type.SimTypeFloat method), 648
method), 733__init__() (angr.sim_type.SimTypeFunction method),__init__() (angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal646
method), 728__init__() (angr.sim_type.SimTypeInt method), 641__init__()(angr.knowledge_plugins.xrefs.XRef __init__() (angr.sim_type.SimTypeLength method),
method), 776
647__init__() (angr.knowledge_plugins.xrefs.XRefManager __init__() (angr.sim_type.SimTypeNum method), 641
method), 776__init__() (angr.sim_type.SimTypeNumOffset method),__init__()(angr.knowledge_plugins.xrefs.xref.XRef
651
method), 778__init__() (angr.sim_type.SimTypePointer method),__init__() (angr.knowledge_plugins.xrefs.xref_manager.XRefManager
643
method), 779__init__() (angr.sim_type.SimTypeRef method), 652__init__() (angr.misc.plugins.PluginHub method), 218 __init__() (angr.sim_type.SimTypeReference method),__init__() (angr.misc.plugins.PluginPreset method),644
219__init__() (angr.sim_type.SimTypeReg method), 641__init__()(angr.procedures.definitions.SimLibrary __init__() (angr.sim_type.SimTypeString method), 645
method), 606__init__() (angr.sim_type.SimTypeTop method), 640__init__() (angr.procedures.definitions.SimSyscallLibrary__init__() (angr.sim_type.SimTypeWString method),
method), 610
646__init__() (angr.procedures.definitions.SimTypeCollection__init__() (angr.sim_type.SimTypeWideChar method),
method), 605
643__init__() (angr.procedures.stubs.format_parser.FormatSpecifier__init__() (angr.sim_type.SimUnion method), 650
method), 604__init__() (angr.sim_type.SimUnionValue method),__init__() (angr.procedures.stubs.format_parser.FormatString
650
1232

Index

angr

__init__() (angr.sim_type.TypeRef method), 639__init__() (angr.sim_variable.SimConstantVariable
method), 634__init__()(angr.sim_variable.SimMemoryVariable
method), 636__init__()(angr.sim_variable.SimRegisterVariable
method), 635__init__()(angr.sim_variable.SimStackVariable
method), 637__init__() (angr.sim_variable.SimTemporaryVariable
method), 634__init__() (angr.sim_variable.SimVariable method),633__init__()(angr.sim_variable.SimVariableSet
method), 638__init__() (angr.simos.SimCGC method), 1176__init__() (angr.simos.SimJavaVM method), 1177__init__() (angr.simos.SimLinux method), 1175__init__() (angr.simos.SimOS method), 1172__init__() (angr.simos.SimSnimmucNxp method),1179__init__() (angr.simos.SimUserland method), 1174__init__() (angr.simos.SimWindows method), 1176__init__() (angr.simos.cgc.SimCGC method), 1182__init__() (angr.simos.javavm.SimJavaVM method),1185__init__() (angr.simos.linux.SimLinux method), 1181__init__() (angr.simos.simos.GlobalDescriptorTable
method), 1181__init__() (angr.simos.simos.SimOS method), 1179__init__() (angr.simos.userland.SimUserland method),1183__init__() (angr.simos.windows.SimWindows method),1184__init__() (angr.slicer.SimLightState method), 1168__init__() (angr.slicer.SimSlicer method), 1168__init__()(angr.state_hierarchy.StateHierarchy
method), 505__init__() (angr.state_plugins.CallStack method), 266__init__() (angr.state_plugins.Concrete method), 291__init__() (angr.state_plugins.GDB method), 258__init__() (angr.state_plugins.PTChunk method), 289__init__()(angr.state_plugins.PTChunkIterator
method), 291__init__() (angr.state_plugins.SimAction method), 262__init__() (angr.state_plugins.SimActionConstraint
method), 263__init__()(angr.state_plugins.SimActionData
method), 264__init__() (angr.state_plugins.SimActionExit method),263__init__()(angr.state_plugins.SimActionObject
method), 264__init__()(angr.state_plugins.SimActionOperation
Index

method), 263__init__()(angr.state_plugins.SimDebugVariable
method), 297__init__() (angr.state_plugins.SimEvent method), 266__init__() (angr.state_plugins.SimFilesystem method),281__init__() (angr.state_plugins.SimHeapBase method),284__init__() (angr.state_plugins.SimHeapBrk method),284__init__()(angr.state_plugins.SimHeapPTMalloc
method), 287__init__()(angr.state_plugins.SimHostFilesystem
method), 283__init__() (angr.state_plugins.SimInspector method),232__init__() (angr.state_plugins.SimJavaVmClassloader
method), 294__init__()(angr.state_plugins.SimLightRegisters
method), 249__init__() (angr.state_plugins.SimMemView method),276__init__() (angr.state_plugins.SimSolver method), 242__init__() (angr.state_plugins.SimStateCGC method),257__init__()(angr.state_plugins.SimStateGlobals
method), 269__init__()(angr.state_plugins.SimStateHistory
method), 251__init__() (angr.state_plugins.SimStateJNIReferences
method), 292__init__() (angr.state_plugins.SimStateLibc method),230__init__() (angr.state_plugins.SimStateLog method),250__init__()(angr.state_plugins.SimStateLoopData
method), 273__init__()(angr.state_plugins.SimStatePlugin
method), 226__init__() (angr.state_plugins.SimStatePreconstrainer
method), 271__init__()(angr.state_plugins.SimStateScratchmethod), 254__init__()(angr.state_plugins.SimSymbolizer
method), 296__init__()(angr.state_plugins.SimSystemPosix
method), 239__init__()(angr.state_plugins.SimUCManager
method), 259__init__() (angr.state_plugins.StructMode method),279__init__() (angr.state_plugins.Unicorn method), 260__init__()(angr.state_plugins.callstack.CallStackmethod), 329
1233

angr

__init__() (angr.state_plugins.callstack.CallStackAction
method), 362
method), 332__init__()(angr.state_plugins.libc.SimStateLibc__init__()(angr.state_plugins.cgc.SimStateCGC
method), 304
method), 337__init__() (angr.state_plugins.light_registers.SimLightRegisters__init__()(angr.state_plugins.concrete.Concrete
method), 332
method), 358__init__()(angr.state_plugins.log.SimStateLog__init__() (angr.state_plugins.debug_variables.SimDebugVariable method), 328
method), 380__init__() (angr.state_plugins.loop_data.SimStateLoopData__init__() (angr.state_plugins.filesystem.SimConcreteFilesystem method), 357
method), 317__init__() (angr.state_plugins.plugin.SimStatePlugin__init__() (angr.state_plugins.filesystem.SimFilesystem
method), 298
method), 315__init__() (angr.state_plugins.posix.SimSystemPosix__init__() (angr.state_plugins.filesystem.SimHostFilesystem
method), 311
method), 319__init__() (angr.state_plugins.preconstrainer.SimStatePreconstrainer__init__() (angr.state_plugins.gdb.GDB method), 336
method), 347__init__() (angr.state_plugins.globals.SimStateGlobals __init__() (angr.state_plugins.scratch.SimStateScratchmethod), 343
method), 346__init__()(angr.state_plugins.heap.PTChunk __init__() (angr.state_plugins.sim_action.SimAction
method), 369
method), 595__init__() (angr.state_plugins.heap.PTChunkIterator __init__() (angr.state_plugins.sim_action.SimActionConstraint
method), 370
method), 596__init__()(angr.state_plugins.heap.SimHeapBase __init__() (angr.state_plugins.sim_action.SimActionData
method), 363
method), 596__init__()(angr.state_plugins.heap.SimHeapBrk __init__() (angr.state_plugins.sim_action.SimActionExit
method), 364
method), 595__init__() (angr.state_plugins.heap.SimHeapPTMalloc __init__() (angr.state_plugins.sim_action.SimActionOperation
method), 367
method), 596__init__() (angr.state_plugins.heap.heap_base.SimHeapBase__init__() (angr.state_plugins.sim_action_object.SimActionObject
method), 371
method), 597__init__() (angr.state_plugins.heap.heap_brk.SimHeapBrk__init__()(angr.state_plugins.sim_event.SimEventmethod), 371
method), 598__init__() (angr.state_plugins.heap.heap_freelist.Chunk __init__()(angr.state_plugins.solver.SimSolver
method), 373
method), 320__init__() (angr.state_plugins.heap.heap_ptmalloc.PTChunk__init__() (angr.state_plugins.symbolizer.SimSymbolizer
method), 375
method), 380__init__() (angr.state_plugins.heap.heap_ptmalloc.PTChunkIterator__init__() (angr.state_plugins.trace_additions.ChallRespInfo
method), 377
method), 340__init__() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc__init__() (angr.state_plugins.trace_additions.FormatInfoDontConstrain
method), 377
method), 340__init__() (angr.state_plugins.history.LambdaAttrIter __init__() (angr.state_plugins.trace_additions.FormatInfoIntToStr
method), 336
method), 339__init__() (angr.state_plugins.history.LambdaIterIter __init__() (angr.state_plugins.trace_additions.FormatInfoStrToInt
method), 336
method), 339__init__() (angr.state_plugins.history.SimStateHistory __init__() (angr.state_plugins.trace_additions.ZenPlugin
method), 333
method), 342__init__()(angr.state_plugins.history.TreeIter __init__() (angr.state_plugins.uc_manager.SimUCManager
method), 336
method), 345__init__() (angr.state_plugins.inspect.BP method), __init__() (angr.state_plugins.unicorn_engine.AggressiveConcretizationA300
method), 354__init__() (angr.state_plugins.inspect.SimInspector __init__() (angr.state_plugins.unicorn_engine.Unicorn
method), 300
method), 354__init__() (angr.state_plugins.javavm_classloader.SimJavaVmClassloader__init__() (angr.state_plugins.unicorn_engine.Uniwrapper
method), 360
method), 354__init__() (angr.state_plugins.jni_references.SimStateJNIReferences__init__()(angr.state_plugins.view.SimMemView
1234

Index

angr

method), 387
method), 442__init__()(angr.state_plugins.view.StructMode __init__() (angr.storage.memory_mixins.RegionedMemoryMixin
method), 390
method), 437__init__() (angr.storage.SimFile method), 382__init__() (angr.storage.memory_mixins.SizeConcretizationMixin__init__() (angr.storage.SimMemoryObject method),
method), 421
384__init__() (angr.storage.memory_mixins.SlottedMemoryMixin__init__() (angr.storage.file.SimFile method), 393
method), 436__init__() (angr.storage.file.SimFileBase method), 392 __init__() (angr.storage.memory_mixins.SpecialFillerMixin__init__()(angr.storage.file.SimFileDescriptor
method), 418
method), 403__init__() (angr.storage.memory_mixins.StackAllocationMixin__init__() (angr.storage.file.SimFileDescriptorDuplex
method), 427
method), 405__init__() (angr.storage.memory_mixins.TopMergerMixin__init__() (angr.storage.file.SimFileStream method),
method), 421
395__init__()(angr.storage.memory_mixins.UltraPage__init__() (angr.storage.file.SimPackets method), 397
method), 434__init__() (angr.storage.file.SimPacketsSlots method), __init__() (angr.storage.memory_mixins.UnderconstrainedMixin408
method), 422__init__()(angr.storage.file.SimPacketsStream __init__() (angr.storage.memory_mixins.address_concretization_mixin.A
method), 399
method), 451__init__() (angr.storage.memory_mixins.AddressConcretizationMixin__init__() (angr.storage.memory_mixins.convenient_mappings_mixin.Co
method), 415
method), 454__init__() (angr.storage.memory_mixins.ClemoryBackerMixin__init__() (angr.storage.memory_mixins.default_filler_mixin.ExplicitFille
method), 423
method), 447__init__() (angr.storage.memory_mixins.ConvenientMappingsMixin__init__() (angr.storage.memory_mixins.default_filler_mixin.SpecialFille
method), 417
method), 447__init__() (angr.storage.memory_mixins.DictBackerMixin__init__() (angr.storage.memory_mixins.label_merger_mixin.LabelMerg
method), 423
method), 453__init__() (angr.storage.memory_mixins.ExplicitFillerMixin__init__() (angr.storage.memory_mixins.multi_value_merger_mixin.Mult
method), 418
method), 459__init__() (angr.storage.memory_mixins.HistoryTrackingMixin__init__() (angr.storage.memory_mixins.paged_memory.page_backer_m
method), 430
method), 464__init__() (angr.storage.memory_mixins.JavaVmMemoryMixin__init__() (angr.storage.memory_mixins.paged_memory.page_backer_m
method), 443
method), 464__init__() (angr.storage.memory_mixins.KeyValueMemoryMixin__init__() (angr.storage.memory_mixins.paged_memory.page_backer_m
method), 443
method), 463__init__() (angr.storage.memory_mixins.LabelMergerMixin__init__() (angr.storage.memory_mixins.paged_memory.paged_memory_
method), 419
method), 463__init__()(angr.storage.memory_mixins.ListPage __init__() (angr.storage.memory_mixins.paged_memory.paged_memory_
method), 431
method), 460__init__() (angr.storage.memory_mixins.MVListPage __init__() (angr.storage.memory_mixins.paged_memory.pages.HistoryTr
method), 432
method), 467__init__() (angr.storage.memory_mixins.MVListPagesMixin__init__() (angr.storage.memory_mixins.paged_memory.pages.ListPage
method), 427
method), 468__init__() (angr.storage.memory_mixins.MemoryRegionMetaMixin__init__() (angr.storage.memory_mixins.paged_memory.pages.MVListPa
method), 440
method), 470__init__() (angr.storage.memory_mixins.MultiValueMergerMixin__init__() (angr.storage.memory_mixins.paged_memory.pages.Permissio
method), 419
method), 467__init__() (angr.storage.memory_mixins.PagedMemoryMixin__init__() (angr.storage.memory_mixins.paged_memory.pages.RefcountM
method), 424
method), 466__init__() (angr.storage.memory_mixins.PermissionsMixin__init__() (angr.storage.memory_mixins.paged_memory.pages.UltraPage
method), 429
method), 471__init__() (angr.storage.memory_mixins.RefcountMixin __init__() (angr.storage.memory_mixins.paged_memory.pages.history_tr
method), 428
method), 474__init__() (angr.storage.memory_mixins.RegionedAddressConcretizationMixin__init__() (angr.storage.memory_mixins.paged_memory.pages.list_page.
Index

1235

angr

method), 476
method), 1190__init__() (angr.storage.memory_mixins.paged_memory.pages.multi_values.MultiValues__init__() (angr.utils.graph.ContainerNode method),
method), 457
1192__init__() (angr.storage.memory_mixins.paged_memory.pages.mv_list_page.MVListPage__init__() (angr.utils.graph.Dominators method),
method), 455
1193__init__() (angr.storage.memory_mixins.paged_memory.pages.permissions_mixin.PermissionsMixin__init__() (angr.utils.graph.PostDominators method),
method), 474
1193__init__() (angr.storage.memory_mixins.paged_memory.pages.refcount_mixin.RefcountMixin__init__() (angr.utils.graph.SCCPlaceholder method),
method), 473
1193__init__() (angr.storage.memory_mixins.paged_memory.pages.ultra_page.UltraPage__init__() (angr.utils.graph.TemporaryNode method),
method), 477
1192__init__() (angr.storage.memory_mixins.paged_memory.stack_allocation_mixin.StackAllocationMixin__init__() (angr.utils.mp.Initializer method), 1198
method), 465__init__() (angr.vaults.Vault method), 785__init__() (angr.storage.memory_mixins.regioned_memory.MemoryRegionMetaMixin__init__() (angr.vaults.VaultDict method), 785
method), 482__init__() (angr.vaults.VaultDir method), 785__init__() (angr.storage.memory_mixins.regioned_memory.RegionedAddressConcretizationMixin__init__() (angr.vaults.VaultDirShelf method), 786
method), 484__init__() (angr.vaults.VaultPickler method), 784__init__() (angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin__init__() (angr.vaults.VaultShelf method), 786
method), 479__init__() (angr.vaults.VaultUnpickler method), 785__init__() (angr.storage.memory_mixins.regioned_memory.abstract_address_descriptor.AbstractAddressDescriptor
A
method), 490__init__() (angr.storage.memory_mixins.regioned_memory.region_data.AddressWrapper
abort() (angr.analyses.forward_analysis.forward_analysis.ForwardAnalys
method), 488
method), 839__init__() (angr.storage.memory_mixins.regioned_memory.region_data.RegionDescriptor
abort() (angr.analyses.forward_analysis.ForwardAnalysis
method), 488
method), 835__init__() (angr.storage.memory_mixins.regioned_memory.region_data.RegionMap
abort() (angr.analyses.ForwardAnalysis method), 787
method), 489
absolutize() (angr.storage.memory_mixins.regioned_memory.region_dat__init__() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.AbstractLocation
method), 489
method), 491
absorb()(angr.sim_manager.SimulationManager__init__() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.MemoryRegionMetaMixin
method), 503
method), 491
absorb() (angr.SimulationManager method), 171__init__() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.Segment
abstract() (angr.analyses.typehoon.simple_solver.SimpleSolver
method), 490
static method), 1120__init__() (angr.storage.memory_mixins.regioned_memory.regioned_address_concretization_mixin.RegionedAddressConcretizationM
AbstractAddressDescriptor(classinmethod), 493
angr.storage.memory_mixins.regioned_memory.abstract_address___init__() (angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin490
method), 485
AbstractLocation(classin__init__() (angr.storage.memory_mixins.size_resolution_mixin.SizeConcretizationMixin
angr.storage.memory_mixins.regioned_memory.region_meta_mix
method), 450
490__init__() (angr.storage.memory_mixins.slotted_memory.SlottedMemoryMixin
AbstractMemory(classinmethod), 494
angr.storage.memory_mixins), 446__init__() (angr.storage.memory_mixins.top_merger_mixin.TopMergerMixin
AbstractMergerMixin(classinmethod), 458
angr.storage.memory_mixins), 440__init__() (angr.storage.memory_mixins.underconstrained_mixin.UnderconstrainedMixin
AbstractMergerMixin(classinmethod), 449
angr.storage.memory_mixins.regioned_memory),__init__() (angr.storage.memory_object.SimLabeledMemoryObject482
method), 410
AbstractMergerMixin(classin__init__() (angr.storage.memory_object.SimMemoryObject
angr.storage.memory_mixins.regioned_memory.abstract_merger_
method), 410
492__init__()(angr.utils.cowdict.ChainMapCOW access_type (angr.knowledge_plugins.variables.variable_access.Variable
method), 1189
attribute), 727__init__() (angr.utils.cowdict.DefaultChainMapCOW accessed_data_references
method), 1190
(angr.knowledge_plugins.cfg.cfg_node.CFGNode__init__() (angr.utils.dynamic_dictlist.DynamicDictList
property), 698
1236

Index

angr

accessed_data_references
erty), 1206
(angr.knowledge_plugins.cfg.CFGNode prop- active_workers (angr.Server property), 206erty), 679
Add (angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransform
AccessingZeroPageError, 353
attribute), 899
acquire_shared() (angr.storage.memory_mixins.paged_memory.pages.refcount_mixin.RefcountMixin
Add (angr.engines.light.ArithmeticExpression attribute),
method), 474
1031
acquire_shared() (angr.storage.memory_mixins.paged_memory.pages.RefcountMixin
Add(angr.engines.light.data.ArithmeticExpression
method), 466
attribute), 1030
acquire_shared() (angr.storage.memory_mixins.RefcountMixin
Add (class in angr.analyses.typehoon.typevars), 1123
method), 429
add() (angr.exploration_techniques.spiller.PickledStatesBase
acquire_unique() (angr.storage.memory_mixins.HistoryTrackingMixin
method), 527
method), 430
add() (angr.exploration_techniques.spiller.PickledStatesDb
acquire_unique() (angr.storage.memory_mixins.paged_memory.pages.history_tracking_mixin.HistoryTrackingMixin
method), 528
method), 475
add() (angr.exploration_techniques.spiller.PickledStatesList
acquire_unique() (angr.storage.memory_mixins.paged_memory.pages.HistoryTrackingMixin
method), 527
method), 467
add() (angr.procedures.definitions.SimLibrary method),acquire_unique() (angr.storage.memory_mixins.paged_memory.pages.refcount_mixin.RefcountMixin607
method), 474
add() (angr.procedures.definitions.SimTypeCollection
acquire_unique() (angr.storage.memory_mixins.paged_memory.pages.RefcountMixin
method), 605
method), 466
add() (angr.sim_state_options.SimStateOptions method),acquire_unique() (angr.storage.memory_mixins.RefcountMixin 225
method), 429
add() (angr.sim_variable.SimVariableSet method), 638
action()(angr.state_plugins.inspect.SimInspector add() (angr.state_plugins.SimSolver method), 247
method), 300
add() (angr.state_plugins.solver.SimSolver method), 325
action() (angr.state_plugins.SimInspector method), 232 add_action() (angr.state_plugins.history.SimStateHistory
actions(angr.state_plugins.history.SimStateHistory
method), 335
property), 335
add_action()(angr.state_plugins.log.SimStateLog
actions (angr.state_plugins.log.SimStateLog property),
method), 328
328
add_action()(angr.state_plugins.SimStateHistory
actions (angr.state_plugins.SimStateHistory property),
method), 253254
add_action()(angr.state_plugins.SimStateLog
actions (angr.state_plugins.SimStateLog property), 250
method), 250
actions_of_type() (angr.state_plugins.log.SimStateLog add_alias() (angr.procedures.definitions.SimLibrarymethod), 328
method), 607
actions_of_type() (angr.state_plugins.SimStateLog add_all_from_dict()
method), 250(angr.procedures.definitions.SimLibrary
ActionsMixinHigh(classinmethod), 607
angr.storage.memory_mixins), 414
add_block_to_whitelist()
ActionsMixinHigh(classin(angr.annocfg.AnnotatedCFG method), 1169
angr.storage.memory_mixins.actions_mixin),
add_breakpoint() (angr.state_plugins.inspect.SimInspector449
method), 301
ActionsMixinLow(classin add_breakpoint() (angr.state_plugins.SimInspector
angr.storage.memory_mixins), 414
method), 232
ActionsMixinLow(classin add_constraint() (angr.analyses.typehoon.simple_solver.Sketch
angr.storage.memory_mixins.actions_mixin),
method), 1118449
add_constraints() (angr.sim_state.SimState method),
activate() (angr.misc.plugins.PluginPreset method),222219
add_constraints() (angr.SimState method), 178
active (angr.sim_manager.SimulationManager at- add_data_seg() (angr.analyses.cfg.cfg_fast.DecodingAssumption
tribute), 499
method), 885
active (angr.SimulationManager attribute), 168
add_def() (angr.analyses.ddg.LiveDefinitions method),
active_workers (angr.distributed.Server property),
1025
1205
add_def() (angr.analyses.reaching_definitions.ReachingDefinitionsModel
active_workers (angr.distributed.server.Server propmethod), 1057
Index

1237

angr

add_def() (angr.knowledge_plugins.key_definitions.rd_model.ReachingDefinitionsModel
add_heap_use_by_def()
method), 770(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
add_def() (angr.knowledge_plugins.key_definitions.ReachingDefinitionsModel
method), 768
method), 737
add_heap_use_by_def()
add_default_plugin()(angr.knowledge_plugins.key_definitions.LiveDefinitions(angr.misc.plugins.PluginPreset
method),method), 746219
add_heap_use_by_defs()
add_defs()(angr.analyses.ddg.LiveDefinitions(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsS
method), 1026
method), 1096
add_dependencies_for_concrete_pointers_of() add_heap_use_by_defs()(angr.analyses.reaching_definitions.dep_graph.DepGraph (angr.analyses.reaching_definitions.ReachingDefinitionsState
method), 1080
method), 1065
add_edge() (angr.analyses.reaching_definitions.dep_graph.DepGraph
add_history() (angr.state_hierarchy.StateHierarchy
method), 1079
method), 506
add_edge() (angr.analyses.typehoon.simple_solver.Sketch add_history() (angr.StateHierarchy method), 176
method), 1118
add_job()(angr.analyses.cfg.cfg_fast.PendingJobs
add_edge_to_buffer()(inmodulemethod), 885
angr.utils.formatting), 1197
add_job() (angr.analyses.forward_analysis.job_info.JobInfo
add_event() (angr.state_plugins.history.SimStateHistory
method), 840
method), 335
add_jumpout_site() (angr.knowledge_plugins.Function
add_event()(angr.state_plugins.log.SimStateLog
method), 661
method), 328
add_jumpout_site() (angr.knowledge_plugins.functions.Function
add_event()(angr.state_plugins.SimStateHistory
method), 709
method), 253
add_jumpout_site() (angr.knowledge_plugins.functions.function.Functio
add_event() (angr.state_plugins.SimStateLog method),
method), 720
250
add_label() (angr.analyses.Reassembler method), 812
add_exit_to_whitelist()
add_label() (angr.analyses.reassembler.Reassembler(angr.annocfg.AnnotatedCFG method), 1169
method), 1151
add_final_job()(angr.analyses.vfg.CallAnalysis add_labels()(inmodulemethod), 1136
angr.analyses.decompiler.utils), 1022
add_function()(angr.analyses.cfg.cfb.CFBlanket add_loop() (angr.annocfg.AnnotatedCFG method),
method), 8741169
add_function()(angr.analyses.cfg.CFBlanket add_loop_exit_stmt()
method), 868(angr.analyses.loop_analysis.LoopAnalysisState
add_function_edge()
method), 1132
(angr.analyses.cfg.cfg_fast.CFGJob method), add_mapping() (angr.analyses.decompiler.structured_codegen.base.Instru
889
method), 1002
add_goal()(angr.exploration_techniques.Director add_mapping() (angr.analyses.decompiler.structured_codegen.base.Positio
method), 516
method), 1001
add_goal() (angr.exploration_techniques.director.Directoradd_mapping() (angr.analyses.decompiler.structured_codegen.Instruction
method), 537
method), 997
add_heap_use() (angr.analyses.reaching_definitions.LiveDefinitions
add_mapping() (angr.analyses.decompiler.structured_codegen.PositionMa
method), 1047
method), 998
add_heap_use() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
add_memory_data() (angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 1096
method), 693
add_heap_use() (angr.analyses.reaching_definitions.ReachingDefinitionsState
add_memory_data() (angr.knowledge_plugins.cfg.CFGModel
method), 1065
method), 686
add_heap_use() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
add_memory_use() (angr.analyses.reaching_definitions.LiveDefinitions
method), 768
method), 1047
add_heap_use() (angr.knowledge_plugins.key_definitions.LiveDefinitions
add_memory_use() (angr.knowledge_plugins.key_definitions.live_definitio
method), 746
method), 768
add_heap_use_by_def()
add_memory_use() (angr.knowledge_plugins.key_definitions.LiveDefinitio(angr.analyses.reaching_definitions.LiveDefinitions
method), 746
method), 1047
add_memory_use_by_def()
1238

Index

angr

(angr.analyses.reaching_definitions.LiveDefinitions
add_patch_obj() (angr.knowledge_plugins.patches.PatchManager
method), 1047
method), 674
add_memory_use_by_def()
add_patch_obj() (angr.knowledge_plugins.PatchManager(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
method), 669
method), 1096
add_regioned_address()
add_memory_use_by_def()(angr.storage.memory_mixins.regioned_memory.abstract_address(angr.analyses.reaching_definitions.ReachingDefinitionsState
method), 490
method), 1065
add_register_use() (angr.analyses.reaching_definitions.LiveDefinitions
add_memory_use_by_def()
method), 1046
(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
add_register_use() (angr.analyses.reaching_definitions.rd_state.Reachi
method), 768
method), 1095
add_memory_use_by_def()
add_register_use() (angr.analyses.reaching_definitions.ReachingDefini(angr.knowledge_plugins.key_definitions.LiveDefinitions method), 1064
method), 746
add_register_use() (angr.knowledge_plugins.key_definitions.live_defini
add_memory_use_by_defs()
method), 767(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
add_register_use() (angr.knowledge_plugins.key_definitions.LiveDefini
method), 1096
method), 745
add_memory_use_by_defs()
add_register_use_by_def()(angr.analyses.reaching_definitions.ReachingDefinitionsState(angr.analyses.reaching_definitions.LiveDefinitions
method), 1065
method), 1046
add_memory_variable()
add_register_use_by_def()(angr.sim_variable.SimVariableSet method),(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
638
method), 767
add_memory_variables()
add_register_use_by_def()(angr.sim_variable.SimVariableSet method),(angr.knowledge_plugins.key_definitions.LiveDefinitions
638
method), 745
add_node() (angr.analyses.decompiler.structuring.structurer_nodes.SequenceNode
add_register_use_by_defs()
method), 934(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsS
add_node() (angr.analyses.reaching_definitions.dep_graph.DepGraphmethod), 1095
method), 1079
add_register_use_by_defs()
add_node() (angr.knowledge_plugins.cfg.cfg_model.CFGModel(angr.analyses.reaching_definitions.ReachingDefinitionsState
method), 689
method), 1064
add_node() (angr.knowledge_plugins.cfg.CFGModel add_register_variable()method), 683(angr.sim_variable.SimVariableSet method),
add_nonreturning_function()638(angr.analyses.cfg.cfg_fast.PendingJobs
add_retout_site() (angr.knowledge_plugins.Function
method), 886
method), 661
add_number_mapping()
add_retout_site() (angr.knowledge_plugins.functions.Function(angr.procedures.definitions.SimSyscallLibrarymethod), 709
method), 611
add_retout_site() (angr.knowledge_plugins.functions.function.Function
add_number_mapping_from_dict()
method), 721(angr.procedures.definitions.SimSyscallLibrary add_returning_function()
method), 611(angr.analyses.cfg.cfg_fast.PendingJobs
add_obj() (angr.analyses.cfg.cfb.CFBlanket method),
method), 886874
add_sinkhole() (angr.state_plugins.cgc.SimStateCGC
add_obj() (angr.analyses.cfg.CFBlanket method), 867
method), 339
add_object()(angr.keyed_region.KeyedRegion add_sinkhole()(angr.state_plugins.SimStateCGC
method), 782
method), 258
add_object()(angr.keyed_region.RegionObject add_stack_use() (angr.analyses.reaching_definitions.LiveDefinitions
method), 781
method), 1047
add_patch() (angr.knowledge_plugins.patches.PatchManager
add_stack_use() (angr.analyses.reaching_definitions.rd_state.ReachingD
method), 674
method), 1095
add_patch() (angr.knowledge_plugins.PatchManager add_stack_use() (angr.analyses.reaching_definitions.ReachingDefinition
method), 669
method), 1065
Index

1239

angr

add_stack_use() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 1101
method), 768
add_transitions() (angr.analyses.cfg_slice_to_sink.CFGSliceToSink
add_stack_use() (angr.knowledge_plugins.key_definitions.LiveDefinitions
method), 1099
method), 746
add_type_constraint()
add_stack_use_by_def()(angr.analyses.variable_recovery.variable_recovery_base.Variabl(angr.analyses.reaching_definitions.LiveDefinitions
method), 1109
method), 1047
add_type_constraint_for_function()
add_stack_use_by_def()(angr.analyses.variable_recovery.variable_recovery_base.Variabl(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 1110
method), 768
add_type_variable()
add_stack_use_by_def()(angr.analyses.typehoon.typevars.TypeVariables(angr.knowledge_plugins.key_definitions.LiveDefinitions method), 1125
method), 746
add_use() (angr.analyses.reaching_definitions.LiveDefinitions
add_stack_use_by_defs()
method), 1044
(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
add_use() (angr.analyses.reaching_definitions.rd_state.ReachingDefinition
method), 1096
method), 1094
add_stack_use_by_defs()
add_use() (angr.analyses.reaching_definitions.ReachingDefinitionsState(angr.analyses.reaching_definitions.ReachingDefinitionsState
method), 1064
method), 1065
add_use() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDe
add_state()(angr.state_hierarchy.StateHierarchy
method), 765
method), 506
add_use() (angr.knowledge_plugins.key_definitions.LiveDefinitions
add_state() (angr.StateHierarchy method), 176
method), 743
add_statements_to_whitelist()
add_use() (angr.knowledge_plugins.key_definitions.Uses(angr.annocfg.AnnotatedCFG method), 1169
method), 748
add_successor()(angr.engines.SimSuccessors add_use() (angr.knowledge_plugins.key_definitions.uses.Uses
method), 544
method), 774
add_successor() (angr.engines.successors.SimSuccessorsadd_use_by_def() (angr.analyses.reaching_definitions.LiveDefinitions
method), 553
method), 1044
add_tmp_use() (angr.analyses.reaching_definitions.LiveDefinitions
add_use_by_def() (angr.analyses.reaching_definitions.rd_state.Reaching
method), 1048
method), 1094
add_tmp_use() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
add_use_by_def() (angr.analyses.reaching_definitions.ReachingDefinitio
method), 1095
method), 1064
add_tmp_use() (angr.analyses.reaching_definitions.ReachingDefinitionsState
add_use_by_def() (angr.knowledge_plugins.key_definitions.live_definitio
method), 1064
method), 765
add_tmp_use() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
add_use_by_def() (angr.knowledge_plugins.key_definitions.LiveDefinitio
method), 769
method), 743
add_tmp_use() (angr.knowledge_plugins.key_definitions.LiveDefinitions
add_value() (angr.storage.memory_mixins.paged_memory.pages.multi_va
method), 747
method), 457
add_tmp_use_by_def()
add_variable()(angr.keyed_region.KeyedRegion(angr.analyses.reaching_definitions.LiveDefinitions
method), 782
method), 1048
add_variable() (angr.knowledge_plugins.debug_variables.DebugVariabl
add_tmp_use_by_def()
method), 736(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
add_variable() (angr.knowledge_plugins.DebugVariableManager
method), 769
method), 666
add_tmp_use_by_def()
add_variable() (angr.knowledge_plugins.variables.variable_manager.Va(angr.knowledge_plugins.key_definitions.LiveDefinitions method), 728
method), 747
add_variable_list()
add_tmp_use_by_defs()(angr.knowledge_plugins.debug_variables.DebugVariableManage(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
method), 736
method), 1095
add_variable_list()
add_tmp_use_by_defs()(angr.knowledge_plugins.DebugVariableManager(angr.analyses.reaching_definitions.ReachingDefinitionsState
method), 666
method), 1064
add_xref() (angr.analyses.xrefs.SimEngineXRefsVEX
add_transitions() (angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceToSink
method), 1156
1240

Index

angr

add_xref()(angr.knowledge_plugins.XRefManager addr (angr.angrdb.models.DbFunction attribute), 921
method), 668
addr (angr.angrdb.models.DbLabel attribute), 923
add_xref() (angr.knowledge_plugins.xrefs.xref_manager.XRefManager
addr (angr.Block attribute), 166
method), 779
addr (angr.block.Block attribute), 217
add_xref() (angr.knowledge_plugins.xrefs.XRefManager addr (angr.block.DisassemblerBlock attribute), 215
method), 777
addr (angr.codenode.CodeNode attribute), 1170
add_xrefs() (angr.knowledge_plugins.XRefManager addr (angr.engines.pcode.lifter.IRSB attribute), 565
method), 668
addr (angr.engines.pcode.lifter.Lifter attribute), 568
add_xrefs() (angr.knowledge_plugins.xrefs.xref_manager.XRefManager
addr (angr.engines.pcode.lifter.PcodeDisassemblerBlockmethod), 779
attribute), 563
add_xrefs() (angr.knowledge_plugins.xrefs.XRefManager addr (angr.engines.pcode.lifter.PcodeLifter attribute),
method), 777
570
AddN (class in angr.analyses.typehoon.typevars), 1125
addr (angr.knowledge_plugins.cfg.cfg_node.CFGNodeaddr (angr.analyses.cfg.cfg_fast.CFGJob attribute), 889
attribute), 697
addr (angr.analyses.decompiler.decompilation_cache.DecompilationCache
addr (angr.knowledge_plugins.cfg.CFGNode attribute),
attribute), 955
678
addr (angr.analyses.decompiler.graph_region.GraphRegionaddr (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump
property), 960
attribute), 701
addr (angr.analyses.decompiler.structured_codegen.c.CFunction
addr (angr.knowledge_plugins.cfg.IndirectJump atattribute), 1004
tribute), 681
addr (angr.analyses.decompiler.structuring.structurer_nodes.BaseNodeaddr (angr.knowledge_plugins.cfg.memory_data.MemoryData
attribute), 933
attribute), 695
addr (angr.analyses.decompiler.structuring.structurer_nodes.BreakNode
addr (angr.knowledge_plugins.cfg.MemoryData atattribute), 936
tribute), 677
addr (angr.analyses.decompiler.structuring.structurer_nodes.CascadingConditionNodeaddr (angr.knowledge_plugins.Function attribute), 658
attribute), 935
addr (angr.knowledge_plugins.functions.Function ataddr (angr.analyses.decompiler.structuring.structurer_nodes.CodeNodetribute), 705
property), 934
addr (angr.knowledge_plugins.functions.function.Function
addr (angr.analyses.decompiler.structuring.structurer_nodes.ConditionNode
attribute), 717
attribute), 934
addr (angr.knowledge_plugins.functions.soot_function.SootFunction
addr (angr.analyses.decompiler.structuring.structurer_nodes.ContinueNodeattribute), 725
attribute), 936
addr (angr.knowledge_plugins.key_definitions.atoms.MemoryLocation
addr (angr.analyses.decompiler.structuring.structurer_nodes.IncompleteSwitchCaseHeadStatement
attribute), 755
attribute), 938
addr (angr.sim_state.SimState property), 221
addr (angr.analyses.decompiler.structuring.structurer_nodes.IncompleteSwitchCaseNodeaddr (angr.sim_variable.SimMemoryVariable attribute),
attribute), 937
636
addr (angr.analyses.decompiler.structuring.structurer_nodes.LoopNode
addr (angr.SimState property), 178
property), 936
addr (angr.state_plugins.history.SimStateHistory propaddr (angr.analyses.decompiler.structuring.structurer_nodes.MultiNodeerty), 333
attribute), 933
addr (angr.state_plugins.SimStateHistory property), 252
addr (angr.analyses.decompiler.structuring.structurer_nodes.SequenceNode
addr_and_variables (angr.analyses.variable_recovery.variable_recovery
attribute), 934
attribute), 1107
addr (angr.analyses.decompiler.structuring.structurer_nodes.SwitchCaseNode
addr_invalid() (angr.state_plugins.cgc.SimStateCGC
attribute), 937
method), 338
addr (angr.analyses.disassembly.DisassemblyPiece at- addr_invalid()(angr.state_plugins.SimStateCGC
tribute), 1141
method), 257
addr (angr.analyses.disassembly.IROp attribute), 1142
addr_to_instruction_addr()
addr (angr.analyses.disassembly.OperandPiece at(angr.knowledge_plugins.Function
method),tribute), 1143
663
addr (angr.analyses.propagator.vex_vars.VEXMemVar addr_to_instruction_addr()
attribute), 1035
(angr.knowledge_plugins.functions.Function
addr (angr.analyses.reaching_definitions.MemoryLocation
method), 711
attribute), 1052
addr_to_instruction_addr()
addr (angr.angrdb.models.DbComment attribute), 922(angr.knowledge_plugins.functions.function.Function
Index

1241

angr

method), 722(angr.analyses.decompiler.optimization_passes.optimization_pass
address (angr.analyses.reaching_definitions.function_handler.FunctionCallData
attribute), 975
attribute), 1085
AFTER_AIL_GRAPH_CREATION
address (angr.analyses.reaching_definitions.FunctionCallData(angr.analyses.decompiler.optimization_passes.OptimizationPassS
attribute), 1070
attribute), 960
address (angr.block.CapstoneInsn property), 216
AFTER_GLOBAL_SIMPLIFICATION
address (angr.block.DisassemblerInsn property), 216(angr.analyses.decompiler.optimization_passes.optimization_pass
address (angr.engines.pcode.lifter.PcodeDisassemblerInsn
attribute), 975
property), 563
AFTER_GLOBAL_SIMPLIFICATION
address (angr.knowledge_plugins.cfg.memory_data.MemoryData (angr.analyses.decompiler.optimization_passes.OptimizationPassS
property), 696
attribute), 960
address(angr.knowledge_plugins.cfg.MemoryData AFTER_MAKING_CALLSITES
property), 677(angr.analyses.decompiler.optimization_passes.optimization_pass
address (angr.state_plugins.unicorn_engine.MEM_PATCH
attribute), 975
attribute), 349
AFTER_MAKING_CALLSITES
address (angr.state_plugins.unicorn_engine.MemoryValue(angr.analyses.decompiler.optimization_passes.OptimizationPassS
attribute), 350
attribute), 960
address (angr.storage.memory_mixins.regioned_memory.region_data.AddressWrapper
AFTER_SINGLE_BLOCK_SIMPLIFICATION
attribute), 488(angr.analyses.decompiler.optimization_passes.optimization_pass
address_multi (angr.analyses.reaching_definitions.function_handler.FunctionCallData
attribute), 975
attribute), 1085
AFTER_SINGLE_BLOCK_SIMPLIFICATION
address_multi (angr.analyses.reaching_definitions.function_handler.FunctionCallDataUnwrapped(angr.analyses.decompiler.optimization_passes.OptimizationPassS
attribute), 1087
attribute), 960
address_multi (angr.analyses.reaching_definitions.FunctionCallData
AFTER_STRUCTURING (angr.analyses.decompiler.optimization_passes.optim
attribute), 1070
attribute), 975
AddressConcretizationMixin(classin AFTER_STRUCTURING (angr.analyses.decompiler.optimization_passes.Optim
angr.storage.memory_mixins), 415
attribute), 961
AddressConcretizationMixin(classin AFTER_VARIABLE_RECOVERY
angr.storage.memory_mixins.address_concretization_mixin),(angr.analyses.decompiler.optimization_passes.optimization_pass451
attribute), 975
AddressOperand(classin AFTER_VARIABLE_RECOVERY
angr.analyses.cfg.indirect_jump_resolvers.jumptable),(angr.analyses.decompiler.optimization_passes.OptimizationPassS
899
attribute), 961
AddressTransformation(classin AggressiveConcretizationAnnotation (class inangr.analyses.cfg.indirect_jump_resolvers.jumptable),angr.state_plugins.unicorn_engine), 354
899
AILBlockTempCollector(classin
AddressTransformationTypes(classinangr.analyses.decompiler.ail_simplifier),
angr.analyses.cfg.indirect_jump_resolvers.jumptable),
948
899
AILGraphWalker(classin
AddressWrapper(classinangr.analyses.decompiler.ailgraph_walker),angr.storage.memory_mixins.regioned_memory.region_data),
949
487
AILSimplifier (class in angr.analyses.decompiler), 946
addrs_for_hash() (angr.storage.memory_mixins.convenient_mappings_mixin.ConvenientMappingsMixin
AILSimplifier(classinmethod), 455
angr.analyses.decompiler.ail_simplifier),addrs_for_hash() (angr.storage.memory_mixins.ConvenientMappingsMixin948
method), 417
Alignment (angr.knowledge_plugins.cfg.memory_data.MemoryDataSort
addrs_for_name() (angr.storage.memory_mixins.convenient_mappings_mixin.ConvenientMappingsMixin
attribute), 695
method), 455
Alignment (angr.knowledge_plugins.cfg.MemoryDataSort
addrs_for_name() (angr.storage.memory_mixins.ConvenientMappingsMixin
attribute), 676
method), 417
alignment (angr.knowledge_plugins.Function property),
ADDS_EXITS (angr.sim_procedure.SimProcedure at658
tribute), 601
alignment (angr.knowledge_plugins.functions.Function
ADDS_EXITS (angr.SimProcedure attribute), 149
property), 706
AFTER_AIL_GRAPH_CREATIONalignment (angr.knowledge_plugins.functions.function.Function
1242

Index

angr

property), 718
property), 264
alignment (angr.sim_type.SimStruct property), 649
all_stashes (angr.analyses.Veritesting attribute), 808
alignment (angr.sim_type.SimType property), 638
all_stashes (angr.analyses.veritesting.Veritesting atalignment (angr.sim_type.SimTypeArray property), 645
tribute), 1133
alignment (angr.sim_type.SimTypeDouble property), all_successors() (angr.analyses.forward_analysis.visitors.graph.GraphV648
method), 846
alignment (angr.sim_type.SimTypeString property), 645 all_successors() (angr.state_hierarchy.StateHierarchyalignment (angr.sim_type.SimTypeWString property),
method), 506646
all_successors() (angr.StateHierarchy method), 176alignment (angr.sim_type.SimUnion property), 650
ALL_TABLES (angr.angrdb.AngrDB attribute), 916
alignment (angr.sim_type.TypeRef property), 639
ALL_TABLES (angr.angrdb.db.AngrDB attribute), 918
ALL (angr.sim_manager.SimulationManager attribute), all_uses (angr.analyses.reaching_definitions.reaching_definitions.Reachin499
property), 1077
ALL (angr.SimulationManager attribute), 167
all_uses (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
all_bytes_changed_in_history()
property), 1056
(angr.storage.memory_mixins.HistoryTrackingMixin
all_uses (angr.analyses.ReachingDefinitionsAnalysis
method), 430
property), 819
all_bytes_changed_in_history()
alloc()(angr.calling_conventions.AllocHelper(angr.storage.memory_mixins.paged_memory.pages.history_tracking_mixin.HistoryTrackingMixin
method), 614
method), 475
allocate() (angr.analyses.reaching_definitions.heap_allocator.HeapAlloc
all_bytes_changed_in_history()method), 1082
(angr.storage.memory_mixins.paged_memory.pages.HistoryTrackingMixin
allocate()(angr.knowledge_plugins.CustomStrings
method), 467
method), 673
all_constants (angr.engines.pcode.lifter.IRSB prop- allocate() (angr.SimHeapBrk method), 200erty), 567
allocate() (angr.state_plugins.heap.heap_brk.SimHeapBrk
all_definitions (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
method), 372
attribute), 1091
allocate()(angr.state_plugins.heap.SimHeapBrk
all_definitions (angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
method), 364
property), 1077
allocate() (angr.state_plugins.SimHeapBrk method),
all_definitions (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
285
property), 1056
allocate_stack_pages()
all_definitions (angr.analyses.reaching_definitions.ReachingDefinitionsState(angr.storage.memory_mixins.paged_memory.stack_allocation_m
attribute), 1061
method), 465
all_definitions (angr.analyses.ReachingDefinitionsAnalysis
allocate_stack_pages()
property), 819(angr.storage.memory_mixins.StackAllocationMixin
all_objects (angr.state_plugins.sim_action.SimAction
method), 428
property), 595
allocated_addresses
all_objects (angr.state_plugins.sim_action.SimActionConstraint (angr.analyses.reaching_definitions.heap_allocator.HeapAllocato
property), 596
property), 1082
all_objects (angr.state_plugins.sim_action.SimActionData
allocated_chunks()(angr.SimHeapPTMalloc
property), 596
method), 202
all_objects (angr.state_plugins.sim_action.SimActionExitallocated_chunks() (angr.state_plugins.heap.heap_freelist.SimHeapFree
property), 595
method), 374
all_objects (angr.state_plugins.sim_action.SimActionOperation
allocated_chunks() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPT
property), 596
method), 377
all_objects (angr.state_plugins.SimAction property), allocated_chunks() (angr.state_plugins.heap.SimHeapPTMalloc
263
method), 367
all_objects (angr.state_plugins.SimActionConstraint allocated_chunks() (angr.state_plugins.SimHeapPTMalloc
property), 263
method), 287
all_objects (angr.state_plugins.SimActionData prop- AllocHelper (class in angr.calling_conventions), 613erty), 264
allow_arch_optimizations
all_objects (angr.state_plugins.SimActionExit prop(angr.engines.pcode.lifter.Lifter
attribute),erty), 263568
all_objects (angr.state_plugins.SimActionOperation allow_arch_optimizations
Index

1243

angr

(angr.engines.pcode.lifter.PcodeLifter
at- And (angr.engines.light.ArithmeticExpression attribute),
tribute), 570
1031
ALT_NAMES (angr.sim_procedure.SimProcedure at- And(angr.engines.light.data.ArithmeticExpression
tribute), 602
attribute), 1030
ALT_NAMES (angr.SimProcedure attribute), 149
angr
ALWAYS (angr.analyses.decompiler.structuring.phoenix.MultiStmtExprMode
module, 147
attribute), 939
angr.analyses
AlwaysUpdate (angr.analyses.calling_convention.UpdateArgumentsOption
module, 786
attribute), 854
angr.analyses.analysis
AMD64CCallRewriter(classinmodule, 832
angr.analyses.decompiler.ccall_rewriters.amd64_ccalls),
angr.analyses.backward_slice
950
module, 849
AMD64ElfGotResolver(classin angr.analyses.binary_optimizer
angr.analyses.cfg.indirect_jump_resolvers),
module, 1154
910
angr.analyses.bindiff
AMD64ElfGotResolver(classinmodule, 850
angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got),
angr.analyses.boyscout
894
module, 853
AMD64PeIatResolver(classin angr.analyses.callee_cleanup_finder
angr.analyses.cfg.indirect_jump_resolvers),
module, 1155
912
angr.analyses.calling_convention
analyses (angr.Project property), 154
module, 853
analyses (angr.project.Project property), 209
angr.analyses.cdg
AnalysesHub (class in angr.analyses), 786
module, 915
AnalysesHub (class in angr.analyses.analysis), 832
angr.analyses.cfg
AnalysesHubWithDefault(classinmodule, 857
angr.analyses.analysis), 833
angr.analyses.cfg.cfb
analysis (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
module, 873
attribute), 1091
angr.analyses.cfg.cfg
analysis (angr.analyses.reaching_definitions.ReachingDefinitionsState
module, 874
attribute), 1061
angr.analyses.cfg.cfg_arch_options
Analysis (class in angr), 173
module, 892
Analysis (class in angr.analyses), 786
angr.analyses.cfg.cfg_base
Analysis (class in angr.analyses.analysis), 834
module, 881
AnalysisFactory (class in angr.analyses.analysis), 833 angr.analyses.cfg.cfg_emulated
AnalysisLogEntry (class in angr.analyses.analysis),module, 876
832
angr.analyses.cfg.cfg_fast
AnalysisTask (class in angr.analyses.vfg), 1135
module, 884
analyze() (angr.analyses.callee_cleanup_finder.CalleeCleanupFinder
angr.analyses.cfg.cfg_fast_sootmethod), 1155
module, 913
analyze()(angr.analyses.CalleeCleanupFinder angr.analyses.cfg.cfg_job_base
method), 817
module, 893
analyze() (angr.analyses.code_tagging.CodeTagging angr.analyses.cfg.indirect_jump_resolvers
method), 916
module, 905
analyze() (angr.analyses.CodeTagging method), 822
angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got
analyze() (angr.analyses.decompiler.optimization_passes.optimization_pass.BaseOptimizationPass
module, 894
method), 976
angr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast
analyze() (angr.analyses.decompiler.optimization_passes.optimization_pass.StructuringOptimizationPass
module, 895
method), 977
angr.analyses.cfg.indirect_jump_resolvers.const_resolver
analyze() (angr.analyses.vtable.VtableFinder method),module, 904
1140
angr.analyses.cfg.indirect_jump_resolvers.default_resolver
analyze() (angr.analyses.VtableFinder method), 830
module, 898
analyze_transmit() (angr.state_plugins.trace_additions.ZenPluginangr.analyses.cfg.indirect_jump_resolvers.jumptable
method), 343
module, 898
1244

Index

angr

angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast
angr.analyses.decompiler.condition_processor
module, 896
module, 953
angr.analyses.cfg.indirect_jump_resolvers.resolver
angr.analyses.decompiler.decompilation_cachemodule, 904
module, 955
angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt
angr.analyses.decompiler.decompilation_options
module, 897
module, 954
angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat
angr.analyses.decompiler.decompiler
module, 896
module, 955
angr.analyses.cfg_slice_to_sink
angr.analyses.decompiler.empty_node_remover
module, 1098
module, 957
angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink
angr.analyses.decompiler.expression_narrower
module, 1101
module, 957
angr.analyses.cfg_slice_to_sink.graphangr.analyses.decompiler.graph_region
module, 1102
module, 959
angr.analyses.cfg_slice_to_sink.transitions angr.analyses.decompiler.jump_target_collector
module, 1103
module, 960
angr.analyses.class_identifierangr.analyses.decompiler.jumptable_entry_condition_rewrite
module, 1140
module, 960
angr.analyses.code_tagging
angr.analyses.decompiler.optimization_passes
module, 915
module, 960
angr.analyses.complete_calling_conventions
angr.analyses.decompiler.optimization_passes.base_ptr_save
module, 855
module, 978angr.analyses.congruency_checkangr.analyses.decompiler.optimization_passes.const_derefs
module, 1153
module, 974
angr.analyses.data_dep
angr.analyses.decompiler.optimization_passes.div_simplifie
module, 1164
module, 978angr.analyses.data_dep.data_dependency_analysis
angr.analyses.decompiler.optimization_passes.engine_base
module, 1159
module, 982
angr.analyses.data_dep.dep_nodes
angr.analyses.decompiler.optimization_passes.expr_op_swapp
module, 1161
module, 983
angr.analyses.data_dep.sim_act_location
angr.analyses.decompiler.optimization_passes.ite_expr_conv
module, 1160
module, 978angr.analyses.datagraph_meta
angr.analyses.decompiler.optimization_passes.lowered_switc
module, 915
module, 979
angr.analyses.ddg
angr.analyses.decompiler.optimization_passes.mod_simplifie
module, 1024
module, 981
angr.analyses.decompiler
angr.analyses.decompiler.optimization_passes.multi_simplif
module, 940
module, 981
angr.analyses.decompiler.ail_simplifierangr.analyses.decompiler.optimization_passes.optimization_
module, 948
module, 975
angr.analyses.decompiler.ailgraph_walker
angr.analyses.decompiler.optimization_passes.register_save
module, 949
module, 984
angr.analyses.decompiler.block_simplifierangr.analyses.decompiler.optimization_passes.ret_addr_save
module, 949
module, 984
angr.analyses.decompiler.callsite_makerangr.analyses.decompiler.optimization_passes.stack_canary_module, 950
module, 977
angr.analyses.decompiler.ccall_rewriters
angr.analyses.decompiler.optimization_passes.x86_gcc_getpc
module, 950
module, 985
angr.analyses.decompiler.ccall_rewriters.amd64_ccalls
angr.analyses.decompiler.peephole_optimizations
module, 950
module, 985
angr.analyses.decompiler.ccall_rewriters.rewriter_base
angr.analyses.decompiler.peephole_optimizations.base
module, 950
module, 985
angr.analyses.decompiler.clinic
angr.analyses.decompiler.redundant_label_remover
module, 950
module, 996
Index

1245

angr

angr.analyses.decompiler.region_identifierangr.analyses.disassembly
module, 987
module, 1141
angr.analyses.decompiler.region_simplifiers angr.analyses.disassembly_utils
module, 988
module, 1145
angr.analyses.decompiler.region_simplifiers.cascading_cond_transformer
angr.analyses.dominance_frontier
module, 988
module, 1155
angr.analyses.decompiler.region_simplifiers.cascading_ifs
angr.analyses.find_objects_static
module, 988
module, 1140
angr.analyses.decompiler.region_simplifiers.expr_folding
angr.analyses.flirt
module, 989
module, 1030
angr.analyses.decompiler.region_simplifiers.goto
angr.analyses.forward_analysis
module, 991
module, 834
angr.analyses.decompiler.region_simplifiers.if_
angr.analyses.forward_analysis.forward_analysis
module, 992
module, 839
angr.analyses.decompiler.region_simplifiers.ifelse
angr.analyses.forward_analysis.job_info
module, 992
module, 840
angr.analyses.decompiler.region_simplifiers.loop
angr.analyses.forward_analysis.visitors
module, 992
module, 840
angr.analyses.decompiler.region_simplifiers.node_address_finder
angr.analyses.forward_analysis.visitors.call_graphmodule, 992
module, 843
angr.analyses.decompiler.region_simplifiers.region_simplifierangr.analyses.forward_analysis.visitors.function_graphmodule, 992
module, 844
angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifierangr.analyses.forward_analysis.visitors.graphmodule, 993
module, 845
angr.analyses.decompiler.region_simplifiers.switch_expr_simplifierangr.analyses.forward_analysis.visitors.loop
module, 996
module, 847
angr.analyses.decompiler.region_walker
angr.analyses.forward_analysis.visitors.single_node_graphmodule, 996
module, 848
angr.analyses.decompiler.sequence_walker
angr.analyses.identifier.identify
module, 996
module, 1130
angr.analyses.decompiler.structured_codegen angr.analyses.init_finder
module, 997
module, 1155
angr.analyses.decompiler.structured_codegen.baseangr.analyses.loop_analysis
module, 1001
module, 1131
angr.analyses.decompiler.structured_codegen.c angr.analyses.loopfinder
module, 1002
module, 1131
angr.analyses.decompiler.structured_codegen.dummyangr.analyses.propagatormodule, 1020
module, 1033
angr.analyses.decompiler.structured_codegen.dwarf_importangr.analyses.propagator.engine_ail
module, 1020
module, 1036
angr.analyses.decompiler.structuringangr.analyses.propagator.engine_base
module, 930
module, 1035
angr.analyses.decompiler.structuring.dreamangr.analyses.propagator.engine_vex
module, 932
module, 1036
angr.analyses.decompiler.structuring.phoenix angr.analyses.propagator.outdated_definition_walker
module, 939
module, 1037
angr.analyses.decompiler.structuring.recursive_structurer
angr.analyses.propagator.propagatormodule, 930
module, 1038
angr.analyses.decompiler.structuring.structurer_base
angr.analyses.propagator.tmpvar_finder
module, 938
module, 1038
angr.analyses.decompiler.structuring.structurer_nodes
angr.analyses.propagator.top_checker_mixin
module, 933
module, 1040
angr.analyses.decompiler.utils
angr.analyses.propagator.values
module, 1020
module, 1034
1246

Index

angr

angr.analyses.propagator.vex_vars
angr.analyses.variable_recovery.engine_vex
module, 1035
module, 1114
angr.analyses.proximity_graphangr.analyses.variable_recovery.irsb_scannermodule, 1157
module, 1115
angr.analyses.reaching_definitions
angr.analyses.variable_recovery.variable_recovery
module, 1040
module, 1112
angr.analyses.reaching_definitions.call_trace angr.analyses.variable_recovery.variable_recovery_base
module, 1072
module, 1106
angr.analyses.reaching_definitions.dep_graph angr.analyses.variable_recovery.variable_recovery_fast
module, 1078
module, 1110
angr.analyses.reaching_definitions.engine_ail angr.analyses.veritesting
module, 1098
module, 1132
angr.analyses.reaching_definitions.engine_vex angr.analyses.vfg
module, 1074
module, 1134
angr.analyses.reaching_definitions.function_handler
angr.analyses.vsa_ddg
module, 1082
module, 1139
angr.analyses.reaching_definitions.heap_allocatorangr.analyses.vtable
module, 1081
module, 1139
angr.analyses.reaching_definitions.rd_state angr.analyses.xrefs
module, 1089
module, 1156
angr.analyses.reaching_definitions.reaching_definitions
angr.angrdb
module, 1074
module, 916
angr.analyses.reaching_definitions.subject
angr.angrdb.db
module, 1097
module, 917
angr.analyses.reassembler
angr.angrdb.models
module, 1145
module, 919
angr.analyses.soot_class_hierarchy
angr.angrdb.serializers
module, 857
module, 923
angr.analyses.stack_pointer_tracker
angr.angrdb.serializers.cfg_model
module, 1103
module, 924
angr.analyses.static_hooker
angr.angrdb.serializers.comments
module, 1153
module, 924
angr.analyses.typehoon
angr.angrdb.serializers.funcs
module, 1129
module, 925
angr.analyses.typehoon.lifter
angr.angrdb.serializers.kb
module, 1116
module, 925
angr.analyses.typehoon.simple_solver
angr.angrdb.serializers.labels
module, 1117
module, 926
angr.analyses.typehoon.translator
angr.angrdb.serializers.loader
module, 1121
module, 926
angr.analyses.typehoon.typeconsts
angr.angrdb.serializers.structured_code
module, 1127
module, 929
angr.analyses.typehoon.typehoon
angr.angrdb.serializers.variables
module, 1126
module, 928
angr.analyses.typehoon.typevars
angr.angrdb.serializers.xrefs
module, 1121
module, 928
angr.analyses.variable_recovery
angr.annocfg
module, 1115
module, 1169
angr.analyses.variable_recovery.annotations angr.blade
module, 1106
module, 1167
angr.analyses.variable_recovery.engine_ail
angr.block
module, 1113
module, 215
angr.analyses.variable_recovery.engine_base angr.callable
module, 1114
module, 653
Index

1247

angr

angr.calling_conventions
angr.engines.pcode
module, 613
module, 561
angr.code_location
angr.engines.pcode.behavior
module, 779
module, 573
angr.codenodeangr.engines.pcode.cc
module, 1170
module, 593
angr.concretization_strategies
angr.engines.pcode.emulate
module, 411
module, 573
angr.concretization_strategies.any
angr.engines.pcode.engine
module, 498
module, 562
angr.concretization_strategies.controlled_dataangr.engines.pcode.lifter
module, 498
module, 563
angr.concretization_strategies.eval
angr.engines.procedure
module, 495
module, 554
angr.concretization_strategies.max
angr.engines.soot
module, 497
module, 558
angr.concretization_strategies.nonzero
angr.engines.soot.engine
module, 497
module, 559
angr.concretization_strategies.nonzero_range angr.engines.successors
module, 496
module, 552
angr.concretization_strategies.norepeats
angr.engines.syscall
module, 495
module, 555
angr.concretization_strategies.norepeats_rangeangr.engines.unicorn
module, 497
module, 559
angr.concretization_strategies.range
angr.engines.vex
module, 496
module, 555
angr.concretization_strategies.single
angr.errors
module, 495
module, 1198
angr.concretization_strategies.solutions
angr.exploration_techniques
module, 496
module, 506
angr.concretization_strategies.unlimited_rangeangr.exploration_techniques.bucketizer
module, 498
module, 543
angr.distributed
angr.exploration_techniques.common
module, 1204
module, 541
angr.distributed.server
angr.exploration_techniques.dfs
module, 1205
module, 524
angr.distributed.worker
angr.exploration_techniques.director
module, 1206
module, 534
angr.engines
angr.exploration_techniques.driller_core
module, 543
module, 533
angr.engines.concreteangr.exploration_techniques.explorer
module, 560
module, 525
angr.engines.engine
angr.exploration_techniques.lengthlimiter
module, 551
module, 526
angr.engines.failureangr.exploration_techniques.local_loop_seer
module, 555
module, 538
angr.engines.hookangr.exploration_techniques.loop_seer
module, 554
module, 537
angr.engines.lightangr.exploration_techniques.manual_mergepoint
module, 1031
module, 526
angr.engines.light.data
angr.exploration_techniques.memory_watcher
module, 1030
module, 542
angr.engines.light.engine
angr.exploration_techniques.oppologist
module, 1032
module, 537
1248

Index

angr

angr.exploration_techniques.slicecutor
module, 533
angr.exploration_techniques.spiller
module, 527
angr.exploration_techniques.spiller_db
module, 529
angr.exploration_techniques.stochastic
module, 539
angr.exploration_techniques.suggestions
module, 543
angr.exploration_techniques.symbion
module, 541
angr.exploration_techniques.tech_builder
module, 540
angr.exploration_techniques.threading
module, 529
angr.exploration_techniques.timeout
module, 524
angr.exploration_techniques.tracer
module, 530
angr.exploration_techniques.uniquemodule, 540
angr.exploration_techniques.veritesting
module, 530
angr.factory
module, 212
angr.flirt
module, 1187
angr.flirt.build_sig
module, 1188
angr.keyed_region
module, 781
angr.knowledge_base
module, 654
angr.knowledge_plugins
module, 655
angr.knowledge_plugins.callsite_prototypes
module, 675
angr.knowledge_plugins.cfg
module, 676
angr.knowledge_plugins.cfg.cfg_manager
module, 696
angr.knowledge_plugins.cfg.cfg_model
module, 688
angr.knowledge_plugins.cfg.cfg_node
module, 697
angr.knowledge_plugins.cfg.indirect_jump
module, 700
angr.knowledge_plugins.cfg.memory_data
module, 694
angr.knowledge_plugins.comments
module, 703
angr.knowledge_plugins.data
module, 704
Indexangr.knowledge_plugins.debug_variables
module, 734
angr.knowledge_plugins.functions
module, 705
angr.knowledge_plugins.functions.function
module, 716
angr.knowledge_plugins.functions.function_manager
module, 714
angr.knowledge_plugins.functions.function_parser
module, 724
angr.knowledge_plugins.functions.soot_function
module, 724
angr.knowledge_plugins.indirect_jumps
module, 704
angr.knowledge_plugins.key_definitions
module, 736
angr.knowledge_plugins.key_definitions.atoms
module, 750
angr.knowledge_plugins.key_definitions.constants
module, 755
angr.knowledge_plugins.key_definitions.definition
module, 755
angr.knowledge_plugins.key_definitions.environment
module, 758
angr.knowledge_plugins.key_definitions.heap_address
module, 759
angr.knowledge_plugins.key_definitions.key_definition_mana
module, 759
angr.knowledge_plugins.key_definitions.live_definitions
module, 760
angr.knowledge_plugins.key_definitions.rd_model
module, 769
angr.knowledge_plugins.key_definitions.tag
module, 771
angr.knowledge_plugins.key_definitions.undefinedmodule, 773
angr.knowledge_plugins.key_definitions.unknown_size
module, 773
angr.knowledge_plugins.key_definitions.uses
module, 773
angr.knowledge_plugins.labels
module, 704
angr.knowledge_plugins.patches
module, 673
angr.knowledge_plugins.plugin
module, 675
angr.knowledge_plugins.propagations
module, 702
angr.knowledge_plugins.structured_code
module, 736
angr.knowledge_plugins.types
module, 701
angr.knowledge_plugins.variables
module, 726
1249

angr

angr.knowledge_plugins.variables.variable_accessangr.slicer
module, 727
module, 1168
angr.knowledge_plugins.variables.variable_manager
angr.state_hierarchy
module, 727
module, 505
angr.knowledge_plugins.xrefs
angr.state_plugins
module, 775
module, 226
angr.knowledge_plugins.xrefs.xref
angr.state_plugins.callstack
module, 777
module, 329
angr.knowledge_plugins.xrefs.xref_manager
angr.state_plugins.cgc
module, 779
module, 337
angr.knowledge_plugins.xrefs.xref_types
angr.state_plugins.concrete
module, 779
module, 358
angr.misc.plugins
angr.state_plugins.debug_variables
module, 218
module, 380
angr.proceduresangr.state_plugins.filesystemmodule, 603
module, 313
angr.procedures.definitions
angr.state_plugins.gdb
module, 605
module, 336
angr.procedures.stubs.format_parser
angr.state_plugins.globals
module, 603
module, 343
angr.project
angr.state_plugins.heap
module, 207
module, 363
angr.protos
angr.state_plugins.heap.heap_base
module, 784
module, 370
angr.serializable
angr.state_plugins.heap.heap_brk
module, 784
module, 371
angr.sim_manager
angr.state_plugins.heap.heap_freelist
module, 498
module, 373
angr.sim_options
angr.state_plugins.heap.heap_libc
module, 223
module, 374
angr.sim_procedureangr.state_plugins.heap.heap_ptmalloc
module, 599
module, 375
angr.sim_stateangr.state_plugins.heap.utils
module, 220
module, 379
angr.sim_state_options
angr.state_plugins.history
module, 223
module, 333
angr.sim_typeangr.state_plugins.inspect
module, 638
module, 300
angr.sim_variable
angr.state_plugins.javavm_classloader
module, 633
module, 360
angr.simos
angr.state_plugins.jni_references
module, 1172
module, 361
angr.simos.cgc
angr.state_plugins.libc
module, 1182
module, 302
angr.simos.javavm
angr.state_plugins.light_registers
module, 1185
module, 332
angr.simos.linux
angr.state_plugins.log
module, 1181
module, 328
angr.simos.simos
angr.state_plugins.loop_data
module, 1179
module, 357
angr.simos.userland
angr.state_plugins.plugin
module, 1182
module, 298
angr.simos.windows
angr.state_plugins.posix
module, 1184
module, 306
1250

Index

angr

angr.state_plugins.preconstrainer
angr.storage.memory_mixins.paged_memory.page_backer_mixins
module, 347
module, 463
angr.state_plugins.scratch
angr.storage.memory_mixins.paged_memory.paged_memory_mixin
module, 346
module, 459
angr.state_plugins.sim_action
angr.storage.memory_mixins.paged_memory.pages
module, 595
module, 465
angr.state_plugins.sim_action_object
angr.storage.memory_mixins.paged_memory.pages.cooperation
module, 597
module, 475
angr.state_plugins.sim_event
angr.storage.memory_mixins.paged_memory.pages.history_trac
module, 598
module, 474
angr.state_plugins.solver
angr.storage.memory_mixins.paged_memory.pages.ispo_mixin
module, 320
module, 475
angr.state_plugins.symbolizer
angr.storage.memory_mixins.paged_memory.pages.list_page
module, 379
module, 476
angr.state_plugins.trace_additions
angr.storage.memory_mixins.paged_memory.pages.multi_values
module, 339
module, 457
angr.state_plugins.uc_manager
angr.storage.memory_mixins.paged_memory.pages.mv_list_page
module, 345
module, 455
angr.state_plugins.unicorn_engine
angr.storage.memory_mixins.paged_memory.pages.permissions_module, 349
module, 474
angr.state_plugins.view
angr.storage.memory_mixins.paged_memory.pages.refcount_mix
module, 385
module, 473
angr.storage
angr.storage.memory_mixins.paged_memory.pages.ultra_page
module, 382
module, 477
angr.storage.fileangr.storage.memory_mixins.paged_memory.privileged_mixin
module, 390
module, 465
angr.storage.memory_mixins
angr.storage.memory_mixins.paged_memory.stack_allocation_m
module, 414
module, 464
angr.storage.memory_mixins.actions_mixin
angr.storage.memory_mixins.regioned_memory
module, 449
module, 479
angr.storage.memory_mixins.address_concretization_mixin
angr.storage.memory_mixins.regioned_memory.abstract_addres
module, 451
module, 490
angr.storage.memory_mixins.bvv_conversion_mixin
angr.storage.memory_mixins.regioned_memory.abstract_merger
module, 448
module, 492
angr.storage.memory_mixins.clouseau_mixin
angr.storage.memory_mixins.regioned_memory.region_category
module, 453
module, 490
angr.storage.memory_mixins.conditional_store_mixin
angr.storage.memory_mixins.regioned_memory.region_data
module, 453
module, 487
angr.storage.memory_mixins.convenient_mappings_mixin
angr.storage.memory_mixins.regioned_memory.region_meta_mix
module, 454
module, 490
angr.storage.memory_mixins.default_filler_mixin
angr.storage.memory_mixins.regioned_memory.regioned_addres
module, 447
module, 493
angr.storage.memory_mixins.dirty_addrs_mixin angr.storage.memory_mixins.regioned_memory.regioned_memory
module, 451
module, 485
angr.storage.memory_mixins.hex_dumper_mixin angr.storage.memory_mixins.regioned_memory.static_find_mix
module, 448
module, 490
angr.storage.memory_mixins.label_merger_mixin angr.storage.memory_mixins.simple_interface_mixin
module, 453
module, 449
angr.storage.memory_mixins.multi_value_merger_mixin
angr.storage.memory_mixins.simplification_mixin
module, 459
module, 454
angr.storage.memory_mixins.name_resolution_mixin
angr.storage.memory_mixins.size_resolution_mixin
module, 447
module, 450
angr.storage.memory_mixins.paged_memory
angr.storage.memory_mixins.slotted_memory
module, 459
module, 494
Index

1251

angr

angr.storage.memory_mixins.smart_find_mixin AngrDB (class in angr.angrdb.db), 917
module, 447
AngrDBError, 159, 1200
angr.storage.memory_mixins.symbolic_merger_mixin
AngrDDGError, 158, 1200
module, 449
AngrDecompilationError, 162, 1204
angr.storage.memory_mixins.top_merger_mixin AngrDelayJobNotice, 158, 1200
module, 458
AngrDirectorError, 159, 1200
angr.storage.memory_mixins.underconstrained_mixin
AngrError, 157, 1198
module, 449
AngrExitError, 157, 1199
angr.storage.memory_mixins.unwrapper_mixin
AngrExplorationTechniqueError, 159, 1200
module, 454
AngrExplorerError, 159, 1200
angr.storage.memory_object
AngrForwardAnalysisError, 158, 1200
module, 409
AngrIncompatibleDBError, 159, 1201
angr.utils
AngrIncongruencyError, 158, 1200
module, 1189
AngrInvalidArgumentError, 157, 1199
angr.utils.algo
AngrJobMergingFailureNotice, 158, 1200
module, 1189
AngrJobWideningFailureNotice, 158, 1200
angr.utils.constants
AngrLifterError, 157, 1199
module, 1189
AngrLoopAnalysisError, 159, 1200
angr.utils.cowdict
AngrMissingTypeError, 158, 1200
module, 1189
AngrNoPluginError, 162, 1204
angr.utils.dynamic_dictlist
AngrObjectFactory (class in angr.factory), 212
module, 1190
AngrPathError, 157, 1199
angr.utils.enums_conv
AngrRuntimeError, 157, 1198
module, 1190
AngrSimOSError, 158, 1199
angr.utils.env
AngrSkipJobNotice, 158, 1200
module, 1190
AngrSurveyorError, 157, 1199
angr.utils.formatting
AngrSyscallError, 158, 1199
module, 1197
AngrTracerError, 159, 1200
angr.utils.graph
AngrTypeError, 158, 1199
module, 1191
AngrUnsupportedSyscallError, 161, 1203
angr.utils.lazy_import
AngrValueError, 157, 1198
module, 1195
AngrVariableRecoveryError, 1200
angr.utils.library
AngrVaultError, 157, 1199
module, 1195
AngrVFGError, 158, 1200
angr.utils.loader
AngrVFGRestartAnalysisNotice, 158, 1200
module, 1195
annotate_mv_with_def()
angr.utils.mp(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsS
module, 1197
method), 1092
angr.utils.timing
annotate_mv_with_def()module, 1197
(angr.analyses.reaching_definitions.ReachingDefinitionsState
angr.vaults
method), 1062
module, 784
annotate_with_def()
AngrAnalysisError, 157, 1199
(angr.analyses.reaching_definitions.LiveDefinitions
AngrAnnotatedCFGError, 157, 1199
static method), 1042
AngrAssemblyError, 158, 1199
annotate_with_def()
AngrBackwardSlicingError, 158, 1199
(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsS
AngrBladeError, 157, 1199
method), 1092
AngrBladeSimProcError, 157, 1199
annotate_with_def()
AngrCallableError, 158, 1199
(angr.analyses.reaching_definitions.ReachingDefinitionsState
AngrCallableMultistateError, 158, 1199
method), 1062
AngrCFGError, 158, 1200
annotate_with_def()
AngrCorruptDBError, 159, 1201
(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
AngrDataGraphError, 158, 1200
static method), 763
AngrDB (class in angr.angrdb), 916
annotate_with_def()
1252

Index

angr

(angr.knowledge_plugins.key_definitions.LiveDefinitions 889
static method), 741
apply_patches_to_binary()
annotate_with_variables()(angr.knowledge_plugins.patches.PatchManager(angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase
method), 674
static method), 1108
apply_patches_to_binary()
annotated_cfg() (angr.analyses.backward_slice.BackwardSlice(angr.knowledge_plugins.PatchManager
method), 850
method), 670
annotated_cfg()(angr.analyses.BackwardSlice apply_patches_to_state()
method), 807(angr.knowledge_plugins.patches.PatchManager
AnnotatedCFG (class in angr.annocfg), 1169
method), 675
AnnotatedVariable(classin apply_patches_to_state()angr.analyses.loop_analysis), 1131
(angr.knowledge_plugins.PatchManager
annotations (angr.state_plugins.sim_action_object.SimActionObjectmethod), 670
property), 598
arch (angr.analyses.cfg.cfg_arch_options.CFGArchOptions
annotations(angr.state_plugins.SimActionObject
attribute), 893
property), 265
arch (angr.analyses.cfg.CFGArchOptions attribute), 870
ansi_color() (in module angr.utils.formatting), 1197
arch (angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableProc
append_data() (angr.analyses.Reassembler method),attribute), 900813
arch (angr.analyses.CFGArchOptions attribute), 799
append_data() (angr.analyses.reassembler.Reassembler arch (angr.analyses.decompiler.ccall_rewriters.rewriter_base.CCallRewrite
method), 1152
attribute), 950
append_procedure()(angr.analyses.Reassembler arch (angr.analyses.reaching_definitions.engine_ail.SimEngineRDAIL
method), 813
attribute), 1098
append_procedure() (angr.analyses.reassembler.Reassembler
arch (angr.analyses.reaching_definitions.LiveDefinitions
method), 1152
attribute), 1041
append_state() (angr.analyses.vfg.VFGNode method), arch (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
1137
attribute), 1091
append_statement()(inmodule arch (angr.analyses.reaching_definitions.ReachingDefinitionsState
angr.analyses.decompiler.utils), 1020
attribute), 1061
apply() (angr.analyses.cfg.cfg_fast.FunctionCallEdge arch(angr.analyses.reaching_definitions.Register
method), 887
attribute), 1051
apply()(angr.analyses.cfg.cfg_fast.FunctionEdge arch (angr.Block attribute), 166
method), 886
arch (angr.block.Block attribute), 216
apply() (angr.analyses.cfg.cfg_fast.FunctionFakeRetEdge arch (angr.block.DisassemblerBlock attribute), 216
method), 887
ARCH (angr.calling_conventions.SimCC attribute), 619
apply() (angr.analyses.cfg.cfg_fast.FunctionReturnEdge ARCH (angr.calling_conventions.SimCCAArch64 atmethod), 887
tribute), 627
apply() (angr.analyses.cfg.cfg_fast.FunctionTransitionEdgeARCH (angr.calling_conventions.SimCCAArch64LinuxSyscall
method), 887
attribute), 628
apply()(angr.calling_conventions.AllocHelper ARCH (angr.calling_conventions.SimCCAMD64LinuxSyscall
method), 614
attribute), 626
apply()(angr.sim_manager.SimulationManager ARCH (angr.calling_conventions.SimCCAMD64WindowsSyscall
method), 504
attribute), 626
apply() (angr.SimulationManager method), 172
ARCH (angr.calling_conventions.SimCCARM attribute),
apply_at_callsite (angr.analyses.reaching_definitions.function_handler.FunctionEffect626
attribute), 1083
ARCH (angr.calling_conventions.SimCCARMHF atapply_definition() (angr.knowledge_plugins.Function
tribute), 627
method), 664
ARCH (angr.calling_conventions.SimCCARMLinuxSyscall
apply_definition() (angr.knowledge_plugins.functions.Function attribute), 627
method), 712
ARCH (angr.calling_conventions.SimCCCdecl attribute),
apply_definition() (angr.knowledge_plugins.functions.function.Function622
method), 724
ARCH (angr.calling_conventions.SimCCMicrosoftAMD64
apply_function_edges()
attribute), 623(angr.analyses.cfg.cfg_fast.CFGJob method), ARCH (angr.calling_conventions.SimCCMicrosoftFastcall
Index

1253

angr

attribute), 623
ARCHES (angr.analyses.decompiler.optimization_passes.CallStatementRewri
ARCH (angr.calling_conventions.SimCCN64 attribute),
attribute), 972
629
ARCHES (angr.analyses.decompiler.optimization_passes.CodeMotionOptimiz
ARCH (angr.calling_conventions.SimCCN64LinuxSyscall
attribute), 969
attribute), 629
ARCHES (angr.analyses.decompiler.optimization_passes.const_derefs.Consta
ARCH (angr.calling_conventions.SimCCO32 attribute),
attribute), 974
628
ARCHES (angr.analyses.decompiler.optimization_passes.ConstantDereferenc
ARCH (angr.calling_conventions.SimCCO32LinuxSyscall
attribute), 966
attribute), 629
ARCHES (angr.analyses.decompiler.optimization_passes.ConstPropOptRever
ARCH (angr.calling_conventions.SimCCPowerPC atattribute), 971
tribute), 630
ARCHES (angr.analyses.decompiler.optimization_passes.DeadblockRemover
ARCH (angr.calling_conventions.SimCCPowerPC64 atattribute), 971
tribute), 631
ARCHES (angr.analyses.decompiler.optimization_passes.div_simplifier.DivSi
ARCH (angr.calling_conventions.SimCCPowerPC64LinuxSyscall
attribute), 978attribute), 631
ARCHES (angr.analyses.decompiler.optimization_passes.DivSimplifier
ARCH (angr.calling_conventions.SimCCPowerPCLinuxSyscall
attribute), 963
attribute), 630
ARCHES (angr.analyses.decompiler.optimization_passes.expr_op_swapper.E
ARCH (angr.calling_conventions.SimCCRISCV64LinuxSyscall
attribute), 984
attribute), 628
ARCHES (angr.analyses.decompiler.optimization_passes.ExprOpSwapper
ARCH (angr.calling_conventions.SimCCS390X attribute),
attribute), 961
632
ARCHES (angr.analyses.decompiler.optimization_passes.FlipBooleanCmp
ARCH (angr.calling_conventions.SimCCS390XLinuxSyscall
attribute), 967
attribute), 632
ARCHES (angr.analyses.decompiler.optimization_passes.InlinedStringTransfo
ARCH (angr.calling_conventions.SimCCSoot attribute),
attribute), 971
631
ARCHES (angr.analyses.decompiler.optimization_passes.ite_expr_converter.I
ARCH (angr.calling_conventions.SimCCSystemVAMD64
attribute), 979
attribute), 625
ARCHES (angr.analyses.decompiler.optimization_passes.ITEExprConverter
ARCH (angr.calling_conventions.SimCCX86LinuxSyscall
attribute), 962
attribute), 624
ARCHES (angr.analyses.decompiler.optimization_passes.ITERegionConverte
ARCH (angr.calling_conventions.SimCCX86WindowsSyscall
attribute), 962
attribute), 625
ARCHES (angr.analyses.decompiler.optimization_passes.mod_simplifier.Mod
arch (angr.engines.pcode.lifter.IRSB attribute), 565
attribute), 982
arch (angr.engines.pcode.lifter.Lifter attribute), 568
ARCHES (angr.analyses.decompiler.optimization_passes.ModSimplifierarch (angr.engines.pcode.lifter.PcodeDisassemblerBlockattribute), 964
attribute), 563
ARCHES (angr.analyses.decompiler.optimization_passes.multi_simplifier.Mu
arch (angr.engines.pcode.lifter.PcodeLifter attribute),
attribute), 981
570
ARCHES (angr.analyses.decompiler.optimization_passes.MultiSimplifierarch (angr.knowledge_plugins.key_definitions.atoms.Register
attribute), 963
attribute), 754
ARCHES (angr.analyses.decompiler.optimization_passes.optimization_pass.B
arch (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
attribute), 975
attribute), 762
ARCHES (angr.analyses.decompiler.optimization_passes.optimization_pass.S
arch (angr.knowledge_plugins.key_definitions.LiveDefinitions
attribute), 976
attribute), 740
ARCHES (angr.analyses.decompiler.optimization_passes.optimization_pass.S
arch (angr.Project attribute), 154
attribute), 977
arch (angr.project.Project attribute), 209
ARCHES (angr.analyses.decompiler.optimization_passes.register_save_area_arch (angr.sim_procedure.SimProcedure attribute), 601
attribute), 984
arch (angr.sim_state.SimState property), 221
ARCHES (angr.analyses.decompiler.optimization_passes.RegisterSaveAreaSi
ARCH (angr.SimCC attribute), 181
attribute), 966
arch (angr.SimState property), 178
ARCHES (angr.analyses.decompiler.optimization_passes.ret_addr_save_simp
arch_overridable() (in module angr.sim_state), 220
attribute), 984
ARCHES (angr.analyses.decompiler.optimization_passes.base_ptr_save_simplifier.BasePointerSaveSimplifier
ARCHES (angr.analyses.decompiler.optimization_passes.RetAddrSaveSimplifi
attribute), 978attribute), 966
ARCHES (angr.analyses.decompiler.optimization_passes.BasePointerSaveSimplifier
ARCHES (angr.analyses.decompiler.optimization_passes.ReturnDeduplicator
attribute), 961
attribute), 967
1254

Index

angr

ARCHES (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorHigh
attribute), 630
attribute), 965
ARG_REGS (angr.calling_conventions.SimCCPowerPC64LinuxSyscall
ARCHES (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorLow
attribute), 631
attribute), 964
ARG_REGS (angr.calling_conventions.SimCCPowerPCLinuxSyscall
ARCHES (angr.analyses.decompiler.optimization_passes.stack_canary_simplifier.StackCanarySimplifier
attribute), 630
attribute), 977
ARG_REGS (angr.calling_conventions.SimCCRISCV64LinuxSyscall
ARCHES (angr.analyses.decompiler.optimization_passes.StackCanarySimplifier
attribute), 628
attribute), 961
ARG_REGS (angr.calling_conventions.SimCCS390X atARCHES (angr.analyses.decompiler.optimization_passes.SwitchDefaultCaseDuplicator
tribute), 632
attribute), 970
ARG_REGS (angr.calling_conventions.SimCCS390XLinuxSyscall
ARCHES (angr.analyses.decompiler.optimization_passes.WinStackCanarySimplifier
attribute), 632
attribute), 968
ARG_REGS (angr.calling_conventions.SimCCSoot atARCHES (angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier.X86GccGetPcSimplifier
tribute), 631
attribute), 985
ARG_REGS (angr.calling_conventions.SimCCSystemVAMD64
ARCHES (angr.analyses.decompiler.optimization_passes.X86GccGetPcSimplifier
attribute), 625
attribute), 967
ARG_REGS (angr.calling_conventions.SimCCX86LinuxSyscall
arg_list (angr.analyses.decompiler.structured_codegen.c.CFunctionattribute), 624
attribute), 1004
ARG_REGS (angr.calling_conventions.SimCCX86WindowsSyscall
arg_locs() (angr.calling_conventions.SimCC method),attribute), 624
620
ARG_REGS(angr.engines.pcode.cc.SimCCM68k
atarg_locs() (angr.SimCC method), 182
tribute), 593
ARG_REGS (angr.calling_conventions.SimCC attribute), ARG_REGS (angr.engines.pcode.cc.SimCCPARISC at618
tribute), 594
ARG_REGS (angr.calling_conventions.SimCCAArch64 at- ARG_REGS(angr.engines.pcode.cc.SimCCPowerPC
tribute), 627
attribute), 594
ARG_REGS (angr.calling_conventions.SimCCAArch64LinuxSyscall
ARG_REGS (angr.engines.pcode.cc.SimCCRISCV atattribute), 627
tribute), 593
ARG_REGS (angr.calling_conventions.SimCCAMD64LinuxSyscall
ARG_REGS (angr.engines.pcode.cc.SimCCSH4 attribute),
attribute), 625
594
ARG_REGS (angr.calling_conventions.SimCCAMD64WindowsSyscall
ARG_REGS (angr.engines.pcode.cc.SimCCSPARC atattribute), 626
tribute), 593
ARG_REGS (angr.calling_conventions.SimCCARM at- ARG_REGS (angr.engines.pcode.cc.SimCCXtensa attribute), 626
tribute), 594
ARG_REGS (angr.calling_conventions.SimCCARMHF at- ARG_REGS (angr.SimCC attribute), 180
tribute), 626
arg_session(angr.sim_procedure.SimProcedure
ARG_REGS (angr.calling_conventions.SimCCARMLinuxSyscall
attribute), 601
attribute), 627
arg_session()(angr.calling_conventions.SimCC
ARG_REGS(angr.calling_conventions.SimCCCdecl
method), 619
attribute), 622
arg_session() (angr.SimCC method), 182
ARG_REGS (angr.calling_conventions.SimCCMicrosoftAMD64
args (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
attribute), 623
attribute), 1008
ARG_REGS (angr.calling_conventions.SimCCMicrosoftFastcall
args (angr.state_plugins.sim_action_object.SimActionObject
attribute), 623
property), 597
ARG_REGS (angr.calling_conventions.SimCCN64 at- args (angr.state_plugins.SimActionObject property), 265
tribute), 629
args (angr.utils.mp.Closure attribute), 1198
ARG_REGS (angr.calling_conventions.SimCCN64LinuxSyscall
args_atoms (angr.analyses.reaching_definitions.function_handler.Function
attribute), 629
attribute), 1085
ARG_REGS (angr.calling_conventions.SimCCO32 at- args_atoms (angr.analyses.reaching_definitions.FunctionCallData
tribute), 628
attribute), 1070
ARG_REGS (angr.calling_conventions.SimCCO32LinuxSyscall
args_defns (angr.analyses.reaching_definitions.dep_graph.FunctionCallR
attribute), 628
attribute), 1079
ARG_REGS (angr.calling_conventions.SimCCPowerPC at- ARGS_MISMATCH (angr.procedures.stubs.format_parser.FormatParser
tribute), 630
attribute), 604
ARG_REGS (angr.calling_conventions.SimCCPowerPC64 ARGS_MISMATCH (angr.sim_procedure.SimProcedure atIndex

1255

angr

tribute), 602
method), 1152
ARGS_MISMATCH (angr.SimProcedure attribute), 149
assign() (angr.state_plugins.SimUCManager method),
args_values (angr.analyses.reaching_definitions.function_handler.FunctionCallData259
attribute), 1085
assign() (angr.state_plugins.uc_manager.SimUCManager
args_values (angr.analyses.reaching_definitions.FunctionCallData method), 345
attribute), 1071
assign_labels() (angr.analyses.reassembler.BasicBlock
ArgSession (angr.calling_conventions.SimCCMicrosoftAMD64
method), 1148
attribute), 624
assign_labels()(angr.analyses.reassembler.Data
ArgSession (angr.calling_conventions.SimCCUsercall
method), 1150
attribute), 622
assign_labels() (angr.analyses.reassembler.Instruction
ArgSession (class in angr.calling_conventions), 617
method), 1147
argument_types (angr.sim_procedure.SimProcedure assign_labels() (angr.analyses.reassembler.Procedure
property), 603
method), 1148
argument_types (angr.SimProcedure property), 151
assign_unified_variable_names()arguments (angr.knowledge_plugins.Function property),(angr.knowledge_plugins.variables.variable_manager.VariableMa
663
method), 732
arguments (angr.knowledge_plugins.functions.Function assign_variable_names()
property), 711(angr.knowledge_plugins.variables.variable_manager.VariableMa
arguments (angr.knowledge_plugins.functions.function.Function
method), 732
property), 723
Assignment (angr.analyses.cfg.indirect_jump_resolvers.jumptable.Address
ArithmeticExpression (class in angr.engines.light),
attribute), 8991031
ast (angr.analyses.data_dep.BaseDepNode property),
ArithmeticExpression(classin1165
angr.engines.light.data), 1030
ast (angr.analyses.data_dep.dep_nodes.BaseDepNode
ARM (angr.analyses.cfg.cfg_fast.ARMDecodingMode atproperty), 1162
tribute), 884
ast (angr.state_plugins.sim_action_object.SimActionObject
ARMDecodingMode (class in angr.analyses.cfg.cfg_fast),
attribute), 597884
ast (angr.state_plugins.SimActionObject attribute), 265
ArmElfFastResolver(classin AST (class in angr.analyses.ddg), 1024
angr.analyses.cfg.indirect_jump_resolvers),
ast_graph (angr.analyses.DDG property), 802910
ast_graph (angr.analyses.ddg.DDG property), 1028
ArmElfFastResolver(classin ast_preserving_op()(inmoduleangr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast), angr.state_plugins.sim_action_object), 597895
ast_stripping_decorator()(inmoduleArray (class in angr.analyses.typehoon.typeconsts), 1129
angr.state_plugins.sim_action_object), 597
array() (angr.state_plugins.debug_variables.SimDebugVariable
ast_weight()(inmodulemethod), 381
angr.exploration_techniques.suggestions),array()(angr.state_plugins.SimDebugVariable543
method), 297
at_new_block() (angr.analyses.reaching_definitions.ReachingDefinitionsMarray() (angr.state_plugins.SimMemView method), 279
method), 1058
array()(angr.state_plugins.view.SimMemView at_new_block() (angr.knowledge_plugins.key_definitions.rd_model.Reachmethod), 390
method), 770
assembly() (angr.analyses.Reassembler method), 813
at_new_block() (angr.knowledge_plugins.key_definitions.ReachingDefinit
assembly()(angr.analyses.reassembler.BasicBlockmethod), 737
method), 1148
at_new_stmt() (angr.analyses.reaching_definitions.ReachingDefinitionsM
assembly() (angr.analyses.reassembler.Data method),
method), 1057
1150
at_new_stmt() (angr.knowledge_plugins.key_definitions.rd_model.Reachi
assembly()(angr.analyses.reassembler.Instruction
method), 770
method), 1147
at_new_stmt() (angr.knowledge_plugins.key_definitions.ReachingDefiniti
assembly()(angr.analyses.reassembler.Operandmethod), 737
method), 1147
atoi_dumps() (angr.state_plugins.trace_additions.ChallRespInfo
assembly()(angr.analyses.reassembler.Procedurestatic method), 342
method), 1148
atom (angr.analyses.reaching_definitions.Definition atassembly()(angr.analyses.reassembler.Reassembler
tribute), 1053
1256

Index

angr

atom (angr.knowledge_plugins.key_definitions.Definition base (angr.storage.SimMemoryObject attribute), 384
attribute), 750
base_addr (angr.sim_variable.SimStackVariable atatom (angr.knowledge_plugins.key_definitions.definition.Definition tribute), 637
attribute), 758
base_addr_available
Atom (class in angr.analyses.reaching_definitions), 1049
(angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTarget
Atom (class in angr.knowledge_plugins.key_definitions.atoms),
property), 900751
base_address (angr.storage.memory_mixins.regioned_memory.region_dat
atom_hash (angr.knowledge_plugins.variables.variable_access.VariableAccess
attribute), 488
attribute), 727
BaseDepNode (class in angr.analyses.data_dep), 1165
AtomKind (class in angr.analyses.reaching_definitions), BaseDepNode(classin1049
angr.analyses.data_dep.dep_nodes), 1161
AtomKind (class in angr.knowledge_plugins.key_definitions.atoms),
BaseGoal (class in angr.exploration_techniques.director),
750
534
available_flavors()
BaseLabel (class in angr.analyses.typehoon.typevars),(angr.knowledge_plugins.structured_code.StructuredCodeManager
1125
method), 736
BaseNode (class in angr.analyses.decompiler.structuring.structurer_nodes),available_flavors()933(angr.knowledge_plugins.StructuredCodeManagerBaseOptimizationPass(classinmethod), 672
angr.analyses.decompiler.optimization_passes.optimization_pass)
975
B
BasePointerSaveSimplifier(classinangr.analyses.decompiler.optimization_passes),b() (angr.state_plugins.inspect.SimInspector method),
961
300
BasePointerSaveSimplifier(classinb() (angr.state_plugins.SimInspector method), 232
angr.analyses.decompiler.optimization_passes.base_ptr_save_sim
back_edges() (angr.analyses.forward_analysis.FunctionGraphVisitor
978
method), 837
BaseProxiNode(classinback_edges() (angr.analyses.forward_analysis.visitors.function_graph.FunctionGraphVisitor
angr.analyses.proximity_graph), 1157
method), 845
BaseStructuredCodeGenerator(classinback_edges() (angr.analyses.forward_analysis.visitors.FunctionGraphVisitor
angr.analyses.decompiler.structured_codegen),method), 842997
back_edges() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor
BaseStructuredCodeGenerator(classinmethod), 846
angr.analyses.decompiler.structured_codegen.base),
backend (angr.angrdb.models.DbObject attribute), 919
1002
backend2name (angr.angrdb.serializers.loader.LoaderSerializer
basic_spec (angr.procedures.stubs.format_parser.FormatParser
attribute), 927
attribute), 604
backend2name (angr.angrdb.serializers.LoaderSerializer
basic_spec (angr.procedures.stubs.format_parser.ScanfFormatParser
attribute), 923
attribute), 605
backend_args(angr.angrdb.models.DbObject
atBasicBlock (class in angr.analyses.reassembler), 1147
tribute), 920
basicblock_key (angr.storage.memory_mixins.regioned_memory.region_
backpatch() (angr.analyses.typehoon.translator.TypeTranslator
property), 491
method), 1121
BasicClaripyCooperation(classin
BackwardSlice (angr.analyses.analysis.KnownAnalysesPluginangr.storage.memory_mixins.paged_memory.pages.cooperation),
attribute), 833
475
BackwardSlice (class in angr.analyses), 806
BackwardSlice (class in angr.analyses.backward_slice), bbl_addr (angr.errors.SimError attribute), 1201
bbl_addr (angr.knowledge_plugins.key_definitions.definition.DefinitionMa
849
attribute), 756
BadJumpkindNotification, 1167
bbl_addr(angr.SimError attribute), 159
BadStatesDropper (class in angr.distributed.worker),bbl_addrs(angr.state_plugins.history.SimStateHistory1206
property),
335
base (angr.sim_type.SimType attribute), 638
bbl_addrs(angr.state_plugins.SimStateHistory
propbase (angr.sim_type.SimTypeFunction attribute), 646erty),
254
base (angr.sim_variable.SimStackVariable attribute), 637
base (angr.storage.memory_object.SimMemoryObject bck_chunk() (angr.PTChunk method), 205
bck_chunk() (angr.state_plugins.heap.heap_freelist.Chunkattribute), 410
Index

1257

angr

method), 374
bits (angr.analyses.propagator.values.Top property),
bck_chunk() (angr.state_plugins.heap.heap_ptmalloc.PTChunk1035
method), 376
bits (angr.analyses.reaching_definitions.Atom propbck_chunk()(angr.state_plugins.heap.PTChunkerty), 1049
method), 370
bits (angr.analyses.typehoon.lifter.TypeLifter attribute),
bck_chunk() (angr.state_plugins.PTChunk method),1117
290
bits (angr.analyses.typehoon.typevars.HasField atBEFORE_REGION_IDENTIFICATION
tribute), 1126
(angr.analyses.decompiler.optimization_passes.optimization_pass.OptimizationPassStage
bits (angr.analyses.variable_recovery.engine_base.RichR
attribute), 975
property), 1114
BEFORE_REGION_IDENTIFICATION
bits (angr.engines.light.data.RegisterOffset property),(angr.analyses.decompiler.optimization_passes.OptimizationPassStage
1031
attribute), 961
bits (angr.engines.light.RegisterOffset property), 1032
BEFORE_SSA_LEVEL0_TRANSFORMATION
bits (angr.knowledge_plugins.key_definitions.atoms.Atom(angr.analyses.decompiler.optimization_passes.optimization_pass.OptimizationPassStage
property), 751
attribute), 975
bits (angr.sim_variable.SimMemoryVariable property),
BEFORE_SSA_LEVEL0_TRANSFORMATION
636(angr.analyses.decompiler.optimization_passes.OptimizationPassStage
bits (angr.sim_variable.SimRegisterVariable property),
attribute), 960
635
BehaviorFactory(classin Blade (class in angr), 163
angr.engines.pcode.behavior), 593
Blade (class in angr.blade), 1167
behaviors (angr.engines.pcode.lifter.IRSB attribute), blank_state()(angr.factory.AngrObjectFactory565
method), 212
behaviors (angr.engines.pcode.lifter.PcodeBasicBlockLifter
blob (angr.angrdb.models.DbCFGModel attribute), 920
attribute), 569
blob (angr.angrdb.models.DbFunction attribute), 921
binary (angr.knowledge_plugins.Function property), blob (angr.angrdb.models.DbVariableCollection at661
tribute), 921
binary(angr.knowledge_plugins.functions.Function blob (angr.angrdb.models.DbXRefs attribute), 922
property), 708
block (angr.analyses.decompiler.structured_codegen.c.CAILBlockbinary (angr.knowledge_plugins.functions.function.Function
attribute), 1005
property), 720
Block (angr.analyses.reaching_definitions.subject.SubjectTypebinary_insert() (in module angr.utils.algo), 1189
attribute), 1097
binary_name (angr.knowledge_plugins.Function at- block (angr.analyses.variable_recovery.engine_ail.SimEngineVRAIL
tribute), 658
attribute), 1114
binary_name (angr.knowledge_plugins.functions.Function block (angr.knowledge_plugins.cfg.cfg_node.CFGNodeattribute), 706
property), 699
binary_name (angr.knowledge_plugins.functions.function.Function
block (angr.knowledge_plugins.cfg.CFGNode property),
attribute), 718
679
binary_name (angr.knowledge_plugins.functions.soot_function.SootFunction
Block (class in angr), 165
attribute), 725
Block (class in angr.block), 216
BinaryError, 1145
block() (angr.analyses.decompiler.Clinic method), 943
BinaryOptimizer (angr.analyses.analysis.KnownAnalysesPlugin
block()(angr.analyses.decompiler.clinic.Clinic
attribute), 833
method), 952
BinaryOptimizer (class in angr.analyses), 814
block() (angr.factory.AngrObjectFactory method), 215
BinaryOptimizer(classin block() (angr.sim_state.SimState method), 222
angr.analyses.binary_optimizer), 1154
block() (angr.SimState method), 179
BinDiff (angr.analyses.analysis.KnownAnalysesPlugin block_addr (angr.analyses.decompiler.clinic.DataRefDesc
attribute), 832
attribute), 951
BinDiff (class in angr.analyses), 809
block_addr (angr.analyses.decompiler.region_simplifiers.expr_folding.Exp
BinDiff (class in angr.analyses.bindiff ), 852
attribute), 989
binop_operators (angr.analyses.decompiler.decompilation_cache.DecompilationCache
block_addr (angr.analyses.decompiler.region_simplifiers.expr_folding.Sta
attribute), 955
attribute), 989
bitlen (angr.analyses.stack_pointer_tracker.Register at- block_addr (angr.analyses.reaching_definitions.call_trace.CallSite
tribute), 1103
attribute), 1073
1258

Index

angr

block_addr (angr.code_location.CodeLocation at- block_size (angr.state_plugins.unicorn_engine.BlockDetails
tribute), 780
attribute), 351
block_addr (angr.knowledge_plugins.xrefs.XRef at- block_size (angr.state_plugins.unicorn_engine.StopDetails
tribute), 776
attribute), 353
block_addr (angr.knowledge_plugins.xrefs.xref.XRef at- block_trace_ind (angr.state_plugins.unicorn_engine.BlockDetails
tribute), 778
attribute), 351
block_addr (angr.state_plugins.unicorn_engine.BlockDetails
BlockCache (class in angr.analyses.decompiler.clinic),
attribute), 351
950
block_addr (angr.state_plugins.unicorn_engine.StopDetails
BlockDetails(classin
attribute), 353
angr.state_plugins.unicorn_engine), 351
block_addrs (angr.knowledge_plugins.Function prop- BlockID (class in angr.analyses.cfg.cfg_job_base), 893erty), 659
BlockLocator(classinblock_addrs (angr.knowledge_plugins.functions.Function
angr.analyses.decompiler.optimization_passes.ite_expr_converter
property), 707
978block_addrs (angr.knowledge_plugins.functions.function.Function
BlockNode (class in angr.codenode), 1171
property), 718
blocks (angr.knowledge_plugins.Function property),
block_addrs_set (angr.knowledge_plugins.Function
658
property), 659
blocks(angr.knowledge_plugins.functions.Function
block_addrs_set (angr.knowledge_plugins.functions.Function
property), 706
property), 707
blocks (angr.knowledge_plugins.functions.function.Function
block_addrs_set (angr.knowledge_plugins.functions.function.Function
property), 718
property), 718
blocks_by_addr (angr.analyses.decompiler.optimization_passes.optimizat
block_beginning_state()
property), 976(angr.knowledge_plugins.propagations.PropagationModel
blocks_by_addr_and_idx
method), 703(angr.analyses.decompiler.optimization_passes.optimization_pass
block_count (angr.state_plugins.history.SimStateHistory
property), 976
property), 335
blocks_probably_identical()block_count (angr.state_plugins.SimStateHistory prop(angr.analyses.bindiff.FunctionDiff method),erty), 254852
block_id(angr.analyses.cfg.cfg_emulated.CFGJob BLOCKS_THRESHOLD (angr.analyses.binary_optimizer.BinaryOptimizer
property), 877
attribute), 1154
block_id (angr.analyses.vfg.PendingJob attribute), 1135 BLOCKS_THRESHOLD (angr.analyses.BinaryOptimizer atblock_id (angr.analyses.vfg.VFGJob property), 1134
tribute), 814
block_id (angr.knowledge_plugins.cfg.cfg_node.CFGNodeblocks_with_differing_constants
attribute), 698(angr.analyses.BinDiff property), 810
block_id(angr.knowledge_plugins.cfg.CFGNode blocks_with_differing_constants
attribute), 678(angr.analyses.bindiff.BinDiff
property),
block_idx (angr.analyses.decompiler.region_simplifiers.expr_folding.ExpressionLocation
853
attribute), 989
blocks_with_differing_constants
block_idx (angr.analyses.decompiler.region_simplifiers.expr_folding.StatementLocation(angr.analyses.bindiff.FunctionDiff property),
attribute), 989
851
block_idx (angr.analyses.decompiler.structured_codegen.c.CLabel
BlockSimplifier (class in angr.analyses.decompiler),
attribute), 1010
945
block_idx(angr.code_location.CodeLocation
at- BlockSimplifier(classintribute), 780
angr.analyses.decompiler.block_simplifier),
block_initial_reg_values
949(angr.knowledge_plugins.propagations.PropagationModel
BlockStart (class in angr.analyses.disassembly), 1142
attribute), 702
BlockWalker(classinblock_matches(angr.analyses.bindiff.FunctionDiff
angr.analyses.decompiler.optimization_passes.const_derefs),
property), 852
974
BLOCK_MAX_SIZE (angr.Block attribute), 166
body (angr.analyses.decompiler.structured_codegen.c.CDoWhileLoop
BLOCK_MAX_SIZE (angr.block.Block attribute), 216
attribute), 1005
block_similarity() (angr.analyses.bindiff.FunctionDiff body (angr.analyses.decompiler.structured_codegen.c.CForLoop
method), 852
attribute), 1006
Index

1259

angr

body (angr.analyses.decompiler.structured_codegen.c.CWhileLoop
Bucketizer (class in angr.exploration_techniques), 522
attribute), 1005
Bucketizer (class in angr.exploration_techniques.bucketizer),
boolean_operators_in_condition()543(angr.analyses.decompiler.optimization_passes.DuplicationReverterbuild() (angr.analyses.disassembly.Operand static
static method), 972
method), 1143
booleanize() (angr.engines.pcode.behavior.OpBehavior bv_slice() (in module angr.storage.memory_object),class method), 574
410
both_iter(angr.calling_conventions.ArgSession bv_to_fp() (angr.state_plugins.sim_action_object.SimActionObject
attribute), 618
method), 598
both_iter (angr.calling_conventions.SimCC.ArgSession bv_to_fp()(angr.state_plugins.SimActionObject
attribute), 619
method), 266
both_iter (angr.SimCC.ArgSession attribute), 181
BVS() (angr.state_plugins.SimSolver method), 243
Bottom (class in angr.analyses.propagator.values), 1035 BVS() (angr.state_plugins.solver.SimSolver method), 321
BottomType (class in angr.analyses.stack_pointer_tracker), byte_string (angr.knowledge_plugins.cfg.cfg_node.CFGNode1103
attribute), 697
BottomType (class in angr.analyses.typehoon.typeconsts), byte_string (angr.knowledge_plugins.cfg.CFGNode1127
attribute), 678
BoyScout (angr.analyses.analysis.KnownAnalysesPlugin bytes (angr.Block property), 166
attribute), 833
bytes (angr.block.Block property), 217
BoyScout (class in angr.analyses), 806
bytes_at() (angr.storage.memory_object.SimMemoryObject
BoyScout (class in angr.analyses.boyscout), 853
method), 410
BP (class in angr), 151
bytes_at() (angr.storage.SimMemoryObject method),BP (class in angr.state_plugins.inspect), 300
385
BP_AFTER (angr.state_plugins.inspect.SimInspector at- bytes_offset (angr.engines.pcode.lifter.Lifter attribute), 300
tribute), 568
BP_AFTER (angr.state_plugins.SimInspector attribute), bytes_offset (angr.engines.pcode.lifter.PcodeLifter at232
tribute), 570
BP_BEFORE (angr.state_plugins.inspect.SimInspector at- bytestr (angr.codenode.BlockNode attribute), 1171
tribute), 300
BP_BEFORE (angr.state_plugins.SimInspector attribute), C
232
c_args_as_atoms() (angr.analyses.reaching_definitions.function_handler
BP_BOTH(angr.state_plugins.inspect.SimInspector
static method), 1089
attribute), 300
c_args_as_atoms() (angr.analyses.reaching_definitions.FunctionHandler
BP_BOTH (angr.state_plugins.SimInspector attribute), 232static method), 1068
bp_on_stack (angr.knowledge_plugins.Function at- c_repr() (angr.analyses.decompiler.structured_codegen.c.CConstructtribute), 658
method), 1003
bp_on_stack (angr.knowledge_plugins.functions.Function c_repr() (angr.analyses.typehoon.translator.SimTypeTempRef
attribute), 705
method), 1121
bp_on_stack (angr.knowledge_plugins.functions.function.Function
c_repr() (angr.sim_type.SimStruct method), 649
attribute), 717
c_repr() (angr.sim_type.SimType method), 638
bp_on_stack (angr.knowledge_plugins.functions.soot_function.SootFunction
c_repr() (angr.sim_type.SimTypeArray method), 644
attribute), 725
c_repr() (angr.sim_type.SimTypeBottom method), 640
branch() (angr.analyses.ddg.LiveDefinitions method), c_repr() (angr.sim_type.SimTypeFixedSizeInt method),1025
642
BreakNode (class in angr.analyses.decompiler.structuring.structurer_nodes),c_repr() (angr.sim_type.SimTypeFunction method), 647
936
c_repr() (angr.sim_type.SimTypeInt method), 641
bss_memory_read_hook()
c_repr() (angr.sim_type.SimTypePointer method), 644(angr.analyses.cfg.indirect_jump_resolvers.jumptable.BSSHookc_repr() (angr.sim_type.SimTypeRef method), 652
method), 902
c_repr() (angr.sim_type.SimTypeReference method),
bss_memory_write_hook()644(angr.analyses.cfg.indirect_jump_resolvers.jumptable.BSSHookc_repr() (angr.sim_type.SimTypeString method), 645
method), 902
c_repr() (angr.sim_type.SimTypeWString method), 646
BSSHook (class in angr.analyses.cfg.indirect_jump_resolvers.jumptable),c_repr() (angr.sim_type.SimUnion method), 650902
c_repr() (angr.sim_type.TypeRef method), 639
1260

Index

angr

c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CAILBlockc_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CUnarmethod), 1005
method), 1013
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CAssignment
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CUnsu
method), 1008
method), 1009
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CBinaryOp
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CVaria
method), 1013
method), 1011
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CBreakc_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CVaria
method), 1007
method), 1012
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CConstantc_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CWhilemethod), 1014
method), 1005
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CConstructc_return_as_atoms()
method), 1003
(angr.analyses.reaching_definitions.function_handler.FunctionHa
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CContinue
static method), 1089
method), 1007
c_return_as_atoms()
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CDirtyExpression(angr.analyses.reaching_definitions.FunctionHandler
method), 1016
static method), 1068
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CDirtyStatement
CAILBlock (class in angr.analyses.decompiler.structured_codegen.c),method), 1009
1005
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CDoWhileLoop
calc_size()(angr.calling_conventions.AllocHelper
method), 1006
class method), 614
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CFakeVariablecalculate_stack_depth()
method), 1011
(angr.analyses.decompiler.Clinic
method),c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CForLoop
943
method), 1006
calculate_stack_depth()c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CFunction(angr.analyses.decompiler.clinic.Clinic
method), 1004
method), 953
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
call() (angr.sim_procedure.SimProcedure method), 603
method), 1008
call() (angr.SimProcedure method), 150
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CGotocall() (angr.state_plugins.CallStack method), 268
method), 1009
call() (angr.state_plugins.callstack.CallStack method),c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CIfBreak331
method), 1007
call_c() (angr.callable.Callable method), 654
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CIfElse
call_site_addr (angr.analyses.cfg.cfg_fast.FunctionReturn
method), 1006
attribute), 885
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CIndexedVariable
call_stack (angr.analyses.cfg.cfg_job_base.CFGJobBase
method), 1012
property), 894
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CITE
call_stack (angr.analyses.vfg.PendingJob attribute),
method), 1015
1135
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CLabelcall_stack_copy() (angr.analyses.cfg.cfg_job_base.CFGJobBase
method), 1010
method), 894
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CMultiStatementExpression
call_state()(angr.factory.AngrObjectFactory
method), 1016
method), 213
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CRegister
call_string (angr.code_location.ExternalCodeLocation
method), 1015
attribute), 781
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CReturncallable (angr.knowledge_plugins.Function property),
method), 1009
663
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CStatements
callable (angr.knowledge_plugins.functions.Function
method), 1005
property), 711
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CStructField
callable (angr.knowledge_plugins.functions.function.Function
method), 1010
property), 723
c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CSwitchCase
Callable (class in angr.callable), 653
method), 1007
callable() (angr.factory.AngrObjectFactory method),c_repr_chunks() (angr.analyses.decompiler.structured_codegen.c.CTypeCast
215
method), 1014
CallAnalysis (class in angr.analyses.vfg), 1135
Index

1261

angr

CALLEE_CLEANUP (angr.calling_conventions.SimCC at- CallFunctionGoal(classintribute), 619
angr.exploration_techniques.director), 536
CALLEE_CLEANUP (angr.calling_conventions.SimCCStdcall callgraph (angr.knowledge_base.KnowledgeBase propattribute), 623erty), 655
CALLEE_CLEANUP (angr.SimCC attribute), 181
callgraph (angr.KnowledgeBase property), 207callee_func (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
CallGraphVisitor(classin
attribute), 1008
angr.analyses.forward_analysis), 835
callee_func_addr (angr.analyses.cfg.cfg_fast.FunctionReturn
CallGraphVisitor(classin
attribute), 885
angr.analyses.forward_analysis.visitors),
callee_func_addr (angr.analyses.reaching_definitions.call_trace.CallSite
840
attribute), 1073
CallGraphVisitor(classincallee_target (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
angr.analyses.forward_analysis.visitors.call_graph),attribute), 1008
843
CalleeCleanupFinder
calling_convention (angr.knowledge_plugins.Function(angr.analyses.analysis.KnownAnalysesPlugin
attribute), 658
attribute), 832
calling_convention (angr.knowledge_plugins.functions.Function
CalleeCleanupFinder (class in angr.analyses), 817
attribute), 706
CalleeCleanupFinder(classin calling_convention (angr.knowledge_plugins.functions.function.Functio
angr.analyses.callee_cleanup_finder), 1155
attribute), 718
caller_func_addr (angr.analyses.cfg.cfg_fast.FunctionReturncalling_convention (angr.knowledge_plugins.functions.soot_function.So
attribute), 885
attribute), 725
caller_func_addr (angr.analyses.reaching_definitions.call_trace.CallSite
CallingConvention (angr.analyses.analysis.KnownAnalysesPlugin
attribute), 1073
attribute), 833
CALLER_SAVED_REGS (angr.calling_conventions.SimCC CallingConventionAnalysis (class in angr.analyses),
attribute), 618
821
CALLER_SAVED_REGS (angr.calling_conventions.SimCCAMD64LinuxSyscall
CallingConventionAnalysis(classin
attribute), 626
angr.analyses.calling_convention), 854
CALLER_SAVED_REGS (angr.calling_conventions.SimCCARM
calloc() (angr.SimHeapPTMalloc method), 203
attribute), 626
calloc() (angr.state_plugins.heap.heap_libc.SimHeapLibc
CALLER_SAVED_REGS (angr.calling_conventions.SimCCARMHF
method), 375
attribute), 627
calloc() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
CALLER_SAVED_REGS (angr.calling_conventions.SimCCCdecl
method), 378
attribute), 622
calloc()(angr.state_plugins.heap.SimHeapLibc
CALLER_SAVED_REGS (angr.calling_conventions.SimCCN64
method), 366
attribute), 629
calloc() (angr.state_plugins.heap.SimHeapPTMalloc
CALLER_SAVED_REGS (angr.calling_conventions.SimCCO32
method), 367
attribute), 628
calloc() (angr.state_plugins.SimHeapLibc method),
CALLER_SAVED_REGS (angr.calling_conventions.SimCCSystemVAMD64
286
attribute), 625
calloc()(angr.state_plugins.SimHeapPTMalloc
CALLER_SAVED_REGS (angr.SimCC attribute), 181
method), 288
caller_saved_regs_as_atoms()
callout_sites(angr.knowledge_plugins.Function(angr.analyses.reaching_definitions.function_handler.FunctionHandler
property), 661
static method), 1089
callout_sites (angr.knowledge_plugins.functions.Function
caller_saved_regs_as_atoms()
property), 708(angr.analyses.reaching_definitions.FunctionHandler
callout_sites (angr.knowledge_plugins.functions.function.Function
static method), 1069
property), 720
caller_will_handle_single_ret
CallProxiNode(classin(angr.analyses.reaching_definitions.function_handler.FunctionCallData
angr.analyses.proximity_graph), 1158
attribute), 1085
calls_in_graph()(inmodulecaller_will_handle_single_ret
angr.analyses.decompiler.utils), 1024
(angr.analyses.reaching_definitions.FunctionCallData
callsite (angr.analyses.reaching_definitions.dep_graph.FunctionCallRela
attribute), 1071
attribute), 1079
CallFunctionGoal(classin CallSite (class in angr.analyses.reaching_definitions.call_trace),angr.exploration_techniques), 517
1072
1262

Index

angr

callsite_codeloc (angr.analyses.reaching_definitions.function_handler.FunctionCallData
can_call_same_name()
attribute), 1084
(angr.analyses.identifier.identify.Identifiercallsite_codeloc (angr.analyses.reaching_definitions.FunctionCallData
method), 1130
attribute), 1070
candidate_names (angr.sim_variable.SimVariable atcallsite_repr() (angr.analyses.cfg.cfg_job_base.BlockID
tribute), 634
method), 893
capstone (angr.Block property), 166
callsite_repr() (angr.analyses.cfg.cfg_job_base.FunctionKey
capstone (angr.block.Block property), 217
method), 893
CapstoneBlock (class in angr.block), 216
CallSiteFact(classin CapstoneInsn (class in angr.block), 216
angr.analyses.calling_convention), 853
cardinality (angr.storage.memory_mixins.regioned_memory.abstract_ad
CallSiteMaker (class in angr.analyses.decompiler), 946
property), 490
CallSiteMaker(classin CArrayTypeLength(classinangr.analyses.decompiler.callsite_maker),angr.analyses.decompiler.structured_codegen.c),
9501016
CallsitePrototypes(classin CascadingConditionNode(classinangr.knowledge_plugins), 672
angr.analyses.decompiler.structuring.structurer_nodes),CallsitePrototypes(classin935
angr.knowledge_plugins.callsite_prototypes),
CascadingConditionTransformer(classin675
angr.analyses.decompiler.region_simplifiers.cascading_cond_tran
callsites (angr.analyses.reaching_definitions.call_trace.CallTrace 988
attribute), 1073
CascadingIfsRemover(classincallsites_to() (angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
angr.analyses.decompiler.region_simplifiers.cascading_ifs),
method), 1078
988
callsites_to() (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
Case (class in angr.analyses.decompiler.optimization_passes.lowered_switch
method), 1057
979
callsites_to() (angr.analyses.ReachingDefinitionsAnalysis
Case2Result(classinmethod), 821
angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast),
callstack (angr.sim_state.SimState attribute), 220897
callstack (angr.SimState attribute), 177
case_addrs (angr.analyses.decompiler.structuring.structurer_nodes.Incom
CallStack (class in angr.state_plugins), 266
attribute), 938
CallStack (class in angr.state_plugins.callstack), 329
case_idx (angr.analyses.decompiler.region_simplifiers.expr_folding.Condi
callstack_key (angr.knowledge_plugins.cfg.cfg_node.CFGENode attribute), 990
property), 700
cases (angr.analyses.decompiler.structured_codegen.c.CSwitchCase
callstack_key (angr.knowledge_plugins.cfg.cfg_node.CFGNode attribute), 1007
property), 698
cases (angr.analyses.decompiler.structuring.structurer_nodes.IncompleteSw
callstack_key (angr.knowledge_plugins.cfg.CFGENode
attribute), 937
property), 680
cases (angr.analyses.decompiler.structuring.structurer_nodes.SwitchCaseN
callstack_key (angr.knowledge_plugins.cfg.CFGNodeattribute), 937
property), 679
cases_issubset() (angr.analyses.decompiler.optimization_passes.lowere
callstack_repr()(angr.analyses.vfg.VFGJob
static method), 981
method), 1134
cases_issubset() (angr.analyses.decompiler.optimization_passes.Lowere
CallStackAction(classinstatic method), 963
angr.state_plugins.callstack), 332
CAssignment(classin
CallStatementRewriter(classinangr.analyses.decompiler.structured_codegen.c),angr.analyses.decompiler.optimization_passes),1007
972
cast_primitive()(angr.simos.javavm.SimJavaVM
CallTrace (angr.analyses.reaching_definitions.subject.SubjectType static method), 1186
attribute), 1097
cast_primitive() (angr.simos.SimJavaVM static
CallTrace (class in angr.analyses.reaching_definitions.call_trace), method), 1178
1073
cast_to_mem() (angr.analyses.data_dep.dep_nodes.MemDepNode
CallTracingFilter(classinclass method), 1162
angr.analyses.veritesting), 1132
cast_to_mem() (angr.analyses.data_dep.MemDepNode
can_call_same_name()(angr.analyses.Identifierclass method), 1166
method), 817
CastType (angr.state_plugins.SimSolver attribute), 247
Index

1263

angr

CastType(angr.state_plugins.solver.SimSolver
at- CDirtyStatement(classintribute), 325
angr.analyses.decompiler.structured_codegen.c),CatchDesync (angr.exploration_techniques.tracer.TracingMode1009
attribute), 531
CDoWhileLoop(classincategory (angr.knowledge_plugins.key_definitions.atoms.VirtualVariable
angr.analyses.decompiler.structured_codegen.c),
attribute), 7541005
category (angr.sim_variable.SimVariable attribute), ceiling_addr()(angr.analyses.cfg.cfb.CFBlanket
634
method), 874
category (angr.SimFile property), 186
ceiling_addr()(angr.analyses.cfg.CFBlanket
category (angr.storage.file.SimFile property), 393
method), 867
category (angr.storage.memory_mixins.RegionCategoryMixin
ceiling_addr() (angr.knowledge_plugins.functions.function_manager.Fu
property), 440
method), 715
category (angr.storage.memory_mixins.regioned_memory.region_category_mixin.RegionCategoryMixin
ceiling_func() (angr.knowledge_plugins.FunctionManager
property), 490
method), 656
category (angr.storage.memory_mixins.regioned_memory.RegionCategoryMixin
ceiling_func() (angr.knowledge_plugins.functions.function_manager.Fu
property), 482
method), 715
category (angr.storage.SimFile property), 382
ceiling_func() (angr.knowledge_plugins.functions.FunctionManager
CBinaryOp (class in angr.analyses.decompiler.structured_codegen.c), method), 713
1013
ceiling_item()(angr.analyses.cfg.cfb.CFBlanket
CBreak (class in angr.analyses.decompiler.structured_codegen.c),method), 874
1007
ceiling_item()(angr.analyses.cfg.CFBlanket
cc (angr.analyses.reaching_definitions.function_handler.FunctionCallData
method), 867
attribute), 1085
ceiling_items()(angr.analyses.cfg.cfb.CFBlanket
cc (angr.analyses.reaching_definitions.FunctionCallData
method), 874
attribute), 1070
ceiling_items()(angr.analyses.cfg.CFBlanket
cc (angr.analyses.reaching_definitions.subject.Subject
method), 867
property), 1098
CExpression(classincc (angr.calling_conventions.ArgSession attribute), 617
angr.analyses.decompiler.structured_codegen.c),
cc (angr.calling_conventions.SimCC.ArgSession at1004
tribute), 619
CFakeVariable(classincc (angr.calling_conventions.UsercallArgSession atangr.analyses.decompiler.structured_codegen.c),tribute), 618
1010
cc (angr.sim_procedure.SimProcedure attribute), 601
CFB(angr.analyses.analysis.KnownAnalysesPlugin
cc (angr.SimCC.ArgSession attribute), 181
attribute), 832
cc() (angr.factory.AngrObjectFactory method), 215
CFBlanket (angr.analyses.analysis.KnownAnalysesPlugin
CCallRewriterBase(classin
attribute), 832
angr.analyses.decompiler.ccall_rewriters.rewriter_base),
CFBlanket (class in angr.analyses.cfg), 867
950
CFBlanket (class in angr.analyses.cfg.cfb), 874
CClosingObject(classin CFBlanketView (class in angr.analyses.cfg.cfb), 873
angr.analyses.decompiler.structured_codegen.c), CFG(angr.analyses.analysis.KnownAnalysesPlugin
1016
attribute), 832
CConstant (class in angr.analyses.decompiler.structured_codegen.c),
CFG (class in angr.analyses), 796
1014
CFG (class in angr.analyses.cfg), 865
CConstruct (class in angr.analyses.decompiler.structured_codegen.c),
CFG (class in angr.analyses.cfg.cfg), 874
1003
cfg_cache (angr.analyses.Veritesting attribute), 808
CContinue (class in angr.analyses.decompiler.structured_codegen.c),
cfg_cache (angr.analyses.veritesting.CallTracingFilter
1007
attribute), 1133
CDG
(angr.analyses.analysis.KnownAnalysesPlugin cfg_cache (angr.analyses.veritesting.Veritesting atattribute), 832
tribute), 1133
CDG (class in angr.analyses), 801
cfg_jumpkind_from_pb()(in
moduleCDG (class in angr.analyses.cdg), 915
angr.utils.enums_conv), 1190
CDirtyExpression(classin cfg_jumpkind_to_pb()(in
moduleangr.analyses.decompiler.structured_codegen.c),angr.utils.enums_conv), 1190
1016
CFGArchOptions (class in angr.analyses), 798
1264

Index

angr

CFGArchOptions (class in angr.analyses.cfg), 870
CFunction (class in angr.analyses.decompiler.structured_codegen.c),
CFGArchOptions(classin1003
angr.analyses.cfg.cfg_arch_options), 892
CFunctionCall(classin
CFGBase (class in angr.analyses.cfg), 870
angr.analyses.decompiler.structured_codegen.c),
CFGBase (class in angr.analyses.cfg.cfg_base), 881
1008
CFGEmulated (angr.analyses.analysis.KnownAnalysesPlugin
CGoto (class in angr.analyses.decompiler.structured_codegen.c),
attribute), 832
1009
CFGEmulated (class in angr.analyses), 792
ChainMapCOW (class in angr.utils.cowdict), 1189
CFGEmulated (class in angr.analyses.cfg), 861
ChallRespInfo(classin
CFGEmulated (class in angr.analyses.cfg.cfg_emulated),
angr.state_plugins.trace_additions), 340
877
changed_bytes() (angr.storage.memory_mixins.HistoryTrackingMixin
CFGENode (class in angr.knowledge_plugins.cfg), 679
method), 430
CFGENode (class in angr.knowledge_plugins.cfg.cfg_node), changed_bytes() (angr.storage.memory_mixins.ListPage699
method), 432
CFGFast (angr.analyses.analysis.KnownAnalysesPlugin changed_bytes() (angr.storage.memory_mixins.MVListPage
attribute), 832
method), 434
CFGFast (class in angr.analyses), 789
changed_bytes() (angr.storage.memory_mixins.paged_memory.paged_me
CFGFast (class in angr.analyses.cfg), 857
method), 461
CFGFast (class in angr.analyses.cfg.cfg_fast), 889
changed_bytes() (angr.storage.memory_mixins.paged_memory.pages.his
CFGFastSoot (class in angr.analyses), 799
method), 475
CFGFastSoot (class in angr.analyses.cfg), 868
changed_bytes() (angr.storage.memory_mixins.paged_memory.pages.His
CFGFastSoot (class in angr.analyses.cfg.cfg_fast_soot),
method), 467
913
changed_bytes() (angr.storage.memory_mixins.paged_memory.pages.list
CFGJob (class in angr.analyses.cfg.cfg_emulated), 876
method), 477
CFGJob (class in angr.analyses.cfg.cfg_fast), 888
changed_bytes() (angr.storage.memory_mixins.paged_memory.pages.Lis
CFGJobBase (class in angr.analyses.cfg.cfg_job_base),method), 469
893
changed_bytes() (angr.storage.memory_mixins.paged_memory.pages.mv
CFGJobType (class in angr.analyses.cfg.cfg_fast), 888
method), 457
CFGManager (class in angr.knowledge_plugins), 668
changed_bytes() (angr.storage.memory_mixins.paged_memory.pages.MV
CFGManager (class in angr.knowledge_plugins.cfg), 688
method), 471
CFGManager (class in angr.knowledge_plugins.cfg.cfg_manager),changed_bytes() (angr.storage.memory_mixins.paged_memory.pages.ultr
696
method), 479
CFGModel (class in angr.knowledge_plugins.cfg), 682
changed_bytes() (angr.storage.memory_mixins.paged_memory.pages.Ult
CFGModel (class in angr.knowledge_plugins.cfg.cfg_model),method), 473
688
changed_bytes() (angr.storage.memory_mixins.PagedMemoryMixin
CFGModelSerializer(classinmethod), 425
angr.angrdb.serializers.cfg_model), 924
changed_bytes() (angr.storage.memory_mixins.slotted_memory.SlottedM
CFGNode (class in angr.knowledge_plugins.cfg), 678
method), 495
CFGNode (class in angr.knowledge_plugins.cfg.cfg_node), changed_bytes() (angr.storage.memory_mixins.SlottedMemoryMixin697
method), 437
CFGNodeCreationFailure(classin changed_bytes() (angr.storage.memory_mixins.UltraPageangr.knowledge_plugins.cfg.cfg_node), 697
method), 436
cfgs (angr.angrdb.models.DbKnowledgeBase attribute), changed_pages() (angr.storage.memory_mixins.paged_memory.paged_me920
method), 461
cfgs (angr.knowledge_base.KnowledgeBase attribute), changed_pages() (angr.storage.memory_mixins.PagedMemoryMixin655
method), 426
cfgs (angr.KnowledgeBase attribute), 207
chdir()(angr.state_plugins.filesystem.SimFilesystem
CFGSliceToSink(classinmethod), 316
angr.analyses.cfg_slice_to_sink), 1098
chdir() (angr.state_plugins.SimFilesystem method), 282
CFGSliceToSink(classin check() (angr.BP method), 151
angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink),
check() (angr.exploration_techniques.CallFunctionGoal
1101
method), 517
CForLoop (class in angr.analyses.decompiler.structured_codegen.c),check() (angr.exploration_techniques.director.BaseGoal
1006
method), 535
Index

1265

angr

check() (angr.exploration_techniques.director.CallFunctionGoal
1006
method), 536
CIfElse (class in angr.analyses.decompiler.structured_codegen.c),check() (angr.exploration_techniques.director.ExecuteAddressGoal 1006
method), 535
CIndexedVariable(classincheck() (angr.exploration_techniques.ExecuteAddressGoal
angr.analyses.decompiler.structured_codegen.c),method), 516
1011
check() (angr.state_plugins.inspect.BP method), 300
CITE (class in angr.analyses.decompiler.structured_codegen.c),check_concrete_target_methods()
1015(angr.engines.concrete.SimEngineConcrete
CLabel (class in angr.analyses.decompiler.structured_codegen.c),static method), 561
1009
check_concrete_target_methods()
claripy_ast_from_ail_condition()(angr.engines.SimEngineConcrete
static(angr.analyses.decompiler.condition_processor.ConditionProcess
method), 550
method), 954
check_offset() (angr.calling_conventions.SimRegArg claripy_ast_to_sympy_expr()
method), 615(angr.analyses.decompiler.condition_processor.ConditionProcess
check_state() (angr.exploration_techniques.CallFunctionGoal
static method), 954
method), 517
ClaripyDataMixin (class in angr.engines.vex), 555
check_state() (angr.exploration_techniques.director.BaseGoal
ClassIdentifier (class in angr.analyses), 830
method), 535
ClassIdentifier(classincheck_state() (angr.exploration_techniques.director.CallFunctionGoal
angr.analyses.class_identifier), 1140
method), 536
clean() (angr.utils.cowdict.ChainMapCOW method),
check_state() (angr.exploration_techniques.director.ExecuteAddressGoal
1190
method), 535
clean()(angr.utils.cowdict.DefaultChainMapCOW
check_state() (angr.exploration_techniques.ExecuteAddressGoal method), 1190
method), 517
cleanup()(angr.analyses.cfg.cfg_fast.PendingJobs
check_tests() (angr.analyses.Identifier method), 817
method), 886
check_tests() (angr.analyses.identifier.identify.Identifier cleanup() (angr.analyses.decompiler.CStructuredCodeGenerator
method), 1131
method), 941
check_value_get() (angr.calling_conventions.SimFunctionArgument
cleanup() (angr.analyses.decompiler.structured_codegen.c.CStructuredCo
method), 615
method), 1017
check_value_set() (angr.calling_conventions.SimFunctionArgument
cleanup() (angr.analyses.decompiler.structured_codegen.CStructuredCod
method), 615
method), 999
Chunk (class in angr.state_plugins.heap.heap_freelist), clear() (angr.analyses.decompiler.condition_processor.ConditionProcesso
373
method), 953
chunk_from_mem() (angr.SimHeapPTMalloc method), clear()(angr.knowledge_plugins.FunctionManager
202
method), 656
chunk_from_mem() (angr.state_plugins.heap.heap_freelist.SimHeapFreelist
clear() (angr.knowledge_plugins.functions.function_manager.FunctionMa
method), 374
method), 715
chunk_from_mem() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
clear() (angr.knowledge_plugins.functions.FunctionManager
method), 377
method), 713
chunk_from_mem() (angr.state_plugins.heap.SimHeapPTMalloc
clear() (angr.state_plugins.log.SimStateLog method),
method), 367
329
chunk_from_mem() (angr.state_plugins.SimHeapPTMallocclear()(angr.state_plugins.scratch.SimStateScratchmethod), 287
method), 347
chunks() (angr.SimHeapPTMalloc method), 202
clear() (angr.state_plugins.SimStateLog method), 251
chunks() (angr.state_plugins.heap.heap_freelist.SimHeapFreelist
clear() (angr.state_plugins.SimStateScratch method),
method), 374
256
chunks() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
clear() (angr.storage.memory_mixins.regioned_memory.abstract_address
method), 377
method), 490
chunks() (angr.state_plugins.heap.SimHeapPTMalloc clear_cache() (angr.engines.pcode.lifter.PcodeLifterEngineMixin
method), 367
method), 571
chunks()(angr.state_plugins.SimHeapPTMalloc clear_cache() (angr.engines.vex.VEXLifter method),
method), 287
557
CIfBreak (class in angr.analyses.decompiler.structured_codegen.c),clear_local_references()
1266

Index

angr

(angr.state_plugins.jni_references.SimStateJNIReferences 1015
method), 362
code_constants(angr.knowledge_plugins.Function
clear_local_references()
property), 660(angr.state_plugins.SimStateJNIReferences
code_constants (angr.knowledge_plugins.functions.Function
method), 293
property), 707
clear_page_cache()(angr.state_plugins.Unicorn code_constants (angr.knowledge_plugins.functions.function.Function
method), 262
property), 719
clear_page_cache() (angr.state_plugins.unicorn_engine.Unicorn
codegen (angr.analyses.decompiler.decompilation_cache.DecompilationCa
method), 356
attribute), 955
clear_region_for_reflow()
codegen (angr.analyses.decompiler.structured_codegen.c.CConstruct(angr.knowledge_plugins.cfg.cfg_model.CFGModel
attribute), 1003
method), 694
codeloc (angr.analyses.reaching_definitions.Definition
clear_region_for_reflow()
attribute), 1053
(angr.knowledge_plugins.cfg.CFGModel
codeloc (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsS
method), 688
attribute), 1091
clear_updated_functions()
codeloc (angr.analyses.reaching_definitions.ReachingDefinitionsState(angr.analyses.cfg.cfg_fast.PendingJobs
attribute), 1061
method), 886
codeloc (angr.knowledge_plugins.key_definitions.Definition
ClemoryBackerMixin(classin
attribute), 750
angr.storage.memory_mixins), 423
codeloc (angr.knowledge_plugins.key_definitions.definition.Definition
ClemoryBackerMixin(classin
attribute), 758
angr.storage.memory_mixins.paged_memory.page_backer_mixins),
codeloc_uses (angr.analyses.reaching_definitions.rd_state.ReachingDefin
464
attribute), 1091
Clinic (angr.analyses.analysis.KnownAnalysesPlugin codeloc_uses (angr.analyses.reaching_definitions.ReachingDefinitionsSta
attribute), 833
attribute), 1061
clinic (angr.analyses.decompiler.decompilation_cache.DecompilationCache
CodeLocation (class in angr.code_location), 779
attribute), 955
CodeMotionOptimization(classinClinic (class in angr.analyses.decompiler), 942
angr.analyses.decompiler.optimization_passes),Clinic (class in angr.analyses.decompiler.clinic), 951
969
ClinicMode (class in angr.analyses.decompiler.clinic), codenode (angr.Block property), 166
950
codenode (angr.block.Block property), 217
CLoop (class in angr.analyses.decompiler.structured_codegen.c),codenode (angr.block.SootBlock property), 218
1005
CodeNode (class in angr.analyses.decompiler.structuring.structurer_nodes),close()(angr.state_plugins.posix.SimSystemPosix
934
method), 312
CodeNode (class in angr.codenode), 1170
close() (angr.state_plugins.SimSystemPosix method), CodeReference (angr.knowledge_plugins.cfg.memory_data.MemoryDataS
240
attribute), 695
close() (angr.vaults.Vault static method), 785
CodeReference (angr.knowledge_plugins.cfg.MemoryDataSort
close() (angr.vaults.VaultShelf method), 786
attribute), 676
closed_fds (angr.state_plugins.posix.SimSystemPosix CodeTagging (angr.analyses.analysis.KnownAnalysesPlugin
property), 311
attribute), 833
closed_fds (angr.state_plugins.SimSystemPosix prop- CodeTagging (class in angr.analyses), 822erty), 239
CodeTagging (class in angr.analyses.code_tagging), 916
closest_common_ancestor()
CodeTags (class in angr.analyses.code_tagging), 915(angr.state_plugins.history.SimStateHistory
collapse() (angr.analyses.decompiler.structured_codegen.c.MakeTypecas
method), 335
class method), 1019
closest_common_ancestor()collapsed (angr.analyses.decompiler.structured_codegen.c.CExpression(angr.state_plugins.SimStateHistory method),attribute), 1004
254
collapsed (angr.analyses.decompiler.structured_codegen.c.CIndexedVaria
Closure (class in angr.utils.mp), 1197
attribute), 1012
CmpOp (class in angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier),
collapsed (angr.analyses.decompiler.structured_codegen.c.CVariableField
993
attribute), 1012
CMultiStatementExpression(classin collect_conditions_between_nodes()angr.analyses.decompiler.structured_codegen.c),(angr.analyses.decompiler.optimization_passes.DuplicationRevert
Index

1267

angr

method), 973
angr.analyses.bindiff ), 851
COLLECT_DATA_REFS (angr.analyses.decompiler.clinic.ClinicMode
compare_states() (angr.analyses.congruency_check.CongruencyCheckattribute), 951
method), 1153
collect_data_refs (angr.engines.pcode.lifter.Lifter compare_states() (angr.analyses.CongruencyCheckattribute), 568
method), 811
collect_data_refs (angr.engines.pcode.lifter.PcodeLiftercomplement()(angr.sim_variable.SimVariableSet
attribute), 570
method), 638
color() (angr.analyses.disassembly.DisassemblyPiece complete() (angr.exploration_techniques.ExplorationTechniquestatic method), 1141
method), 508
comment (angr.angrdb.models.DbComment attribute), complete()(angr.exploration_techniques.Explorer
922
method), 513
Comment (class in angr.analyses.disassembly), 1144
complete() (angr.exploration_techniques.explorer.Explorer
comments (angr.angrdb.models.DbKnowledgeBase atmethod), 526
tribute), 920
complete()(angr.exploration_techniques.Symbion
Comments (class in angr.knowledge_plugins), 667
method), 521
Comments (class in angr.knowledge_plugins.comments), complete() (angr.exploration_techniques.symbion.Symbion
703
method), 542
CommentsSerializer(classin complete()(angr.exploration_techniques.Tracer
angr.angrdb.serializers.comments), 924
method), 511
common_type (angr.analyses.decompiler.structured_codegen.c.CBinaryOp
complete() (angr.exploration_techniques.tracer.Tracer
attribute), 1013
method), 532
compare() (angr.analyses.reaching_definitions.LiveDefinitions
complete() (angr.ExplorationTechnique method), 175
method), 1043
complete()(angr.sim_manager.SimulationManager
compare() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
method), 501
method), 1094
complete() (angr.SimulationManager method), 169
compare() (angr.analyses.reaching_definitions.ReachingDefinitionsStateCOMPLETE_SCANNING (angr.analyses.cfg.cfg_fast.CFGJobType
method), 1063
attribute), 888
compare() (angr.knowledge_plugins.key_definitions.environment.Environment
CompleteCallingConventions
method), 759(angr.analyses.analysis.KnownAnalysesPlugincompare() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
attribute), 833
method), 764
CompleteCallingConventionsAnalysis (class incompare() (angr.knowledge_plugins.key_definitions.LiveDefinitions angr.analyses), 827
method), 742
CompleteCallingConventionsAnalysis (class incompare() (angr.storage.memory_mixins.MVListPageangr.analyses.complete_calling_conventions),
method), 434855
compare() (angr.storage.memory_mixins.paged_memory.paged_memory_mixin.PagedMemoryMixin
compute() (angr.state_plugins.trace_additions.FormatInfo
method), 461
method), 339
compare() (angr.storage.memory_mixins.paged_memory.pages.mv_list_page.MVListPage
compute() (angr.state_plugins.trace_additions.FormatInfoDontConstrain
method), 457
method), 340
compare() (angr.storage.memory_mixins.paged_memory.pages.MVListPage
compute() (angr.state_plugins.trace_additions.FormatInfoIntToStr
method), 471
method), 340
compare() (angr.storage.memory_mixins.PagedMemoryMixin
compute() (angr.state_plugins.trace_additions.FormatInfoStrToInt
method), 425
method), 339
compare_path_group()
compute_common_type()(angr.analyses.congruency_check.CongruencyCheck(angr.analyses.decompiler.structured_codegen.c.CBinaryOp
method), 1153
static method), 1013
compare_path_group()
compute_dominance_frontier()(inmodule(angr.analyses.CongruencyCheck
method),angr.utils.graph), 1192
811
compute_quotient_graph()compare_paths() (angr.analyses.congruency_check.CongruencyCheck(angr.analyses.typehoon.simple_solver.SimpleSolver
method), 1153
method), 1120
compare_paths()(angr.analyses.CongruencyCheck concat() (angr.storage.memory_mixins.paged_memory.pages.multi_values
method), 811
method), 458
compare_statement_dict()(inmodule concrete (angr.state_plugins.debug_variables.SimDebugVariable
1268

Index

angr

property), 381
392
concrete (angr.state_plugins.SimDebugVariable prop- concretize()(angr.storage.file.SimFileDescriptor
erty), 297
method), 403
concrete (angr.state_plugins.SimMemView property), concretize() (angr.storage.file.SimFileDescriptorBase279
method), 402
concrete (angr.state_plugins.view.SimMemView prop- concretize() (angr.storage.file.SimFileDescriptorDuplex
erty), 390
method), 406
Concrete (class in angr.state_plugins), 291
concretize() (angr.storage.file.SimPackets method),Concrete (class in angr.state_plugins.concrete), 358
397
concrete_bytes() (angr.storage.memory_object.SimMemoryObject
concretize()(angr.storage.file.SimPacketsSlots
method), 410
method), 408
concrete_bytes()(angr.storage.SimMemoryObject concretize() (angr.storage.SimFile method), 383
method), 385
concretize() (in module angr.state_plugins.heap.utils),
concrete_load() (angr.storage.memory_mixins.address_concretization_mixin.AddressConcretizationMixin379
method), 453
concretize_load_idx()
concrete_load() (angr.storage.memory_mixins.AddressConcretizationMixin(angr.storage.memory_mixins.JavaVmMemoryMixin
method), 416
method), 444
concrete_load() (angr.storage.memory_mixins.paged_memory.paged_memory_mixin.PagedMemoryMixin
concretize_read_addr()
method), 461(angr.storage.memory_mixins.address_concretization_mixin.Addr
concrete_load() (angr.storage.memory_mixins.paged_memory.pages.ultra_page.UltraPage
method), 452
method), 479
concretize_read_addr()
concrete_load() (angr.storage.memory_mixins.paged_memory.pages.UltraPage(angr.storage.memory_mixins.AddressConcretizationMixin
method), 473
method), 416
concrete_load() (angr.storage.memory_mixins.PagedMemoryMixin
concretize_store_idx()
method), 425(angr.storage.memory_mixins.JavaVmMemoryMixin
concrete_load() (angr.storage.memory_mixins.UltraPage
method), 444
method), 435
concretize_write_addr()
concrete_path_bool()(inmodule(angr.storage.memory_mixins.address_concretization_mixin.Addr
angr.state_plugins.solver), 320
method), 452
concrete_path_list()(inmodule concretize_write_addr()
angr.state_plugins.solver), 320(angr.storage.memory_mixins.AddressConcretizationMixin
concrete_path_not_bool()(inmodulemethod), 416
angr.state_plugins.solver), 320
cond (angr.analyses.decompiler.structured_codegen.c.CITE
concrete_path_scalar()(inmoduleattribute), 1015
angr.state_plugins.solver), 320
condition (angr.analyses.decompiler.structured_codegen.c.CDoWhileLoo
concrete_path_tuple()(inmoduleattribute), 1005
angr.state_plugins.solver), 320
condition (angr.analyses.decompiler.structured_codegen.c.CForLoop
concrete_states (angr.analyses.variable_recovery.variable_recovery.VariableRecoveryState
attribute), 1006
property), 1112
condition (angr.analyses.decompiler.structured_codegen.c.CIfBreakConcreteBackerMixin(classin
attribute), 1007
angr.storage.memory_mixins), 423
condition (angr.analyses.decompiler.structured_codegen.c.CWhileLoop
ConcreteBackerMixin(classin
attribute), 1005
angr.storage.memory_mixins.paged_memory.page_backer_mixins),
condition (angr.analyses.decompiler.structuring.structurer_nodes.Conditi
464
attribute), 937
concretize() (angr.concretization_strategies.SimConcretizationStrategy
condition (angr.analyses.decompiler.structuring.structurer_nodes.Conditi
method), 411
attribute), 934
concretize() (angr.SimFile method), 186condition (angr.analyses.decompiler.structuring.structurer_nodes.LoopNo
concretize() (angr.SimFileBase method), 184
attribute), 936
concretize() (angr.SimFileDescriptor method), 194
Condition (class in angr.analyses.loop_analysis), 1131
concretize() (angr.SimFileDescriptorDuplex method), condition_and_nodes
197(angr.analyses.decompiler.structured_codegen.c.CIfElse
concretize() (angr.SimPackets method), 188
attribute), 1006
concretize() (angr.storage.file.SimFile method), 393
condition_and_nodes
concretize() (angr.storage.file.SimFileBase method),(angr.analyses.decompiler.structuring.structurer_nodes.Cascadin
Index

1269

angr

attribute), 935
attribute), 887
condition_to_lambda()(inmodule CongruencyCheck (angr.analyses.analysis.KnownAnalysesPluginangr.exploration_techniques.common), 541
attribute), 833
CONDITIONAL (angr.state_plugins.sim_action.SimActionExitCongruencyCheck (class in angr.analyses), 810
attribute), 595
CongruencyCheck(classin
CONDITIONAL (angr.state_plugins.SimActionExit atangr.analyses.congruency_check), 1153
tribute), 263
const_formats (angr.angrdb.models.DbStructuredCode
ConditionalBreakLocation(classin
attribute), 922
angr.analyses.decompiler.region_simplifiers.expr_folding),
CONST_TYPES (angr.engines.light.ArithmeticExpression
990
attribute), 1031
ConditionalBreakNode(classin CONST_TYPES (angr.engines.light.data.ArithmeticExpression
angr.analyses.decompiler.structuring.structurer_nodes), attribute), 1030
936
const_val (angr.knowledge_plugins.key_definitions.definition.DefinitionM
ConditionalMixin(classin
attribute), 756
angr.storage.memory_mixins), 417
const_vals (angr.engines.pcode.lifter.IRSB attribute),
ConditionalMixin(classin565
angr.storage.memory_mixins.conditional_store_mixin),
Constant (angr.analyses.data_dep.dep_nodes.DepNodeTypes453
attribute), 1161
ConditionalRegion(classin Constant(angr.analyses.data_dep.DepNodeTypes
angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier),
attribute), 1165
993
CONSTANT (angr.analyses.reaching_definitions.AtomKind
ConditionLocation(classin
attribute), 1049
angr.analyses.decompiler.region_simplifiers.expr_folding),
CONSTANT (angr.knowledge_plugins.key_definitions.atoms.AtomKind
989
attribute), 751
ConditionNode(classin Constant (class in angr.analyses.stack_pointer_tracker),angr.analyses.decompiler.structuring.structurer_nodes), 1103
934
constant_after() (angr.analyses.stack_pointer_tracker.StackPointerTrac
ConditionProcessor(classinmethod), 1106
angr.analyses.decompiler.condition_processor), constant_after() (angr.analyses.StackPointerTracker
953
method), 823
configuration (angr.angrdb.models.DbStructuredCode constant_after_block()
attribute), 922(angr.analyses.stack_pointer_tracker.StackPointerTracker
configure_project() (angr.SimOS method), 164
method), 1106
configure_project()(angr.simos.linux.SimLinux constant_after_block()method), 1181
(angr.analyses.StackPointerTracker method),configure_project() (angr.simos.SimLinux method),823
1175
constant_before() (angr.analyses.stack_pointer_tracker.StackPointerTra
configure_project() (angr.simos.SimOS method),
method), 1106
1172
constant_before() (angr.analyses.StackPointerTracker
configure_project()(angr.simos.simos.SimOS
method), 823
method), 1179
constant_before_block()
configure_project() (angr.simos.SimSnimmucNxp(angr.analyses.stack_pointer_tracker.StackPointerTracker
method), 1179
method), 1106
configure_project()(angr.simos.SimUserland constant_before_block()method), 1174
(angr.analyses.StackPointerTracker method),configure_project()(angr.simos.SimWindows
823
method), 1176
constant_jump_targets
configure_project()(angr.engines.pcode.lifter.IRSB
property),(angr.simos.userland.SimUserland
method),567
1183
constant_jump_targets_and_jumpkinds
configure_project()(angr.engines.pcode.lifter.IRSB
property),(angr.simos.windows.SimWindows
method),567
1184
ConstantChange (class in angr.analyses.bindiff ), 850
confirmed (angr.analyses.cfg.cfg_fast.FunctionFakeRetEdge
ConstantDepNode (class in angr.analyses.data_dep),
1270

Index

angr

1166
static method), 756
ConstantDepNode(classin ContainerNode (class in angr.utils.graph), 1192
angr.analyses.data_dep.dep_nodes), 1162
contains() (angr.knowledge_plugins.debug_variables.DebugVariable
ConstantDereferencesSimplifier(classinmethod), 735
angr.analyses.decompiler.optimization_passes), contains_addr() (angr.knowledge_plugins.FunctionManager
966
method), 656
ConstantDereferencesSimplifier(classin contains_addr() (angr.knowledge_plugins.functions.function_manager.F
angr.analyses.decompiler.optimization_passes.const_derefs),method), 715
974
contains_addr() (angr.knowledge_plugins.functions.FunctionManager
ConstantOperand (class in angr.analyses.disassembly),
method), 713
1143
contains_atom() (angr.analyses.reaching_definitions.dep_graph.DepGra
ConstantPropagation(classinmethod), 1080
angr.analyses.binary_optimizer), 1154
contains_memory_variable()
ConstantResolver(classin(angr.sim_variable.SimVariableSet method),angr.analyses.cfg.indirect_jump_resolvers),
638
911
contains_register_variable()
ConstantResolver(classin(angr.sim_variable.SimVariableSet method),angr.analyses.cfg.indirect_jump_resolvers.const_resolver), 638
904
content (angr.analyses.reaching_definitions.subject.Subject
constants (angr.engines.pcode.lifter.IRSB property),
property), 1098
567
content (angr.analyses.reassembler.Data property),
ConstantSrc(classin1149
angr.analyses.reaching_definitions), 1052
content (angr.angrdb.models.DbObject attribute), 919
ConstantSrc(classin content (angr.knowledge_plugins.cfg.memory_data.MemoryData
angr.knowledge_plugins.key_definitions.atoms),
attribute), 696
753
content (angr.knowledge_plugins.cfg.MemoryData atConstantValueManager(classintribute), 677
angr.analyses.cfg.indirect_jump_resolvers.jumptable),
content_gen() (angr.storage.memory_mixins.MVListPage
900
method), 434
ConstPropOptReverter(classin content_gen() (angr.storage.memory_mixins.paged_memory.pages.mv_li
angr.analyses.decompiler.optimization_passes),method), 457
971
content_gen() (angr.storage.memory_mixins.paged_memory.pages.MVLi
constrain_all_zero() (angr.analyses.Identifier static
method), 471
method), 817
context (angr.code_location.CodeLocation attribute),
constrain_all_zero()
780(angr.analyses.identifier.identify.Identifier
context (angr.engines.pcode.lifter.PcodeBasicBlockLifter
static method), 1130
attribute), 569
constraint_hook()(inmodule context_sensitivity_levelangr.state_plugins.trace_additions), 340(angr.analyses.cfg.cfg_base.CFGBase
propConstraintGraphNode(classinerty), 882
angr.analyses.typehoon.simple_solver), 1118
context_sensitivity_level
ConstraintGraphTag(classin(angr.analyses.cfg.cfg_emulated.CFGEmulated
angr.analyses.typehoon.simple_solver), 1118
property), 881
constraints (angr.state_plugins.SimSolver property), context_sensitivity_level245(angr.analyses.cfg.CFGBase property), 872
constraints (angr.state_plugins.solver.SimSolver prop- context_sensitivity_levelerty), 323(angr.analyses.cfg.CFGEmulated
property),
constraints_since()
864(angr.state_plugins.history.SimStateHistory
context_sensitivity_level
method), 335(angr.analyses.CFGEmulated
property),
constraints_since()
796(angr.state_plugins.SimStateHistory method), continue_addr (angr.analyses.decompiler.structuring.structurer_nodes.Lo
254
property), 936
construct() (angr.knowledge_plugins.key_definitions.definition.DefinitionMatchPredicate
ContinueNode(class
in
Index

1271

angr

angr.analyses.decompiler.structuring.structurer_nodes),copy() (angr.analyses.decompiler.region_simplifiers.expr_folding.Statemen
936
method), 989
ContinueScanningNotification, 884
copy() (angr.analyses.decompiler.structuring.structurer_nodes.CodeNode
ConvenientMappingsMixin(classinmethod), 934
angr.storage.memory_mixins), 417
copy() (angr.analyses.decompiler.structuring.structurer_nodes.LoopNode
ConvenientMappingsMixin(classinmethod), 936
angr.storage.memory_mixins.convenient_mappings_mixin),
copy() (angr.analyses.decompiler.structuring.structurer_nodes.MultiNode454
method), 933
convert_claripy_bool_ast()copy() (angr.analyses.decompiler.structuring.structurer_nodes.SequenceNo(angr.analyses.decompiler.condition_processor.ConditionProcessor
method), 934
method), 954
copy() (angr.analyses.loop_analysis.LoopAnalysisState
convert_claripy_bool_ast_core()method), 1132
(angr.analyses.decompiler.condition_processor.ConditionProcessor
copy() (angr.analyses.reaching_definitions.call_trace.CallTrace
method), 954
method), 1074
convert_cppproto_to_py()(inmodule copy() (angr.analyses.reaching_definitions.LiveDefinitions
angr.utils.library), 1196
method), 1042
convert_cproto_to_py()(inmodule copy() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsSta
angr.utils.library), 1196
method), 1093
convert_variable_list()copy() (angr.analyses.reaching_definitions.ReachingDefinitionsModel(angr.knowledge_plugins.VariableManager
method), 1058
static method), 665
copy() (angr.analyses.reaching_definitions.ReachingDefinitionsState
convert_variable_list()
method), 1063
(angr.knowledge_plugins.variables.variable_manager.VariableManager
copy() (angr.analyses.stack_pointer_tracker.StackPointerTrackerStatestatic method), 734
method), 1105
convert_variable_list()copy() (angr.analyses.typehoon.typevars.TypeVariables(angr.knowledge_plugins.variables.VariableManager
method), 1125
static method), 726
copy() (angr.analyses.variable_recovery.variable_recovery.VariableRecove
ConvertTo (class in angr.analyses.typehoon.typevars),
method), 1113
1126
copy() (angr.analyses.variable_recovery.variable_recovery_fast.VariableR
CooperationBase(classinmethod), 1111
angr.storage.memory_mixins), 428
copy() (angr.analyses.VFG method), 806
CooperationBase(classin copy() (angr.analyses.vfg.VFG method), 1139
angr.storage.memory_mixins.paged_memory.pages),copy() (angr.concretization_strategies.norepeats.SimConcretizationStrateg
465
method), 496
CooperationBase(classin copy() (angr.concretization_strategies.norepeats_range.SimConcretization
angr.storage.memory_mixins.paged_memory.pages.cooperation),
method), 497475
copy() (angr.concretization_strategies.SimConcretizationStrategy
copy() (angr.analyses.cfg.cfg_base.CFGBase method),
method), 411883
copy() (angr.concretization_strategies.SimConcretizationStrategyNorepeat
copy() (angr.analyses.cfg.cfg_emulated.CFGEmulated
method), 413
method), 879
copy() (angr.concretization_strategies.SimConcretizationStrategyNorepeat
copy() (angr.analyses.cfg.cfg_fast.CFGFast method),
method), 413892
copy() (angr.engines.pcode.lifter.IRSB method), 566
copy() (angr.analyses.cfg.CFGBase method), 872
copy() (angr.keyed_region.KeyedRegion method), 782
copy() (angr.analyses.cfg.CFGEmulated method), 862
copy() (angr.keyed_region.RegionObject method), 781
copy() (angr.analyses.cfg.CFGFast method), 861
copy() (angr.knowledge_plugins.callsite_prototypes.CallsitePrototypes
copy() (angr.analyses.CFGEmulated method), 794
method), 676
copy() (angr.analyses.CFGFast method), 792
copy()(angr.knowledge_plugins.CallsitePrototypes
copy() (angr.analyses.ddg.LiveDefinitions method),
method), 6731025
copy() (angr.knowledge_plugins.cfg.cfg_manager.CFGManager
copy() (angr.analyses.decompiler.graph_region.GraphRegion
method), 697
method), 959
copy() (angr.knowledge_plugins.cfg.cfg_model.CFGModelcopy() (angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILState
method), 689
method), 982
copy() (angr.knowledge_plugins.cfg.cfg_node.CFGENode
1272

Index

angr

method), 700
method), 749
copy() (angr.knowledge_plugins.cfg.cfg_node.CFGNode copy() (angr.knowledge_plugins.key_definitions.uses.Uses
method), 699
method), 775
copy()(angr.knowledge_plugins.cfg.CFGENode copy() (angr.knowledge_plugins.KeyDefinitionManager
method), 680
method), 671
copy()(angr.knowledge_plugins.cfg.CFGManager copy() (angr.knowledge_plugins.KnowledgeBasePlugin
method), 688
method), 669
copy()(angr.knowledge_plugins.cfg.CFGModel copy() (angr.knowledge_plugins.Labels method), 668
method), 682
copy() (angr.knowledge_plugins.labels.Labels method),copy() (angr.knowledge_plugins.cfg.CFGNode method),704679
copy() (angr.knowledge_plugins.patches.PatchManager
copy() (angr.knowledge_plugins.cfg.memory_data.MemoryData
method), 674
method), 696
copy()(angr.knowledge_plugins.PatchManager
copy()(angr.knowledge_plugins.cfg.MemoryData
method), 670
method), 677
copy() (angr.knowledge_plugins.plugin.KnowledgeBasePlugincopy() (angr.knowledge_plugins.CFGManager method),
method), 675668
copy() (angr.knowledge_plugins.PropagationManager
copy() (angr.knowledge_plugins.Comments method),
method), 672667
copy() (angr.knowledge_plugins.propagations.PropagationManager
copy() (angr.knowledge_plugins.comments.Comments
method), 703
method), 704
copy() (angr.knowledge_plugins.structured_code.StructuredCodeManager
copy()(angr.knowledge_plugins.CustomStrings
method), 736
method), 673
copy() (angr.knowledge_plugins.StructuredCodeManager
copy() (angr.knowledge_plugins.Data method), 667
method), 672
copy() (angr.knowledge_plugins.data.Data method), copy()(angr.knowledge_plugins.types.TypesStore704
method), 701copy() (angr.knowledge_plugins.Function method), 665 copy() (angr.knowledge_plugins.TypesStore method),copy()(angr.knowledge_plugins.FunctionManager
672
method), 655
copy()(angr.knowledge_plugins.VariableManager
copy()(angr.knowledge_plugins.functions.Function
method), 665
method), 712
copy() (angr.knowledge_plugins.variables.variable_manager.VariableMan
copy() (angr.knowledge_plugins.functions.function.Function
method), 734
method), 724
copy() (angr.knowledge_plugins.variables.VariableManager
copy() (angr.knowledge_plugins.functions.function_manager.FunctionManager
method), 726
method), 715
copy() (angr.knowledge_plugins.XRefManager method),copy() (angr.knowledge_plugins.functions.FunctionManager
668
method), 713
copy() (angr.knowledge_plugins.xrefs.XRef method),copy() (angr.knowledge_plugins.indirect_jumps.IndirectJumps776
method), 704
copy()(angr.knowledge_plugins.xrefs.xref.XRefcopy()(angr.knowledge_plugins.IndirectJumps
method), 778
method), 667
copy() (angr.knowledge_plugins.xrefs.xref_manager.XRefManager
copy() (angr.knowledge_plugins.key_definitions.key_definition_manager.KeyDefinitionManager
method), 779
method), 760
copy()(angr.knowledge_plugins.xrefs.XRefManager
copy() (angr.knowledge_plugins.key_definitions.KeyDefinitionManager
method), 777
method), 739
copy() (angr.misc.plugins.PluginPreset method), 219
copy() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
copy()(angr.procedures.definitions.SimLibrarymethod), 762
method), 606
copy() (angr.knowledge_plugins.key_definitions.LiveDefinitions
copy() (angr.procedures.definitions.SimSyscallLibrarymethod), 740
method), 610
copy() (angr.knowledge_plugins.key_definitions.rd_model.ReachingDefinitionsModelcopy() (angr.sim_manager.SimulationManager method),
method), 771
500
copy() (angr.knowledge_plugins.key_definitions.ReachingDefinitionsModelcopy() (angr.sim_state.SimState method), 222
method), 738
copy()(angr.sim_state_options.SimStateOptions
copy() (angr.knowledge_plugins.key_definitions.Uses
method), 226
Index

1273

angr

copy() (angr.sim_type.SimCppClass method), 651
copy() (angr.sim_type.SimCppClassValue method), 651
copy() (angr.sim_type.SimStruct method), 649
copy() (angr.sim_type.SimStructValue method), 650
copy() (angr.sim_type.SimType method), 639
copy() (angr.sim_type.SimTypeArray method), 645
copy() (angr.sim_type.SimTypeBool method), 643
copy() (angr.sim_type.SimTypeBottom method), 640copy() (angr.sim_type.SimTypeChar method), 642
copy() (angr.sim_type.SimTypeCppFunction method),647
copy() (angr.sim_type.SimTypeDouble method), 649
copy() (angr.sim_type.SimTypeFd method), 643
copy() (angr.sim_type.SimTypeFloat method), 648
copy() (angr.sim_type.SimTypeFunction method), 647
copy() (angr.sim_type.SimTypeInt method), 642
copy() (angr.sim_type.SimTypeLength method), 648
copy() (angr.sim_type.SimTypeNum method), 641
copy() (angr.sim_type.SimTypeNumOffset method), 652
copy() (angr.sim_type.SimTypePointer method), 644
copy() (angr.sim_type.SimTypeReference method), 644
copy() (angr.sim_type.SimTypeReg method), 641
copy() (angr.sim_type.SimTypeString method), 645
copy() (angr.sim_type.SimTypeTop method), 640copy() (angr.sim_type.SimTypeWideChar method), 643
copy() (angr.sim_type.SimTypeWString method), 646
copy() (angr.sim_type.SimUnion method), 650
copy() (angr.sim_type.SimUnionValue method), 650
copy() (angr.sim_type.TypeRef method), 640copy()(angr.sim_variable.SimConstantVariable
method), 634
copy()(angr.sim_variable.SimMemoryVariable
method), 636
copy()(angr.sim_variable.SimRegisterVariable
method), 635
copy() (angr.sim_variable.SimStackVariable method),637
copy()(angr.sim_variable.SimTemporaryVariable
method), 635
copy() (angr.sim_variable.SimVariable method), 634
copy() (angr.sim_variable.SimVariableSet method), 638
copy() (angr.SimFile method), 186copy() (angr.SimFileBase method), 185copy() (angr.SimFileDescriptor method), 195copy() (angr.SimFileDescriptorDuplex method), 197copy() (angr.SimFileStream method), 191copy() (angr.SimHeapBrk method), 200copy() (angr.SimHeapPTMalloc method), 202copy() (angr.SimHostFilesystem method), 199copy() (angr.SimPackets method), 189copy() (angr.SimPacketsStream method), 192copy() (angr.SimState method), 179
copy() (angr.SimStatePlugin method), 151
copy() (angr.SimulationManager method), 1681274

copy() (angr.state_plugins.CallStack method), 266
copy() (angr.state_plugins.callstack.CallStack method),329
copy() (angr.state_plugins.cgc.SimStateCGC method),337
copy() (angr.state_plugins.Concrete method), 291
copy() (angr.state_plugins.concrete.Concrete method),358
copy() (angr.state_plugins.filesystem.SimConcreteFilesystem
method), 318
copy()(angr.state_plugins.filesystem.SimFilesystem
method), 315
copy() (angr.state_plugins.filesystem.SimHostFilesystem
method), 319
copy() (angr.state_plugins.GDB method), 259
copy() (angr.state_plugins.gdb.GDB method), 337
copy()(angr.state_plugins.globals.SimStateGlobals
method), 344
copy() (angr.state_plugins.heap.heap_base.SimHeapBase
method), 371
copy() (angr.state_plugins.heap.heap_brk.SimHeapBrk
method), 371
copy() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
method), 377
copy() (angr.state_plugins.heap.SimHeapBase method),363
copy() (angr.state_plugins.heap.SimHeapBrk method),364
copy()(angr.state_plugins.heap.SimHeapPTMalloc
method), 367
copy()(angr.state_plugins.history.SimStateHistory
method), 334
copy()(angr.state_plugins.inspect.SimInspector
method), 301
copy() (angr.state_plugins.javavm_classloader.SimJavaVmClassloader
method), 360
copy() (angr.state_plugins.jni_references.SimStateJNIReferences
method), 362
copy() (angr.state_plugins.libc.SimStateLibc method),304
copy() (angr.state_plugins.light_registers.SimLightRegisters
method), 332
copy() (angr.state_plugins.log.SimStateLog method),328
copy() (angr.state_plugins.loop_data.SimStateLoopData
method), 358
copy()(angr.state_plugins.plugin.SimStatePlugin
method), 298
copy() (angr.state_plugins.posix.PosixDevFS method),307
copy() (angr.state_plugins.posix.PosixProcFS method),309
copy()(angr.state_plugins.posix.SimSystemPosix
method), 311
Index

angr

copy() (angr.state_plugins.PosixDevFS method), 236
copy() (angr.state_plugins.trace_additions.ChallRespInfo
copy() (angr.state_plugins.PosixProcFS method), 237
method), 340
copy() (angr.state_plugins.preconstrainer.SimStatePreconstrainer
copy() (angr.state_plugins.trace_additions.FormatInfo
method), 348
method), 339
copy()(angr.state_plugins.scratch.SimStateScratch copy() (angr.state_plugins.trace_additions.FormatInfoDontConstrain
method), 346
method), 340
copy()(angr.state_plugins.sim_action.SimAction copy() (angr.state_plugins.trace_additions.FormatInfoIntToStr
method), 595
method), 340
copy() (angr.state_plugins.sim_action_object.SimActionObject
copy() (angr.state_plugins.trace_additions.FormatInfoStrToInt
method), 597
method), 339
copy() (angr.state_plugins.SimAction method), 263
copy() (angr.state_plugins.trace_additions.ZenPlugincopy() (angr.state_plugins.SimActionObject method),
method), 342
265
copy() (angr.state_plugins.uc_manager.SimUCManager
copy() (angr.state_plugins.SimFilesystem method), 281
method), 345
copy() (angr.state_plugins.SimHeapBase method), 284 copy() (angr.state_plugins.Unicorn method), 260copy() (angr.state_plugins.SimHeapBrk method), 284
copy()(angr.state_plugins.unicorn_engine.Unicorn
copy() (angr.state_plugins.SimHeapPTMalloc method),
method), 355287
copy() (angr.state_plugins.view.SimMemView method),copy() (angr.state_plugins.SimHostFilesystem method),389283
copy()(angr.state_plugins.view.SimRegNameView
copy() (angr.state_plugins.SimInspector method), 232
method), 385
copy()(angr.state_plugins.SimJavaVmClassloader copy() (angr.storage.file.SimFile method), 394
method), 295
copy() (angr.storage.file.SimFileBase method), 392
copy() (angr.state_plugins.SimLightRegisters method), copy() (angr.storage.file.SimFileDescriptor method),249404
copy() (angr.state_plugins.SimMemView method), 278
copy()(angr.storage.file.SimFileDescriptorDuplex
copy() (angr.state_plugins.SimRegNameView method),
method), 406274
copy() (angr.storage.file.SimFileStream method), 396
copy() (angr.state_plugins.SimSolver method), 244
copy() (angr.storage.file.SimPackets method), 398
copy() (angr.state_plugins.SimStateCGC method), 257
copy() (angr.storage.file.SimPacketsSlots method), 408
copy() (angr.state_plugins.SimStateGlobals method), copy() (angr.storage.file.SimPacketsStream method),270400
copy() (angr.state_plugins.SimStateHistory method), copy() (angr.storage.memory_mixins.address_concretization_mixin.Addres
253
method), 451
copy()(angr.state_plugins.SimStateJNIReferences copy() (angr.storage.memory_mixins.AddressConcretizationMixin
method), 293
method), 415
copy() (angr.state_plugins.SimStateLibc method), 230
copy() (angr.storage.memory_mixins.ClemoryBackerMixin
copy() (angr.state_plugins.SimStateLog method), 250
method), 423
copy() (angr.state_plugins.SimStateLoopData method), copy() (angr.storage.memory_mixins.convenient_mappings_mixin.Conveni274
method), 454
copy() (angr.state_plugins.SimStatePlugin method), 227 copy() (angr.storage.memory_mixins.ConvenientMappingsMixin
copy()(angr.state_plugins.SimStatePreconstrainer
method), 417
method), 271
copy() (angr.storage.memory_mixins.default_filler_mixin.ExplicitFillerMix
copy() (angr.state_plugins.SimStateScratch method),
method), 448255
copy() (angr.storage.memory_mixins.default_filler_mixin.SpecialFillerMix
copy() (angr.state_plugins.SimSymbolizer method), 296
method), 447
copy() (angr.state_plugins.SimSystemPosix method), copy() (angr.storage.memory_mixins.DictBackerMixin239
method), 423
copy() (angr.state_plugins.SimUCManager method), copy() (angr.storage.memory_mixins.ExplicitFillerMixin259
method), 418
copy() (angr.state_plugins.solver.SimSolver method), copy() (angr.storage.memory_mixins.HistoryTrackingMixin322
method), 430
copy() (angr.state_plugins.symbolizer.SimSymbolizer copy() (angr.storage.memory_mixins.JavaVmMemoryMixin
method), 380
method), 444
Index

1275

angr

copy() (angr.storage.memory_mixins.KeyValueMemoryMixin
copy() (angr.storage.memory_mixins.PermissionsMixin
method), 443
method), 429
copy() (angr.storage.memory_mixins.label_merger_mixin.LabelMergerMixin
copy()(angr.storage.memory_mixins.RefcountMixin
method), 453
method), 428
copy() (angr.storage.memory_mixins.LabelMergerMixin copy() (angr.storage.memory_mixins.regioned_memory.MemoryRegionMe
method), 419
method), 482
copy() (angr.storage.memory_mixins.ListPage method), copy() (angr.storage.memory_mixins.regioned_memory.region_data.Regio431
method), 489
copy() (angr.storage.memory_mixins.MemoryRegionMetaMixin
copy() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin
method), 440
method), 491
copy() (angr.storage.memory_mixins.multi_value_merger_mixin.MultiValueMergerMixin
copy() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin
method), 459
method), 491
copy() (angr.storage.memory_mixins.MultiValueMergerMixin
copy() (angr.storage.memory_mixins.regioned_memory.regioned_address_
method), 420
method), 493
copy()(angr.storage.memory_mixins.MVListPage copy() (angr.storage.memory_mixins.regioned_memory.regioned_memory
method), 432
method), 485copy() (angr.storage.memory_mixins.MVListPagesMixin copy() (angr.storage.memory_mixins.regioned_memory.RegionedAddressC
method), 427
method), 484
copy() (angr.storage.memory_mixins.paged_memory.page_backer_mixins.ClemoryBackerMixin
copy() (angr.storage.memory_mixins.regioned_memory.RegionedMemoryM
method), 464
method), 480
copy() (angr.storage.memory_mixins.paged_memory.page_backer_mixins.DictBackerMixin
copy() (angr.storage.memory_mixins.RegionedAddressConcretizationMixin
method), 464
method), 442
copy() (angr.storage.memory_mixins.paged_memory.paged_memory_mixin.MVListPagesMixin
copy() (angr.storage.memory_mixins.RegionedMemoryMixin
method), 463
method), 438
copy() (angr.storage.memory_mixins.paged_memory.paged_memory_mixin.PagedMemoryMixin
copy() (angr.storage.memory_mixins.size_resolution_mixin.SizeConcretiza
method), 460
method), 450
copy() (angr.storage.memory_mixins.paged_memory.pages.history_tracking_mixin.HistoryTrackingMixin
copy() (angr.storage.memory_mixins.SizeConcretizationMixin
method), 474
method), 421
copy() (angr.storage.memory_mixins.paged_memory.pages.HistoryTrackingMixin
copy() (angr.storage.memory_mixins.slotted_memory.SlottedMemoryMixin
method), 467
method), 494
copy() (angr.storage.memory_mixins.paged_memory.pages.list_page.ListPage
copy() (angr.storage.memory_mixins.SlottedMemoryMixin
method), 476
method), 436
copy() (angr.storage.memory_mixins.paged_memory.pages.ListPage
copy() (angr.storage.memory_mixins.SpecialFillerMixin
method), 468
method), 418
copy() (angr.storage.memory_mixins.paged_memory.pages.mv_list_page.MVListPage
copy() (angr.storage.memory_mixins.StackAllocationMixin
method), 455
method), 427
copy() (angr.storage.memory_mixins.paged_memory.pages.MVListPage
copy() (angr.storage.memory_mixins.top_merger_mixin.TopMergerMixin
method), 470
method), 459
copy() (angr.storage.memory_mixins.paged_memory.pages.permissions_mixin.PermissionsMixin
copy() (angr.storage.memory_mixins.TopMergerMixin
method), 474
method), 422
copy() (angr.storage.memory_mixins.paged_memory.pages.PermissionsMixin
copy()(angr.storage.memory_mixins.UltraPage
method), 467
method), 434
copy() (angr.storage.memory_mixins.paged_memory.pages.refcount_mixin.RefcountMixin
copy() (angr.storage.memory_mixins.underconstrained_mixin.Underconstr
method), 473
method), 449
copy() (angr.storage.memory_mixins.paged_memory.pages.RefcountMixin
copy() (angr.storage.memory_mixins.UnderconstrainedMixin
method), 466
method), 422
copy() (angr.storage.memory_mixins.paged_memory.pages.ultra_page.UltraPagecopy() (angr.storage.SimFile method), 383
method), 477
copy() (angr.utils.cowdict.ChainMapCOW method),copy() (angr.storage.memory_mixins.paged_memory.pages.UltraPage1190
method), 472
copy_contents() (angr.storage.memory_mixins.paged_memory.paged_me
copy() (angr.storage.memory_mixins.paged_memory.stack_allocation_mixin.StackAllocationMixin
method), 462
method), 465
copy_contents() (angr.storage.memory_mixins.PagedMemoryMixin
copy() (angr.storage.memory_mixins.PagedMemoryMixin
method), 426
method), 424
copy_contents() (angr.storage.memory_mixins.unwrapper_mixin.Unwra
1276

Index

angr

method), 454
CrossJumpReverter(classin
copy_contents() (angr.storage.memory_mixins.UnwrapperMixin angr.analyses.decompiler.optimization_passes),method), 422968
copy_graph()(angr.analyses.decompiler.Clinic cs_operand (angr.analyses.disassembly.Operand propmethod), 943
erty), 1143
copy_graph() (angr.analyses.decompiler.clinic.Clinic CStatement (class in angr.analyses.decompiler.structured_codegen.c),method), 953
1004
copy_graph()(inmodule CStatements(classinangr.analyses.decompiler.utils), 1023
angr.analyses.decompiler.structured_codegen.c),
CouldNotResolveException, 1105
1005
count (angr.state_plugins.unicorn_engine.TRANSMIT_RECORD
CStructField(classin
attribute), 350
angr.analyses.decompiler.structured_codegen.c),count() (angr.exploration_techniques.spiller.PickledStatesDb
1010
method), 528
CStructFieldNameDef(classincount() (angr.state_plugins.history.TreeIter method),angr.analyses.decompiler.structured_codegen.c),336
1016
count() (angr.storage.memory_mixins.paged_memory.pages.multi_values.MultiValues
CStructuredCodeGenerator(classinmethod), 458
angr.analyses.decompiler), 940
cprotos2py() (in module angr.utils.library), 1196
CStructuredCodeGenerator(classincrash_windup() (angr.exploration_techniques.Tracer
angr.analyses.decompiler.structured_codegen),class method), 512998
crash_windup() (angr.exploration_techniques.tracer.Tracer
CStructuredCodeGenerator(classinclass method), 533
angr.analyses.decompiler.structured_codegen.c),create_extract_vtable()1016(angr.analyses.vtable.VtableFinder method), CStructuredCodeWalker(classin1140
angr.analyses.decompiler.structured_codegen),create_extract_vtable()999(angr.analyses.VtableFinder method), 830
CStructuredCodeWalker(classincreate_jump_target_var()angr.analyses.decompiler.structured_codegen.c),(angr.analyses.decompiler.condition_processor.ConditionProcessor
1018
method), 954
cstyle_ifs (angr.analyses.decompiler.structured_codegen.c.CIfBreakcreate_merged_subgraph()attribute), 1007
(angr.analyses.decompiler.optimization_passes.DuplicationReverter
cstyle_ifs (angr.analyses.decompiler.structured_codegen.c.CIfElse
method), 973
attribute), 1006
create_new_reference()
CSwitchCase(classin(angr.state_plugins.jni_references.SimStateJNIReferences angr.analyses.decompiler.structured_codegen.c),method), 362
1007
create_new_reference()
CTypeCast (class in angr.analyses.decompiler.structured_codegen.c),(angr.state_plugins.SimStateJNIReferences1013
method), 292
CUnaryOp (class in angr.analyses.decompiler.structured_codegen.c),creation_failed (angr.knowledge_plugins.cfg.cfg_node.CFGENode1012
property), 700
CUnsupportedStatement(classincreation_failed (angr.knowledge_plugins.cfg.CFGENodeangr.analyses.decompiler.structured_codegen.c),property), 680
1009
creation_failure_info
current_function_address(angr.knowledge_plugins.cfg.cfg_node.CFGENode(angr.state_plugins.CallStackproperty),
attribute), 699
267
creation_failure_info
current_function_address(angr.knowledge_plugins.cfg.CFGENode(angr.state_plugins.callstack.CallStack propattribute), 680
erty), 331
CRegister (class in angr.analyses.decompiler.structured_codegen.c),current_function_address()
1015(angr.analyses.reaching_definitions.call_trace.CallTrace
CReturn (class in angr.analyses.decompiler.structured_codegen.c), method), 1073
1009
current_return_target (angr.state_plugins.CallStack
Index

1277

angr

property), 268
data_ptr()(angr.state_plugins.heap.PTChunkcurrent_return_target
method), 370(angr.state_plugins.callstack.CallStack prop- data_ptr() (angr.state_plugins.PTChunk method), 290erty), 331
data_refs (angr.engines.pcode.lifter.IRSB attribute),
current_stack_pointer565(angr.analyses.cfg.cfg_job_base.CFGJobBase data_size (angr.analyses.decompiler.clinic.DataRefDesc
property), 894
attribute), 951
current_stack_pointer (angr.state_plugins.CallStack data_sub_graph() (angr.analyses.DDG method), 803
property), 268
data_sub_graph() (angr.analyses.ddg.DDG method),current_stack_pointer1028(angr.state_plugins.callstack.CallStack prop- data_type_str (angr.analyses.decompiler.clinic.DataRefDesc
erty), 331
attribute), 951
CustomStrings (class in angr.knowledge_plugins), 673 DataDependencyGraphAnalysis(classinCVariable (class in angr.analyses.decompiler.structured_codegen.c), angr.analyses), 823
1011
DataDependencyGraphAnalysis(classinCVariableField(classinangr.analyses.data_dep), 1164
angr.analyses.decompiler.structured_codegen.c), DataDependencyGraphAnalysis(classin1012
angr.analyses.data_dep.data_dependency_analysis),
CWhileLoop (class in angr.analyses.decompiler.structured_codegen.c),1159
1005
DataGraphError, 915
cyclic (angr.analyses.decompiler.graph_region.GraphRegion
DataGraphMeta(classin
attribute), 959
angr.analyses.datagraph_meta), 915
cyclic_ancestor (angr.analyses.decompiler.graph_region.GraphRegion
DataLabel (class in angr.analyses.reassembler), 1145
attribute), 959
DataNormalizationMixin(classin
cyclomatic_complexity
angr.storage.memory_mixins), 417(angr.knowledge_plugins.Function property), DataNormalizationMixin(classin659
angr.storage.memory_mixins.bvv_conversion_mixin),
cyclomatic_complexity
448(angr.knowledge_plugins.functions.Function
DATAREF_HINTS (angr.analyses.cfg.cfg_fast.CFGJobType
property), 706
attribute), 888
cyclomatic_complexity
DataRefDesc (class in angr.analyses.decompiler.clinic),(angr.knowledge_plugins.functions.function.Function
951
property), 718
db_compatible() (angr.angrdb.AngrDB method), 917
db_compatible() (angr.angrdb.db.AngrDB method),D
918
data (angr.analyses.variable_recovery.engine_base.RichR DbCFGModel (class in angr.angrdb.models), 920
DbComment (class in angr.angrdb.models), 922
attribute), 1114
DbFunction (class in angr.angrdb.models), 921
data (angr.engines.pcode.lifter.Lifter attribute), 568
data (angr.engines.pcode.lifter.PcodeLifter attribute), dbg_comments() (angr.analyses.reassembler.Instruction
method), 1147
570
dbg_draw() (angr.knowledge_plugins.Function method),data (angr.state_plugins.unicorn_engine.TRANSMIT_RECORD
663
attribute), 350
dbg_draw() (angr.knowledge_plugins.FunctionManager
Data (class in angr.analyses.reassembler), 1149
method), 657
Data (class in angr.knowledge_plugins), 667
dbg_draw() (angr.knowledge_plugins.functions.Function
Data (class in angr.knowledge_plugins.data), 704
method), 711
data_addr (angr.analyses.decompiler.clinic.DataRefDesc
dbg_draw()(angr.knowledge_plugins.functions.function.Function
attribute), 951
method),723
data_graph (angr.analyses.DDG property), 802
dbg_draw()(angr.knowledge_plugins.functions.function_manager.Function
data_graph (angr.analyses.ddg.DDG property), 1028
method), 716
data_ptr() (angr.PTChunk method), 205
dbg_draw()(angr.knowledge_plugins.functions.FunctionManager
data_ptr() (angr.state_plugins.heap.heap_freelist.Chunkmethod),714
method), 373
dbg_get_repr()(angr.analyses.decompiler.graph_region.GraphRegion
data_ptr() (angr.state_plugins.heap.heap_ptmalloc.PTChunkstatic method), 960
method), 376
1278

Index

angr

dbg_print() (angr.analyses.decompiler.graph_region.GraphRegion 782
method), 960
dbg_repr() (angr.state_plugins.CallStack method), 269
dbg_print()(angr.knowledge_plugins.Function dbg_repr()(angr.state_plugins.callstack.CallStackmethod), 663
method), 332
dbg_print() (angr.knowledge_plugins.functions.Function dbg_repr_run() (angr.analyses.backward_slice.BackwardSlicemethod), 711
method), 849
dbg_print() (angr.knowledge_plugins.functions.function.Function
dbg_repr_run()(angr.analyses.BackwardSlicemethod), 723
method), 807
dbg_print() (angr.storage.memory_mixins.MemoryRegionMetaMixin
DbInformation (class in angr.angrdb.models), 919
method), 442
DbKnowledgeBase (class in angr.angrdb.models), 920
dbg_print() (angr.storage.memory_mixins.regioned_memory.MemoryRegionMetaMixin
DbLabel (class in angr.angrdb.models), 923
method), 484
DbObject (class in angr.angrdb.models), 919
dbg_print() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.MemoryRegionMetaMixin
DbStructuredCode (class in angr.angrdb.models), 921
method), 492
DbVariableCollection (class in angr.angrdb.models),
dbg_print_irsb()(angr.annocfg.AnnotatedCFG
921
method), 1170
DbXRefs (class in angr.angrdb.models), 922
dbg_print_stack() (angr.sim_state.SimState method), DDG(angr.analyses.analysis.KnownAnalysesPlugin
223
attribute), 833
dbg_print_stack() (angr.SimState method), 180
DDG (class in angr.analyses), 801
dbg_repr() (angr.analyses.backward_slice.BackwardSlice DDG (class in angr.analyses.ddg), 1027
method), 849
DDGJob (class in angr.analyses.ddg), 1025
dbg_repr() (angr.analyses.BackwardSlice method), 807 DDGView (class in angr.analyses.ddg), 1027
dbg_repr() (angr.analyses.cfg.cfb.CFBlanket method), DDGViewInstruction (class in angr.analyses.ddg),874
1027
dbg_repr() (angr.analyses.cfg.CFBlanket method), 868 DDGViewItem (class in angr.analyses.ddg), 1027
dbg_repr() (angr.analyses.DDG method), 802
deactivate()(angr.misc.plugins.PluginPreset
dbg_repr() (angr.analyses.ddg.DDG method), 1028
method), 219
dbg_repr() (angr.analyses.decompiler.Clinic method), dead_ref()(angr.state_hierarchy.StateHierarchy
943
method), 505
dbg_repr()(angr.analyses.decompiler.clinic.Clinic dead_ref() (angr.StateHierarchy method), 176
method), 953
DeadAssignment(classin
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.BaseNodeangr.analyses.binary_optimizer), 1154
method), 933
DeadblockRemover(classin
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.BreakNodeangr.analyses.decompiler.optimization_passes),method), 936
970
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.CodeNodedeadended (angr.sim_manager.SimulationManager atmethod), 934
tribute), 499
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.ConditionalBreakNode
deadended (angr.SimulationManager attribute), 168
method), 937
deadends (angr.analyses.cfg.cfg_emulated.CFGEmulated
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.ConditionNode
property), 881
method), 934
deadends (angr.analyses.cfg.CFGEmulated property),
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.ContinueNode865
method), 936
deadends (angr.analyses.CFGEmulated property), 796
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.LoopNode
debug() (angr.sim_manager.ErrorRecord method), 505
method), 936
DebugVariable(classin
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.MultiNodeangr.knowledge_plugins.debug_variables),method), 933
734
dbg_repr() (angr.analyses.decompiler.structuring.structurer_nodes.SequenceNode
DebugVariableContainer(classinmethod), 934
angr.knowledge_plugins.debug_variables),
dbg_repr() (angr.annocfg.AnnotatedCFG method),734
1170
DebugVariableManager(classin
dbg_repr() (angr.Blade method), 164angr.knowledge_plugins), 666
dbg_repr() (angr.blade.Blade method), 1168
DebugVariableManager(classin
dbg_repr() (angr.keyed_region.KeyedRegion method),angr.knowledge_plugins.debug_variables),
Index

1279

angr

735
default_simtype_from_size()
dec_active_workers()(angr.distributed.Server(angr.analyses.decompiler.structured_codegen.CStructuredCodeG
method), 1205
method), 999
dec_active_workers() (angr.distributed.server.Server DEFAULT_STRUCTURER(inmodulemethod), 1206
angr.analyses.decompiler.structuring), 932
dec_active_workers() (angr.Server method), 206
DefaultChainMapCOW (class in angr.utils.cowdict),
decode_instruction()(inmodule1190
angr.analyses.disassembly_utils), 1145
DefaultFillerMixin(classin
DecodingAssumption(classinangr.storage.memory_mixins), 418
angr.analyses.cfg.cfg_fast), 884
DefaultFillerMixin(classinDecompilationCache(classinangr.storage.memory_mixins.default_filler_mixin),
angr.analyses.decompiler.decompilation_cache),447
955
DefaultListPagesMemory(classinDecompilationOption(classinangr.storage.memory_mixins), 446
angr.analyses.decompiler.decompilation_options),DefaultMemory (class in angr.storage), 385
954
DefaultMemory (class in angr.storage.memory_mixins),
DECOMPILE (angr.analyses.decompiler.clinic.ClinicMode446
attribute), 951
defer_cleanup() (angr.state_hierarchy.StateHierarchy
decompile_functions()(inmodulemethod), 505
angr.analyses.decompiler.utils), 1023
defer_cleanup() (angr.StateHierarchy method), 176
Decompiler (angr.analyses.analysis.KnownAnalysesPlugindefinition (angr.knowledge_plugins.key_definitions.live_definitions.Defin
attribute), 833
attribute), 760
Decompiler (class in angr.analyses), 824
Definition (class in angr.analyses.reaching_definitions),
Decompiler (class in angr.analyses.decompiler), 944
1053
Decompiler (class in angr.analyses.decompiler.decompiler),Definition (class in angr.knowledge_plugins.key_definitions),
955
750
decorate() (angr.analyses.reaching_definitions.function_handler.FunctionCallDataUnwrapped
Definition (class in angr.knowledge_plugins.key_definitions.definition),
static method), 1087
757
default (angr.analyses.decompiler.structured_codegen.c.CSwitchCase
DefinitionAnnotation(classin
attribute), 1007
angr.knowledge_plugins.key_definitions.live_definitions),
default (angr.sim_state_options.StateOption attribute),
760
223
DefinitionMatchPredicate(classin
DEFAULT (angr.state_plugins.sim_action.SimActionExit
angr.knowledge_plugins.key_definitions.definition),
attribute), 595
755
DEFAULT (angr.state_plugins.SimActionExit attribute), definitions (angr.analyses.ddg.DDGViewInstruction
263
property), 1027
default() (angr.angrdb.serializers.loader.LoadArgsJSONEncoder
defs (angr.knowledge_base.KnowledgeBase attribute),
method), 926
654
default_cc() (in module angr), 180
defs (angr.KnowledgeBase attribute), 206
default_cc() (in module angr.calling_conventions), DefUseChain (class in angr.analyses.vsa_ddg), 1139
633
delete() (angr.SimMount method), 199
default_exit_target (angr.engines.pcode.lifter.IRSB delete() (angr.state_plugins.filesystem.SimConcreteFilesystem
attribute), 565
method), 318
default_indirect_jump_resolvers() (in module delete() (angr.state_plugins.filesystem.SimFilesystem
angr.analyses.cfg.indirect_jump_resolvers.default_resolvers),
method), 316
898
delete()(angr.state_plugins.filesystem.SimMountdefault_node (angr.analyses.decompiler.structuring.structurer_nodes.SwitchCaseNodemethod), 317
attribute), 937
delete()(angr.state_plugins.posix.PosixDevFS
default_simtype_from_size()method), 306(angr.analyses.decompiler.CStructuredCodeGenerator
delete()(angr.state_plugins.posix.PosixProcFS
method), 942
method), 308
default_simtype_from_size()
delete() (angr.state_plugins.PosixDevFS method), 234(angr.analyses.decompiler.structured_codegen.c.CStructuredCodeGenerator
delete() (angr.state_plugins.PosixProcFS method), 236
method), 1018
delete() (angr.state_plugins.SimFilesystem method),
1280

Index

angr

282
property), 381
delete() (angr.state_plugins.SimMount method), 283
deref (angr.state_plugins.SimDebugVariable property),
delete_reference() (angr.state_plugins.jni_references.SimStateJNIReferences297
method), 362
deref (angr.state_plugins.SimMemView property), 279
delete_reference() (angr.state_plugins.SimStateJNIReferences
deref (angr.state_plugins.view.SimMemView property),
method), 293
390
delete_uc()(angr.state_plugins.Unicorn
static deref() (angr.analyses.reaching_definitions.LiveDefinitions
method), 262
method), 1048
delete_uc() (angr.state_plugins.unicorn_engine.Unicorn deref() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsS
static method), 356
method), 1097
demangled_name (angr.analyses.decompiler.structured_codegen.c.CFunction
deref() (angr.analyses.reaching_definitions.ReachingDefinitionsState
attribute), 1004
method), 1066
demangled_name(angr.knowledge_plugins.Function deref() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
property), 664
method), 769
demangled_name (angr.knowledge_plugins.functions.Function
deref() (angr.knowledge_plugins.key_definitions.LiveDefinitions
property), 712
method), 747
demangled_name (angr.knowledge_plugins.functions.function.Function
dereference_simtype() (in module angr.sim_type),
property), 723
653
demote() (angr.state_plugins.history.SimStateHistory DerefSize (class in angr.knowledge_plugins.key_definitions),
method), 335
747
demote() (angr.state_plugins.SimStateHistory method), DerefSize (class in angr.knowledge_plugins.key_definitions.live_definitions
253
760
dep_graph (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
DerivedTypeVariable(classinproperty), 1093
angr.analyses.typehoon.typevars), 1124
dep_graph (angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
describe_variables() (angr.state_plugins.SimSolver
property), 1077
method), 243
dep_graph (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
describe_variables()property), 1056
(angr.state_plugins.solver.SimSolver method),
dep_graph (angr.analyses.reaching_definitions.ReachingDefinitionsState
321
property), 1063
DESCRIPTION (angr.analyses.decompiler.optimization_passes.base_ptr_sav
dep_graph (angr.analyses.ReachingDefinitionsAnalysis
attribute), 978property), 819
DESCRIPTION (angr.analyses.decompiler.optimization_passes.BasePointerS
dependents (angr.analyses.ddg.DDGViewItem propattribute), 961
erty), 1027
DESCRIPTION (angr.analyses.decompiler.optimization_passes.CallStatemen
depends() (angr.analyses.reaching_definitions.function_handler.FunctionCallData
attribute), 972
method), 1085
DESCRIPTION (angr.analyses.decompiler.optimization_passes.CodeMotionO
depends() (angr.analyses.reaching_definitions.FunctionCallData attribute), 969
method), 1071
DESCRIPTION (angr.analyses.decompiler.optimization_passes.const_derefs.
depends_on (angr.analyses.ddg.DDGViewItem propattribute), 974erty), 1027
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ConstantDere
DepGraph (class in angr.analyses.reaching_definitions.dep_graph), attribute), 966
1079
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ConstPropOp
DepNodeTypes (class in angr.analyses.data_dep), 1164
attribute), 972
DepNodeTypes(classin DESCRIPTION (angr.analyses.decompiler.optimization_passes.CrossJumpReangr.analyses.data_dep.dep_nodes), 1161
attribute), 968
depth (angr.knowledge_plugins.cfg.cfg_node.CFGENode DESCRIPTION (angr.analyses.decompiler.optimization_passes.DeadblockRe
attribute), 699
attribute), 971
depth (angr.knowledge_plugins.cfg.CFGENode at- DESCRIPTION (angr.analyses.decompiler.optimization_passes.div_simplifier
tribute), 680
attribute), 978depth (angr.state_plugins.sim_action_object.SimActionObject
DESCRIPTION (angr.analyses.decompiler.optimization_passes.DivSimplifier
property), 598
attribute), 963
depth (angr.state_plugins.SimActionObject property), DESCRIPTION (angr.analyses.decompiler.optimization_passes.DuplicationR265
attribute), 972
deref (angr.state_plugins.debug_variables.SimDebugVariable
DESCRIPTION (angr.analyses.decompiler.optimization_passes.expr_op_swa
Index

1281

angr

attribute), 984
attribute), 987
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ExprOpSwapper
DESCRIPTION (angr.analyses.decompiler.peephole_optimizations.base.Peep
attribute), 962
attribute), 986
DESCRIPTION (angr.analyses.decompiler.optimization_passes.FlipBooleanCmp
DESCRIPTION (angr.analyses.decompiler.peephole_optimizations.base.Peep
attribute), 967
attribute), 985
DESCRIPTION (angr.analyses.decompiler.optimization_passes.InlinedStringTransformationSimplifier
description (angr.sim_state_options.StateOption atattribute), 971
tribute), 223
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ite_expr_converter.ITEExprConverter
descriptions (angr.state_plugins.history.SimStateHistory
attribute), 979
property), 335
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ITEExprConverter
descriptions(angr.state_plugins.SimStateHistory
attribute), 962
property), 254
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ITERegionConverter
dest (angr.analyses.reaching_definitions.function_handler.FunctionEffectattribute), 962
attribute), 1083
DESCRIPTION (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.LoweredSwitchSimplifier
destroy() (angr.state_plugins.Unicorn method), 262
attribute), 981
destroy() (angr.state_plugins.unicorn_engine.Unicorn
DESCRIPTION (angr.analyses.decompiler.optimization_passes.LoweredSwitchSimplifier
method), 356
attribute), 963
desymbolize()(angr.analyses.reassembler.Data
DESCRIPTION (angr.analyses.decompiler.optimization_passes.mod_simplifier.ModSimplifier
method), 1149
attribute), 982
determine() (angr.analyses.typehoon.simple_solver.SimpleSolver
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ModSimplifier
method), 1120
attribute), 964
DFS (class in angr.exploration_techniques), 514
DESCRIPTION (angr.analyses.decompiler.optimization_passes.multi_simplifier.MultiSimplifier
DFS (class in angr.exploration_techniques.dfs), 524
attribute), 981
dfs_back_edges() (in module angr.utils.graph), 1191
DESCRIPTION (angr.analyses.decompiler.optimization_passes.MultiSimplifier
dict_content (angr.utils.dynamic_dictlist.DynamicDictList
attribute), 963
attribute), 1190
DESCRIPTION (angr.analyses.decompiler.optimization_passes.optimization_pass.BaseOptimizationPass
dict_strkey_to_intkey()
attribute), 975(angr.angrdb.serializers.structured_code.StructuredCodeManager
DESCRIPTION (angr.analyses.decompiler.optimization_passes.register_save_area_simplifier.RegisterSaveAreaSimplifier
static method), 929
attribute), 984
DictBackerMixin(classin
DESCRIPTION (angr.analyses.decompiler.optimization_passes.RegisterSaveAreaSimplifierangr.storage.memory_mixins), 423
attribute), 966
DictBackerMixin(classin
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier.RetAddrSaveSimplifierangr.storage.memory_mixins.paged_memory.page_backer_mixins
attribute), 984
464
DESCRIPTION (angr.analyses.decompiler.optimization_passes.RetAddrSaveSimplifier
Difference (class in angr.analyses.bindiff ), 850
attribute), 967
difference() (angr.sim_state_options.SimStateOptions
DESCRIPTION (angr.analyses.decompiler.optimization_passes.ReturnDeduplicatormethod), 225
attribute), 968
differing_blocks (angr.analyses.BinDiff property),DESCRIPTION (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorHigh810
attribute), 965
differing_blocks (angr.analyses.bindiff.BinDiff propDESCRIPTION (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorLow
erty), 853
attribute), 965
differing_blocks (angr.analyses.bindiff.FunctionDiff
DESCRIPTION (angr.analyses.decompiler.optimization_passes.stack_canary_simplifier.StackCanarySimplifier
property), 851
attribute), 977
differing_constants()(inmoduleDESCRIPTION (angr.analyses.decompiler.optimization_passes.StackCanarySimplifierangr.analyses.bindiff ), 850
attribute), 961
differing_functions (angr.analyses.BinDiff propDESCRIPTION (angr.analyses.decompiler.optimization_passes.SwitchDefaultCaseDuplicatorerty), 809
attribute), 970
differing_functions (angr.analyses.bindiff.BinDiff
DESCRIPTION (angr.analyses.decompiler.optimization_passes.WinStackCanarySimplifier
property), 853
attribute), 968
differing_functions_with_consts()
DESCRIPTION (angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier.X86GccGetPcSimplifier(angr.analyses.BinDiff method), 809
attribute), 985
differing_functions_with_consts()
DESCRIPTION (angr.analyses.decompiler.optimization_passes.X86GccGetPcSimplifier(angr.analyses.bindiff.BinDiff method), 853
attribute), 967
direct_next (angr.engines.pcode.lifter.IRSB property),DESCRIPTION (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationExprBase
567
1282

Index

angr

Director (class in angr.exploration_techniques), 516
discard_plugin_preset()
Director (class in angr.exploration_techniques.director),(angr.misc.plugins.PluginHub method), 218
536
discard_register_variable()dirty (angr.analyses.decompiler.structured_codegen.c.CDirtyExpression(angr.sim_variable.SimVariableSet method),attribute), 1016
638
dirty (angr.analyses.decompiler.structured_codegen.c.CDirtyStatement
display_name (angr.analyses.data_dep.dep_nodes.VarDepNode
attribute), 1009
property), 1163
DirtyAddrsMixin(classin display_name (angr.analyses.data_dep.VarDepNodeangr.storage.memory_mixins), 418
property), 1165
DirtyAddrsMixin(classin dissect_instruction()angr.storage.memory_mixins.dirty_addrs_mixin),(angr.analyses.disassembly.Instruction
451
method), 1142
disable_profiling()(inmodule dissect_instruction_by_default()
angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast), (angr.analyses.disassembly.Instruction
896
method), 1142
disable_timing()(inmodule dissect_instruction_for_arm()
angr.state_plugins.solver), 320(angr.analyses.disassembly.Instruction
DisassemblerBlock (class in angr.block), 215
method), 1142
DisassemblerInsn (class in angr.block), 216
DivSimplifier(classin
Disassembly (angr.analyses.analysis.KnownAnalysesPluginangr.analyses.decompiler.optimization_passes),
attribute), 833
963
disassembly (angr.Block property), 166
DivSimplifier(classindisassembly (angr.block.Block property), 217
angr.analyses.decompiler.optimization_passes.div_simplifier),
disassembly (angr.engines.pcode.lifter.IRSB property),
978567
DivSimplifierAILEngine(classin
Disassembly (class in angr.analyses), 814
angr.analyses.decompiler.optimization_passes.div_simplifier),
Disassembly (class in angr.analyses.disassembly), 1144
978
DisassemblyPiece(classin do_full_xrefs() (angr.analyses.cfg.cfg_fast.CFGFast
angr.analyses.disassembly), 1141
method), 892
discard() (angr.knowledge_plugins.structured_code.StructuredCodeManager
do_full_xrefs() (angr.analyses.cfg.CFGFast method),
method), 736
860
discard() (angr.knowledge_plugins.StructuredCodeManager
do_full_xrefs() (angr.analyses.CFGFast method),
method), 672
792
discard()(angr.sim_state_options.SimStateOptions do_preprocess() (in module angr.sim_type), 652
method), 225
do_trace() (angr.analyses.Identifier method), 817
discard() (angr.sim_variable.SimVariableSet method), do_trace() (angr.analyses.identifier.identify.Identifier
638
method), 1131
discard_by_prefix()dom (angr.utils.graph.Dominators attribute), 1193
(angr.knowledge_plugins.PropagationManager dominance_frontiers
method), 672(angr.analyses.variable_recovery.variable_recovery_base.Variabl
discard_by_prefix()
property), 1109
(angr.knowledge_plugins.propagations.PropagationManager
DominanceFrontier (class in angr.analyses), 823
method), 703
DominanceFrontier(classindiscard_input() (angr.state_plugins.cgc.SimStateCGC
angr.analyses.dominance_frontier), 1155
method), 338
dominates() (in module angr.utils.graph), 1192
discard_input()(angr.state_plugins.SimStateCGC Dominators (class in angr.utils.graph), 1192
method), 257
done (angr.analyses.vfg.AnalysisTask property), 1135
discard_memory_variable()done (angr.analyses.vfg.CallAnalysis property), 1136
(angr.sim_variable.SimVariableSet method), done (angr.analyses.vfg.FunctionAnalysis property),638
1135
discard_output() (angr.state_plugins.cgc.SimStateCGC DoNotUpdate (angr.analyses.calling_convention.UpdateArgumentsOption
method), 338
attribute), 854
discard_output() (angr.state_plugins.SimStateCGC Double (class in angr.analyses.typehoon.typeconsts),
method), 257
1128
Index

1283

angr

dowhile_known_tail_nodes
angr.exploration_techniques.driller_core),(angr.analyses.decompiler.structuring.phoenix.PhoenixStructurer
533
attribute), 940
DROP (angr.sim_manager.SimulationManager attribute),
downsize() (angr.analyses.cfg.cfg_emulated.CFGEmulated499
method), 879
DROP (angr.SimulationManager attribute), 168
downsize() (angr.analyses.cfg.CFGEmulated method), drop() (angr.sim_manager.SimulationManager method),863
503
downsize() (angr.analyses.CFGEmulated method), 794 drop() (angr.SimulationManager method), 172
downsize() (angr.analyses.forward_analysis.forward_analysis.ForwardAnalysis
dst (angr.engines.pcode.lifter.ExitStatement attribute),
method), 840
563
downsize() (angr.analyses.forward_analysis.ForwardAnalysis
dst (angr.knowledge_plugins.xrefs.XRef attribute), 776
method), 835
dst (angr.knowledge_plugins.xrefs.xref.XRef attribute),
downsize() (angr.analyses.ForwardAnalysis method),778
788
dst_addr (angr.analyses.cfg.cfg_fast.FunctionCallEdge
downsize() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
attribute), 887
method), 1097
dst_addr (angr.analyses.cfg.cfg_fast.FunctionFakeRetEdge
downsize() (angr.analyses.reaching_definitions.ReachingDefinitionsState
attribute), 887
method), 1066
dst_addr (angr.analyses.cfg.cfg_fast.FunctionTransitionEdge
downsize() (angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase
attribute), 887
method), 1110
dst_func_addr (angr.analyses.cfg.cfg_fast.FunctionReturnEdge
downsize() (angr.analyses.variable_recovery.variable_recovery_fast.VariableRecoveryFastState
attribute), 887
method), 1111
dst_func_addr (angr.analyses.cfg.cfg_fast.FunctionTransitionEdge
downsize() (angr.knowledge_plugins.cfg.cfg_node.CFGENode
attribute), 887
method), 700
dst_type (angr.analyses.decompiler.structured_codegen.c.CTypeCast
downsize() (angr.knowledge_plugins.cfg.CFGENode
attribute), 1014
method), 680
dummy (angr.analyses.reaching_definitions.Definition atdownsize() (angr.knowledge_plugins.propagations.PropagationModeltribute), 1053
method), 703
dummy (angr.knowledge_plugins.key_definitions.Definition
downsize() (angr.sim_state.SimState method), 222
attribute), 750
downsize() (angr.SimState method), 178
dummy (angr.knowledge_plugins.key_definitions.definition.Definition
downsize() (angr.state_plugins.inspect.SimInspector
attribute), 758
method), 301
DummyStructuredCodeGenerator(classindownsize() (angr.state_plugins.sim_action.SimAction
angr.analyses.decompiler.structured_codegen),method), 595
1000
downsize() (angr.state_plugins.sim_action.SimActionDataDummyStructuredCodeGenerator(classinmethod), 596
angr.analyses.decompiler.structured_codegen.dummy),
downsize() (angr.state_plugins.SimAction method), 263
1020
downsize()(angr.state_plugins.SimActionData dump() (angr.angrdb.AngrDB method), 917
method), 264
dump() (angr.angrdb.db.AngrDB method), 919
downsize() (angr.state_plugins.SimInspector method), dump() (angr.angrdb.serializers.cfg_model.CFGModelSerializer
233
static method), 924
downsize() (angr.state_plugins.SimSolver method), 245 dump() (angr.angrdb.serializers.comments.CommentsSerializer
downsize()(angr.state_plugins.solver.SimSolver
static method), 925
method), 323
dump() (angr.angrdb.serializers.funcs.FunctionManagerSerializer
downsize_region() (angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBasestatic method), 925
static method), 1110
dump() (angr.angrdb.serializers.kb.KnowledgeBaseSerializer
DreamStructurer(classinstatic method), 925
angr.analyses.decompiler.structuring), 930
dump() (angr.angrdb.serializers.KnowledgeBaseSerializer
DreamStructurer(classinstatic method), 924
angr.analyses.decompiler.structuring.dream),dump() (angr.angrdb.serializers.labels.LabelsSerializer
932
static method), 926
DrillerCore (class in angr.exploration_techniques), dump() (angr.angrdb.serializers.loader.LoaderSerializer
509
static method), 928
DrillerCore(classin dump() (angr.angrdb.serializers.LoaderSerializer static
1284

Index

angr

method), 924
1190
dump() (angr.angrdb.serializers.structured_code.StructuredCodeManagerSerializerEstatic method), 929
dump() (angr.angrdb.serializers.variables.VariableManagerSerializer
E2BIG (angr.state_plugins.posix.SimSystemPosix atstatic method), 929
tribute), 310
dump()(angr.angrdb.serializers.xrefs.XRefsSerializer E2BIG (angr.state_plugins.SimSystemPosix attribute), 238
static method), 928
EACCES (angr.state_plugins.posix.SimSystemPosix atdump() (angr.calling_conventions.AllocHelper method),
tribute), 310
614
EACCES (angr.state_plugins.SimSystemPosix attribute),
dump_file_by_path()
238(angr.state_plugins.posix.SimSystemPosix
EAGAIN (angr.state_plugins.posix.SimSystemPosix atmethod), 313
tribute), 310
dump_file_by_path()
EAGAIN (angr.state_plugins.SimSystemPosix attribute),(angr.state_plugins.SimSystemPosix method),
238
241
EBADF (angr.state_plugins.cgc.SimStateCGC attribute),
dump_graph() (angr.analyses.decompiler.structuring.phoenix.PhoenixStructurer
337
static method), 940
EBADF (angr.state_plugins.posix.SimSystemPosix atdump_graph() (angr.analyses.decompiler.structuring.PhoenixStructurer
tribute), 310
static method), 931
EBADF (angr.state_plugins.SimStateCGC attribute), 256
dump_internal() (angr.angrdb.serializers.variables.VariableManagerSerializer
EBADF (angr.state_plugins.SimSystemPosix attribute), 238
static method), 929
EBUSY (angr.state_plugins.posix.SimSystemPosix atdumps()(angr.state_plugins.posix.SimSystemPosix
tribute), 310
method), 313
EBUSY (angr.state_plugins.SimSystemPosix attribute), 238
dumps() (angr.state_plugins.SimSystemPosix method), ECHILD (angr.state_plugins.posix.SimSystemPosix at242
tribute), 310
dumps() (angr.vaults.Vault method), 785
ECHILD (angr.state_plugins.SimSystemPosix attribute),
DUPLICATION_CHECK (angr.analyses.decompiler.structured_codegen.base.PositionMapping238
attribute), 1001
edges_to_repair (angr.knowledge_plugins.cfg.cfg_model.CFGModelDUPLICATION_CHECK (angr.analyses.decompiler.structured_codegen.PositionMapping
attribute), 689
attribute), 998
edges_to_repair (angr.knowledge_plugins.cfg.CFGModel
DuplicationReverter(classin
attribute), 682
angr.analyses.decompiler.optimization_passes), EDOM
(angr.state_plugins.posix.SimSystemPosix
at972
tribute), 311
DURING_REGION_IDENTIFICATIONEDOM (angr.state_plugins.SimSystemPosix attribute), 239(angr.analyses.decompiler.optimization_passes.optimization_pass.OptimizationPassStageEEXIST (angr.state_plugins.posix.SimSystemPosix atattribute), 975
tribute), 310
DURING_REGION_IDENTIFICATIONEEXIST (angr.state_plugins.SimSystemPosix attribute),(angr.analyses.decompiler.optimization_passes.OptimizationPassStage
238
attribute), 961
EFAULT (angr.state_plugins.cgc.SimStateCGC attribute),
dwarf_cfa (angr.state_plugins.debug_variables.SimDebugVariablePlugin
337
property), 382
EFAULT (angr.state_plugins.posix.SimSystemPosix atdwarf_cfa (angr.state_plugins.SimDebugVariablePlugin
tribute), 310
property), 298
EFAULT (angr.state_plugins.SimStateCGC attribute), 256
dwarf_cfa_approx (angr.state_plugins.debug_variables.SimDebugVariablePlugin
EFAULT (angr.state_plugins.SimSystemPosix attribute),
property), 382
238
dwarf_cfa_approx (angr.state_plugins.SimDebugVariablePlugin
EFBIG (angr.state_plugins.posix.SimSystemPosix atproperty), 298
tribute), 311
DYNAMIC_RET(angr.sim_procedure.SimProcedure EFBIG (angr.state_plugins.SimSystemPosix attribute), 239
attribute), 601
effects (angr.analyses.reaching_definitions.function_handler.FunctionCal
DYNAMIC_RET (angr.SimProcedure attribute), 149
attribute), 1085
dynamic_returns() (angr.sim_procedure.SimProcedure effects (angr.analyses.reaching_definitions.FunctionCallData
method), 602
attribute), 1071
dynamic_returns() (angr.SimProcedure method), 149 EINTR (angr.state_plugins.posix.SimSystemPosix atDynamicDictList (class in angr.utils.dynamic_dictlist),
tribute), 310
Index

1285

angr

EINTR (angr.state_plugins.SimSystemPosix attribute), 238
angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast),
EINVAL (angr.state_plugins.cgc.SimStateCGC attribute),
896
337
enable_timing()(inmodule
EINVAL (angr.state_plugins.posix.SimSystemPosix atangr.state_plugins.solver), 320
tribute), 310
end (angr.keyed_region.RegionObject property), 781
EINVAL (angr.state_plugins.SimStateCGC attribute), 256 end_info_hook()(inmodule
EINVAL (angr.state_plugins.SimSystemPosix attribute),
angr.state_plugins.trace_additions), 340
239
endness (angr.analyses.reaching_definitions.MemoryLocation
EIO (angr.state_plugins.posix.SimSystemPosix attribute),
attribute), 1052
310
endness (angr.knowledge_plugins.key_definitions.atoms.MemoryLocation
EIO (angr.state_plugins.SimSystemPosix attribute), 238
attribute), 755
EISDIR (angr.state_plugins.posix.SimSystemPosix at- endness (angr.storage.memory_object.SimMemoryObject
tribute), 310
attribute), 410
EISDIR (angr.state_plugins.SimSystemPosix attribute), endness (angr.storage.SimMemoryObject attribute), 384
239
endpoints (angr.knowledge_plugins.Function property),
ELFHeader (angr.knowledge_plugins.cfg.memory_data.MemoryDataSort
660
attribute), 695
endpoints (angr.knowledge_plugins.functions.Function
ELFHeader (angr.knowledge_plugins.cfg.MemoryDataSort
property), 708
attribute), 676
endpoints (angr.knowledge_plugins.functions.function.Function
eliminatable (angr.analyses.cfg.indirect_jump_resolvers.jumptable.RegOffsetAnnotation
property), 720
property), 901
endpoints_with_type
eliminatable (angr.analyses.data_dep.data_dependency_analysis.NodalAnnotation(angr.knowledge_plugins.Function property),
property), 1159
660
eliminatable (angr.analyses.variable_recovery.annotations.StackLocationAnnotation
endpoints_with_type
property), 1106
(angr.knowledge_plugins.functions.Function
eliminatable (angr.analyses.variable_recovery.annotations.VariableSourceAnnotation
property), 708
property), 1106
endpoints_with_type
eliminatable (angr.analyses.variable_recovery.variable_recovery_base.VariableAnnotation(angr.knowledge_plugins.functions.function.Function
property), 1107
property), 720
eliminatable (angr.knowledge_plugins.key_definitions.live_definitions.DefinitionAnnotation
ENFILE (angr.state_plugins.posix.SimSystemPosix atproperty), 760
tribute), 310
eliminatable (angr.storage.memory_mixins.address_concretization_mixin.MultiwriteAnnotation
ENFILE (angr.state_plugins.SimSystemPosix attribute),
property), 451
239
else_node (angr.analyses.decompiler.structured_codegen.c.CIfElse
ENODEV (angr.state_plugins.posix.SimSystemPosix atattribute), 1006
tribute), 310
else_node (angr.analyses.decompiler.structuring.structurer_nodes.CascadingConditionNode
ENODEV (angr.state_plugins.SimSystemPosix attribute),
attribute), 935
239
EMFILE (angr.state_plugins.posix.SimSystemPosix at- ENOENT (angr.state_plugins.posix.SimSystemPosix attribute), 310
tribute), 310
EMFILE (angr.state_plugins.SimSystemPosix attribute), ENOENT (angr.state_plugins.SimSystemPosix attribute),
239
238
EMLINK (angr.state_plugins.posix.SimSystemPosix at- ENOEXEC (angr.state_plugins.posix.SimSystemPosix attribute), 311
tribute), 310
EMLINK (angr.state_plugins.SimSystemPosix attribute), ENOEXEC (angr.state_plugins.SimSystemPosix attribute),
239
238
Empty (angr.analyses.proximity_graph.ProxiNodeTypes ENOMEM (angr.state_plugins.cgc.SimStateCGC attribute),
attribute), 1157
337
empty_block() (angr.engines.pcode.lifter.IRSB static ENOMEM (angr.state_plugins.posix.SimSystemPosix atmethod), 566
tribute), 310
EmptyBlockNotice, 933
ENOMEM (angr.state_plugins.SimStateCGC attribute), 256
EmptyNodeRemover(classin ENOMEM (angr.state_plugins.SimSystemPosix attribute),
angr.analyses.decompiler.empty_node_remover),238
957
ENOSPC (angr.state_plugins.posix.SimSystemPosix atenable_profiling()(inmoduletribute), 311
1286

Index

angr

ENOSPC (angr.state_plugins.SimSystemPosix attribute), ENXIO (angr.state_plugins.SimSystemPosix attribute), 238239
eof() (angr.SimFileDescriptor method), 194
ENOSYS (angr.state_plugins.cgc.SimStateCGC attribute), eof() (angr.SimFileDescriptorDuplex method), 197
337
eof() (angr.storage.file.SimFileDescriptor method), 403
ENOSYS (angr.state_plugins.SimStateCGC attribute), 256 eof() (angr.storage.file.SimFileDescriptorBase method),
ENOTBLK (angr.state_plugins.posix.SimSystemPosix at402
tribute), 310
eof()(angr.storage.file.SimFileDescriptorDuplex
ENOTBLK (angr.state_plugins.SimSystemPosix attribute),
method), 406
238
EPERM (angr.state_plugins.posix.SimSystemPosix atENOTDIR (angr.state_plugins.posix.SimSystemPosix attribute), 310
tribute), 310
EPERM (angr.state_plugins.SimSystemPosix attribute), 238
ENOTDIR (angr.state_plugins.SimSystemPosix attribute), EPIPE (angr.state_plugins.cgc.SimStateCGC attribute),
239
337
ENOTTY (angr.state_plugins.posix.SimSystemPosix at- EPIPE (angr.state_plugins.posix.SimSystemPosix attribute), 310
tribute), 311
ENOTTY (angr.state_plugins.SimSystemPosix attribute), EPIPE (angr.state_plugins.SimStateCGC attribute), 256
239
EPIPE (angr.state_plugins.SimSystemPosix attribute), 239
entry_node_addr (angr.analyses.decompiler.optimization_passes.base_ptr_save_simplifier.BasePointerSaveSimplifier
EQ (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.C
attribute), 978attribute), 993
entry_node_addr (angr.analyses.decompiler.optimization_passes.const_derefs.ConstantDereferencesSimplifier
Eq (class in angr.analyses.stack_pointer_tracker), 1103
attribute), 975
Equal (angr.analyses.loop_analysis.Condition attribute),
entry_node_addr (angr.analyses.decompiler.optimization_passes.div_simplifier.DivSimplifier
1132
attribute), 978equivalence (angr.knowledge_plugins.propagations.PropagationModel
entry_node_addr (angr.analyses.decompiler.optimization_passes.ite_expr_converter.ITEExprConverter
attribute), 702
attribute), 979
Equivalence (class in angr.analyses.typehoon.typevars),
entry_node_addr (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.LoweredSwitchSimplifier
1122
attribute), 981
ERANGE (angr.state_plugins.posix.SimSystemPosix atentry_node_addr (angr.analyses.decompiler.optimization_passes.mod_simplifier.ModSimplifier
tribute), 311
attribute), 982
ERANGE (angr.state_plugins.SimSystemPosix attribute),
entry_node_addr (angr.analyses.decompiler.optimization_passes.multi_simplifier.MultiSimplifier239
attribute), 981
erase()(angr.storage.memory_mixins.ListPage
entry_node_addr (angr.analyses.decompiler.optimization_passes.register_save_area_simplifier.RegisterSaveAreaSimplifier
method), 431
attribute), 984
erase()(angr.storage.memory_mixins.MVListPage
entry_node_addr (angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier.RetAddrSaveSimplifier
method), 433
attribute), 985
erase() (angr.storage.memory_mixins.paged_memory.paged_memory_mix
entry_node_addr (angr.analyses.decompiler.optimization_passes.stack_canary_simplifier.StackCanarySimplifier
method), 460
attribute), 977
erase() (angr.storage.memory_mixins.paged_memory.pages.list_page.List
entry_node_addr (angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier.X86GccGetPcSimplifier
method), 476
attribute), 985
erase() (angr.storage.memory_mixins.paged_memory.pages.ListPage
entry_state()(angr.factory.AngrObjectFactory
method), 468
method), 213erase() (angr.storage.memory_mixins.paged_memory.pages.mv_list_page.
entrypoints (angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceToSink
method), 456
property), 1101
erase() (angr.storage.memory_mixins.paged_memory.pages.MVListPage
entrypoints (angr.analyses.cfg_slice_to_sink.CFGSliceToSink
method), 470
property), 1099
erase() (angr.storage.memory_mixins.PagedMemoryMixin
environment (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
method), 424
property), 1093
EROFS (angr.state_plugins.posix.SimSystemPosix atenvironment (angr.analyses.reaching_definitions.ReachingDefinitionsStatetribute), 311
property), 1063
EROFS (angr.state_plugins.SimSystemPosix attribute), 239
Environment(classin errno (angr.state_plugins.libc.SimStateLibc property),
angr.knowledge_plugins.key_definitions.environment),
306
758
errno (angr.state_plugins.SimStateLibc property), 232
ENXIO (angr.state_plugins.posix.SimSystemPosix at- error_converter()(inmoduletribute), 310
angr.state_plugins.solver), 320
Index

1287

angr

ERROR_REG (angr.calling_conventions.SimCCN64LinuxSyscall
evaluate_binary() (angr.engines.pcode.behavior.OpBehavior
attribute), 629
method), 574
ERROR_REG (angr.calling_conventions.SimCCO32LinuxSyscall
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorBoolAnd
attribute), 629
method), 587
ERROR_REG (angr.calling_conventions.SimCCPowerPC64LinuxSyscall
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorBoolOr
attribute), 631
method), 587
ERROR_REG (angr.calling_conventions.SimCCPowerPCLinuxSyscall
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorBoolXor
attribute), 630
method), 586
ERROR_REG (angr.calling_conventions.SimCCSyscall at- evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorEqual
tribute), 624
method), 575
errored (angr.sim_manager.SimulationManager prop- evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntAdderty), 500
method), 578
errored (angr.SimulationManager property), 168
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntAnd
ErrorRecord (class in angr.sim_manager), 505
method), 582
errors (angr.analyses.Analysis attribute), 786
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntCarryerrors (angr.analyses.analysis.Analysis attribute), 834
method), 579
errors (angr.Analysis attribute), 174
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntDiv
ESPIPE (angr.state_plugins.posix.SimSystemPosix atmethod), 584
tribute), 311
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntLeft
ESPIPE (angr.state_plugins.SimSystemPosix attribute),
method), 582
239
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntLess
ESRCH (angr.state_plugins.posix.SimSystemPosix atmethod), 577
tribute), 310
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntLessEqu
ESRCH (angr.state_plugins.SimSystemPosix attribute), 238
method), 577
ETXTBSY (angr.state_plugins.posix.SimSystemPosix at- evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntMult
tribute), 310
method), 584
ETXTBSY (angr.state_plugins.SimSystemPosix attribute), evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntOr
239
method), 582
eval() (angr.state_plugins.SimSolver method), 247
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntRemeval() (angr.state_plugins.solver.SimSolver method),
method), 585
325
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntRighteval_atleast()(angr.state_plugins.SimSolver
method), 583
method), 248
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntSborroweval_atleast() (angr.state_plugins.solver.SimSolver
method), 580
method), 326
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntScarryeval_atmost() (angr.state_plugins.SimSolver method),
method), 579
248
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntSdiv
eval_atmost()(angr.state_plugins.solver.SimSolver
method), 585
method), 326
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntSlesseval_exact() (angr.state_plugins.SimSolver method),
method), 576
248
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntSlessEq
eval_exact()(angr.state_plugins.solver.SimSolver
method), 576
method), 327
evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntSrem
eval_one() (angr.state_plugins.SimSolver method), 247
method), 585
eval_one()(angr.state_plugins.solver.SimSolver evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntSrightmethod), 326
method), 583
eval_to_ast() (angr.state_plugins.SimSolver method), evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntSub
245
method), 579
eval_to_ast()(angr.state_plugins.solver.SimSolver evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorIntXor
method), 323
method), 581
eval_upto() (angr.state_plugins.SimSolver method), evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorNotEqual
247
method), 575
eval_upto()(angr.state_plugins.solver.SimSolver evaluate_binary() (angr.engines.pcode.behavior.OpBehaviorSubpiece
method), 325
method), 592
1288

Index

angr

evaluate_unary() (angr.engines.pcode.behavior.OpBehavior
exit() (angr.SimProcedure method), 150
method), 574
exit_hook()(inmoduleevaluate_unary() (angr.engines.pcode.behavior.OpBehaviorBoolNegate
angr.state_plugins.trace_additions), 340
method), 586
exit_observe() (angr.analyses.reaching_definitions.reaching_definitions.
evaluate_unary() (angr.engines.pcode.behavior.OpBehaviorCopy method), 1078
method), 574
exit_observe() (angr.analyses.reaching_definitions.ReachingDefinitionsAevaluate_unary() (angr.engines.pcode.behavior.OpBehaviorInt2Comp
method), 1057
method), 580
exit_observe() (angr.analyses.ReachingDefinitionsAnalysis
evaluate_unary() (angr.engines.pcode.behavior.OpBehaviorIntNegate
method), 820
method), 581
exit_observed (angr.analyses.reaching_definitions.rd_state.ReachingDefi
evaluate_unary() (angr.engines.pcode.behavior.OpBehaviorIntSextattribute), 1091
method), 578
exit_observed (angr.analyses.reaching_definitions.ReachingDefinitionsSt
evaluate_unary() (angr.engines.pcode.behavior.OpBehaviorIntZextattribute), 1061
method), 577
exit_statements (angr.engines.pcode.lifter.IRSB propevaluate_unary() (angr.engines.pcode.behavior.OpBehaviorLzcounterty), 566
method), 592
ExitStatement (class in angr.engines.pcode.lifter), 563
evaluate_unary() (angr.engines.pcode.behavior.OpBehaviorPopcountExplicitFillerMixin(classinmethod), 592
angr.storage.memory_mixins), 418
events(angr.state_plugins.history.SimStateHistory ExplicitFillerMixin(classinproperty), 335
angr.storage.memory_mixins.default_filler_mixin),
events (angr.state_plugins.SimStateHistory property),447
254
ExplorationStatusNotifier(classin
events_of_type() (angr.state_plugins.log.SimStateLog
angr.distributed.worker), 1206
method), 328
ExplorationTechnique (class in angr), 174
events_of_type()(angr.state_plugins.SimStateLog ExplorationTechnique(classinmethod), 250
angr.exploration_techniques), 506
EXC_COUNTER (angr.analyses.decompiler.condition_processor.ConditionProcessor
explore()(angr.sim_manager.SimulationManager
attribute), 954
method), 500
EXDEV (angr.state_plugins.posix.SimSystemPosix at- explore() (angr.SimulationManager method), 169
tribute), 310
Explorer (class in angr.exploration_techniques), 512
EXDEV (angr.state_plugins.SimSystemPosix attribute), 239 Explorer (class in angr.exploration_techniques.explorer),
execute() (angr.Project method), 156
525
execute() (angr.project.Project method), 211
expr (angr.analyses.decompiler.optimization_passes.lowered_switch_simpli
execute() (angr.sim_procedure.SimProcedure method),attribute), 980
601
expr (angr.analyses.decompiler.structured_codegen.c.CMultiStatementExpr
execute() (angr.SimProcedure method), 149
attribute), 1016
ExecuteAddressGoal(classin expr (angr.analyses.decompiler.structured_codegen.c.CTypeCast
angr.exploration_techniques), 516
attribute), 1014
ExecuteAddressGoal(classin expr_classes (angr.analyses.decompiler.peephole_optimizations.base.Pee
angr.exploration_techniques.director), 535
attribute), 987
executed_instruction_count (angr.errors.SimError expr_comments (angr.angrdb.models.DbStructuredCode
attribute), 1201
attribute), 922
executed_instruction_count (angr.SimError at- expr_idx (angr.analyses.decompiler.region_simplifiers.expr_folding.Expretribute), 159
attribute), 989
Existence (class in angr.analyses.typehoon.typevars), ExpressionCounter(classin1122
angr.analyses.decompiler.region_simplifiers.expr_folding),
exists() (angr.knowledge_plugins.PropagationManager
990
method), 671
ExpressionFolder(classinexists() (angr.knowledge_plugins.propagations.PropagationManager
angr.analyses.decompiler.region_simplifiers.expr_folding),
method), 703
991
exists_in_replacements()(inmodule ExpressionLocation(classinangr.analyses.cfg.indirect_jump_resolvers.const_resolver), angr.analyses.decompiler.region_simplifiers.expr_folding),
904989
exit() (angr.sim_procedure.SimProcedure method), 603 ExpressionNarrower(class
in
Index

1289

angr

angr.analyses.decompiler.expression_narrower), extract() (angr.sim_type.SimTypeWideChar method),958
643
ExpressionReplacer(classin extract() (angr.sim_type.SimTypeWString method),angr.analyses.decompiler.optimization_passes.expr_op_swapper),646
983
extract() (angr.sim_type.SimUnion method), 650
ExpressionReplacer(classin extract() (angr.storage.memory_mixins.paged_memory.pages.multi_valueangr.analyses.decompiler.optimization_passes.ite_expr_converter),method), 458
979
extract_claripy() (angr.sim_type.SimType method),
ExpressionReplacer(classin639
angr.analyses.decompiler.region_simplifiers.expr_folding),
extract_components()
990(angr.procedures.stubs.format_parser.FormatParser
expressions (angr.engines.pcode.lifter.IRSB property),
method), 605
567
extract_defs() (angr.analyses.reaching_definitions.LiveDefinitions
ExpressionUseFinder(classinstatic method), 1043
angr.analyses.decompiler.region_simplifiers.expr_folding),
extract_defs() (angr.analyses.reaching_definitions.rd_state.ReachingDe
990
method), 1093
ExprNarrowingInfo(classin extract_defs() (angr.analyses.reaching_definitions.ReachingDefinitionsSangr.analyses.decompiler.expression_narrower),
method), 1062
957
extract_defs() (angr.knowledge_plugins.key_definitions.live_definitions.
ExprOpSwapper(classinstatic method), 763
angr.analyses.decompiler.optimization_passes), extract_defs() (angr.knowledge_plugins.key_definitions.LiveDefinitions
961
static method), 741
ExprOpSwapper(classin extract_defs_from_annotations()
angr.analyses.decompiler.optimization_passes.expr_op_swapper),(angr.analyses.reaching_definitions.LiveDefinitions
983
static method), 1043
extend() (angr.engines.pcode.lifter.IRSB method), 566 extract_defs_from_annotations()
extend_actions() (angr.state_plugins.history.SimStateHistory(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
method), 335
static method), 764
extend_actions() (angr.state_plugins.log.SimStateLog extract_defs_from_annotations()
method), 328(angr.knowledge_plugins.key_definitions.LiveDefinitions
extend_actions() (angr.state_plugins.SimStateHistory
static method), 742
method), 253
extract_defs_from_mv()
extend_actions()(angr.state_plugins.SimStateLog(angr.analyses.reaching_definitions.LiveDefinitions
method), 250
static method), 1043
extern (angr.knowledge_plugins.key_definitions.definition.DefinitionMatchPredicate
extract_defs_from_mv()
attribute), 756(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
ExternalCodeLocation (class in angr.code_location),
static method), 764
780
extract_defs_from_mv()
extract() (angr.sim_type.SimCppClass method), 651(angr.knowledge_plugins.key_definitions.LiveDefinitions
extract() (angr.sim_type.SimStruct method), 649
static method), 742
extract() (angr.sim_type.SimType method), 639
extract_jump_targets()(inmoduleextract() (angr.sim_type.SimTypeArray method), 645
angr.analyses.decompiler.utils), 1020
extract() (angr.sim_type.SimTypeBool method), 643
extract_offset_to_sp()
extract() (angr.sim_type.SimTypeChar method), 642(angr.analyses.propagator.engine_ail.SimEnginePropagatorAIL
extract() (angr.sim_type.SimTypeFd method), 643
method), 1036
extract() (angr.sim_type.SimTypeFloat method), 648
extract_offset_to_sp()
extract() (angr.sim_type.SimTypeInt method), 642(angr.engines.light.engine.SimEngineLightMixin
extract() (angr.sim_type.SimTypeNum method), 641
static method), 1032
extract() (angr.sim_type.SimTypeNumOffset method), extract_stack_offset_from_addr()
651(angr.analyses.variable_recovery.variable_recovery_base.Variabl
extract() (angr.sim_type.SimTypePointer method), 644
static method), 1109
extract() (angr.sim_type.SimTypeReference method), extract_terms()(inmodule644
angr.analyses.decompiler.structured_codegen.c),extract() (angr.sim_type.SimTypeString method), 645
1002
1290

Index

angr

extract_value_if_concrete()filter() (angr.analyses.cfg.indirect_jump_resolvers.ArmElfFastResolver(angr.analyses.xrefs.SimEngineXRefsVEX
method), 911static method), 1156
filter() (angr.analyses.cfg.indirect_jump_resolvers.const_resolver.Consta
extract_variables()method), 904(angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase
filter() (angr.analyses.cfg.indirect_jump_resolvers.ConstantResolver
static method), 1108
method), 911
filter() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableF
method), 903
filter() (angr.analyses.cfg.indirect_jump_resolvers.JumpTableResolverf (angr.utils.mp.Closure attribute), 1197
method), 908
FAILURE (angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.Case2Result
filter() (angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.MipsEl
attribute), 897
method), 897
failure() (angr.engines.SimSuccessors class method),filter() (angr.analyses.cfg.indirect_jump_resolvers.MipsElfFastResolver
544
method), 905
failure()(angr.engines.successors.SimSuccessors
filter() (angr.analyses.cfg.indirect_jump_resolvers.MipsElfGotResolver
class method), 553
method), 906
false_node (angr.analyses.decompiler.structuring.structurer_nodes.ConditionNodefilter() (angr.analyses.cfg.indirect_jump_resolvers.resolver.IndirectJump
attribute), 934
method), 905
fast_memory_load()(angr.analyses.Reassembler
filter() (angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt.X86E
method), 814
method), 898
fast_memory_load() (angr.analyses.reassembler.Reassembler
filter() (angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat.X86PeIatR
method), 1153
method), 896
FastMemory (class in angr.storage.memory_mixins), 446
filter() (angr.analyses.cfg.indirect_jump_resolvers.X86ElfPicPltResolver
fd (angr.state_plugins.unicorn_engine.TRANSMIT_RECORD
method), 907
attribute), 350
FD_SETSIZE (angr.state_plugins.cgc.SimStateCGC at- filter() (angr.analyses.cfg.indirect_jump_resolvers.X86PeIatResolver
method), 909
tribute), 337
FD_SETSIZE(angr.state_plugins.SimStateCGC
at- filter() (angr.analyses.veritesting.CallTracingFilter
method), 1133
tribute), 256
filter() (angr.exploration_techniques.ExplorationTechnique
FetchingZeroPageError, 353
field (angr.analyses.decompiler.structured_codegen.c.CStructField method), 507
filter()(angr.exploration_techniques.Explorer
attribute), 1010
method), 513
FieldReferenceCleanup(classinangr.analyses.decompiler.structured_codegen.c), filter() (angr.exploration_techniques.explorer.Explorer
method), 525
1019
filter() (angr.exploration_techniques.local_loop_seer.LocalLoopSeer
fields (angr.sim_type.SimUnion attribute), 650
method), 539
file_exists (angr.SimFileDescriptor property), 194
file_exists (angr.storage.file.SimFileDescriptor prop- filter() (angr.exploration_techniques.LocalLoopSeer
method), 522erty), 403
file_exists (angr.storage.file.SimFileDescriptorBase filter() (angr.exploration_techniques.loop_seer.LoopSeer
method), 538
property), 402
filter()(angr.exploration_techniques.LoopSeer
fill_content() (angr.knowledge_plugins.cfg.memory_data.MemoryData
method), 510
method), 696
filter()(angr.exploration_techniques.Slicecutor
fill_content() (angr.knowledge_plugins.cfg.MemoryData
method), 508
method), 677
fill_reg_map()(inmodule filter() (angr.exploration_techniques.slicecutor.Slicecutor
method), 534
angr.analyses.reassembler), 1145
filter()(angr.exploration_techniques.Tracer method),filter() (angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got.AMD64ElfGotResolver
512
method), 894
filter()(angr.exploration_techniques.tracer.Tracer
filter() (angr.analyses.cfg.indirect_jump_resolvers.AMD64ElfGotResolver
method),532
method), 910
filter()(angr.ExplorationTechniquemethod), 174
filter() (angr.analyses.cfg.indirect_jump_resolvers.AMD64PeIatResolver
filter()(angr.sim_manager.SimulationManager
method), 912
method), 502
filter() (angr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast.ArmElfFastResolver
filter()(angr.SimulationManager method), 170
method), 895
Index

1291

angr

filter_actions() (angr.state_plugins.history.SimStateHistory(angr.analyses.decompiler.Decompiler
method), 334
method), 945
filter_actions() (angr.state_plugins.SimStateHistory find_data_references_and_update_memory_data()
method), 253(angr.analyses.decompiler.decompiler.Decompiler
filter_cond_regions()(inmodulemethod), 957
angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier),
find_declaration() (angr.knowledge_plugins.Function
994
method), 664
filter_constraints()
find_declaration() (angr.knowledge_plugins.functions.Function(angr.state_plugins.trace_additions.ZenPlugin
method), 711
method), 343
find_declaration() (angr.knowledge_plugins.functions.function.Functio
final_states (angr.knowledge_plugins.cfg.cfg_node.CFGENode method), 723
attribute), 699
find_definition() (angr.analyses.decompiler.peephole_optimizations.ba
final_states (angr.knowledge_plugins.cfg.CFGENodestatic method), 987
attribute), 680
find_definitions() (angr.analyses.DDG method),find() (angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin803
method), 486
find_definitions()(angr.analyses.ddg.DDG
find() (angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin
method), 1029
method), 481
find_definitions() (angr.analyses.reaching_definitions.dep_graph.Dep
find() (angr.storage.memory_mixins.regioned_memory.static_find_mixin.StaticFindMixin
method), 1080
method), 490
find_defs_at() (angr.analyses.reaching_definitions.ReachingDefinitionsMfind() (angr.storage.memory_mixins.regioned_memory.StaticFindMixin
method), 1058
method), 482
find_defs_at() (angr.knowledge_plugins.key_definitions.rd_model.Reachfind() (angr.storage.memory_mixins.RegionedMemoryMixin
method), 770
method), 439
find_defs_at() (angr.knowledge_plugins.key_definitions.ReachingDefinitfind() (angr.storage.memory_mixins.smart_find_mixin.SmartFindMixin
method), 737
method), 447
find_function_for_reflow_into_addr()
find() (angr.storage.memory_mixins.SmartFindMixin(angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 421
method), 694
find() (angr.storage.memory_mixins.StaticFindMixin find_function_for_reflow_into_addr()
method), 440(angr.knowledge_plugins.cfg.CFGModelfind() (angr.storage.memory_mixins.unwrapper_mixin.UnwrapperMixin
method), 688
method), 454
find_killers() (angr.analyses.DDG method), 804
find() (angr.storage.memory_mixins.UnwrapperMixin find_killers() (angr.analyses.ddg.DDG method),
method), 4221029
find_all_predecessors()
find_merge_points()(angr.utils.graph.GraphUtils(angr.analyses.reaching_definitions.dep_graph.DepGraph static method), 1193
method), 1081
find_path() (angr.analyses.reaching_definitions.dep_graph.DepGraphfind_all_successors()
method), 1081
(angr.analyses.reaching_definitions.dep_graph.DepGraphfind_paths() (angr.analyses.reaching_definitions.dep_graph.DepGraphmethod), 1081
method), 1081
find_block_by_addr()(inmodule find_sources() (angr.analyses.DDG method), 804
angr.analyses.decompiler.utils), 1024
find_sources() (angr.analyses.ddg.DDG method),
find_cc() (angr.calling_conventions.SimCC static1029
method), 621
find_stack_vars_x86()(angr.analyses.Identifier
find_cc() (angr.SimCC static method), 183
method), 817
find_conflicting_call_args()
find_stack_vars_x86()(angr.analyses.decompiler.optimization_passes.ConstPropOptReverter(angr.analyses.identifier.identify.Identifier
static method), 972
method), 1131
find_consumers() (angr.analyses.DDG method), 803
find_variable_by_atom()
find_consumers() (angr.analyses.ddg.DDG method),(angr.knowledge_plugins.variables.variable_manager.VariableMa
1029
method), 730
find_data_references_and_update_memory_data() find_variable_by_stmt()(angr.analyses.Decompiler method), 825(angr.knowledge_plugins.variables.variable_manager.VariableMa
find_data_references_and_update_memory_data()
method), 729
1292

Index

angr

find_variables_by_atom()Float (class in angr.analyses.typehoon.typeconsts), 1128
(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
float_len_mod (angr.procedures.stubs.format_parser.ScanfFormatParser
method), 730
attribute), 605
find_variables_by_insn()
float_spec (angr.procedures.stubs.format_parser.ScanfFormatParser(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
attribute), 605
method), 729
float_type()(inmodulefind_variables_by_register()angr.analyses.typehoon.typeconsts), 1129
(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
FloatBase (class in angr.analyses.typehoon.typeconsts),
method), 730
1128
find_variables_by_stack_offset()
FloatingPoint (angr.knowledge_plugins.cfg.memory_data.MemoryDataS(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
attribute), 695
method), 730
FloatingPoint (angr.knowledge_plugins.cfg.MemoryDataSort
find_variables_by_stmt()
attribute), 676(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
floor_addr()(angr.analyses.cfg.cfb.CFBlanket
method), 729
method), 874
find_widening_points()
floor_addr() (angr.analyses.cfg.CFBlanket method),(angr.utils.graph.GraphUtils static method),867
1193
floor_addr() (angr.knowledge_plugins.functions.function_manager.Funct
FindFirstNodeInSet(classinmethod), 715
angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier),
floor_func() (angr.knowledge_plugins.FunctionManager
995
method), 656
finish() (angr.state_plugins.Unicorn method), 262
floor_func() (angr.knowledge_plugins.functions.function_manager.Functfinish() (angr.state_plugins.unicorn_engine.Unicorn
method), 715
method), 356
floor_func() (angr.knowledge_plugins.functions.FunctionManager
fire() (angr.BP method), 151
method), 713
fire() (angr.state_plugins.inspect.BP method), 300
floor_item()(angr.analyses.cfg.cfb.CFBlanket
first_nonlabel_node()(inmodulemethod), 874
angr.analyses.decompiler.utils), 1022
floor_item() (angr.analyses.cfg.CFBlanket method),first_nonlabel_nonphi_node()(inmodule867
angr.analyses.decompiler.utils), 1022
floor_items()(angr.analyses.cfg.cfb.CFBlanket
first_nonlabel_nonphi_statement() (in module
method), 874
angr.analyses.decompiler.utils), 1022
floor_items() (angr.analyses.cfg.CFBlanket method),first_nonlabel_statement()(inmodule867
angr.analyses.decompiler.utils), 1021
flush_pages() (angr.storage.memory_mixins.paged_memory.paged_mem
first_nonlabel_statement_id()(inmodulemethod), 462
angr.analyses.decompiler.utils), 1022
flush_pages() (angr.storage.memory_mixins.PagedMemoryMixin
fix_prototype_returnty()
method), 426(angr.sim_procedure.SimProcedure method), fmt (angr.analyses.decompiler.structured_codegen.c.CConstant602
property), 1014
fix_prototype_returnty()(angr.SimProcedure fmt_char (angr.analyses.decompiler.structured_codegen.c.CConstantmethod), 150
property), 1014
flags (angr.procedures.stubs.format_parser.FormatParser fmt_double (angr.analyses.decompiler.structured_codegen.c.CConstantattribute), 604
property), 1014
Flags (class in angr.storage.file), 390
fmt_float (angr.analyses.decompiler.structured_codegen.c.CConstantflatten_typevar() (angr.analyses.typehoon.simple_solver.Sketch property), 1014
static method), 1118
fmt_hex (angr.analyses.decompiler.structured_codegen.c.CConstantflavor (angr.angrdb.models.DbStructuredCode atproperty), 1014
tribute), 922
fmt_int() (angr.analyses.decompiler.structured_codegen.c.CConstant
FlipBooleanCmp(classinmethod), 1014
angr.analyses.decompiler.optimization_passes), fmt_neg (angr.analyses.decompiler.structured_codegen.c.CConstant967
property), 1014
FlirtAnalysis (class in angr.analyses), 830
force_unroll_loops()
FlirtAnalysis (class in angr.analyses.flirt), 1030
(angr.analyses.cfg.cfg_emulated.CFGEmulated
FlirtSignature (class in angr.flirt), 1187
method), 879
Index

1293

angr

force_unroll_loops()
tribute), 629(angr.analyses.cfg.CFGEmulated
method), FP_ARG_REGS (angr.calling_conventions.SimCCN64LinuxSyscall
863
attribute), 629
force_unroll_loops() (angr.analyses.CFGEmulated FP_ARG_REGS (angr.calling_conventions.SimCCO32 atmethod), 795
tribute), 628
forget_last_label()
FP_ARG_REGS (angr.calling_conventions.SimCCO32LinuxSyscall(angr.analyses.typehoon.simple_solver.ConstraintGraphNode
attribute), 629
method), 1119
FP_ARG_REGS (angr.calling_conventions.SimCCPowerPC
forgotten (angr.analyses.typehoon.simple_solver.ConstraintGraphNode
attribute), 630
attribute), 1119
FP_ARG_REGS (angr.calling_conventions.SimCCPowerPC64
FORGOTTEN (class in angr.analyses.typehoon.simple_solver),attribute), 630
1118
FP_ARG_REGS (angr.calling_conventions.SimCCPowerPC64LinuxSyscall
FormatInfo (class in angr.state_plugins.trace_additions),
attribute), 631
339
FP_ARG_REGS (angr.calling_conventions.SimCCPowerPCLinuxSyscall
FormatInfoDontConstrain(classin
attribute), 630
angr.state_plugins.trace_additions), 340
FP_ARG_REGS (angr.calling_conventions.SimCCRISCV64LinuxSyscall
FormatInfoIntToStr(classin
attribute), 628
angr.state_plugins.trace_additions), 339
FP_ARG_REGS (angr.calling_conventions.SimCCS390X
FormatInfoStrToInt(classin
attribute), 632
angr.state_plugins.trace_additions), 339
FP_ARG_REGS (angr.calling_conventions.SimCCS390XLinuxSyscall
FormatParser(classin
attribute), 632
angr.procedures.stubs.format_parser), 604
FP_ARG_REGS (angr.calling_conventions.SimCCSystemVAMD64
FormatSpecifier(classin
attribute), 625
angr.procedures.stubs.format_parser), 604
FP_ARG_REGS (angr.calling_conventions.SimCCX86LinuxSyscall
FormatString(classin
attribute), 624
angr.procedures.stubs.format_parser), 603
FP_ARG_REGS (angr.calling_conventions.SimCCX86WindowsSyscall
ForwardAnalysis (class in angr.analyses), 787
attribute), 625
ForwardAnalysis(classin FP_ARG_REGS (angr.engines.pcode.cc.SimCCM68k atangr.analyses.forward_analysis), 834
tribute), 593
ForwardAnalysis(classin FP_ARG_REGS (angr.engines.pcode.cc.SimCCPowerPC
angr.analyses.forward_analysis.forward_analysis),
attribute), 594
839
FP_ARG_REGS (angr.engines.pcode.cc.SimCCXtensa atfound (angr.sim_manager.SimulationManager attribute),
tribute), 594
499
FP_ARG_REGS (angr.SimCC attribute), 181
found (angr.SimulationManager attribute), 168
fp_args (angr.calling_conventions.SimCC property),
FP_ARG_REGS (angr.calling_conventions.SimCC at619
tribute), 618
fp_args (angr.SimCC property), 181
FP_ARG_REGS (angr.calling_conventions.SimCCAArch64 fp_iter(angr.calling_conventions.ArgSession
atattribute), 627
tribute), 618
FP_ARG_REGS (angr.calling_conventions.SimCCAArch64LinuxSyscall
fp_iter (angr.calling_conventions.SimCC.ArgSession
attribute), 627
attribute), 619
FP_ARG_REGS (angr.calling_conventions.SimCCAMD64WindowsSyscall
fp_iter (angr.SimCC.ArgSession attribute), 181
attribute), 626
FP_RETURN_VAL (angr.calling_conventions.SimCC atFP_ARG_REGS (angr.calling_conventions.SimCCARM attribute), 618
tribute), 626
FP_RETURN_VAL (angr.calling_conventions.SimCCARMHF
FP_ARG_REGS (angr.calling_conventions.SimCCARMHF
attribute), 627
attribute), 627
FP_RETURN_VAL (angr.calling_conventions.SimCCCdecl
FP_ARG_REGS (angr.calling_conventions.SimCCARMLinuxSyscall attribute), 622
attribute), 627
FP_RETURN_VAL (angr.calling_conventions.SimCCMicrosoftAMD64
FP_ARG_REGS (angr.calling_conventions.SimCCCdecl
attribute), 623
attribute), 622
FP_RETURN_VAL (angr.calling_conventions.SimCCSystemVAMD64
FP_ARG_REGS (angr.calling_conventions.SimCCMicrosoftAMD64
attribute), 625
attribute), 623
FP_RETURN_VAL (angr.SimCC attribute), 181
FP_ARG_REGS (angr.calling_conventions.SimCCN64 at- free() (angr.analyses.reaching_definitions.heap_allocator.HeapAllocator
1294

Index

angr

method), 1082
from_opstr() (angr.analyses.loop_analysis.Condition
free() (angr.SimHeapPTMalloc method), 202class method), 1132
free() (angr.state_plugins.heap.heap_libc.SimHeapLibc from_pc() (angr.knowledge_plugins.debug_variables.DebugVariable
method), 375
method), 735
free() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
from_pc() (angr.knowledge_plugins.debug_variables.DebugVariableConta
method), 378
method), 734
free() (angr.state_plugins.heap.SimHeapLibc method), from_signature (angr.knowledge_plugins.Function at366
tribute), 658
free()(angr.state_plugins.heap.SimHeapPTMalloc from_signature (angr.knowledge_plugins.functions.Function
method), 367
attribute), 706
free() (angr.state_plugins.SimHeapLibc method), 286
from_signature (angr.knowledge_plugins.functions.function.Function
free() (angr.state_plugins.SimHeapPTMalloc method),attribute), 718
288
from_signature (angr.knowledge_plugins.functions.soot_function.SootFun
free_chunks() (angr.SimHeapPTMalloc method), 202
attribute), 725
free_chunks() (angr.state_plugins.heap.heap_freelist.SimHeapFreelist
from_state() (angr.analyses.variable_recovery.annotations.VariableSour
method), 374
static method), 1106
free_chunks() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
FrozenStackPointerTrackerState(classinmethod), 377
angr.analyses.stack_pointer_tracker), 1104
free_chunks() (angr.state_plugins.heap.SimHeapPTMalloc
FS (in module angr.flirt), 1188
method), 367
fstat()(angr.state_plugins.posix.SimSystemPosix
free_chunks() (angr.state_plugins.SimHeapPTMalloc
method), 312
method), 287
fstat() (angr.state_plugins.SimSystemPosix method),
freeze() (angr.analyses.stack_pointer_tracker.StackPointerTrackerState240
method), 1105
fstat_with_result()
fresh_block()(angr.factory.AngrObjectFactory(angr.state_plugins.posix.SimSystemPosix
method), 215
method), 312
fresh_constraints (angr.state_plugins.log.SimStateLog fstat_with_result()
property), 328(angr.state_plugins.SimSystemPosix method),
fresh_constraints (angr.state_plugins.SimStateLog
240
property), 250
full_c_repr_chunks()
from_ail_expr() (angr.analyses.reaching_definitions.Atom(angr.analyses.decompiler.structured_codegen.c.CFunction
static method), 1049
method), 1004
from_ail_expr() (angr.knowledge_plugins.key_definitions.atoms.Atom
full_graph (angr.analyses.decompiler.graph_region.GraphRegion
static method), 751
attribute), 959
from_argument() (angr.analyses.reaching_definitions.Atom
full_init_state() (angr.factory.AngrObjectFactory
static method), 1049
method), 213
from_argument() (angr.knowledge_plugins.key_definitions.atoms.Atom
full_simplify() (angr.state_hierarchy.StateHierarchy
static method), 751
method), 506
from_cle_variable()full_simplify() (angr.StateHierarchy method), 176(angr.state_plugins.debug_variables.SimDebugVariablefunc (angr.analyses.cfg.indirect_jump_resolvers.jumptable.ConstantValueM
static method), 380
attribute), 900
from_cle_variable()func_addr (angr.analyses.cfg.cfg_fast.CFGJob at(angr.state_plugins.SimDebugVariable static
tribute), 889
method), 297
func_addr(angr.analyses.cfg.cfg_job_base.BlockID
from_digraph()(angr.annocfg.AnnotatedCFG
property), 893
method), 1169
func_addr (angr.analyses.cfg.cfg_job_base.CFGJobBase
from_name() (angr.knowledge_plugins.debug_variables.DebugVariableManager
property), 894
method), 735
func_addr (angr.analyses.decompiler.peephole_optimizations.base.Peepho
from_name() (angr.knowledge_plugins.DebugVariableManager
attribute), 987
method), 666
func_addr (angr.analyses.decompiler.peephole_optimizations.base.Peepho
from_name_and_pc() (angr.knowledge_plugins.debug_variables.DebugVariableManager
attribute), 986
method), 735
func_addr (angr.analyses.decompiler.peephole_optimizations.base.Peepho
from_name_and_pc() (angr.knowledge_plugins.DebugVariableManager
attribute), 986
method), 666
func_addr (angr.analyses.variable_recovery.engine_base.SimEngineVRBa
Index

1295

angr

property), 1115
function_address (angr.knowledge_plugins.cfg.CFGNodefunc_addr (angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase
attribute), 678
property), 1109
function_address (angr.storage.memory_mixins.regioned_memory.regio
func_addr (angr.angrdb.models.DbStructuredCode atattribute), 488
tribute), 922
function_codeloc (angr.analyses.reaching_definitions.function_handler.F
func_addr (angr.angrdb.models.DbVariableCollection
attribute), 1085
attribute), 921
function_codeloc (angr.analyses.reaching_definitions.FunctionCallData
func_addr (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump attribute), 1070
attribute), 701
function_dependency_graph() (angr.analyses.DDG
func_addr (angr.knowledge_plugins.cfg.IndirectJump
method), 803
attribute), 681
function_dependency_graph()func_edge_type_from_pb()(in
module(angr.analyses.ddg.DDG method), 1028
angr.utils.enums_conv), 1190
function_final_states (angr.analyses.VFG propfunc_edge_type_to_pb()(in
moduleerty), 806
angr.utils.enums_conv), 1190
function_final_states(angr.analyses.vfg.VFG
func_graph (angr.analyses.reaching_definitions.subject.Subject
property), 1138
property), 1098
function_initial_states (angr.analyses.VFG propfunc_lookup() (angr.analyses.Disassembly method),erty), 806
815
function_initial_states (angr.analyses.vfg.VFG
func_lookup() (angr.analyses.disassembly.Disassembly
property), 1138
method), 1144
function_name (angr.analyses.reassembler.FunctionLabelfunc_typevar (angr.analyses.decompiler.decompilation_cache.DecompilationCache
property), 1146
attribute), 955
function_needs_variable_recovery()
FuncComment (class in angr.analyses.disassembly), 1144
(angr.analyses.complete_calling_conventions.CompleteCallingCo
FuncIn (class in angr.analyses.typehoon.typevars), 1125
static method), 856
FuncInfo (class in angr.analyses.identifier.identify), function_needs_variable_recovery()1130(angr.analyses.CompleteCallingConventionsAnalysis
FuncOut (class in angr.analyses.typehoon.typevars),static method), 828
1125
FUNCTION_PROLOGUE (angr.analyses.cfg.cfg_fast.CFGJobType
funcs(angr.angrdb.models.DbKnowledgeBase
atattribute), 888
tribute), 920
function_prototype()
Function (angr.analyses.proximity_graph.ProxiNodeTypes(angr.factory.AngrObjectFactory
method),attribute), 1157
215
function (angr.analyses.reaching_definitions.function_handler.FunctionCallData
FunctionAnalysis (class in angr.analyses.vfg), 1135
attribute), 1085
FunctionCall (angr.analyses.proximity_graph.ProxiNodeTypes
function (angr.analyses.reaching_definitions.FunctionCallData
attribute), 1157
attribute), 1070
FunctionCallData(classin
Function (angr.analyses.reaching_definitions.subject.SubjectType angr.analyses.reaching_definitions), 1069
attribute), 1097
FunctionCallData(classin
Function (class in angr.analyses.typehoon.typeconsts),
angr.analyses.reaching_definitions.function_handler),
1129
1083
Function (class in angr.knowledge_plugins), 657
FunctionCallDataUnwrapped(classin
Function (class in angr.knowledge_plugins.functions),
angr.analyses.reaching_definitions.function_handler),
705
1087
Function (class in angr.knowledge_plugins.functions.function),
FunctionCallEdge (class in angr.analyses.cfg.cfg_fast),
716
887
function() (angr.knowledge_plugins.FunctionManager FunctionCallRelationships(classinmethod), 656
angr.analyses.reaching_definitions.dep_graph),function() (angr.knowledge_plugins.functions.function_manager.FunctionManager
1078
method), 716
FunctionDict(classinfunction() (angr.knowledge_plugins.functions.FunctionManager angr.knowledge_plugins.functions.function_manager),method), 714
714
function_address (angr.knowledge_plugins.cfg.cfg_node.CFGNode
FunctionDiff (class in angr.analyses.bindiff ), 851
attribute), 697
FunctionEdge (class in angr.analyses.cfg.cfg_fast), 886
1296

Index

angr

FunctionEffect(classin(angr.knowledge_plugins.functions.Function
angr.analyses.reaching_definitions.function_handler),
method), 712
1082
functions_reachable()
FunctionFakeRetEdge(classin(angr.knowledge_plugins.functions.function.Function
angr.analyses.cfg.cfg_fast), 887
method), 724
FunctionGraphVisitor(classin FunctionStart (class in angr.analyses.disassembly),
angr.analyses.forward_analysis), 836
1141
FunctionGraphVisitor(classin FunctionTag(classinangr.analyses.forward_analysis.visitors),
angr.knowledge_plugins.key_definitions.tag),
841
772
FunctionGraphVisitor(classin FunctionTransitionEdge(classinangr.analyses.forward_analysis.visitors.function_graph), angr.analyses.cfg.cfg_fast), 886
844
functy (angr.analyses.decompiler.structured_codegen.c.CFunction
FunctionHandler(classin
attribute), 1004
angr.analyses.reaching_definitions), 1066
fwd_chunk() (angr.PTChunk method), 205
FunctionHandler(classin fwd_chunk() (angr.state_plugins.heap.heap_freelist.Chunkangr.analyses.reaching_definitions.function_handler),
method), 3741087
fwd_chunk() (angr.state_plugins.heap.heap_ptmalloc.PTChunk
FunctionKey (class in angr.analyses.cfg.cfg_job_base),method), 376893
fwd_chunk()(angr.state_plugins.heap.PTChunk
FunctionLabel (class in angr.analyses.reassembler),
method), 3701145
fwd_chunk() (angr.state_plugins.PTChunk method),
FunctionManager (class in angr.knowledge_plugins),
290
655
FunctionManager(classin G
angr.knowledge_plugins.functions), 712
g_label_ctr (angr.analyses.reassembler.Label atFunctionManager(classintribute), 1145
angr.knowledge_plugins.functions.function_manager),
GDB (class in angr.state_plugins), 258
715
GDB (class in angr.state_plugins.gdb), 336
FunctionManagerSerializer(classin generate_code_cover()angr.angrdb.serializers.funcs), 925(angr.analyses.cfg.cfg_fast.CFGFast method),
FunctionParser(classin892
angr.knowledge_plugins.functions.function_parser),generate_code_cover() (angr.analyses.cfg.CFGFast
724
method), 861
FunctionProxiNode(classin generate_code_cover()(angr.analyses.CFGFast
angr.analyses.proximity_graph), 1157
method), 792
FunctionReturn (class in angr.analyses.cfg.cfg_fast), generate_gdt() (angr.SimOS method), 165885
generate_gdt() (angr.simos.SimOS method), 1173
FunctionReturnEdge(classin generate_gdt() (angr.simos.simos.SimOS method),angr.analyses.cfg.cfg_fast), 887
1181
functions (angr.analyses.cfg.cfg_base.CFGBase prop- generate_index() (angr.analyses.cfg.cfg_base.CFGBaseerty), 882
method), 883
functions (angr.analyses.cfg.CFGBase property), 872
generate_index()(angr.analyses.cfg.CFGBase
functions(angr.knowledge_base.KnowledgeBase
method), 872
attribute), 654
generate_symbolic_cmd_line_arg()
functions (angr.KnowledgeBase attribute), 206(angr.simos.javavm.SimJavaVM static method),functions_probably_identical()1185(angr.analyses.BinDiff method), 809
generate_symbolic_cmd_line_arg()
functions_probably_identical()(angr.simos.SimJavaVM
staticmethod),(angr.analyses.bindiff.BinDiff method), 852
1178
functions_reachable()
generic_compare() (angr.engines.pcode.behavior.OpBehavior(angr.knowledge_plugins.Function
method),static method), 574
664
generic_info_hook()(inmodulefunctions_reachable()angr.state_plugins.trace_additions), 340
Index

1297

angr

get() (angr.analyses.stack_pointer_tracker.StackPointerTrackerState 1169
method), 1105
get_addr_of_native_method()get() (angr.knowledge_plugins.functions.function_manager.FunctionDict(angr.simos.javavm.SimJavaVM
method),method), 715
1186
get() (angr.knowledge_plugins.key_definitions.environment.Environment
get_addr_of_native_method()
method), 758(angr.simos.SimJavaVM method), 1178
get() (angr.knowledge_plugins.Labels method), 667
get_all_definitions()(inmoduleget() (angr.knowledge_plugins.labels.Labels method),angr.analyses.reaching_definitions), 1072
704
get_all_nodes() (angr.analyses.cfg.cfg_base.CFGBaseget() (angr.knowledge_plugins.PropagationManager
method), 883
method), 671
get_all_nodes()(angr.analyses.cfg.CFGBaseget() (angr.knowledge_plugins.propagations.PropagationManager method), 872
method), 703
get_all_nodes() (angr.analyses.VFG method), 806
get()(angr.procedures.definitions.SimCppLibrary get_all_nodes() (angr.analyses.vfg.VFG method),
method), 609
1138
get() (angr.procedures.definitions.SimLibrary method), get_all_nodes() (angr.analyses.VSA_DDG method),608809
get() (angr.procedures.definitions.SimSyscallLibrary get_all_nodes() (angr.analyses.vsa_ddg.VSA_DDG
method), 611
method), 1139
get() (angr.procedures.definitions.SimTypeCollection get_all_nodes() (angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 605
method), 690
get() (angr.SimMount method), 199
get_all_nodes() (angr.knowledge_plugins.cfg.CFGModelget() (angr.state_plugins.filesystem.SimConcreteFilesystem
method), 684
method), 317
get_all_nodes_intersecting_region()get()(angr.state_plugins.filesystem.SimFilesystem(angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 316
method), 690
get() (angr.state_plugins.filesystem.SimMount method), get_all_nodes_intersecting_region()
317(angr.knowledge_plugins.cfg.CFGModelget()(angr.state_plugins.globals.SimStateGlobals
method), 684
method), 344
get_all_patches() (angr.knowledge_plugins.patches.PatchManager
get() (angr.state_plugins.posix.PosixDevFS method),
method), 674306
get_all_patches() (angr.knowledge_plugins.PatchManager
get() (angr.state_plugins.posix.PosixProcFS method),
method), 670
308
get_all_predecessors()get() (angr.state_plugins.PosixDevFS method), 234(angr.analyses.cfg.cfg_base.CFGBaseget() (angr.state_plugins.PosixProcFS method), 236
method), 883
get() (angr.state_plugins.SimFilesystem method), 282
get_all_predecessors()get() (angr.state_plugins.SimMount method), 282(angr.analyses.cfg.CFGBase method), 872
get() (angr.state_plugins.SimRegNameView method), get_all_predecessors()
275(angr.knowledge_plugins.cfg.cfg_model.CFGModelget() (angr.state_plugins.SimStateGlobals method), 270
method), 692
get()(angr.state_plugins.view.SimRegNameView get_all_predecessors()
method), 386(angr.knowledge_plugins.cfg.CFGModelget() (angr.utils.mp.Initializer class method), 1198
method), 686
get_abstract_locations()
get_all_successors()(angr.storage.memory_mixins.MemoryRegionMetaMixin (angr.analyses.cfg.cfg_base.CFGBasemethod), 440
method), 883
get_abstract_locations()
get_all_successors() (angr.analyses.cfg.CFGBase(angr.storage.memory_mixins.regioned_memory.MemoryRegionMetaMixin
method), 872
method), 482
get_all_successors()
get_abstract_locations()(angr.knowledge_plugins.cfg.cfg_model.CFGModel(angr.storage.memory_mixins.regioned_memory.region_meta_mixin.MemoryRegionMetaMixin
method), 693
method), 491
get_all_successors()
get_addr() (angr.annocfg.AnnotatedCFG method),(angr.knowledge_plugins.cfg.CFGModel
1298

Index

angr

method), 686(angr.knowledge_plugins.cfg.CFGModel
get_all_variables()method), 686(angr.keyed_region.KeyedRegion
method), get_by_addr() (angr.knowledge_plugins.FunctionManager783
method), 656
get_alloc_depth() (angr.state_plugins.SimUCManager get_by_addr() (angr.knowledge_plugins.functions.function_manager.Func
method), 259
method), 715
get_alloc_depth() (angr.state_plugins.uc_manager.SimUCManager
get_by_addr() (angr.knowledge_plugins.functions.FunctionManager
method), 345
method), 713
get_any_node() (angr.analyses.cfg.cfg_base.CFGBase get_by_name() (angr.knowledge_plugins.FunctionManager
method), 883
method), 656
get_any_node() (angr.analyses.cfg.CFGBase method), get_by_name() (angr.knowledge_plugins.functions.function_manager.Func
872
method), 715
get_any_node() (angr.analyses.VFG method), 806
get_by_name() (angr.knowledge_plugins.functions.FunctionManager
get_any_node() (angr.analyses.vfg.VFG method), 1138
method), 713
get_any_node() (angr.knowledge_plugins.cfg.cfg_model.CFGModel
get_byte() (angr.state_plugins.trace_additions.ChallRespInfo
method), 690
static method), 341
get_any_node() (angr.knowledge_plugins.cfg.CFGModel get_call_args() (angr.analyses.Identifier method),
method), 683817
get_arg_info()(angr.calling_conventions.SimCC get_call_args() (angr.analyses.identifier.identify.Identifier
method), 621
method), 1131
get_arg_info() (angr.SimCC method), 184
get_call_return() (angr.knowledge_plugins.Function
get_args() (angr.calling_conventions.SimCC method),
method), 662
620
get_call_return() (angr.knowledge_plugins.functions.Function
get_args() (angr.SimCC method), 182
method), 710
get_ast_subexprs()(inmodule get_call_return() (angr.knowledge_plugins.functions.function.Function
angr.analyses.decompiler.utils), 1021
method), 721
get_base_addr()(angr.keyed_region.KeyedRegion get_call_sites() (angr.knowledge_plugins.Function
method), 783
method), 662
get_basic_info() (in module angr.flirt.build_sig), get_call_sites() (angr.knowledge_plugins.functions.Function
1188
method), 709
get_behavior_for_opcode()
get_call_sites() (angr.knowledge_plugins.functions.function.Function(angr.engines.pcode.behavior.BehaviorFactory
method), 721
method), 593
get_call_stack_suffix()
get_block()(angr.knowledge_plugins.Function(angr.analyses.cfg.cfg_job_base.CFGJobBase
method), 659
method), 894
get_block() (angr.knowledge_plugins.functions.Function get_call_target() (angr.knowledge_plugins.Function
method), 707
method), 662
get_block() (angr.knowledge_plugins.functions.function.Function
get_call_target() (angr.knowledge_plugins.functions.Function
method), 719
method), 709
get_block_size() (angr.knowledge_plugins.Function get_call_target() (angr.knowledge_plugins.functions.function.Function
method), 659
method), 721
get_block_size() (angr.knowledge_plugins.functions.Function
get_cc() (angr.knowledge_plugins.callsite_prototypes.CallsitePrototypes
method), 707
method), 675
get_block_size() (angr.knowledge_plugins.functions.function.Function
get_cc() (angr.knowledge_plugins.CallsitePrototypes
method), 719
method), 672
get_branching_nodes()get_class() (angr.state_plugins.javavm_classloader.SimJavaVmClassloa(angr.analyses.cfg.cfg_base.CFGBasemethod), 360
method), 883
get_class() (angr.state_plugins.SimJavaVmClassloader
get_branching_nodes() (angr.analyses.cfg.CFGBasemethod), 294
method), 872
get_class_hierarchy()get_branching_nodes()(angr.state_plugins.javavm_classloader.SimJavaVmClassloader(angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 360
method), 693
get_class_hierarchy()get_branching_nodes()(angr.state_plugins.SimJavaVmClassloader
Index

1299

angr

method), 294(angr.knowledge_plugins.cfg.cfg_node.CFGNodeget_cmd_line_args() (angr.simos.javavm.SimJavaVM
method), 698
static method), 1186
get_data_references()
get_cmd_line_args() (angr.simos.SimJavaVM static(angr.knowledge_plugins.cfg.CFGNodemethod), 1178
method), 679
get_concrete_fd() (angr.state_plugins.posix.SimSystemPosix
get_data_size() (angr.PTChunk method), 204
method), 312
get_data_size() (angr.state_plugins.heap.heap_freelist.Chunk
get_concrete_fd() (angr.state_plugins.SimSystemPosix
method), 373
method), 240
get_data_size() (angr.state_plugins.heap.heap_ptmalloc.PTChunk
get_concrete_state()
method), 375(angr.analyses.variable_recovery.variable_recovery.VariableRecoveryState
get_data_size() (angr.state_plugins.heap.PTChunkmethod), 1112
method), 369
get_concrete_value()
get_data_size()(angr.state_plugins.PTChunk(angr.analyses.reaching_definitions.LiveDefinitions
method), 289
method), 1046
get_dbinfo() (angr.angrdb.AngrDB method), 917
get_concrete_value()
get_dbinfo() (angr.angrdb.db.AngrDB method), 918(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
get_default_value_by_type()
method), 1097
(angr.simos.javavm.SimJavaVM static method),
get_concrete_value()1186(angr.analyses.reaching_definitions.ReachingDefinitionsState
get_default_value_by_type()
method), 1066
(angr.simos.SimJavaVM
staticmethod),get_concrete_value()1178(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
get_definitions() (angr.analyses.reaching_definitions.LiveDefinitions
method), 767
method), 1044
get_concrete_value()
get_definitions() (angr.analyses.reaching_definitions.rd_state.Reachin(angr.knowledge_plugins.key_definitions.LiveDefinitions method), 1096
method), 745
get_definitions() (angr.analyses.reaching_definitions.ReachingDefiniti
get_concrete_value_from_atom()method), 1065
(angr.analyses.reaching_definitions.LiveDefinitions
get_definitions() (angr.knowledge_plugins.key_definitions.live_definiti
method), 1046
method), 765
get_concrete_value_from_atom()get_definitions() (angr.knowledge_plugins.key_definitions.LiveDefiniti(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 743
method), 767
get_definitions_from_atoms()
get_concrete_value_from_atom()(angr.analyses.reaching_definitions.LiveDefinitions(angr.knowledge_plugins.key_definitions.LiveDefinitions method), 1045
method), 745
get_definitions_from_atoms()
get_concrete_value_from_definition()(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin(angr.analyses.reaching_definitions.LiveDefinitions
method), 766
method), 1046
get_definitions_from_atoms()
get_concrete_value_from_definition()(angr.knowledge_plugins.key_definitions.LiveDefinitions(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 744
method), 767
get_defs() (angr.analyses.reaching_definitions.ReachingDefinitionsMode
get_concrete_value_from_definition()
method), 1058
(angr.knowledge_plugins.key_definitions.LiveDefinitions
get_defs() (angr.knowledge_plugins.key_definitions.rd_model.ReachingD
method), 745
method), 770
get_cpp_function_name()(inmodule get_defs() (angr.knowledge_plugins.key_definitions.ReachingDefinitionsMangr.utils.library), 1197
method), 737
get_data_dep() (angr.analyses.data_dep.data_dependency_analysis.DataDependencyGraphAnalysis
get_dependants() (angr.analyses.CDG method), 801
method), 1160
get_dependants() (angr.analyses.cdg.CDG method),
get_data_dep() (angr.analyses.data_dep.DataDependencyGraphAnalysis
915
method), 1164
get_element() (angr.analyses.decompiler.structured_codegen.base.Positio
get_data_dep() (angr.analyses.DataDependencyGraphAnalysis
method), 1001
method), 824
get_element() (angr.analyses.decompiler.structured_codegen.PositionMa
get_data_references()
method), 998
1300

Index

angr

get_exit_livedefinitions()(inmodule(angr.knowledge_plugins.variables.VariableManager
angr.analyses.reaching_definitions.function_handler),
method), 726
1082
get_function_name() (in module angr.utils.library),
get_exit_stmt_idx()
1195(angr.analyses.cfg.cfg_base.CFGBaseget_function_subgraph()method), 883(angr.analyses.cfg.cfg_emulated.CFGEmulated
get_exit_stmt_idx()(angr.analyses.cfg.CFGBasemethod), 881
method), 872
get_function_subgraph()
get_exit_stmt_idx()(angr.analyses.cfg.CFGEmulated
method),(angr.knowledge_plugins.cfg.cfg_model.CFGModel864
method), 693
get_function_subgraph()
get_exit_stmt_idx()(angr.analyses.CFGEmulated method), 796(angr.knowledge_plugins.cfg.CFGModel
get_global_variables()method), 686(angr.knowledge_plugins.variables.variable_manager.VariableMa
get_expr_depth() (angr.state_plugins.trace_additions.ZenPlugin method), 731
method), 342
get_guardians() (angr.analyses.CDG method), 801
get_fd()(angr.state_plugins.posix.SimSystemPosix get_guardians() (angr.analyses.cdg.CDG method),
method), 312915
get_fd() (angr.state_plugins.SimSystemPosix method), get_heap_definitions()
240(angr.analyses.reaching_definitions.LiveDefinitions
get_flag_bytes() (angr.state_plugins.trace_additions.ZenPlugin method), 1045
method), 343
get_heap_definitions()
get_flag_rand_args()(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin(angr.state_plugins.trace_additions.ZenPlugin
method), 766
static method), 342
get_heap_definitions()
get_footprint() (angr.calling_conventions.SimArrayArg(angr.knowledge_plugins.key_definitions.LiveDefinitions
method), 617
method), 744
get_footprint() (angr.calling_conventions.SimComboArg
get_heap_offset() (angr.analyses.reaching_definitions.LiveDefinitions
method), 616
static method), 1048
get_footprint() (angr.calling_conventions.SimFunctionArgument
get_heap_offset() (angr.analyses.reaching_definitions.rd_state.Reachin
method), 615
static method), 1092
get_footprint() (angr.calling_conventions.SimReferenceArgument
get_heap_offset() (angr.analyses.reaching_definitions.ReachingDefiniti
method), 617
static method), 1061
get_footprint() (angr.calling_conventions.SimRegArg get_heap_offset() (angr.knowledge_plugins.key_definitions.live_definiti
method), 615
static method), 769
get_footprint() (angr.calling_conventions.SimStackArg get_heap_offset() (angr.knowledge_plugins.key_definitions.LiveDefiniti
method), 616
static method), 747
get_footprint() (angr.calling_conventions.SimStructArgget_implementers() (angr.analyses.soot_class_hierarchy.SootClassHiera
method), 617
method), 857
get_func_info() (angr.analyses.Identifier method), get_implementers() (angr.analyses.SootClassHierarchy817
method), 826
get_func_info() (angr.analyses.identifier.identify.Identifier
get_info() (angr.angrdb.AngrDB static method), 916
method), 1130
get_info() (angr.angrdb.db.AngrDB static method),
get_function_diff() (angr.analyses.BinDiff method),918
810
get_intersecting_functions()
get_function_diff() (angr.analyses.bindiff.BinDiff(angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 853
method), 694
get_function_manager()
get_intersecting_functions()(angr.knowledge_plugins.VariableManager(angr.knowledge_plugins.cfg.CFGModel
method), 665
method), 687
get_function_manager()
get_irsb_at() (angr.analyses.datagraph_meta.DataGraphMeta(angr.knowledge_plugins.variables.variable_manager.VariableManager
method), 915
method), 733
get_knowledge() (angr.knowledge_base.KnowledgeBase
get_function_manager()method), 655
Index

1301

angr

get_knowledge() (angr.KnowledgeBase method), 207
get_native_type() (angr.simos.SimJavaVM method),
get_last_statement()
1179(angr.analyses.decompiler.condition_processor.ConditionProcessor
get_nearest_pos() (angr.analyses.decompiler.structured_codegen.base.I
class method), 954
method), 1002
get_last_statement_index()
get_nearest_pos() (angr.analyses.decompiler.structured_codegen.Instru(angr.annocfg.AnnotatedCFG method), 1169
method), 997
get_last_statements()
get_new_uuid() (angr.storage.memory_mixins.JavaVmMemoryMixin(angr.analyses.decompiler.condition_processor.ConditionProcessor
static method), 443
class method), 954
get_node()(angr.analyses.cfg.cfg_base.CFGBaseget_loop_back_edges()
method), 883(angr.analyses.cfg.cfg_base.CFGBaseget_node() (angr.analyses.cfg.CFGBase method), 872
method), 883
get_node() (angr.analyses.decompiler.structured_codegen.base.PositionM
get_loop_back_edges() (angr.analyses.cfg.CFGBasemethod), 1001
method), 872
get_node() (angr.analyses.decompiler.structured_codegen.PositionMappin
get_loops() (angr.annocfg.AnnotatedCFG method),
method), 9981170
get_node() (angr.knowledge_plugins.cfg.cfg_model.CFGModel
get_max_sinkhole() (angr.state_plugins.cgc.SimStateCGC
method), 689
method), 339
get_node() (angr.knowledge_plugins.cfg.CFGModel
get_max_sinkhole() (angr.state_plugins.SimStateCGC
method), 683
method), 258
get_node() (angr.knowledge_plugins.Function method),
get_memory_definitions()
660(angr.analyses.reaching_definitions.LiveDefinitions
get_node() (angr.knowledge_plugins.functions.Function
method), 1045
method), 707
get_memory_definitions()
get_node() (angr.knowledge_plugins.functions.function.Function(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 719
method), 766
get_normalized_block()
get_memory_definitions()(angr.analyses.bindiff.FunctionDiff
static(angr.knowledge_plugins.key_definitions.LiveDefinitions method), 852
method), 744
get_objects_by_offset()
get_model() (angr.knowledge_plugins.key_definitions.key_definition_manager.KeyDefinitionManager(angr.keyed_region.KeyedRegion
method),method), 760
783
get_model() (angr.knowledge_plugins.key_definitions.KeyDefinitionManager
get_observation_by_exit()
method), 739(angr.analyses.reaching_definitions.ReachingDefinitionsModel
get_model() (angr.knowledge_plugins.KeyDefinitionManager
method), 1059
method), 671
get_observation_by_exit()
get_most_accurate()(angr.knowledge_plugins.key_definitions.rd_model.ReachingDefin(angr.knowledge_plugins.cfg.cfg_manager.CFGManager method), 771
method), 697
get_observation_by_exit()
get_most_accurate()(angr.knowledge_plugins.key_definitions.ReachingDefinitionsMod(angr.knowledge_plugins.cfg.CFGManager
method), 738
method), 688
get_observation_by_insn()
get_most_accurate()(angr.analyses.reaching_definitions.ReachingDefinitionsModel(angr.knowledge_plugins.CFGManager
method), 1058
method), 668
get_observation_by_insn()
get_mountpoint() (angr.state_plugins.filesystem.SimFilesystem(angr.knowledge_plugins.key_definitions.rd_model.ReachingDefin
method), 316
method), 771
get_mountpoint() (angr.state_plugins.SimFilesystem get_observation_by_insn()
method), 282(angr.knowledge_plugins.key_definitions.ReachingDefinitionsMod
get_native_cc()(angr.simos.javavm.SimJavaVM
method), 738
method), 1187
get_observation_by_node()
get_native_cc() (angr.simos.SimJavaVM method),(angr.analyses.reaching_definitions.ReachingDefinitionsModel
1179
method), 1059
get_native_type() (angr.simos.javavm.SimJavaVM get_observation_by_node()
method), 1186
(angr.knowledge_plugins.key_definitions.rd_model.ReachingDefin
1302

Index

angr

method), 771
get_plugin() (angr.knowledge_base.KnowledgeBase
get_observation_by_node()
method), 655(angr.knowledge_plugins.key_definitions.ReachingDefinitionsModel
get_plugin() (angr.KnowledgeBase method), 207
method), 738
get_plugin() (angr.misc.plugins.PluginHub method),
get_observation_by_stmt()
218(angr.analyses.reaching_definitions.ReachingDefinitionsModel
get_plugin() (angr.sim_state.SimState method), 221
method), 1059
get_plugin() (angr.SimState method), 178
get_observation_by_stmt()
get_possible_len() (angr.state_plugins.trace_additions.ChallRespInfo(angr.knowledge_plugins.key_definitions.rd_model.ReachingDefinitionsModel
method), 341
method), 771
get_post_dominators()(angr.analyses.CDG
get_observation_by_stmt()
method), 801(angr.knowledge_plugins.key_definitions.ReachingDefinitionsModel
get_post_dominators()(angr.analyses.cdg.CDG
method), 738
method), 915
get_one_value() (angr.analyses.reaching_definitions.LiveDefinitions
get_predecessors() (angr.analyses.cfg.cfg_base.CFGBasemethod), 1046
method), 883
get_one_value() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
get_predecessors()(angr.analyses.cfg.CFGBasemethod), 1096
method), 872
get_one_value() (angr.analyses.reaching_definitions.ReachingDefinitionsState
get_predecessors() (angr.analyses.DDG method),
method), 1066802
get_one_value() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
get_predecessors()(angr.analyses.ddg.DDG
method), 767
method), 1028
get_one_value() (angr.knowledge_plugins.key_definitions.LiveDefinitions
get_predecessors()(angr.analyses.VSA_DDG
method), 745
method), 809
get_one_value_from_atom()
get_predecessors() (angr.analyses.vsa_ddg.VSA_DDG(angr.analyses.reaching_definitions.LiveDefinitions
method), 1139
method), 1046
get_predecessors() (angr.knowledge_plugins.cfg.cfg_model.CFGModel
get_one_value_from_atom()method), 691(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
get_predecessors() (angr.knowledge_plugins.cfg.CFGModel
method), 767
method), 684
get_one_value_from_atom()
get_predecessors_and_jumpkind()(angr.knowledge_plugins.key_definitions.LiveDefinitions (angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 745
method), 692
get_one_value_from_definition()
get_predecessors_and_jumpkind()(angr.analyses.reaching_definitions.LiveDefinitions(angr.knowledge_plugins.cfg.CFGModel
method), 1046
method), 686
get_one_value_from_definition()
get_predecessors_and_jumpkinds()(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions(angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 767
method), 692
get_one_value_from_definition()
get_predecessors_and_jumpkinds()(angr.knowledge_plugins.key_definitions.LiveDefinitions (angr.knowledge_plugins.cfg.CFGModel
method), 745
method), 685
get_optimization_passes()(inmodule get_prototype() (angr.knowledge_plugins.callsite_prototypes.CallsitePro
angr.analyses.decompiler.optimization_passes),method), 675974
get_prototype() (angr.knowledge_plugins.CallsitePrototypes
get_patch() (angr.knowledge_plugins.patches.PatchManager
method), 673
method), 674
get_prototype() (angr.procedures.definitions.SimCppLibrary
get_patch() (angr.knowledge_plugins.PatchManager
method), 609
method), 669
get_prototype() (angr.procedures.definitions.SimLibrary
get_phi_subvariables()method), 608(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
get_prototype() (angr.procedures.definitions.SimSyscallLibrarymethod), 731
method), 612
get_phi_variables()get_prototype_type()(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal(angr.knowledge_plugins.callsite_prototypes.CallsitePrototypes
method), 731
method), 676
Index

1303

angr

get_prototype_type()
method), 744(angr.knowledge_plugins.CallsitePrototypes
get_regs() (angr.state_plugins.Unicorn method), 262
method), 673
get_regs() (angr.state_plugins.unicorn_engine.Unicorn
get_reaching_definitions()
method), 356(angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
get_run() (angr.annocfg.AnnotatedCFG method), 1169
method), 1077
get_same_length_constraints()
get_reaching_definitions()(angr.state_plugins.trace_additions.ChallRespInfo(angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
method), 342
method), 1056
get_segment_register_name()
get_reaching_definitions()(angr.simos.linux.SimLinux method), 1182
(angr.analyses.ReachingDefinitionsAnalysis
get_segment_register_name()method), 820(angr.simos.SimLinux method), 1176
get_reaching_definitions_by_insn()
get_segment_register_name()(angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis(angr.simos.SimWindows method), 1177
method), 1077
get_segment_register_name()
get_reaching_definitions_by_insn()(angr.simos.windows.SimWindows
method),(angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
1185
method), 1056
get_size() (angr.PTChunk method), 204
get_reaching_definitions_by_insn()
get_size() (angr.state_plugins.heap.heap_freelist.Chunk(angr.analyses.ReachingDefinitionsAnalysis
method), 373
method), 820
get_size() (angr.state_plugins.heap.heap_ptmalloc.PTChunk
get_reaching_definitions_by_node()
method), 375(angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
get_size()(angr.state_plugins.heap.PTChunkmethod), 1077
method), 369
get_reaching_definitions_by_node()
get_size() (angr.state_plugins.PTChunk method), 289(angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
get_sp() (angr.analyses.reaching_definitions.LiveDefinitions
method), 1056
method), 1043
get_reaching_definitions_by_node()
get_sp() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitions(angr.analyses.ReachingDefinitionsAnalysis
method), 1093
method), 820
get_sp() (angr.analyses.reaching_definitions.ReachingDefinitionsState
get_real_len() (angr.state_plugins.trace_additions.ChallRespInfo method), 1062
method), 341
get_sp() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefi
get_recent_bbl_addrs() (angr.state_plugins.Unicorn
method), 764
method), 262
get_sp() (angr.knowledge_plugins.key_definitions.LiveDefinitions
get_recent_bbl_addrs()
method), 742(angr.state_plugins.unicorn_engine.Unicorn
get_sp_offset() (angr.analyses.reaching_definitions.LiveDefinitions
method), 356
method), 1043
get_recent_n() (angr.exploration_techniques.spiller.PickledStatesDb
get_sp_offset() (angr.knowledge_plugins.key_definitions.live_definition
method), 528
method), 764
get_ref()(angr.state_hierarchy.StateHierarchy get_sp_offset() (angr.knowledge_plugins.key_definitions.LiveDefinition
method), 505
method), 742
get_ref() (angr.StateHierarchy method), 176
get_stack_address()
get_reg_name()(angr.analyses.Identifier
static(angr.analyses.reaching_definitions.LiveDefinitions
method), 817
method), 1043
get_reg_name() (angr.analyses.identifier.identify.Identifierget_stack_address()static method), 1131
(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsS
get_register_definitions()
method), 1093
(angr.analyses.reaching_definitions.LiveDefinitions
get_stack_address()method), 1045
(angr.analyses.reaching_definitions.ReachingDefinitionsState
get_register_definitions()
method), 1063
(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
get_stack_address()method), 766(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
get_register_definitions()
method), 764(angr.knowledge_plugins.key_definitions.LiveDefinitions
get_stack_address()
1304

Index

angr

(angr.knowledge_plugins.key_definitions.LiveDefinitions
get_sub_classes_including()
method), 742(angr.analyses.soot_class_hierarchy.SootClassHierarchy
get_stack_definitions()
method), 857(angr.analyses.reaching_definitions.LiveDefinitions
get_sub_classes_including()
method), 1045
(angr.analyses.SootClassHierarchy method),
get_stack_definitions()
826(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
get_sub_interfaces()
method), 766(angr.analyses.soot_class_hierarchy.SootClassHierarchy
get_stack_definitions()
method), 857(angr.knowledge_plugins.key_definitions.LiveDefinitions
get_sub_interfaces()
method), 744(angr.analyses.SootClassHierarchy method),
get_stack_offset() (angr.analyses.reaching_definitions.LiveDefinitions
826
static method), 1042
get_sub_interfaces_including()
get_stack_offset() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState(angr.analyses.soot_class_hierarchy.SootClassHierarchy
method), 1092
method), 857
get_stack_offset() (angr.analyses.reaching_definitions.ReachingDefinitionsState
get_sub_interfaces_including()
method), 1061
(angr.analyses.SootClassHierarchy method),
get_stack_offset() (angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase826
method), 1109
get_subgraph() (angr.analyses.cfg.cfg_emulated.CFGEmulated
get_stack_offset() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 880
static method), 763
get_subgraph()(angr.analyses.cfg.CFGEmulated
get_stack_offset() (angr.knowledge_plugins.key_definitions.LiveDefinitions
method), 864
static method), 741
get_subgraph()(angr.analyses.CFGEmulated
get_stack_values() (angr.analyses.reaching_definitions.LiveDefinitions
method), 796
method), 1045
get_successors() (angr.analyses.cfg.cfg_base.CFGBaseget_stack_values() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 883
method), 766
get_successors()(angr.analyses.cfg.CFGBaseget_stack_values() (angr.knowledge_plugins.key_definitions.LiveDefinitions
method), 872
method), 744
get_successors() (angr.knowledge_plugins.cfg.cfg_model.CFGModel
get_stdin_indices()
method), 691(angr.state_plugins.trace_additions.ChallRespInfoget_successors() (angr.knowledge_plugins.cfg.CFGModel
method), 341
method), 684
get_stdout_indices()
get_successors_and_jumpkind()(angr.state_plugins.trace_additions.ChallRespInfo(angr.analyses.cfg.cfg_base.CFGBasemethod), 341
method), 883
get_stop_details()(angr.state_plugins.Unicorn get_successors_and_jumpkind()method), 262(angr.analyses.cfg.CFGBase method), 872
get_stop_details() (angr.state_plugins.unicorn_engine.Unicorn
get_successors_and_jumpkind()method), 356(angr.knowledge_plugins.cfg.cfg_model.CFGModel
get_stop_msg() (angr.state_plugins.unicorn_engine.STOP
method), 692
static method), 353
get_successors_and_jumpkind()get_structurer_option()(inmodule(angr.knowledge_plugins.cfg.CFGModelangr.analyses.decompiler.decompilation_options),
method), 685
955
get_successors_and_jumpkinds()
get_stub() (angr.procedures.definitions.SimCppLibrary(angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 609
method), 691
get_stub()(angr.procedures.definitions.SimLibrary get_successors_and_jumpkinds()
method), 608(angr.knowledge_plugins.cfg.CFGModel
get_stub() (angr.procedures.definitions.SimSyscallLibrarymethod), 685
method), 612
get_super_classes()
get_sub_classes() (angr.analyses.soot_class_hierarchy.SootClassHierarchy(angr.analyses.soot_class_hierarchy.SootClassHierarchy
method), 857
method), 857
get_sub_classes() (angr.analyses.SootClassHierarchy get_super_classes()method), 826(angr.analyses.SootClassHierarchy method),
Index

1305

angr

825
(angr.knowledge_plugins.functions.function.Function
get_super_classes_including()
method), 723(angr.analyses.soot_class_hierarchy.SootClassHierarchy
get_unconstrained_simprocedure()
method), 857(angr.engines.soot.engine.SootMixin method),
get_super_classes_including()
559(angr.analyses.SootClassHierarchy method), get_unconstrained_simprocedure()826(angr.engines.soot.SootMixin method), 558
get_superclass() (angr.state_plugins.javavm_classloader.SimJavaVmClassloader
get_unconstrained_simprocedure()
method), 360(angr.engines.SootMixin method), 551
get_superclass() (angr.state_plugins.SimJavaVmClassloader
get_unified_local_vars()
method), 294(angr.analyses.decompiler.structured_codegen.c.CFunction
get_symbolic_addrs()
method), 1004
(angr.storage.memory_mixins.convenient_mappings_mixin.ConvenientMappingsMixin
get_unified_variables()method), 455(angr.knowledge_plugins.variables.variable_manager.VariableMa
get_symbolic_addrs()
method), 731(angr.storage.memory_mixins.ConvenientMappingsMixin
get_unique_label() (angr.knowledge_plugins.Labels
method), 417
method), 668
get_targets() (angr.annocfg.AnnotatedCFG method), get_unique_label() (angr.knowledge_plugins.labels.Labels
1170
method), 704
get_tmp_definitions()
get_unique_strings()(inmodule(angr.analyses.reaching_definitions.LiveDefinitions
angr.flirt.build_sig), 1188
method), 1045
get_unique_symbol_name()
get_tmp_definitions()(angr.analyses.reassembler.SymbolManager(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 1146
method), 765
get_uses() (angr.knowledge_plugins.key_definitions.Uses
get_tmp_definitions()
method), 748(angr.knowledge_plugins.key_definitions.LiveDefinitions
get_uses() (angr.knowledge_plugins.key_definitions.uses.Uses
method), 743
method), 774
get_topological_order()get_uses_by_insaddr()(angr.analyses.cfg.cfg_emulated.CFGEmulated(angr.knowledge_plugins.key_definitions.Uses
method), 880
method), 749
get_topological_order()get_uses_by_insaddr()(angr.analyses.cfg.CFGEmulated
method),(angr.knowledge_plugins.key_definitions.uses.Uses864
method), 775
get_topological_order()get_uses_by_location()(angr.analyses.CFGEmulated method), 795(angr.knowledge_plugins.key_definitions.Uses
get_type() (angr.state_plugins.trace_additions.FormatInfo
method), 749
method), 339
get_uses_by_location()
get_type() (angr.state_plugins.trace_additions.FormatInfoDontConstrain(angr.knowledge_plugins.key_definitions.uses.Uses
method), 340
method), 774
get_type() (angr.state_plugins.trace_additions.FormatInfoIntToStr
get_uses_with_expr()
method), 340(angr.knowledge_plugins.key_definitions.Uses
get_type() (angr.state_plugins.trace_additions.FormatInfoStrToInt method), 748
method), 339
get_uses_with_expr()
get_type_variable()(angr.knowledge_plugins.key_definitions.uses.Uses(angr.analyses.typehoon.typevars.TypeVariables
method), 774
method), 1125
get_value() (angr.calling_conventions.SimArrayArg
get_unambiguous_name()method), 617(angr.knowledge_plugins.Function
method), get_value() (angr.calling_conventions.SimComboArg664
method), 616
get_unambiguous_name()
get_value() (angr.calling_conventions.SimFunctionArgument(angr.knowledge_plugins.functions.Function
method), 615
method), 712
get_value() (angr.calling_conventions.SimLyingRegArg
get_unambiguous_name()method), 622
1306

Index

angr

get_value() (angr.calling_conventions.SimReferenceArgument
get_variable_definitions()
method), 617(angr.analyses.variable_recovery.variable_recovery_base.Variabl
get_value()(angr.calling_conventions.SimRegArg
method), 1107
method), 615
get_variable_definitions()
get_value() (angr.calling_conventions.SimStackArg(angr.analyses.variable_recovery.variable_recovery_base.Variabl
method), 616
method), 1109
get_value() (angr.calling_conventions.SimStructArg get_variable_type()
method), 617(angr.knowledge_plugins.variables.variable_manager.VariableMa
get_value_from_atom()method), 732(angr.analyses.reaching_definitions.LiveDefinitions
get_variables() (angr.knowledge_plugins.variables.variable_manager.V
method), 1046
method), 730
get_value_from_atom()
get_variables()(angr.state_plugins.SimSolver(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 242
method), 767
get_variables() (angr.state_plugins.solver.SimSolver
get_value_from_atom()method), 320(angr.knowledge_plugins.key_definitions.LiveDefinitions
get_variables_by_offset()method), 745(angr.keyed_region.KeyedRegion
method),get_value_from_definition()783(angr.analyses.reaching_definitions.LiveDefinitions
get_variables_without_writes()method), 1045
(angr.knowledge_plugins.variables.variable_manager.VariableMa
get_value_from_definition()
method), 731(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
get_whitelisted_statements()
method), 766(angr.annocfg.AnnotatedCFG method), 1169
get_value_from_definition()
get_xrefs_by_dst() (angr.knowledge_plugins.XRefManager(angr.knowledge_plugins.key_definitions.LiveDefinitions method), 668
method), 744
get_xrefs_by_dst() (angr.knowledge_plugins.xrefs.xref_manager.XRefM
get_values() (angr.analyses.reaching_definitions.LiveDefinitions method), 779
method), 1046
get_xrefs_by_dst() (angr.knowledge_plugins.xrefs.XRefManager
get_values() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
method), 777
method), 1096
get_xrefs_by_dst_region()
get_values() (angr.analyses.reaching_definitions.ReachingDefinitionsState(angr.knowledge_plugins.XRefManager
method), 1066
method), 668
get_values() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
get_xrefs_by_dst_region()
method), 767(angr.knowledge_plugins.xrefs.xref_manager.XRefManager
get_values() (angr.knowledge_plugins.key_definitions.LiveDefinitions
method), 779
method), 745
get_xrefs_by_dst_region()
get_variable() (angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILState(angr.knowledge_plugins.xrefs.XRefManager
method), 982
method), 777
get_variable() (angr.state_plugins.debug_variables.SimDebugVariablePlugin
get_xrefs_by_ins_addr()
method), 381(angr.knowledge_plugins.XRefManager
get_variable() (angr.state_plugins.SimDebugVariablePlugin
method), 668
method), 298
get_xrefs_by_ins_addr()
get_variable_accesses()(angr.knowledge_plugins.xrefs.xref_manager.XRefManager(angr.knowledge_plugins.VariableManager
method), 779
method), 665
get_xrefs_by_ins_addr()
get_variable_accesses()(angr.knowledge_plugins.xrefs.XRefManager(angr.knowledge_plugins.variables.variable_manager.VariableManager
method), 777
method), 734
get_xrefs_by_ins_addr_region()
get_variable_accesses()(angr.knowledge_plugins.XRefManager(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
method), 668
method), 730
get_xrefs_by_ins_addr_region()
get_variable_accesses()(angr.knowledge_plugins.xrefs.xref_manager.XRefManager(angr.knowledge_plugins.variables.VariableManager
method), 779
method), 726
get_xrefs_by_ins_addr_region()
Index

1307

angr

(angr.knowledge_plugins.xrefs.XRefManager
property), 1164
method), 777
graph (angr.analyses.DataDependencyGraphAnalysis
getpiece() (angr.analyses.disassembly.DisassemblyPiece
property), 824
method), 1141
graph (angr.analyses.DDG property), 802
getstate()(angr.calling_conventions.ArgSession graph (angr.analyses.ddg.DDG property), 1028
method), 618
graph (angr.analyses.decompiler.graph_region.GraphRegion
getstate() (angr.calling_conventions.SerializableCounter
attribute), 959
method), 614
graph (angr.analyses.forward_analysis.forward_analysis.ForwardAnalysis
getstate() (angr.calling_conventions.SerializableIterator
property), 839
method), 614
graph (angr.analyses.forward_analysis.ForwardAnalysis
getstate() (angr.calling_conventions.SerializableListIterator
property), 835
method), 614
graph (angr.analyses.ForwardAnalysis property), 787
getstate() (angr.calling_conventions.SimCC.ArgSession graph (angr.analyses.reaching_definitions.dep_graph.DepGraphmethod), 619
property), 1079
getstate() (angr.calling_conventions.UsercallArgSessiongraph (angr.analyses.typehoon.simple_solver.Sketch atmethod), 618
tribute), 1118
getstate() (angr.SimCC.ArgSession method), 181
graph (angr.knowledge_plugins.cfg.cfg_model.CFGModelgive_up_on_memory_tracking()
attribute), 688(angr.analyses.stack_pointer_tracker.StackPointerTrackerStategraph (angr.knowledge_plugins.cfg.CFGModel atmethod), 1104
tribute), 682
global_addr (angr.knowledge_plugins.key_definitions.definition.DefinitionMatchPredicate
graph (angr.knowledge_plugins.Function property), 662
attribute), 756
graph (angr.knowledge_plugins.functions.Function propGlobalDescriptorTable (class in angr.simos.simos),erty), 710
1181
graph (angr.knowledge_plugins.functions.function.Function
GotoSimplifier(classinproperty), 721
angr.analyses.decompiler.region_simplifiers.goto),graph_ex() (angr.knowledge_plugins.Function method),
991
662
GOTPLTEntry (angr.knowledge_plugins.cfg.memory_data.MemoryDataSort
graph_ex() (angr.knowledge_plugins.functions.Function
attribute), 695
method), 710
GOTPLTEntry (angr.knowledge_plugins.cfg.MemoryDataSort
graph_ex() (angr.knowledge_plugins.functions.function.Function
attribute), 676
method), 722
gp (angr.analyses.cfg.cfg_fast.CFGJob attribute), 889
graph_visitor (angr.knowledge_plugins.propagations.PropagationModel
gp_register_read_hook()
attribute), 703(angr.analyses.cfg.indirect_jump_resolvers.jumptable.MIPSGPHook
graph_with_successors
method), 902(angr.analyses.decompiler.graph_region.GraphRegion
gp_register_write_hook()
attribute), 959(angr.analyses.cfg.indirect_jump_resolvers.jumptable.MIPSGPHook
GraphChangedNotification, 939
method), 902
GraphDephication (class in angr.analyses.decompiler),graph (angr.analyses.CDG property), 801947graph (angr.analyses.cdg.CDG property), 915
GraphRegion(classingraph (angr.analyses.cfg.cfg_base.CFGBase property),
angr.analyses.decompiler.graph_region),
883
959
graph (angr.analyses.cfg.cfg_emulated.CFGEmulated GraphUtils (class in angr.utils.graph), 1193
property), 881
GraphVisitor(classingraph (angr.analyses.cfg.cfg_fast.CFGFast property),
angr.analyses.forward_analysis.visitors.graph),
892
845
graph (angr.analyses.cfg.CFGBase property), 872
GT (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.C
graph (angr.analyses.cfg.CFGEmulated property), 864
attribute), 993
graph (angr.analyses.cfg.CFGFast property), 860
GUARD (angr.analyses.reaching_definitions.AtomKind atgraph (angr.analyses.CFGEmulated property), 796
tribute), 1049
graph (angr.analyses.CFGFast property), 792
guard (angr.errors.SimError attribute), 1201
graph (angr.analyses.data_dep.data_dependency_analysis.DataDependencyGraphAnalysis
GUARD (angr.knowledge_plugins.key_definitions.atoms.AtomKind
property), 1160
attribute), 751
graph (angr.analyses.data_dep.DataDependencyGraphAnalysis
guard (angr.SimError attribute), 159
1308

Index

angr

GuardUse (class in angr.analyses.reaching_definitions), handle_CFunction() (angr.analyses.decompiler.structured_codegen.c.CS
1052
method), 1018
GuardUse (class in angr.knowledge_plugins.key_definitions.atoms),
handle_CFunction() (angr.analyses.decompiler.structured_codegen.CStr752
method), 999
guess_prototype() (angr.calling_conventions.SimCC handle_CFunctionCall()static method), 620(angr.analyses.decompiler.structured_codegen.c.CStructuredCode
guess_prototype() (angr.calling_conventions.SimCCSoot
method), 1018
static method), 632
handle_CFunctionCall()guess_prototype() (angr.SimCC static method), 182(angr.analyses.decompiler.structured_codegen.c.MakeTypecastsIm
guess_value_type()(inmodulemethod), 1019
angr.analyses.decompiler.structured_codegen.c), handle_CFunctionCall()1003(angr.analyses.decompiler.structured_codegen.CStructuredCodeW
guessed_cc (angr.analyses.reaching_definitions.function_handler.FunctionCallData
method), 1000
attribute), 1085
handle_CGoto() (angr.analyses.decompiler.structured_codegen.c.CStructu
guessed_cc (angr.analyses.reaching_definitions.FunctionCallData method), 1018
attribute), 1071
handle_CGoto() (angr.analyses.decompiler.structured_codegen.CStructur
guessed_prototype (angr.analyses.reaching_definitions.function_handler.FunctionCallData
method), 1000
attribute), 1085
handle_CIfBreak() (angr.analyses.decompiler.structured_codegen.c.CStr
guessed_prototype (angr.analyses.reaching_definitions.FunctionCallData
method), 1018
attribute), 1071
handle_CIfBreak() (angr.analyses.decompiler.structured_codegen.CStru
method), 1000
H
handle_CIfElse() (angr.analyses.decompiler.structured_codegen.c.CStru
method), 1018
handle() (angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
handle_CIfElse() (angr.analyses.decompiler.structured_codegen.CStruct
method), 1018
method), 1000
handle() (angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker
handle_CIndexedVariable()method), 999(angr.analyses.decompiler.structured_codegen.c.CStructuredCode
handle_CAssignment()
method), 1018
(angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
handle_CIndexedVariable()method), 1018
(angr.analyses.decompiler.structured_codegen.CStructuredCodeW
handle_CAssignment()
method), 1000
(angr.analyses.decompiler.structured_codegen.c.MakeTypecastsImplicit
handle_CITE() (angr.analyses.decompiler.structured_codegen.c.CStructur
method), 1019
method), 1019
handle_CAssignment()
handle_CITE() (angr.analyses.decompiler.structured_codegen.CStructured(angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker
method), 1000
method), 1000
handle_CReturn() (angr.analyses.decompiler.structured_codegen.c.CStru
handle_CBinaryOp() (angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
method), 1018
method), 1019
handle_CReturn() (angr.analyses.decompiler.structured_codegen.c.Make
handle_CBinaryOp() (angr.analyses.decompiler.structured_codegen.c.MakeTypecastsImplicit
method), 1019
method), 1019
handle_CReturn() (angr.analyses.decompiler.structured_codegen.CStructhandle_CBinaryOp() (angr.analyses.decompiler.structured_codegen.c.PointerArithmeticFixer
method), 1000
method), 1019
handle_CStatements()
handle_CBinaryOp() (angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker(angr.analyses.decompiler.structured_codegen.c.CStructuredCode
method), 1000
method), 1018
handle_CDoWhileLoop()
handle_CStatements()(angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker(angr.analyses.decompiler.structured_codegen.CStructuredCodeW
method), 1018
method), 1000
handle_CDoWhileLoop()
handle_CSwitchCase()(angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker(angr.analyses.decompiler.structured_codegen.c.CStructuredCode
method), 1000
method), 1018
handle_CForLoop() (angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
handle_CSwitchCase()method), 1018
(angr.analyses.decompiler.structured_codegen.CStructuredCodeW
handle_CForLoop() (angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker
method), 1000
method), 1000
handle_CTypeCast() (angr.analyses.decompiler.structured_codegen.c.CS
Index

1309

angr

method), 1019
method), 1088
handle_CTypeCast() (angr.analyses.decompiler.structured_codegen.c.FieldReferenceCleanup
handle_indirect_function()
method), 1019
(angr.analyses.reaching_definitions.FunctionHandler
handle_CTypeCast() (angr.analyses.decompiler.structured_codegen.c.MakeTypecastsImplicit
method), 1068
method), 1019
handle_local_function()
handle_CTypeCast() (angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker(angr.analyses.find_objects_static.NewFunctionHandler
method), 1000
method), 1140
handle_CUnaryOp() (angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
handle_local_function()
method), 1018
(angr.analyses.reaching_definitions.function_handler.FunctionHa
handle_CUnaryOp() (angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker
method), 1088
method), 1000
handle_local_function()
handle_CVariableField()(angr.analyses.reaching_definitions.FunctionHandler(angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
method), 1068
method), 1018
handle_pcode_block()handle_CVariableField()(angr.engines.pcode.emulate.PcodeEmulatorMixin(angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker
method), 573
method), 1000
handle_vex_block() (angr.engines.SimInspectMixin
handle_CWhileLoop()
method), 547(angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
handle_vex_block() (angr.engines.SuperFastpathMixin
method), 1018
method), 547
handle_CWhileLoop()
handle_vex_block() (angr.engines.TrackActionsMixin(angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker
method), 547
method), 1000
handle_vex_block() (angr.engines.vex.SimInspectMixin
handle_default() (angr.analyses.decompiler.structured_codegen.c.CStructuredCodeWalker
method), 557
method), 1018
handle_vex_block() (angr.engines.vex.SuperFastpathMixin
handle_default() (angr.analyses.decompiler.structured_codegen.CStructuredCodeWalker
method), 557
method), 999
handle_vex_block() (angr.engines.vex.TrackActionsMixin
handle_exception() (angr.SimOS method), 165
method), 556
handle_exception() (angr.simos.SimOS method), handle_vex_block()(angr.engines.vex.VEXMixin1172
method), 556
handle_exception()(angr.simos.simos.SimOS handle_vex_block() (angr.engines.vex.VEXSlicingMixin
method), 1180
method), 556
handle_exception()(angr.simos.SimWindows hardcopy (angr.state_plugins.history.TreeIter property),
method), 1176
336
handle_exception() (angr.simos.windows.SimWindows HAS_BITSHIFTS (angr.analyses.code_tagging.CodeTags
method), 1184
attribute), 916
handle_external_function()
has_bitshifts() (angr.analyses.code_tagging.CodeTagging(angr.analyses.reaching_definitions.function_handler.FunctionHandler
method), 916
method), 1088
has_bitshifts()(angr.analyses.CodeTagging
handle_external_function()
method), 822(angr.analyses.reaching_definitions.FunctionHandler
has_clobbered() (angr.analyses.reaching_definitions.function_handler.Fu
method), 1068
method), 1085
handle_function() (angr.analyses.reaching_definitions.function_handler.FunctionHandler
has_clobbered() (angr.analyses.reaching_definitions.FunctionCallData
method), 1088
method), 1071
handle_function() (angr.analyses.reaching_definitions.FunctionHandler
has_default_value (angr.sim_state_options.StateOption
method), 1067
property), 223
handle_generic_function()
has_function_manager()(angr.analyses.reaching_definitions.function_handler.FunctionHandler(angr.knowledge_plugins.VariableManager
method), 1088
method), 665
handle_generic_function()
has_function_manager()(angr.analyses.reaching_definitions.FunctionHandler(angr.knowledge_plugins.variables.variable_manager.VariableMa
method), 1067
method), 733
handle_indirect_function()
has_function_manager()(angr.analyses.reaching_definitions.function_handler.FunctionHandler(angr.knowledge_plugins.variables.VariableManager
1310

Index

angr

method), 726
has_prototype() (angr.procedures.definitions.SimLibrary
has_implementation()
method), 608(angr.procedures.definitions.SimCppLibrary
has_prototype() (angr.procedures.definitions.SimSyscallLibrarymethod), 610
method), 613
has_implementation()
has_return (angr.knowledge_plugins.cfg.cfg_node.CFGNode(angr.procedures.definitions.SimLibrary
attribute), 698
method), 608
has_return (angr.knowledge_plugins.cfg.CFGNode athas_implementation()tribute), 678(angr.procedures.definitions.SimSyscallLibrary has_return (angr.knowledge_plugins.Function propmethod), 613erty), 663
has_job() (angr.analyses.forward_analysis.forward_analysis.ForwardAnalysis
has_return (angr.knowledge_plugins.functions.Function
method), 839
property), 711
has_job() (angr.analyses.forward_analysis.ForwardAnalysis
has_return (angr.knowledge_plugins.functions.function.Function
method), 835
property), 723
has_job() (angr.analyses.ForwardAnalysis method), HAS_SQL (angr.analyses.code_tagging.CodeTags at788
tribute), 916
has_load (angr.analyses.decompiler.region_simplifiers.expr_folding.ExpressionUseFinder
has_sql() (angr.analyses.code_tagging.CodeTagging
attribute), 990
method), 916
has_memory_dep (angr.state_plugins.unicorn_engine.VEXStmtDetails
has_sql() (angr.analyses.CodeTagging method), 822
attribute), 351
has_statements (angr.engines.pcode.lifter.IRSB prophas_metadata() (angr.procedures.definitions.SimCppLibraryerty), 566
method), 609
has_store() (angr.analyses.decompiler.region_simplifiers.expr_folding.St
has_metadata() (angr.procedures.definitions.SimLibrarymethod), 991
method), 608
has_super_class() (angr.analyses.soot_class_hierarchy.SootClassHierar
has_metadata() (angr.procedures.definitions.SimSyscallLibrarymethod), 857
method), 612
has_super_class() (angr.analyses.SootClassHierarchy
has_model() (angr.knowledge_plugins.key_definitions.key_definition_manager.KeyDefinitionManager
method), 825
method), 760
has_symbolic_exit (angr.state_plugins.unicorn_engine.BlockDetails
has_model() (angr.knowledge_plugins.key_definitions.KeyDefinitionManager
attribute), 351
method), 739
has_tmpexpr() (angr.analyses.propagator.engine_ail.SimEnginePropagat
has_model() (angr.knowledge_plugins.KeyDefinitionManager
static method), 1037
method), 671
has_type_variable_for()has_nonlabel_nonphi_statements()(angr.analyses.typehoon.typevars.TypeVariables(angr.analyses.decompiler.structuring.structurer_base.StructurerBase
method), 1125
static method), 939
has_unresolved_calls
has_nonlabel_nonphi_statements() (in module(angr.knowledge_plugins.Function property),
angr.analyses.decompiler.utils), 1021
660
has_nonlabel_statements()(inmodule has_unresolved_calls
angr.analyses.decompiler.utils), 1021
(angr.knowledge_plugins.functions.Function
has_plugin() (angr.knowledge_base.KnowledgeBase
property), 707
method), 655
has_unresolved_calls
has_plugin() (angr.KnowledgeBase method), 207(angr.knowledge_plugins.functions.function.Function
has_plugin() (angr.misc.plugins.PluginHub method),
property), 719
218
has_unresolved_jumps
has_plugin() (angr.sim_state.SimState method), 221(angr.knowledge_plugins.Function property),
has_plugin() (angr.SimState method), 178660
has_plugin_preset(angr.misc.plugins.PluginHub has_unresolved_jumps
property), 218(angr.knowledge_plugins.functions.Function
has_prototype() (angr.knowledge_plugins.callsite_prototypes.CallsitePrototypes
property), 707
method), 676
has_unresolved_jumps
has_prototype() (angr.knowledge_plugins.CallsitePrototypes(angr.knowledge_plugins.functions.function.Function
method), 673
property), 719
has_prototype() (angr.procedures.definitions.SimCppLibrary
HAS_XOR (angr.analyses.code_tagging.CodeTags atmethod), 610
tribute), 916
Index

1311

angr

has_xor() (angr.analyses.code_tagging.CodeTagging
property), 1093
method), 916
heap_uses (angr.analyses.reaching_definitions.ReachingDefinitionsState
has_xor() (angr.analyses.CodeTagging method), 822
property), 1062
HasCallExprWalker(classin heap_uses (angr.knowledge_plugins.key_definitions.live_definitions.LiveDeangr.analyses.decompiler.block_simplifier),
attribute), 762
949
heap_uses (angr.knowledge_plugins.key_definitions.LiveDefinitions
HasCallNotification, 948
attribute), 740
HasField (class in angr.analyses.typehoon.typevars), HeapAddress(classin1126
angr.knowledge_plugins.key_definitions.heap_address),
HasNext (angr.analyses.loop_analysis.VariableTypes at759
tribute), 1131
HeapAllocator(classin
HasVVarNotification, 948
angr.analyses.reaching_definitions.heap_allocator),head (angr.analyses.decompiler.graph_region.GraphRegion
1081
attribute), 959
HeavyPcodeMixin (class in angr.engines.pcode), 561
head (angr.analyses.decompiler.structuring.structurer_nodes.IncompleteSwitchCaseNode
HeavyPcodeMixin (class in angr.engines.pcode.engine),
attribute), 937
562
headerless_c_repr_chunks()
HeavyResilienceMixin (class in angr.engines), 547(angr.analyses.decompiler.structured_codegen.c.CFunction
HeavyResilienceMixin (class in angr.engines.vex),
method), 1004
557
heap (angr.analyses.reaching_definitions.LiveDefinitions HeavyVEXMixin (class in angr.engines), 546
attribute), 1041
HeavyVEXMixin (class in angr.engines.vex), 556
heap (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
height()(angr.analyses.disassembly.Comment
property), 1093
method), 1144
heap (angr.analyses.reaching_definitions.ReachingDefinitionsState
height() (angr.analyses.disassembly.DisassemblyPiece
property), 1062
method), 1141
heap (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
height()(angr.analyses.disassembly.FunctionStart
attribute), 762
method), 1141
heap (angr.knowledge_plugins.key_definitions.LiveDefinitions
hex_dump() (angr.storage.memory_mixins.hex_dumper_mixin.HexDumper
attribute), 740
method), 448
heap_address() (angr.analyses.reaching_definitions.LiveDefinitions
hex_dump() (angr.storage.memory_mixins.HexDumperMixin
method), 1048
method), 418
heap_address() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
HexDumperMixin(classinmethod), 1091
angr.storage.memory_mixins), 418
heap_address() (angr.analyses.reaching_definitions.ReachingDefinitionsState
HexDumperMixin(classinmethod), 1061
angr.storage.memory_mixins.hex_dumper_mixin),
heap_address() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
448
method), 769
highlight() (angr.analyses.disassembly.DisassemblyPiece
heap_address() (angr.knowledge_plugins.key_definitions.LiveDefinitions
method), 1141
method), 747
history (angr.sim_state.SimState attribute), 220
heap_allocator (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsStatehistory (angr.SimState attribute), 177
attribute), 1091
history_contains() (angr.state_hierarchy.StateHierarchy
heap_allocator (angr.analyses.reaching_definitions.ReachingDefinitionsState
method), 506
attribute), 1061
history_contains() (angr.StateHierarchy method),
heap_definitions (angr.analyses.reaching_definitions.LiveDefinitions
176
property), 1041
history_predecessors()
heap_definitions (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions(angr.state_hierarchy.StateHierarchy method),
property), 762
506
heap_definitions (angr.knowledge_plugins.key_definitions.LiveDefinitions
history_predecessors()(angr.StateHierarchy
property), 740
method), 176
heap_offset (angr.knowledge_plugins.key_definitions.definition.DefinitionMatchPredicate
history_successors()
attribute), 756(angr.state_hierarchy.StateHierarchy method),
heap_uses (angr.analyses.reaching_definitions.LiveDefinitions
506
attribute), 1041
history_successors() (angr.StateHierarchy method),
heap_uses (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
176
1312

Index

angr

HistoryIter (class in angr.state_plugins.history), 336
id (angr.angrdb.models.DbStructuredCode attribute),
HistoryTrackingMixin(classin921
angr.storage.memory_mixins), 429
id (angr.angrdb.models.DbVariableCollection attribute),
HistoryTrackingMixin(classin921
angr.storage.memory_mixins.paged_memory.pages),id (angr.angrdb.models.DbXRefs attribute), 922
467
id (angr.exploration_techniques.spiller_db.PickledState
HistoryTrackingMixin(classin
attribute), 529
angr.storage.memory_mixins.paged_memory.pages.history_tracking_mixin),
ident (angr.analyses.disassembly.DisassemblyPiece at474
tribute), 1141
Hook (class in angr.analyses.disassembly), 1142
ident (angr.analyses.disassembly.OperandPiece athook() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.PutHook
tribute), 1143
static method), 902
ident (angr.angrdb.models.DbCFGModel attribute), 920
hook() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.RegisterInitializerHook
ident(angr.angrdb.models.DbVariableCollection
method), 902
attribute), 921
hook() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.StoreHook
ident (angr.knowledge_plugins.cfg.cfg_model.CFGModelstatic method), 901
attribute), 688
hook() (angr.analyses.find_objects_static.NewFunctionHandler
ident (angr.knowledge_plugins.cfg.CFGModel atmethod), 1140
tribute), 682
hook() (angr.analyses.reaching_definitions.function_handler.FunctionHandler
ident (angr.sim_variable.SimVariable attribute), 634
method), 1087
identical_blocks (angr.analyses.BinDiff property),hook() (angr.analyses.reaching_definitions.FunctionHandler810
method), 1067
identical_blocks (angr.analyses.bindiff.BinDiff prophook() (angr.Project method), 154erty), 853
hook() (angr.project.Project method), 209
identical_blocks (angr.analyses.bindiff.FunctionDiff
hook() (angr.state_plugins.Unicorn method), 262
property), 851
hook()(angr.state_plugins.unicorn_engine.Unicorn identical_functions (angr.analyses.BinDiff propmethod), 356erty), 809
hook_add() (angr.state_plugins.unicorn_engine.Uniwrapper
identical_functions (angr.analyses.bindiff.BinDiff
method), 354
property), 853
hook_after() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.LoadHook
Identifier (angr.analyses.analysis.KnownAnalysesPlugin
method), 902
attribute), 832
hook_before() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.LoadHook
Identifier (class in angr.analyses), 817
method), 902
Identifier (class in angr.analyses.identifier.identify),
hook_del() (angr.state_plugins.unicorn_engine.Uniwrapper
1130
method), 354
identify_func() (angr.analyses.Identifier method),
hook_reset() (angr.state_plugins.unicorn_engine.Uniwrapper
817
method), 354
identify_func() (angr.analyses.identifier.identify.Identifier
hook_symbol() (angr.Project method), 155
method), 1130
hook_symbol() (angr.project.Project method), 210
idx (angr.analyses.decompiler.structuring.structurer_nodes.CodeNodehooked_by() (angr.Project method), 155property), 934
hooked_by() (angr.project.Project method), 210
idx (angr.analyses.decompiler.structuring.structurer_nodes.MultiNode
HookNode (class in angr.codenode), 1171
attribute), 933
HooksMixin (class in angr.engines), 550
idx (angr.analyses.typehoon.typevars.TypeVariable atHooksMixin (class in angr.engines.hook), 554
tribute), 1124
IfElseFlattener(classinI
angr.analyses.decompiler.region_simplifiers.ifelse),992
id (angr.angrdb.models.DbCFGModel attribute), 920
iffalse(angr.analyses.decompiler.structured_codegen.c.CITE
id (angr.angrdb.models.DbComment attribute), 922
attribute), 1015
id (angr.angrdb.models.DbFunction attribute), 921
IfSimplifier(classinid (angr.angrdb.models.DbInformation attribute), 919
angr.analyses.decompiler.region_simplifiers.if_),
id (angr.angrdb.models.DbKnowledgeBase attribute),
992
920
iftrue(angr.analyses.decompiler.structured_codegen.c.CITE
id (angr.angrdb.models.DbLabel attribute), 923
attribute), 1015
id (angr.angrdb.models.DbObject attribute), 919
Index

1313

angr

IFUNC_HINTS (angr.analyses.cfg.cfg_fast.CFGJobType
method), 1106
attribute), 888
inconsistent_for() (angr.analyses.StackPointerTracker
immediate_dominators()
method), 823(angr.analyses.cfg.cfg_emulated.CFGEmulated indent_str() (angr.analyses.decompiler.structured_codegen.c.CConstrucmethod), 880
static method), 1003
immediate_dominators()
index (angr.utils.graph.ContainerNode attribute), 1192
(angr.analyses.cfg.CFGEmulated
method), indirect_jumps (angr.analyses.cfg.cfg_base.CFGBase863
attribute), 882
immediate_dominators()
indirect_jumps (angr.analyses.cfg.cfg_emulated.CFGEmulated(angr.analyses.CFGEmulated method), 795
attribute), 881
immediate_postdominators()
indirect_jumps (angr.analyses.cfg.cfg_fast.CFGFast(angr.analyses.cfg.cfg_emulated.CFGEmulated
attribute), 892
method), 880
indirect_jumps (angr.analyses.cfg.CFGEmulated atimmediate_postdominators()
tribute), 865(angr.analyses.cfg.CFGEmulated
method), indirect_jumps (angr.analyses.cfg.CFGFast attribute),
863
861
immediate_postdominators()
IndirectJump (class in angr.knowledge_plugins.cfg),(angr.analyses.CFGEmulated method), 795
680
ImportedLine(classin IndirectJump(classinangr.analyses.decompiler.structured_codegen.dwarf_import),
angr.knowledge_plugins.cfg.indirect_jump),
1020
700
ImportSourceCode (class in angr.analyses.decompiler), IndirectJumpResolver(classin942
angr.analyses.cfg.indirect_jump_resolvers.resolver),ImportSourceCode(classin904
angr.analyses.decompiler.structured_codegen), IndirectJumps (class in angr.knowledge_plugins), 667
1000
IndirectJumps(classin
ImportSourceCode(classinangr.knowledge_plugins.indirect_jumps),
angr.analyses.decompiler.structured_codegen.dwarf_import),
704
1020
IndirectJumpType(classininc_active_workers()(angr.distributed.Server
angr.knowledge_plugins.cfg), 682
method), 1205
IndirectJumpType(classininc_active_workers() (angr.distributed.server.Server
angr.knowledge_plugins.cfg.indirect_jump),
method), 1206
700
inc_active_workers() (angr.Server method), 206infer_shapes() (angr.analyses.typehoon.simple_solver.SimpleSolver
includes() (angr.keyed_region.RegionObject method),
method), 1120
781
info (angr.code_location.CodeLocation attribute), 780
includes() (angr.storage.memory_object.SimMemoryObject
info (angr.knowledge_plugins.Function attribute), 658
method), 410
info (angr.knowledge_plugins.functions.Function atincludes() (angr.storage.SimMemoryObject method),
tribute), 706
385
info (angr.knowledge_plugins.functions.function.Function
includes_function()
attribute), 717(angr.analyses.reaching_definitions.call_trace.CallTrace
info (angr.knowledge_plugins.functions.soot_function.SootFunction
method), 1073
attribute), 725
IncompleteSwitchCaseHeadStatement (class in init_class() (angr.state_plugins.javavm_classloader.SimJavaVmClassloangr.analyses.decompiler.structuring.structurer_nodes), method), 360
937
init_class() (angr.state_plugins.SimJavaVmClassloader
IncompleteSwitchCaseNode(classinmethod), 294
angr.analyses.decompiler.structuring.structurer_nodes),init_hierarchy() (angr.analyses.soot_class_hierarchy.SootClassHierarc
937
method), 857
inconsistent (angr.analyses.stack_pointer_tracker.StackPointerTracker
init_hierarchy() (angr.analyses.SootClassHierarchy
property), 1106
method), 825
inconsistent (angr.analyses.StackPointerTracker prop- init_state() (angr.SimHeapPTMalloc method), 204erty), 823
init_state() (angr.SimStatePlugin method), 153
inconsistent_for() (angr.analyses.stack_pointer_tracker.StackPointerTracker
init_state() (angr.state_plugins.heap.heap_base.SimHeapBase
1314

Index

angr

method), 371
initialize_gdt_x86()(angr.simos.SimLinux
init_state() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
method), 1175
method), 379
initialize_gdt_x86()(angr.simos.SimWindows
init_state() (angr.state_plugins.heap.SimHeapBase
method), 1177
method), 364
initialize_gdt_x86()
init_state() (angr.state_plugins.heap.SimHeapPTMalloc(angr.simos.windows.SimWindows
method),method), 369
1185
init_state() (angr.state_plugins.history.SimStateHistory initialize_segment_register_x64()
method), 333(angr.simos.linux.SimLinux method), 1182
init_state() (angr.state_plugins.plugin.SimStatePlugin initialize_segment_register_x64()
method), 300(angr.simos.SimLinux method), 1175
init_state() (angr.state_plugins.posix.SimSystemPosix initialize_segment_register_x64()
method), 311(angr.simos.SimWindows method), 1177
init_state()(angr.state_plugins.SimHeapBase initialize_segment_register_x64()
method), 284(angr.simos.windows.SimWindows
method),init_state() (angr.state_plugins.SimHeapPTMalloc
1184
method), 289
initialize_variable_names()
init_state()(angr.state_plugins.SimStateHistory(angr.knowledge_plugins.VariableManager
method), 252
method), 665
init_state()(angr.state_plugins.SimStatePlugin initialize_variable_names()
method), 228(angr.knowledge_plugins.variables.variable_manager.VariableMa
init_state()(angr.state_plugins.SimSymbolizer
method), 733
method), 296
initialize_variable_names()
init_state()(angr.state_plugins.SimSystemPosix(angr.knowledge_plugins.variables.VariableManager
method), 239
method), 726
init_state() (angr.state_plugins.symbolizer.SimSymbolizer
initialized_classes
method), 380(angr.state_plugins.javavm_classloader.SimJavaVmClassloader
init_static_field() (angr.simos.javavm.SimJavaVM
property), 360
static method), 1186
initialized_classes
init_static_field() (angr.simos.SimJavaVM static(angr.state_plugins.SimJavaVmClassloader
method), 1178
property), 295
init_str() (angr.procedures.definitions.SimTypeCollectioninitializer (angr.analyses.decompiler.structured_codegen.c.CForLoop
method), 606
attribute), 1006
INITIAL_SP_32BIT (angr.analyses.reaching_definitions.LiveDefinitions
initializer (angr.analyses.decompiler.structuring.structurer_nodes.Loop
attribute), 1041
attribute), 936
INITIAL_SP_32BIT (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
Initializer (class in angr.utils.mp), 1198
attribute), 761
InitialValueTag(classin
INITIAL_SP_32BIT (angr.knowledge_plugins.key_definitions.LiveDefinitions
angr.knowledge_plugins.key_definitions.tag),
attribute), 739
773
INITIAL_SP_64BIT (angr.analyses.reaching_definitions.LiveDefinitions
inline_call()(angr.sim_procedure.SimProcedure
attribute), 1041
method), 602
INITIAL_SP_64BIT (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
inline_call() (angr.SimProcedure method), 150
attribute), 761
InlinedStringTransformationSimplifier (class in
INITIAL_SP_64BIT (angr.knowledge_plugins.key_definitions.LiveDefinitions
angr.analyses.decompiler.optimization_passes),
attribute), 739
971
InitializationFinder (class in angr.analyses), 826
inner_step() (angr.exploration_techniques.Threading
InitializationFinder(classinmethod), 514
angr.analyses.init_finder), 1155
inner_step() (angr.exploration_techniques.threading.Threading
initialize() (angr.utils.mp.Initializer method), 1198
method), 530
initialize_dominance_frontiers()
input_state (angr.knowledge_plugins.cfg.cfg_node.CFGENode(angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryBase
attribute), 699
method), 1107
input_state (angr.knowledge_plugins.cfg.CFGENodeinitialize_gdt_x86()(angr.simos.linux.SimLinux
attribute), 680
method), 1182
input_states (angr.knowledge_plugins.propagations.PropagationModel
Index

1315

angr

attribute), 702
angr.analyses.decompiler.utils), 1021
input_variables() (angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
inserted_asm_after_label
method), 732(angr.analyses.Reassembler property), 811
ins_addr (angr.analyses.cfg.cfg_fast.FunctionEdge at- inserted_asm_after_label
tribute), 886(angr.analyses.reassembler.Reassembler
ins_addr (angr.analyses.decompiler.clinic.DataRefDesc
property), 1150
attribute), 951
inserted_asm_before_label
ins_addr (angr.analyses.decompiler.structured_codegen.base.InstructionMappingElement(angr.analyses.Reassembler property), 811
attribute), 1001
inserted_asm_before_label
ins_addr (angr.analyses.decompiler.structured_codegen.c.CLabel (angr.analyses.reassembler.Reassembler
attribute), 1010
property), 1150
ins_addr (angr.analyses.decompiler.structured_codegen.InstructionMappingElement
insn (angr.block.CapstoneInsn attribute), 216
attribute), 997
insn_addr_to_memory_data
ins_addr (angr.code_location.CodeLocation attribute),(angr.analyses.cfg.cfg_fast.CFGFast
prop780erty), 892
ins_addr (angr.errors.SimError attribute), 1201
insn_addr_to_memory_data
ins_addr (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump (angr.analyses.cfg.CFGFast property), 860
attribute), 701
insn_addr_to_memory_data (angr.analyses.CFGFast
ins_addr (angr.knowledge_plugins.cfg.IndirectJump atproperty), 792
tribute), 681
insn_addr_to_memory_data
ins_addr (angr.knowledge_plugins.key_definitions.definition.DefinitionMatchPredicate(angr.knowledge_plugins.cfg.cfg_model.CFGModel
attribute), 756
attribute), 689
ins_addr (angr.knowledge_plugins.xrefs.XRef attribute), insn_addr_to_memory_data
776(angr.knowledge_plugins.cfg.CFGModel
ins_addr (angr.knowledge_plugins.xrefs.xref.XRef atattribute), 682
tribute), 778
insn_observe() (angr.analyses.reaching_definitions.reaching_definitions.
ins_addr (angr.SimError attribute), 159
method), 1077
ins_addrs (angr.state_plugins.history.SimStateHistory insn_observe() (angr.analyses.reaching_definitions.ReachingDefinitionsA
property), 335
method), 1056
ins_addrs (angr.state_plugins.SimStateHistory prop- insn_observe() (angr.analyses.ReachingDefinitionsAnalysiserty), 254
method), 820
insert() (angr.SimMount method), 199
insn_op_idx(angr.knowledge_plugins.xrefs.XRef
insert() (angr.state_plugins.filesystem.SimConcreteFilesystem
attribute), 776
method), 318
insn_op_idx (angr.knowledge_plugins.xrefs.xref.XRef
insert() (angr.state_plugins.filesystem.SimFilesystem
attribute), 778
method), 316
insn_op_type (angr.knowledge_plugins.xrefs.XRef atinsert()(angr.state_plugins.filesystem.SimMounttribute), 776
method), 317
insn_op_type (angr.knowledge_plugins.xrefs.xref.XRef
insert()(angr.state_plugins.posix.PosixDevFS
attribute), 779
method), 306
insns (angr.block.DisassemblerBlock attribute), 215
insert()(angr.state_plugins.posix.PosixProcFS insns (angr.engines.pcode.lifter.PcodeDisassemblerBlockmethod), 308
attribute), 563
insert() (angr.state_plugins.PosixDevFS method), 234 inspect (angr.sim_state.SimState attribute), 221insert() (angr.state_plugins.PosixProcFS method), 236 inspect (angr.SimState attribute), 177
insert() (angr.state_plugins.SimFilesystem method), InspectMixinHigh(classin282
angr.storage.memory_mixins), 417
insert() (angr.state_plugins.SimMount method), 283
InspectMixinHigh(classininsert_asm() (angr.analyses.Reassembler method),angr.storage.memory_mixins.clouseau_mixin),
812
453
insert_asm() (angr.analyses.reassembler.Reassembler Instruction (class in angr.analyses.disassembly), 1142
method), 1151
Instruction (class in angr.analyses.reassembler), 1147
insert_node() (angr.analyses.decompiler.structuring.structurer_nodes.SequenceNode
instruction_addresses
method), 934(angr.engines.pcode.lifter.IRSB
property),
insert_node()(inmodule
567
1316

Index

angr

instruction_addresses()
int_iter (angr.calling_conventions.ArgSession at(angr.analyses.reassembler.BasicBlock
tribute), 618
method), 1148
int_iter (angr.calling_conventions.SimCC.ArgSession
instruction_addresses()
attribute), 619(angr.analyses.reassembler.Procedure method), int_iter (angr.SimCC.ArgSession attribute), 1811149
int_len_mod (angr.procedures.stubs.format_parser.FormatParser
instruction_addrs (angr.Block property), 166
attribute), 604
instruction_addrs (angr.block.Block property), 217
int_sign (angr.procedures.stubs.format_parser.FormatParser
instruction_addrs (angr.knowledge_plugins.cfg.cfg_node.CFGNodeattribute), 604
attribute), 698
int_type()(inmoduleinstruction_addrs (angr.knowledge_plugins.cfg.CFGNodeangr.analyses.typehoon.typeconsts), 1129
attribute), 678
Integer (angr.analyses.proximity_graph.ProxiNodeTypes
instruction_size() (angr.knowledge_plugins.Function
attribute), 1157
method), 663
Integer (angr.knowledge_plugins.cfg.memory_data.MemoryDataSort
instruction_size() (angr.knowledge_plugins.functions.Function attribute), 695
method), 711
Integer (angr.knowledge_plugins.cfg.MemoryDataSort
instruction_size() (angr.knowledge_plugins.functions.function.Function
attribute), 676
method), 722
IntegerProxiNode(classinInstructionError, 1145
angr.analyses.proximity_graph), 1158
InstructionMapping(classin interference_graph()angr.analyses.decompiler.structured_codegen),(angr.analyses.SLivenessAnalysis
method),997
832
InstructionMapping(classin internal_objects (angr.keyed_region.RegionObject
angr.analyses.decompiler.structured_codegen.base),
property), 781
1001
interpret() (angr.procedures.stubs.format_parser.FormatString
InstructionMappingElement(classinmethod), 603
angr.analyses.decompiler.structured_codegen), intersection() (angr.state_plugins.sim_action_object.SimActionObject
997
method), 598
InstructionMappingElement(classin intersection() (angr.state_plugins.SimActionObject
angr.analyses.decompiler.structured_codegen.base),method), 265
1001
invalidate_direct_next()
instructions (angr.analyses.Reassembler property),(angr.engines.pcode.lifter.IRSB
method),811
566
instructions (angr.analyses.reassembler.Reassembler inverse() (angr.analyses.typehoon.simple_solver.ConstraintGraphNode
property), 1150
method), 1119
instructions (angr.Block property), 166
inverse_wo_tag() (angr.analyses.typehoon.simple_solver.ConstraintGrap
instructions (angr.block.Block property), 217
method), 1119
instructions (angr.engines.pcode.lifter.IRSB prop- inverted_idoms() (in module angr.utils.graph), 1191
erty), 567
ip (angr.sim_state.SimState property), 221
Int (class in angr.analyses.typehoon.typeconsts), 1127
ip (angr.SimState property), 177
Int1 (class in angr.analyses.typehoon.typeconsts), 1127 IROp (class in angr.analyses.disassembly), 1141
Int128 (class in angr.analyses.typehoon.typeconsts), irsb (angr.analyses.disassembly.IROp attribute), 1142
1128
irsb (angr.engines.pcode.lifter.Lifter attribute), 568
Int16 (class in angr.analyses.typehoon.typeconsts), 1128 irsb (angr.engines.pcode.lifter.PcodeLifter attribute),
Int256 (class in angr.analyses.typehoon.typeconsts),
570
1128
irsb (angr.engines.UberEngine attribute), 551
int2base()(inmodule irsb (angr.knowledge_plugins.cfg.cfg_node.CFGNodeangr.state_plugins.trace_additions), 340
attribute), 698
Int32 (class in angr.analyses.typehoon.typeconsts), 1128 irsb (angr.knowledge_plugins.cfg.CFGNode attribute),
Int64 (class in angr.analyses.typehoon.typeconsts), 1128
678
Int8 (class in angr.analyses.typehoon.typeconsts), 1127 IRSB (class in angr.engines.pcode.lifter), 563
int_args (angr.calling_conventions.SimCC property), irsb_from_node() (angr.analyses.VFG method), 806
619
irsb_from_node() (angr.analyses.vfg.VFG method),
int_args (angr.SimCC property), 181
1138
Index

1317

angr

is_a_jump_target() (angr.analyses.decompiler.structuring.structurer_base.StructurerBase
781
static method), 938
is_empty (angr.storage.memory_mixins.regioned_memory.region_data.Reg
is_alignment(angr.knowledge_plugins.Function
property), 489
attribute), 658
is_empty() (angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceT
is_alignment (angr.knowledge_plugins.functions.Function
method), 1101
attribute), 705
is_empty() (angr.analyses.cfg_slice_to_sink.CFGSliceToSink
is_alignment (angr.knowledge_plugins.functions.function.Function method), 1099
attribute), 717
is_empty_node()(inmoduleis_alignment (angr.knowledge_plugins.functions.soot_function.SootFunction
angr.analyses.decompiler.utils), 1021
attribute), 725
is_empty_or_label_only_node()(inmoduleis_alignment_mask() (in module angr.utils.constants),
angr.analyses.decompiler.utils), 10211189
is_exception (angr.analyses.cfg.cfg_fast.FunctionTransitionEdge
is_arm (angr.knowledge_plugins.cfg.cfg_model.CFGModel
attribute), 887
attribute), 688
is_expr (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
is_arm (angr.knowledge_plugins.cfg.CFGModel atattribute), 1008
tribute), 682
is_false() (angr.state_plugins.SimSolver method), 246
is_base (angr.engines.light.data.SpOffset attribute), is_false()(angr.state_plugins.solver.SimSolver
1031
method), 324
is_base (angr.engines.light.SpOffset attribute), 1031
is_fp_arg()(angr.calling_conventions.SimCC
is_bool_expr() (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationExprBase
method), 619
static method), 987
is_fp_arg() (angr.SimCC method), 181
is_bounded()(angr.state_plugins.SimUCManager is_fp_value() (angr.calling_conventions.SimCC static
method), 260
method), 620
is_bounded() (angr.state_plugins.uc_manager.SimUCManager
is_fp_value() (angr.SimCC static method), 182
method), 345
is_free() (angr.PTChunk method), 205
is_bytes (angr.storage.memory_object.SimMemoryObject is_free() (angr.state_plugins.heap.heap_freelist.Chunkattribute), 410
method), 373
is_bytes (angr.storage.SimMemoryObject attribute), is_free() (angr.state_plugins.heap.heap_ptmalloc.PTChunk384
method), 376
is_class_initialized()
is_free() (angr.state_plugins.heap.PTChunk method),(angr.state_plugins.javavm_classloader.SimJavaVmClassloader
370
method), 360
is_free() (angr.state_plugins.PTChunk method), 290
is_class_initialized()
IS_FUNCTION(angr.sim_procedure.SimProcedure(angr.state_plugins.SimJavaVmClassloader
attribute), 602
method), 294
IS_FUNCTION (angr.SimProcedure attribute), 149
is_concrete() (angr.analyses.init_finder.SimEngineInitFinderVEX
is_function()(angr.analyses.vtable.VtableFinder
static method), 1155
method), 1140
is_cross_referenced()
is_function() (angr.analyses.VtableFinder method),(angr.analyses.vtable.VtableFinder method),830
1140
is_function_argument
is_cross_referenced() (angr.analyses.VtableFinder(angr.sim_variable.SimVariable
property),
method), 830
634
is_default_name (angr.knowledge_plugins.Function is_global_variable_address()
attribute), 658(angr.analyses.variable_recovery.variable_recovery_base.Variabl
is_default_name (angr.knowledge_plugins.functions.Function
method), 1109
attribute), 706
is_heap_address() (angr.analyses.reaching_definitions.LiveDefinitions
is_default_name (angr.knowledge_plugins.functions.function.Function
static method), 1048
attribute), 718
is_heap_address() (angr.analyses.reaching_definitions.rd_state.Reachin
is_default_name (angr.knowledge_plugins.functions.soot_function.SootFunction
static method), 1092
attribute), 725
is_heap_address() (angr.analyses.reaching_definitions.ReachingDefiniti
is_empty (angr.engines.SimSuccessors property), 544
static method), 1061
is_empty (angr.engines.successors.SimSuccessors prop- is_heap_address() (angr.knowledge_plugins.key_definitions.live_definitierty), 553
static method), 769
is_empty (angr.keyed_region.RegionObject property), is_heap_address() (angr.knowledge_plugins.key_definitions.LiveDefiniti
1318

Index

angr

static method), 747
is_prev_free() (angr.state_plugins.heap.heap_ptmalloc.PTChunk
is_hex() (in module angr.analyses.reassembler), 1145
method), 376
is_hook (angr.codenode.BlockNode attribute), 1171
is_prev_free()(angr.state_plugins.heap.PTChunkis_hook (angr.codenode.CodeNode attribute), 1171
method), 369
is_hook (angr.codenode.HookNode attribute), 1171
is_prev_free() (angr.state_plugins.PTChunk method),
is_hook (angr.codenode.SyscallNode attribute), 1171
290
is_hooked() (angr.Project method), 155
is_prototype_guessed
is_hooked() (angr.project.Project method), 210(angr.knowledge_plugins.Function attribute),
is_immediate(angr.analyses.reassembler.Operand658
property), 1147
is_prototype_guessed
is_in_readonly_section()(inmodule(angr.knowledge_plugins.functions.Function
angr.utils.loader), 1195
attribute), 706
is_in_readonly_segment()(inmodule is_prototype_guessed
angr.utils.loader), 1195
(angr.knowledge_plugins.functions.function.Function
is_java (angr.sim_procedure.SimProcedure property),
attribute), 717603
is_prototype_guessedis_java (angr.SimProcedure property), 150(angr.knowledge_plugins.functions.soot_function.SootFunction
is_jumptable (angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableProcessorState
attribute), 726
attribute), 900
is_pyinstaller() (in module angr.utils), 1189
is_leaf() (angr.state_plugins.sim_action_object.SimActionObject
is_pyinstaller() (in module angr.utils.env), 1190
method), 597
is_simple_jump_node()(inmoduleis_leaf()(angr.state_plugins.SimActionObject
angr.analyses.decompiler.region_simplifiers.switch_cluster_simpl
method), 265994
is_machine_word_size_type()(inmodule is_simprocedure (angr.knowledge_plugins.cfg.cfg_node.CFGNodeangr.analyses.decompiler.structured_codegen.c),property), 6981002
is_simprocedure (angr.knowledge_plugins.cfg.CFGNodeis_not_in_cfg() (angr.analyses.Veritesting method),
property), 679808
is_simprocedure (angr.knowledge_plugins.Function
is_not_in_cfg() (angr.analyses.veritesting.Veritesting
attribute), 658
method), 1133
is_simprocedure (angr.knowledge_plugins.functions.Function
is_on_stack (angr.analyses.reaching_definitions.MemoryLocation attribute), 706
property), 1052
is_simprocedure (angr.knowledge_plugins.functions.function.Function
is_on_stack (angr.knowledge_plugins.key_definitions.atoms.MemoryLocation
attribute), 718
property), 755
is_simprocedure (angr.knowledge_plugins.functions.soot_function.SootF
is_on_stack (angr.storage.memory_mixins.regioned_memory.region_data.AddressWrapper
attribute), 725
attribute), 488
is_special (angr.engines.pcode.behavior.OpBehavior
is_overbound() (angr.analyses.Veritesting method),attribute), 574808
is_special (angr.engines.pcode.behavior.OpBehaviorBoolAnd
is_overbound() (angr.analyses.veritesting.Veritesting
attribute), 587
method), 1134
is_special (angr.engines.pcode.behavior.OpBehaviorBoolNegate
is_pc() (in module angr.utils.loader), 1195
attribute), 586
is_phi_variable() (angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
is_special (angr.engines.pcode.behavior.OpBehaviorBoolOr
method), 731
attribute), 587
is_plt (angr.analyses.reassembler.Procedure property), is_special (angr.engines.pcode.behavior.OpBehaviorBoolXor
1148
attribute), 587
is_plt (angr.knowledge_plugins.Function attribute), is_special (angr.engines.pcode.behavior.OpBehaviorCopy
658
attribute), 575
is_plt (angr.knowledge_plugins.functions.Function at- is_special (angr.engines.pcode.behavior.OpBehaviorEqual
tribute), 706
attribute), 575
is_plt (angr.knowledge_plugins.functions.function.Function
is_special (angr.engines.pcode.behavior.OpBehaviorFloatAbs
attribute), 718
attribute), 590
is_plt (angr.knowledge_plugins.functions.soot_function.SootFunction
is_special (angr.engines.pcode.behavior.OpBehaviorFloatAdd
attribute), 725
attribute), 589
is_prev_free() (angr.PTChunk method), 205
is_special (angr.engines.pcode.behavior.OpBehaviorFloatCeil
Index

1319

angr

attribute), 591
attribute), 585
is_special (angr.engines.pcode.behavior.OpBehaviorFloatDiv
is_special (angr.engines.pcode.behavior.OpBehaviorIntRightattribute), 589
attribute), 583
is_special (angr.engines.pcode.behavior.OpBehaviorFloatEqual
is_special (angr.engines.pcode.behavior.OpBehaviorIntSborrow
attribute), 588
attribute), 580
is_special (angr.engines.pcode.behavior.OpBehaviorFloatFloat2Float
is_special (angr.engines.pcode.behavior.OpBehaviorIntScarry
attribute), 590
attribute), 580
is_special (angr.engines.pcode.behavior.OpBehaviorFloatFloor
is_special (angr.engines.pcode.behavior.OpBehaviorIntSdiv
attribute), 591
attribute), 585
is_special (angr.engines.pcode.behavior.OpBehaviorFloatInt2Float
is_special (angr.engines.pcode.behavior.OpBehaviorIntSext
attribute), 590
attribute), 578
is_special (angr.engines.pcode.behavior.OpBehaviorFloatLess
is_special (angr.engines.pcode.behavior.OpBehaviorIntSlessattribute), 588
attribute), 576
is_special (angr.engines.pcode.behavior.OpBehaviorFloatLessEqual
is_special (angr.engines.pcode.behavior.OpBehaviorIntSlessEqual
attribute), 588
attribute), 576
is_special (angr.engines.pcode.behavior.OpBehaviorFloatMult
is_special (angr.engines.pcode.behavior.OpBehaviorIntSrem
attribute), 589
attribute), 586
is_special (angr.engines.pcode.behavior.OpBehaviorFloatNan
is_special (angr.engines.pcode.behavior.OpBehaviorIntSrightattribute), 588
attribute), 584
is_special (angr.engines.pcode.behavior.OpBehaviorFloatNeg
is_special (angr.engines.pcode.behavior.OpBehaviorIntSub
attribute), 590
attribute), 579
is_special (angr.engines.pcode.behavior.OpBehaviorFloatNotEqual
is_special (angr.engines.pcode.behavior.OpBehaviorIntXor
attribute), 588
attribute), 581
is_special (angr.engines.pcode.behavior.OpBehaviorFloatRoundis_special (angr.engines.pcode.behavior.OpBehaviorIntZext
attribute), 591
attribute), 578
is_special (angr.engines.pcode.behavior.OpBehaviorFloatSqrt
is_special (angr.engines.pcode.behavior.OpBehaviorLzcountattribute), 590
attribute), 593
is_special (angr.engines.pcode.behavior.OpBehaviorFloatSub
is_special (angr.engines.pcode.behavior.OpBehaviorNotEqual
attribute), 589
attribute), 576
is_special (angr.engines.pcode.behavior.OpBehaviorFloatTrunc
is_special (angr.engines.pcode.behavior.OpBehaviorPiece
attribute), 591
attribute), 591
is_special (angr.engines.pcode.behavior.OpBehaviorInt2Comp
is_special (angr.engines.pcode.behavior.OpBehaviorPopcountattribute), 581
attribute), 592
is_special (angr.engines.pcode.behavior.OpBehaviorIntAdd
is_special (angr.engines.pcode.behavior.OpBehaviorSubpiece
attribute), 578
attribute), 592
is_special (angr.engines.pcode.behavior.OpBehaviorIntAnd
is_stack (angr.storage.memory_mixins.MemoryRegionMetaMixin
attribute), 582
property), 440
is_special (angr.engines.pcode.behavior.OpBehaviorIntCarryis_stack (angr.storage.memory_mixins.regioned_memory.MemoryRegionM
attribute), 579
property), 482
is_special (angr.engines.pcode.behavior.OpBehaviorIntDiv
is_stack (angr.storage.memory_mixins.regioned_memory.region_meta_m
attribute), 584
property), 491
is_special (angr.engines.pcode.behavior.OpBehaviorIntLeft
is_stack_address() (angr.analyses.reaching_definitions.LiveDefinitions
attribute), 583
static method), 1042
is_special (angr.engines.pcode.behavior.OpBehaviorIntLess
is_stack_address() (angr.analyses.reaching_definitions.rd_state.Reachi
attribute), 577
method), 1092
is_special (angr.engines.pcode.behavior.OpBehaviorIntLessEqual
is_stack_address() (angr.analyses.reaching_definitions.ReachingDefini
attribute), 577
method), 1061
is_special (angr.engines.pcode.behavior.OpBehaviorIntMult
is_stack_address() (angr.analyses.variable_recovery.variable_recovery
attribute), 584
static method), 1109
is_special (angr.engines.pcode.behavior.OpBehaviorIntNegate
is_stack_address() (angr.knowledge_plugins.key_definitions.live_defini
attribute), 581
static method), 763
is_special (angr.engines.pcode.behavior.OpBehaviorIntOr
is_stack_address() (angr.knowledge_plugins.key_definitions.LiveDefini
attribute), 582
static method), 741
is_special (angr.engines.pcode.behavior.OpBehaviorIntRem
is_statement_terminating()(inmodule
1320

Index

angr

angr.analyses.decompiler.utils), 1023
is_syscall_addr() (angr.simos.SimUserland method),
is_stored() (angr.vaults.Vault method), 785
1174
is_stored() (angr.vaults.VaultDict method), 785
is_syscall_addr() (angr.simos.userland.SimUserlandis_subclass() (angr.analyses.soot_class_hierarchy.SootClassHierarchy
method), 1183
method), 857
is_taint_impacting_stack_pointers()
is_subclass()(angr.analyses.SootClassHierarchy(angr.analyses.backward_slice.BackwardSlicemethod), 825
method), 850
is_subclass_including()
is_taint_impacting_stack_pointers()(angr.analyses.soot_class_hierarchy.SootClassHierarchy (angr.analyses.BackwardSlice method), 807
method), 857
is_taint_related_to_ip()
is_subclass_including()(angr.analyses.backward_slice.BackwardSlice(angr.analyses.SootClassHierarchy method),
method), 850825
is_taint_related_to_ip()
is_symbol_hooked() (angr.Project method), 156(angr.analyses.BackwardSlice method), 807
is_symbol_hooked() (angr.project.Project method), is_thumb_addr() (angr.analyses.cfg.cfg_base.CFGBase211
method), 883
is_symbolic (angr.state_plugins.sim_action.SimAction is_thumb_addr()(angr.analyses.cfg.CFGBase
property), 595
method), 873
is_symbolic (angr.state_plugins.sim_action.SimActionConstraint
is_top() (angr.analyses.reaching_definitions.LiveDefinitions
property), 596
static method), 1042
is_symbolic (angr.state_plugins.sim_action.SimActionData
is_top() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitions
property), 596
method), 1091
is_symbolic (angr.state_plugins.sim_action.SimActionExitis_top() (angr.analyses.reaching_definitions.ReachingDefinitionsState
property), 595
method), 1061
is_symbolic (angr.state_plugins.sim_action.SimActionOperation
is_top() (angr.analyses.variable_recovery.variable_recovery_base.Variab
property), 596
static method), 1108
is_symbolic (angr.state_plugins.SimAction property), is_top() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefi
263
static method), 763
is_symbolic (angr.state_plugins.SimActionConstraint is_top() (angr.knowledge_plugins.key_definitions.LiveDefinitions
property), 263
static method), 741
is_symbolic (angr.state_plugins.SimActionData prop- is_tracking_memory (angr.analyses.stack_pointer_tracker.FrozenStackPoerty), 264
attribute), 1104
is_symbolic (angr.state_plugins.SimActionExit prop- is_tracking_memory (angr.analyses.stack_pointer_tracker.StackPointerTrerty), 263
attribute), 1104
is_symbolic (angr.state_plugins.SimActionOperation is_true() (angr.state_plugins.SimSolver method), 246
property), 264
is_true()(angr.state_plugins.solver.SimSolver
is_syscall (angr.analyses.cfg.cfg_emulated.CFGJob
method), 324
property), 877
is_unary (angr.engines.pcode.behavior.OpBehavior atis_syscall (angr.knowledge_plugins.cfg.cfg_node.CFGNodetribute), 574
attribute), 698
is_unary (angr.engines.pcode.behavior.OpBehaviorBoolAnd
is_syscall (angr.knowledge_plugins.cfg.CFGNode atattribute), 587
tribute), 678
is_unary (angr.engines.pcode.behavior.OpBehaviorBoolNegate
is_syscall (angr.knowledge_plugins.Function atattribute), 586
tribute), 658
is_unary (angr.engines.pcode.behavior.OpBehaviorBoolOr
is_syscall (angr.knowledge_plugins.functions.Function
attribute), 587
attribute), 706
is_unary (angr.engines.pcode.behavior.OpBehaviorBoolXor
is_syscall (angr.knowledge_plugins.functions.function.Function attribute), 587
attribute), 718
is_unary (angr.engines.pcode.behavior.OpBehaviorCopy
is_syscall (angr.knowledge_plugins.functions.soot_function.SootFunction
attribute), 575
attribute), 725
is_unary (angr.engines.pcode.behavior.OpBehaviorEqual
is_syscall_addr() (angr.SimOS method), 165
attribute), 575
is_syscall_addr() (angr.simos.SimOS method), 1173 is_unary (angr.engines.pcode.behavior.OpBehaviorFloatAbs
is_syscall_addr() (angr.simos.simos.SimOS method),attribute), 590
1180
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatAdd
Index

1321

angr

attribute), 589
attribute), 582
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatCeil
is_unary (angr.engines.pcode.behavior.OpBehaviorIntRem
attribute), 591
attribute), 585
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatDiv
is_unary (angr.engines.pcode.behavior.OpBehaviorIntRightattribute), 589
attribute), 583
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatEqual
is_unary (angr.engines.pcode.behavior.OpBehaviorIntSborrow
attribute), 588
attribute), 580
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatFloat2Float
is_unary (angr.engines.pcode.behavior.OpBehaviorIntScarry
attribute), 590
attribute), 580
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatFloor
is_unary (angr.engines.pcode.behavior.OpBehaviorIntSdiv
attribute), 591
attribute), 585
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatInt2Float
is_unary (angr.engines.pcode.behavior.OpBehaviorIntSext
attribute), 590
attribute), 578
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatLess
is_unary (angr.engines.pcode.behavior.OpBehaviorIntSlessattribute), 588
attribute), 576
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatLessEqual
is_unary (angr.engines.pcode.behavior.OpBehaviorIntSlessEqual
attribute), 588
attribute), 576
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatMult
is_unary (angr.engines.pcode.behavior.OpBehaviorIntSrem
attribute), 589
attribute), 586
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatNan
is_unary (angr.engines.pcode.behavior.OpBehaviorIntSrightattribute), 588
attribute), 584
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatNeg
is_unary (angr.engines.pcode.behavior.OpBehaviorIntSub
attribute), 589
attribute), 579
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatNotEqual
is_unary (angr.engines.pcode.behavior.OpBehaviorIntXor
attribute), 588
attribute), 581
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatRoundis_unary (angr.engines.pcode.behavior.OpBehaviorIntZext
attribute), 591
attribute), 578
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatSqrt
is_unary (angr.engines.pcode.behavior.OpBehaviorLzcountattribute), 590
attribute), 593
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatSub
is_unary (angr.engines.pcode.behavior.OpBehaviorNotEqual
attribute), 589
attribute), 575
is_unary (angr.engines.pcode.behavior.OpBehaviorFloatTrunc
is_unary (angr.engines.pcode.behavior.OpBehaviorPiece
attribute), 591
attribute), 591
is_unary (angr.engines.pcode.behavior.OpBehaviorInt2Comp
is_unary (angr.engines.pcode.behavior.OpBehaviorPopcountattribute), 581
attribute), 592
is_unary (angr.engines.pcode.behavior.OpBehaviorIntAddis_unary (angr.engines.pcode.behavior.OpBehaviorSubpiece
attribute), 578
attribute), 592
is_unary (angr.engines.pcode.behavior.OpBehaviorIntAndis_using_outdated_def()
attribute), 582(angr.analyses.propagator.engine_ail.SimEnginePropagatorAIL
is_unary (angr.engines.pcode.behavior.OpBehaviorIntCarrymethod), 1037
attribute), 579
is_va_start_amd64()
is_unary (angr.engines.pcode.behavior.OpBehaviorIntDiv(angr.analyses.calling_convention.CallingConventionAnalysis
attribute), 584
method), 855
is_unary (angr.engines.pcode.behavior.OpBehaviorIntLeftis_va_start_amd64()
attribute), 583(angr.analyses.CallingConventionAnalysis
is_unary (angr.engines.pcode.behavior.OpBehaviorIntLessmethod), 822
attribute), 577
is_value_set (angr.state_plugins.unicorn_engine.MemoryValue
is_unary (angr.engines.pcode.behavior.OpBehaviorIntLessEqual attribute), 350
attribute), 577
is_value_symbolic (angr.state_plugins.unicorn_engine.MemoryValue
is_unary (angr.engines.pcode.behavior.OpBehaviorIntMult
attribute), 350
attribute), 584
is_variable_used_at()
is_unary (angr.engines.pcode.behavior.OpBehaviorIntNegate(angr.knowledge_plugins.variables.variable_manager.VariableMa
attribute), 581
method), 729
is_unary (angr.engines.pcode.behavior.OpBehaviorIntOr is_visible_class() (angr.analyses.soot_class_hierarchy.SootClassHiera
1322

Index

angr

method), 857
attribute), 1006
is_visible_class() (angr.analyses.SootClassHierarchy iterator (angr.analyses.decompiler.structuring.structurer_nodes.LoopNod
method), 825
attribute), 936
is_visible_method()
Iterator (angr.analyses.loop_analysis.VariableTypes(angr.analyses.soot_class_hierarchy.SootClassHierarchy attribute), 1131
method), 857
ITERegionConverter(classin
is_visible_method()angr.analyses.decompiler.optimization_passes),(angr.analyses.SootClassHierarchy method),962
825
itervariables() (angr.analyses.ddg.LiveDefinitions
IsArray (class in angr.analyses.typehoon.typevars),
method), 1026
1126
ISPOMixin (class in angr.storage.memory_mixins), 428 J
ISPOMixin (class in angr.storage.memory_mixins.paged_memory.pages),javavm_memory (angr.sim_state.SimState property), 221466
javavm_memory (angr.SimState property), 178
ISPOMixin (class in angr.storage.memory_mixins.paged_memory.pages.ispo_mixin),
javavm_registers (angr.sim_state.SimState property),475
221
ite_exprs (angr.analyses.decompiler.decompilation_cache.DecompilationCachejavavm_registers (angr.SimState property), 178
attribute), 955
JavaVmMemory (class in angr.storage.memory_mixins),
ite_exprs (angr.angrdb.models.DbStructuredCode at447
tribute), 922
JavaVmMemoryMixin(classin
ITEExprConverter(classinangr.storage.memory_mixins), 443
angr.analyses.decompiler.optimization_passes), jni_references (angr.sim_state.SimState attribute),962
221
ITEExprConverter(classin jni_references (angr.SimState attribute), 177angr.analyses.decompiler.optimization_passes.ite_expr_converter),job(angr.analyses.forward_analysis.job_info.JobInfo
979
property), 840
items() (angr.analyses.ddg.LiveDefinitions method), job_type (angr.analyses.cfg.cfg_fast.CFGJob attribute),1026
889
items() (angr.analyses.decompiler.structured_codegen.base.InstructionMapping
JobInfo (class in angr.analyses.forward_analysis.job_info),
method), 1002
840
items() (angr.analyses.decompiler.structured_codegen.base.PositionMappingjobs (angr.analyses.forward_analysis.forward_analysis.ForwardAnalysis
method), 1001
property), 839
items() (angr.analyses.decompiler.structured_codegen.InstructionMappingjobs (angr.analyses.forward_analysis.ForwardAnalysis
method), 997
property), 835
items() (angr.analyses.decompiler.structured_codegen.PositionMappingjobs (angr.analyses.ForwardAnalysis property), 787
method), 998
join() (angr.analyses.typehoon.simple_solver.SimpleSolver
items() (angr.knowledge_plugins.Labels method), 667
method), 1120
items()(angr.knowledge_plugins.labels.Labels json_serialize_load_args()
method), 704(angr.angrdb.serializers.loader.LoaderSerializer
items() (angr.knowledge_plugins.patches.PatchManager
static method), 928
method), 674
json_serialize_load_args()
items()(angr.knowledge_plugins.PatchManager(angr.angrdb.serializers.LoaderSerializer
method), 670
static method), 923
items()(angr.state_plugins.globals.SimStateGlobals jump() (angr.sim_procedure.SimProcedure method), 603
method), 344
jump() (angr.SimProcedure method), 150
items() (angr.state_plugins.SimStateGlobals method), jump_guard (angr.state_plugins.history.SimStateHistory
270
attribute), 333
items() (angr.storage.memory_mixins.paged_memory.pages.multi_values.MultiValues
jump_guards (angr.state_plugins.history.SimStateHistory
method), 458
property), 335
iter_own() (angr.knowledge_plugins.types.TypesStore jump_guards (angr.state_plugins.SimStateHistory propmethod), 701erty), 254
iter_own()(angr.knowledge_plugins.TypesStore jump_sources (angr.state_plugins.history.SimStateHistory
method), 672
property), 335
iterator (angr.analyses.decompiler.structured_codegen.c.CForLoop
Index

1323

angr

jump_sources(angr.state_plugins.SimStateHistory(angr.knowledge_plugins.cfg.IndirectJumpType
property), 254
attribute), 682
jump_tables (angr.analyses.cfg.cfg_fast.CFGFast prop- jumptable_entries (angr.knowledge_plugins.cfg.indirect_jump.IndirectJ
erty), 892
attribute), 701
jump_tables (angr.analyses.cfg.CFGFast property), jumptable_entries (angr.knowledge_plugins.cfg.IndirectJump
860
attribute), 682
jump_tables (angr.analyses.CFGFast property), 792
jumptable_entry_size
jump_tables (angr.knowledge_plugins.cfg.cfg_model.CFGModel (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump
attribute), 688
attribute), 701
jump_tables (angr.knowledge_plugins.cfg.CFGModel jumptable_entry_size
attribute), 682(angr.knowledge_plugins.cfg.IndirectJump
jump_targets (angr.state_plugins.history.SimStateHistory
attribute), 681
property), 335
jumptable_size (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump
jump_targets(angr.state_plugins.SimStateHistory
attribute), 701
property), 254
jumptable_size (angr.knowledge_plugins.cfg.IndirectJump
jumpkind (angr.analyses.cfg.cfg_fast.CFGJob attribute),
attribute), 681
889
JumpTableEntryConditionRewriter(classin
jumpkind(angr.engines.pcode.lifter.ExitStatement
angr.analyses.decompiler.jumptable_entry_condition_rewriter),
attribute), 563
960
jumpkind (angr.engines.pcode.lifter.IRSB attribute), 566 JumpTableProcessor(classin
jumpkind (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump angr.analyses.cfg.indirect_jump_resolvers.jumptable),
attribute), 701
901
jumpkind (angr.knowledge_plugins.cfg.IndirectJump at- JumpTableProcessorState(classintribute), 681
angr.analyses.cfg.indirect_jump_resolvers.jumptable),
jumpkind (angr.state_plugins.history.SimStateHistory
900
attribute), 333
JumpTableResolver(classin
jumpkinds (angr.state_plugins.history.SimStateHistory
angr.analyses.cfg.indirect_jump_resolvers),
property), 335
908
jumpkinds (angr.state_plugins.SimStateHistory prop- JumpTableResolver(classinerty), 254
angr.analyses.cfg.indirect_jump_resolvers.jumptable),
jumpout_sites(angr.knowledge_plugins.Function
903
property), 661
JumpTargetBaseAddr(classinjumpout_sites (angr.knowledge_plugins.functions.Function
angr.analyses.cfg.indirect_jump_resolvers.jumptable),
property), 708
900
jumpout_sites (angr.knowledge_plugins.functions.function.Function
JumpTargetCollector(classinproperty), 720
angr.analyses.decompiler.jump_target_collector),
jumptable (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump 960
attribute), 701
jumptable (angr.knowledge_plugins.cfg.IndirectJump K
attribute), 681
K (angr.knowledge_base.KnowledgeBase attribute), 655
jumptable_addr (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump
K (angr.KnowledgeBase attribute), 207
attribute), 701
kb (angr.analyses.Analysis attribute), 786
jumptable_addr (angr.knowledge_plugins.cfg.IndirectJump
kb (angr.analyses.analysis.Analysis attribute), 834
attribute), 681
kb (angr.analyses.binary_optimizer.BinaryOptimizer atJumptable_AddressComputed
tribute), 1155
(angr.knowledge_plugins.cfg.indirect_jump.IndirectJumpTypekb (angr.analyses.cfg.cfg_base.CFGBase attribute), 884
attribute), 700
kb(angr.analyses.cfg.cfg_emulated.CFGEmulated
Jumptable_AddressComputed
attribute), 881(angr.knowledge_plugins.cfg.IndirectJumpType kb (angr.analyses.cfg.cfg_fast.CFGFast attribute), 892
attribute), 682
kb (angr.analyses.cfg.CFGEmulated attribute), 865
Jumptable_AddressLoadedFromMemorykb (angr.analyses.cfg.CFGFast attribute), 861(angr.knowledge_plugins.cfg.indirect_jump.IndirectJumpTypekb (angr.analyses.cfg.indirect_jump_resolvers.jumptable.ConstantValueMan
attribute), 700
attribute), 900
Jumptable_AddressLoadedFromMemory

1324

Index

angr

kb (angr.analyses.decompiler.optimization_passes.optimization_pass.BaseOptimizationPass
keys() (angr.storage.memory_mixins.paged_memory.pages.multi_values.M
property), 976
method), 458
kb (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationExprBase
keys() (angr.vaults.Vault method), 785
attribute), 987
keys() (angr.vaults.VaultDict method), 785
kb (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationMultiStmtBase
keys() (angr.vaults.VaultDir method), 786
attribute), 986
keys() (angr.vaults.VaultDirShelf method), 786
kb (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationStmtBase
KeyValueMemory(classin
attribute), 986
angr.storage.memory_mixins), 446
kb (angr.analyses.decompiler.structuring.dream.DreamStructurer
KeyValueMemoryMixin(classin
attribute), 933
angr.storage.memory_mixins), 443
kb (angr.analyses.decompiler.structuring.phoenix.PhoenixStructurer
kill_and_add_definition()
attribute), 940(angr.analyses.reaching_definitions.LiveDefinitions
kb (angr.analyses.veritesting.Veritesting attribute), 1134
method), 1044
kb (angr.Analysis attribute), 174
kill_and_add_definition()kb (angr.angrdb.models.DbCFGModel attribute), 920(angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsSkb (angr.angrdb.models.DbComment attribute), 922
method), 1094
kb (angr.angrdb.models.DbFunction attribute), 921
kill_and_add_definition()kb (angr.angrdb.models.DbLabel attribute), 923(angr.analyses.reaching_definitions.ReachingDefinitionsStatekb (angr.angrdb.models.DbStructuredCode attribute),
method), 1063
922
kill_and_add_definition()kb (angr.angrdb.models.DbVariableCollection attribute),(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin921
method), 765
kb (angr.angrdb.models.DbXRefs attribute), 922
kill_and_add_definition()
kb_id (angr.angrdb.models.DbCFGModel attribute), 920(angr.knowledge_plugins.key_definitions.LiveDefinitions
kb_id (angr.angrdb.models.DbComment attribute), 922
method), 743
kb_id (angr.angrdb.models.DbFunction attribute), 921
kill_def()(angr.analyses.ddg.LiveDefinitions
kb_id (angr.angrdb.models.DbLabel attribute), 923
method), 1026
kb_id
(angr.angrdb.models.DbStructuredCodeat- kill_def() (angr.analyses.reaching_definitions.ReachingDefinitionsModetribute), 921
method), 1057
kb_id
(angr.angrdb.models.DbVariableCollection kill_def() (angr.knowledge_plugins.key_definitions.rd_model.ReachingD
attribute), 921
method), 770
kb_id (angr.angrdb.models.DbXRefs attribute), 922
kill_def() (angr.knowledge_plugins.key_definitions.ReachingDefinitionsM
keep_path() (angr.annocfg.AnnotatedCFG method),
method), 737
1170
kill_definitions() (angr.analyses.reaching_definitions.LiveDefinitions
key (angr.angrdb.models.DbInformation attribute), 919
method), 1044
key (angr.knowledge_plugins.propagations.PropagationModel
kill_definitions() (angr.analyses.reaching_definitions.rd_state.Reachi
attribute), 702
method), 1094
KeyDefinitionManager(classin kill_definitions() (angr.analyses.reaching_definitions.ReachingDefini
angr.knowledge_plugins), 670
method), 1063
KeyDefinitionManager(classin kill_definitions() (angr.knowledge_plugins.key_definitions.live_defini
angr.knowledge_plugins.key_definitions),
method), 764
738
kill_definitions() (angr.knowledge_plugins.key_definitions.LiveDefini
KeyDefinitionManager(classinmethod), 742
angr.knowledge_plugins.key_definitions.key_definition_manager),kind (angr.knowledge_plugins.key_definitions.definition.DefinitionMatchPr
760
attribute), 756
KeyedRegion (class in angr.keyed_region), 782
KnowledgeBase (class in angr), 206
keys() (angr.knowledge_plugins.patches.PatchManager KnowledgeBase (class in angr.knowledge_base), 654
method), 674
KnowledgeBasePlugin(classinkeys()(angr.knowledge_plugins.PatchManager
angr.knowledge_plugins), 669
method), 670
KnowledgeBasePlugin(classinkeys()(angr.state_plugins.globals.SimStateGlobals
angr.knowledge_plugins.plugin), 675
method), 344
KnowledgeBaseSerializer(classinkeys() (angr.state_plugins.SimStateGlobals method),angr.angrdb.serializers), 924
270
KnowledgeBaseSerializer(class
in
Index

1325

angr

angr.angrdb.serializers.kb), 925
KnownAnalysesPlugin(classangr.analyses.analysis), 832
kwargs (angr.utils.mp.Closure attribute), 1198

length (angr.state_plugins.SimActionObject property),265
length (angr.state_plugins.unicorn_engine.MEM_PATCH
attribute), 349
length (angr.storage.memory_object.SimMemoryObject
Lattribute), 410
length(angr.storage.SimMemoryObject
attribute), 384
label (angr.storage.memory_object.SimLabeledMemoryObject
length_spec(angr.procedures.stubs.format_parser.FormatSpecifier
attribute), 410
attribute), 604
Label (class in angr.analyses.disassembly), 1141
LengthLimiter(class in angr.exploration_techniques),
Label (class in angr.analyses.reassembler), 1145
514
label_got() (angr.analyses.reassembler.SymbolManager
LengthLimiter(classinmethod), 1146
angr.exploration_techniques.lengthlimiter),LabeledMemory (class in angr.storage.memory_mixins),
526
446
LabeledPagesMixin(classin lhs (angr.analyses.decompiler.structured_codegen.c.CAssignment
attribute), 1007
angr.storage.memory_mixins.paged_memory.paged_memory_mixin),
lhs (angr.analyses.decompiler.structured_codegen.c.CBinaryOp
462
attribute), 1013
LabelMergerMixin(classinlift()(angr.analyses.typehoon.lifter.TypeLifter
angr.storage.memory_mixins), 419
method), 1117
LabelMergerMixin(classinangr.storage.memory_mixins.label_merger_mixin),lift() (angr.engines.pcode.lifter.Lifter method), 568
lift() (angr.engines.pcode.lifter.PcodeBasicBlockLifter
453
method), 569
labels (angr.analyses.typehoon.typevars.DerivedTypeVariable
lift() (angr.engines.pcode.lifter.PcodeLifter method),attribute), 1124
570
labels (angr.angrdb.models.DbKnowledgeBase atlift() (in module angr.engines.pcode.lifter), 568
tribute), 920
lift_pcode() (angr.engines.pcode.lifter.PcodeLifterEngineMixin
Labels (class in angr.knowledge_plugins), 667
method), 572
Labels (class in angr.knowledge_plugins.labels), 704(angr.engines.soot.engine.SootMixin
LabelsSerializer(classin lift_soot()
method), 559
angr.angrdb.serializers.labels), 926
LambdaAttrIter (class in angr.state_plugins.history), lift_soot() (angr.engines.soot.SootMixin method),558
336
LambdaIterIter (class in angr.state_plugins.history), lift_soot() (angr.engines.SootMixin method), 550
lift_vex() (angr.engines.pcode.lifter.PcodeLifterEngineMixin336
method), 571
LARGE_SWITCH (angr.analyses.code_tagging.CodeTags
lift_vex() (angr.engines.vex.VEXLifter method), 557
attribute), 916
last_addr (angr.analyses.cfg.cfg_fast.CFGJob at- Lifter (class in angr.engines.pcode.lifter), 567
lineage(angr.state_plugins.history.SimStateHistory
tribute), 889
property), 335
last_addr (angr.storage.memory_object.SimMemoryObject
lineage (angr.state_plugins.SimStateHistory property),
property), 410
254
last_addr (angr.storage.SimMemoryObject property),
lineage()(angr.state_hierarchy.StateHierarchy385
method), 506
last_nonlabel_statement()(inmodulelineage() (angr.StateHierarchy method), 176angr.analyses.decompiler.utils), 1022
lazy_import() (in module angr.utils.lazy_import), linux_syscall_update_error_reg()(angr.calling_conventions.SimCCSyscall
1195
method), 624
LEFT (angr.analyses.typehoon.simple_solver.ConstraintGraphTag
list_content(angr.utils.dynamic_dictlist.DynamicDictList
attribute), 1118
attribute),
1190
length (angr.analyses.decompiler.structured_codegen.base.PositionMappingElement
list_default_plugins()
attribute), 1001
(angr.misc.plugins.PluginPreset
method),length (angr.analyses.decompiler.structured_codegen.PositionMappingElement219
attribute), 997
ListPage (class in angr.storage.memory_mixins), 430
length (angr.state_plugins.sim_action_object.SimActionObject
ListPage (class in angr.storage.memory_mixins.paged_memory.pages),
property), 598
1326

in

Index

angr

468
load() (angr.angrdb.serializers.variables.VariableManagerSerializer
ListPage (class in angr.storage.memory_mixins.paged_memory.pages.list_page),static method), 929476
load()(angr.angrdb.serializers.xrefs.XRefsSerializer
ListPagesMixin(classinstatic method), 928
angr.storage.memory_mixins), 426
load() (angr.state_plugins.light_registers.SimLightRegisters
ListPagesMixin(classinmethod), 333
angr.storage.memory_mixins.paged_memory.paged_memory_mixin),load() (angr.state_plugins.SimLightRegisters method),
462
250
ListPagesWithLabelsMixin(classin load() (angr.storage.memory_mixins.actions_mixin.ActionsMixinHighangr.storage.memory_mixins), 426
method), 449
ListPagesWithLabelsMixin(classin load() (angr.storage.memory_mixins.actions_mixin.ActionsMixinLow
angr.storage.memory_mixins.paged_memory.paged_memory_mixin),
method), 449463
load() (angr.storage.memory_mixins.ActionsMixinHighlive_definitions (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
method), 414
attribute), 1091load() (angr.storage.memory_mixins.ActionsMixinLow
live_definitions (angr.analyses.reaching_definitions.ReachingDefinitionsState
method), 415
attribute), 1061
load() (angr.storage.memory_mixins.address_concretization_mixin.Addres
LiveDefinitions (class in angr.analyses.ddg), 1025
method), 453
LiveDefinitions(classin load() (angr.storage.memory_mixins.AddressConcretizationMixin
angr.analyses.reaching_definitions), 1040
method), 416
LiveDefinitions(classin load() (angr.storage.memory_mixins.bvv_conversion_mixin.DataNormalizangr.knowledge_plugins.key_definitions),
method), 448739
load() (angr.storage.memory_mixins.clouseau_mixin.InspectMixinHigh
LiveDefinitions(classinmethod), 453
angr.knowledge_plugins.key_definitions.live_definitions),load() (angr.storage.memory_mixins.conditional_store_mixin.Conditional761
method), 453
LiveVariables(classin load() (angr.storage.memory_mixins.ConditionalMixin
angr.knowledge_plugins.variables.variable_manager),method), 417728
load() (angr.storage.memory_mixins.DataNormalizationMixin
Load (angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransformationTypes
method), 417
attribute), 899
load() (angr.storage.memory_mixins.InspectMixinHigh
Load (class in angr.analyses.typehoon.typevars), 1125
method), 417
load() (angr.analyses.stack_pointer_tracker.StackPointerTrackerStateload() (angr.storage.memory_mixins.JavaVmMemoryMixin
method), 1105
method), 443
load() (angr.angrdb.AngrDB method), 917
load() (angr.storage.memory_mixins.KeyValueMemoryMixinload() (angr.angrdb.db.AngrDB method), 919
method), 443
load() (angr.angrdb.serializers.cfg_model.CFGModelSerializer
load() (angr.storage.memory_mixins.ListPage method),static method), 924431
load() (angr.angrdb.serializers.comments.CommentsSerializer
load() (angr.storage.memory_mixins.MemoryRegionMetaMixin
static method), 925
method), 441
load() (angr.angrdb.serializers.funcs.FunctionManagerSerializer
load()(angr.storage.memory_mixins.MVListPage
static method), 925
method), 433
load() (angr.angrdb.serializers.kb.KnowledgeBaseSerializer
load() (angr.storage.memory_mixins.name_resolution_mixin.NameResolut
static method), 926
method), 447
load() (angr.angrdb.serializers.KnowledgeBaseSerializer load() (angr.storage.memory_mixins.NameResolutionMixin
static method), 924
method), 420load() (angr.angrdb.serializers.labels.LabelsSerializer load() (angr.storage.memory_mixins.paged_memory.paged_memory_mixi
static method), 926
method), 460load() (angr.angrdb.serializers.loader.LoaderSerializer load() (angr.storage.memory_mixins.paged_memory.pages.list_page.ListP
static method), 928
method), 476
load() (angr.angrdb.serializers.LoaderSerializer static load() (angr.storage.memory_mixins.paged_memory.pages.ListPage
method), 924
method), 468
load() (angr.angrdb.serializers.structured_code.StructuredCodeManagerSerializer
load() (angr.storage.memory_mixins.paged_memory.pages.mv_list_page.M
static method), 929
method), 456
Index

1327

angr

load() (angr.storage.memory_mixins.paged_memory.pages.MVListPage
load_array_element()
method), 470(angr.storage.memory_mixins.JavaVmMemoryMixinload() (angr.storage.memory_mixins.paged_memory.pages.ultra_page.UltraPage
method), 444
method), 478
load_array_elements()load() (angr.storage.memory_mixins.paged_memory.pages.UltraPage(angr.storage.memory_mixins.JavaVmMemoryMixin
method), 472
method), 444
load() (angr.storage.memory_mixins.PagedMemoryMixin load_external_definitions()(inmodulemethod), 424
angr.procedures.definitions), 613
load() (angr.storage.memory_mixins.regioned_memory.MemoryRegionMetaMixin
load_from_dwarf() (angr.knowledge_plugins.debug_variables.DebugVar
method), 483
method), 736
load() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.MemoryRegionMetaMixin
load_from_dwarf() (angr.knowledge_plugins.DebugVariableManager
method), 491
method), 666
load() (angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin
load_from_dwarf() (angr.knowledge_plugins.VariableManager
method), 485
method), 665
load() (angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin
load_from_dwarf() (angr.knowledge_plugins.variables.variable_manage
method), 480
method), 734
load() (angr.storage.memory_mixins.RegionedMemoryMixin
load_from_dwarf() (angr.knowledge_plugins.variables.VariableManager
method), 438
method), 726
load() (angr.storage.memory_mixins.simple_interface_mixin.SimpleInterfaceMixin
load_internal() (angr.angrdb.serializers.variables.VariableManagerSer
method), 449
static method), 929
load() (angr.storage.memory_mixins.SimpleInterfaceMixinload_shellcode() (in module angr), 157
method), 420
load_shellcode() (in module angr.project), 207load() (angr.storage.memory_mixins.size_resolution_mixin.SizeConcretizationMixin
load_signatures() (in module angr.flirt), 1188
method), 451
load_type_collections()(inmoduleload() (angr.storage.memory_mixins.size_resolution_mixin.SizeNormalizationMixin
angr.procedures.definitions), 613
method), 450
load_win32_type_collections()(inmoduleload() (angr.storage.memory_mixins.SizeConcretizationMixin
angr.procedures.definitions), 613
method), 421
load_win32api_definitions()(inmoduleload() (angr.storage.memory_mixins.SizeNormalizationMixin
angr.procedures.definitions), 613
method), 420
load_with_labels() (angr.storage.memory_mixins.paged_memory.pagedload() (angr.storage.memory_mixins.slotted_memory.SlottedMemoryMixin
method), 462
method), 495
LoadArgsJSONDecoder(classinload() (angr.storage.memory_mixins.SlottedMemoryMixin
angr.angrdb.serializers.loader), 927
method), 437
LoadArgsJSONEncoder(classinload()(angr.storage.memory_mixins.UltraPageangr.angrdb.serializers.loader), 926
method), 434
LoaderSerializer (class in angr.angrdb.serializers),load() (angr.storage.memory_mixins.underconstrained_mixin.UnderconstrainedMixin923
method), 449
LoaderSerializer(classinload() (angr.storage.memory_mixins.UnderconstrainedMixin
angr.angrdb.serializers.loader), 927
method), 422
LoadHook (class in angr.analyses.cfg.indirect_jump_resolvers.jumptable),load() (angr.storage.memory_mixins.unwrapper_mixin.UnwrapperMixin902
method), 454
loads() (angr.vaults.Vault method), 785
load() (angr.storage.memory_mixins.UnwrapperMixin loc (angr.analyses.typehoon.typevars.FuncIn attribute),
method), 4221125
load() (angr.vaults.Vault method), 785
loc(angr.analyses.typehoon.typevars.FuncOut
atload() (angr.vaults.VaultDirShelf method), 786
tribute), 1125
load_all_definitions()(inmodule loc_repr() (angr.sim_variable.SimConstantVariable
angr.procedures.definitions), 613
method), 634
load_annotations() (angr.storage.memory_mixins.PagedMemoryMultiValueMixin
loc_repr()(angr.sim_variable.SimMemoryVariable
method), 428
method), 636
LOAD_ARG_BLACKLIST (angr.angrdb.serializers.loader.LoaderSerializer
loc_repr()(angr.sim_variable.SimRegisterVariable
attribute), 927
method), 635
LOAD_ARG_BLACKLIST (angr.angrdb.serializers.LoaderSerializer
loc_repr()(angr.sim_variable.SimStackVariable
attribute), 923
method), 637
1328

Index

angr

loc_repr() (angr.sim_variable.SimTemporaryVariable lookup()(angr.state_plugins.posix.PosixProcFS
method), 635
method), 308
loc_repr() (angr.sim_variable.SimVariable method), lookup() (angr.state_plugins.PosixDevFS method), 234
634
lookup() (angr.state_plugins.PosixProcFS method), 236
local_runtime_values
lookup() (angr.state_plugins.SimMount method), 283(angr.knowledge_plugins.Function property), lookup()(angr.state_plugins.SimStateJNIReferences660
method), 292
local_runtime_values
lookup_defs()(angr.analyses.ddg.LiveDefinitions(angr.knowledge_plugins.functions.Function
method), 1026
property), 708
lookup_original() (angr.state_plugins.trace_additions.ChallRespInfo
local_runtime_values
method), 341(angr.knowledge_plugins.functions.function.Function
Loop (class in angr.analyses.loopfinder), 1131
property), 720
loop_nesting_forest() (angr.utils.graph.GraphUtils
local_types (angr.analyses.decompiler.decompilation_cache.DecompilationCache
static method), 1194
property), 955
LoopAnalysis (class in angr.analyses.loop_analysis),
local_vars (angr.sim_procedure.SimProcedure at1132
tribute), 602
LoopAnalysisState(classinlocal_vars (angr.SimProcedure attribute), 149angr.analyses.loop_analysis), 1132
LOCALE_ARRAY (angr.state_plugins.libc.SimStateLibc at- LoopFinder (angr.analyses.analysis.KnownAnalysesPlugin
tribute), 302
attribute), 833
LOCALE_ARRAY (angr.state_plugins.SimStateLibc at- LoopFinder (class in angr.analyses), 810
tribute), 228
LoopFinder (class in angr.analyses.loopfinder), 1131
LocalLoopSeer (class in angr.exploration_techniques), looping_times (angr.knowledge_plugins.cfg.cfg_node.CFGENode522
attribute), 699
LocalLoopSeer(classin looping_times (angr.knowledge_plugins.cfg.CFGENodeangr.exploration_techniques.local_loop_seer),
attribute), 680
538
LoopNode (class in angr.analyses.decompiler.structuring.structurer_nodes),LocalVariableTag(classin935
angr.knowledge_plugins.key_definitions.tag),
LoopSeer (class in angr.exploration_techniques), 509
772
LoopSeer (class in angr.exploration_techniques.loop_seer),
location (angr.knowledge_plugins.variables.variable_access.VariableAccess
537
attribute), 727
LoopSimplifier(classin
LocationBase(classinangr.analyses.decompiler.region_simplifiers.loop),
angr.analyses.decompiler.region_simplifiers.expr_folding), 992
989
LoopVisitor (class in angr.analyses.forward_analysis),long_reason (angr.knowledge_plugins.cfg.cfg_node.CFGNodeCreationFailure
837
attribute), 697
LoopVisitor(classinlongest_prefix() (angr.analyses.typehoon.typevars.DerivedTypeVariable
angr.analyses.forward_analysis.visitors),
method), 1124
842
looks_like_sql() (in module angr.utils), 1189
LoopVisitor(classinlookup() (angr.analyses.typehoon.simple_solver.Sketch
angr.analyses.forward_analysis.visitors.loop),
method), 1118
847
lookup() (angr.knowledge_plugins.Labels method), 668 lower_bound (angr.analyses.typehoon.simple_solver.SketchNodelookup()(angr.knowledge_plugins.labels.Labels
attribute), 1117
method), 704
LoweredSwitchSimplifier(classinlookup() (angr.SimMount method), 199
angr.analyses.decompiler.optimization_passes),
lookup() (angr.state_plugins.filesystem.SimConcreteFilesystem962
method), 318
LoweredSwitchSimplifier(classinlookup()(angr.state_plugins.filesystem.SimMountangr.analyses.decompiler.optimization_passes.lowered_switch_sim
method), 317
980
lookup() (angr.state_plugins.jni_references.SimStateJNIReferences
LShift (angr.engines.light.ArithmeticExpression atmethod), 362
tribute), 1031
lookup()(angr.state_plugins.posix.PosixDevFS LShift (angr.engines.light.data.ArithmeticExpression
method), 306
attribute), 1030
Index

1329

angr

LT (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.CmpOp
601
attribute), 993
make_continuation() (angr.SimProcedure method),149
M
make_copy()(angr.analyses.cfg.cfg_base.CFGBasemethod),883
main() (in module angr.flirt.build_sig), 1188
make_copy()(angr.analyses.cfg.CFGBasemethod), 872
main_executable_region_limbos_contain()make_function_codeloc()(angr.analyses.Reassembler method), 812(angr.analyses.reaching_definitions.function_handler.FunctionHa
main_executable_region_limbos_contain()method), 1088
(angr.analyses.reassembler.Reassembler
make_function_codeloc()
method), 1151
(angr.analyses.reaching_definitions.FunctionHandler
main_executable_regions
method), 1067
(angr.analyses.Reassembler property), 811
make_functions() (angr.analyses.cfg.cfg_base.CFGBasemain_executable_regions
method), 884(angr.analyses.reassembler.Reassembler
make_functions() (angr.analyses.cfg.cfg_fast_soot.CFGFastSoot
property), 1150
method), 914
main_executable_regions_contain()make_functions()(angr.analyses.cfg.CFGBase(angr.analyses.Reassembler method), 812
method), 873
main_executable_regions_contain()make_functions()(angr.analyses.cfg.CFGFastSoot(angr.analyses.reassembler.Reassembler
method), 869
method), 1150
make_functions()(angr.analyses.CFGFastSoot
main_nonexecutable_region_limbos_contain()method), 801(angr.analyses.Reassembler method), 812
make_ident() (angr.SimFileBase static method), 184
main_nonexecutable_region_limbos_contain()make_ident() (angr.storage.file.SimFileBase static(angr.analyses.reassembler.Reassembler
method), 392
method), 1151
make_initial_state() (angr.analyses.Identifier static
main_nonexecutable_regions
method), 817(angr.analyses.Reassembler property), 811
make_initial_state()
main_nonexecutable_regions(angr.analyses.identifier.identify.Identifier(angr.analyses.reassembler.Reassembler
static method), 1131
property), 1150
make_liveness_snapshot()
main_nonexecutable_regions_contain()(angr.analyses.reaching_definitions.ReachingDefinitionsModel(angr.analyses.Reassembler method), 812
method), 1058
main_nonexecutable_regions_contain()make_liveness_snapshot()(angr.analyses.reassembler.Reassembler(angr.knowledge_plugins.key_definitions.rd_model.ReachingDefin
method), 1151
method), 770
main_object (angr.angrdb.models.DbObject attribute),
make_liveness_snapshot()919(angr.knowledge_plugins.key_definitions.ReachingDefinitionsMod
make() (angr.sim_type.SimTypePointer method), 644
method), 737
make() (angr.sim_type.SimTypeReference method), 644
make_phi_node() (angr.knowledge_plugins.variables.variable_manager.V
make_breakpoint() (angr.state_plugins.inspect.SimInspector
method), 729
method), 300(angr.analyses.Identifier
make_breakpoint() (angr.state_plugins.SimInspector make_symbolic_state()
static method), 817
method), 232
make_bv_sizes_equal()(inmodule make_symbolic_state()(angr.analyses.identifier.identify.Identifierangr.engines.pcode.behavior), 573
static method), 1131
make_child() (angr.state_plugins.history.SimStateHistory
MakeTypecastsImplicit(classinmethod), 336
angr.analyses.decompiler.structured_codegen.c),make_child()(angr.state_plugins.SimStateHistory1019
method), 254
malloc()(angr.SimHeapPTMalloc method), 202
make_concrete_int()(angr.sim_state.SimState
malloc()(angr.state_plugins.heap.heap_libc.SimHeapLibc
method), 223
method), 374
make_concrete_int() (angr.SimState method), 180
malloc()(angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
make_continuation()
method),378(angr.sim_procedure.SimProcedure method),
1330

Index

angr

malloc()(angr.state_plugins.heap.SimHeapLibc
method), 721
method), 366
mark_okfilter() (angr.exploration_techniques.manual_mergepoint.Manu
malloc() (angr.state_plugins.heap.SimHeapPTMalloc
method), 526
method), 367
mark_okfilter() (angr.exploration_techniques.ManualMergepoint
malloc() (angr.state_plugins.SimHeapLibc method),
method), 518
286
match_stmt_classes()(inmodulemalloc()(angr.state_plugins.SimHeapPTMalloc
angr.analyses.decompiler.utils), 1023
method), 287
matches() (angr.analyses.reaching_definitions.Definition
ManualMergepoint(classinmethod), 1053
angr.exploration_techniques), 518
matches() (angr.knowledge_plugins.key_definitions.Definition
ManualMergepoint(classinmethod), 750
angr.exploration_techniques.manual_mergepoint),matches() (angr.knowledge_plugins.key_definitions.definition.Definition526
method), 758
map() (angr.storage.memory_mixins.regioned_memory.region_data.RegionMap
matches() (angr.knowledge_plugins.key_definitions.definition.DefinitionM
method), 489
method), 756
map_callsites() (angr.analyses.Identifier method), max() (angr.state_plugins.SimSolver method), 245
817
max() (angr.state_plugins.solver.SimSolver method), 324
map_callsites() (angr.analyses.identifier.identify.Identifier
max_allocation (angr.state_plugins.cgc.SimStateCGC
method), 1131
attribute), 337
map_region() (angr.storage.memory_mixins.address_concretization_mixin.AddressConcretizationMixin
max_allocation (angr.state_plugins.SimStateCGC atmethod), 453
tribute), 256
map_region() (angr.storage.memory_mixins.AddressConcretizationMixin
max_bytes (angr.engines.pcode.lifter.Lifter attribute),
method), 416
568
map_region() (angr.storage.memory_mixins.paged_memory.paged_memory_mixin.PagedMemoryMixin
max_bytes(angr.engines.pcode.lifter.PcodeLifter
method), 461
attribute), 570
map_region() (angr.storage.memory_mixins.PagedMemoryMixin
MAX_DATA_REFS (angr.engines.pcode.lifter.IRSB atmethod), 425
tribute), 564
mapping (angr.analyses.cfg.indirect_jump_resolvers.jumptable.ConstantValueManager
MAX_EXITS (angr.engines.pcode.lifter.IRSB attribute),
attribute), 900564
mark_const() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
max_inst (angr.engines.pcode.lifter.Lifter attribute), 568
method), 1097
max_inst (angr.engines.pcode.lifter.PcodeLifter atmark_const() (angr.analyses.reaching_definitions.ReachingDefinitionsStatetribute), 570
method), 1066
max_int() (angr.state_plugins.SimSolver method), 249
mark_function_alignments()
max_int()(angr.state_plugins.solver.SimSolver(angr.analyses.cfg.cfg_base.CFGBasemethod), 327
method), 884
MAX_ONE_CALL (angr.analyses.decompiler.structuring.phoenix.MultiStmtEx
mark_function_alignments()
attribute), 939(angr.analyses.cfg.CFGBase method), 873
max_size (angr.knowledge_plugins.cfg.memory_data.MemoryData
mark_guard() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
attribute), 696
method), 1097
max_size (angr.knowledge_plugins.cfg.MemoryData atmark_guard() (angr.analyses.reaching_definitions.ReachingDefinitionsStatetribute), 677
method), 1066
max_size (angr.utils.dynamic_dictlist.DynamicDictList
mark_nofilter() (angr.exploration_techniques.manual_mergepoint.ManualMergepoint
attribute), 1190
method), 526
maximize_similarity_of_blocks()
mark_nofilter() (angr.exploration_techniques.ManualMergepoint (angr.analyses.decompiler.optimization_passes.DuplicationRevert
method), 518
method), 973
mark_nonreturning_calls_endpoints()
maximum_syscall_number()(angr.knowledge_plugins.Function
method),(angr.procedures.definitions.SimSyscallLibrary661
method), 611
mark_nonreturning_calls_endpoints()meet() (angr.analyses.typehoon.simple_solver.SimpleSolver(angr.knowledge_plugins.functions.Function
method), 1120
method), 709
mem (angr.sim_state.SimState attribute), 220
mark_nonreturning_calls_endpoints()
mem (angr.SimState attribute), 177(angr.knowledge_plugins.functions.function.Function
mem (angr.state_plugins.debug_variables.SimDebugVariable
Index

1331

angr

property), 381
attribute), 1041
MEM (angr.state_plugins.sim_action.SimAction attribute), memory (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsSta
595
property), 1093
MEM (angr.state_plugins.SimAction attribute), 262
memory (angr.analyses.reaching_definitions.ReachingDefinitionsStatemem (angr.state_plugins.SimDebugVariable property),
property), 1062
297
memory (angr.analyses.stack_pointer_tracker.FrozenStackPointerTrackerStamem() (angr.analyses.reaching_definitions.Atom static
attribute), 1104
method), 1050
memory (angr.analyses.stack_pointer_tracker.StackPointerTrackerStatemem() (angr.knowledge_plugins.key_definitions.atoms.Atom
attribute), 1104
static method), 752
MEMORY (angr.knowledge_plugins.key_definitions.atoms.AtomKind
mem_concrete() (angr.sim_state.SimState method), 222
attribute), 750
mem_concrete() (angr.SimState method), 179
memory (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefini
mem_map() (angr.state_plugins.unicorn_engine.Uniwrapper
attribute), 762
method), 354
memory (angr.knowledge_plugins.key_definitions.LiveDefinitions
mem_map_ptr() (angr.state_plugins.unicorn_engine.Uniwrapper
attribute), 740
method), 354
MEMORY (angr.knowledge_plugins.variables.variable_manager.VariableType
MEM_PATCH (class in angr.state_plugins.unicorn_engine),
attribute), 728
349
MEMORY (angr.knowledge_plugins.variables.VariableType
mem_reset() (angr.state_plugins.unicorn_engine.Uniwrapper
attribute), 727
method), 354
memory (angr.sim_state.SimState attribute), 220
mem_unmap() (angr.state_plugins.unicorn_engine.Uniwrapper
memory (angr.SimState attribute), 177
method), 354
memory()(angr.analyses.reaching_definitions.Atom
mem_untyped (angr.state_plugins.debug_variables.SimDebugVariablestatic method), 1050
property), 381
memory() (angr.knowledge_plugins.key_definitions.atoms.Atom
mem_untyped(angr.state_plugins.SimDebugVariable
static method), 752
property), 297
memory_args (angr.calling_conventions.SimCC propmember() (angr.state_plugins.debug_variables.SimDebugVariable erty), 619
method), 381
memory_args (angr.SimCC property), 181
member()(angr.state_plugins.SimDebugVariable memory_data (angr.analyses.cfg.cfg_fast.CFGFast propmethod), 297erty), 892
member() (angr.state_plugins.SimMemView method), memory_data (angr.analyses.cfg.CFGFast property),279
860
member()(angr.state_plugins.view.SimMemView memory_data (angr.analyses.CFGFast property), 792
method), 390
memory_data (angr.knowledge_plugins.cfg.cfg_model.CFGModel
members (angr.sim_type.SimCppClass property), 651
attribute), 689
MemDepNode (class in angr.analyses.data_dep), 1165
memory_data (angr.knowledge_plugins.cfg.CFGModel
MemDepNode (class in angr.analyses.data_dep.dep_nodes),attribute), 682
1162
memory_data(angr.knowledge_plugins.xrefs.XRef
memo (angr.analyses.typehoon.lifter.TypeLifter attribute),
attribute), 776
1117
memory_data (angr.knowledge_plugins.xrefs.xref.XRefmemo() (angr.SimStatePlugin static method), 151
attribute), 778
memo() (angr.state_plugins.plugin.SimStatePlugin static memory_definitions (angr.analyses.reaching_definitions.LiveDefinitions
method), 299
property), 1041
memo()(angr.state_plugins.SimStatePlugin
static memory_definitions (angr.knowledge_plugins.key_definitions.live_defini
method), 227
property), 762
memoize()(inmodule memory_definitions (angr.knowledge_plugins.key_definitions.LiveDefini
angr.analyses.typehoon.typeconsts), 1127
property), 740
Memory (angr.analyses.data_dep.dep_nodes.DepNodeTypes memory_uses (angr.analyses.reaching_definitions.LiveDefinitions
attribute), 1161
attribute), 1041
Memory (angr.analyses.data_dep.DepNodeTypes at- memory_uses (angr.analyses.reaching_definitions.rd_state.ReachingDefinit
tribute), 1164
property), 1093
MEMORY (angr.analyses.reaching_definitions.AtomKind memory_uses (angr.analyses.reaching_definitions.ReachingDefinitionsState
attribute), 1049
property), 1062
memory (angr.analyses.reaching_definitions.LiveDefinitions memory_uses (angr.knowledge_plugins.key_definitions.live_definitions.Live
1332

Index

angr

attribute), 762
method), 1132
memory_uses (angr.knowledge_plugins.key_definitions.LiveDefinitions
merge() (angr.analyses.reaching_definitions.LiveDefinitions
attribute), 740
method), 1043
memory_values (angr.state_plugins.unicorn_engine.VEXStmtDetails
merge() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsS
attribute), 351
method), 1093
memory_values_countmerge() (angr.analyses.reaching_definitions.ReachingDefinitionsModel(angr.state_plugins.unicorn_engine.VEXStmtDetails
method), 1058
attribute), 351
merge() (angr.analyses.reaching_definitions.ReachingDefinitionsState
MemoryData (class in angr.knowledge_plugins.cfg), 676
method), 1063
MemoryData (class in angr.knowledge_plugins.cfg.memory_data),
merge() (angr.analyses.stack_pointer_tracker.FrozenStackPointerTrackerSt695
method), 1104
MemoryDataSort (class in angr.knowledge_plugins.cfg), merge() (angr.analyses.stack_pointer_tracker.StackPointerTrackerState676
method), 1105
MemoryDataSort(classin merge() (angr.analyses.variable_recovery.variable_recovery.VariableRecoangr.knowledge_plugins.cfg.memory_data),
method), 1113
694
merge() (angr.analyses.variable_recovery.variable_recovery_fast.Variable
MemoryLocation(classinmethod), 1111
angr.analyses.reaching_definitions), 1051
merge() (angr.concretization_strategies.norepeats.SimConcretizationStrate
MemoryLocation(classinmethod), 496
angr.knowledge_plugins.key_definitions.atoms), merge() (angr.concretization_strategies.norepeats_range.SimConcretizatio
755
method), 497
MemoryMappingError, 353
merge() (angr.concretization_strategies.SimConcretizationStrategy
MemoryObjectMixin(classinmethod), 411
angr.storage.memory_mixins), 428
merge() (angr.concretization_strategies.SimConcretizationStrategyNorepea
MemoryObjectMixin(classinmethod), 413
angr.storage.memory_mixins.paged_memory.pages),
merge() (angr.concretization_strategies.SimConcretizationStrategyNorepea
465
method), 413
MemoryObjectMixin(classin merge() (angr.keyed_region.KeyedRegion method), 782
angr.storage.memory_mixins.paged_memory.pages.cooperation),merge() (angr.knowledge_plugins.cfg.cfg_node.CFGNode475
method), 699
MemoryObjectSetMixin(classin merge()(angr.knowledge_plugins.cfg.CFGNodeangr.storage.memory_mixins.paged_memory.pages.cooperation),
method), 679
475
merge() (angr.knowledge_plugins.key_definitions.environment.Environmen
MemoryOperand (class in angr.analyses.disassembly),
method), 759
1143
merge() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
MemoryRegion (class in angr.analyses.cfg.cfb), 873
method), 764
MemoryRegionMetaMixin(classin merge() (angr.knowledge_plugins.key_definitions.LiveDefinitions
angr.storage.memory_mixins), 440
method), 742
MemoryRegionMetaMixin(classin merge() (angr.knowledge_plugins.key_definitions.rd_model.ReachingDefinangr.storage.memory_mixins.regioned_memory),method), 771
482
merge() (angr.knowledge_plugins.key_definitions.ReachingDefinitionsMod
MemoryRegionMetaMixin(classinmethod), 738
angr.storage.memory_mixins.regioned_memory.region_meta_mixin),
merge() (angr.knowledge_plugins.key_definitions.Uses491
method), 749
MemoryValue(classin merge() (angr.knowledge_plugins.key_definitions.uses.Uses
angr.state_plugins.unicorn_engine), 350
method), 775
MemoryWatcher (class in angr.exploration_techniques), merge()(angr.sim_manager.SimulationManager
521
method), 505
MemoryWatcher(classin merge() (angr.sim_state.SimState method), 222
angr.exploration_techniques.memory_watcher), merge() (angr.SimFile method), 187542
merge() (angr.SimFileDescriptor method), 195
merge() (angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILState
merge() (angr.SimFileDescriptorDuplex method), 197
method), 982
merge() (angr.SimFileStream method), 191
merge() (angr.analyses.loop_analysis.LoopAnalysisState merge() (angr.SimHeapBrk method), 200
Index

1333

angr

merge() (angr.SimHeapPTMalloc method), 203
merge()(angr.state_plugins.scratch.SimStateScratch
merge() (angr.SimPackets method), 189
method), 346
merge() (angr.SimPacketsStream method), 193
merge() (angr.state_plugins.SimFilesystem method), 281
merge() (angr.SimState method), 179
merge() (angr.state_plugins.SimHeapBrk method), 285
merge() (angr.SimStatePlugin method), 152
merge()(angr.state_plugins.SimHeapPTMalloc
merge() (angr.SimulationManager method), 173
method), 288
merge() (angr.state_plugins.CallStack method), 267
merge() (angr.state_plugins.SimInspector method), 233
merge()(angr.state_plugins.callstack.CallStack merge()(angr.state_plugins.SimJavaVmClassloader
method), 330
method), 295
merge() (angr.state_plugins.cgc.SimStateCGC method), merge() (angr.state_plugins.SimMemView method), 278
338
merge() (angr.state_plugins.SimRegNameView method),merge() (angr.state_plugins.Concrete method), 291
274
merge() (angr.state_plugins.concrete.Concrete method), merge() (angr.state_plugins.SimSolver method), 244358
merge() (angr.state_plugins.SimStateCGC method), 257
merge() (angr.state_plugins.filesystem.SimConcreteFilesystemmerge() (angr.state_plugins.SimStateGlobals method),
method), 318
269
merge()(angr.state_plugins.filesystem.SimFilesystem merge() (angr.state_plugins.SimStateHistory method),
method), 315
252
merge()(angr.state_plugins.globals.SimStateGlobals merge()(angr.state_plugins.SimStateJNIReferences
method), 343
method), 293
merge() (angr.state_plugins.heap.heap_brk.SimHeapBrk merge() (angr.state_plugins.SimStateLibc method), 231
method), 372
merge() (angr.state_plugins.SimStateLog method), 250
merge() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
merge()(angr.state_plugins.SimStateLoopData
method), 378
method), 273
merge() (angr.state_plugins.heap.SimHeapBrk method), merge() (angr.state_plugins.SimStatePlugin method),365
227
merge()(angr.state_plugins.heap.SimHeapPTMalloc merge()(angr.state_plugins.SimStatePreconstrainer
method), 368
method), 271
merge()(angr.state_plugins.history.SimStateHistory merge() (angr.state_plugins.SimStateScratch method),
method), 333
255
merge()(angr.state_plugins.inspect.SimInspector merge() (angr.state_plugins.SimSystemPosix method),
method), 301
240
merge() (angr.state_plugins.javavm_classloader.SimJavaVmClassloader
merge() (angr.state_plugins.solver.SimSolver method),
method), 361
322
merge() (angr.state_plugins.jni_references.SimStateJNIReferences
merge() (angr.state_plugins.trace_additions.ChallRespInfo
method), 362
method), 340
merge() (angr.state_plugins.libc.SimStateLibc method), merge() (angr.state_plugins.trace_additions.ZenPlugin
305
method), 342
merge() (angr.state_plugins.log.SimStateLog method), merge() (angr.state_plugins.Unicorn method), 261
328
merge()(angr.state_plugins.unicorn_engine.Unicorn
merge() (angr.state_plugins.loop_data.SimStateLoopData
method), 355
method), 357
merge()(angr.state_plugins.view.SimMemView
merge()(angr.state_plugins.plugin.SimStatePlugin
method), 389
method), 299
merge()(angr.state_plugins.view.SimRegNameView
merge() (angr.state_plugins.posix.PosixDevFS method),
method), 385
306
merge() (angr.storage.file.SimFile method), 394
merge()(angr.state_plugins.posix.PosixProcFS merge() (angr.storage.file.SimFileDescriptor method),
method), 308404
merge()(angr.state_plugins.posix.SimSystemPosix merge()(angr.storage.file.SimFileDescriptorDuplex
method), 312
method), 407
merge() (angr.state_plugins.PosixDevFS method), 235
merge() (angr.storage.file.SimFileStream method), 396
merge() (angr.state_plugins.PosixProcFS method), 237 merge() (angr.storage.file.SimPackets method), 398
merge() (angr.state_plugins.preconstrainer.SimStatePreconstrainer
merge() (angr.storage.file.SimPacketsSlots method), 408
method), 348
merge() (angr.storage.file.SimPacketsStream method),
1334

Index

angr

400
method), 435
merge() (angr.storage.memory_mixins.address_concretization_mixin.AddressConcretizationMixin
merge() (angr.storage.SimFile method), 383
method), 452
merge_jobs() (angr.analyses.vfg.CallAnalysis method),merge() (angr.storage.memory_mixins.AddressConcretizationMixin 1136
method), 415
merge_points()(angr.annocfg.AnnotatedCFG
merge() (angr.storage.memory_mixins.JavaVmMemoryMixin
method), 1170
method), 445
merge_to_top()(angr.keyed_region.KeyedRegion
merge()(angr.storage.memory_mixins.ListPage
method), 782
method), 431
merge_transitions()(inmodulemerge() (angr.storage.memory_mixins.MemoryRegionMetaMixin angr.analyses.cfg_slice_to_sink.transitions),
method), 441
1103
merge()(angr.storage.memory_mixins.MVListPage merged_jobs (angr.analyses.forward_analysis.job_info.JobInfo
method), 433
property), 840
merge() (angr.storage.memory_mixins.paged_memory.paged_memory_mixin.PagedMemoryMixin
MicrosoftAMD64ArgSession(classinmethod), 460
angr.calling_conventions), 623
merge() (angr.storage.memory_mixins.paged_memory.pages.list_page.ListPagemin() (angr.state_plugins.SimSolver method), 246
method), 476
min() (angr.state_plugins.solver.SimSolver method), 324
merge() (angr.storage.memory_mixins.paged_memory.pages.ListPage
min_int() (angr.state_plugins.SimSolver method), 249
method), 469
min_int()(angr.state_plugins.solver.SimSolver
merge() (angr.storage.memory_mixins.paged_memory.pages.multi_values.MultiValues
method), 327
method), 458
minimum_syscall_number()merge() (angr.storage.memory_mixins.paged_memory.pages.mv_list_page.MVListPage(angr.procedures.definitions.SimSyscallLibrarymethod), 456
method), 610
merge() (angr.storage.memory_mixins.paged_memory.pages.MVListPage
MipsElfFastResolver(classinmethod), 470
angr.analyses.cfg.indirect_jump_resolvers),
merge() (angr.storage.memory_mixins.paged_memory.pages.ultra_page.UltraPage905
method), 478
MipsElfFastResolver(classinmerge() (angr.storage.memory_mixins.paged_memory.pages.UltraPageangr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast),
method), 472
897
merge() (angr.storage.memory_mixins.PagedMemoryMixinMipsElfGotResolver(classinmethod), 424
angr.analyses.cfg.indirect_jump_resolvers),
merge() (angr.storage.memory_mixins.regioned_memory.MemoryRegionMetaMixin906
method), 483
MIPSGPHook (class in angr.analyses.cfg.indirect_jump_resolvers.jumptable)
merge() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.AbstractLocation902
method), 491
MixedPermissonsError, 354
merge() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.MemoryRegionMetaMixin
mnemonic (angr.analyses.disassembly.Instruction propmethod), 492erty), 1142
merge() (angr.storage.memory_mixins.regioned_memory.regioned_address_concretization_mixin.RegionedAddressConcretizationMixi
mnemonic (angr.block.CapstoneInsn property), 216
method), 493
mnemonic (angr.block.DisassemblerInsn property), 216
merge() (angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin
mnemonic (angr.engines.pcode.lifter.PcodeDisassemblerInsn
method), 486
property), 563
merge() (angr.storage.memory_mixins.regioned_memory.RegionedAddressConcretizationMixin
model (angr.analyses.cfg.cfg_base.CFGBase property),
method), 484
882
merge() (angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin
model (angr.analyses.cfg.CFGBase property), 871
method), 480
ModSimplifier(classinmerge() (angr.storage.memory_mixins.RegionedAddressConcretizationMixin
angr.analyses.decompiler.optimization_passes),method), 442
964
merge() (angr.storage.memory_mixins.RegionedMemoryMixin
ModSimplifier(classinmethod), 438
angr.analyses.decompiler.optimization_passes.mod_simplifier),
merge() (angr.storage.memory_mixins.slotted_memory.SlottedMemoryMixin982
method), 494
ModSimplifierAILEngine(classinmerge() (angr.storage.memory_mixins.SlottedMemoryMixin
angr.analyses.decompiler.optimization_passes.mod_simplifier),
method), 436
981
merge()(angr.storage.memory_mixins.UltraPage module
Index

1335

angr

angr, 147
angr.analyses.data_dep.dep_nodes, 1161
angr.analyses, 786
angr.analyses.data_dep.sim_act_location,
angr.analyses.analysis, 832
1160
angr.analyses.backward_slice, 849
angr.analyses.datagraph_meta, 915
angr.analyses.binary_optimizer, 1154
angr.analyses.ddg, 1024
angr.analyses.bindiff, 850
angr.analyses.decompiler, 940
angr.analyses.boyscout, 853
angr.analyses.decompiler.ail_simplifier,angr.analyses.callee_cleanup_finder, 1155
948
angr.analyses.calling_convention, 853
angr.analyses.decompiler.ailgraph_walker,
angr.analyses.cdg, 915
949
angr.analyses.cfg, 857
angr.analyses.decompiler.block_simplifier,angr.analyses.cfg.cfb, 873
949
angr.analyses.cfg.cfg, 874
angr.analyses.decompiler.callsite_maker,
angr.analyses.cfg.cfg_arch_options, 892
950
angr.analyses.cfg.cfg_base, 881
angr.analyses.decompiler.ccall_rewriters,
angr.analyses.cfg.cfg_emulated, 876
950
angr.analyses.cfg.cfg_fast, 884
angr.analyses.decompiler.ccall_rewriters.amd64_ccalls,
angr.analyses.cfg.cfg_fast_soot, 913
950
angr.analyses.cfg.cfg_job_base, 893
angr.analyses.decompiler.ccall_rewriters.rewriter_base
angr.analyses.cfg.indirect_jump_resolvers,
950905
angr.analyses.decompiler.clinic, 950
angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got,
angr.analyses.decompiler.condition_processor,
894
953
angr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast,angr.analyses.decompiler.decompilation_cache,895
955
angr.analyses.cfg.indirect_jump_resolvers.const_resolver,
angr.analyses.decompiler.decompilation_options,904
954
angr.analyses.cfg.indirect_jump_resolvers.default_resolvers,
angr.analyses.decompiler.decompiler, 955
898
angr.analyses.decompiler.empty_node_remover,angr.analyses.cfg.indirect_jump_resolvers.jumptable,
957
898
angr.analyses.decompiler.expression_narrower,
angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast,
957
896
angr.analyses.decompiler.graph_region,angr.analyses.cfg.indirect_jump_resolvers.resolver,959
904
angr.analyses.decompiler.jump_target_collector,
angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt,
960
897
angr.analyses.decompiler.jumptable_entry_condition_rew
angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat,
960
896
angr.analyses.decompiler.optimization_passes,
angr.analyses.cfg_slice_to_sink, 1098
960
angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink,angr.analyses.decompiler.optimization_passes.base_ptr_
1101
978angr.analyses.cfg_slice_to_sink.graph,angr.analyses.decompiler.optimization_passes.const_der1102
974
angr.analyses.cfg_slice_to_sink.transitions, angr.analyses.decompiler.optimization_passes.div_simpl
1103
978
angr.analyses.class_identifier, 1140
angr.analyses.decompiler.optimization_passes.engine_ba
angr.analyses.code_tagging, 915
982
angr.analyses.complete_calling_conventions,angr.analyses.decompiler.optimization_passes.expr_op_s
855983
angr.analyses.congruency_check, 1153
angr.analyses.decompiler.optimization_passes.ite_expr_
angr.analyses.data_dep, 1164
978angr.analyses.data_dep.data_dependency_analysis,angr.analyses.decompiler.optimization_passes.lowered_s
1159
979
1336

Index

angr

angr.analyses.decompiler.optimization_passes.mod_simplifier,angr.analyses.decompiler.structured_codegen.c,
981
1002
angr.analyses.decompiler.optimization_passes.multi_simplifier,angr.analyses.decompiler.structured_codegen.dummy,
981
1020
angr.analyses.decompiler.optimization_passes.optimization_pass,angr.analyses.decompiler.structured_codegen.dwarf_impo
975
1020
angr.analyses.decompiler.optimization_passes.register_save_area_simplifier,angr.analyses.decompiler.structuring, 930
984
angr.analyses.decompiler.structuring.dream,
angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier,932
984
angr.analyses.decompiler.structuring.phoenix,
angr.analyses.decompiler.optimization_passes.stack_canary_simplifier,939
977
angr.analyses.decompiler.structuring.recursive_structu
angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier,930
985
angr.analyses.decompiler.structuring.structurer_base,angr.analyses.decompiler.peephole_optimizations, 938985
angr.analyses.decompiler.structuring.structurer_nodes,
angr.analyses.decompiler.peephole_optimizations.base,933
985
angr.analyses.decompiler.utils, 1020
angr.analyses.decompiler.redundant_label_remover,angr.analyses.disassembly, 1141
996
angr.analyses.disassembly_utils, 1145
angr.analyses.decompiler.region_identifier,angr.analyses.dominance_frontier, 1155
987
angr.analyses.find_objects_static, 1140
angr.analyses.decompiler.region_simplifiers, angr.analyses.flirt, 1030
988
angr.analyses.forward_analysis, 834
angr.analyses.decompiler.region_simplifiers.cascading_cond_transformer,
angr.analyses.forward_analysis.forward_analysis,
988
839
angr.analyses.decompiler.region_simplifiers.cascading_ifs,
angr.analyses.forward_analysis.job_info,
988
840
angr.analyses.decompiler.region_simplifiers.expr_folding,angr.analyses.forward_analysis.visitors,
989
840
angr.analyses.decompiler.region_simplifiers.goto,
angr.analyses.forward_analysis.visitors.call_graph,991
843
angr.analyses.decompiler.region_simplifiers.if_,
angr.analyses.forward_analysis.visitors.function_graph992
844
angr.analyses.decompiler.region_simplifiers.ifelse,
angr.analyses.forward_analysis.visitors.graph,992
845
angr.analyses.decompiler.region_simplifiers.loop,
angr.analyses.forward_analysis.visitors.loop,
992
847
angr.analyses.decompiler.region_simplifiers.node_address_finder,
angr.analyses.forward_analysis.visitors.single_node_gr
992
848
angr.analyses.decompiler.region_simplifiers.region_simplifier,angr.analyses.identifier.identify, 1130
992
angr.analyses.init_finder, 1155
angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier,angr.analyses.loop_analysis, 1131
993
angr.analyses.loopfinder, 1131
angr.analyses.decompiler.region_simplifiers.switch_expr_simplifier,angr.analyses.propagator, 1033
996
angr.analyses.propagator.engine_ail, 1036
angr.analyses.decompiler.region_walker,
angr.analyses.propagator.engine_base,996
1035
angr.analyses.decompiler.sequence_walker,
angr.analyses.propagator.engine_vex, 1036
996
angr.analyses.propagator.outdated_definition_walker,
angr.analyses.decompiler.structured_codegen,1037
997
angr.analyses.propagator.propagator, 1038
angr.analyses.decompiler.structured_codegen.base,angr.analyses.propagator.tmpvar_finder,
1001
1038
Index

1337

angr

angr.analyses.propagator.top_checker_mixin,
angr.analyses.vfg, 1134
1040
angr.analyses.vsa_ddg, 1139
angr.analyses.propagator.values, 1034
angr.analyses.vtable, 1139
angr.analyses.propagator.vex_vars, 1035
angr.analyses.xrefs, 1156
angr.analyses.proximity_graph, 1157
angr.angrdb, 916
angr.analyses.reaching_definitions, 1040
angr.angrdb.db, 917
angr.analyses.reaching_definitions.call_trace, angr.angrdb.models, 919
1072
angr.angrdb.serializers, 923
angr.analyses.reaching_definitions.dep_graph, angr.angrdb.serializers.cfg_model, 924
1078
angr.angrdb.serializers.comments, 924
angr.analyses.reaching_definitions.engine_ail, angr.angrdb.serializers.funcs, 925
1098
angr.angrdb.serializers.kb, 925
angr.analyses.reaching_definitions.engine_vex, angr.angrdb.serializers.labels, 926
1074
angr.angrdb.serializers.loader, 926
angr.analyses.reaching_definitions.function_handler,
angr.angrdb.serializers.structured_code,1082
929
angr.analyses.reaching_definitions.heap_allocator,
angr.angrdb.serializers.variables, 928
1081
angr.angrdb.serializers.xrefs, 928
angr.analyses.reaching_definitions.rd_state, angr.annocfg, 1169
1089
angr.blade, 1167
angr.analyses.reaching_definitions.reaching_definitions,angr.block, 215
1074
angr.callable, 653
angr.analyses.reaching_definitions.subject,angr.calling_conventions, 613
1097
angr.code_location, 779
angr.analyses.reassembler, 1145
angr.codenode, 1170
angr.analyses.soot_class_hierarchy, 857
angr.concretization_strategies, 411
angr.analyses.stack_pointer_tracker, 1103
angr.concretization_strategies.any, 498
angr.analyses.static_hooker, 1153
angr.concretization_strategies.controlled_data,
angr.analyses.typehoon, 1129
498
angr.analyses.typehoon.lifter, 1116
angr.concretization_strategies.eval, 495
angr.analyses.typehoon.simple_solver,
angr.concretization_strategies.max, 497
1117
angr.concretization_strategies.nonzero,angr.analyses.typehoon.translator, 1121
497
angr.analyses.typehoon.typeconsts, 1127
angr.concretization_strategies.nonzero_range,
angr.analyses.typehoon.typehoon, 1126
496
angr.analyses.typehoon.typevars, 1121
angr.concretization_strategies.norepeats,
angr.analyses.variable_recovery, 1115
495
angr.analyses.variable_recovery.annotations, angr.concretization_strategies.norepeats_range,
1106
497
angr.analyses.variable_recovery.engine_ail,angr.concretization_strategies.range, 496
1113
angr.concretization_strategies.single,
angr.analyses.variable_recovery.engine_base,495
1114
angr.concretization_strategies.solutions,angr.analyses.variable_recovery.engine_vex,
496
1114
angr.concretization_strategies.unlimited_range,
angr.analyses.variable_recovery.irsb_scanner,
498
1115
angr.distributed, 1204
angr.analyses.variable_recovery.variable_recovery,
angr.distributed.server, 1205
1112
angr.distributed.worker, 1206
angr.analyses.variable_recovery.variable_recovery_base,angr.engines, 543
1106
angr.engines.concrete, 560
angr.analyses.variable_recovery.variable_recovery_fast,angr.engines.engine, 551
1110
angr.engines.failure, 555
angr.analyses.veritesting, 1132
angr.engines.hook, 554
1338

Index

angr

angr.engines.light, 1031
angr.exploration_techniques.unique, 540
angr.engines.light.data, 1030
angr.exploration_techniques.veritesting,angr.engines.light.engine, 1032
530
angr.engines.pcode, 561
angr.factory, 212
angr.engines.pcode.behavior, 573
angr.flirt, 1187
angr.engines.pcode.cc, 593
angr.flirt.build_sig, 1188
angr.engines.pcode.emulate, 573
angr.keyed_region, 781
angr.engines.pcode.engine, 562
angr.knowledge_base, 654
angr.engines.pcode.lifter, 563
angr.knowledge_plugins, 655
angr.engines.procedure, 554
angr.knowledge_plugins.callsite_prototypes,
angr.engines.soot, 558
675
angr.engines.soot.engine, 559
angr.knowledge_plugins.cfg, 676
angr.engines.successors, 552
angr.knowledge_plugins.cfg.cfg_manager,
angr.engines.syscall, 555
696
angr.engines.unicorn, 559
angr.knowledge_plugins.cfg.cfg_model, 688
angr.engines.vex, 555
angr.knowledge_plugins.cfg.cfg_node, 697
angr.errors, 1198
angr.knowledge_plugins.cfg.indirect_jump,angr.exploration_techniques, 506
700
angr.exploration_techniques.bucketizer,
angr.knowledge_plugins.cfg.memory_data,
543
694
angr.exploration_techniques.common, 541
angr.knowledge_plugins.comments, 703
angr.exploration_techniques.dfs, 524
angr.knowledge_plugins.data, 704
angr.exploration_techniques.director, 534
angr.knowledge_plugins.debug_variables,
angr.exploration_techniques.driller_core,734
533
angr.knowledge_plugins.functions, 705
angr.exploration_techniques.explorer, 525
angr.knowledge_plugins.functions.function,
angr.exploration_techniques.lengthlimiter,
716
526
angr.knowledge_plugins.functions.function_manager,
angr.exploration_techniques.local_loop_seer,
714
538
angr.knowledge_plugins.functions.function_parser,
angr.exploration_techniques.loop_seer,
724
537
angr.knowledge_plugins.functions.soot_function,
angr.exploration_techniques.manual_mergepoint,724
526
angr.knowledge_plugins.indirect_jumps,
angr.exploration_techniques.memory_watcher,704
542
angr.knowledge_plugins.key_definitions,angr.exploration_techniques.oppologist,
736
537
angr.knowledge_plugins.key_definitions.atoms,
angr.exploration_techniques.slicecutor,
750
533
angr.knowledge_plugins.key_definitions.constants,
angr.exploration_techniques.spiller, 527
755
angr.exploration_techniques.spiller_db,
angr.knowledge_plugins.key_definitions.definition,
529
755
angr.exploration_techniques.stochastic,
angr.knowledge_plugins.key_definitions.environment,
539
758
angr.exploration_techniques.suggestions,angr.knowledge_plugins.key_definitions.heap_address,543
759
angr.exploration_techniques.symbion, 541
angr.knowledge_plugins.key_definitions.key_definition_
angr.exploration_techniques.tech_builder,759
540
angr.knowledge_plugins.key_definitions.live_definition
angr.exploration_techniques.threading,760
529
angr.knowledge_plugins.key_definitions.rd_model,
angr.exploration_techniques.timeout, 524769
angr.exploration_techniques.tracer, 530
angr.knowledge_plugins.key_definitions.tag,
Index

1339

angr

771
angr.state_plugins.gdb, 336
angr.knowledge_plugins.key_definitions.undefined,
angr.state_plugins.globals, 343
773
angr.state_plugins.heap, 363
angr.knowledge_plugins.key_definitions.unknown_size,
angr.state_plugins.heap.heap_base, 370
773
angr.state_plugins.heap.heap_brk, 371
angr.knowledge_plugins.key_definitions.uses, angr.state_plugins.heap.heap_freelist,
773
373
angr.knowledge_plugins.labels, 704
angr.state_plugins.heap.heap_libc, 374
angr.knowledge_plugins.patches, 673
angr.state_plugins.heap.heap_ptmalloc,
angr.knowledge_plugins.plugin, 675
375
angr.knowledge_plugins.propagations, 702
angr.state_plugins.heap.utils, 379
angr.knowledge_plugins.structured_code,angr.state_plugins.history, 333736
angr.state_plugins.inspect, 300
angr.knowledge_plugins.types, 701
angr.state_plugins.javavm_classloader,angr.knowledge_plugins.variables, 726
360
angr.knowledge_plugins.variables.variable_access,angr.state_plugins.jni_references, 361
727
angr.state_plugins.libc, 302
angr.knowledge_plugins.variables.variable_manager,
angr.state_plugins.light_registers, 332
727
angr.state_plugins.log, 328
angr.knowledge_plugins.xrefs, 775
angr.state_plugins.loop_data, 357
angr.knowledge_plugins.xrefs.xref, 777
angr.state_plugins.plugin, 298
angr.knowledge_plugins.xrefs.xref_manager,
angr.state_plugins.posix, 306
779
angr.state_plugins.preconstrainer, 347
angr.knowledge_plugins.xrefs.xref_types,
angr.state_plugins.scratch, 346
779
angr.state_plugins.sim_action, 595
angr.misc.plugins, 218
angr.state_plugins.sim_action_object, 597
angr.procedures, 603
angr.state_plugins.sim_event, 598
angr.procedures.definitions, 605
angr.state_plugins.solver, 320
angr.procedures.stubs.format_parser, 603
angr.state_plugins.symbolizer, 379
angr.project, 207
angr.state_plugins.trace_additions, 339
angr.protos, 784
angr.state_plugins.uc_manager, 345
angr.serializable, 784
angr.state_plugins.unicorn_engine, 349
angr.sim_manager, 498
angr.state_plugins.view, 385
angr.sim_options, 223
angr.storage, 382
angr.sim_procedure, 599
angr.storage.file, 390
angr.sim_state, 220
angr.storage.memory_mixins, 414
angr.sim_state_options, 223
angr.storage.memory_mixins.actions_mixin,
angr.sim_type, 638
449
angr.sim_variable, 633
angr.storage.memory_mixins.address_concretization_mixi
angr.simos, 1172
451
angr.simos.cgc, 1182
angr.storage.memory_mixins.bvv_conversion_mixin,
angr.simos.javavm, 1185
448
angr.simos.linux, 1181
angr.storage.memory_mixins.clouseau_mixin,
angr.simos.simos, 1179
453
angr.simos.userland, 1182
angr.storage.memory_mixins.conditional_store_mixin,
angr.simos.windows, 1184
453
angr.slicer, 1168
angr.storage.memory_mixins.convenient_mappings_mixin,
angr.state_hierarchy, 505454
angr.state_plugins, 226
angr.storage.memory_mixins.default_filler_mixin,
angr.state_plugins.callstack, 329
447
angr.state_plugins.cgc, 337
angr.storage.memory_mixins.dirty_addrs_mixin,
angr.state_plugins.concrete, 358
451
angr.state_plugins.debug_variables, 380
angr.storage.memory_mixins.hex_dumper_mixin,
angr.state_plugins.filesystem, 313
448
1340

Index

angr

angr.storage.memory_mixins.label_merger_mixin, angr.storage.memory_mixins.simple_interface_mixin,
453
449
angr.storage.memory_mixins.multi_value_merger_mixin,
angr.storage.memory_mixins.simplification_mixin,
459
454
angr.storage.memory_mixins.name_resolution_mixin,
angr.storage.memory_mixins.size_resolution_mixin,
447
450
angr.storage.memory_mixins.paged_memory,angr.storage.memory_mixins.slotted_memory,459
494
angr.storage.memory_mixins.paged_memory.page_backer_mixins,
angr.storage.memory_mixins.smart_find_mixin,
463
447
angr.storage.memory_mixins.paged_memory.paged_memory_mixin,
angr.storage.memory_mixins.symbolic_merger_mixin,
459
449
angr.storage.memory_mixins.paged_memory.pages, angr.storage.memory_mixins.top_merger_mixin,
465
458
angr.storage.memory_mixins.paged_memory.pages.cooperation,
angr.storage.memory_mixins.underconstrained_mixin,
475
449
angr.storage.memory_mixins.paged_memory.pages.history_tracking_mixin,
angr.storage.memory_mixins.unwrapper_mixin,
474
454
angr.storage.memory_mixins.paged_memory.pages.ispo_mixin,
angr.storage.memory_object, 409
475
angr.utils, 1189
angr.storage.memory_mixins.paged_memory.pages.list_page,angr.utils.algo, 1189
476
angr.utils.constants, 1189
angr.storage.memory_mixins.paged_memory.pages.multi_values,
angr.utils.cowdict, 1189
457
angr.utils.dynamic_dictlist, 1190
angr.storage.memory_mixins.paged_memory.pages.mv_list_page,angr.utils.enums_conv, 1190
455
angr.utils.env, 1190
angr.storage.memory_mixins.paged_memory.pages.permissions_mixin,
angr.utils.formatting, 1197
474
angr.utils.graph, 1191
angr.storage.memory_mixins.paged_memory.pages.refcount_mixin,
angr.utils.lazy_import, 1195
473
angr.utils.library, 1195
angr.storage.memory_mixins.paged_memory.pages.ultra_page,angr.utils.loader, 1195
477
angr.utils.mp, 1197
angr.storage.memory_mixins.paged_memory.privileged_mixin,
angr.utils.timing, 1197
465
angr.vaults, 784
angr.storage.memory_mixins.paged_memory.stack_allocation_mixin,
most_mergeable() (angr.state_hierarchy.StateHierarchy464
method), 506
angr.storage.memory_mixins.regioned_memory,most_mergeable() (angr.StateHierarchy method), 176479
mount()(angr.state_plugins.filesystem.SimFilesystem
angr.storage.memory_mixins.regioned_memory.abstract_address_descriptor,
method), 316
490
mount() (angr.state_plugins.SimFilesystem method), 282
angr.storage.memory_mixins.regioned_memory.abstract_merger_mixin,move() (angr.sim_manager.SimulationManager method),492
503
angr.storage.memory_mixins.regioned_memory.region_category_mixin,move() (angr.SimulationManager method), 171490
move_codelocs() (angr.analyses.reaching_definitions.rd_state.ReachingD
angr.storage.memory_mixins.regioned_memory.region_data,
method), 1094
487
move_codelocs() (angr.analyses.reaching_definitions.ReachingDefinition
angr.storage.memory_mixins.regioned_memory.region_meta_mixin,
method), 1063
490
mp_context() (in module angr.utils.mp), 1198
angr.storage.memory_mixins.regioned_memory.regioned_address_concretization_mixin,
Mul (angr.engines.light.ArithmeticExpression attribute),493
1031
angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin,
Mul(angr.engines.light.data.ArithmeticExpression
485
attribute), 1030
angr.storage.memory_mixins.regioned_memory.static_find_mixin,
mulpyplex() (angr.sim_manager.SimulationManager
490
method), 500
Index

1341

angr

mulpyplex() (angr.SimulationManager method), 168
NAME (angr.analyses.decompiler.optimization_passes.BasePointerSaveSimpl
MultiNode (class in angr.analyses.decompiler.structuring.structurer_nodes),attribute), 961
933
NAME (angr.analyses.decompiler.optimization_passes.CallStatementRewriter
MultipleBlocksException, 975
attribute), 972
MultiSimplifier(classin NAME (angr.analyses.decompiler.optimization_passes.CodeMotionOptimizatangr.analyses.decompiler.optimization_passes),
attribute), 969
963
NAME (angr.analyses.decompiler.optimization_passes.const_derefs.ConstantD
MultiSimplifier(classin
attribute), 974
angr.analyses.decompiler.optimization_passes.multi_simplifier),
NAME (angr.analyses.decompiler.optimization_passes.ConstantDereferencesS981
attribute), 966
MultiSimplifierAILEngine(classin NAME (angr.analyses.decompiler.optimization_passes.ConstPropOptReverter
angr.analyses.decompiler.optimization_passes.multi_simplifier),
attribute), 971
981
NAME (angr.analyses.decompiler.optimization_passes.CrossJumpReverter
MultiStatementExpressionAssignmentFinder
attribute), 968(class in angr.analyses.decompiler.region_simplifiers.expr_folding),
NAME (angr.analyses.decompiler.optimization_passes.DeadblockRemover
990
attribute), 971
MultiStmtExprMode(classin NAME (angr.analyses.decompiler.optimization_passes.div_simplifier.DivSimp
angr.analyses.decompiler.structuring.phoenix),
attribute), 978939
NAME (angr.analyses.decompiler.optimization_passes.DivSimplifier
MultiValuedMemory(classin
attribute), 963
angr.storage.memory_mixins), 446
NAME (angr.analyses.decompiler.optimization_passes.DuplicationReverter
MultiValueMergerMixin(classin
attribute), 972
angr.storage.memory_mixins), 419
NAME (angr.analyses.decompiler.optimization_passes.expr_op_swapper.Exp
MultiValueMergerMixin(classin
attribute), 984
angr.storage.memory_mixins.multi_value_merger_mixin),
NAME (angr.analyses.decompiler.optimization_passes.ExprOpSwapper
459
attribute), 961
MultiValues(classin NAME (angr.analyses.decompiler.optimization_passes.FlipBooleanCmp
angr.storage.memory_mixins.paged_memory.pages.multi_values),
attribute), 967
457
NAME (angr.analyses.decompiler.optimization_passes.InlinedStringTransform
MultiwriteAnnotation(classin
attribute), 971
angr.storage.memory_mixins.address_concretization_mixin),
NAME (angr.analyses.decompiler.optimization_passes.ite_expr_converter.ITE
451
attribute), 979
MVListPage (class in angr.storage.memory_mixins), 432 NAME (angr.analyses.decompiler.optimization_passes.ITEExprConverter
MVListPage (class in angr.storage.memory_mixins.paged_memory.pages),
attribute), 962
469
NAME (angr.analyses.decompiler.optimization_passes.ITERegionConverter
MVListPage (class in angr.storage.memory_mixins.paged_memory.pages.mv_list_page),
attribute), 962
455
NAME (angr.analyses.decompiler.optimization_passes.lowered_switch_simpli
MVListPagesMixin(classin
attribute), 981
angr.storage.memory_mixins), 426
NAME (angr.analyses.decompiler.optimization_passes.LoweredSwitchSimplifi
MVListPagesMixin(classin
attribute), 963
angr.storage.memory_mixins.paged_memory.paged_memory_mixin),
NAME (angr.analyses.decompiler.optimization_passes.mod_simplifier.ModSim
463
attribute), 982
MVListPagesWithLabelsMixin(classin NAME (angr.analyses.decompiler.optimization_passes.ModSimplifierangr.storage.memory_mixins), 427
attribute), 964
MVListPagesWithLabelsMixin(classin NAME (angr.analyses.decompiler.optimization_passes.multi_simplifier.MultiS
angr.storage.memory_mixins.paged_memory.paged_memory_mixin),
attribute), 981
463
NAME (angr.analyses.decompiler.optimization_passes.MultiSimplifier
attribute), 963
N
NAME (angr.analyses.decompiler.optimization_passes.optimization_pass.Bas
attribute), 975
n (angr.analyses.typehoon.typevars.AddN attribute), 1125
NAME
(angr.analyses.decompiler.optimization_passes.register_save_area_sim
n (angr.analyses.typehoon.typevars.SubN attribute), 1126
attribute), 984
NAME (angr.analyses.decompiler.optimization_passes.base_ptr_save_simplifier.BasePointerSaveSimplifier
NAME(angr.analyses.decompiler.optimization_passes.RegisterSaveAreaSimp
attribute), 978attribute), 966
1342

Index

angr

NAME (angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier.RetAddrSaveSimplifier
name (angr.analyses.reaching_definitions.Register propattribute), 984erty), 1051
NAME (angr.analyses.decompiler.optimization_passes.RetAddrSaveSimplifier
name (angr.analyses.reassembler.Procedure property),
attribute), 967
1148
NAME (angr.analyses.decompiler.optimization_passes.ReturnDeduplicatorname (angr.analyses.typehoon.typevars.TypeVariable atattribute), 968
tribute), 1124
NAME (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorHighname (angr.angrdb.models.DbKnowledgeBase attribute),
attribute), 965
920
NAME (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorLow
name (angr.angrdb.models.DbLabel attribute), 923
attribute), 965
name (angr.knowledge_plugins.cfg.cfg_node.CFGNode
NAME (angr.analyses.decompiler.optimization_passes.stack_canary_simplifier.StackCanarySimplifier
property), 698
attribute), 977
name (angr.knowledge_plugins.cfg.CFGNode property),
NAME (angr.analyses.decompiler.optimization_passes.StackCanarySimplifier
678
attribute), 961
name (angr.knowledge_plugins.Function property), 658
NAME (angr.analyses.decompiler.optimization_passes.SwitchDefaultCaseDuplicatorname (angr.knowledge_plugins.functions.Function propattribute), 970
erty), 706
NAME (angr.analyses.decompiler.optimization_passes.WinStackCanarySimplifier
name (angr.knowledge_plugins.functions.function.Function
attribute), 968
property), 718
NAME (angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier.X86GccGetPcSimplifier
name (angr.knowledge_plugins.key_definitions.atoms.Register
attribute), 985
property), 754
NAME (angr.analyses.decompiler.optimization_passes.X86GccGetPcSimplifier
name (angr.procedures.definitions.SimLibrary property),
attribute), 967
606
NAME (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationExprBasename (angr.sim_state_options.StateOption attribute), 223
attribute), 987
name (angr.sim_type.NamedTypeMixin property), 640
NAME (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationMultiStmtBasename (angr.sim_type.SimTypeRef property), 652
attribute), 986
name (angr.sim_type.TypeRef property), 639
NAME (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationStmtBasename (angr.sim_variable.SimVariable attribute), 634
attribute), 985
name_stop() (angr.state_plugins.unicorn_engine.STOP
name (angr.analyses.decompiler.structured_codegen.c.CFakeVariable static method), 353
attribute), 1011
named_errors (angr.analyses.Analysis attribute), 786
name (angr.analyses.decompiler.structured_codegen.c.CFunction
named_errors (angr.analyses.analysis.Analysis atattribute), 1004
tribute), 834
name (angr.analyses.decompiler.structured_codegen.c.CLabel
named_errors (angr.Analysis attribute), 174
attribute), 1010
NamedTypeMixin (class in angr.sim_type), 640
name (angr.analyses.decompiler.structured_codegen.c.CStructFieldNameDef
NameResolutionMixin(classin
attribute), 1016
angr.storage.memory_mixins), 420
name (angr.analyses.decompiler.structured_codegen.c.CVariable
NameResolutionMixin(classinproperty), 1011
angr.storage.memory_mixins.name_resolution_mixin),
NAME (angr.analyses.decompiler.structuring.dream.DreamStructurer 447
attribute), 933
narrowable (angr.analyses.decompiler.expression_narrower.ExprNarrowin
NAME (angr.analyses.decompiler.structuring.DreamStructurer
attribute), 958
attribute), 930
NarrowingInfoExtractor(classin
NAME (angr.analyses.decompiler.structuring.phoenix.PhoenixStructurerangr.analyses.decompiler.expression_narrower),
attribute), 939
958
NAME (angr.analyses.decompiler.structuring.PhoenixStructurer
native_arch (angr.simos.javavm.SimJavaVM property),
attribute), 931
1186
NAME (angr.analyses.decompiler.structuring.SAILRStructurernative_arch (angr.simos.SimJavaVM property), 1179
attribute), 932
NE (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.C
NAME (angr.analyses.decompiler.structuring.structurer_base.StructurerBase
attribute), 993
attribute), 938
NEVER (angr.analyses.decompiler.structuring.phoenix.MultiStmtExprModename (angr.analyses.reaching_definitions.function_handler.FunctionCallData
attribute), 939
attribute), 1085
new() (angr.analyses.cfg.cfg_job_base.BlockID staticname (angr.analyses.reaching_definitions.FunctionCallData
method), 893
attribute), 1070
new()(angr.analyses.cfg.cfg_job_base.FunctionKey
Index

1343

angr

static method), 893
next_chunk()(angr.state_plugins.heap.PTChunk(angr.analyses.typehoon.typeconsts.Pointermethod), 370
method), 1128
next_chunk() (angr.state_plugins.PTChunk method),
new_block_addr() (angr.analyses.decompiler.Clinic
290
method), 943
next_node() (angr.analyses.forward_analysis.SingleNodeGraphVisitor
new_block_addr() (angr.analyses.decompiler.clinic.Clinic
method), 838
method), 953
next_node() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor
new_block_addr() (angr.analyses.decompiler.optimization_passes.optimization_pass.OptimizationPass
method), 846
method), 976
next_node() (angr.analyses.forward_analysis.visitors.single_node_graph.
new_from_shared() (angr.storage.memory_mixins.paged_memory.pages.ultra_page.UltraPage
method), 848
class method), 477
next_node() (angr.analyses.forward_analysis.visitors.SingleNodeGraphVi
new_from_shared() (angr.storage.memory_mixins.paged_memory.pages.UltraPage
method), 843
class method), 472
next_variable_ident()
new_from_shared() (angr.storage.memory_mixins.UltraPage(angr.knowledge_plugins.variables.variable_manager.VariableMa
class method), 434
method), 728
new_label() (angr.analyses.reassembler.Label static NO_MAINBIN_BACKENDS
method), 1145
(angr.angrdb.serializers.loader.LoaderSerializer
new_label() (angr.analyses.reassembler.SymbolManager
attribute), 927
method), 1146
NO_MAINBIN_BACKENDS
new_model() (angr.knowledge_plugins.cfg.cfg_manager.CFGManager(angr.angrdb.serializers.LoaderSerializer
method), 696
attribute), 923
new_model() (angr.knowledge_plugins.cfg.CFGManager no_ret (angr.knowledge_plugins.cfg.cfg_node.CFGNodemethod), 688
attribute), 697
new_model() (angr.knowledge_plugins.CFGManager no_ret (angr.knowledge_plugins.cfg.CFGNode atmethod), 668
tribute), 678
NewFunctionHandler(classin NO_RET (angr.sim_procedure.SimProcedure attribute),
angr.analyses.find_objects_static), 1140
601
Next (angr.analyses.loop_analysis.VariableTypes at- NO_RET (angr.SimProcedure attribute), 149
tribute), 1131
NoConcreteDispatch, 857
next (angr.engines.pcode.lifter.IRSB attribute), 566
NodalAnnotation(classinnext (angr.state_plugins.unicorn_engine.MEM_PATCH
angr.analyses.data_dep.data_dependency_analysis),
attribute), 350
1159
next_addr (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.Case
node (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier
attribute), 980
attribute), 993
next_arg() (angr.calling_conventions.SimCC method), node (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier
620
attribute), 994
next_arg()(angr.calling_conventions.SimCCARM node (angr.analyses.decompiler.structuring.structurer_nodes.CodeNodemethod), 626
attribute), 934
next_arg()(angr.calling_conventions.SimCCCdecl node (angr.analyses.decompiler.structuring.structurer_nodes.ConditionNod
method), 622
attribute), 935
next_arg() (angr.calling_conventions.SimCCMicrosoftAMD64
node (angr.analyses.forward_analysis.SingleNodeGraphVisitor
method), 624
attribute), 838
next_arg()(angr.calling_conventions.SimCCO32 node (angr.analyses.forward_analysis.visitors.single_node_graph.SingleNod
method), 628
attribute), 848
next_arg() (angr.calling_conventions.SimCCSystemVAMD64
node (angr.analyses.forward_analysis.visitors.SingleNodeGraphVisitor
method), 625
attribute), 843
next_arg() (angr.calling_conventions.SimCCUsercall node_addr (angr.analyses.decompiler.region_simplifiers.expr_folding.Cond
method), 622
attribute), 990
next_arg() (angr.SimCC method), 182
node_addr (angr.analyses.decompiler.region_simplifiers.expr_folding.Cond
next_chunk() (angr.PTChunk method), 205
attribute), 990
next_chunk() (angr.state_plugins.heap.heap_freelist.Chunknode_iterations (angr.knowledge_plugins.propagations.PropagationMod
method), 373
attribute), 702
next_chunk() (angr.state_plugins.heap.heap_ptmalloc.PTChunknode_mapping (angr.analyses.typehoon.simple_solver.Sketch
method), 376
attribute), 1118

new()

1344

Index

angr

node_observe() (angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
normalize()(angr.analyses.cfg.cfg_base.CFGBasemethod), 1077
method), 883
node_observe() (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
normalize() (angr.analyses.cfg.cfg_fast_soot.CFGFastSoot
method), 1056
method), 914
node_observe() (angr.analyses.ReachingDefinitionsAnalysis
normalize() (angr.analyses.cfg.CFGBase method), 873
method), 820
normalize() (angr.analyses.cfg.CFGFastSoot method),node_position() (angr.analyses.decompiler.structuring.structurer_nodes.SequenceNode869
method), 934
normalize() (angr.analyses.CFGFastSoot method), 801
node_returned (angr.analyses.forward_analysis.SingleNodeGraphVisitor
normalize()(angr.knowledge_plugins.Function
attribute), 838
method), 663
node_returned (angr.analyses.forward_analysis.visitors.single_node_graph.SingleNodeGraphVisitor
normalize() (angr.knowledge_plugins.functions.Function
attribute), 848
method), 711
node_returned (angr.analyses.forward_analysis.visitors.SingleNodeGraphVisitor
normalize() (angr.knowledge_plugins.functions.function.Function
attribute), 843
method), 723
node_type (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.Case
normalize() (angr.knowledge_plugins.functions.soot_function.SootFunctio
attribute), 980
method), 725
NodeAddressFinder(classin normalize() (angr.knowledge_plugins.key_definitions.definition.Definition
angr.analyses.decompiler.region_simplifiers.node_address_finder),method), 756
992
normalize_cpp_function_name()(inmoduleNodeFoundNotification, 978angr.sim_type), 653
nodes (angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceToSink
normalized(angr.analyses.cfg.cfg_base.CFGBase
property), 1101
property), 882
nodes (angr.analyses.cfg_slice_to_sink.CFGSliceToSink normalized (angr.analyses.cfg.CFGBase property), 872
property), 1099
normalized (angr.knowledge_plugins.cfg.cfg_model.CFGModelnodes (angr.analyses.decompiler.structuring.structurer_nodes.MultiNodeattribute), 689
attribute), 933
normalized (angr.knowledge_plugins.cfg.CFGModel atnodes (angr.analyses.decompiler.structuring.structurer_nodes.SequenceNodetribute), 682
attribute), 934
normalized (angr.knowledge_plugins.Function atnodes (angr.knowledge_plugins.Function property), 660
tribute), 658
nodes (angr.knowledge_plugins.functions.Function prop- normalized (angr.knowledge_plugins.functions.Functionerty), 707
attribute), 705
nodes (angr.knowledge_plugins.functions.function.Functionnormalized (angr.knowledge_plugins.functions.function.Function
property), 719
attribute), 717
nodes() (angr.analyses.cfg.cfg_base.CFGBase method), normalized (angr.knowledge_plugins.functions.soot_function.SootFunction
883
attribute), 725
nodes() (angr.analyses.cfg.CFGBase method), 872
NormalizedBlock (class in angr.analyses.bindiff ), 851
nodes() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor
NormalizedFunction (class in angr.analyses.bindiff ),method), 846
851
nodes() (angr.analyses.reaching_definitions.dep_graph.DepGraph
NotAJumpTableNotification, 898
method), 1080
NotEqual(angr.analyses.loop_analysis.Condition
nodes() (angr.knowledge_plugins.cfg.cfg_model.CFGModel
attribute), 1132
method), 691
NotMemoryview(classinnodes()(angr.knowledge_plugins.cfg.CFGModelangr.storage.memory_mixins.paged_memory.page_backer_mixins
method), 684
463
nodes_iter() (angr.analyses.cfg.cfg_base.CFGBase NotypeLabel (class in angr.analyses.reassembler), 1146
method), 883
NULL_TERMINATE (angr.knowledge_plugins.key_definitions.DerefSize
nodes_iter() (angr.analyses.cfg.CFGBase method),attribute), 748
872
NULL_TERMINATE (angr.knowledge_plugins.key_definitions.live_definitions.
nodes_iter() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor
attribute), 760
method), 846
num_arguments(angr.knowledge_plugins.Function
NONE (angr.simos.windows.SecurityCookieInit attribute),
property), 660
1184
num_arguments (angr.knowledge_plugins.functions.Function
NORMAL (angr.analyses.cfg.cfg_fast.CFGJobType atproperty), 708
tribute), 888
num_arguments (angr.knowledge_plugins.functions.function.Function
Index

1345

angr

property), 720

offset (angr.analyses.propagator.vex_vars.VEXReg attribute), 1035
O
offset (angr.analyses.reaching_definitions.Definition
property), 1053
O (in module angr.analyses.decompiler.decompilation_options),
offset(angr.analyses.reassembler.Label property),955
1145
O_ACCMODE (angr.storage.file.Flags attribute), 391
offset (angr.analyses.stack_pointer_tracker.OffsetVal
O_APPEND (angr.storage.file.Flags attribute), 391
property), 1103
O_ASYNC (angr.storage.file.Flags attribute), 391
offset(angr.analyses.stack_pointer_tracker.Register
atO_CLOEXEC (angr.storage.file.Flags attribute), 391
tribute),1103
O_CREAT (angr.storage.file.Flags attribute), 391
offset (angr.analyses.typehoon.typevars.HasField atO_DIRECT (angr.storage.file.Flags attribute), 391
tribute), 1126
O_DIRECTORY (angr.storage.file.Flags attribute), 391
offset (angr.engines.light.data.RegisterOffset attribute),
O_DSYNC (angr.storage.file.Flags attribute), 391
1031
O_EXCL (angr.storage.file.Flags attribute), 391
offset (angr.engines.light.RegisterOffset attribute),
O_LARGEFILE (angr.storage.file.Flags attribute), 391
1032
O_NDELAY (angr.storage.file.Flags attribute), 391
offset (angr.knowledge_plugins.Function property),O_NOATIME (angr.storage.file.Flags attribute), 391
661
O_NOCTTY (angr.storage.file.Flags attribute), 391
offset(angr.knowledge_plugins.functions.Function
O_NOFOLLOW (angr.storage.file.Flags attribute), 391
property), 708
O_NONBLOCK (angr.storage.file.Flags attribute), 391
offset (angr.knowledge_plugins.functions.function.Function
O_PATH (angr.storage.file.Flags attribute), 391
property), 720
O_RDONLY (angr.storage.file.Flags attribute), 390
offset (angr.knowledge_plugins.key_definitions.Definition
O_RDWR (angr.storage.file.Flags attribute), 390
property), 750
O_SYNC (angr.storage.file.Flags attribute), 391
offset (angr.knowledge_plugins.key_definitions.definition.Definition
O_TMPFILE (angr.storage.file.Flags attribute), 391
property), 758
O_TRUNC (angr.storage.file.Flags attribute), 391
offset (angr.knowledge_plugins.variables.variable_access.VariableAccess
O_WRONLY (angr.storage.file.Flags attribute), 390
attribute), 727
obj (angr.analyses.decompiler.structured_codegen.base.PositionMappingElement
Offset (angr.knowledge_plugins.xrefs.xref_types.XRefTypeattribute), 1001
attribute), 779
obj (angr.analyses.decompiler.structured_codegen.PositionMappingElement
Offset (angr.knowledge_plugins.xrefs.XRefType atattribute), 998
tribute), 777
obj (angr.analyses.disassembly.IROp attribute), 1142
offset (angr.sim_variable.SimStackVariable attribute),obj (angr.keyed_region.StoredObject attribute), 781
637
obj (angr.utils.graph.ContainerNode property), 1192
obj_bit_size()(inmodule offset (angr.state_plugins.unicorn_engine.RegisterValue
attribute), 350
angr.storage.memory_object), 409
obj_id (angr.keyed_region.StoredObject property), 781 offset_after() (angr.analyses.stack_pointer_tracker.StackPointerTracker
method), 1105
object (angr.storage.memory_object.SimMemoryObject
offset_after()(angr.analyses.StackPointerTracker
attribute), 410
method), 823
object (angr.storage.SimMemoryObject attribute), 384
ObjectLabel (class in angr.analyses.reassembler), 1146 offset_after_block()(angr.analyses.stack_pointer_tracker.StackPointerTracker
ObservationPointType(classinmethod), 1105
angr.analyses.reaching_definitions), 1048
ObservationPointType(classin offset_after_block()(angr.analyses.StackPointerTracker method),angr.knowledge_plugins.key_definitions.constants),
823
755
offset_before()(angr.analyses.stack_pointer_tracker.StackPointerTrackobserved_results (angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
method),1105
property), 1077
offset_before() (angr.analyses.StackPointerTracker
observed_results (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
method), 823
property), 1055
offset_before_block()observed_results (angr.analyses.ReachingDefinitionsAnalysis(angr.analyses.stack_pointer_tracker.StackPointerTracker
property), 819
offset (angr.analyses.decompiler.structured_codegen.c.CStructFieldmethod), 1106
offset_before_block()
attribute), 1010
1346

Index

angr

(angr.analyses.StackPointerTracker method), op (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.C
823
attribute), 993
offsets (angr.sim_type.SimStruct property), 649
op (angr.analyses.decompiler.structured_codegen.c.CBinaryOp
offsets_for() (angr.analyses.stack_pointer_tracker.StackPointerTracker
attribute), 1013
method), 1106
op (angr.analyses.decompiler.structured_codegen.c.CUnaryOp
offsets_for()(angr.analyses.StackPointerTracker
attribute), 1012
method), 823
op (angr.engines.light.ArithmeticExpression attribute),
OffsetVal (class in angr.analyses.stack_pointer_tracker),
1031
1103
op (angr.engines.light.data.ArithmeticExpression atoffsIP (angr.engines.pcode.lifter.IRSB property), 566
tribute), 1030
oident (angr.knowledge_plugins.key_definitions.atoms.VirtualVariable
op (angr.state_plugins.sim_action_object.SimActionObject
attribute), 754
property), 597
omit_header (angr.analyses.decompiler.structured_codegen.c.CFunction
op (angr.state_plugins.SimActionObject property), 265
attribute), 1004
OP_AFTER (angr.analyses.reaching_definitions.ObservationPointType
on_worker_exit() (angr.distributed.Server method),attribute), 1049
1205
OP_AFTER (angr.knowledge_plugins.key_definitions.constants.ObservationP
on_worker_exit()(angr.distributed.server.Server
attribute), 755
method), 1206
OP_BEFORE (angr.analyses.reaching_definitions.ObservationPointType
on_worker_exit() (angr.Server method), 206
attribute), 1048
one_active (angr.sim_manager.SimulationManager at- OP_BEFORE (angr.knowledge_plugins.key_definitions.constants.Observation
tribute), 499
attribute), 755
one_active (angr.SimulationManager attribute), 168
op_precedence (angr.analyses.decompiler.structured_codegen.c.CBinaryO
one_deadended (angr.sim_manager.SimulationManager
property), 1013
attribute), 500
op_str (angr.block.CapstoneInsn property), 216
one_deadended (angr.SimulationManager attribute), op_str (angr.block.DisassemblerInsn property), 216
168
op_str (angr.engines.pcode.lifter.PcodeDisassemblerInsn
one_found (angr.sim_manager.SimulationManager atproperty), 563
tribute), 500
OpBehavior (class in angr.engines.pcode.behavior), 573
one_found (angr.SimulationManager attribute), 168
OpBehaviorBoolAnd(classin
one_label() (angr.analyses.typehoon.typevars.DerivedTypeVariable angr.engines.pcode.behavior), 587
method), 1124
OpBehaviorBoolNegate(classin
one_pruned (angr.sim_manager.SimulationManager atangr.engines.pcode.behavior), 586
tribute), 500
OpBehaviorBoolOr(classin
one_pruned (angr.SimulationManager attribute), 168
angr.engines.pcode.behavior), 587
one_result (angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
OpBehaviorBoolXor(classinproperty), 1077
angr.engines.pcode.behavior), 586
one_result (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
OpBehaviorCopy(classinproperty), 1056
angr.engines.pcode.behavior), 574
one_result (angr.analyses.ReachingDefinitionsAnalysis OpBehaviorEqual(classinproperty), 819
angr.engines.pcode.behavior), 575
one_stashed (angr.sim_manager.SimulationManager OpBehaviorFloatAbs(classin
attribute), 500
angr.engines.pcode.behavior), 590
one_stashed (angr.SimulationManager attribute), 168
OpBehaviorFloatAdd(classin
one_type()(angr.sim_state_options.StateOption
angr.engines.pcode.behavior), 589
method), 223
OpBehaviorFloatCeil(classin
one_unconstrained (angr.sim_manager.SimulationManager
angr.engines.pcode.behavior), 591
attribute), 500
OpBehaviorFloatDiv(classin
one_unconstrained (angr.SimulationManager atangr.engines.pcode.behavior), 589
tribute), 168
OpBehaviorFloatEqual(classin
one_unsat (angr.sim_manager.SimulationManager atangr.engines.pcode.behavior), 587
tribute), 500
OpBehaviorFloatFloat2Float(classin
one_unsat (angr.SimulationManager attribute), 168
angr.engines.pcode.behavior), 590
one_value() (angr.storage.memory_mixins.paged_memory.pages.multi_values.MultiValues
OpBehaviorFloatFloor(classinmethod), 457
angr.engines.pcode.behavior), 591
Index

1347

angr

OpBehaviorFloatInt2Float(classangr.engines.pcode.behavior), 590
OpBehaviorFloatLess(classangr.engines.pcode.behavior), 588
OpBehaviorFloatLessEqual(classangr.engines.pcode.behavior), 588
OpBehaviorFloatMult(classangr.engines.pcode.behavior), 589
OpBehaviorFloatNan(classangr.engines.pcode.behavior), 588
OpBehaviorFloatNeg(classangr.engines.pcode.behavior), 589
OpBehaviorFloatNotEqual(classangr.engines.pcode.behavior), 588
OpBehaviorFloatRound(classangr.engines.pcode.behavior), 591
OpBehaviorFloatSqrt(classangr.engines.pcode.behavior), 590
OpBehaviorFloatSub(classangr.engines.pcode.behavior), 589
OpBehaviorFloatTrunc(classangr.engines.pcode.behavior), 590
OpBehaviorInt2Comp(classangr.engines.pcode.behavior), 580
OpBehaviorIntAdd(classangr.engines.pcode.behavior), 578
OpBehaviorIntAnd(classangr.engines.pcode.behavior), 581
OpBehaviorIntCarry(classangr.engines.pcode.behavior), 579
OpBehaviorIntDiv(classangr.engines.pcode.behavior), 584
OpBehaviorIntLeft(classangr.engines.pcode.behavior), 582
OpBehaviorIntLess(classangr.engines.pcode.behavior), 576
OpBehaviorIntLessEqual(classangr.engines.pcode.behavior), 577
OpBehaviorIntMult(classangr.engines.pcode.behavior), 584
OpBehaviorIntNegate(classangr.engines.pcode.behavior), 581
OpBehaviorIntOr(classangr.engines.pcode.behavior), 582
OpBehaviorIntRem(classangr.engines.pcode.behavior), 585
OpBehaviorIntRight(classangr.engines.pcode.behavior), 583
OpBehaviorIntSborrow(classangr.engines.pcode.behavior), 580
OpBehaviorIntScarry(classangr.engines.pcode.behavior), 579
OpBehaviorIntSdiv(classangr.engines.pcode.behavior), 584
1348

in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in
in

OpBehaviorIntSext(classinangr.engines.pcode.behavior), 578
OpBehaviorIntSless(classinangr.engines.pcode.behavior), 576
OpBehaviorIntSlessEqual(classinangr.engines.pcode.behavior), 576
OpBehaviorIntSrem(classinangr.engines.pcode.behavior), 585
OpBehaviorIntSright(classinangr.engines.pcode.behavior), 583
OpBehaviorIntSub(classinangr.engines.pcode.behavior), 578
OpBehaviorIntXor(classinangr.engines.pcode.behavior), 581
OpBehaviorIntZext(classinangr.engines.pcode.behavior), 577
OpBehaviorLzcount(classinangr.engines.pcode.behavior), 592
OpBehaviorNotEqual(classinangr.engines.pcode.behavior), 575
OpBehaviorPiece(classinangr.engines.pcode.behavior), 591
OpBehaviorPopcount(classinangr.engines.pcode.behavior), 592
OpBehaviorSubpiece(classinangr.engines.pcode.behavior), 591
opcode(angr.engines.pcode.behavior.OpBehavior
attribute), 573
opcode (angr.engines.pcode.behavior.OpBehaviorBoolAnd
attribute), 587
opcode (angr.engines.pcode.behavior.OpBehaviorBoolNegate
attribute), 586
opcode (angr.engines.pcode.behavior.OpBehaviorBoolOr
attribute), 587
opcode (angr.engines.pcode.behavior.OpBehaviorBoolXor
attribute), 587
opcode (angr.engines.pcode.behavior.OpBehaviorCopy
attribute), 575
opcode (angr.engines.pcode.behavior.OpBehaviorEqual
attribute), 575
opcode (angr.engines.pcode.behavior.OpBehaviorFloatAbs
attribute), 590
opcode (angr.engines.pcode.behavior.OpBehaviorFloatAdd
attribute), 589
opcode (angr.engines.pcode.behavior.OpBehaviorFloatCeil
attribute), 591
opcode (angr.engines.pcode.behavior.OpBehaviorFloatDiv
attribute), 589
opcode (angr.engines.pcode.behavior.OpBehaviorFloatEqual
attribute), 588
opcode (angr.engines.pcode.behavior.OpBehaviorFloatFloat2Float
attribute), 590
opcode (angr.engines.pcode.behavior.OpBehaviorFloatFloor
attribute), 591
Index

angr

opcode (angr.engines.pcode.behavior.OpBehaviorFloatInt2Float
opcode (angr.engines.pcode.behavior.OpBehaviorIntSext
attribute), 590
attribute), 578
opcode (angr.engines.pcode.behavior.OpBehaviorFloatLessopcode (angr.engines.pcode.behavior.OpBehaviorIntSlessattribute), 588
attribute), 576
opcode (angr.engines.pcode.behavior.OpBehaviorFloatLessEqual
opcode (angr.engines.pcode.behavior.OpBehaviorIntSlessEqual
attribute), 588
attribute), 576
opcode (angr.engines.pcode.behavior.OpBehaviorFloatMultopcode (angr.engines.pcode.behavior.OpBehaviorIntSrem
attribute), 589
attribute), 586
opcode (angr.engines.pcode.behavior.OpBehaviorFloatNanopcode (angr.engines.pcode.behavior.OpBehaviorIntSrightattribute), 588
attribute), 584
opcode (angr.engines.pcode.behavior.OpBehaviorFloatNegopcode (angr.engines.pcode.behavior.OpBehaviorIntSub
attribute), 589
attribute), 579
opcode (angr.engines.pcode.behavior.OpBehaviorFloatNotEqual
opcode (angr.engines.pcode.behavior.OpBehaviorIntXor
attribute), 588
attribute), 581
opcode (angr.engines.pcode.behavior.OpBehaviorFloatRound
opcode (angr.engines.pcode.behavior.OpBehaviorIntZext
attribute), 591
attribute), 578
opcode (angr.engines.pcode.behavior.OpBehaviorFloatSqrtopcode (angr.engines.pcode.behavior.OpBehaviorLzcountattribute), 590
attribute), 593
opcode (angr.engines.pcode.behavior.OpBehaviorFloatSub opcode (angr.engines.pcode.behavior.OpBehaviorNotEqual
attribute), 589
attribute), 575
opcode (angr.engines.pcode.behavior.OpBehaviorFloatTrunc
opcode (angr.engines.pcode.behavior.OpBehaviorPiece
attribute), 590
attribute), 591
opcode (angr.engines.pcode.behavior.OpBehaviorInt2Compopcode (angr.engines.pcode.behavior.OpBehaviorPopcountattribute), 581
attribute), 592
opcode (angr.engines.pcode.behavior.OpBehaviorIntAdd opcode (angr.engines.pcode.behavior.OpBehaviorSubpiece
attribute), 578
attribute), 592
opcode (angr.engines.pcode.behavior.OpBehaviorIntAnd Opcode (class in angr.analyses.disassembly), 1143
attribute), 582
OpDescriptor(classin
opcode (angr.engines.pcode.behavior.OpBehaviorIntCarryangr.analyses.decompiler.optimization_passes.expr_op_swapper)
attribute), 579
983
opcode (angr.engines.pcode.behavior.OpBehaviorIntDiv open()(angr.state_plugins.posix.SimSystemPosix
attribute), 584
method), 311
opcode (angr.engines.pcode.behavior.OpBehaviorIntLeft open() (angr.state_plugins.SimSystemPosix method),attribute), 583
240
opcode (angr.engines.pcode.behavior.OpBehaviorIntLess open_db() (angr.angrdb.AngrDB static method), 916
attribute), 577
open_db() (angr.angrdb.db.AngrDB static method), 918
opcode (angr.engines.pcode.behavior.OpBehaviorIntLessEqual
open_socket() (angr.state_plugins.posix.SimSystemPosix
attribute), 577
method), 311
opcode (angr.engines.pcode.behavior.OpBehaviorIntMult open_socket()(angr.state_plugins.SimSystemPosix
attribute), 584
method), 240
opcode (angr.engines.pcode.behavior.OpBehaviorIntNegateopening_symbol (angr.analyses.decompiler.structured_codegen.c.CClosin
attribute), 581
attribute), 1016
opcode (angr.engines.pcode.behavior.OpBehaviorIntOr operand (angr.analyses.decompiler.structured_codegen.c.CUnaryOp
attribute), 582
attribute), 1012
opcode (angr.engines.pcode.behavior.OpBehaviorIntRem Operand (class in angr.analyses.disassembly), 1143
attribute), 585
Operand (class in angr.analyses.reassembler), 1146
opcode (angr.engines.pcode.behavior.OpBehaviorIntRight operand_str(angr.analyses.reassembler.DataLabel
attribute), 583
property), 1145
opcode (angr.engines.pcode.behavior.OpBehaviorIntSborrow
operand_str (angr.analyses.reassembler.FunctionLabel
attribute), 580
property), 1146
opcode (angr.engines.pcode.behavior.OpBehaviorIntScarryoperand_str (angr.analyses.reassembler.Label propattribute), 580
erty), 1145
opcode (angr.engines.pcode.behavior.OpBehaviorIntSdiv operand_str (angr.analyses.reassembler.NotypeLabel
attribute), 585
property), 1146
Index

1349

angr

operand_str (angr.analyses.reassembler.ObjectLabel options_to_params()(angr.analyses.Decompiler
property), 1146
static method), 825
OperandPiece (class in angr.analyses.disassembly), options_to_params()
1143(angr.analyses.decompiler.Decompiler static
operands (angr.engines.light.ArithmeticExpression atmethod), 945
tribute), 1031
options_to_params()
operands (angr.engines.light.data.ArithmeticExpression(angr.analyses.decompiler.decompiler.Decompiler
attribute), 1030
static method), 957
OPERATE (angr.state_plugins.sim_action.SimActionData Or (angr.engines.light.ArithmeticExpression attribute),
attribute), 596
1031
OPERATE (angr.state_plugins.SimActionData attribute), Or (angr.engines.light.data.ArithmeticExpression at264
tribute), 1030
operations (angr.engines.pcode.lifter.IRSB property), Or1 (angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransform
567
attribute), 899
operations (angr.knowledge_plugins.Function prop- original_node (angr.analyses.decompiler.optimization_passes.lowered_swerty), 660
attribute), 980
operations (angr.knowledge_plugins.functions.Function other_input_defns (angr.analyses.reaching_definitions.dep_graph.Functproperty), 707
attribute), 1079
operations (angr.knowledge_plugins.functions.function.Function
other_output_defns (angr.analyses.reaching_definitions.dep_graph.Func
property), 719
attribute), 1079
Oppologist (class in angr.exploration_techniques), 515 other_types (angr.procedures.stubs.format_parser.FormatParser
Oppologist (class in angr.exploration_techniques.oppologist),
attribute), 604
537
other_uses (angr.analyses.reaching_definitions.LiveDefinitions
opt_level (angr.engines.pcode.lifter.Lifter attribute),
attribute), 1041
568
other_uses (angr.knowledge_plugins.key_definitions.live_definitions.LiveD
opt_level(angr.engines.pcode.lifter.PcodeLifter
attribute), 762
attribute), 570
other_uses (angr.knowledge_plugins.key_definitions.LiveDefinitions
OptimizationPass(classin
attribute), 740
angr.analyses.decompiler.optimization_passes.optimization_pass),others (angr.analyses.reaching_definitions.LiveDefinitions
976
attribute), 1041
OptimizationPassStage(classin others (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefini
angr.analyses.decompiler.optimization_passes),
attribute), 762
960
others (angr.knowledge_plugins.key_definitions.LiveDefinitions
OptimizationPassStage(classin
attribute), 740
angr.analyses.decompiler.optimization_passes.optimization_pass),
out_graph (angr.analyses.decompiler.optimization_passes.base_ptr_save_s975
attribute), 978
optimize() (angr.analyses.binary_optimizer.BinaryOptimizer
out_graph (angr.analyses.decompiler.optimization_passes.const_derefs.Co
method), 1155
attribute), 975
optimize() (angr.analyses.BinaryOptimizer method), out_graph (angr.analyses.decompiler.optimization_passes.div_simplifier.D
814
attribute), 978
optimize() (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationExprBase
out_graph (angr.analyses.decompiler.optimization_passes.ite_expr_conver
method), 987
attribute), 979
optimize() (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationMultiStmtBase
out_graph (angr.analyses.decompiler.optimization_passes.lowered_switch_method), 986
attribute), 981
optimize() (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationStmtBase
out_graph (angr.analyses.decompiler.optimization_passes.mod_simplifier.M
method), 986
attribute), 982
OPTIONS (angr.analyses.cfg.cfg_arch_options.CFGArchOptions
out_graph (angr.analyses.decompiler.optimization_passes.multi_simplifier
attribute), 893
attribute), 981
OPTIONS (angr.analyses.cfg.CFGArchOptions attribute), out_graph (angr.analyses.decompiler.optimization_passes.register_save_a870
attribute), 984
OPTIONS (angr.analyses.CFGArchOptions attribute), 799 out_graph (angr.analyses.decompiler.optimization_passes.ret_addr_save_s
OPTIONS(angr.sim_state_options.SimStateOptions
attribute), 985
attribute), 223
out_graph (angr.analyses.decompiler.optimization_passes.stack_canary_si
options (angr.slicer.SimLightState attribute), 1168
attribute), 978
1350

Index

angr

out_graph (angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier.X86GccGetPcSimplifier
PAGE_TYPE (angr.storage.memory_mixins.paged_memory.paged_memory_m
attribute), 985
attribute), 462
OutdatedDefinitionWalker(classin PAGE_TYPE (angr.storage.memory_mixins.paged_memory.paged_memory_m
angr.analyses.propagator.outdated_definition_walker),
attribute), 463
1037
PAGE_TYPE (angr.storage.memory_mixins.paged_memory.paged_memory_m
OutdatedError, 874
attribute), 459
OuterWalker(classin PAGE_TYPE (angr.storage.memory_mixins.paged_memory.paged_memory_m
angr.analyses.decompiler.optimization_passes.expr_op_swapper),attribute), 463
983
PAGE_TYPE (angr.storage.memory_mixins.PagedMemoryMixin
output()(angr.analyses.cfg.cfg_base.CFGBaseattribute), 424
method), 883
PAGE_TYPE (angr.storage.memory_mixins.UltraPagesMixin
output() (angr.analyses.cfg.cfg_fast.CFGFast method),attribute), 426
892
PageBase (class in angr.storage.memory_mixins), 430
output() (angr.analyses.cfg.CFGBase method), 872
PageBase (class in angr.storage.memory_mixins.paged_memory.pages),
output() (angr.analyses.cfg.CFGFast method), 861
468
output() (angr.analyses.CFGFast method), 792
PagedMemoryMixin(classin
OVERFLOW_FP_RETURN_VAL
angr.storage.memory_mixins), 423(angr.calling_conventions.SimCCSystemVAMD64 PagedMemoryMixin(classin
attribute), 625
angr.storage.memory_mixins.paged_memory.paged_memory_mix
OVERFLOW_RETURN_VAL
459(angr.calling_conventions.SimCC attribute), PagedMemoryMultiValueMixin(classin618
angr.storage.memory_mixins), 428
OVERFLOW_RETURN_VAL
ParameterTag(classin(angr.calling_conventions.SimCCARM
atangr.knowledge_plugins.key_definitions.tag),tribute), 626
772
OVERFLOW_RETURN_VAL
parent (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifi(angr.calling_conventions.SimCCCdecl
atattribute), 993
tribute), 622
parent (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifi
OVERFLOW_RETURN_VAL
attribute), 994(angr.calling_conventions.SimCCMicrosoftAMD64
parentop (angr.analyses.disassembly.OperandPiece atattribute), 623
tribute), 1143
OVERFLOW_RETURN_VAL
parents(angr.state_plugins.history.SimStateHistory(angr.calling_conventions.SimCCO32
atproperty), 335
tribute), 628
parents (angr.state_plugins.SimStateHistory property),
OVERFLOW_RETURN_VAL
254(angr.calling_conventions.SimCCPowerPCparents() (angr.storage.memory_mixins.HistoryTrackingMixin
attribute), 630
method), 430
OVERFLOW_RETURN_VAL
parents() (angr.storage.memory_mixins.paged_memory.pages.history_tra(angr.calling_conventions.SimCCSystemVAMD64
method), 475
attribute), 625
parents() (angr.storage.memory_mixins.paged_memory.pages.HistoryTra
OVERFLOW_RETURN_VAL (angr.SimCC attribute), 181
method), 467
overlap() (angr.knowledge_plugins.patches.PatchManagerparse() (angr.serializable.Serializable class method),static method), 674
784
overlap()(angr.knowledge_plugins.PatchManager parse_block() (angr.analyses.Disassembly method),static method), 670
815
parse_block() (angr.analyses.disassembly.DisassemblyP
method), 1144
parse_cpp_file()(in module angr.sim_type), 653
packed (angr.sim_type.SimStruct property), 649
parse_defns()(inmoduleangr.sim_type), 652
pad_chr (angr.procedures.stubs.format_parser.FormatSpecifierparse_file()(inmoduleangr.sim_type),652
attribute), 604
parse_from_cmessage()(angr.Blockclass
method),PAGE_TYPE (angr.storage.memory_mixins.ListPagesMixin
166
attribute), 426
parse_from_cmessage() (angr.block.Block class
PAGE_TYPE (angr.storage.memory_mixins.MVListPagesMixin
method), 217
attribute), 427
Index

1351

angr

parse_from_cmessage()parse_from_cmessage()(angr.knowledge_plugins.cfg.cfg_model.CFGModel(angr.sim_variable.SimRegisterVariable classclass method), 689
method), 636
parse_from_cmessage()parse_from_cmessage()(angr.knowledge_plugins.cfg.cfg_node.CFGNode(angr.sim_variable.SimStackVariable
class
class method), 698
method), 637
parse_from_cmessage()parse_from_cmessage()(angr.knowledge_plugins.cfg.CFGModel(angr.sim_variable.SimTemporaryVariableclass method), 682
class method), 635
parse_from_cmessage()parse_from_cmsg() (angr.knowledge_plugins.functions.function_parser.F(angr.knowledge_plugins.cfg.CFGNode classstatic method), 724
method), 679
parse_signature() (in module angr.sim_type), 652
parse_from_cmessage()parse_stack_pointer()(inmodule(angr.knowledge_plugins.cfg.memory_data.MemoryData angr.analyses.variable_recovery.variable_recovery_base),class method), 696
1106
parse_from_cmessage()parse_type() (in module angr.sim_type), 653(angr.knowledge_plugins.cfg.MemoryData
parse_type_with_name() (in module angr.sim_type),class method), 678
653
parse_from_cmessage()parse_types() (in module angr.sim_type), 652(angr.knowledge_plugins.Function
class parse_variable_addr()
method), 660(angr.analyses.decompiler.Clinic
method),parse_from_cmessage()943(angr.knowledge_plugins.functions.Functionparse_variable_addr()
class method), 708(angr.analyses.decompiler.clinic.Clinic
parse_from_cmessage()method), 953(angr.knowledge_plugins.functions.function.Functionparsedcprotos2py() (in module angr.utils.library),class method), 719
1196
parse_from_cmessage()
ParsedInstruction(classin(angr.knowledge_plugins.variables.variable_access.VariableAccessangr.analyses.data_dep.sim_act_location),class method), 727
1161
parse_from_cmessage()
Patch (class in angr.knowledge_plugins.patches), 673(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
patch_addrs() (angr.knowledge_plugins.patches.PatchManager
class method), 728
method), 674
parse_from_cmessage()patch_addrs() (angr.knowledge_plugins.PatchManager(angr.knowledge_plugins.XRefManager classmethod), 669
method), 669
patched_entry_stateparse_from_cmessage()(angr.knowledge_plugins.patches.PatchManager(angr.knowledge_plugins.xrefs.XRef
classproperty), 675
method), 776
patched_entry_stateparse_from_cmessage()(angr.knowledge_plugins.PatchManager(angr.knowledge_plugins.xrefs.xref.XRefproperty), 670
class method), 778
PatchManager (class in angr.knowledge_plugins), 669
parse_from_cmessage()
PatchManager(classin(angr.knowledge_plugins.xrefs.xref_manager.XRefManager angr.knowledge_plugins.patches), 673
class method), 779
path (angr.angrdb.models.DbObject attribute), 919
parse_from_cmessage()path() (angr.analyses.typehoon.typevars.DerivedTypeVariable(angr.knowledge_plugins.xrefs.XRefManager
method), 1124
class method), 777
path_between() (angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGS
parse_from_cmessage()method), 1102
(angr.serializable.Serializable class method), path_between() (angr.analyses.cfg_slice_to_sink.CFGSliceToSink
784
method), 1099
parse_from_cmessage()
PathUnreachableError, 157, 1199
(angr.sim_variable.SimMemoryVariable
PcodeBasicBlockLifter(classinclass method), 636
angr.engines.pcode.lifter), 569
1352

Index

angr

PcodeDisassemblerBlock(classinproperty), 467
angr.engines.pcode.lifter), 563
perm_write (angr.storage.memory_mixins.PermissionsMixin
PcodeDisassemblerInsn(classinproperty), 429
angr.engines.pcode.lifter), 563
permissions() (angr.storage.memory_mixins.address_concretization_mix
PcodeEmulatorMixin(classinmethod), 453
angr.engines.pcode.emulate), 573
permissions() (angr.storage.memory_mixins.AddressConcretizationMixin
PcodeLifter (class in angr.engines.pcode.lifter), 570
method), 416
PcodeLifterEngineMixin(classin permissions() (angr.storage.memory_mixins.paged_memory.paged_mem
angr.engines.pcode.lifter), 571
method), 461
peek_input()(angr.state_plugins.cgc.SimStateCGC permissions() (angr.storage.memory_mixins.PagedMemoryMixin
method), 338
method), 425
peek_input()(angr.state_plugins.SimStateCGC PermissionsMixin(classinmethod), 257
angr.storage.memory_mixins), 429
peek_output() (angr.state_plugins.cgc.SimStateCGC PermissionsMixin(classinmethod), 338
angr.storage.memory_mixins.paged_memory.pages),
peek_output()(angr.state_plugins.SimStateCGC
466
method), 257
PermissionsMixin(classinpeephole_optimize_expr()(inmoduleangr.storage.memory_mixins.paged_memory.pages.permissions_m
angr.analyses.decompiler.utils), 1023
474
peephole_optimize_exprs()(inmodule Permissive (angr.exploration_techniques.tracer.TracingModeangr.analyses.decompiler.utils), 1023
attribute), 531
peephole_optimize_multistmts()(inmodule persistent_id() (angr.vaults.VaultPickler method),angr.analyses.decompiler.utils), 1023
785
peephole_optimize_stmts()(inmodule persistent_load()(angr.vaults.VaultUnpickler
angr.analyses.decompiler.utils), 1023
method), 785
PeepholeOptimizationExprBase(classin phi_vars (angr.analyses.decompiler.expression_narrower.ExprNarrowingI
angr.analyses.decompiler.peephole_optimizations.base), attribute), 958
986
PhoenixStructurer(classin
PeepholeOptimizationMultiStmtBase (class inangr.analyses.decompiler.structuring), 931
angr.analyses.decompiler.peephole_optimizations.base),
PhoenixStructurer(classin986
angr.analyses.decompiler.structuring.phoenix),
PeepholeOptimizationStmtBase(classin939
angr.analyses.decompiler.peephole_optimizations.base),
PickledState(classin985
angr.exploration_techniques.spiller_db),
PendingJob (class in angr.analyses.cfg.cfg_emulated),
529
877
PickledStatesBase(classin
PendingJob (class in angr.analyses.vfg), 1134
angr.exploration_techniques.spiller), 527
PendingJobs (class in angr.analyses.cfg.cfg_fast), 885
PickledStatesDb(classinperform_call() (angr.callable.Callable method), 654
angr.exploration_techniques.spiller), 528
perm_exec (angr.storage.memory_mixins.paged_memory.pages.permissions_mixin.PermissionsMixin
PickledStatesList(classinproperty), 474
angr.exploration_techniques.spiller), 527
perm_exec (angr.storage.memory_mixins.paged_memory.pages.PermissionsMixin
PLATFORMS (angr.analyses.decompiler.optimization_passes.base_ptr_save_s
property), 467
attribute), 978
perm_exec (angr.storage.memory_mixins.PermissionsMixinPLATFORMS (angr.analyses.decompiler.optimization_passes.BasePointerSav
property), 429
attribute), 961
perm_read (angr.storage.memory_mixins.paged_memory.pages.permissions_mixin.PermissionsMixin
PLATFORMS (angr.analyses.decompiler.optimization_passes.CallStatementRe
property), 474
attribute), 972
perm_read (angr.storage.memory_mixins.paged_memory.pages.PermissionsMixin
PLATFORMS (angr.analyses.decompiler.optimization_passes.CodeMotionOpt
property), 467
attribute), 969
perm_read (angr.storage.memory_mixins.PermissionsMixinPLATFORMS (angr.analyses.decompiler.optimization_passes.const_derefs.Co
property), 429
attribute), 974
perm_write (angr.storage.memory_mixins.paged_memory.pages.permissions_mixin.PermissionsMixin
PLATFORMS (angr.analyses.decompiler.optimization_passes.ConstantDerefe
property), 474
attribute), 966
perm_write (angr.storage.memory_mixins.paged_memory.pages.PermissionsMixin
PLATFORMS (angr.analyses.decompiler.optimization_passes.ConstPropOptR
Index

1353

angr

attribute), 971
attribute), 977
PLATFORMS (angr.analyses.decompiler.optimization_passes.DeadblockRemover
PLATFORMS (angr.analyses.decompiler.optimization_passes.StackCanarySim
attribute), 971
attribute), 961
PLATFORMS (angr.analyses.decompiler.optimization_passes.div_simplifier.DivSimplifier
PLATFORMS (angr.analyses.decompiler.optimization_passes.SwitchDefaultC
attribute), 978attribute), 970
PLATFORMS (angr.analyses.decompiler.optimization_passes.DivSimplifier
PLATFORMS (angr.analyses.decompiler.optimization_passes.WinStackCanar
attribute), 963
attribute), 968
PLATFORMS (angr.analyses.decompiler.optimization_passes.expr_op_swapper.ExprOpSwapper
PLATFORMS (angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_
attribute), 984
attribute), 985
PLATFORMS (angr.analyses.decompiler.optimization_passes.ExprOpSwapper
PLATFORMS (angr.analyses.decompiler.optimization_passes.X86GccGetPcSi
attribute), 961
attribute), 967
PLATFORMS (angr.analyses.decompiler.optimization_passes.FlipBooleanCmp
plugin_preset (angr.misc.plugins.PluginHub propattribute), 967
erty), 218
PLATFORMS (angr.analyses.decompiler.optimization_passes.InlinedStringTransformationSimplifier
PluginHub (class in angr.misc.plugins), 218
attribute), 971
PluginPreset (class in angr.misc.plugins), 219
PLATFORMS (angr.analyses.decompiler.optimization_passes.ite_expr_converter.ITEExprConverter
plugins (angr.sim_state.SimState property), 221
attribute), 979
plugins (angr.SimState property), 177
PLATFORMS (angr.analyses.decompiler.optimization_passes.ITEExprConverter
PluginVendor (class in angr.misc.plugins), 219
attribute), 962
Pointer (class in angr.analyses.typehoon.typeconsts),
PLATFORMS (angr.analyses.decompiler.optimization_passes.ITERegionConverter
1128
attribute), 962
Pointer32 (class in angr.analyses.typehoon.typeconsts),
PLATFORMS (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.LoweredSwitchSimplifier
1128
attribute), 980
Pointer64 (class in angr.analyses.typehoon.typeconsts),
PLATFORMS (angr.analyses.decompiler.optimization_passes.LoweredSwitchSimplifier
1128
attribute), 963
pointer_addr (angr.knowledge_plugins.cfg.memory_data.MemoryData
PLATFORMS (angr.analyses.decompiler.optimization_passes.mod_simplifier.ModSimplifier
attribute), 696
attribute), 982
pointer_addr (angr.knowledge_plugins.cfg.MemoryData
PLATFORMS (angr.analyses.decompiler.optimization_passes.ModSimplifier
attribute), 677
attribute), 964
pointer_to_atom() (angr.analyses.reaching_definitions.rd_state.Reachin
PLATFORMS (angr.analyses.decompiler.optimization_passes.multi_simplifier.MultiSimplifier
method), 1097
attribute), 981
pointer_to_atom() (angr.analyses.reaching_definitions.ReachingDefiniti
PLATFORMS (angr.analyses.decompiler.optimization_passes.MultiSimplifier
method), 1066
attribute), 963
pointer_to_atoms() (angr.analyses.reaching_definitions.rd_state.Reachi
PLATFORMS (angr.analyses.decompiler.optimization_passes.optimization_pass.BaseOptimizationPass
method), 1097
attribute), 975
pointer_to_atoms() (angr.analyses.reaching_definitions.ReachingDefini
PLATFORMS (angr.analyses.decompiler.optimization_passes.optimization_pass.SequenceOptimizationPass
method), 1066
attribute), 976
PointerArithmeticFixer(classin
PLATFORMS (angr.analyses.decompiler.optimization_passes.optimization_pass.StructuringOptimizationPass
angr.analyses.decompiler.structured_codegen.c),
attribute), 977
1019
PLATFORMS (angr.analyses.decompiler.optimization_passes.register_save_area_simplifier.RegisterSaveAreaSimplifier
PointerArray (angr.knowledge_plugins.cfg.memory_data.MemoryDataSo
attribute), 984
attribute), 695
PLATFORMS (angr.analyses.decompiler.optimization_passes.RegisterSaveAreaSimplifier
PointerArray (angr.knowledge_plugins.cfg.MemoryDataSort
attribute), 966
attribute), 676
PLATFORMS (angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier.RetAddrSaveSimplifier
PointerWrapper (class in angr), 180
attribute), 984
PointerWrapper (class in angr.calling_conventions),
PLATFORMS (angr.analyses.decompiler.optimization_passes.RetAddrSaveSimplifier
613
attribute), 967
pop() (angr.state_plugins.CallStack method), 268
PLATFORMS (angr.analyses.decompiler.optimization_passes.ReturnDeduplicatorpop() (angr.state_plugins.callstack.CallStack method),attribute), 967
331
PLATFORMS (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorHighpop()(angr.state_plugins.globals.SimStateGlobals
attribute), 965
method), 344
PLATFORMS (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorLow
pop() (angr.state_plugins.SimStateGlobals method), 270
attribute), 964
pop_from_backup() (angr.state_plugins.trace_additions.ChallRespInfo
PLATFORMS (angr.analyses.decompiler.optimization_passes.stack_canary_simplifier.StackCanarySimplifier
method), 341
1354

Index

angr

pop_job()(angr.analyses.cfg.cfg_fast.PendingJobs pp() (angr.Block method), 166
method), 885
pp() (angr.block.Block method), 217
pop_n() (angr.exploration_techniques.spiller.PickledStatesBasepp() (angr.block.DisassemblerBlock method), 216
method), 527
pp() (angr.engines.pcode.lifter.IRSB method), 566
pop_n() (angr.exploration_techniques.spiller.PickledStatesDb
pp() (angr.knowledge_plugins.Function method), 665
method), 528
pp()(angr.knowledge_plugins.functions.Function
pop_n() (angr.exploration_techniques.spiller.PickledStatesList
method), 712
method), 527
pp() (angr.knowledge_plugins.functions.function.Function
pop_priv() (angr.state_plugins.scratch.SimStateScratchmethod), 724
method), 346
pp_constraints() (angr.analyses.Typehoon method),
pop_priv()(angr.state_plugins.SimStateScratch829
method), 254
pp_constraints() (angr.analyses.typehoon.Typehoon
pop_stack_frame() (angr.storage.memory_mixins.JavaVmMemoryMixin
method), 1130
method), 443
pp_constraints() (angr.analyses.typehoon.typehoon.Typehoon
populate()(angr.sim_manager.SimulationManager
method), 1127
method), 502
pp_solution() (angr.analyses.Typehoon method), 829
populate() (angr.SimulationManager method), 171
pp_solution()(angr.analyses.typehoon.Typehoonpos (angr.SimFileBase attribute), 184
method), 1130
pos (angr.storage.file.SimFileBase attribute), 392
pp_solution() (angr.analyses.typehoon.typehoon.Typehoon
PositionMapping(classinmethod), 1127
angr.analyses.decompiler.structured_codegen), pp_str() (angr.analyses.typehoon.typeconsts.TypeConstant998
method), 1127
PositionMapping(classin pp_str()(angr.analyses.typehoon.typevars.Add
angr.analyses.decompiler.structured_codegen.base),method), 1123
1001
pp_str() (angr.analyses.typehoon.typevars.DerivedTypeVariable
PositionMappingElement(classinmethod), 1124
angr.analyses.decompiler.structured_codegen), pp_str() (angr.analyses.typehoon.typevars.Equivalence997
method), 1122
PositionMappingElement(classin pp_str() (angr.analyses.typehoon.typevars.Existence
angr.analyses.decompiler.structured_codegen.base),method), 1122
1001
pp_str()(angr.analyses.typehoon.typevars.Sub
posix (angr.sim_state.SimState attribute), 220
method), 1123
posix (angr.SimState attribute), 177
pp_str()(angr.analyses.typehoon.typevars.Subtype
PosixDevFS (class in angr.state_plugins), 234
method), 1122
PosixDevFS (class in angr.state_plugins.posix), 306
pp_str() (angr.analyses.typehoon.typevars.TypeConstraint
PosixProcFS (class in angr.state_plugins), 236
method), 1121
PosixProcFS (class in angr.state_plugins.posix), 308
pp_str() (angr.analyses.typehoon.typevars.TypeVariable
posmap_pos (angr.analyses.decompiler.structured_codegen.base.InstructionMappingElement
method), 1124
attribute), 1001
PRE_FORGOTTEN (angr.analyses.typehoon.simple_solver.FORGOTTEN
posmap_pos (angr.analyses.decompiler.structured_codegen.InstructionMappingElement
attribute), 1118
attribute), 997
preconstrain() (angr.state_plugins.preconstrainer.SimStatePreconstraine
PossibleObject(classinmethod), 349
angr.analyses.find_objects_static), 1140
preconstrain() (angr.state_plugins.SimStatePreconstrainer
post_dom (angr.utils.graph.PostDominators property),
method), 272
1193
preconstrain_file()
post_filter() (angr.exploration_techniques.StubStasher(angr.state_plugins.preconstrainer.SimStatePreconstrainer
static method), 524
method), 349
POST_FORGOTTEN (angr.analyses.typehoon.simple_solver.FORGOTTEN
preconstrain_file()
attribute), 1118
(angr.state_plugins.SimStatePreconstrainer
PostDominators (class in angr.utils.graph), 1193
method), 272
pp() (angr.analyses.datagraph_meta.DataGraphMeta preconstrain_flag_page()method), 915(angr.state_plugins.preconstrainer.SimStatePreconstrainerpp() (angr.analyses.DDG method), 802
method), 349
pp() (angr.analyses.ddg.DDG method), 1028
preconstrain_flag_page()
Index

1355

angr

(angr.state_plugins.SimStatePreconstrainer
method), 223
method), 272
prepare_callsite() (angr.SimState method), 180predecessors (angr.knowledge_plugins.cfg.cfg_node.CFGNodeprepare_function_symbol() (angr.SimOS method),
property), 698
164
predecessors (angr.knowledge_plugins.cfg.CFGNode prepare_function_symbol()property), 678(angr.simos.linux.SimLinux method), 1182
predecessors() (angr.analyses.forward_analysis.CallGraphVisitor
prepare_function_symbol() (angr.simos.SimLinuxmethod), 836
method), 1175
predecessors() (angr.analyses.forward_analysis.FunctionGraphVisitor
prepare_function_symbol()(angr.simos.SimOS
method), 837
method), 1172
predecessors() (angr.analyses.forward_analysis.LoopVisitor
prepare_function_symbol()
method), 837(angr.simos.simos.SimOS method), 1180
predecessors() (angr.analyses.forward_analysis.SingleNodeGraphVisitor
prepare_native_return_state()
method), 838(angr.engines.soot.engine.SootMixin
staticpredecessors() (angr.analyses.forward_analysis.visitors.call_graph.CallGraphVisitor
method), 559
method), 844
prepare_native_return_state()predecessors() (angr.analyses.forward_analysis.visitors.CallGraphVisitor(angr.engines.soot.SootMixin static method),
method), 841
558
predecessors() (angr.analyses.forward_analysis.visitors.function_graph.FunctionGraphVisitor
prepare_native_return_state()
method), 845(angr.engines.SootMixin
staticmethod),predecessors() (angr.analyses.forward_analysis.visitors.FunctionGraphVisitor
551
method), 841
prepare_native_return_state()(inmodulepredecessors() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor
angr.simos.javavm), 1187
method), 845
prepare_return_state()predecessors() (angr.analyses.forward_analysis.visitors.loop.LoopVisitor(angr.engines.soot.engine.SootMixin
staticmethod), 847
method), 559
predecessors() (angr.analyses.forward_analysis.visitors.LoopVisitor
prepare_return_state()
method), 842(angr.engines.soot.SootMixin static method),predecessors() (angr.analyses.forward_analysis.visitors.single_node_graph.SingleNodeGraphVisitor
558
method), 848
prepare_return_state()(angr.engines.SootMixin
predecessors() (angr.analyses.forward_analysis.visitors.SingleNodeGraphVisitor
static method), 551
method), 843
prepared_registers (angr.knowledge_plugins.Functionpredecessors() (angr.analyses.reaching_definitions.dep_graph.DepGraphattribute), 658
method), 1080
prepared_registers (angr.knowledge_plugins.functions.Functionpredecessors() (angr.codenode.CodeNode method),attribute), 706
1170
prepared_registers (angr.knowledge_plugins.functions.function.Functio
predecessors_and_jumpkinds()
attribute), 717(angr.knowledge_plugins.cfg.cfg_node.CFGNode prepared_registers (angr.knowledge_plugins.functions.soot_function.So
method), 698
attribute), 725
predecessors_and_jumpkinds()
prepared_stack_variables(angr.knowledge_plugins.cfg.CFGNode(angr.knowledge_plugins.Function attribute),
method), 679
658
prep()(angr.analyses.analysis.AnalysisFactory prepared_stack_variables
method), 834(angr.knowledge_plugins.functions.Function
prep_tracer() (angr.state_plugins.trace_additions.ChallRespInfo attribute), 706
static method), 342
prepared_stack_variables
prep_tracer() (angr.state_plugins.trace_additions.ZenPlugin(angr.knowledge_plugins.functions.function.Function
static method), 343
attribute), 717
prepare_call_state() (angr.SimOS method), 164
prepared_stack_variables
prepare_call_state() (angr.simos.SimOS method),(angr.knowledge_plugins.functions.soot_function.SootFunction
1172
attribute), 725
prepare_call_state()(angr.simos.simos.SimOS prev_chunk() (angr.PTChunk method), 205
method), 1180
prev_chunk() (angr.state_plugins.heap.heap_freelist.Chunk
prepare_callsite()(angr.sim_state.SimState
method), 373
1356

Index

angr

prev_chunk() (angr.state_plugins.heap.heap_ptmalloc.PTChunk method), 1098
method), 376
process() (angr.analyses.reaching_definitions.engine_vex.SimEngineRDV
prev_chunk()(angr.state_plugins.heap.PTChunkmethod), 1074
method), 370
process() (angr.analyses.variable_recovery.engine_base.SimEngineVRBa
prev_chunk() (angr.state_plugins.PTChunk method),
method), 1115
290
process() (angr.engines.engine.SimEngine method),
prev_size() (angr.PTChunk method), 205
551
prev_size() (angr.state_plugins.heap.heap_ptmalloc.PTChunkprocess()(angr.engines.engine.SuccessorsMixin
method), 376
method), 552
prev_size()(angr.state_plugins.heap.PTChunk process() (angr.engines.light.engine.SimEngineLight
method), 370
method), 1033
prev_size() (angr.state_plugins.PTChunk method), process() (angr.engines.light.SimEngineLight method),290
1032
print_all_chunks() (angr.state_plugins.heap.heap_freelist.SimHeapFreelist
process() (angr.engines.SimEngine method), 545
method), 374
process() (angr.engines.SuccessorsMixin method), 545
print_heap_state() (angr.state_plugins.heap.heap_freelist.SimHeapFreelist
process() (angr.engines.vex.VEXSlicingMixin method),
method), 374
556
PRINTABLES(angr.analyses.cfg.cfg_fast.CFGFast process_exc_file() (in module angr.flirt.build_sig),
attribute), 890
1188
PRINTABLES (angr.analyses.cfg.CFGFast attribute), 858 process_procedure()
PRINTABLES (angr.analyses.CFGFast attribute), 790(angr.engines.procedure.ProcedureMixin
prioritize_functions()
method), 554(angr.analyses.complete_calling_conventions.CompleteCallingConventionsAnalysis
process_procedure() (angr.engines.ProcedureMixin
method), 856
method), 547
prioritize_functions()
process_successors()(angr.analyses.CompleteCallingConventionsAnalysis(angr.engines.concrete.SimEngineConcrete
method), 828
method), 560
priority (angr.exploration_techniques.spiller_db.PickledState
process_successors()
attribute), 529(angr.engines.engine.SuccessorsMixin
priv (angr.state_plugins.scratch.SimStateScratch propmethod), 552
erty), 346
process_successors()
priv (angr.state_plugins.SimStateScratch property), 254(angr.engines.failure.SimEngineFailure
PrivilegedPagingMixin(classinmethod), 555
angr.storage.memory_mixins), 427
process_successors()
PrivilegedPagingMixin(classin(angr.engines.HeavyVEXMixin
method),angr.storage.memory_mixins.paged_memory.privileged_mixin),
546
465
process_successors()
probably_identical (angr.analyses.bindiff.FunctionDiff(angr.engines.hook.HooksMixin
method),property), 851
554
Procedure (class in angr.analyses.reassembler), 1148
process_successors()(angr.engines.HooksMixin
ProcedureChunk (class in angr.analyses.reassembler),
method), 550
1149
process_successors()
ProcedureEngine (class in angr.engines), 547(angr.engines.pcode.engine.HeavyPcodeMixin
ProcedureEngine (class in angr.engines.procedure),
method), 562
554
process_successors()
ProcedureMixin (class in angr.engines), 547(angr.engines.pcode.HeavyPcodeMixin
ProcedureMixin (class in angr.engines.procedure), 554
method), 561
process() (angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILEngine
process_successors()
method), 982(angr.engines.procedure.ProcedureEngine
process() (angr.analyses.loop_analysis.SootBlockProcessor
method), 554
method), 1132
process_successors()
process() (angr.analyses.propagator.engine_base.SimEnginePropagatorBase(angr.engines.ProcedureEngine
method),method), 1036
547
process() (angr.analyses.reaching_definitions.engine_ail.SimEngineRDAIL
process_successors()
Index

1357

angr

(angr.engines.SimEngineConcrete
method), project (angr.analyses.decompiler.structuring.dream.DreamStructurer
549
attribute), 933
process_successors()
project (angr.analyses.decompiler.structuring.phoenix.PhoenixStructurer(angr.engines.SimEngineFailure
method),attribute), 940
548
project (angr.analyses.disassembly.Value property),
process_successors()
1144(angr.engines.SimEngineSyscall
method), project (angr.analyses.reaching_definitions.LiveDefinitions
548
attribute), 1041
process_successors()
project (angr.analyses.veritesting.Veritesting attribute),(angr.engines.SimEngineUnicorn
method),1134
548
project (angr.Analysis attribute), 174
process_successors()
project (angr.knowledge_plugins.cfg.cfg_model.CFGModel(angr.engines.soot.engine.SootMixin method),
property), 689
559
project (angr.knowledge_plugins.cfg.CFGModel propprocess_successors() (angr.engines.soot.SootMixin
erty), 682
method), 558
project (angr.knowledge_plugins.Function property),
process_successors()(angr.engines.SootMixin658
method), 550
project(angr.knowledge_plugins.functions.Function
process_successors()
property), 706(angr.engines.SuccessorsMixin
method), project (angr.knowledge_plugins.functions.function.Function
545
property), 718
process_successors()
project (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin(angr.engines.syscall.SimEngineSyscall
attribute), 762
method), 555
project (angr.knowledge_plugins.key_definitions.LiveDefinitions
process_successors()
attribute), 740(angr.engines.unicorn.SimEngineUnicorn
project (angr.sim_procedure.SimProcedure attribute),
method), 559
601
process_successors()
Project (class in angr), 153(angr.engines.vex.HeavyVEXMixin method), Project (class in angr.project), 208
556
prop(angr.analyses.decompiler.clinic.BlockCache
ProgramVariable (class in angr.analyses.ddg), 1025
attribute), 950
project (angr.analyses.Analysis attribute), 786
prop_key (angr.analyses.propagator.propagator.PropagatorAnalysis
project (angr.analyses.analysis.Analysis attribute), 834
property), 1040
project (angr.analyses.binary_optimizer.BinaryOptimizer prop_key (angr.analyses.propagator.PropagatorAnalysis
attribute), 1155
property), 1034
project (angr.analyses.cfg.cfg_base.CFGBase at- prop_key (angr.analyses.PropagatorAnalysis property),
tribute), 884789
project (angr.analyses.cfg.cfg_emulated.CFGEmulated PropagationManager(classin
attribute), 881
angr.knowledge_plugins), 671
project (angr.analyses.cfg.cfg_fast.CFGFast attribute), PropagationManager(classin892
angr.knowledge_plugins.propagations), 703
project (angr.analyses.cfg.CFGEmulated attribute), PropagationModel(classin865
angr.knowledge_plugins.propagations), 702
project (angr.analyses.cfg.CFGFast attribute), 861
propagations (angr.knowledge_base.KnowledgeBase
project (angr.analyses.cfg.indirect_jump_resolvers.jumptable.ConstantValueManager
attribute), 655
attribute), 900
propagations (angr.KnowledgeBase attribute), 207
project (angr.analyses.decompiler.optimization_passes.optimization_pass.BaseOptimizationPass
Propagator (angr.analyses.analysis.KnownAnalysesPlugin
property), 976
attribute), 833
project (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationExprBase
PropagatorAnalysis (class in angr.analyses), 788
attribute), 987
PropagatorAnalysis(classinproject (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationMultiStmtBase
angr.analyses.propagator), 1033
attribute), 986
PropagatorAnalysis(classinproject (angr.analyses.decompiler.peephole_optimizations.base.PeepholeOptimizationStmtBase
angr.analyses.propagator.propagator), 1038
attribute), 985
prototype (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
1358

Index

angr

property), 1008
push_priv() (angr.state_plugins.scratch.SimStateScratch
prototype (angr.analyses.reaching_definitions.function_handler.FunctionCallData
method), 346
attribute), 1085
push_priv()(angr.state_plugins.SimStateScratch
prototype (angr.analyses.reaching_definitions.FunctionCallData method), 254
attribute), 1070
push_stack_frame() (angr.storage.memory_mixins.JavaVmMemoryMixin
prototype (angr.knowledge_plugins.Function attribute),
method), 443
658
put() (angr.analyses.stack_pointer_tracker.StackPointerTrackerState
prototype (angr.knowledge_plugins.functions.Function
method), 1105
attribute), 705
PutHook (class in angr.analyses.cfg.indirect_jump_resolvers.jumptable),
prototype (angr.knowledge_plugins.functions.function.Function
902
attribute), 717
Qprototype (angr.knowledge_plugins.functions.soot_function.SootFunction
attribute), 725
qualifies_for_implicit_cast()(inmoduleprototype (angr.sim_procedure.SimProcedure atangr.analyses.decompiler.structured_codegen.c),tribute), 601
1002
prototype_libname (angr.knowledge_plugins.Function qualifies_for_simple_cast()(inmoduleattribute), 658
angr.analyses.decompiler.structured_codegen.c),
prototype_libname (angr.knowledge_plugins.functions.Function 1002
attribute), 706
quasi_topological_sort_nodes()prototype_libname (angr.knowledge_plugins.functions.function.Function(angr.utils.graph.GraphUtils static method),attribute), 717
1194
prototype_libname (angr.knowledge_plugins.functions.soot_function.SootFunction
query()(angr.knowledge_plugins.FunctionManager
attribute), 725
method), 656
ProximityGraphAnalysis (class in angr.analyses), 829 query() (angr.knowledge_plugins.functions.function_manager.FunctionMa
ProximityGraphAnalysis(classinmethod), 716
angr.analyses.proximity_graph), 1159
query() (angr.knowledge_plugins.functions.FunctionManager
ProxiNodeTypes(classinmethod), 713
angr.analyses.proximity_graph), 1157
prune()(angr.sim_manager.SimulationManager R
method), 502
ran_cca (angr.knowledge_plugins.Function attribute),
prune() (angr.SimulationManager method), 171
658
pruned (angr.sim_manager.SimulationManager at- ran_cca (angr.knowledge_plugins.functions.Function attribute), 499
tribute), 706
pruned (angr.SimulationManager attribute), 168
ran_cca (angr.knowledge_plugins.functions.function.Function
pseudocode (angr.knowledge_plugins.Function propattribute), 717
erty), 661
ran_cca (angr.knowledge_plugins.functions.soot_function.SootFunction
pseudocode (angr.knowledge_plugins.functions.Function
attribute), 726
property), 709
RANDOM (angr.simos.windows.SecurityCookieInit atpseudocode (angr.knowledge_plugins.functions.function.Function tribute), 1184
property), 720
randomize_procedures() (angr.analyses.Reassembler
PTChunk (class in angr), 204
method), 813
PTChunk (class in angr.state_plugins), 289
randomize_procedures()
PTChunk (class in angr.state_plugins.heap), 369(angr.analyses.reassembler.Reassembler
PTChunk (class in angr.state_plugins.heap.heap_ptmalloc),
method), 1152
375
raw_to_bv() (angr.state_plugins.sim_action_object.SimActionObject
PTChunkIterator (class in angr.state_plugins), 291
method), 598
PTChunkIterator (class in angr.state_plugins.heap), raw_to_bv()(angr.state_plugins.SimActionObject
370
method), 266
PTChunkIterator(classin rd (angr.analyses.decompiler.clinic.BlockCache atangr.state_plugins.heap.heap_ptmalloc),
tribute), 950377
rda_observe_callback()push() (angr.state_plugins.CallStack method), 268(angr.knowledge_plugins.key_definitions.key_definition_manager.
push() (angr.state_plugins.callstack.CallStack method),
method), 759
331
Index

1359

angr

RDAObserverControl(classinmethod), 401
angr.knowledge_plugins.key_definitions.key_definition_manager),read() (angr.storage.file.SimFileStream method), 395759
read() (angr.storage.file.SimPackets method), 397
reachable() (angr.state_plugins.history.SimStateHistory read() (angr.storage.file.SimPacketsSlots method), 408
method), 335
read() (angr.storage.file.SimPacketsStream method),reachable()(angr.state_plugins.SimStateHistory399
method), 253read() (angr.storage.SimFile method), 383
reached_fixedpoint()
read_data() (angr.SimFileDescriptor method), 194(angr.analyses.forward_analysis.visitors.graph.GraphVisitor
read_data() (angr.SimFileDescriptorDuplex method),
method), 847
196reaching_condition (angr.analyses.decompiler.structuring.structurer_nodes.CodeNode
read_data()(angr.storage.file.SimFileDescriptor
attribute), 934
method), 403
reaching_condition (angr.analyses.decompiler.structuring.structurer_nodes.ConditionNode
read_data() (angr.storage.file.SimFileDescriptorBase
attribute), 934
method), 401
ReachingDefinitions
read_data() (angr.storage.file.SimFileDescriptorDuplex(angr.analyses.analysis.KnownAnalysesPlugin
method), 405
attribute), 833
read_from() (angr.knowledge_plugins.variables.variable_manager.Variab
ReachingDefinitionsAnalysis(classinmethod), 729
angr.analyses), 817
read_msr() (angr.state_plugins.Unicorn method), 262
ReachingDefinitionsAnalysis(classin read_msr() (angr.state_plugins.unicorn_engine.Unicorn
angr.analyses.reaching_definitions), 1053
method), 356
ReachingDefinitionsAnalysis(classin read_pos (angr.SimFileDescriptor property), 195
angr.analyses.reaching_definitions.reaching_definitions),
read_pos (angr.SimFileDescriptorDuplex property), 197
1074
read_pos (angr.storage.file.SimFileDescriptor property),
ReachingDefinitionsModel(classin404
angr.analyses.reaching_definitions), 1057
read_pos(angr.storage.file.SimFileDescriptorBase
ReachingDefinitionsModel(classinproperty), 402
angr.knowledge_plugins.key_definitions),
read_pos(angr.storage.file.SimFileDescriptorDuplex
736
property), 406
ReachingDefinitionsModel(classin read_storage (angr.SimFileDescriptor property), 194
angr.knowledge_plugins.key_definitions.rd_model),read_storage (angr.SimFileDescriptorDuplex prop769
erty), 197
ReachingDefinitionsState(classin read_storage(angr.storage.file.SimFileDescriptor
angr.analyses.reaching_definitions), 1059
property), 403
ReachingDefinitionsState(classin read_storage (angr.storage.file.SimFileDescriptorBase
angr.analyses.reaching_definitions.rd_state),
property), 402
1089
read_storage (angr.storage.file.SimFileDescriptorDuplex
READ (angr.knowledge_plugins.variables.variable_access.VariableAccessSort
property), 406
attribute), 727
real_args (angr.calling_conventions.UsercallArgSession
Read (angr.knowledge_plugins.xrefs.xref_types.XRefTypeattribute), 618
attribute), 779
real_length() (angr.utils.dynamic_dictlist.DynamicDictList
Read (angr.knowledge_plugins.xrefs.XRefType attribute),
method), 1190
777
realloc() (angr.SimHeapPTMalloc method), 203
READ (angr.state_plugins.sim_action.SimActionData at- realloc() (angr.state_plugins.heap.heap_libc.SimHeapLibc
tribute), 596
method), 375
READ (angr.state_plugins.SimActionData attribute), 264
realloc() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
read() (angr.SimFile method), 186
method), 378
read() (angr.SimFileBase method), 184realloc()(angr.state_plugins.heap.SimHeapLibc
read() (angr.SimFileStream method), 190
method), 366
read() (angr.SimPackets method), 188realloc() (angr.state_plugins.heap.SimHeapPTMalloc
read() (angr.SimPacketsStream method), 192
method), 368
read() (angr.storage.file.SimFile method), 393
realloc() (angr.state_plugins.SimHeapLibc method),read() (angr.storage.file.SimFileBase method), 392
286
read()(angr.storage.file.SimFileDescriptorBase realloc()(angr.state_plugins.SimHeapPTMalloc
1360

Index

angr

method), 288
recurse_analysis() (angr.analyses.reaching_definitions.FunctionHandle
reapply_options() (angr.analyses.decompiler.CStructuredCodeGenerator
method), 1068
method), 941
recursive_copy() (angr.analyses.decompiler.graph_region.GraphRegion
reapply_options() (angr.analyses.decompiler.structured_codegen.base.BaseStructuredCodeGenerator
method), 959
method), 1002
RecursiveRefNode(classinreapply_options() (angr.analyses.decompiler.structured_codegen.BaseStructuredCodeGenerator
angr.analyses.typehoon.simple_solver), 1117
method), 997
RecursiveStructurer(classinreapply_options() (angr.analyses.decompiler.structured_codegen.c.CStructuredCodeGenerator
angr.analyses.decompiler.structuring), 932
method), 1017
RecursiveStructurer(classinreapply_options() (angr.analyses.decompiler.structured_codegen.CStructuredCodeGenerator
angr.analyses.decompiler.structuring.recursive_structurer),
method), 999
930
Reassembler (angr.analyses.analysis.KnownAnalysesPlugin
redefine_locals (angr.analyses.reaching_definitions.function_handler.Fu
attribute), 833
attribute), 1085
Reassembler (class in angr.analyses), 811
redefine_locals (angr.analyses.reaching_definitions.FunctionCallData
Reassembler (class in angr.analyses.reassembler), 1150
attribute), 1071
ReassemblerFailureNotice, 1145
RedundantLabelRemover(classinrebuild_callgraph()angr.analyses.decompiler.redundant_label_remover),(angr.knowledge_plugins.FunctionManager
996
method), 657
RedundantStackVariable(classinrebuild_callgraph()angr.analyses.binary_optimizer), 1154
(angr.knowledge_plugins.functions.function_manager.FunctionManager
RefcountMixin (class in angr.storage.memory_mixins),
method), 716
428
rebuild_callgraph()
RefcountMixin(classin(angr.knowledge_plugins.functions.FunctionManager
angr.storage.memory_mixins.paged_memory.pages),
method), 714
466
recall() (angr.analyses.typehoon.simple_solver.ConstraintGraphNode
RefcountMixin(classinmethod), 1119
angr.storage.memory_mixins.paged_memory.pages.refcount_mixi
recent_actions (angr.state_plugins.history.SimStateHistory
473
property), 335
REFERENCE (angr.knowledge_plugins.variables.variable_access.VariableAc
recent_actions (angr.state_plugins.SimStateHistory
attribute), 727
property), 254
reference_at() (angr.knowledge_plugins.variables.variable_manager.Va
recent_constraints (angr.state_plugins.history.SimStateHistory method), 729
property), 335
reference_size (angr.knowledge_plugins.cfg.memory_data.MemoryData
recent_constraints (angr.state_plugins.SimStateHistory
attribute), 696
property), 253
reference_size (angr.knowledge_plugins.cfg.MemoryData
reconstrain() (angr.state_plugins.preconstrainer.SimStatePreconstrainer
attribute), 677
method), 349
reference_values (angr.analyses.decompiler.structured_codegen.c.CCon
reconstrain() (angr.state_plugins.SimStatePreconstrainer
attribute), 1014
method), 272
refine() (angr.calling_conventions.SimFunctionArgument
record_state() (angr.errors.SimError method), 1201
method), 615
record_state() (angr.SimError method), 159
refine() (angr.calling_conventions.SimLyingRegArg
record_variable() (angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
method), 622
method), 729
refine()(angr.calling_conventions.SimRegArg
recover_edge_condition()
method), 615(angr.analyses.decompiler.condition_processor.ConditionProcessor
refine()(angr.calling_conventions.SimStackArg
method), 953
method), 616
recover_edge_conditions()refine_locs_with_struct_type()(inmodule(angr.analyses.decompiler.condition_processor.ConditionProcessor
angr.calling_conventions), 614
method), 953
reflow_variable_types()
recover_reaching_conditions()(angr.analyses.Decompiler method), 825(angr.analyses.decompiler.condition_processor.ConditionProcessor
reflow_variable_types()
method), 954(angr.analyses.decompiler.Decompiler
recurse_analysis() (angr.analyses.reaching_definitions.function_handler.FunctionHandler
method), 945
method), 1089
reflow_variable_types()
Index

1361

angr

(angr.analyses.decompiler.decompiler.Decompiler
method), 942
method), 956
regenerate_text() (angr.analyses.decompiler.structured_codegen.base.B
reg (angr.analyses.decompiler.structured_codegen.c.CRegister
method), 1002
attribute), 1015
regenerate_text() (angr.analyses.decompiler.structured_codegen.BaseSreg (angr.analyses.stack_pointer_tracker.OffsetVal propmethod), 997
erty), 1103
regenerate_text() (angr.analyses.decompiler.structured_codegen.c.CStr
reg (angr.engines.light.data.RegisterOffset attribute),
method), 1017
1031
regenerate_text() (angr.analyses.decompiler.structured_codegen.CStru
reg (angr.engines.light.RegisterOffset attribute), 1032
method), 999
reg (angr.sim_variable.SimRegisterVariable attribute), regenerate_text() (angr.analyses.decompiler.structured_codegen.dwarf
635
method), 1020
REG (angr.state_plugins.sim_action.SimAction attribute), regenerate_text() (angr.analyses.decompiler.structured_codegen.Impor595
method), 1000
REG (angr.state_plugins.SimAction attribute), 262
region (angr.sim_variable.SimVariable attribute), 634
reg() (angr.analyses.reaching_definitions.Atom static region (angr.storage.memory_mixins.regioned_memory.region_data.Addre
method), 1049
attribute), 488
reg() (angr.knowledge_plugins.key_definitions.atoms.Atomregion (angr.storage.memory_mixins.regioned_memory.region_meta_mixin
static method), 751
property), 491
reg_concrete() (angr.sim_state.SimState method), 222 region_base_addr (angr.storage.memory_mixins.regioned_memory.regio
reg_concrete() (angr.SimState method), 179
attribute), 488
reg_deps(angr.state_plugins.sim_action.SimAction region_id (angr.storage.memory_mixins.regioned_memory.region_data.R
property), 595
attribute), 488
reg_deps (angr.state_plugins.sim_action.SimActionData region_ids (angr.storage.memory_mixins.regioned_memory.region_data.R
property), 596
property), 489
reg_deps (angr.state_plugins.sim_action_object.SimActionObject
RegionCategoryMixin(classin
attribute), 597
angr.storage.memory_mixins), 440
reg_deps (angr.state_plugins.SimAction property), 263 RegionCategoryMixin(classin
reg_deps (angr.state_plugins.SimActionData property),
angr.storage.memory_mixins.regioned_memory),264
482
reg_deps (angr.state_plugins.SimActionObject at- RegionCategoryMixin(classintribute), 265
angr.storage.memory_mixins.regioned_memory.region_category_
reg_name (angr.knowledge_plugins.key_definitions.definition.DefinitionMatchPredicate
490
attribute), 756
RegionDescriptor(classin
reg_offset (angr.analyses.cfg.indirect_jump_resolvers.jumptable.RegOffsetAnnotation
angr.storage.memory_mixins.regioned_memory.region_data),
attribute), 901
488
reg_offset (angr.analyses.reaching_definitions.Register RegionedAddressConcretizationMixin (class inattribute), 1051
angr.storage.memory_mixins), 442
reg_offset (angr.knowledge_plugins.key_definitions.atoms.Register
RegionedAddressConcretizationMixin (class inattribute), 754
angr.storage.memory_mixins.regioned_memory),
reg_offset (angr.knowledge_plugins.key_definitions.atoms.VirtualVariable
484
property), 754
RegionedAddressConcretizationMixin (class in
reg_read_callback()
angr.storage.memory_mixins.regioned_memory.regioned_address(angr.analyses.cfg.indirect_jump_resolvers.jumptable.ConstantValueManager493
method), 900
RegionedMemory(classin
reg_size (angr.analyses.data_dep.dep_nodes.RegDepNodeangr.storage.memory_mixins), 446
property), 1163
RegionedMemoryMixin(classin
reg_size (angr.analyses.data_dep.RegDepNode propangr.storage.memory_mixins), 437erty), 1167
RegionedMemoryMixin(classin
RegDepNode (class in angr.analyses.data_dep), 1167
angr.storage.memory_mixins.regioned_memory),
RegDepNode (class in angr.analyses.data_dep.dep_nodes),479
1163
RegionedMemoryMixin(classinregenerate_text() (angr.analyses.decompiler.CStructuredCodeGenerator
angr.storage.memory_mixins.regioned_memory.regioned_memory
method), 941
485
regenerate_text() (angr.analyses.decompiler.ImportSourceCode
RegionIdentifier (class in angr.analyses.decompiler),
1362

Index

angr

940
method), 1113
RegionIdentifier(classin register_data_reference()
angr.analyses.decompiler.region_identifier),(angr.analyses.Reassembler method), 812
987
register_data_reference()
RegionMap (class in angr.storage.memory_mixins.regioned_memory.region_data),(angr.analyses.reassembler.Reassembler
488
method), 1151
RegionObject (class in angr.keyed_region), 781
register_default() (angr.knowledge_plugins.KnowledgeBasePlugin
regions (angr.analyses.cfg.cfb.CFBlanket property),static method), 669
874
register_default() (angr.knowledge_plugins.plugin.KnowledgeBasePlu
regions (angr.analyses.cfg.CFBlanket property), 867
static method), 675
RegionSimplifier (class in angr.analyses.decompiler), register_default() (angr.misc.plugins.PluginHub
944
class method), 218
RegionSimplifier(classin register_default()(angr.SimStatePlugin
classangr.analyses.decompiler.region_simplifiers),
method), 152988
register_default() (angr.state_plugins.plugin.SimStatePlugin
RegionSimplifier(classinclass method), 300
angr.analyses.decompiler.region_simplifiers.region_simplifier),
register_default() (angr.state_plugins.SimStatePlugin992
class method), 228
RegionWalker(classin register_default_cc()(inmoduleangr.analyses.decompiler.region_walker),angr.calling_conventions), 633
996
register_definitions
Register (angr.analyses.data_dep.dep_nodes.DepNodeTypes(angr.analyses.reaching_definitions.LiveDefinitions
attribute), 1161
property), 1041
Register(angr.analyses.data_dep.DepNodeTypes register_definitions
attribute), 1164
(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinregister (angr.analyses.disassembly.RegisterOperandproperty), 762
property), 1143
register_definitions
REGISTER (angr.analyses.reaching_definitions.AtomKind(angr.knowledge_plugins.key_definitions.LiveDefinitions
attribute), 1049
property), 740
REGISTER (angr.knowledge_plugins.key_definitions.atoms.AtomKind
register_function_analysis()
attribute), 750(angr.analyses.vfg.CallAnalysis
method),REGISTER (angr.knowledge_plugins.variables.variable_manager.VariableType1136
attribute), 728
register_instruction_reference()
REGISTER (angr.knowledge_plugins.variables.VariableType(angr.analyses.Reassembler method), 812
attribute), 727
register_instruction_reference()
Register (class in angr.analyses.disassembly), 1143
(angr.analyses.reassembler.Reassembler
Register (class in angr.analyses.reaching_definitions),
method), 1151
1051
register_kernel_types()(inmoduleRegister (class in angr.analyses.stack_pointer_tracker),angr.utils.library), 1195
1103
register_optimization_pass()(inmoduleRegister (class in angr.knowledge_plugins.key_definitions.atoms), angr.analyses.decompiler.optimization_passes),753
974
register() (angr.analyses.reaching_definitions.Atom register_option() (angr.sim_state_options.SimStateOptions
static method), 1050
class method), 226register() (angr.knowledge_plugins.key_definitions.atoms.Atomregister_pcode_arch_default_cc() (in module
static method), 752
angr.engines.pcode), 561
register() (angr.utils.mp.Initializer method), 1198
register_pcode_arch_default_cc() (in module
register_analysis() (in module angr), 174
angr.engines.pcode.cc), 595
register_analysis() (in module angr.analyses), 787 register_plugin() (angr.knowledge_base.KnowledgeBase
register_bool_option()
method), 655(angr.sim_state_options.SimStateOptions
register_plugin() (angr.KnowledgeBase method),class method), 226
207
register_callbacks()
register_plugin()(angr.misc.plugins.PluginHub(angr.analyses.variable_recovery.variable_recovery.VariableRecoveryState
method), 218
Index

1363

angr

register_plugin() (angr.misc.plugins.PluginVendor(angr.knowledge_plugins.Function attribute),
method), 219
658
register_plugin() (angr.sim_state.SimState method), registers_read_afterwards
221(angr.knowledge_plugins.functions.Function
register_plugin() (angr.SimState method), 178
attribute), 706
register_preset()(angr.misc.plugins.PluginHub registers_read_afterwards
class method), 218(angr.knowledge_plugins.functions.function.Function
register_region (angr.knowledge_plugins.variables.variable_manager.LiveVariables
attribute), 717
attribute), 728
registers_read_afterwards
register_syscall_cc()(inmodule(angr.knowledge_plugins.functions.soot_function.SootFunction
angr.calling_conventions), 633
attribute), 725
register_types() (in module angr.sim_type), 652
RegisterSaveAreaSimplifier(classinregister_uses (angr.analyses.reaching_definitions.LiveDefinitions angr.analyses.decompiler.optimization_passes),
attribute), 1041
966
register_uses (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
RegisterSaveAreaSimplifier(classinproperty), 1093
angr.analyses.decompiler.optimization_passes.register_save_area
register_uses (angr.analyses.reaching_definitions.ReachingDefinitionsState
984
property), 1062
RegisterValue(classinregister_uses (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
angr.state_plugins.unicorn_engine), 350
attribute), 762
RegOffsetAnnotation(classinregister_uses (angr.knowledge_plugins.key_definitions.LiveDefinitions
angr.analyses.cfg.indirect_jump_resolvers.jumptable),
attribute), 740
900
register_values (angr.state_plugins.unicorn_engine.BlockDetails
regs (angr.analyses.stack_pointer_tracker.FrozenStackPointerTrackerState
attribute), 351
attribute), 1104
register_values_countregs (angr.analyses.stack_pointer_tracker.StackPointerTrackerState(angr.state_plugins.unicorn_engine.BlockDetails
attribute), 1104
attribute), 351
regs (angr.sim_state.SimState attribute), 220register_variable() (angr.state_plugins.SimSolver regs (angr.SimState attribute), 177
method), 243
regs (angr.slicer.SimLightState attribute), 1168
register_variable()regs_to_initialize (angr.analyses.cfg.indirect_jump_resolvers.jumptab(angr.state_plugins.solver.SimSolver method),attribute), 900
321
rehook_symbol() (angr.Project method), 156
RegisterInitializerHook(classin rehook_symbol() (angr.project.Project method), 211
angr.analyses.cfg.indirect_jump_resolvers.jumptable),
ReinterpretAs(classin902
angr.analyses.typehoon.typevars), 1126
RegisterOffset (class in angr.engines.light), 1031
related_function_addr
RegisterOffset (class in angr.engines.light.data), 1031
(angr.storage.memory_mixins.MemoryRegionMetaMixin
RegisterOperand (class in angr.analyses.disassembly),
property), 4401143
related_function_addr
RegisterReallocation(classin(angr.storage.memory_mixins.regioned_memory.MemoryRegionM
angr.analyses.binary_optimizer), 1154
property), 482
registers (angr.analyses.reaching_definitions.LiveDefinitions
related_function_addr
attribute), 1041
(angr.storage.memory_mixins.regioned_memory.region_meta_mix
registers (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
property), 491
property), 1093
related_function_address
registers (angr.analyses.reaching_definitions.ReachingDefinitionsState(angr.storage.memory_mixins.regioned_memory.region_data.Reg
property), 1062
attribute), 488
registers (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
relativize() (angr.storage.memory_mixins.regioned_memory.region_dat
attribute), 762
method), 489
registers (angr.knowledge_plugins.key_definitions.LiveDefinitions
release() (angr.SimHeapBrk method), 200
attribute), 740
release() (angr.state_plugins.heap.heap_brk.SimHeapBrk
registers (angr.sim_state.SimState attribute), 220
method), 372
registers (angr.SimState attribute), 177
release()(angr.state_plugins.heap.SimHeapBrk
registers_read_afterwards
method), 365
1364

Index

angr

release() (angr.state_plugins.SimHeapBrk method), Relocation (class in angr.analyses.reassembler), 1150
285
relocations (angr.analyses.Reassembler property), 811
release_plugin() (angr.knowledge_base.KnowledgeBaserelocations (angr.analyses.reassembler.Reassembler
method), 655
property), 1150
release_plugin() (angr.KnowledgeBase method), 207 remove()(angr.sim_state_options.SimStateOptions
release_plugin()(angr.misc.plugins.PluginHub
method), 225
method), 219
remove_breakpoint()
release_plugin() (angr.misc.plugins.PluginVendor(angr.state_plugins.inspect.SimInspector
method), 219
method), 301
release_shared() (angr.storage.memory_mixins.paged_memory.pages.refcount_mixin.RefcountMixin
remove_breakpoint()
method), 474(angr.state_plugins.SimInspector
method),release_shared() (angr.storage.memory_mixins.paged_memory.pages.RefcountMixin
232
method), 466
remove_cgc_attachments()
release_shared() (angr.storage.memory_mixins.RefcountMixin (angr.analyses.Reassembler method), 813
method), 429
remove_cgc_attachments()
reload_analyses()(angr.analyses.AnalysesHub(angr.analyses.reassembler.Reassembler
method), 787
method), 1152
reload_analyses() (angr.analyses.analysis.AnalysesHub remove_claripy_bool_asts()
method), 832(angr.analyses.decompiler.condition_processor.ConditionProcess
reload_format() (angr.analyses.disassembly.Instruction
method), 954
method), 1142
remove_cycles() (angr.analyses.cfg.cfg_emulated.CFGEmulated
reload_solver()(angr.state_plugins.SimSolver
method), 879
method), 242
remove_cycles()(angr.analyses.cfg.CFGEmulated
reload_solver() (angr.state_plugins.solver.SimSolver
method), 863
method), 320
remove_cycles()(angr.analyses.CFGEmulated
reload_variable_types()
method), 794(angr.analyses.decompiler.CStructuredCodeGenerator
remove_edge() (angr.analyses.cfg.cfg_base.CFGBasemethod), 942
method), 883
reload_variable_types()
remove_edge() (angr.analyses.cfg.CFGBase method),(angr.analyses.decompiler.structured_codegen.base.BaseStructuredCodeGenerator
873
method), 1002
remove_empty_nodes()reload_variable_types()(angr.analyses.decompiler.Clinic
static(angr.analyses.decompiler.structured_codegen.BaseStructuredCodeGenerator
method), 944
method), 997
remove_empty_nodes()reload_variable_types()(angr.analyses.decompiler.clinic.Clinic static(angr.analyses.decompiler.structured_codegen.c.CStructuredCodeGenerator
method), 953
method), 1018
remove_fakerets() (angr.analyses.cfg.cfg_emulated.CFGEmulated
reload_variable_types()
method), 880(angr.analyses.decompiler.structured_codegen.CStructuredCodeGenerator
remove_fakerets() (angr.analyses.cfg.CFGEmulated
method), 999
method), 864
relocatable (angr.analyses.cfg.indirect_jump_resolvers.jumptable.RegOffsetAnnotation
remove_fakerets()(angr.analyses.CFGEmulated
property), 901
method), 795
relocatable (angr.analyses.data_dep.data_dependency_analysis.NodalAnnotation
remove_instruction() (angr.analyses.Reassembler
property), 1159
method), 813
relocatable (angr.analyses.variable_recovery.annotations.StackLocationAnnotation
remove_instruction()
property), 1106
(angr.analyses.reassembler.Reassembler
relocatable (angr.analyses.variable_recovery.annotations.VariableSourceAnnotation
method), 1152
property), 1106
remove_labels()(inmodulerelocatable (angr.analyses.variable_recovery.variable_recovery_base.VariableAnnotation
angr.analyses.decompiler.utils), 1022
property), 1107
remove_last_statement()(inmodulerelocatable (angr.knowledge_plugins.key_definitions.live_definitions.DefinitionAnnotation
angr.analyses.decompiler.utils), 1020
property), 760
remove_node() (angr.analyses.decompiler.structuring.structurer_nodes.Se
relocateable (angr.storage.memory_mixins.address_concretization_mixin.MultiwriteAnnotation
method), 934
property), 451
remove_node() (angr.knowledge_plugins.cfg.cfg_model.CFGModel
Index

1365

angr

method), 689
render() (angr.analyses.Disassembly method), 815
remove_node() (angr.knowledge_plugins.cfg.CFGModel render()(angr.analyses.disassembly.Disassembly
method), 683
method), 1145
remove_node_and_graph_node()
render() (angr.analyses.disassembly.DisassemblyPiece(angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 1141
method), 694
render_text() (angr.analyses.decompiler.CStructuredCodeGenerator
remove_node_and_graph_node()
method), 941(angr.knowledge_plugins.cfg.CFGModel
render_text() (angr.analyses.decompiler.structured_codegen.c.CStructur
method), 687
method), 1018
remove_patch() (angr.knowledge_plugins.patches.PatchManager
render_text() (angr.analyses.decompiler.structured_codegen.CStructured
method), 674
method), 999
remove_patch() (angr.knowledge_plugins.PatchManager RENDER_TYPE (angr.analyses.decompiler.CStructuredCodeGenerator
method), 669
attribute), 941
remove_preconstraints()
RENDER_TYPE (angr.analyses.decompiler.structured_codegen.c.CStructured(angr.state_plugins.preconstrainer.SimStatePreconstrainer attribute), 1017
method), 349
RENDER_TYPE (angr.analyses.decompiler.structured_codegen.CStructuredC
remove_preconstraints()
attribute), 999(angr.state_plugins.SimStatePreconstrainer
RepHook (class in angr.exploration_techniques.tracer),method), 272
531
remove_technique() (angr.sim_manager.SimulationManager
replace()(angr.analyses.typehoon.typevars.Add
method), 500
method), 1123
remove_technique()(angr.SimulationManager replace() (angr.analyses.typehoon.typevars.DerivedTypeVariable
method), 169
method), 1125
remove_types() (angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
replace() (angr.analyses.typehoon.typevars.Existence
method), 733
method), 1122
remove_unnecessary_stuff()
replace()(angr.analyses.typehoon.typevars.Sub(angr.analyses.Reassembler method), 813
method), 1123
remove_unnecessary_stuff()
replace()(angr.analyses.typehoon.typevars.Subtype(angr.analyses.reassembler.Reassembler
method), 1123
method), 1152
replace() (angr.keyed_region.KeyedRegion method),remove_unnecessary_stuff_glibc()
782(angr.analyses.Reassembler method), 814
replace() (angr.procedures.stubs.format_parser.FormatString
remove_unnecessary_stuff_glibc()
method), 603(angr.analyses.reassembler.Reassembler
replace_all() (angr.storage.memory_mixins.convenient_mappings_mixin
method), 1152
method), 455
remove_use() (angr.knowledge_plugins.key_definitions.Uses
replace_all() (angr.storage.memory_mixins.ConvenientMappingsMixin
method), 748
method), 417
remove_use() (angr.knowledge_plugins.key_definitions.uses.Uses
replace_all() (angr.storage.memory_mixins.regioned_memory.regioned_
method), 774
method), 487
remove_uses() (angr.knowledge_plugins.key_definitions.Uses
replace_all() (angr.storage.memory_mixins.regioned_memory.Regioned
method), 749
method), 481
remove_uses() (angr.knowledge_plugins.key_definitions.uses.Uses
replace_all() (angr.storage.memory_mixins.RegionedMemoryMixin
method), 774
method), 439
remove_variable() (angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILState
replace_all_with_offsets()
method), 982(angr.storage.memory_mixins.paged_memory.pages.ultra_page.U
remove_variable_by_atom()method), 479(angr.knowledge_plugins.variables.variable_manager.VariableManagerInternal
replace_all_with_offsets()
method), 729(angr.storage.memory_mixins.paged_memory.pages.UltraPage
RemoveNodeNotice, 949
method), 473
rename()(angr.knowledge_plugins.types.TypesStore replace_all_with_offsets()
method), 701(angr.storage.memory_mixins.UltraPage
rename() (angr.knowledge_plugins.TypesStore method),
method), 436
672
replace_last_statement()(inmodulerenamed (angr.sim_variable.SimVariable attribute), 634
angr.analyses.decompiler.utils), 1020
1366

Index

angr

replace_node_in_node()
reset_initial_regs() (angr.Block static method),(angr.analyses.decompiler.structuring.structurer_base.StructurerBase
166
static method), 938
reset_initial_regs()(angr.block.Blockstaticreplace_nodes() (angr.analyses.decompiler.structuring.structurer_base.StructurerBase
method), 217
static method), 938
reset_prototype() (angr.analyses.reaching_definitions.function_handler
replace_region() (angr.analyses.decompiler.graph_region.GraphRegion
method), 1086
method), 960
reset_prototype() (angr.analyses.reaching_definitions.FunctionCallDat
replace_region_with_region()
method), 1071
(angr.analyses.decompiler.graph_region.GraphRegion
reset_uses() (angr.analyses.reaching_definitions.LiveDefinitions
method), 960
method), 1042
replacements (angr.analyses.propagator.propagator.PropagatorAnalysis
reset_uses() (angr.knowledge_plugins.key_definitions.live_definitions.Liv
property), 1040
method), 762
replacements (angr.analyses.propagator.PropagatorAnalysis
reset_uses() (angr.knowledge_plugins.key_definitions.LiveDefinitions
property), 1034
method), 740
replacements (angr.analyses.PropagatorAnalysis prop- resilient (angr.analyses.stack_pointer_tracker.FrozenStackPointerTrackeerty), 789
attribute), 1104
replacements(angr.analyses.SPropagatorAnalysis resilient (angr.analyses.stack_pointer_tracker.StackPointerTrackerState
property), 831
attribute), 1104
replacements (angr.knowledge_plugins.propagations.PropagationModel
resolvable (angr.state_plugins.debug_variables.SimDebugVariable
attribute), 702
property), 381
report()(angr.exploration_techniques.Suggestions resolvable(angr.state_plugins.SimDebugVariable
static method), 524
property), 297
report() (angr.exploration_techniques.suggestions.Suggestions
resolvable (angr.state_plugins.SimMemView propstatic method), 543erty), 279
repr_addr() (in module angr.codenode), 1170
resolvable(angr.state_plugins.view.SimMemView
request_knowledge()
property), 390(angr.knowledge_base.KnowledgeBase
resolve() (angr.analyses.cfg.indirect_jump_resolvers.amd64_elf_got.AMD
method), 655
method), 894
request_knowledge() (angr.KnowledgeBase method), resolve() (angr.analyses.cfg.indirect_jump_resolvers.AMD64ElfGotResol207
method), 910
request_plugin()(angr.misc.plugins.PluginPreset resolve() (angr.analyses.cfg.indirect_jump_resolvers.AMD64PeIatResolve
method), 219
method), 912
REQUIRE_CFG_STATES (angr.exploration_techniques.CallFunctionGoal
resolve() (angr.analyses.cfg.indirect_jump_resolvers.arm_elf_fast.ArmEl
attribute), 517
method), 895
REQUIRE_CFG_STATES (angr.exploration_techniques.director.BaseGoal
resolve() (angr.analyses.cfg.indirect_jump_resolvers.ArmElfFastResolver
attribute), 535
method), 911
REQUIRE_CFG_STATES (angr.exploration_techniques.director.CallFunctionGoal
resolve() (angr.analyses.cfg.indirect_jump_resolvers.const_resolver.Cons
attribute), 536
method), 904
REQUIRE_DATA_C(angr.engines.pcode.lifter.Lifter resolve() (angr.analyses.cfg.indirect_jump_resolvers.ConstantResolver
attribute), 568
method), 912
REQUIRE_DATA_PY (angr.engines.pcode.lifter.Lifter at- resolve() (angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTabl
tribute), 568
method), 903
reraise() (angr.sim_manager.ErrorRecord method), resolve() (angr.analyses.cfg.indirect_jump_resolvers.JumpTableResolver
505
method), 908
reset() (angr.analyses.forward_analysis.SingleNodeGraphVisitor
resolve() (angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.MipsE
method), 838
method), 897
reset() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor
resolve() (angr.analyses.cfg.indirect_jump_resolvers.MipsElfFastResolve
method), 846
method), 906
reset() (angr.analyses.forward_analysis.visitors.single_node_graph.SingleNodeGraphVisitor
resolve() (angr.analyses.cfg.indirect_jump_resolvers.MipsElfGotResolver
method), 848
method), 906
reset() (angr.analyses.forward_analysis.visitors.SingleNodeGraphVisitor
resolve() (angr.analyses.cfg.indirect_jump_resolvers.resolver.IndirectJum
method), 843
method), 905
reset() (angr.state_plugins.unicorn_engine.Uniwrapper resolve() (angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt.X86
method), 354
method), 898
Index

1367

angr

resolve() (angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat.X86PeIatResolver
restore_graph() (angr.analyses.decompiler.optimization_passes.Lowered
method), 896
static method), 963
resolve() (angr.analyses.cfg.indirect_jump_resolvers.X86ElfPicPltResolver
result (angr.analyses.decompiler.ccall_rewriters.rewriter_base.CCallRew
method), 907
attribute), 950
resolve() (angr.analyses.cfg.indirect_jump_resolvers.X86PeIatResolver
RESUME (angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.Case2Res
method), 909
attribute), 897
resolve_abstract_dispatch()
resume() (angr.analyses.cfg.cfg_emulated.CFGEmulated(angr.analyses.soot_class_hierarchy.SootClassHierarchy method), 879
method), 857
resume() (angr.analyses.cfg.CFGEmulated method),resolve_abstract_dispatch()863(angr.analyses.SootClassHierarchy method), resume() (angr.analyses.CFGEmulated method), 794
826
resume_with_new_graph()resolve_concrete_dispatch()(angr.analyses.forward_analysis.FunctionGraphVisitor(angr.analyses.soot_class_hierarchy.SootClassHierarchy method), 836
method), 857
resume_with_new_graph()resolve_concrete_dispatch()(angr.analyses.forward_analysis.visitors.function_graph.Function(angr.analyses.SootClassHierarchy method),
method), 844
826
resume_with_new_graph()resolve_invoke() (angr.analyses.soot_class_hierarchy.SootClassHierarchy(angr.analyses.forward_analysis.visitors.FunctionGraphVisitor
method), 857
method), 841
resolve_invoke() (angr.analyses.SootClassHierarchy resymbolize()(angr.state_plugins.SimSymbolizer
method), 826
method), 296
resolve_register() (angr.state_plugins.light_registers.SimLightRegisters
resymbolize() (angr.state_plugins.symbolizer.SimSymbolizer
method), 332
method), 380
resolve_register() (angr.state_plugins.SimLightRegisters
ret() (angr.sim_procedure.SimProcedure method), 602
method), 250
ret() (angr.SimProcedure method), 150
resolve_special_dispatch()ret() (angr.state_plugins.CallStack method), 268(angr.analyses.soot_class_hierarchy.SootClassHierarchy
ret() (angr.state_plugins.callstack.CallStack method),
method), 857
331
resolve_special_dispatch()
ret_addr (angr.analyses.cfg.cfg_fast.FunctionCallEdge(angr.analyses.SootClassHierarchy method),attribute), 887826
ret_atoms (angr.analyses.reaching_definitions.function_handler.FunctionC
resolved (angr.state_plugins.debug_variables.SimDebugVariable attribute), 1085
property), 381
ret_atoms (angr.analyses.reaching_definitions.FunctionCallData
resolved (angr.state_plugins.SimDebugVariable propattribute), 1071
erty), 297
ret_defns (angr.analyses.reaching_definitions.dep_graph.FunctionCallRe
resolved (angr.state_plugins.SimMemView property),
attribute), 1079
279
ret_errno()(angr.state_plugins.libc.SimStateLibc
resolved (angr.state_plugins.view.SimMemView propmethod), 306erty), 390
ret_errno() (angr.state_plugins.SimStateLibc method),resolved_indirect_jumps
232(angr.knowledge_base.KnowledgeBase prop- ret_expr (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
erty), 655
attribute), 1008
resolved_indirect_jumps(angr.KnowledgeBase ret_from_addr (angr.analyses.cfg.cfg_fast.FunctionReturnEdge
property), 207
attribute), 887
resolved_targets (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump
ret_sites (angr.knowledge_plugins.Function property),
attribute), 701
660
resolved_targets (angr.knowledge_plugins.cfg.IndirectJump
ret_sites (angr.knowledge_plugins.functions.Function
attribute), 681
property), 708
resource_event() (in module angr.state_plugins), 266 ret_sites (angr.knowledge_plugins.functions.function.Function
resource_event()(inmoduleproperty), 720
angr.state_plugins.sim_event), 598
ret_target (angr.analyses.cfg.cfg_fast.CFGJob atrestore_graph() (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.LoweredSwitchSimplifier
tribute), 889
static method), 981
ret_to_addr (angr.analyses.cfg.cfg_fast.FunctionReturnEdge
1368

Index

angr

attribute), 887
attribute), 623
ret_values (angr.analyses.reaching_definitions.function_handler.FunctionCallData
RETURN_ADDR (angr.calling_conventions.SimCCMicrosoftFastcall
attribute), 1085
attribute), 623
ret_values (angr.analyses.reaching_definitions.FunctionCallData
RETURN_ADDR (angr.calling_conventions.SimCCN64 atattribute), 1071
tribute), 629
ret_values_deps (angr.analyses.reaching_definitions.function_handler.FunctionCallData
RETURN_ADDR (angr.calling_conventions.SimCCN64LinuxSyscall
attribute), 1085
attribute), 629
ret_values_deps (angr.analyses.reaching_definitions.FunctionCallData
RETURN_ADDR (angr.calling_conventions.SimCCO32 atattribute), 1071
tribute), 628
retaddr_on_stack (angr.knowledge_plugins.Function RETURN_ADDR (angr.calling_conventions.SimCCO32LinuxSyscall
attribute), 658
attribute), 629
retaddr_on_stack (angr.knowledge_plugins.functions.Function
RETURN_ADDR (angr.calling_conventions.SimCCPowerPC
attribute), 705
attribute), 630
retaddr_on_stack (angr.knowledge_plugins.functions.function.Function
RETURN_ADDR (angr.calling_conventions.SimCCPowerPC64
attribute), 717
attribute), 630
retaddr_on_stack (angr.knowledge_plugins.functions.soot_function.SootFunction
RETURN_ADDR (angr.calling_conventions.SimCCPowerPC64LinuxSyscall
attribute), 725
attribute), 631
retaddr_popped (angr.analyses.reaching_definitions.function_handler.FunctionCallData
RETURN_ADDR (angr.calling_conventions.SimCCPowerPCLinuxSyscall
attribute), 1085
attribute), 630
retaddr_popped (angr.analyses.reaching_definitions.FunctionCallData
RETURN_ADDR (angr.calling_conventions.SimCCRISCV64LinuxSyscall
attribute), 1071
attribute), 628
RetAddrSaveSimplifier(classin RETURN_ADDR (angr.calling_conventions.SimCCS390X
angr.analyses.decompiler.optimization_passes),
attribute), 632
966
RETURN_ADDR (angr.calling_conventions.SimCCS390XLinuxSyscall
RetAddrSaveSimplifier(classin
attribute), 632
angr.analyses.decompiler.optimization_passes.ret_addr_save_simplifier),
RETURN_ADDR (angr.calling_conventions.SimCCSystemVAMD64
984
attribute), 625
retout_sites (angr.knowledge_plugins.Function prop- RETURN_ADDR (angr.calling_conventions.SimCCX86LinuxSyscallerty), 661
attribute), 624
retout_sites (angr.knowledge_plugins.functions.FunctionRETURN_ADDR (angr.calling_conventions.SimCCX86WindowsSyscall
property), 708
attribute), 625
retout_sites (angr.knowledge_plugins.functions.function.Function
RETURN_ADDR (angr.engines.pcode.cc.SimCCM68k atproperty), 720
tribute), 593
RETURN_ADDR (angr.calling_conventions.SimCC at- RETURN_ADDR (angr.engines.pcode.cc.SimCCPARISC attribute), 618
tribute), 594
return_addr (angr.calling_conventions.SimCC prop- RETURN_ADDR (angr.engines.pcode.cc.SimCCPowerPCerty), 620
attribute), 594
RETURN_ADDR (angr.calling_conventions.SimCCAArch64 RETURN_ADDR (angr.engines.pcode.cc.SimCCRISCV atattribute), 627
tribute), 593
RETURN_ADDR (angr.calling_conventions.SimCCAArch64LinuxSyscall
RETURN_ADDR (angr.engines.pcode.cc.SimCCSH4 atattribute), 628
tribute), 594
RETURN_ADDR (angr.calling_conventions.SimCCAMD64LinuxSyscall
RETURN_ADDR (angr.engines.pcode.cc.SimCCSPARC atattribute), 626
tribute), 594
RETURN_ADDR (angr.calling_conventions.SimCCAMD64WindowsSyscall
RETURN_ADDR (angr.engines.pcode.cc.SimCCXtensa atattribute), 626
tribute), 595
RETURN_ADDR (angr.calling_conventions.SimCCARM at- RETURN_ADDR (angr.SimCC attribute), 181
tribute), 626
return_addr (angr.SimCC property), 182
RETURN_ADDR (angr.calling_conventions.SimCCARMHF return_in_implicit_outparam()
attribute), 627(angr.calling_conventions.SimCC
method),RETURN_ADDR (angr.calling_conventions.SimCCARMLinuxSyscall 619
attribute), 627
return_in_implicit_outparam()
RETURN_ADDR (angr.calling_conventions.SimCCCdecl(angr.calling_conventions.SimCCCdecl
attribute), 622
method), 622
RETURN_ADDR (angr.calling_conventions.SimCCMicrosoftAMD64
return_in_implicit_outparam()
Index

1369

angr

(angr.calling_conventions.SimCCMicrosoftAMD64
RETURN_VAL (angr.calling_conventions.SimCCRISCV64LinuxSyscall
method), 624
attribute), 628
return_in_implicit_outparam()
RETURN_VAL (angr.calling_conventions.SimCCS390X at(angr.calling_conventions.SimCCSystemVAMD64
tribute), 632
method), 625
RETURN_VAL (angr.calling_conventions.SimCCS390XLinuxSyscall
return_in_implicit_outparam()(angr.SimCC
attribute), 632
method), 182
RETURN_VAL (angr.calling_conventions.SimCCSystemVAMD64
return_target (angr.knowledge_plugins.cfg.cfg_node.CFGENode attribute), 625
attribute), 699
RETURN_VAL (angr.calling_conventions.SimCCX86LinuxSyscall
return_target (angr.knowledge_plugins.cfg.CFGENode
attribute), 624
attribute), 680
RETURN_VAL (angr.calling_conventions.SimCCX86WindowsSyscall
return_to (angr.analyses.cfg.cfg_fast.FunctionReturn
attribute), 625
attribute), 885
RETURN_VAL (angr.engines.pcode.cc.SimCCM68k atreturn_type (angr.sim_procedure.SimProcedure proptribute), 593erty), 603
RETURN_VAL (angr.engines.pcode.cc.SimCCPARISC atreturn_type (angr.SimProcedure property), 151
tribute), 594
RETURN_VAL(angr.calling_conventions.SimCC
at- RETURN_VAL (angr.engines.pcode.cc.SimCCPowerPC attribute), 618
tribute), 594
RETURN_VAL (angr.calling_conventions.SimCCAArch64 RETURN_VAL(angr.engines.pcode.cc.SimCCRISCV
attribute), 627
attribute), 593
RETURN_VAL (angr.calling_conventions.SimCCAArch64LinuxSyscall
RETURN_VAL (angr.engines.pcode.cc.SimCCSH4 atattribute), 628
tribute), 594
RETURN_VAL (angr.calling_conventions.SimCCAMD64LinuxSyscall
RETURN_VAL (angr.engines.pcode.cc.SimCCSPARC atattribute), 626
tribute), 594
RETURN_VAL (angr.calling_conventions.SimCCAMD64WindowsSyscall
RETURN_VAL(angr.engines.pcode.cc.SimCCXtensa
attribute), 626
attribute), 595
RETURN_VAL (angr.calling_conventions.SimCCARM at- RETURN_VAL (angr.SimCC attribute), 181
tribute), 626
return_val()(angr.calling_conventions.SimCC
RETURN_VAL (angr.calling_conventions.SimCCARMHF
method), 620
attribute), 627
return_val() (angr.calling_conventions.SimCCCdecl
RETURN_VAL (angr.calling_conventions.SimCCARMLinuxSyscall
method), 622
attribute), 627
return_val() (angr.calling_conventions.SimCCMicrosoftAMD64
RETURN_VAL (angr.calling_conventions.SimCCCdecl atmethod), 624
tribute), 622
return_val() (angr.calling_conventions.SimCCSystemVAMD64
RETURN_VAL (angr.calling_conventions.SimCCMicrosoftAMD64
method), 625
attribute), 623
return_val() (angr.calling_conventions.SimCCUsercall
RETURN_VAL (angr.calling_conventions.SimCCMicrosoftFastcall
method), 622
attribute), 623
return_val() (angr.SimCC method), 182
RETURN_VAL (angr.calling_conventions.SimCCN64 at- ReturnDeduplicator(classintribute), 629
angr.analyses.decompiler.optimization_passes),
RETURN_VAL (angr.calling_conventions.SimCCN64LinuxSyscall
967
attribute), 629
ReturnDuplicatorHigh(classin
RETURN_VAL (angr.calling_conventions.SimCCO32 atangr.analyses.decompiler.optimization_passes),tribute), 628
965
RETURN_VAL (angr.calling_conventions.SimCCO32LinuxSyscall
ReturnDuplicatorLow(classin
attribute), 629
angr.analyses.decompiler.optimization_passes),
RETURN_VAL (angr.calling_conventions.SimCCPowerPC
964
attribute), 630
returning (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
RETURN_VAL (angr.calling_conventions.SimCCPowerPC64
attribute), 1008
attribute), 630
returning (angr.knowledge_plugins.Function property),
RETURN_VAL (angr.calling_conventions.SimCCPowerPC64LinuxSyscall
658
attribute), 631
returning (angr.knowledge_plugins.functions.Function
RETURN_VAL (angr.calling_conventions.SimCCPowerPCLinuxSyscall property), 706
attribute), 630
returning (angr.knowledge_plugins.functions.function.Function
1370

Index

angr

property), 718
s2u() (in module angr.analyses.decompiler.optimization_passes.stack_cana
returning_source (angr.analyses.cfg.cfg_fast.CFGJob
977
attribute), 889
SAILRStructurer(classin
ReturnValueTag(classinangr.analyses.decompiler.structuring), 931
angr.knowledge_plugins.key_definitions.tag),satisfiable() (angr.sim_state.SimState method), 222
773
satisfiable() (angr.SimState method), 178
retval (angr.analyses.decompiler.structured_codegen.c.CReturnsatisfiable() (angr.state_plugins.SimSolver method),attribute), 1009
247
reverse_post_order_sort_nodes()satisfiable()(angr.state_plugins.solver.SimSolver(angr.utils.graph.GraphUtils static method),
method), 325
1194
save_info() (angr.angrdb.AngrDB static method), 916
revisit_node() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor
save_info() (angr.angrdb.db.AngrDB static method),
method), 847
918
revisit_successors()
SCANF_DELIMITERS (angr.procedures.stubs.format_parser.FormatString(angr.analyses.forward_analysis.visitors.graph.GraphVisitorattribute), 603
method), 847
ScanfFormatParser(classinrhs (angr.analyses.decompiler.structured_codegen.c.CAssignment angr.procedures.stubs.format_parser), 605
attribute), 1007
scc_id (angr.utils.graph.SCCPlaceholder attribute),rhs (angr.analyses.decompiler.structured_codegen.c.CBinaryOp
1193
attribute), 1013
SCCPlaceholder (class in angr.utils.graph), 1193
RichR (class in angr.analyses.variable_recovery.engine_base),
scratch (angr.sim_state.SimState attribute), 2211114
scratch (angr.SimState attribute), 177
RIGHT (angr.analyses.typehoon.simple_solver.ConstraintGraphTag
SDiv() (angr.state_plugins.sim_action_object.SimActionObject
attribute), 1118
method), 598
root (angr.analyses.typehoon.simple_solver.Sketch at- SDiv() (angr.state_plugins.SimActionObject method),
tribute), 1118
265
RShift (angr.engines.light.ArithmeticExpression at- se (angr.sim_state.SimState property), 221
tribute), 1031
se (angr.SimState property), 177
RShift (angr.engines.light.data.ArithmeticExpression section_alignment()(angr.analyses.Reassembler
attribute), 1030
method), 811
run() (angr.analyses.congruency_check.CongruencyCheck section_alignment()
method), 1153
(angr.analyses.reassembler.Reassembler
run() (angr.analyses.CongruencyCheck method), 810
method), 1150
run() (angr.analyses.Identifier method), 817
SecurityCookieInit (class in angr.simos.windows),
run()(angr.analyses.identifier.identify.Identifier
1184
method), 1130
seek() (angr.SimFileDescriptor method), 194
run() (angr.distributed.Server method), 1205
seek() (angr.SimFileDescriptorDuplex method), 197
run() (angr.distributed.server.Server method), 1206
seek() (angr.storage.file.SimFileDescriptor method),run() (angr.distributed.worker.Worker method), 1207
403
run()
(angr.exploration_techniques.tracer.RepHook seek()(angr.storage.file.SimFileDescriptorBase
method), 531
method), 402
run() (angr.Server method), 206seek()(angr.storage.file.SimFileDescriptorDuplex
run() (angr.sim_manager.SimulationManager method),
method), 406
501
seekable (angr.SimFileBase attribute), 184run() (angr.sim_procedure.SimProcedure method), 602 seekable (angr.storage.file.SimFileBase attribute), 392
run() (angr.SimProcedure method), 149
seekable (angr.storage.file.SimPacketsSlots attribute),
run() (angr.SimulationManager method), 169408
run_pelf() (in module angr.flirt.build_sig), 1188
SegfaultError, 354
run_sigmake() (in module angr.flirt.build_sig), 1188
Segment (class in angr.storage.memory_mixins.regioned_memory.region_m
490
S
SegmentBoundary (angr.knowledge_plugins.cfg.memory_data.MemoryDat
attribute), 695
s2u() (in module angr.analyses.decompiler.optimization_passes.register_save_area_simplifier),
SegmentBoundary(angr.knowledge_plugins.cfg.MemoryDataSort
984
attribute), 676
Index

1371

angr

segments (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.AbstractLocation
method), 682
property), 491
serialize_to_cmessage()selector() (angr.exploration_techniques.ExplorationTechnique(angr.knowledge_plugins.cfg.CFGNodemethod), 507
method), 679
selector() (angr.ExplorationTechnique method), 175
serialize_to_cmessage()selector()(angr.sim_manager.SimulationManager(angr.knowledge_plugins.cfg.memory_data.MemoryData
method), 502
method), 696
selector() (angr.SimulationManager method), 170
serialize_to_cmessage()seq (angr.analyses.disassembly.IROp attribute), 1142
(angr.knowledge_plugins.cfg.MemoryData
SeqNodeDephication(classinmethod), 677
angr.analyses.decompiler), 947
serialize_to_cmessage()sequence_matcher_similarity()(angr.knowledge_plugins.Function
method),(angr.exploration_techniques.unique.UniqueSearch
660
static method), 540
serialize_to_cmessage()sequence_matcher_similarity()(angr.knowledge_plugins.functions.Function(angr.exploration_techniques.UniqueSearchmethod), 707
static method), 520
serialize_to_cmessage()sequence_node (angr.analyses.decompiler.structuring.structurer_nodes.LoopNode(angr.knowledge_plugins.functions.function.Function
attribute), 936
method), 719
sequence_to_blocks()(inmodule serialize_to_cmessage()angr.analyses.decompiler.utils), 1024
(angr.knowledge_plugins.variables.variable_access.VariableAcce
sequence_to_statements()(inmodulemethod), 727
angr.analyses.decompiler.utils), 1024
serialize_to_cmessage()
SequenceNode(classin(angr.knowledge_plugins.variables.variable_manager.VariableMa
angr.analyses.decompiler.structuring.structurer_nodes), method), 728
933
serialize_to_cmessage()
SequenceOptimizationPass(classin(angr.knowledge_plugins.XRefManager
angr.analyses.decompiler.optimization_passes.optimization_pass),
method), 668
976
serialize_to_cmessage()
SequenceWalker(classin(angr.knowledge_plugins.xrefs.XRef method),angr.analyses.decompiler.sequence_walker),
776
996
serialize_to_cmessage()
Serializable (class in angr.serializable), 784(angr.knowledge_plugins.xrefs.xref.XRef
SerializableCounter(classinmethod), 778
angr.calling_conventions), 614
serialize_to_cmessage()
SerializableIterator(classin(angr.knowledge_plugins.xrefs.xref_manager.XRefManager
angr.calling_conventions), 614
method), 779
SerializableListIterator(classin serialize_to_cmessage()angr.calling_conventions), 614(angr.knowledge_plugins.xrefs.XRefManager
serialize() (angr.knowledge_plugins.functions.function_parser.FunctionParser
method), 777
static method), 724
serialize_to_cmessage()serialize() (angr.serializable.Serializable method),(angr.serializable.Serializable method), 784
784
serialize_to_cmessage()serialize_to_cmessage() (angr.Block method), 166(angr.sim_variable.SimMemoryVariable
serialize_to_cmessage()(angr.block.Blockmethod), 636
method), 217
serialize_to_cmessage()serialize_to_cmessage()(angr.sim_variable.SimRegisterVariable(angr.knowledge_plugins.cfg.cfg_model.CFGModel
method), 635
method), 689
serialize_to_cmessage()serialize_to_cmessage()(angr.sim_variable.SimStackVariable method),(angr.knowledge_plugins.cfg.cfg_node.CFGNode637
method), 698
serialize_to_cmessage()serialize_to_cmessage()(angr.sim_variable.SimTemporaryVariable(angr.knowledge_plugins.cfg.CFGModel
method), 635
1372

Index

angr

Server (class in angr), 206
set_fwd_chunk()(angr.state_plugins.PTChunk
Server (class in angr.distributed), 1204
method), 290
Server (class in angr.distributed.server), 1205
set_heap() (angr.state_plugins.GDB method), 258
session_scope() (angr.angrdb.AngrDB static method), set_heap() (angr.state_plugins.gdb.GDB method), 336
916
set_initial_regs() (angr.Block method), 166
session_scope() (angr.angrdb.db.AngrDB static set_initial_regs() (angr.block.Block method), 217
method), 918
set_last_block_details()
set() (angr.knowledge_plugins.key_definitions.environment.Environment(angr.state_plugins.Unicorn method), 262
method), 758
set_last_block_details()
set_abi_cc() (angr.procedures.definitions.SimSyscallLibrary(angr.state_plugins.unicorn_engine.Unicorn
method), 611
method), 356
set_alloc_depth() (angr.state_plugins.SimUCManager set_last_statement() (angr.annocfg.AnnotatedCFG
method), 260
method), 1169
set_alloc_depth() (angr.state_plugins.uc_manager.SimUCManager
set_library_names()
method), 345(angr.procedures.definitions.SimLibrary
set_args()(angr.sim_procedure.SimProcedure
method), 606
method), 602
set_live_variables()set_args() (angr.SimProcedure method), 150(angr.knowledge_plugins.variables.variable_manager.VariableMa
set_base_state() (angr.callable.Callable method),
method), 729
654
set_manager() (angr.knowledge_plugins.variables.variable_manager.Vari
set_bck_chunk() (angr.PTChunk method), 205
method), 728
set_bck_chunk() (angr.state_plugins.heap.heap_freelist.Chunk
set_mode() (angr.sim_state.SimState method), 223
method), 374
set_mode() (angr.SimState method), 180
set_bck_chunk() (angr.state_plugins.heap.heap_ptmalloc.PTChunk
set_names() (angr.procedures.definitions.SimTypeCollection
method), 377
method), 605
set_bck_chunk() (angr.state_plugins.heap.PTChunk set_non_returning()
method), 370(angr.procedures.definitions.SimLibrary
set_bck_chunk()(angr.state_plugins.PTChunkmethod), 606
method), 291
set_object()(angr.keyed_region.KeyedRegion
set_brk()(angr.state_plugins.posix.SimSystemPosix
method), 783
method), 311
set_object()(angr.keyed_region.RegionObject
set_brk() (angr.state_plugins.SimSystemPosix method),
method), 781
239
set_prev_freeness() (angr.PTChunk method), 205
set_c_prototype() (angr.procedures.definitions.SimLibrary
set_prev_freeness()method), 607(angr.state_plugins.heap.heap_ptmalloc.PTChunk
set_data() (angr.state_plugins.GDB method), 259
method), 376
set_data() (angr.state_plugins.gdb.GDB method), 337 set_prev_freeness()
set_default_cc() (angr.procedures.definitions.SimLibrary(angr.state_plugins.heap.PTChunkmethod),method), 606369
set_entry_register_values()
set_prev_freeness() (angr.state_plugins.PTChunk(angr.simos.linux.SimLinux method), 1182
method), 290
set_entry_register_values()
set_prototype() (angr.knowledge_plugins.callsite_prototypes.CallsitePro(angr.simos.SimLinux method), 1175
method), 675
set_fd_data()(angr.exploration_techniques.Tracer set_prototype() (angr.knowledge_plugins.CallsitePrototypes
method), 511
method), 672
set_fd_data() (angr.exploration_techniques.tracer.Tracerset_prototype() (angr.procedures.definitions.SimLibrarymethod), 532
method), 607
set_fwd_chunk() (angr.PTChunk method), 205
set_prototype() (angr.procedures.definitions.SimSyscallLibrary
set_fwd_chunk() (angr.state_plugins.heap.heap_freelist.Chunkmethod), 611
method), 374
set_prototypes() (angr.procedures.definitions.SimLibrary
set_fwd_chunk() (angr.state_plugins.heap.heap_ptmalloc.PTChunkmethod), 607
method), 376
set_prototypes() (angr.procedures.definitions.SimSyscallLibrary
set_fwd_chunk() (angr.state_plugins.heap.PTChunkmethod), 611
method), 370
set_regs() (angr.state_plugins.GDB method), 259
Index

1373

angr

set_regs() (angr.state_plugins.gdb.GDB method), 337 set_state() (angr.state_plugins.filesystem.SimConcreteFilesystem
set_regs() (angr.state_plugins.Unicorn method), 262
method), 318
set_regs() (angr.state_plugins.unicorn_engine.Unicorn set_state() (angr.state_plugins.filesystem.SimFilesystem
method), 356
method), 315
set_return_val() (angr.calling_conventions.SimCC set_state() (angr.state_plugins.globals.SimStateGlobals
method), 620
method), 343
set_return_val() (angr.calling_conventions.SimCCSyscall
set_state() (angr.state_plugins.inspect.SimInspector
method), 624
method), 302
set_return_val() (angr.SimCC method), 182
set_state() (angr.state_plugins.light_registers.SimLightRegisters
set_simgr() (angr.analyses.congruency_check.CongruencyCheck method), 332
method), 1153
set_state() (angr.state_plugins.plugin.SimStatePlugin
set_simgr()(angr.analyses.CongruencyCheck
method), 298
method), 810
set_state() (angr.state_plugins.posix.SimSystemPosix
set_size() (angr.PTChunk method), 204
method), 311
set_size() (angr.sim_type.SimTypeRef method), 652
set_state()(angr.state_plugins.SimFilesystem
set_size() (angr.state_plugins.heap.heap_freelist.Chunkmethod), 281
method), 373
set_state() (angr.state_plugins.SimInspector method),
set_size() (angr.state_plugins.heap.heap_ptmalloc.PTChunk234
method), 375
set_state()(angr.state_plugins.SimLightRegisters
set_size()(angr.state_plugins.heap.PTChunkmethod), 250
method), 369
set_state()(angr.state_plugins.SimMemView
set_size() (angr.state_plugins.PTChunk method), 289
method), 276
set_stack() (angr.state_plugins.GDB method), 258
set_state()(angr.state_plugins.SimStateGlobals
set_stack() (angr.state_plugins.gdb.GDB method),
method), 269336
set_state()(angr.state_plugins.SimStatePlugin
set_stack_address_mapping()
method), 227(angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin
set_state()(angr.state_plugins.SimSystemPosix
method), 487
method), 239
set_stack_address_mapping()
set_state()(angr.state_plugins.SimUCManager(angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin
method), 260
method), 481
set_state() (angr.state_plugins.uc_manager.SimUCManager
set_stack_address_mapping()
method), 345(angr.storage.memory_mixins.RegionedMemoryMixin
set_state() (angr.state_plugins.Unicorn method), 261
method), 439
set_state() (angr.state_plugins.unicorn_engine.Unicorn
set_stack_size() (angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin
method), 356
method), 487
set_state()(angr.state_plugins.view.SimMemView
set_stack_size() (angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin
method), 387
method), 481
set_state() (angr.storage.file.SimFile method), 393
set_stack_size() (angr.storage.memory_mixins.RegionedMemoryMixin
set_state()(angr.storage.file.SimFileDescriptor
method), 439
method), 404
set_state() (angr.SimFile method), 186
set_state() (angr.storage.file.SimFileDescriptorDuplex
set_state() (angr.SimFileDescriptor method), 195
method), 406
set_state() (angr.SimFileDescriptorDuplex method), set_state() (angr.storage.file.SimFileStream method),
196395
set_state() (angr.SimFileStream method), 190
set_state() (angr.storage.file.SimPackets method), 397
set_state() (angr.SimPackets method), 188
set_state() (angr.storage.memory_mixins.address_concretization_mixin.
set_state() (angr.SimStatePlugin method), 151
method), 451
set_state() (angr.state_plugins.CallStack method), set_state() (angr.storage.memory_mixins.AddressConcretizationMixin266
method), 415
set_state()(angr.state_plugins.callstack.CallStack set_state() (angr.storage.memory_mixins.ISPOMixin
method), 330
method), 428
set_state() (angr.state_plugins.Concrete method), 292 set_state() (angr.storage.memory_mixins.JavaVmMemoryMixin
set_state()(angr.state_plugins.concrete.Concrete
method), 444
method), 359
set_state() (angr.storage.memory_mixins.paged_memory.pages.ispo_mix
1374

Index

angr

method), 475(angr.state_plugins.SimSymbolizer
method),set_state() (angr.storage.memory_mixins.paged_memory.pages.ISPOMixin296
method), 466
set_symbolized_target_range()
set_state() (angr.storage.memory_mixins.regioned_memory.regioned_address_concretization_mixin.RegionedAddressConcretizatio(angr.state_plugins.symbolizer.SimSymbolizer
method), 493
method), 380
set_state() (angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin
set_tracking() (angr.state_plugins.Unicorn method),
method), 486
262
set_state() (angr.storage.memory_mixins.regioned_memory.RegionedAddressConcretizationMixin
set_tracking() (angr.state_plugins.unicorn_engine.Unicorn
method), 484
method), 356
set_state() (angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin
set_tyenv() (angr.state_plugins.scratch.SimStateScratchmethod), 481
method), 346
set_state() (angr.storage.memory_mixins.RegionedAddressConcretizationMixin
set_tyenv()(angr.state_plugins.SimStateScratchmethod), 442
method), 255
set_state() (angr.storage.memory_mixins.RegionedMemoryMixin
set_type() (angr.analyses.decompiler.structured_codegen.c.CExpression
method), 439
method), 1005
set_state() (angr.storage.memory_mixins.slotted_memory.SlottedMemoryMixin
set_unified_variable()method), 494(angr.knowledge_plugins.variables.variable_manager.VariableMa
set_state() (angr.storage.memory_mixins.SlottedMemoryMixin method), 733
method), 436
set_value() (angr.calling_conventions.SimArrayArg
set_state() (angr.storage.SimFile method), 382
method), 617
set_state_options()
set_value() (angr.calling_conventions.SimComboArg(angr.analyses.congruency_check.CongruencyCheck
method), 616
method), 1153
set_value() (angr.calling_conventions.SimFunctionArgument
set_state_options()
method), 615(angr.analyses.CongruencyCheck
method), set_value() (angr.calling_conventions.SimLyingRegArg
810
method), 622
set_states() (angr.analyses.congruency_check.CongruencyCheck
set_value() (angr.calling_conventions.SimReferenceArgument
method), 1153
method), 617
set_states()(angr.analyses.CongruencyCheck set_value()(angr.calling_conventions.SimRegArg
method), 810
method), 615
set_stops() (angr.state_plugins.Unicorn method), 262 set_value() (angr.calling_conventions.SimStackArg
set_stops() (angr.state_plugins.unicorn_engine.Unicorn
method), 616
method), 356
set_value() (angr.calling_conventions.SimStructArg
set_strongref_state()(angr.SimStatePlugin
method), 617
method), 151
set_variable()(angr.keyed_region.KeyedRegion
set_strongref_state()
method), 783(angr.state_plugins.history.SimStateHistory
set_variable() (angr.knowledge_plugins.variables.variable_manager.Va
method), 333
method), 729
set_strongref_state()
set_variable_type()(angr.state_plugins.plugin.SimStatePlugin(angr.knowledge_plugins.variables.variable_manager.VariableMa
method), 298
method), 732
set_strongref_state()
setstate()(angr.calling_conventions.ArgSession(angr.state_plugins.SimStateHistory method),
method), 618
252
setstate() (angr.calling_conventions.SerializableCounter
set_strongref_state()
method), 614(angr.state_plugins.SimStatePlugin method), setstate() (angr.calling_conventions.SerializableIterator
227
method), 614
set_symbolization_for_all_pages()
setstate() (angr.calling_conventions.SerializableListIterator(angr.state_plugins.SimSymbolizer
method),method), 614
296
setstate() (angr.calling_conventions.SimCC.ArgSession
set_symbolization_for_all_pages()
method), 619(angr.state_plugins.symbolizer.SimSymbolizer
setstate() (angr.calling_conventions.UsercallArgSession
method), 380
method), 618
set_symbolized_target_range()
setstate() (angr.SimCC.ArgSession method), 182
Index

1375

angr

setup() (angr.exploration_techniques.DFS method), setup_arguments() (angr.engines.soot.engine.SootMixin
514
static method), 559
setup() (angr.exploration_techniques.dfs.DFS method), setup_arguments()(angr.engines.soot.SootMixin
524
static method), 558
setup() (angr.exploration_techniques.driller_core.DrillerCore
setup_arguments() (angr.engines.SootMixin static
method), 533
method), 551
setup()(angr.exploration_techniques.DrillerCore setup_callsite() (angr.calling_conventions.SimCC
method), 509
method), 620
setup() (angr.exploration_techniques.ExplorationTechniquesetup_callsite() (angr.calling_conventions.SimCCSoot
method), 506
method), 631
setup()(angr.exploration_techniques.Explorer setup_callsite() (angr.engines.soot.engine.SootMixin
method), 513
class method), 559
setup() (angr.exploration_techniques.explorer.Explorer setup_callsite() (angr.engines.soot.SootMixin classmethod), 525
method), 558
setup() (angr.exploration_techniques.local_loop_seer.LocalLoopSeer
setup_callsite() (angr.engines.SootMixin classmethod), 539
method), 551
setup() (angr.exploration_techniques.LocalLoopSeer setup_callsite() (angr.SimCC method), 182
method), 522
setup_flags() (angr.state_plugins.Unicorn method),
setup() (angr.exploration_techniques.loop_seer.LoopSeer
262
method), 538
setup_flags() (angr.state_plugins.unicorn_engine.Unicorn
setup()(angr.exploration_techniques.LoopSeer
method), 356
method), 510
setup_gdt() (angr.SimOS method), 165
setup() (angr.exploration_techniques.manual_mergepoint.ManualMergepoint
setup_gdt() (angr.simos.SimOS method), 1173
method), 526
setup_gdt() (angr.simos.simos.SimOS method), 1181
setup() (angr.exploration_techniques.ManualMergepoint setup_gdt() (angr.state_plugins.Unicorn method), 262
method), 518
setup_gdt() (angr.state_plugins.unicorn_engine.Unicorn
setup() (angr.exploration_techniques.memory_watcher.MemoryWatcher
method), 356
method), 542
setup_terminal() (in module angr.utils.formatting),
setup() (angr.exploration_techniques.MemoryWatcher
1197
method), 521
shallow_reverse() (in module angr.utils.graph), 1191
setup()(angr.exploration_techniques.Slicecutor shared_common_conditional_dom()method), 508(angr.analyses.decompiler.optimization_passes.DuplicationRevert
setup() (angr.exploration_techniques.slicecutor.Slicecutor
method), 974
method), 534
ShiftLeft (angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressT
setup() (angr.exploration_techniques.Symbion method),attribute), 899
520
ShiftRight (angr.analyses.cfg.indirect_jump_resolvers.jumptable.Address
setup() (angr.exploration_techniques.symbion.Symbion
attribute), 899
method), 541
short_reason (angr.knowledge_plugins.cfg.cfg_node.CFGNodeCreationF
setup() (angr.exploration_techniques.Timeout method),attribute), 697
523
short_repr (angr.analyses.ddg.ProgramVariable propsetup() (angr.exploration_techniques.timeout.Timeouterty), 1025
method), 524
short_repr (angr.code_location.CodeLocation propsetup() (angr.exploration_techniques.Tracer method),erty), 780
511
should_abort (angr.analyses.forward_analysis.forward_analysis.Forward
setup()(angr.exploration_techniques.tracer.Tracer
property), 839
method), 532
should_abort (angr.analyses.forward_analysis.ForwardAnalysis
setup() (angr.exploration_techniques.unique.UniqueSearchproperty), 835
method), 540
should_abort (angr.analyses.ForwardAnalysis propsetup()(angr.exploration_techniques.UniqueSearcherty), 787
method), 520
should_add_successors
setup() (angr.ExplorationTechnique method), 174(angr.sim_procedure.SimProcedure
propsetup() (angr.state_plugins.Unicorn method), 262erty), 602
setup()(angr.state_plugins.unicorn_engine.Unicorn should_add_successors (angr.SimProcedure propmethod), 356erty), 150
1376

Index

angr

should_execute_statement()
sim_procedure (angr.codenode.HookNode attribute),(angr.annocfg.AnnotatedCFG method), 1169
1171
should_force_replace()
sim_procedure (angr.codenode.SyscallNode attribute),(angr.analyses.propagator.engine_ail.SimEnginePropagatorAIL
1171
method), 1037
SimAbstractMemoryError, 159, 1201
should_skip_main_binary()
SimAction (class in angr.state_plugins), 262(angr.angrdb.serializers.loader.LoaderSerializer SimAction (class in angr.state_plugins.sim_action), 595
static method), 928
SimActionConstraint (class in angr.state_plugins),
should_skip_main_binary()263(angr.angrdb.serializers.LoaderSerializer
SimActionConstraint(classinstatic method), 924
angr.state_plugins.sim_action), 596
should_take_exit()(angr.annocfg.AnnotatedCFG SimActionData (class in angr.state_plugins), 264
method), 1169
SimActionData(classin
show_demangled_nameangr.state_plugins.sim_action), 596(angr.analyses.decompiler.structured_codegen.c.CFunction
SimActionError, 162, 1203
attribute), 1004
SimActionExit (class in angr.state_plugins), 263
show_demangled_name
SimActionExit(classin(angr.analyses.decompiler.structured_codegen.c.CFunctionCall
angr.state_plugins.sim_action), 595
attribute), 1008
SimActionObject (class in angr.state_plugins), 264
show_disambiguated_name
SimActionObject(classin(angr.analyses.decompiler.structured_codegen.c.CFunctionCall
angr.state_plugins.sim_action_object), 597
attribute), 1008
SimActionOperation (class in angr.state_plugins), 263
shrink() (angr.analyses.reassembler.Data method), SimActionOperation(classin1149
angr.state_plugins.sim_action), 596
SideEffectTag(classin SimActLocation(classinangr.knowledge_plugins.key_definitions.tag),angr.analyses.data_dep.sim_act_location),
772
1160
SIG_BLOCK (angr.state_plugins.posix.SimSystemPosix at- SimArrayArg (class in angr.calling_conventions), 617
tribute), 310
SimCC (class in angr), 180
SIG_BLOCK (angr.state_plugins.SimSystemPosix at- SimCC (class in angr.calling_conventions), 618
tribute), 238
SimCC.ArgSession (class in angr), 181
SIG_SETMASK (angr.state_plugins.posix.SimSystemPosix SimCC.ArgSession (class in angr.calling_conventions),
attribute), 310
619
SIG_SETMASK(angr.state_plugins.SimSystemPosix SimCCAArch64 (class in angr.calling_conventions), 627
attribute), 238
SimCCAArch64LinuxSyscall(classin
SIG_UNBLOCK (angr.state_plugins.posix.SimSystemPosix
angr.calling_conventions), 627
attribute), 310
SimCCallError, 161, 1202
SIG_UNBLOCK(angr.state_plugins.SimSystemPosix SimCCAMD64LinuxSyscall(classin
attribute), 238
angr.calling_conventions), 625
sigmask()(angr.state_plugins.posix.SimSystemPosix SimCCAMD64WindowsSyscall(classinmethod), 312
angr.calling_conventions), 626
sigmask() (angr.state_plugins.SimSystemPosix method), SimCCARM (class in angr.calling_conventions), 626
240
SimCCARMHF (class in angr.calling_conventions), 626
signed (angr.procedures.stubs.format_parser.FormatSpecifier
SimCCARMLinuxSyscall(classin
attribute), 604
angr.calling_conventions), 627
signed (angr.sim_type.SimTypeFloat attribute), 648
SimCCCdecl (class in angr.calling_conventions), 622
SignedExtension (angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransformationTypes
SimCCError, 162, 1203
attribute), 899
SimCCM68k (class in angr.engines.pcode.cc), 593
sigprocmask() (angr.state_plugins.posix.SimSystemPosix SimCCMicrosoftAMD64(classinmethod), 312
angr.calling_conventions), 623
sigprocmask()(angr.state_plugins.SimSystemPosix SimCCMicrosoftCdecl(classinmethod), 240
angr.calling_conventions), 622
sim_procedure (angr.code_location.CodeLocation at- SimCCMicrosoftFastcall(classintribute), 780
angr.calling_conventions), 623
Index

1377

angr

SimCCN64 (class in angr.calling_conventions), 629
498
SimCCN64LinuxSyscall(classin SimConcretizationStrategyEval(classinangr.calling_conventions), 629
angr.concretization_strategies), 412
SimCCO32 (class in angr.calling_conventions), 628
SimConcretizationStrategyEval(classin
SimCCO32LinuxSyscall(classinangr.concretization_strategies.eval), 495
angr.calling_conventions), 628
SimConcretizationStrategyMax(classin
SimCCO64 (in module angr.calling_conventions), 629
angr.concretization_strategies), 412
SimCCPARISC (class in angr.engines.pcode.cc), 594
SimConcretizationStrategyMax(classin
SimCCPowerPC (class in angr.calling_conventions), 630
angr.concretization_strategies.max), 497
SimCCPowerPC (class in angr.engines.pcode.cc), 594
SimConcretizationStrategyNonzero(classin
SimCCPowerPC64 (class in angr.calling_conventions),
angr.concretization_strategies), 412
630
SimConcretizationStrategyNonzero(classin
SimCCPowerPC64LinuxSyscall(classinangr.concretization_strategies.nonzero), 497
angr.calling_conventions), 631
SimConcretizationStrategyNonzeroRange (class in
SimCCPowerPCLinuxSyscall(classinangr.concretization_strategies), 412
angr.calling_conventions), 630
SimConcretizationStrategyNonzeroRange (class in
SimCCRISCV (class in angr.engines.pcode.cc), 593
angr.concretization_strategies.nonzero_range),
SimCCRISCV64LinuxSyscall(classin496
angr.calling_conventions), 628
SimConcretizationStrategyNorepeats (class in
SimCCS390X (class in angr.calling_conventions), 632
angr.concretization_strategies), 413
SimCCS390XLinuxSyscall(classin SimConcretizationStrategyNorepeats (class inangr.calling_conventions), 632
angr.concretization_strategies.norepeats), 495
SimCCSH4 (class in angr.engines.pcode.cc), 594
SimConcretizationStrategyNorepeatsRange (class
SimCCSoot (class in angr.calling_conventions), 631
in angr.concretization_strategies), 413
SimCCSPARC (class in angr.engines.pcode.cc), 593
SimConcretizationStrategyNorepeatsRange (class
SimCCStdcall (class in angr.calling_conventions), 623
in angr.concretization_strategies.norepeats_range),
SimCCSyscall (class in angr.calling_conventions), 624
497
SimCCSystemVAMD64(classin SimConcretizationStrategyRange(classinangr.calling_conventions), 625
angr.concretization_strategies), 413
SimCCUnknown (class in angr.calling_conventions), 632 SimConcretizationStrategyRange(classin
SimCCUsercall (class in angr.calling_conventions), 622
angr.concretization_strategies.range), 496
SimCCX86LinuxSyscall(classin SimConcretizationStrategySingle(classinangr.calling_conventions), 624
angr.concretization_strategies), 414
SimCCX86WindowsSyscall(classin SimConcretizationStrategySingle(classinangr.calling_conventions), 624
angr.concretization_strategies.single), 495
SimCCXtensa (class in angr.engines.pcode.cc), 594
SimConcretizationStrategySolutions (class in
SimCGC (class in angr.simos), 1176
angr.concretization_strategies), 414
SimCGC (class in angr.simos.cgc), 1182
SimConcretizationStrategySolutions (class in
SimComboArg (class in angr.calling_conventions), 616
angr.concretization_strategies.solutions), 496
SimConcreteBreakpointError, 162, 1204
SimConcretizationStrategyUnlimitedRange (class
SimConcreteFilesystem(classinin angr.concretization_strategies), 414
angr.state_plugins.filesystem), 317
SimConcretizationStrategyUnlimitedRange (class
SimConcreteMemoryError, 162, 1204
in angr.concretization_strategies.unlimited_range),
SimConcreteRegisterError, 162, 1204
498
SimConcretizationStrategy(classin SimConstantVariable (class in angr.sim_variable),angr.concretization_strategies), 411
634
SimConcretizationStrategyAny(classin SimCppClass (class in angr.sim_type), 650
angr.concretization_strategies), 411
SimCppClassValue (class in angr.sim_type), 651
SimConcretizationStrategyAny(classin SimCppLibrary (class in angr.procedures.definitions),
angr.concretization_strategies.any), 498
609
SimConcretizationStrategyControlledData (class SimDebugVariable (class in angr.state_plugins), 296
in angr.concretization_strategies), 411
SimDebugVariable(classin
SimConcretizationStrategyControlledData (classangr.state_plugins.debug_variables), 380
in angr.concretization_strategies.controlled_data),SimDebugVariablePlugin(class
in
1378

Index

angr

angr.state_plugins), 298
SimDebugVariablePlugin(classinangr.state_plugins.debug_variables), 381
SimEmptyCallStackError, 162, 1204
SimEngine (class in angr.engines), 545
SimEngine (class in angr.engines.engine), 551
SimEngineBase (class in angr.engines.engine), 551
SimEngineConcrete (class in angr.engines), 549
SimEngineConcrete (class in angr.engines.concrete),
560
SimEngineError, 161, 1203
SimEngineFailure (class in angr.engines), 548
SimEngineFailure (class in angr.engines.failure), 555
SimEngineInitFinderVEX(classinangr.analyses.init_finder), 1155
SimEngineLight (class in angr.engines.light), 1032
SimEngineLight (class in angr.engines.light.engine),
1033
SimEngineLightAIL (in module angr.engines.light),
1032
SimEngineLightAIL(inmoduleangr.engines.light.engine), 1033
SimEngineLightAILMixin (class in angr.engines.light),
1032
SimEngineLightAILMixin(classinangr.engines.light.engine), 1033
SimEngineLightMixin(classinangr.engines.light.engine), 1032
SimEngineLightVEX (in module angr.engines.light),
1032
SimEngineLightVEX(inmoduleangr.engines.light.engine), 1033
SimEngineLightVEXMixin (class in angr.engines.light),
1032
SimEngineLightVEXMixin(classinangr.engines.light.engine), 1033
SimEnginePropagatorAIL(classinangr.analyses.propagator.engine_ail), 1036
SimEnginePropagatorBase(classinangr.analyses.propagator.engine_base), 1035
SimEnginePropagatorVEX(classinangr.analyses.propagator.engine_vex), 1036
SimEngineRDAIL(classinangr.analyses.reaching_definitions.engine_ail),
1098
SimEngineRDVEX(classinangr.analyses.reaching_definitions.engine_vex),
1074
SimEngineSyscall (class in angr.engines), 548
SimEngineSyscall (class in angr.engines.syscall), 555
SimEngineUnicorn (class in angr.engines), 547
SimEngineUnicorn (class in angr.engines.unicorn), 559
SimEngineVRAIL(classinangr.analyses.variable_recovery.engine_ail),
Index

1113
SimEngineVRBase(classinangr.analyses.variable_recovery.engine_base),
1114
SimEngineVRVEX(classinangr.analyses.variable_recovery.engine_vex),
1114
SimEngineXRefsVEX (class in angr.analyses.xrefs), 1156
SimError, 159, 1201
SimEvent (class in angr.state_plugins), 266
SimEvent (class in angr.state_plugins.sim_event), 598
SimEventError, 160, 1201
SimException, 162, 1204
SimExpressionError, 160, 1202
SimFastMemoryError, 160, 1201
SimFastPathError, 161, 1203
SimFile (class in angr), 185
SimFile (class in angr.storage), 382
SimFile (class in angr.storage.file), 393
SimFileBase (class in angr), 184
SimFileBase (class in angr.storage.file), 391
SimFileDescriptor (class in angr), 193
SimFileDescriptor (class in angr.storage.file), 402
SimFileDescriptorBase (class in angr.storage.file),
401
SimFileDescriptorDuplex (class in angr), 196
SimFileDescriptorDuplex (class in angr.storage.file),
405
SimFileError, 160, 1202
SimFileStream (class in angr), 190
SimFileStream (class in angr.storage.file), 395
SimFilesystem (class in angr.state_plugins), 280
SimFilesystem (class in angr.state_plugins.filesystem),
314
SimFilesystemError, 160, 1202
SimFunctionArgument(classinangr.calling_conventions), 614
simgr() (angr.factory.AngrObjectFactory method), 215
SimHeapBase (class in angr.state_plugins), 284
SimHeapBase (class in angr.state_plugins.heap), 363
SimHeapBase(classinangr.state_plugins.heap.heap_base), 370
SimHeapBrk (class in angr), 200
SimHeapBrk (class in angr.state_plugins), 284
SimHeapBrk (class in angr.state_plugins.heap), 364
SimHeapBrk (class in angr.state_plugins.heap.heap_brk),
371
SimHeapError, 160, 1202
SimHeapFreelist(classinangr.state_plugins.heap.heap_freelist), 374
SimHeapLibc (class in angr.state_plugins), 286
SimHeapLibc (class in angr.state_plugins.heap), 366
SimHeapLibc(classinangr.state_plugins.heap.heap_libc), 374
1379

angr

SimHeapPTMalloc (class in angr), 201
SimMount (class in angr), 198
SimHeapPTMalloc (class in angr.state_plugins), 287
SimMount (class in angr.state_plugins), 282
SimHeapPTMalloc (class in angr.state_plugins.heap), SimMount (class in angr.state_plugins.filesystem), 316
366
SimOperationError, 160, 1202
SimHeapPTMalloc(classin SimOS (class in angr), 164angr.state_plugins.heap.heap_ptmalloc),
SimOS (class in angr.simos), 1172
377
SimOS (class in angr.simos.simos), 1179
SimHostFilesystem (class in angr), 199
SIMOS_CGC (angr.state_plugins.unicorn_engine.SimOSEnum
SimHostFilesystem (class in angr.state_plugins), 283
attribute), 353
SimHostFilesystem(classin SIMOS_LINUX (angr.state_plugins.unicorn_engine.SimOSEnum
angr.state_plugins.filesystem), 319
attribute), 353
similar_conditional_when_single_corrected() SIMOS_OTHER (angr.state_plugins.unicorn_engine.SimOSEnum(angr.analyses.decompiler.optimization_passes.DuplicationReverter
attribute), 353
method), 973
SimOSEnum (class in angr.state_plugins.unicorn_engine),
similarity() (angr.exploration_techniques.unique.UniqueSearch 353
static method), 540
SimPackets (class in angr), 188
similarity() (angr.exploration_techniques.UniqueSearchSimPackets (class in angr.storage.file), 397
static method), 520
SimPacketsSlots (class in angr.storage.file), 407
SimInspectMixin (class in angr.engines), 547
SimPacketsStream (class in angr), 192
SimInspectMixin (class in angr.engines.vex), 557
SimPacketsStream (class in angr.storage.file), 399
SimInspector (class in angr.state_plugins), 232
SimpleInterfaceMixin(classin
SimInspector (class in angr.state_plugins.inspect), 300
angr.storage.memory_mixins), 420
SimIRSBError, 161, 1203
SimpleInterfaceMixin(classin
SimIRSBNoDecodeError, 161, 1203
angr.storage.memory_mixins.simple_interface_mixin),
SimJavaVM (class in angr.simos), 1177
449
SimJavaVM (class in angr.simos.javavm), 1185
SimpleSolver(classin
SimJavaVmClassloader (class in angr.state_plugins),
angr.analyses.typehoon.simple_solver), 1119
294
SimplificationMixin(classin
SimJavaVmClassloader(classinangr.storage.memory_mixins), 420
angr.state_plugins.javavm_classloader),SimplificationMixin(classin360
angr.storage.memory_mixins.simplification_mixin),
SimLabeledMemoryObject(classin454
angr.storage.memory_object), 410
simplified_data_graph (angr.analyses.DDG propSimLibrary (class in angr.procedures.definitions), 606erty), 802
SimLightRegisters (class in angr.state_plugins), 249
simplified_data_graph(angr.analyses.ddg.DDG
SimLightRegisters(classinproperty), 1028
angr.state_plugins.light_registers), 332
simplified_graph (angr.analyses.data_dep.data_dependency_analysis.D
SimLightState (class in angr.slicer), 1168
property), 1160
SimLinux (class in angr.simos), 1174
simplified_graph (angr.analyses.data_dep.DataDependencyGraphAnaly
SimLinux (class in angr.simos.linux), 1181
property), 1164
SimLyingRegArg (class in angr.calling_conventions), simplified_graph (angr.analyses.DataDependencyGraphAnalysis
621
property), 824
SimMemoryAddressError, 160, 1201
SimplifierAILEngine(classin
SimMemoryError, 159, 1201
angr.analyses.decompiler.optimization_passes.engine_base),
SimMemoryLimitError, 160, 1201
982
SimMemoryMissingError, 159, 1201
SimplifierAILState(classin
SimMemoryObject (class in angr.storage), 384
angr.analyses.decompiler.optimization_passes.engine_base),
SimMemoryObject(classin982
angr.storage.memory_object), 409
simplify() (angr.sim_state.SimState method), 221
SimMemoryVariable (class in angr.sim_variable), 636
simplify() (angr.SimState method), 178
SimMemView (class in angr.state_plugins), 275
simplify()(angr.state_hierarchy.StateHierarchy
SimMemView (class in angr.state_plugins.view), 386
method), 506
SimMergeError, 159, 1201
simplify() (angr.state_plugins.SimSolver method), 249
SimMissingTempError, 161, 1203
simplify()(angr.state_plugins.solver.SimSolver
1380

Index

angr

method), 327
SimStateCGC (class in angr.state_plugins), 256
simplify() (angr.StateHierarchy method), 176
SimStateCGC (class in angr.state_plugins.cgc), 337
simplify_condition()
SimStateError, 159, 1201
(angr.analyses.decompiler.condition_processor.ConditionProcessor
SimStateGlobals (class in angr.state_plugins), 269
static method), 954
SimStateGlobals (class in angr.state_plugins.globals),
simplify_condition_deprecated()343(angr.analyses.decompiler.condition_processor.ConditionProcessor
SimStateHistory (class in angr.state_plugins), 251
static method), 954
SimStateHistory (class in angr.state_plugins.history),
simplify_else_scope333(angr.analyses.decompiler.structured_codegen.c.CIfElse
SimStateJNIReferences (class in angr.state_plugins),
attribute), 1006292
simplify_lowered_switches()(inmodule SimStateJNIReferences(classinangr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier),
angr.state_plugins.jni_references), 361
995
SimStateLibc (class in angr.state_plugins), 228
simplify_lowered_switches_core() (in module SimStateLibc (class in angr.state_plugins.libc), 302
angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier),
SimStateLog (class in angr.state_plugins), 250
995
SimStateLog (class in angr.state_plugins.log), 328
simplify_switch_clusters()(inmodule SimStateLoopData (class in angr.state_plugins), 272
angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier),
SimStateLoopData(classin995
angr.state_plugins.loop_data), 357
SimPosixError, 160, 1201
SimStatementError, 161, 1202
SimProcedure (class in angr), 147
SimStateOptions (class in angr.sim_state_options),
SimProcedure (class in angr.sim_procedure), 599
223
simprocedure_name (angr.knowledge_plugins.cfg.cfg_node.CFGNode
SimStateOptionsError, 162, 1204
attribute), 697
SimStatePlugin (class in angr), 151
simprocedure_name (angr.knowledge_plugins.cfg.CFGNode
SimStatePlugin (class in angr.state_plugins), 226
attribute), 678
SimStatePlugin (class in angr.state_plugins.plugin),
SimProcedureArgumentError, 161, 1203
298
SimProcedureError, 161, 1203
SimStatePreconstrainer(classin
SimReferenceArgument(classinangr.state_plugins), 270
angr.calling_conventions), 617
SimStatePreconstrainer(classin
SimRegArg (class in angr.calling_conventions), 615
angr.state_plugins.preconstrainer), 347
SimRegionMapError, 160, 1201
SimStateScratch (class in angr.state_plugins), 254
SimRegisterVariable (class in angr.sim_variable), SimStateScratch (class in angr.state_plugins.scratch),
635
346
SimRegNameView (class in angr.state_plugins), 274
SimStruct (class in angr.sim_type), 649
SimRegNameView (class in angr.state_plugins.view), 385 SimStructArg (class in angr.calling_conventions), 616
SimReliftException, 161, 1203
SimStructValue (class in angr.sim_type), 649
SimSegfaultError (in module angr), 162
SimSuccessors (class in angr.engines), 543
SimSegfaultError (in module angr.errors), 1204
SimSuccessors (class in angr.engines.successors), 552
SimSegfaultException, 162, 1204
SimSymbolicFilesystemError, 160, 1202
SimShadowStackError, 161, 1203
SimSymbolizer (class in angr.state_plugins), 296
SimSlicer (class in angr.slicer), 1168
SimSymbolizer(classin
SimSlicerError, 162, 1203
angr.state_plugins.symbolizer), 379
SimSnimmucNxp (class in angr.simos), 1179
SimSyscallLibrary(classin
SimSolver (class in angr.state_plugins), 242
angr.procedures.definitions), 610
SimSolver (class in angr.state_plugins.solver), 320
SimSystemPosix (class in angr.state_plugins), 238
SimSolverError, 160, 1202
SimSystemPosix (class in angr.state_plugins.posix), 309
SimSolverModeError, 160, 1202
SimTemporaryVariable (class in angr.sim_variable),
SimSolverOptionError, 160, 1202
634
SimStackArg (class in angr.calling_conventions), 616
SimTranslationError, 161, 1203
SimStackVariable (class in angr.sim_variable), 637
SimType (class in angr.sim_type), 638
SimState (class in angr), 176
simtype2tc() (angr.analyses.typehoon.translator.TypeTranslator
SimState (class in angr.sim_state), 220
method), 1121
Index

1381

angr

SimTypeArray (class in angr.sim_type), 644
SimTypeBool (class in angr.sim_type), 643
SimTypeBottom (class in angr.sim_type), 640
SimTypeChar (class in angr.sim_type), 642
SimTypeCollection(classinangr.procedures.definitions), 605
SimTypeCppFunction (class in angr.sim_type), 647
SimTypeDouble (class in angr.sim_type), 648
SimTypeFd (class in angr.sim_type), 643
SimTypeFixedSizeArray (in module angr.sim_type),
645
SimTypeFixedSizeInt (class in angr.sim_type), 642
SimTypeFloat (class in angr.sim_type), 648
SimTypeFunction (class in angr.sim_type), 646
SimTypeInt (class in angr.sim_type), 641
SimTypeInt128 (class in angr.sim_type), 642
SimTypeInt256 (class in angr.sim_type), 642
SimTypeLength (class in angr.sim_type), 647
SimTypeLong (class in angr.sim_type), 642
SimTypeLongLong (class in angr.sim_type), 642
SimTypeNum (class in angr.sim_type), 641
SimTypeNumOffset (class in angr.sim_type), 651
SimTypePointer (class in angr.sim_type), 643
SimTypeRef (class in angr.sim_type), 652
SimTypeReference (class in angr.sim_type), 644
SimTypeReg (class in angr.sim_type), 640
SimTypeShort (class in angr.sim_type), 642
SimTypeString (class in angr.sim_type), 645
SimTypeTempRef(classinangr.analyses.typehoon.translator), 1121
SimTypeTop (class in angr.sim_type), 640
SimTypeWideChar (class in angr.sim_type), 643
SimTypeWString (class in angr.sim_type), 645
SimUCManager (class in angr.state_plugins), 259
SimUCManager(classinangr.state_plugins.uc_manager), 345
SimUCManagerAllocationError, 162, 1203
SimUCManagerError, 162, 1203
simulation_manager()(angr.factory.AngrObjectFactory
method),214
SimulationManager (class in angr), 167
SimulationManager (class in angr.sim_manager), 498
SimulationManagerError, 157, 1199
SimUnicornError, 162, 1204
SimUnicornSymbolic, 162, 1204
SimUnicornUnsupport, 162, 1203
SimUninitializedAccessError, 161, 1202
SimUnion (class in angr.sim_type), 650
SimUnionValue (class in angr.sim_type), 650
SimUnsatError, 160, 1202
SimUnsupportedError, 160, 1202
SimUserland (class in angr.simos), 1173
SimUserland (class in angr.simos.userland), 1182
1382

SimValueError, 160, 1202
SimVariable (class in angr.sim_variable), 633
SimVariableSet (class in angr.sim_variable), 637
SimWindows (class in angr.simos), 1176
SimWindows (class in angr.simos.windows), 1184
SimZeroDivisionException, 162, 1204
single_valued()(angr.state_plugins.SimSolver
method), 249
single_valued() (angr.state_plugins.solver.SimSolver
method), 327
SingleNodeGraphVisitor(classinangr.analyses.forward_analysis), 838
SingleNodeGraphVisitor(classinangr.analyses.forward_analysis.visitors),
842
SingleNodeGraphVisitor(classinangr.analyses.forward_analysis.visitors.single_node_graph),848
size (angr.analyses.propagator.values.Top attribute),
1035
size (angr.analyses.propagator.vex_vars.VEXMemVar
attribute), 1035
size
(angr.analyses.propagator.vex_vars.VEXReg
attribute), 1035
size
(angr.analyses.reaching_definitions.Atom
attribute), 1049
size
(angr.analyses.reaching_definitions.Definition
property), 1053
SIZE (angr.analyses.typehoon.typeconsts.Double attribute), 1128
SIZE
(angr.analyses.typehoon.typeconsts.Float
attribute), 1128
SIZE (angr.analyses.typehoon.typeconsts.Int1 attribute),
1127
SIZE (angr.analyses.typehoon.typeconsts.Int128 attribute), 1128
SIZE (angr.analyses.typehoon.typeconsts.Int16 attribute),
1128
SIZE (angr.analyses.typehoon.typeconsts.Int256 attribute), 1128
SIZE (angr.analyses.typehoon.typeconsts.Int32 attribute),
1128
SIZE (angr.analyses.typehoon.typeconsts.Int64 attribute),
1128
SIZE (angr.analyses.typehoon.typeconsts.Int8 attribute),
1127
SIZE (angr.analyses.typehoon.typeconsts.TypeConstantattribute), 1127
size (angr.analyses.typehoon.typeconsts.TypeConstantproperty), 1127
size (angr.Block attribute), 166
size (angr.block.Block attribute), 217
size (angr.block.CapstoneInsn property), 216
size (angr.block.DisassemblerInsn property), 216
Index

angr

size (angr.block.SootBlock property), 217
size (angr.storage.file.SimPacketsSlots property), 408
size (angr.codenode.CodeNode attribute), 1170
size (angr.storage.SimFile property), 382
size (angr.engines.pcode.lifter.IRSB property), 567
size() (angr.calling_conventions.AllocHelper method),size (angr.engines.pcode.lifter.PcodeDisassemblerInsn
614
property), 563
size() (angr.SimFileDescriptor method), 194
size (angr.keyed_region.RegionObject attribute), 781
size() (angr.SimFileDescriptorDuplex method), 197
size (angr.keyed_region.StoredObject attribute), 781
size() (angr.storage.file.SimFileDescriptor method),size (angr.knowledge_plugins.cfg.cfg_node.CFGNode403
attribute), 697
size()(angr.storage.file.SimFileDescriptorBase
size (angr.knowledge_plugins.cfg.CFGNode attribute),
method), 402
678
size()(angr.storage.file.SimFileDescriptorDuplex
size (angr.knowledge_plugins.cfg.memory_data.MemoryData
method), 406
attribute), 696
size() (angr.storage.memory_object.SimMemoryObject
size (angr.knowledge_plugins.cfg.MemoryData atmethod), 410
tribute), 677
size() (angr.storage.SimMemoryObject method), 384
size (angr.knowledge_plugins.Function property), 661
SizeConcretizationMixin(classinsize (angr.knowledge_plugins.functions.Function propangr.storage.memory_mixins), 420erty), 708
SizeConcretizationMixin(classinsize (angr.knowledge_plugins.functions.function.Function
angr.storage.memory_mixins.size_resolution_mixin),
property), 720
450
size (angr.knowledge_plugins.key_definitions.atoms.Atom SizeNormalizationMixin(classin
attribute), 751
angr.storage.memory_mixins), 420
size (angr.knowledge_plugins.key_definitions.Definition SizeNormalizationMixin(classinproperty), 750
angr.storage.memory_mixins.size_resolution_mixin),
size (angr.knowledge_plugins.key_definitions.definition.Definition 450
property), 758
Sketch (class in angr.analyses.typehoon.simple_solver),size (angr.procedures.stubs.format_parser.FormatSpecifier
1117
attribute), 604
SketchNode (class in angr.analyses.typehoon.simple_solver),size (angr.sim_type.SimStruct property), 649
1117
size (angr.sim_type.SimType property), 638
SketchNodeBase(classinsize (angr.sim_type.SimTypeArray property), 645
angr.analyses.typehoon.simple_solver), 1117
size (angr.sim_type.SimTypeDouble property), 648
skip_stmts (angr.engines.pcode.lifter.Lifter attribute),
size (angr.sim_type.SimTypeFd property), 643
568
size (angr.sim_type.SimTypeFixedSizeInt property), 642 skip_stmts (angr.engines.pcode.lifter.PcodeLifter atsize (angr.sim_type.SimTypeFloat property), 648
tribute), 570
size (angr.sim_type.SimTypeFunction property), 647
slice (angr.Blade property), 164
size (angr.sim_type.SimTypeInt property), 642
slice (angr.blade.Blade property), 1168
size (angr.sim_type.SimTypeLength property), 648
slice_callgraph()(inmodulesize (angr.sim_type.SimTypeNum property), 641
angr.analyses.cfg_slice_to_sink), 1100
size (angr.sim_type.SimTypePointer property), 644
slice_callgraph()(inmodulesize (angr.sim_type.SimTypeReference property), 644
angr.analyses.cfg_slice_to_sink.graph), 1102
size (angr.sim_type.SimTypeString property), 645
slice_cfg_graph()(inmodulesize (angr.sim_type.SimTypeWString property), 646
angr.analyses.cfg_slice_to_sink), 1100
size (angr.sim_type.SimUnion property), 650
slice_cfg_graph()(inmodulesize (angr.sim_type.TypeRef property), 639
angr.analyses.cfg_slice_to_sink.graph), 1102
size (angr.sim_variable.SimVariable attribute), 634
slice_function_graph()(inmodulesize (angr.SimFile property), 186angr.analyses.cfg_slice_to_sink), 1100
size (angr.SimFileBase property), 185slice_function_graph()(inmodulesize (angr.SimPackets property), 188
angr.analyses.cfg_slice_to_sink.graph), 1102
size (angr.state_plugins.unicorn_engine.RegisterValue slice_graph() (angr.analyses.decompiler.region_identifier.RegionIdentifi
attribute), 350
static method), 988
size (angr.storage.file.SimFile property), 393
slice_graph() (angr.analyses.decompiler.RegionIdentifier
size (angr.storage.file.SimFileBase property), 392
static method), 940
size (angr.storage.file.SimPackets property), 397
Slicecutor (class in angr.exploration_techniques), 508
Index

1383

angr

Slicecutor (class in angr.exploration_techniques.slicecutor),
SootMixin (class in angr.engines.soot.engine), 559
533
SootStatement (class in angr.analyses.disassembly),
SLivenessAnalysis (class in angr.analyses), 832
1143
SlottedMemoryMixin(classin sort (angr.analyses.decompiler.structuring.structurer_nodes.LoopNodeangr.storage.memory_mixins), 436
attribute), 936
SlottedMemoryMixin(classin sort (angr.knowledge_plugins.cfg.memory_data.MemoryData
angr.storage.memory_mixins.slotted_memory),
attribute), 696
494
sort (angr.knowledge_plugins.cfg.MemoryData atSmartFindMixin(classintribute), 677
angr.storage.memory_mixins), 421
sort (angr.sim_type.SimTypeDouble attribute), 648
SmartFindMixin(classin sort (angr.sim_type.SimTypeFloat attribute), 648
angr.storage.memory_mixins.smart_find_mixin), sort() (angr.exploration_techniques.spiller.PickledStatesBase447
method), 527
SMod() (angr.state_plugins.sim_action_object.SimActionObject
sort() (angr.exploration_techniques.spiller.PickledStatesDb
method), 598
method), 528
SMod() (angr.state_plugins.SimActionObject method), sort() (angr.exploration_techniques.spiller.PickledStatesList
265
method), 527
snippet() (angr.factory.AngrObjectFactory method), sort_nodes() (angr.analyses.forward_analysis.CallGraphVisitor
212
method), 836
solution() (angr.state_plugins.SimSolver method), 246 sort_nodes() (angr.analyses.forward_analysis.FunctionGraphVisitor
solution()(angr.state_plugins.solver.SimSolver
method), 837
method), 324
sort_nodes() (angr.analyses.forward_analysis.LoopVisitor
solve() (angr.analyses.typehoon.simple_solver.SimpleSolver
method), 837
method), 1120
sort_nodes() (angr.analyses.forward_analysis.SingleNodeGraphVisitor
solver (angr.analyses.typehoon.simple_solver.Sketch atmethod), 838
tribute), 1118
sort_nodes() (angr.analyses.forward_analysis.visitors.call_graph.CallGr
solver (angr.sim_state.SimState attribute), 220
method), 844
solver (angr.SimState attribute), 177
sort_nodes() (angr.analyses.forward_analysis.visitors.CallGraphVisitor
soot (angr.block.SootBlock property), 217
method), 841
soot_block (angr.knowledge_plugins.cfg.cfg_node.CFGNodesort_nodes() (angr.analyses.forward_analysis.visitors.function_graph.Fu
attribute), 698
method), 845
soot_block (angr.knowledge_plugins.cfg.CFGNode at- sort_nodes() (angr.analyses.forward_analysis.visitors.FunctionGraphVis
tribute), 678
method), 842
SootBlock (class in angr.block), 217
sort_nodes() (angr.analyses.forward_analysis.visitors.graph.GraphVisito
SootBlockNode (class in angr.codenode), 1171
method), 846
SootBlockProcessor(classin sort_nodes() (angr.analyses.forward_analysis.visitors.loop.LoopVisitor
angr.analyses.loop_analysis), 1132
method), 848
SootClassHierarchy (class in angr.analyses), 825
sort_nodes() (angr.analyses.forward_analysis.visitors.LoopVisitor
SootClassHierarchy(classinmethod), 842
angr.analyses.soot_class_hierarchy), 857
sort_nodes() (angr.analyses.forward_analysis.visitors.single_node_graph
SootClassHierarchyError, 857
method), 848
SootExpression (class in angr.analyses.disassembly), sort_nodes() (angr.analyses.forward_analysis.visitors.SingleNodeGraphV1142
method), 843
SootExpressionInvoke(classin sources (angr.analyses.reaching_definitions.function_handler.FunctionEffe
angr.analyses.disassembly), 1143
attribute), 1083
SootExpressionStaticFieldRef(classin sources_defns (angr.analyses.reaching_definitions.function_handler.Func
angr.analyses.disassembly), 1142
attribute), 1083
SootExpressionTarget(classin sp_delta (angr.knowledge_plugins.Function attribute),
angr.analyses.disassembly), 1142
658
SootFunction(classin sp_delta (angr.knowledge_plugins.functions.Function
angr.knowledge_plugins.functions.soot_function),
attribute), 705
724
sp_delta (angr.knowledge_plugins.functions.function.Function
SootMixin (class in angr.engines), 550
attribute), 717
SootMixin (class in angr.engines.soot), 558
sp_delta (angr.knowledge_plugins.functions.soot_function.SootFunction
1384

Index

angr

attribute), 725
src_stmt_idx (angr.analyses.cfg.cfg_fast.CFGJob atsp_offset() (angr.engines.light.engine.SimEngineLightMixin
tribute), 889
static method), 1032
src_stmt_idx (angr.analyses.vfg.PendingJob attribute),
spec_type (angr.procedures.stubs.format_parser.FormatSpecifier 1135
property), 604
src_type (angr.analyses.decompiler.structured_codegen.c.CTypeCast
Special (angr.analyses.disassembly.SootExpressionInvoke
attribute), 1014
attribute), 1143
SReachingDefinitionsAnalysis(classin
SPECIAL_THUNKS (angr.analyses.cfg.cfg_fast.CFGFast
angr.analyses), 831
attribute), 890
Ssailification (class in angr.analyses.decompiler),
SPECIAL_THUNKS (angr.analyses.cfg.CFGFast attribute),947
858
sse_extend()(angr.calling_conventions.SimRegArg
SPECIAL_THUNKS (angr.analyses.CFGFast attribute),
method), 615790
st_atime (angr.state_plugins.filesystem.Stat attribute),
SpecialFillerMixin(classin314
angr.storage.memory_mixins), 418
st_atime (angr.state_plugins.Stat attribute), 279
SpecialFillerMixin(classin st_atimensec(angr.state_plugins.filesystem.Stat
angr.storage.memory_mixins.default_filler_mixin),
attribute), 314447
st_atimensec (angr.state_plugins.Stat attribute), 280
Spiller (class in angr.exploration_techniques), 517
st_blksize(angr.state_plugins.filesystem.Stat
atSpiller (class in angr.exploration_techniques.spiller),tribute), 314528
st_blksize (angr.state_plugins.Stat attribute), 280
split() (angr.keyed_region.RegionObject method), 781 st_blocks (angr.state_plugins.filesystem.Stat attribute),
split()(angr.sim_manager.SimulationManager
314
method), 504
st_blocks (angr.state_plugins.Stat attribute), 280
split() (angr.SimulationManager method), 172
st_ctime (angr.state_plugins.filesystem.Stat attribute),
split_arm_op_string()
314(angr.analyses.disassembly.Instruction static st_ctime (angr.state_plugins.Stat attribute), 280
method), 1142
st_ctimensec(angr.state_plugins.filesystem.Stat
split_op_string() (angr.analyses.disassembly.Instruction
attribute), 314
static method), 1142
st_ctimensec (angr.state_plugins.Stat attribute), 280
split_operands()(inmodule st_dev (angr.state_plugins.filesystem.Stat attribute), 314
angr.analyses.reassembler), 1145
st_dev (angr.state_plugins.Stat attribute), 280
SpOffset (class in angr.engines.light), 1031
st_gid (angr.state_plugins.filesystem.Stat attribute), 314
SpOffset (class in angr.engines.light.data), 1031
st_gid (angr.state_plugins.Stat attribute), 280
SPropagatorAnalysis (class in angr.analyses), 831
st_ino (angr.state_plugins.filesystem.Stat attribute), 314
squash_array_reference()(inmodule st_ino (angr.state_plugins.Stat attribute), 280
angr.analyses.decompiler.structured_codegen.c), st_mode (angr.state_plugins.filesystem.Stat attribute),
1002
314
src_block_id (angr.analyses.vfg.PendingJob attribute), st_mode (angr.state_plugins.Stat attribute), 2801135
st_mtime (angr.state_plugins.filesystem.Stat attribute),
src_func_addr (angr.analyses.cfg.cfg_fast.FunctionEdge
314
attribute), 886
st_mtime (angr.state_plugins.Stat attribute), 280
src_ins_addr (angr.analyses.cfg.cfg_fast.CFGJob at- st_mtimensec(angr.state_plugins.filesystem.Stat
tribute), 889
attribute), 314
src_ins_addr (angr.analyses.vfg.PendingJob attribute), st_mtimensec (angr.state_plugins.Stat attribute), 280
1135
st_nlink (angr.state_plugins.filesystem.Stat attribute),
src_node (angr.analyses.cfg.cfg_fast.CFGJob attribute),314889
st_nlink (angr.state_plugins.Stat attribute), 280
src_node (angr.analyses.cfg.cfg_fast.FunctionCallEdge st_rdev (angr.state_plugins.filesystem.Stat attribute),
attribute), 887314
src_node (angr.analyses.cfg.cfg_fast.FunctionFakeRetEdgest_rdev (angr.state_plugins.Stat attribute), 280
attribute), 887
st_size (angr.state_plugins.filesystem.Stat attribute),
src_node (angr.analyses.cfg.cfg_fast.FunctionTransitionEdge
314
attribute), 887
st_size (angr.state_plugins.Stat attribute), 280
Index

1385

angr

st_uid (angr.state_plugins.filesystem.Stat attribute), 314
method), 481
st_uid (angr.state_plugins.Stat attribute), 280
stack_id() (angr.storage.memory_mixins.RegionedMemoryMixin
StableVarExprHasher(classinmethod), 439
angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier),
stack_loc()(angr.calling_conventions.AllocHelper980
class method), 614
stack (angr.analyses.reaching_definitions.LiveDefinitions stack_offset (angr.knowledge_plugins.key_definitions.atoms.VirtualVaria
attribute), 1041
property), 754
stack (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
stack_offset (angr.knowledge_plugins.key_definitions.definition.Definitio
property), 1093
attribute), 756
stack (angr.analyses.reaching_definitions.ReachingDefinitionsState
stack_offset_to_stack_addr()
property), 1062
(angr.analyses.reaching_definitions.LiveDefinitions
stack (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
method), 1043
attribute), 762
stack_offset_to_stack_addr()
stack (angr.knowledge_plugins.key_definitions.LiveDefinitions(angr.knowledge_plugins.key_definitions.live_definitions.LiveDefin
attribute), 740
method), 764
stack (angr.storage.memory_mixins.JavaVmMemoryMixin stack_offset_to_stack_addr()
property), 443(angr.knowledge_plugins.key_definitions.LiveDefinitions
stack_actions (angr.state_plugins.history.SimStateHistory
method), 742
property), 335
stack_offsets (angr.slicer.SimLightState attribute),
stack_actions(angr.state_plugins.SimStateHistory1168
property), 254
stack_pointer_as_atom()stack_addr_from_offset()(angr.analyses.reaching_definitions.function_handler.FunctionHa(angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBasestatic method), 1089
method), 1109
stack_pointer_as_atom()stack_address() (angr.analyses.reaching_definitions.LiveDefinitions(angr.analyses.reaching_definitions.FunctionHandler
method), 1042
static method), 1069
stack_address() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
stack_pop() (angr.sim_state.SimState method), 223
method), 1092
stack_pop() (angr.SimState method), 179
stack_address() (angr.analyses.reaching_definitions.ReachingDefinitionsState
stack_push() (angr.sim_state.SimState method), 223
method), 1061
stack_push() (angr.SimState method), 179
stack_address() (angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase
stack_read() (angr.sim_state.SimState method), 223
method), 1108
stack_read() (angr.SimState method), 179
stack_address() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
stack_region (angr.knowledge_plugins.variables.variable_manager.LiveV
method), 763
attribute), 728
stack_address() (angr.knowledge_plugins.key_definitions.LiveDefinitions
stack_space()(angr.calling_conventions.SimCC
method), 741
method), 620
STACK_ALIGNMENT (angr.calling_conventions.SimCC at- stack_space() (angr.SimCC method), 182
tribute), 619
stack_suffix()(angr.state_plugins.CallStack
STACK_ALIGNMENT (angr.calling_conventions.SimCCMicrosoftAMD64
method), 269
attribute), 624
stack_suffix() (angr.state_plugins.callstack.CallStack
STACK_ALIGNMENT (angr.calling_conventions.SimCCSystemVAMD64method), 332
attribute), 625
stack_suffix_to_string()
STACK_ALIGNMENT (angr.SimCC attribute), 181(angr.state_plugins.CallStack static method),
stack_base (angr.storage.memory_mixins.regioned_memory.region_data.RegionMap
268
property), 489
stack_suffix_to_string()
stack_definitions (angr.analyses.reaching_definitions.LiveDefinitions(angr.state_plugins.callstack.CallStack static
property), 1041
method), 331
stack_definitions (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions
stack_uses (angr.analyses.reaching_definitions.LiveDefinitions
property), 762
attribute), 1041
stack_definitions (angr.knowledge_plugins.key_definitions.LiveDefinitions
stack_uses (angr.analyses.reaching_definitions.rd_state.ReachingDefinitio
property), 740
property), 1093
stack_id() (angr.storage.memory_mixins.regioned_memory.regioned_memory_mixin.RegionedMemoryMixin
stack_uses (angr.analyses.reaching_definitions.ReachingDefinitionsState
method), 487
property), 1062
stack_id() (angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin
stack_uses (angr.knowledge_plugins.key_definitions.live_definitions.LiveD
1386

Index

angr

attribute), 762
STAGE (angr.analyses.decompiler.optimization_passes.BasePointerSaveSimp
stack_uses (angr.knowledge_plugins.key_definitions.LiveDefinitionsattribute), 961
attribute), 740
STAGE (angr.analyses.decompiler.optimization_passes.CallStatementRewrite
StackAllocationMixin(classin
attribute), 972
angr.storage.memory_mixins), 427
STAGE (angr.analyses.decompiler.optimization_passes.CodeMotionOptimiza
StackAllocationMixin(classin
attribute), 969
angr.storage.memory_mixins.paged_memory.stack_allocation_mixin),
STAGE (angr.analyses.decompiler.optimization_passes.const_derefs.Constan
464
attribute), 974
STACKARG_SP_BUFF (angr.calling_conventions.SimCC STAGE (angr.analyses.decompiler.optimization_passes.ConstantDereference
attribute), 618
attribute), 966
STACKARG_SP_BUFF (angr.calling_conventions.SimCCMicrosoftAMD64
STAGE (angr.analyses.decompiler.optimization_passes.ConstPropOptRevert
attribute), 623
attribute), 971
STACKARG_SP_BUFF (angr.calling_conventions.SimCCN64 STAGE (angr.analyses.decompiler.optimization_passes.CrossJumpReverter
attribute), 629
attribute), 968
STACKARG_SP_BUFF (angr.calling_conventions.SimCCO32 STAGE (angr.analyses.decompiler.optimization_passes.DeadblockRemover
attribute), 628
attribute), 971
STACKARG_SP_BUFF (angr.calling_conventions.SimCCPowerPC
STAGE (angr.analyses.decompiler.optimization_passes.div_simplifier.DivSim
attribute), 630
attribute), 978
STACKARG_SP_BUFF (angr.calling_conventions.SimCCPowerPC64
STAGE (angr.analyses.decompiler.optimization_passes.DivSimplifier
attribute), 630
attribute), 963
STACKARG_SP_BUFF (angr.calling_conventions.SimCCS390X
STAGE (angr.analyses.decompiler.optimization_passes.expr_op_swapper.Ex
attribute), 632
attribute), 984
STACKARG_SP_BUFF (angr.engines.pcode.cc.SimCCPowerPC
STAGE (angr.analyses.decompiler.optimization_passes.ExprOpSwapper
attribute), 594
attribute), 961
STACKARG_SP_BUFF (angr.SimCC attribute), 181
STAGE (angr.analyses.decompiler.optimization_passes.FlipBooleanCmp
STACKARG_SP_DIFF (angr.calling_conventions.SimCC
attribute), 967
attribute), 618
STAGE (angr.analyses.decompiler.optimization_passes.InlinedStringTransfor
STACKARG_SP_DIFF (angr.calling_conventions.SimCCCdecl
attribute), 971
attribute), 622
STAGE (angr.analyses.decompiler.optimization_passes.ite_expr_converter.IT
STACKARG_SP_DIFF (angr.calling_conventions.SimCCMicrosoftAMD64
attribute), 979
attribute), 623
STAGE (angr.analyses.decompiler.optimization_passes.ITEExprConverter
STACKARG_SP_DIFF (angr.calling_conventions.SimCCMicrosoftFastcall
attribute), 962
attribute), 623
STAGE (angr.analyses.decompiler.optimization_passes.ITERegionConverter
STACKARG_SP_DIFF (angr.calling_conventions.SimCCSystemVAMD64
attribute), 962
attribute), 625
STAGE (angr.analyses.decompiler.optimization_passes.mod_simplifier.ModS
STACKARG_SP_DIFF (angr.engines.pcode.cc.SimCCM68k
attribute), 982
attribute), 593
STAGE (angr.analyses.decompiler.optimization_passes.ModSimplifier
STACKARG_SP_DIFF (angr.SimCC attribute), 181
attribute), 964
StackCanarySimplifier(classin STAGE (angr.analyses.decompiler.optimization_passes.multi_simplifier.Mult
angr.analyses.decompiler.optimization_passes),
attribute), 981
961
STAGE (angr.analyses.decompiler.optimization_passes.MultiSimplifier
StackCanarySimplifier(classin
attribute), 963
angr.analyses.decompiler.optimization_passes.stack_canary_simplifier),
STAGE (angr.analyses.decompiler.optimization_passes.optimization_pass.Ba
977
attribute), 975
StackLocationAnnotation(classin STAGE (angr.analyses.decompiler.optimization_passes.optimization_pass.Se
angr.analyses.variable_recovery.annotations),
attribute), 976
1106
STAGE (angr.analyses.decompiler.optimization_passes.optimization_pass.Str
StackPointerTracker (class in angr.analyses), 822
attribute), 977
StackPointerTracker(classin STAGE (angr.analyses.decompiler.optimization_passes.register_save_area_s
angr.analyses.stack_pointer_tracker), 1105
attribute), 984
StackPointerTrackerState(classin STAGE (angr.analyses.decompiler.optimization_passes.RegisterSaveAreaSim
angr.analyses.stack_pointer_tracker), 1104
attribute), 966
STAGE (angr.analyses.decompiler.optimization_passes.base_ptr_save_simplifier.BasePointerSaveSimplifier
STAGE (angr.analyses.decompiler.optimization_passes.ret_addr_save_simpl
attribute), 978attribute), 984
Index

1387

angr

STAGE (angr.analyses.decompiler.optimization_passes.RetAddrSaveSimplifier
attribute), 1098
attribute), 967
state (angr.analyses.reaching_definitions.engine_vex.SimEngineRDVEX
STAGE (angr.analyses.decompiler.optimization_passes.ReturnDeduplicator
attribute), 1074
attribute), 968
state (angr.analyses.variable_recovery.engine_ail.SimEngineVRAILSTAGE (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorHigh
attribute), 1114
attribute), 965
state (angr.analyses.variable_recovery.engine_base.SimEngineVRBase
STAGE (angr.analyses.decompiler.optimization_passes.stack_canary_simplifier.StackCanarySimplifier
attribute), 1114
attribute), 977
state (angr.analyses.variable_recovery.engine_vex.SimEngineVRVEXSTAGE (angr.analyses.decompiler.optimization_passes.StackCanarySimplifier
attribute), 1114
attribute), 961
state (angr.analyses.vfg.PendingJob attribute), 1135
STAGE (angr.analyses.decompiler.optimization_passes.SwitchDefaultCaseDuplicatorstate (angr.engines.UberEngine attribute), 551
attribute), 970
state (angr.procedures.stubs.format_parser.FormatString
STAGE (angr.analyses.decompiler.optimization_passes.WinStackCanarySimplifier
property), 603
attribute), 968
state (angr.sim_procedure.SimProcedure attribute), 601
STAGE (angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_simplifier.X86GccGetPcSimplifier
state (angr.SimProcedure attribute), 149
attribute), 985
state (angr.state_plugins.cgc.SimStateCGC attribute),
STAGE (angr.analyses.decompiler.optimization_passes.X86GccGetPcSimplifier339
attribute), 967
state(angr.state_plugins.history.SimStateHistory
start (angr.analyses.decompiler.structured_codegen.base.PositionMappingElement
attribute), 336
attribute), 1001
state (angr.state_plugins.inspect.SimInspector atstart (angr.analyses.decompiler.structured_codegen.PositionMappingElement
tribute), 302
attribute), 997
state (angr.state_plugins.libc.SimStateLibc attribute),
start (angr.keyed_region.RegionObject attribute), 781
306
start (angr.keyed_region.StoredObject attribute), 781
state (angr.state_plugins.plugin.SimStatePlugin atstart() (angr.distributed.worker.Worker method), 1207
tribute), 298
start() (angr.state_plugins.Unicorn method), 262
state (angr.state_plugins.posix.SimSystemPosix atstart()(angr.state_plugins.unicorn_engine.Unicorn
tribute), 313
method), 356
state (angr.state_plugins.SimMemView attribute), 278
startpoint (angr.knowledge_plugins.Function at- state (angr.state_plugins.SimStatePlugin attribute), 227
tribute), 658
state (angr.state_plugins.solver.SimSolver attribute),
startpoint (angr.knowledge_plugins.functions.Function
326
attribute), 705
state (angr.state_plugins.unicorn_engine.Unicorn atstartpoint (angr.knowledge_plugins.functions.function.Function tribute), 356
attribute), 717
state (angr.state_plugins.view.SimMemView attribute),
startpoint (angr.knowledge_plugins.functions.soot_function.SootFunction389
attribute), 725
state (angr.storage.file.SimFileBase attribute), 393
stash (angr.exploration_techniques.spiller_db.PickledStatestate (angr.storage.memory_mixins.paged_memory.paged_memory_mixin.
attribute), 529
attribute), 462
stash()(angr.sim_manager.SimulationManager state (angr.storage.memory_mixins.paged_memory.pages.ultra_page.Ultra
method), 503
attribute), 479
stash() (angr.SimulationManager method), 171
state (angr.storage.memory_mixins.paged_memory.pages.UltraPage
stashed (angr.sim_manager.SimulationManager atattribute), 473
tribute), 499
state_blank() (angr.SimOS method), 164
stashed (angr.SimulationManager attribute), 168
state_blank() (angr.simos.cgc.SimCGC method),
stashes (angr.sim_manager.SimulationManager prop1182
erty), 500
state_blank()(angr.simos.javavm.SimJavaVM
stashes (angr.SimulationManager property), 168
method), 1185
Stat (class in angr.state_plugins), 279
state_blank() (angr.simos.linux.SimLinux method),
Stat (class in angr.state_plugins.filesystem), 313
1181
state (angr.analyses.propagator.engine_ail.SimEnginePropagatorAIL
state_blank() (angr.simos.SimCGC method), 1176
attribute), 1036
state_blank() (angr.simos.SimJavaVM method), 1177
state (angr.analyses.propagator.engine_vex.SimEnginePropagatorVEX
state_blank() (angr.simos.SimLinux method), 1175
attribute), 1036
state_blank() (angr.simos.SimOS method), 1172
state (angr.analyses.reaching_definitions.engine_ail.SimEngineRDAIL
state_blank() (angr.simos.simos.SimOS method),
1388

Index

angr

1179
StateOption (class in angr.sim_state_options), 223
state_blank() (angr.simos.SimWindows method), 1176 states (angr.knowledge_plugins.propagations.PropagationModelstate_blank()(angr.simos.windows.SimWindows
attribute), 702
method), 1184
Static (angr.analyses.disassembly.SootExpressionInvoke
state_call() (angr.SimOS method), 164
attribute), 1143
state_call()(angr.simos.javavm.SimJavaVM STATIC (angr.simos.windows.SecurityCookieInit atmethod), 1185
tribute), 1184
state_call() (angr.simos.SimJavaVM method), 1178
static_exits() (angr.sim_procedure.SimProcedurestate_call() (angr.simos.SimOS method), 1172
method), 602
state_call() (angr.simos.simos.SimOS method), 1180 static_exits() (angr.SimProcedure method), 149
state_entry() (angr.SimOS method), 164
StaticFindMixin(classinstate_entry() (angr.simos.cgc.SimCGC method),angr.storage.memory_mixins), 440
1182
StaticFindMixin(classinstate_entry()(angr.simos.javavm.SimJavaVM
angr.storage.memory_mixins.regioned_memory),method), 1185
482
state_entry() (angr.simos.linux.SimLinux method), StaticFindMixin(classin1182
angr.storage.memory_mixins.regioned_memory.static_find_mixin)
state_entry() (angr.simos.SimCGC method), 1176
490
state_entry() (angr.simos.SimJavaVM method), 1178 StaticHooker (angr.analyses.analysis.KnownAnalysesPluginstate_entry() (angr.simos.SimLinux method), 1175
attribute), 832
state_entry() (angr.simos.SimOS method), 1172
StaticHooker (class in angr.analyses), 811
state_entry() (angr.simos.simos.SimOS method), StaticHooker (class in angr.analyses.static_hooker),
1180
1153
state_entry() (angr.simos.SimWindows method), 1176 StaticObjectFinder (class in angr.analyses), 830
state_entry()(angr.simos.windows.SimWindows StaticObjectFinder(classinmethod), 1184
angr.analyses.find_objects_static), 1140
state_full_init() (angr.SimOS method), 164step()(angr.distributed.worker.BadStatesDropper
state_full_init()(angr.simos.linux.SimLinuxmethod), 1206
method), 1182
step() (angr.distributed.worker.ExplorationStatusNotifier
state_full_init() (angr.simos.SimLinux method),
method), 1206
1175
step() (angr.exploration_techniques.DFS method), 514
state_full_init() (angr.simos.SimOS method), 1172 step() (angr.exploration_techniques.dfs.DFS method),state_full_init() (angr.simos.simos.SimOS method),5251180
step() (angr.exploration_techniques.Director method),state_priority() (angr.exploration_techniques.Spiller
516
static method), 518
step() (angr.exploration_techniques.director.Director
state_priority() (angr.exploration_techniques.spiller.Spiller
method), 537
static method), 529
step() (angr.exploration_techniques.driller_core.DrillerCore
StateHierarchy (class in angr), 175
method), 533
StateHierarchy (class in angr.state_hierarchy), 505
step()(angr.exploration_techniques.DrillerCore
statement_id (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.AbstractLocation
method), 509
property), 491
step() (angr.exploration_techniques.ExplorationTechniquestatement_location()
method), 506(angr.analyses.decompiler.region_simplifiers.expr_folding.ExpressionLocation
step() (angr.exploration_techniques.Explorer method),
method), 989
513
StatementLocation(classin step() (angr.exploration_techniques.explorer.Explorer
angr.analyses.decompiler.region_simplifiers.expr_folding), method), 525989
step()(angr.exploration_techniques.LengthLimiter
statements (angr.analyses.decompiler.structured_codegen.c.CFunction
method), 515
attribute), 1004
step() (angr.exploration_techniques.lengthlimiter.LengthLimiter
statements (angr.analyses.decompiler.structured_codegen.c.CStatements
method), 526
attribute), 1005
step() (angr.exploration_techniques.manual_mergepoint.ManualMergepoi
statements (angr.engines.pcode.lifter.IRSB property),
method), 526
567
step() (angr.exploration_techniques.ManualMergepoint
Index

1389

angr

method), 518
method), 521
step() (angr.exploration_techniques.memory_watcher.MemoryWatcher
step_state() (angr.exploration_techniques.symbion.Symbion
method), 543
method), 542
step() (angr.exploration_techniques.MemoryWatcher step_state()(angr.exploration_techniques.Tracer
method), 522
method), 512
step() (angr.exploration_techniques.Spiller method), step_state() (angr.exploration_techniques.tracer.Tracer
518
method), 532
step()(angr.exploration_techniques.spiller.Spiller step_state() (angr.exploration_techniques.Veritesting
method), 529
method), 515
step() (angr.exploration_techniques.stochastic.StochasticSearch
step_state() (angr.exploration_techniques.veritesting.Veritesting
method), 540
method), 530
step() (angr.exploration_techniques.StochasticSearch step_state() (angr.ExplorationTechnique method),
method), 519
175
step()(angr.exploration_techniques.StubStasher step_state() (angr.sim_manager.SimulationManager
method), 524
method), 502
step()(angr.exploration_techniques.Suggestions step_state() (angr.SimulationManager method), 170
method), 523
stmt (angr.analyses.decompiler.structured_codegen.c.CUnsupportedStatem
step() (angr.exploration_techniques.suggestions.Suggestions
attribute), 1009
method), 543
stmt_can_move_to() (angr.analyses.decompiler.optimization_passes.Dup
step() (angr.exploration_techniques.Symbion method),
method), 973520
stmt_classes (angr.analyses.decompiler.peephole_optimizations.base.Peestep() (angr.exploration_techniques.symbion.Symbion
attribute), 986
method), 541
stmt_classes (angr.analyses.decompiler.peephole_optimizations.base.Peestep()(angr.exploration_techniques.Threading
attribute), 985
method), 514
stmt_comments (angr.angrdb.models.DbStructuredCodestep() (angr.exploration_techniques.threading.Threading
attribute), 922
method), 529
stmt_idx (angr.analyses.cfg.cfg_fast.FunctionEdge atstep() (angr.exploration_techniques.Timeout method),
tribute), 886523
stmt_idx (angr.analyses.decompiler.clinic.DataRefDesc
step() (angr.exploration_techniques.timeout.Timeout
attribute), 951
method), 524
stmt_idx (angr.analyses.decompiler.region_simplifiers.expr_folding.Exprestep() (angr.exploration_techniques.Tracer method),attribute), 989
512
stmt_idx (angr.analyses.decompiler.region_simplifiers.expr_folding.Statem
step()(angr.exploration_techniques.tracer.Tracer
attribute), 989
method), 532
stmt_idx(angr.analyses.disassembly.SootStatement
step() (angr.exploration_techniques.unique.UniqueSearchproperty), 1143
method), 540
stmt_idx (angr.code_location.CodeLocation attribute),
step()(angr.exploration_techniques.UniqueSearch780
method), 520
stmt_idx (angr.engines.UberEngine attribute), 551
step() (angr.ExplorationTechnique method), 174
stmt_idx (angr.errors.SimError attribute), 1201
step() (angr.sim_manager.SimulationManager method), stmt_idx (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump
501
attribute), 701step() (angr.sim_state.SimState method), 222
stmt_idx (angr.knowledge_plugins.cfg.IndirectJump atstep() (angr.SimState method), 178
tribute), 681
step() (angr.SimulationManager method), 169
stmt_idx (angr.knowledge_plugins.xrefs.XRef attribute),
step_back() (angr.analyses.reaching_definitions.call_trace.CallTrace776
method), 1073
stmt_idx (angr.knowledge_plugins.xrefs.xref.XRef atstep_state() (angr.exploration_techniques.ExplorationTechnique tribute), 778
method), 507
stmt_idx (angr.SimError attribute), 159
step_state() (angr.exploration_techniques.Slicecutor stmt_idx (angr.state_plugins.unicorn_engine.VEXStmtDetails
method), 508
attribute), 351
step_state() (angr.exploration_techniques.slicecutor.Slicecutor
stmt_observe() (angr.analyses.reaching_definitions.reaching_definitions.
method), 534
method), 1078
step_state() (angr.exploration_techniques.Symbion stmt_observe() (angr.analyses.reaching_definitions.ReachingDefinitionsA
1390

Index

angr

method), 1056
STOP_SYMBOLIC_WRITE_ADDR
stmt_observe() (angr.analyses.ReachingDefinitionsAnalysis(angr.state_plugins.unicorn_engine.STOP
method), 820
attribute), 352
stmts (angr.analyses.decompiler.structured_codegen.c.CMultiStatementExpression
STOP_SYSCALL (angr.state_plugins.unicorn_engine.STOP
attribute), 1015
attribute), 351
stmts (angr.codenode.SootBlockNode attribute), 1171
STOP_SYSCALL_ARM (angr.state_plugins.unicorn_engine.STOP
stmts_to_instrument
attribute), 352(angr.analyses.cfg.indirect_jump_resolvers.jumptable.JumpTableProcessorState
STOP_UNKNOWN_MEMORY_WRITE_SIZE
attribute), 900(angr.state_plugins.unicorn_engine.STOP
stmts_used (angr.engines.pcode.lifter.IRSB property),
attribute), 352
566
STOP_UNSUPPORTED_EXPR_GETIStochasticSearch(classin(angr.state_plugins.unicorn_engine.STOP
angr.exploration_techniques), 519
attribute), 352
StochasticSearch(classin STOP_UNSUPPORTED_EXPR_UNKNOWN
angr.exploration_techniques.stochastic),(angr.state_plugins.unicorn_engine.STOP
539
attribute), 352
STOP (class in angr.state_plugins.unicorn_engine), 351
STOP_UNSUPPORTED_STMT_CAS
stop() (angr.distributed.Server method), 1205
(angr.state_plugins.unicorn_engine.STOP
stop() (angr.distributed.server.Server method), 1206
attribute), 352
stop() (angr.Server method), 206
STOP_UNSUPPORTED_STMT_DIRTYSTOP_ERROR (angr.state_plugins.unicorn_engine.STOP(angr.state_plugins.unicorn_engine.STOP
attribute), 351
attribute), 352
STOP_EXECNONE (angr.state_plugins.unicorn_engine.STOP STOP_UNSUPPORTED_STMT_LLSC
attribute), 352(angr.state_plugins.unicorn_engine.STOP
STOP_HLT (angr.state_plugins.unicorn_engine.STOP atattribute), 352
tribute), 352
STOP_UNSUPPORTED_STMT_LOADG
stop_message (angr.state_plugins.unicorn_engine.STOP(angr.state_plugins.unicorn_engine.STOP
attribute), 352
attribute), 352
STOP_NODECODE (angr.state_plugins.unicorn_engine.STOP STOP_UNSUPPORTED_STMT_PUTI
attribute), 352(angr.state_plugins.unicorn_engine.STOP
STOP_NORMAL (angr.state_plugins.unicorn_engine.STOP
attribute), 352
attribute), 351
STOP_UNSUPPORTED_STMT_STOREGSTOP_NOSTART (angr.state_plugins.unicorn_engine.STOP(angr.state_plugins.unicorn_engine.STOP
attribute), 352
attribute), 352
stop_reason (angr.state_plugins.unicorn_engine.StopDetails
STOP_UNSUPPORTED_STMT_UNKNOWN
attribute), 353(angr.state_plugins.unicorn_engine.STOP
STOP_SEGFAULT (angr.state_plugins.unicorn_engine.STOP
attribute), 352
attribute), 352
STOP_VEX_LIFT_FAILEDSTOP_STOPPOINT (angr.state_plugins.unicorn_engine.STOP(angr.state_plugins.unicorn_engine.STOP
attribute), 351
attribute), 352
STOP_SYMBOLIC_BLOCK_EXIT_CONDITIONSTOP_X86_CPUID (angr.state_plugins.unicorn_engine.STOP(angr.state_plugins.unicorn_engine.STOP
attribute), 352
attribute), 352
STOP_ZERO_DIV (angr.state_plugins.unicorn_engine.STOP
STOP_SYMBOLIC_BLOCK_EXIT_TARGET
attribute), 352(angr.state_plugins.unicorn_engine.STOP
STOP_ZEROPAGE (angr.state_plugins.unicorn_engine.STOP
attribute), 352
attribute), 352
STOP_SYMBOLIC_PC (angr.state_plugins.unicorn_engine.STOP
StopDetails(classin
attribute), 352
angr.state_plugins.unicorn_engine), 353
STOP_SYMBOLIC_READ_ADDR
stopped (angr.distributed.Server property), 1205
(angr.state_plugins.unicorn_engine.STOP
stopped (angr.distributed.server.Server property), 1206
attribute), 352
stopped (angr.Server property), 206
STOP_SYMBOLIC_READ_SYMBOLIC_TRACKING_DISABLED storage (angr.state_plugins.sim_action.SimActionData(angr.state_plugins.unicorn_engine.STOP atproperty), 597
tribute), 352
storage (angr.state_plugins.SimActionData property),
Index

1391

angr

264
store() (angr.storage.memory_mixins.dirty_addrs_mixin.DirtyAddrsMixin
Store (class in angr.analyses.typehoon.typevars), 1125
method), 451
store() (angr.analyses.stack_pointer_tracker.StackPointerTrackerState
store() (angr.storage.memory_mixins.DirtyAddrsMixin
method), 1105
method), 418
store() (angr.sim_type.SimCppClass method), 651
store() (angr.storage.memory_mixins.HistoryTrackingMixin
store() (angr.sim_type.SimStruct method), 649
method), 430store() (angr.sim_type.SimType method), 639
store() (angr.storage.memory_mixins.InspectMixinHighstore() (angr.sim_type.SimTypeArray method), 645
method), 417
store() (angr.sim_type.SimTypeBool method), 643
store() (angr.storage.memory_mixins.JavaVmMemoryMixin
store() (angr.sim_type.SimTypeChar method), 642
method), 443
store() (angr.sim_type.SimTypeFloat method), 648
store() (angr.storage.memory_mixins.KeyValueMemoryMixin
store() (angr.sim_type.SimTypeNum method), 641
method), 443
store() (angr.sim_type.SimTypeNumOffset method), store()(angr.storage.memory_mixins.ListPage652
method), 431
store() (angr.sim_type.SimTypeReg method), 641
store() (angr.storage.memory_mixins.MemoryRegionMetaMixin
store() (angr.sim_type.SimTypeWideChar method), 643
method), 441
store() (angr.sim_type.SimTypeWString method), 646
store()(angr.storage.memory_mixins.MVListPage
store() (angr.state_plugins.debug_variables.SimDebugVariable
method), 433
method), 381
store() (angr.storage.memory_mixins.name_resolution_mixin.NameResolu
store() (angr.state_plugins.light_registers.SimLightRegisters
method), 447
method), 333
store() (angr.storage.memory_mixins.NameResolutionMixin
store()(angr.state_plugins.SimDebugVariable
method), 420
method), 297
store() (angr.storage.memory_mixins.paged_memory.paged_memory_mix
store() (angr.state_plugins.SimLightRegisters method),
method), 460
250
store() (angr.storage.memory_mixins.paged_memory.pages.history_tracki
store() (angr.state_plugins.SimMemView method), 279
method), 474
store()(angr.state_plugins.view.SimMemView store() (angr.storage.memory_mixins.paged_memory.pages.HistoryTracki
method), 390
method), 467
store() (angr.storage.memory_mixins.actions_mixin.ActionsMixinHighstore() (angr.storage.memory_mixins.paged_memory.pages.list_page.List
method), 449
method), 476
store() (angr.storage.memory_mixins.actions_mixin.ActionsMixinLow
store() (angr.storage.memory_mixins.paged_memory.pages.ListPage
method), 449
method), 468
store() (angr.storage.memory_mixins.ActionsMixinHigh store() (angr.storage.memory_mixins.paged_memory.pages.mv_list_page.
method), 414
method), 456
store() (angr.storage.memory_mixins.ActionsMixinLow store() (angr.storage.memory_mixins.paged_memory.pages.MVListPage
method), 415
method), 470
store() (angr.storage.memory_mixins.address_concretization_mixin.AddressConcretizationMixin
store() (angr.storage.memory_mixins.paged_memory.pages.ultra_page.Ul
method), 453
method), 478
store() (angr.storage.memory_mixins.AddressConcretizationMixin
store() (angr.storage.memory_mixins.paged_memory.pages.UltraPage
method), 416
method), 472
store() (angr.storage.memory_mixins.bvv_conversion_mixin.DataNormalizationMixin
store() (angr.storage.memory_mixins.PagedMemoryMixin
method), 448
method), 424
store() (angr.storage.memory_mixins.clouseau_mixin.InspectMixinHighstore() (angr.storage.memory_mixins.regioned_memory.MemoryRegionM
method), 453
method), 483
store() (angr.storage.memory_mixins.conditional_store_mixin.ConditionalMixin
store() (angr.storage.memory_mixins.regioned_memory.region_meta_mix
method), 453
method), 491
store() (angr.storage.memory_mixins.ConditionalMixin store() (angr.storage.memory_mixins.regioned_memory.regioned_memor
method), 417
method), 486
store() (angr.storage.memory_mixins.convenient_mappings_mixin.ConvenientMappingsMixin
store() (angr.storage.memory_mixins.regioned_memory.RegionedMemory
method), 455
method), 480
store() (angr.storage.memory_mixins.ConvenientMappingsMixin
store() (angr.storage.memory_mixins.RegionedMemoryMixin
method), 417
method), 438
store() (angr.storage.memory_mixins.DataNormalizationMixin
store() (angr.storage.memory_mixins.simple_interface_mixin.SimpleInter
method), 417
method), 449
1392

Index

angr

store() (angr.storage.memory_mixins.SimpleInterfaceMixin
strict_block_end (angr.engines.pcode.lifter.Lifter atmethod), 420
tribute), 568
store() (angr.storage.memory_mixins.simplification_mixin.SimplificationMixin
strict_block_end (angr.engines.pcode.lifter.PcodeLifter
method), 454
attribute), 570
store() (angr.storage.memory_mixins.SimplificationMixin String (angr.analyses.proximity_graph.ProxiNodeTypes
method), 420
attribute), 1157
store() (angr.storage.memory_mixins.size_resolution_mixin.SizeConcretizationMixin
String (angr.knowledge_plugins.cfg.memory_data.MemoryDataSort
method), 451
attribute), 695
store() (angr.storage.memory_mixins.size_resolution_mixin.SizeNormalizationMixin
String (angr.knowledge_plugins.cfg.MemoryDataSort
method), 450
attribute), 676
store() (angr.storage.memory_mixins.SizeConcretizationMixin
string (angr.procedures.stubs.format_parser.FormatSpecifier
method), 421
attribute), 604
store() (angr.storage.memory_mixins.SizeNormalizationMixin
string (angr.state_plugins.debug_variables.SimDebugVariable
method), 420
property), 381
store() (angr.storage.memory_mixins.slotted_memory.SlottedMemoryMixin
string (angr.state_plugins.SimDebugVariable propmethod), 495erty), 297
store() (angr.storage.memory_mixins.SlottedMemoryMixinstring_escape()(inmodulemethod), 437
angr.analyses.reassembler), 1145
store()(angr.storage.memory_mixins.UltraPage string_references()
method), 434(angr.knowledge_plugins.Function
method),store() (angr.storage.memory_mixins.underconstrained_mixin.UnderconstrainedMixin660
method), 449
string_references()store() (angr.storage.memory_mixins.UnderconstrainedMixin(angr.knowledge_plugins.functions.Function
method), 422
method), 708
store() (angr.storage.memory_mixins.unwrapper_mixin.UnwrapperMixin
string_references()
method), 454(angr.knowledge_plugins.functions.function.Function
store() (angr.storage.memory_mixins.UnwrapperMixin
method), 719
method), 422
StringProxiNode(classinstore() (angr.vaults.Vault method), 785
angr.analyses.proximity_graph), 1158
store() (angr.vaults.VaultDirShelf method), 786
STRONGREF_STATE (angr.SimStatePlugin attribute), 151
store_array_element()
STRONGREF_STATE (angr.state_plugins.history.SimStateHistory(angr.storage.memory_mixins.JavaVmMemoryMixin
attribute), 333
method), 443
STRONGREF_STATE (angr.state_plugins.plugin.SimStatePlugin
store_array_elements()
attribute), 298(angr.storage.memory_mixins.JavaVmMemoryMixin
STRONGREF_STATE (angr.state_plugins.SimStateHistory
method), 444
attribute), 251
store_tmp() (angr.state_plugins.scratch.SimStateScratch STRONGREF_STATE (angr.state_plugins.SimStatePlugin
method), 346
attribute), 226store_tmp()(angr.state_plugins.SimStateScratch struct (angr.sim_type.SimStructValue property), 649
method), 255
struct (angr.state_plugins.SimMemView attribute), 278
store_variable() (angr.analyses.decompiler.optimization_passes.engine_base.SimplifierAILState
struct (angr.state_plugins.view.SimMemView attribute),
method), 982
389
stored_objects (angr.keyed_region.RegionObject at- Struct (class in angr.analyses.typehoon.typeconsts),
tribute), 781
1129
StoredObject (class in angr.keyed_region), 781
struct_name() (angr.analyses.typehoon.translator.TypeTranslator
StoreHook (class in angr.analyses.cfg.indirect_jump_resolvers.jumptable),method), 1121
901
STRUCT_RETURN_THRESHOLDStoreStatementFinder(classin(angr.calling_conventions.SimCCCdecl
atangr.analyses.decompiler.region_simplifiers.expr_folding), tribute), 622
991
STRUCT_RETURN_THRESHOLD
str_to_c_str() (angr.analyses.decompiler.structured_codegen.c.CConstant(angr.calling_conventions.SimCCMicrosoftAMD64
static method), 1014
attribute), 624
Strict (angr.exploration_techniques.tracer.TracingMode STRUCT_RETURN_THRESHOLD
attribute), 531(angr.calling_conventions.SimCCMicrosoftCdecl
Index

1393

angr

attribute), 623
property), 824
struct_type (angr.analyses.decompiler.structured_codegen.c.CStructField
sub_type (angr.analyses.typehoon.typevars.Subtype atattribute), 1010
tribute), 1122
StructMode (class in angr.state_plugins), 279
subgraph() (angr.knowledge_plugins.Function method),
StructMode (class in angr.state_plugins.view), 390
663
structured_code (angr.angrdb.models.DbKnowledgeBasesubgraph() (angr.knowledge_plugins.functions.Function
attribute), 920
method), 710
structured_code (angr.knowledge_base.KnowledgeBase subgraph() (angr.knowledge_plugins.functions.function.Function
attribute), 654
method), 722
structured_code (angr.KnowledgeBase attribute), 206 subgraph_between_nodes()(inmodulestructured_node_is_simple_return() (in module
angr.utils.graph), 1192
angr.analyses.decompiler.utils), 1023
subject (angr.analyses.reaching_definitions.reaching_definitions.Reaching
StructuredCodeGenerator(inmoduleproperty), 1078
angr.analyses.decompiler), 948
subject (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
StructuredCodeGenerator(inmoduleproperty), 1057
angr.analyses.decompiler.structured_codegen.c), subject(angr.analyses.ReachingDefinitionsAnalysis
1019
property), 821
StructuredCodeManager(classin Subject (class in angr.analyses.reaching_definitions.subject),angr.knowledge_plugins), 672
1097
StructuredCodeManager(classin SubjectType(classinangr.knowledge_plugins.structured_code),
angr.analyses.reaching_definitions.subject),736
1097
StructuredCodeManagerSerializer(classin SubN (class in angr.analyses.typehoon.typevars), 1126
angr.angrdb.serializers.structured_code), 929
subscribe_actions()
structurer_class_from_name()(inmodule(angr.state_plugins.history.SimStateHistory
angr.analyses.decompiler.structuring), 932
method), 335
StructurerBase(classin subscribe_actions()
angr.analyses.decompiler.structuring.structurer_base),(angr.state_plugins.SimStateHistory method),
938
253
STRUCTURING (angr.analyses.decompiler.optimization_passes.ConstPropOptReverter
Subtype (class in angr.analyses.typehoon.typevars),
attribute), 971
1122
STRUCTURING (angr.analyses.decompiler.optimization_passes.optimization_pass.BaseOptimizationPass
SUCCESS (angr.analyses.cfg.indirect_jump_resolvers.mips_elf_fast.Case2Re
attribute), 975
attribute), 897
STRUCTURING (angr.analyses.decompiler.optimization_passes.optimization_pass.StructuringOptimizationPass
successor_func()(angr.annocfg.AnnotatedCFG
attribute), 977
method), 1170
STRUCTURING (angr.analyses.decompiler.optimization_passes.ReturnDeduplicatorsuccessors (angr.analyses.decompiler.graph_region.GraphRegion
attribute), 968
attribute), 959
STRUCTURING (angr.analyses.decompiler.optimization_passes.ReturnDuplicatorHigh
successors (angr.engines.UberEngine attribute), 551
attribute), 965
successors (angr.knowledge_plugins.cfg.cfg_node.CFGNode
StructuringOptimizationPass(classinproperty), 698
angr.analyses.decompiler.optimization_passes.optimization_pass),
successors(angr.knowledge_plugins.cfg.CFGNode976
property), 678
StubStasher (class in angr.exploration_techniques), successors() (angr.analyses.forward_analysis.CallGraphVisitor
524
method), 836
Sub (angr.engines.light.ArithmeticExpression attribute), successors() (angr.analyses.forward_analysis.FunctionGraphVisitor
1031
method), 836
Sub(angr.engines.light.data.ArithmeticExpression successors() (angr.analyses.forward_analysis.LoopVisitor
attribute), 1030
method), 837
Sub (class in angr.analyses.typehoon.typevars), 1123
successors() (angr.analyses.forward_analysis.SingleNodeGraphVisitor
sub_graph (angr.analyses.data_dep.data_dependency_analysis.DataDependencyGraphAnalysis
method), 838
property), 1160
successors() (angr.analyses.forward_analysis.visitors.call_graph.CallGr
sub_graph (angr.analyses.data_dep.DataDependencyGraphAnalysis method), 844
property), 1164
successors() (angr.analyses.forward_analysis.visitors.CallGraphVisitor
sub_graph (angr.analyses.DataDependencyGraphAnalysis
method), 840
1394

Index

angr

successors() (angr.analyses.forward_analysis.visitors.function_graph.FunctionGraphVisitor
method), 678
method), 844
SuccessorsMixin (class in angr.engines), 545
successors() (angr.analyses.forward_analysis.visitors.FunctionGraphVisitor
SuccessorsMixin (class in angr.engines.engine), 552
method), 841
Suggestions (class in angr.exploration_techniques),
successors() (angr.analyses.forward_analysis.visitors.graph.GraphVisitor
523
method), 845
Suggestions(classin
successors() (angr.analyses.forward_analysis.visitors.loop.LoopVisitor
angr.exploration_techniques.suggestions),
method), 847
543
successors() (angr.analyses.forward_analysis.visitors.LoopVisitor
super_type (angr.analyses.typehoon.typevars.Subtype
method), 842
attribute), 1122
successors() (angr.analyses.forward_analysis.visitors.single_node_graph.SingleNodeGraphVisitor
SuperFastpathMixin (class in angr.engines), 547
method), 848
SuperFastpathMixin (class in angr.engines.vex), 557
successors() (angr.analyses.forward_analysis.visitors.SingleNodeGraphVisitor
SUPPORTS_CONCRETE_LOAD
method), 843(angr.storage.memory_mixins.paged_memory.paged_memory_mix
successors() (angr.codenode.CodeNode method),attribute), 459
1170
SUPPORTS_CONCRETE_LOAD
successors() (angr.exploration_techniques.Bucketizer(angr.storage.memory_mixins.paged_memory.pages.ultra_page.U
method), 522
attribute), 477
successors() (angr.exploration_techniques.bucketizer.Bucketizer
SUPPORTS_CONCRETE_LOAD
method), 543(angr.storage.memory_mixins.paged_memory.pages.UltraPage
successors() (angr.exploration_techniques.ExplorationTechnique attribute), 471
method), 507
SUPPORTS_CONCRETE_LOAD
successors() (angr.exploration_techniques.local_loop_seer.LocalLoopSeer(angr.storage.memory_mixins.PagedMemoryMixin
method), 539
attribute), 423
successors() (angr.exploration_techniques.LocalLoopSeer
SUPPORTS_CONCRETE_LOAD
method), 523(angr.storage.memory_mixins.UltraPage
successors() (angr.exploration_techniques.loop_seer.LoopSeer
attribute), 434
method), 538
switch (angr.analyses.decompiler.structured_codegen.c.CSwitchCase
successors() (angr.exploration_techniques.LoopSeer
attribute), 1007
method), 510
switch_case_known_heads
successors() (angr.exploration_techniques.Oppologist(angr.analyses.decompiler.structuring.phoenix.PhoenixStructurer
method), 515
attribute), 940
successors() (angr.exploration_techniques.oppologist.Oppologist
switch_expr (angr.analyses.decompiler.structuring.structurer_nodes.Switc
method), 537
attribute), 937
successors() (angr.exploration_techniques.Slicecutor switch_extract_cmp_bounds()(inmodulemethod), 509
angr.analyses.decompiler.utils), 1020
successors() (angr.exploration_techniques.slicecutor.Slicecutor
switch_variable (angr.analyses.decompiler.structuring.structurer_nodes
method), 534
attribute), 938
successors() (angr.exploration_techniques.Threading SwitchCaseNode(classinmethod), 514
angr.analyses.decompiler.structuring.structurer_nodes),successors() (angr.exploration_techniques.threading.Threading 937
method), 530
SwitchCaseRegion(classin
successors() (angr.ExplorationTechnique method),angr.analyses.decompiler.region_simplifiers.switch_cluster_simpl
175
993
successors()(angr.factory.AngrObjectFactory SwitchClusterFinder(classinmethod), 212
angr.analyses.decompiler.region_simplifiers.switch_cluster_simpl
successors() (angr.sim_manager.SimulationManager
994
method), 502
SwitchClusterReplacer(classin
successors() (angr.SimulationManager method), 170
angr.analyses.decompiler.region_simplifiers.switch_cluster_simpl
successors_and_jumpkinds()994(angr.knowledge_plugins.cfg.cfg_node.CFGNode SwitchDefaultCaseDuplicator(classinmethod), 698
angr.analyses.decompiler.optimization_passes),
successors_and_jumpkinds()
970(angr.knowledge_plugins.cfg.CFGNode
SwitchExpressionSimplifier(class
in
Index

1395

angr

angr.analyses.decompiler.region_simplifiers.switch_expr_simplifier),
angr.storage.memory_mixins.symbolic_merger_mixin),
996
449
Symbion (class in angr.exploration_techniques), 520
symbolize() (angr.analyses.Reassembler method), 813
Symbion (class in angr.exploration_techniques.symbion), symbolize() (angr.analyses.reassembler.Reassembler
541
method), 1152
symbol (angr.analyses.reaching_definitions.function_handler.FunctionCallData
symbolized (angr.analyses.reassembler.Operand propattribute), 1085
erty), 1147
symbol (angr.analyses.reaching_definitions.FunctionCallData
SymbolManager (class in angr.analyses.reassembler),
attribute), 1070
1146
symbol (angr.knowledge_plugins.Function property), sympy_expr_to_claripy_ast()
661(angr.analyses.decompiler.condition_processor.ConditionProcess
symbol(angr.knowledge_plugins.functions.Function
static method), 954
property), 708
sync() (angr.state_plugins.Concrete method), 292
symbol (angr.knowledge_plugins.functions.function.Functionsync() (angr.state_plugins.concrete.Concrete method),
property), 720
359
symbol_hooked_by() (angr.Project method), 156
syscall (angr.analyses.cfg.cfg_fast.CFGJob attribute),
symbol_hooked_by() (angr.project.Project method),889
211
syscall (angr.analyses.cfg.cfg_fast.FunctionCallEdge
symbol_name (angr.analyses.reassembler.NotypeLabel
attribute), 887
property), 1146
syscall (angr.knowledge_plugins.cfg.cfg_node.CFGENodesymbol_name (angr.analyses.reassembler.ObjectLabel
attribute), 700
property), 1146
syscall(angr.knowledge_plugins.cfg.CFGENodesymbolic (angr.analyses.reaching_definitions.MemoryLocation
attribute), 680
property), 1052
syscall() (angr.SimOS method), 165
symbolic (angr.engines.light.data.RegisterOffset prop- syscall() (angr.simos.SimOS method), 1173
erty), 1031
syscall() (angr.simos.simos.SimOS method), 1180
symbolic (angr.engines.light.RegisterOffset property), syscall() (angr.simos.SimUserland method), 1174
1032
syscall() (angr.simos.userland.SimUserland method),symbolic (angr.knowledge_plugins.key_definitions.atoms.MemoryLocation
1183
property), 755
syscall_abi() (angr.SimOS method), 165
SYMBOLIC (angr.simos.windows.SecurityCookieInit at- syscall_abi() (angr.simos.linux.SimLinux method),
tribute), 1184
1181
symbolic (angr.state_plugins.sim_action_object.SimActionObject
syscall_abi() (angr.simos.SimLinux method), 1175
property), 598
syscall_abi() (angr.simos.SimOS method), 1173
symbolic (angr.state_plugins.SimActionObject prop- syscall_abi() (angr.simos.simos.SimOS method),erty), 265
1180
symbolic (angr.storage.memory_object.SimMemoryObject syscall_abi() (angr.simos.SimUserland method),
property), 410
1174
symbolic (angr.storage.SimMemoryObject property), syscall_abi()(angr.simos.userland.SimUserland
385
method), 1183
symbolic() (angr.state_plugins.SimSolver method), 249 syscall_cc() (angr.SimOS method), 165
symbolic()(angr.state_plugins.solver.SimSolver syscall_cc() (angr.simos.SimOS method), 1173
method), 327
syscall_cc() (angr.simos.simos.SimOS method), 1180
symbolic_stop_reasonssyscall_cc() (angr.simos.SimUserland method), 1174
(angr.state_plugins.unicorn_engine.STOP
syscall_cc()(angr.simos.userland.SimUserland
attribute), 353
method), 1183
symbolic_vex_stmts (angr.state_plugins.unicorn_engine.BlockDetails
SYSCALL_ERRNO_START
attribute), 351(angr.calling_conventions.SimCCN64LinuxSyscall
symbolic_vex_stmts_countattribute), 629(angr.state_plugins.unicorn_engine.BlockDetails SYSCALL_ERRNO_START
attribute), 351(angr.calling_conventions.SimCCO32LinuxSyscall
SymbolicMergerMixin(classin
attribute), 629
angr.storage.memory_mixins), 421
SYSCALL_ERRNO_START
SymbolicMergerMixin(classin(angr.calling_conventions.SimCCPowerPC64LinuxSyscall
1396

Index

angr

attribute), 631
static method), 624
SYSCALL_ERRNO_START
syscall_num() (angr.calling_conventions.SimCCX86LinuxSyscall(angr.calling_conventions.SimCCPowerPCLinuxSyscall
static method), 624
attribute), 630
syscall_num() (angr.calling_conventions.SimCCX86WindowsSyscall
SYSCALL_ERRNO_START
static method), 625(angr.calling_conventions.SimCCSyscall
SyscallNode (class in angr.codenode), 1171
attribute), 624Tsyscall_from_addr() (angr.SimOS method), 165
syscall_from_addr() (angr.simos.SimOS method), T (angr.sim_state.SimState attribute), 221
1173
T (angr.SimState attribute), 178
syscall_from_addr()(angr.simos.simos.SimOS tag (angr.analyses.cfg.cfg_base.CFGBase attribute), 881
method), 1180
tag (angr.analyses.cfg.cfg_emulated.CFGEmulated atsyscall_from_addr()(angr.simos.SimUserland
tribute), 877
method), 1174
tag (angr.analyses.cfg.cfg_fast.CFGFast attribute), 890
syscall_from_addr()tag (angr.analyses.cfg.CFGBase attribute), 871(angr.simos.userland.SimUserland
method), tag (angr.analyses.cfg.CFGEmulated attribute), 861
1183
tag (angr.analyses.cfg.CFGFast attribute), 858
syscall_from_number() (angr.SimOS method), 165
tag (angr.analyses.CFGEmulated attribute), 793
syscall_from_number() (angr.simos.SimOS method), tag (angr.analyses.CFGFast attribute), 790
1173
tag (angr.analyses.typehoon.simple_solver.ConstraintGraphNodesyscall_from_number()(angr.simos.simos.SimOS
attribute), 1119
method), 1180
Tag (class in angr.knowledge_plugins.key_definitions.tag),syscall_from_number()(angr.simos.SimUserland
772
method), 1174
tags (angr.analyses.decompiler.structured_codegen.c.CAssignment
syscall_from_number()
attribute), 1007
(angr.simos.userland.SimUserland
method), tags (angr.analyses.decompiler.structured_codegen.c.CBinaryOp
1183
attribute), 1013
syscall_hook()(inmodule tags (angr.analyses.decompiler.structured_codegen.c.CBreakangr.state_plugins.trace_additions), 340
attribute), 1007
syscall_name (angr.knowledge_plugins.cfg.cfg_node.CFGNodetags (angr.analyses.decompiler.structured_codegen.c.CConstantattribute), 699
attribute), 1014
syscall_name (angr.knowledge_plugins.cfg.CFGNode tags (angr.analyses.decompiler.structured_codegen.c.CContinue
attribute), 679
attribute), 1007
syscall_num() (angr.calling_conventions.SimCCAArch64LinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CDoWhileLoop
static method), 628
attribute), 1005
syscall_num() (angr.calling_conventions.SimCCAMD64LinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CFakeVariable
static method), 626
attribute), 1011
syscall_num() (angr.calling_conventions.SimCCAMD64WindowsSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CForLoop
static method), 626
attribute), 1006
syscall_num() (angr.calling_conventions.SimCCARMLinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CFunctionCall
static method), 627
attribute), 1008
syscall_num() (angr.calling_conventions.SimCCN64LinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CGoto
static method), 630
attribute), 1009
syscall_num() (angr.calling_conventions.SimCCO32LinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CIfBreakstatic method), 629
attribute), 1007
syscall_num() (angr.calling_conventions.SimCCPowerPC64LinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CIfElse
static method), 631
attribute), 1006
syscall_num() (angr.calling_conventions.SimCCPowerPCLinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CITE
static method), 630
attribute), 1015
syscall_num() (angr.calling_conventions.SimCCRISCV64LinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CLabelstatic method), 628
attribute), 1010
syscall_num() (angr.calling_conventions.SimCCS390XLinuxSyscall
tags (angr.analyses.decompiler.structured_codegen.c.CMultiStatementExpr
static method), 633
attribute), 1016
syscall_num() (angr.calling_conventions.SimCCSyscall
Index

1397

angr

tags (angr.analyses.decompiler.structured_codegen.c.CRegister
attribute), 936
attribute), 1015
target (angr.analyses.decompiler.structuring.structurer_nodes.ContinueNotags (angr.analyses.decompiler.structured_codegen.c.CReturn
attribute), 936
attribute), 1009
target (angr.analyses.reaching_definitions.call_trace.CallTracetags (angr.analyses.decompiler.structured_codegen.c.CStructField attribute), 1073
attribute), 1010
target (angr.analyses.reaching_definitions.dep_graph.FunctionCallRelatiotags (angr.analyses.decompiler.structured_codegen.c.CSwitchCase attribute), 1079
attribute), 1007
target (angr.analyses.reaching_definitions.GuardUse
tags (angr.analyses.decompiler.structured_codegen.c.CTypeCast
attribute), 1052
attribute), 1014
target (angr.knowledge_plugins.key_definitions.atoms.GuardUse
tags (angr.analyses.decompiler.structured_codegen.c.CUnaryOp
attribute), 753
attribute), 1012
target_idx (angr.analyses.decompiler.optimization_passes.lowered_switch
tags (angr.analyses.decompiler.structured_codegen.c.CVariable
attribute), 980
attribute), 1011
target_idx (angr.analyses.decompiler.structured_codegen.c.CGototags (angr.analyses.decompiler.structured_codegen.c.CWhileLoop attribute), 1009
attribute), 1005
tc2simtype() (angr.analyses.typehoon.translator.TypeTranslator
tags (angr.analyses.reaching_definitions.Definition atmethod), 1121
tribute), 1053
teardown_callsite()tags (angr.analyses.reaching_definitions.function_handler.FunctionEffect(angr.calling_conventions.SimCC
method),attribute), 1083
621
tags (angr.knowledge_plugins.Function attribute), 658
teardown_callsite() (angr.SimCC method), 183
tags (angr.knowledge_plugins.functions.Function at- TechniqueBuilder(classintribute), 706
angr.exploration_techniques), 519
tags (angr.knowledge_plugins.functions.function.Function TechniqueBuilder(classin
attribute), 717
angr.exploration_techniques.tech_builder),tags (angr.knowledge_plugins.functions.soot_function.SootFunction 540
attribute), 725
tell() (angr.SimFileDescriptor method), 194
tags (angr.knowledge_plugins.key_definitions.Definition tell() (angr.SimFileDescriptorDuplex method), 197
attribute), 750
tell() (angr.storage.file.SimFileDescriptor method),tags (angr.knowledge_plugins.key_definitions.definition.Definition 403
attribute), 758
tell()(angr.storage.file.SimFileDescriptorBase
TAINT_ENTITY_MEM (angr.state_plugins.unicorn_engine.TaintEntityEnum
method), 402
attribute), 350
tell()(angr.storage.file.SimFileDescriptorDuplex
TAINT_ENTITY_NONE (angr.state_plugins.unicorn_engine.TaintEntityEnum
method), 406
attribute), 350
TemporaryNode (class in angr.utils.graph), 1192
TAINT_ENTITY_REG (angr.state_plugins.unicorn_engine.TaintEntityEnum
temps (angr.slicer.SimLightState attribute), 1168
attribute), 350
terminate_execution()
TAINT_ENTITY_TMP (angr.state_plugins.unicorn_engine.TaintEntityEnum(angr.engines.soot.engine.SootMixin
staticattribute), 350
method), 559
TaintEntityEnum(classin terminate_execution() (angr.engines.soot.SootMixin
angr.state_plugins.unicorn_engine), 350
static method), 558
taken (angr.exploration_techniques.spiller_db.PickledStateterminate_execution()(angr.engines.SootMixin
attribute), 529
static method), 551
tally()(angr.sim_state_options.SimStateOptions terminate_execution() (angr.Project method), 156
method), 226
terminate_execution()(angr.project.Projecttarget (angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceToSink
method), 212
property), 1101
test_empty_condition_node()target (angr.analyses.cfg_slice_to_sink.CFGSliceToSink(angr.analyses.decompiler.structuring.structurer_nodes.BaseNode
property), 1099
static method), 933
target (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.Case
test_empty_node() (angr.analyses.decompiler.structuring.structurer_nod
attribute), 980
static method), 933
target (angr.analyses.decompiler.structured_codegen.c.CGoto
test_unsupported_overlap()
attribute), 1009
(angr.knowledge_plugins.debug_variables.DebugVariabletarget (angr.analyses.decompiler.structuring.structurer_nodes.BreakNode
method), 735
1398

Index

angr

text (angr.analyses.decompiler.structured_codegen.c.CArrayTypeLength753
attribute), 1016
tmp_deps(angr.state_plugins.sim_action.SimAction
Threading (class in angr.exploration_techniques), 513
property), 595
Threading (class in angr.exploration_techniques.threading),tmp_deps (angr.state_plugins.sim_action.SimActionData529
property), 596
THUMB (angr.analyses.cfg.cfg_fast.ARMDecodingMode tmp_deps (angr.state_plugins.sim_action_object.SimActionObject
attribute), 884
attribute), 597
thumb (angr.Block attribute), 166
tmp_deps (angr.state_plugins.SimAction property), 263
thumb (angr.block.Block attribute), 217
tmp_deps (angr.state_plugins.SimActionData property),
thumb (angr.block.DisassemblerBlock attribute), 216
264
thumb (angr.codenode.CodeNode attribute), 1170
tmp_deps (angr.state_plugins.SimActionObject atthumb (angr.engines.pcode.lifter.PcodeDisassemblerBlock
tribute), 265
attribute), 563
tmp_expr() (angr.state_plugins.scratch.SimStateScratch
thumb (angr.knowledge_plugins.cfg.cfg_node.CFGNodemethod), 346
attribute), 697
tmp_expr()(angr.state_plugins.SimStateScratch
thumb (angr.knowledge_plugins.cfg.CFGNode attribute),
method), 255
678
tmp_id(angr.sim_variable.SimTemporaryVariable
thumb (angr.sim_state.SimState property), 223
attribute), 634
thumb (angr.SimState property), 180
tmp_idx(angr.analyses.reaching_definitions.Tmp
tidy_data_references()
attribute), 1052
(angr.knowledge_plugins.cfg.cfg_model.CFGModeltmp_idx (angr.knowledge_plugins.key_definitions.atoms.Tmp
method), 693
attribute), 753
tidy_data_references()
tmp_idx (angr.knowledge_plugins.key_definitions.definition.DefinitionMatc(angr.knowledge_plugins.cfg.CFGModel
attribute), 756
method), 687
tmp_uses (angr.analyses.reaching_definitions.LiveDefinitions
timed_function()(inmoduleattribute), 1041
angr.state_plugins.solver), 320
tmp_uses (angr.analyses.reaching_definitions.rd_state.ReachingDefinitions
Timeout (class in angr.exploration_techniques), 523
property), 1093
Timeout (class in angr.exploration_techniques.timeout), tmp_uses (angr.analyses.reaching_definitions.ReachingDefinitionsState524
property), 1062
timestamp (angr.exploration_techniques.spiller_db.PickledState
tmp_uses (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefi
attribute), 529
attribute), 762
timethis() (in module angr.utils), 1189
tmp_uses (angr.knowledge_plugins.key_definitions.LiveDefinitions
timethis() (in module angr.utils.timing), 1197
attribute), 740
TLSMixin (class in angr.engines), 546
TmpDepNode (class in angr.analyses.data_dep), 1166
TLSMixin (class in angr.engines.engine), 551
TmpDepNode (class in angr.analyses.data_dep.dep_nodes),TLSProperty (class in angr.engines.engine), 552
1163
Tmp (angr.analyses.data_dep.dep_nodes.DepNodeTypes tmps (angr.analyses.reaching_definitions.LiveDefinitions
attribute), 1161
attribute), 1041
Tmp (angr.analyses.data_dep.DepNodeTypes attribute), tmps (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState
1165
property), 1093
tmp (angr.analyses.propagator.vex_vars.VEXTmp at- tmps (angr.analyses.reaching_definitions.ReachingDefinitionsStatetribute), 1035
property), 1062
TMP
(angr.analyses.reaching_definitions.AtomKind tmps (angr.engines.UberEngine attribute), 551
attribute), 1049
tmps (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitio
TMP (angr.knowledge_plugins.key_definitions.atoms.AtomKind
attribute), 762
attribute), 751
tmps (angr.knowledge_plugins.key_definitions.LiveDefinitions
TMP (angr.state_plugins.sim_action.SimAction attribute),
attribute), 740
595
TmpvarFinder(classin
TMP (angr.state_plugins.SimAction attribute), 262
angr.analyses.propagator.tmpvar_finder),Tmp (class in angr.analyses.cfg.indirect_jump_resolvers.jumptable), 1038899
to_acyclic_graph() (in module angr.utils.graph),
Tmp (class in angr.analyses.reaching_definitions), 1052
1191
Tmp (class in angr.knowledge_plugins.key_definitions.atoms),to_ail_supergraph()(inmodule
Index

1399

angr

angr.analyses.decompiler.utils), 1021
TopMergerMixin(classin
to_bits (angr.analyses.typehoon.typevars.ConvertTo atangr.storage.memory_mixins.top_merger_mixin),
tribute), 1126
458
to_bits (angr.analyses.typehoon.typevars.ReinterpretAs TopType (class in angr.analyses.typehoon.typeconsts),
attribute), 1126
1127
to_claripy() (angr.state_plugins.sim_action_object.SimActionObject
TOUPPER_LOC_ARRAY (angr.state_plugins.libc.SimStateLibc
method), 597
attribute), 304
to_claripy()(angr.state_plugins.SimActionObject TOUPPER_LOC_ARRAY (angr.state_plugins.SimStateLibc
method), 265
attribute), 230
to_codenode() (angr.knowledge_plugins.cfg.cfg_node.CFGNodetraceback (angr.knowledge_plugins.cfg.cfg_node.CFGNodeCreationFailu
method), 699
attribute), 697
to_codenode() (angr.knowledge_plugins.cfg.CFGNode traceflags (angr.engines.pcode.lifter.Lifter attribute),
method), 679
568
to_engine() (angr.engines.concrete.SimEngineConcrete traceflags (angr.engines.pcode.lifter.PcodeLifter atmethod), 560
tribute), 570
to_engine()(angr.engines.SimEngineConcrete Tracer (class in angr.exploration_techniques), 511
method), 549
Tracer (class in angr.exploration_techniques.tracer),
to_outside (angr.analyses.cfg.cfg_fast.FunctionTransitionEdge
531
attribute), 887
TracerDesyncError, 531
to_size (angr.analyses.decompiler.expression_narrower.ExprNarrowingInfo
TracerEnvironmentError, 159, 1201
attribute), 958
TracingMode(classin
to_string() (angr.knowledge_plugins.xrefs.xref_types.XRefTypeangr.exploration_techniques.tracer), 530
static method), 779
track_tmps (angr.analyses.reaching_definitions.LiveDefinitions
to_string() (angr.knowledge_plugins.xrefs.XRefTypeattribute), 1041
static method), 777
track_tmps (angr.knowledge_plugins.key_definitions.live_definitions.LiveD
to_type (angr.analyses.typehoon.typevars.ReinterpretAs
attribute), 762
attribute), 1126
track_tmps (angr.knowledge_plugins.key_definitions.LiveDefinitions
to_valueset() (angr.storage.memory_mixins.regioned_memory.region_data.AddressWrapper
attribute), 740
method), 488
TrackActionsMixin (class in angr.engines), 547
TOLOWER_LOC_ARRAY (angr.state_plugins.libc.SimStateLibcTrackActionsMixin (class in angr.engines.vex), 556
attribute), 304
transition_graph (angr.knowledge_plugins.Function
TOLOWER_LOC_ARRAY (angr.state_plugins.SimStateLibc
attribute), 658
attribute), 230
transition_graph (angr.knowledge_plugins.functions.Function
top (angr.state_plugins.CallStack property), 268
attribute), 705
top (angr.state_plugins.callstack.CallStack property), transition_graph (angr.knowledge_plugins.functions.function.Function
331
attribute), 717
Top (class in angr.analyses.propagator.values), 1034
transition_graph (angr.knowledge_plugins.functions.soot_function.SootF
top() (angr.analyses.reaching_definitions.LiveDefinitions
attribute), 725
static method), 1042
transition_graph_ex()
top() (angr.analyses.reaching_definitions.rd_state.ReachingDefinitionsState(angr.knowledge_plugins.Function
method),method), 1091
662
top() (angr.analyses.reaching_definitions.ReachingDefinitionsStatetransition_graph_ex()
method), 1061
(angr.knowledge_plugins.functions.Function
top() (angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase
method), 710
static method), 1108
transition_graph_ex()
top() (angr.knowledge_plugins.key_definitions.live_definitions.LiveDefinitions(angr.knowledge_plugins.functions.function.Function
static method), 762
method), 722
top() (angr.knowledge_plugins.key_definitions.LiveDefinitionstransitions (angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSlicestatic method), 740
property), 1101
TopCheckerMixin(classin transitions (angr.analyses.cfg_slice_to_sink.CFGSliceToSink
angr.analyses.propagator.top_checker_mixin),
property), 1099
1040
transitions_as_tuples
TopMergerMixin(classin(angr.analyses.cfg_slice_to_sink.cfg_slice_to_sink.CFGSliceToSin
angr.storage.memory_mixins), 421
property), 1101
1400

Index

angr

transitions_as_tuples
property), 1010
(angr.analyses.cfg_slice_to_sink.CFGSliceToSink type (angr.analyses.decompiler.structured_codegen.c.CTypeCast
property), 1099
property), 1014
transitive_closure()type (angr.analyses.decompiler.structured_codegen.c.CUnaryOp(angr.analyses.reaching_definitions.dep_graph.DepGraph property), 1012
method), 1080
type (angr.analyses.decompiler.structured_codegen.c.CVariabletranslate()(angr.calling_conventions.AllocHelper
property), 1011
method), 614
type (angr.analyses.decompiler.structured_codegen.c.CVariableField
TRANSMIT_RECORD(classinproperty), 1012
angr.state_plugins.unicorn_engine), 350
type (angr.analyses.loop_analysis.AnnotatedVariable atTreeIter (class in angr.state_plugins.history), 336
tribute), 1131
trim()(angr.state_plugins.history.SimStateHistory type (angr.analyses.reaching_definitions.subject.Subject
method), 334
property), 1098
trim() (angr.state_plugins.SimStateHistory method), type (angr.angrdb.models.DbComment attribute), 922
253
type (angr.knowledge_plugins.cfg.indirect_jump.IndirectJump
true_node (angr.analyses.decompiler.structuring.structurer_nodes.ConditionNode
attribute), 701
attribute), 934
type (angr.knowledge_plugins.cfg.IndirectJump atTruncation (angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransformationTypes
tribute), 682
attribute), 899
type (angr.knowledge_plugins.xrefs.XRef attribute), 776
try_unpack_const() (angr.engines.light.ArithmeticExpression
type (angr.knowledge_plugins.xrefs.xref.XRef attribute),
static method), 1031
778
try_unpack_const() (angr.engines.light.data.ArithmeticExpression
type (angr.sim_type.TypeRef property), 639
static method), 1030
type_
(angr.analyses.typehoon.typevars.Existencety_ptr() (angr.sim_procedure.SimProcedure method),attribute), 1122
603
type_0 (angr.analyses.typehoon.typevars.Add attribute),
ty_ptr() (angr.SimProcedure method), 1501123
tyenv (angr.engines.pcode.lifter.IRSB property), 566
type_0 (angr.analyses.typehoon.typevars.Sub attribute),type (angr.analyses.data_dep.BaseDepNode property),
1123
1165
type_1 (angr.analyses.typehoon.typevars.Add attribute),type (angr.analyses.data_dep.dep_nodes.BaseDepNode1123
property), 1162
type_1 (angr.analyses.typehoon.typevars.Sub attribute),type (angr.analyses.decompiler.structured_codegen.c.CBinaryOp
1123
property), 1013
type_a (angr.analyses.typehoon.typevars.Equivalence
type (angr.analyses.decompiler.structured_codegen.c.CConstantattribute), 1122
property), 1014
type_b (angr.analyses.typehoon.typevars.Equivalence
type (angr.analyses.decompiler.structured_codegen.c.CDirtyExpression
attribute), 1122
property), 1016
type_constraints (angr.analyses.decompiler.decompilation_cache.Decom
type (angr.analyses.decompiler.structured_codegen.c.CDirtyStatement
attribute), 955
property), 1009
type_constraints (angr.analyses.variable_recovery.engine_base.RichR
type (angr.analyses.decompiler.structured_codegen.c.CExpression attribute), 1114
property), 1004
type_parser_singleton() (in module angr.sim_type),
type (angr.analyses.decompiler.structured_codegen.c.CFakeVariable 653
property), 1011
type_r (angr.analyses.typehoon.typevars.Add attribute),type (angr.analyses.decompiler.structured_codegen.c.CFunctionCall 1123
property), 1008
type_r (angr.analyses.typehoon.typevars.Sub attribute),type (angr.analyses.decompiler.structured_codegen.c.CIndexedVariable1123
property), 1012
type_string (angr.knowledge_plugins.xrefs.XRef proptype (angr.analyses.decompiler.structured_codegen.c.CITEerty), 776
property), 1015
type_string (angr.knowledge_plugins.xrefs.xref.XReftype (angr.analyses.decompiler.structured_codegen.c.CMultiStatementExpression
property), 778
property), 1016
type_to_c_repr_chunks()(inmoduletype (angr.analyses.decompiler.structured_codegen.c.CRegisterangr.analyses.decompiler.structured_codegen.c),property), 1015
1003
type (angr.analyses.decompiler.structured_codegen.c.CStructField
type_var (angr.analyses.typehoon.typevars.DerivedTypeVariable
Index

1401

angr

attribute), 1124
UltraPagesMixin(classin
TypeConstant(classinangr.storage.memory_mixins.paged_memory.paged_memory_mix
angr.analyses.typehoon.typeconsts), 1127
463
TypeConstraint(classin uncache_region()(angr.state_plugins.Unicorn
angr.analyses.typehoon.typevars), 1121
method), 262
Typehoon (class in angr.analyses), 829
uncache_region() (angr.state_plugins.unicorn_engine.Unicorn
Typehoon (class in angr.analyses.typehoon), 1129
method), 356
Typehoon (class in angr.analyses.typehoon.typehoon), unconstrained (angr.sim_manager.SimulationManager
1126
attribute), 499
TypeLifter (class in angr.analyses.typehoon.lifter), unconstrained (angr.SimulationManager attribute),
1116
168
TypeRef (class in angr.sim_type), 639
Unconstrained()(angr.state_plugins.SimSolver
types (angr.knowledge_base.KnowledgeBase attribute),
method), 243
655
Unconstrained() (angr.state_plugins.solver.SimSolver
types (angr.KnowledgeBase attribute), 207
method), 321
types (angr.sim_state_options.StateOption attribute), Undefined (class in angr.knowledge_plugins.key_definitions.undefined),
223
773
types (angr.state_plugins.SimMemView attribute), 276
UnderconstrainedMixin(classintypes (angr.state_plugins.view.SimMemView attribute),
angr.storage.memory_mixins), 422
387
UnderconstrainedMixin(classinTypesStore (class in angr.knowledge_plugins), 672
angr.storage.memory_mixins.underconstrained_mixin),
TypesStore (class in angr.knowledge_plugins.types),
449
701
unfreeze() (angr.analyses.stack_pointer_tracker.FrozenStackPointerTrack
TypeTranslator(classinmethod), 1104
angr.analyses.typehoon.translator), 1121
unhook() (angr.Project method), 155
typevar (angr.analyses.typehoon.simple_solver.ConstraintGraphNodeunhook() (angr.project.Project method), 210
attribute), 1119
unhook_symbol() (angr.Project method), 156
typevar (angr.analyses.typehoon.simple_solver.SketchNodeunhook_symbol() (angr.project.Project method), 211
attribute), 1117
UnicodeString (angr.knowledge_plugins.cfg.memory_data.MemoryDataS
typevar (angr.analyses.variable_recovery.engine_base.RichR
attribute), 695
attribute), 1114
UnicodeString (angr.knowledge_plugins.cfg.MemoryDataSort
TypeVariable(classin
attribute), 676
angr.analyses.typehoon.typevars), 1123
Unicorn (class in angr.state_plugins), 260
TypeVariableReference(classin Unicorn (class in angr.state_plugins.unicorn_engine),angr.analyses.typehoon.typeconsts), 1129
354
TypeVariables(classin unified_local_vars (angr.analyses.decompiler.structured_codegen.c.CF
angr.analyses.typehoon.typevars), 1125
attribute), 1004
unified_variable (angr.analyses.decompiler.structured_codegen.c.CVarU
attribute), 1011
unified_variable() (angr.knowledge_plugins.variables.variable_manag
UberEngine (class in angr.engines), 551
method), 733
UberEnginePcode (class in angr.engines), 551
unify_arch_name()(inmoduleuc (angr.state_plugins.Unicorn property), 262
angr.calling_conventions), 633
uc (angr.state_plugins.unicorn_engine.Unicorn propunify_variables() (angr.knowledge_plugins.variables.variable_manageerty), 356
method), 733
UC_CONFIG (angr.state_plugins.Unicorn attribute), 260
uninit_read_base(angr.analyses.cfg.indirect_jump_resolvers.jumptable.
UC_CONFIG (angr.state_plugins.unicorn_engine.Unicorn
attribute),899
attribute), 354(classinUltraPage (class in angr.storage.memory_mixins), 434 UninitReadMeta
angr.analyses.cfg.indirect_jump_resolvers.jumptable),
UltraPage (class in angr.storage.memory_mixins.paged_memory.pages),
898
471
union()(angr.state_plugins.sim_action_object.SimActionObject
UltraPage (class in angr.storage.memory_mixins.paged_memory.pages.ultra_page),method), 598
477
union()(angr.state_plugins.SimActionObject method),
UltraPagesMixin(classin
265
angr.storage.memory_mixins), 426
1402

Index

angr

unique() (angr.state_plugins.SimSolver method), 249
UnmatchedStatementsException, 850
unique() (angr.state_plugins.solver.SimSolver method), unmount() (angr.state_plugins.filesystem.SimFilesystem327
method), 316
unique_type_name() (angr.knowledge_plugins.types.TypesStore
unmount() (angr.state_plugins.SimFilesystem method),
method), 701
282
unique_type_name() (angr.knowledge_plugins.TypesStoreunpack_array()(inmodulemethod), 672
angr.analyses.decompiler.structured_codegen.c),UniqueSearch (class in angr.exploration_techniques),
1002
519
unpack_pointer()(inmoduleUniqueSearch(classinangr.analyses.decompiler.structured_codegen.c),angr.exploration_techniques.unique), 540
1002
Uniwrapper (class in angr.state_plugins.unicorn_engine), unpack_typeref()(inmodule354
angr.analyses.decompiler.structured_codegen.c),Unknown (angr.analyses.proximity_graph.ProxiNodeTypes
1002
attribute), 1157
unqualified_name() (angr.sim_type.NamedTypeMixin
UNKNOWN (angr.analyses.typehoon.simple_solver.ConstraintGraphTag method), 640
attribute), 1118
unreachable_history()
Unknown (angr.knowledge_plugins.cfg.indirect_jump.IndirectJumpType(angr.state_hierarchy.StateHierarchy method),attribute), 700
506
Unknown (angr.knowledge_plugins.cfg.IndirectJumpType unreachable_history()(angr.StateHierarchy
attribute), 682
method), 176
Unknown (angr.knowledge_plugins.cfg.memory_data.MemoryDataSort
unreachable_state()
attribute), 695(angr.state_hierarchy.StateHierarchy method),
Unknown (angr.knowledge_plugins.cfg.MemoryDataSort
506
attribute), 676
unreachable_state() (angr.StateHierarchy method),
Unknown (class in angr.analyses.cfg.cfb), 873
176
UnknownProxiNode(classin unresolvables (angr.analyses.cfg.cfg_emulated.CFGEmulated
angr.analyses.proximity_graph), 1158
property), 881
UnknownSize(classin unresolvables (angr.analyses.cfg.CFGEmulated propangr.knowledge_plugins.key_definitions.unknown_size),erty), 864
773
unresolvables (angr.analyses.CFGEmulated propUnknownSizeTag(classinerty), 796
angr.knowledge_plugins.key_definitions.tag),unresolved_indirect_jumps
773(angr.knowledge_base.KnowledgeBase propunlinks(angr.state_plugins.filesystem.SimFilesystemerty), 655
property), 315
unresolved_indirect_jumps (angr.KnowledgeBase
unlinks (angr.state_plugins.SimFilesystem property),
property), 207
281
unroll_loops() (angr.analyses.cfg.cfg_emulated.CFGEmulated
unmap_by_address() (angr.storage.memory_mixins.regioned_memory.region_data.RegionMap
method), 879
method), 489
unroll_loops()(angr.analyses.cfg.CFGEmulated
unmap_region() (angr.storage.memory_mixins.address_concretization_mixin.AddressConcretizationMixin
method), 863
method), 453
unroll_loops()(angr.analyses.CFGEmulated
unmap_region() (angr.storage.memory_mixins.AddressConcretizationMixin
method), 795
method), 416
unsat (angr.sim_manager.SimulationManager attribute),
unmap_region() (angr.storage.memory_mixins.paged_memory.paged_memory_mixin.PagedMemoryMixin499
method), 461
unsat (angr.SimulationManager attribute), 168
unmap_region() (angr.storage.memory_mixins.PagedMemoryMixin
unsat_core() (angr.state_plugins.SimSolver method),
method), 425
246
unmatched_blocks (angr.analyses.bindiff.FunctionDiff unsat_core()(angr.state_plugins.solver.SimSolver
property), 852
method), 325
unmatched_functions (angr.analyses.BinDiff prop- unset_stack_address_mapping()erty), 810(angr.storage.memory_mixins.regioned_memory.regioned_memor
unmatched_functions (angr.analyses.bindiff.BinDiff
method), 487
property), 853
unset_stack_address_mapping()
Index

1403

angr

(angr.storage.memory_mixins.regioned_memory.RegionedMemoryMixin
update_resolved_addrs()
method), 481(angr.knowledge_plugins.IndirectJumps
unset_stack_address_mapping()
method), 667(angr.storage.memory_mixins.RegionedMemoryMixin
update_switch_case_list()(inmodulemethod), 439
angr.analyses.decompiler.region_simplifiers.switch_cluster_simpl
UnsignedExtension (angr.analyses.cfg.indirect_jump_resolvers.jumptable.AddressTransformationTypes994
attribute), 899
update_variable_types() (angr.analyses.Typehoon
Unspecified (angr.knowledge_plugins.cfg.memory_data.MemoryDataSort
method), 829
attribute), 695
update_variable_types()
Unspecified (angr.knowledge_plugins.cfg.MemoryDataSort(angr.analyses.typehoon.Typehoon
method),attribute), 676
1130
unstash()(angr.sim_manager.SimulationManager update_variable_types()
method), 503(angr.analyses.typehoon.typehoon.Typehoon
unstash() (angr.SimulationManager method), 172
method), 1127
unsupported_reasons
UpdateArgumentsOption(classin(angr.state_plugins.unicorn_engine.STOP
angr.analyses.calling_convention), 853
attribute), 353
UpdateWhenCCHasNoArgs
UnsupportedCCallError, 161, 1202
(angr.analyses.calling_convention.UpdateArgumentsOption
UnsupportedDirtyError, 161, 1203
attribute), 854
UnsupportedIRExprError, 160, 1202
upper_bound (angr.analyses.typehoon.simple_solver.SketchNode
UnsupportedIROpError, 160, 1202
attribute), 1117
UnsupportedIRStmtError, 161, 1202
use_exprs (angr.analyses.decompiler.expression_narrower.ExprNarrowing
UnsupportedNodeTypeError, 163, 1204
attribute), 958
UnsupportedSyscallError (in module angr), 161
use_plugin_preset() (angr.misc.plugins.PluginHub
UnsupportedSyscallError (in module angr.errors),
method), 218
1203
use_technique() (angr.sim_manager.SimulationManager
UnwrapperMixin(classinmethod), 500
angr.storage.memory_mixins), 422
use_technique() (angr.SimulationManager method),
UnwrapperMixin(classin
168
angr.storage.memory_mixins.unwrapper_mixin), UsercallArgSession(classin454
angr.calling_conventions), 618
update() (angr.knowledge_plugins.PropagationManager uses (angr.analyses.decompiler.region_simplifiers.expr_folding.Expression
method), 671
attribute), 990
update() (angr.knowledge_plugins.propagations.PropagationManager
Uses (class in angr.knowledge_plugins.key_definitions),
method), 703
748
update()(angr.procedures.definitions.SimLibrary Uses (class in angr.knowledge_plugins.key_definitions.uses),method), 606
773
update() (angr.procedures.definitions.SimSyscallLibrary uses_by_codeloc (angr.analyses.reaching_definitions.LiveDefinitions
method), 610
attribute), 1041
update()(angr.sim_state_options.SimStateOptions uses_by_codeloc (angr.analyses.reaching_definitions.rd_state.ReachingD
method), 225
property), 1093
update() (angr.storage.memory_mixins.regioned_memory.region_meta_mixin.AbstractLocation
uses_by_codeloc (angr.analyses.reaching_definitions.ReachingDefinition
method), 491
property), 1062
update_dbinfo() (angr.angrdb.AngrDB method), 917
uses_by_codeloc (angr.knowledge_plugins.key_definitions.live_definition
update_dbinfo() (angr.angrdb.db.AngrDB method),attribute), 762
918
uses_by_codeloc (angr.knowledge_plugins.key_definitions.LiveDefinition
update_graph_with_super_edits()
attribute), 740(angr.analyses.decompiler.optimization_passes.CodeMotionOptimizationVstatic method), 970
update_labels()(inmodule va_arg() (angr.sim_procedure.SimProcedure method),angr.analyses.decompiler.utils), 1022
602
update_resolved_addrs()
va_arg() (angr.SimProcedure method), 150(angr.knowledge_plugins.indirect_jumps.IndirectJumps
val(angr.analyses.stack_pointer_tracker.Constantmethod), 704
attribute), 1103
1404

Index

angr

val0 (angr.analyses.stack_pointer_tracker.Eq attribute), variable (angr.analyses.loop_analysis.AnnotatedVariable1104
attribute), 1131
val1 (angr.analyses.stack_pointer_tracker.Eq attribute), Variable (angr.analyses.proximity_graph.ProxiNodeTypes1104
attribute), 1157
value (angr.analyses.decompiler.optimization_passes.lowered_switch_simplifier.Case
variable (angr.analyses.variable_recovery.engine_base.RichR
attribute), 980
attribute), 1114
value (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.ConditionalRegion
variable (angr.knowledge_plugins.key_definitions.definition.DefinitionMa
attribute), 993
attribute), 756
value (angr.analyses.decompiler.structured_codegen.c.CConstantvariable (angr.knowledge_plugins.variables.variable_access.VariableAcce
attribute), 1014
attribute), 727
value (angr.analyses.reaching_definitions.ConstantSrc variable_hash (angr.analyses.decompiler.optimization_passes.lowered_sw
attribute), 1052
attribute), 980
value (angr.analyses.reaching_definitions.function_handler.FunctionEffectvariable_list_repr_chunks()
attribute), 1083
(angr.analyses.decompiler.structured_codegen.c.CFunction
value (angr.angrdb.models.DbInformation attribute),
method), 1004
919
variable_manager (angr.analyses.decompiler.structured_codegen.c.CFun
value (angr.knowledge_plugins.key_definitions.atoms.ConstantSrc attribute), 1004
attribute), 753
variable_manager (angr.analyses.variable_recovery.variable_recovery_b
value (angr.knowledge_plugins.key_definitions.heap_address.HeapAddress
property), 1109
property), 759
variable_manager (angr.knowledge_plugins.key_definitions.definition.De
value (angr.sim_variable.SimConstantVariable atattribute), 756
tribute), 634
variable_type (angr.analyses.decompiler.structured_codegen.c.CVariablevalue (angr.state_plugins.unicorn_engine.MemoryValue
attribute), 1011
attribute), 350
VariableAccess(classinvalue (angr.state_plugins.unicorn_engine.RegisterValueangr.knowledge_plugins.variables.variable_access),
attribute), 350
727
Value (class in angr.analyses.disassembly), 1144
VariableAccessSort(classinvalue_tuple() (angr.analyses.data_dep.BaseDepNodeangr.knowledge_plugins.variables.variable_access),method), 1165
727
value_tuple() (angr.analyses.data_dep.dep_nodes.BaseDepNode
VariableAnnotation(classinmethod), 1161
angr.analyses.variable_recovery.variable_recovery_base),values() (angr.knowledge_plugins.patches.PatchManager
1107
method), 674
VariableManager (class in angr.knowledge_plugins),
values()(angr.knowledge_plugins.PatchManager
665
method), 670
VariableManager(classinvalues() (angr.state_plugins.globals.SimStateGlobals
angr.knowledge_plugins.variables), 726
method), 344
VariableManager(classinvalues() (angr.state_plugins.SimStateGlobals method),angr.knowledge_plugins.variables.variable_manager),
270
733
values() (angr.storage.memory_mixins.paged_memory.pages.multi_values.MultiValues
VariableManagerInternal(classinmethod), 458
angr.knowledge_plugins.variables.variable_manager),
var_collections (angr.angrdb.models.DbKnowledgeBase728
attribute), 920
VariableManagerSerializer(classin
var_to_typevar (angr.analyses.decompiler.decompilation_cache.DecompilationCacheangr.angrdb.serializers.variables), 928
attribute), 955
VariableProxiNode(classin
VarDepNode (class in angr.analyses.data_dep), 1165
angr.analyses.proximity_graph), 1157
VarDepNode (class in angr.analyses.data_dep.dep_nodes), VariableRecovery (angr.analyses.analysis.KnownAnalysesPlugin
1162
attribute), 833
variable (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.ConditionalRegion
VariableRecovery (class in angr.analyses), 815
attribute), 993
VariableRecovery(classinvariable (angr.analyses.decompiler.region_simplifiers.switch_cluster_simplifier.SwitchCaseRegion
angr.analyses.variable_recovery), 1115
attribute), 994
VariableRecovery(classinvariable (angr.analyses.decompiler.structured_codegen.c.CVariableangr.analyses.variable_recovery.variable_recovery),attribute), 1011
1113
Index

1405

angr

VariableRecoveryBase(classin variance (angr.analyses.typehoon.typevars.Store propangr.analyses.variable_recovery.variable_recovery_base), erty), 1125
1107
varid (angr.knowledge_plugins.key_definitions.atoms.VirtualVariable
VariableRecoveryFast
attribute), 754(angr.analyses.analysis.KnownAnalysesPlugin Vault (class in angr.vaults), 785
attribute), 833
VaultDict (class in angr.vaults), 785
VariableRecoveryFast (class in angr.analyses), 816
VaultDir (class in angr.vaults), 785
VariableRecoveryFast(classin VaultDirShelf (class in angr.vaults), 786
angr.analyses.variable_recovery), 1115
VaultPickler (class in angr.vaults), 784
VariableRecoveryFast(classin VaultShelf (class in angr.vaults), 786
angr.analyses.variable_recovery.variable_recovery_fast),
VaultUnpickler (class in angr.vaults), 785
1111
VendorPreset (class in angr.misc.plugins), 219
VariableRecoveryFastState(classin Veritesting (angr.analyses.analysis.KnownAnalysesPluginangr.analyses.variable_recovery.variable_recovery_fast), attribute), 833
1110
Veritesting (class in angr.analyses), 808
VariableRecoveryState(classin Veritesting (class in angr.analyses.veritesting), 1133
angr.analyses.variable_recovery.variable_recovery),
Veritesting (class in angr.exploration_techniques),
1112
515
VariableRecoveryStateBase(classin Veritesting(classinangr.analyses.variable_recovery.variable_recovery_base), angr.exploration_techniques.veritesting),
1107
530
variables (angr.analyses.variable_recovery.variable_recovery_base.VariableRecoveryStateBase
VeritestingError, 1132
property), 1109
VERSION (angr.angrdb.AngrDB attribute), 916
variables(angr.knowledge_base.KnowledgeBase VERSION (angr.angrdb.db.AngrDB attribute), 918
attribute), 654
vex (angr.Block property), 166variables (angr.KnowledgeBase attribute), 206
vex (angr.block.Block property), 217
variables (angr.state_plugins.sim_action_object.SimActionObject
vex_nostmt (angr.Block property), 166
property), 598
vex_nostmt (angr.block.Block property), 217
variables (angr.state_plugins.SimActionObject prop- VEXIRSBScanner(classinerty), 265
angr.analyses.variable_recovery.irsb_scanner),variables (angr.storage.memory_object.SimMemoryObject
1115
property), 410
VEXLifter (class in angr.engines.vex), 557
variables (angr.storage.SimMemoryObject property), VEXMemVar (class in angr.analyses.propagator.vex_vars),
384
1035
variables() (angr.state_plugins.SimSolver method), VEXMixin (class in angr.engines.vex), 556
249
VEXReg (class in angr.analyses.propagator.vex_vars),variables()(angr.state_plugins.solver.SimSolver
1035
method), 327
VEXResilienceMixin (class in angr.engines.vex), 556
variables_in_use (angr.analyses.decompiler.structured_codegen.c.CFunction
VEXSlicingMixin (class in angr.engines.vex), 556
attribute), 1004
VEXStmtDetails(classin
VariableSourceAnnotation(classinangr.state_plugins.unicorn_engine), 351
angr.analyses.variable_recovery.annotations), VEXTmp (class in angr.analyses.propagator.vex_vars),
1106
1035
VariableType(classin VEXVariable(classinangr.knowledge_plugins.variables), 726
angr.analyses.propagator.vex_vars), 1035
VariableType(classin VFG(angr.analyses.analysis.KnownAnalysesPluginangr.knowledge_plugins.variables.variable_manager),
attribute), 833
727
VFG (class in angr.analyses), 804
VariableTypes (class in angr.analyses.loop_analysis), VFG (class in angr.analyses.vfg), 1137
1131
VFGJob (class in angr.analyses.vfg), 1134
variance (angr.analyses.typehoon.simple_solver.ConstraintGraphNode
VFGNode (class in angr.analyses.vfg), 1136
attribute), 1119
Virtual (angr.analyses.disassembly.SootExpressionInvoke
variance (angr.analyses.typehoon.typevars.BaseLabel
attribute), 1143
property), 1125
VirtualVariable(class
in
1406

Index

angr

angr.knowledge_plugins.key_definitions.atoms), widen() (angr.SimFileDescriptorDuplex method), 198754
widen() (angr.SimHeapBrk method), 201
visited_blocks (angr.analyses.reaching_definitions.function_handler.FunctionCallData
widen() (angr.SimHeapPTMalloc method), 204
attribute), 1085
widen() (angr.SimPackets method), 190
visited_blocks (angr.analyses.reaching_definitions.FunctionCallData
widen() (angr.SimState method), 179
attribute), 1071
widen() (angr.SimStatePlugin method), 152
visited_blocks (angr.analyses.reaching_definitions.reaching_definitions.ReachingDefinitionsAnalysis
widen() (angr.state_plugins.CallStack method), 267
property), 1077
widen()(angr.state_plugins.callstack.CallStackvisited_blocks (angr.analyses.reaching_definitions.ReachingDefinitionsAnalysis
method), 330
property), 1056
widen() (angr.state_plugins.cgc.SimStateCGC method),visited_blocks (angr.analyses.ReachingDefinitionsAnalysis
338
property), 819
widen() (angr.state_plugins.Concrete method), 292
visitor (angr.analyses.reaching_definitions.subject.Subjectwiden() (angr.state_plugins.concrete.Concrete method),
property), 1098
359
VSA_DDG (angr.analyses.analysis.KnownAnalysesPlugin widen() (angr.state_plugins.filesystem.SimConcreteFilesystem
attribute), 832
method), 319
VSA_DDG (class in angr.analyses), 808
widen()(angr.state_plugins.filesystem.SimFilesystem
VSA_DDG (class in angr.analyses.vsa_ddg), 1139
method), 316
Vtable (angr.knowledge_plugins.cfg.indirect_jump.IndirectJumpType
widen()(angr.state_plugins.globals.SimStateGlobals
attribute), 700
method), 344
Vtable (angr.knowledge_plugins.cfg.IndirectJumpType widen() (angr.state_plugins.heap.heap_brk.SimHeapBrk
attribute), 682
method), 373
Vtable (class in angr.analyses.vtable), 1139
widen() (angr.state_plugins.heap.heap_ptmalloc.SimHeapPTMalloc
VtableFinder (class in angr.analyses), 830
method), 379
VtableFinder (class in angr.analyses.vtable), 1140
widen() (angr.state_plugins.heap.SimHeapBrk method),365
Wwiden()(angr.state_plugins.heap.SimHeapPTMalloc
walk() (angr.analyses.decompiler.ailgraph_walker.AILGraphWalker method), 368
widen()(angr.state_plugins.history.SimStateHistory
method), 949
method), 334
walk() (angr.analyses.decompiler.expression_narrower.ExpressionNarrower
widen()(angr.state_plugins.inspect.SimInspector
method), 958
method), 302
walk() (angr.analyses.decompiler.optimization_passes.const_derefs.BlockWalker
widen() (angr.state_plugins.javavm_classloader.SimJavaVmClassloader
method), 974
method), 361
walk() (angr.analyses.decompiler.region_walker.RegionWalker
widen() (angr.state_plugins.jni_references.SimStateJNIReferences
method), 996
walk() (angr.analyses.decompiler.sequence_walker.SequenceWalker method), 363
widen() (angr.state_plugins.libc.SimStateLibc method),
method), 997
305
walk_node() (angr.analyses.decompiler.optimization_passes.ite_expr_converter.BlockLocatorwiden() (angr.state_plugins.log.SimStateLog method),
method), 979
walk_node() (angr.analyses.decompiler.region_walker.RegionWalker329
widen() (angr.state_plugins.loop_data.SimStateLoopData
method), 996
method), 358
was_parameter (angr.knowledge_plugins.key_definitions.atoms.VirtualVariablewiden()(angr.state_plugins.plugin.SimStatePlugin
property), 754
method), 299
was_reg (angr.knowledge_plugins.key_definitions.atoms.VirtualVariablewiden() (angr.state_plugins.posix.PosixDevFS method),
property), 754307
was_stack (angr.knowledge_plugins.key_definitions.atoms.VirtualVariablewiden()(angr.state_plugins.posix.PosixProcFS
property), 754
method),309
whitelist (angr.analyses.veritesting.CallTracingFilter
widen()(angr.state_plugins.posix.SimSystemPosix
attribute), 1132
method), 313
whitelist_edges (angr.analyses.decompiler.structuring.phoenix.PhoenixStructurer
widen()(angr.state_plugins.PosixDevFS
method), 235
attribute), 940
widen()(angr.state_plugins.PosixProcFS
method), 237
widen() (angr.sim_state.SimState method), 222
widen()(angr.state_plugins.preconstrainer.SimStatePreconstrainer
widen() (angr.SimFile method), 187
method), 348
widen() (angr.SimFileDescriptor method), 196
Index

1407

angr

(angr.state_plugins.scratch.SimStateScratch widen() (angr.storage.file.SimPackets method), 399
method), 347
widen() (angr.storage.file.SimPacketsSlots method), 409
widen() (angr.state_plugins.sim_action_object.SimActionObject
widen() (angr.storage.memory_mixins.JavaVmMemoryMixin
method), 598
method), 445
widen() (angr.state_plugins.SimActionObject method), widen() (angr.storage.memory_mixins.MemoryRegionMetaMixin266
method), 441
widen() (angr.state_plugins.SimFilesystem method), 282 widen() (angr.storage.memory_mixins.regioned_memory.MemoryRegionM
widen() (angr.state_plugins.SimHeapBrk method), 286
method), 483
widen()(angr.state_plugins.SimHeapPTMalloc widen() (angr.storage.memory_mixins.regioned_memory.region_meta_mix
method), 289
method), 492
widen() (angr.state_plugins.SimInspector method), 234 widen() (angr.storage.SimFile method), 384
widen()(angr.state_plugins.SimJavaVmClassloader widened_jobs (angr.analyses.forward_analysis.job_info.JobInfo
method), 296
property), 840
widen() (angr.state_plugins.SimMemView method), 279 width (angr.analyses.data_dep.dep_nodes.MemDepNodewiden() (angr.state_plugins.SimRegNameView method),
property), 1162
275
width (angr.analyses.data_dep.MemDepNode property),
widen() (angr.state_plugins.SimSolver method), 245
1166
widen() (angr.state_plugins.SimStateCGC method), 258 width() (angr.analyses.disassembly.DisassemblyPiece
widen() (angr.state_plugins.SimStateGlobals method),
method), 1141
270
WinStackCanarySimplifier(classinwiden() (angr.state_plugins.SimStateHistory method),angr.analyses.decompiler.optimization_passes),252
968
widen()(angr.state_plugins.SimStateJNIReferences with_arch() (angr.sim_type.SimType method), 638
method), 294
with_arch() (angr.sim_type.TypeRef method), 639
widen() (angr.state_plugins.SimStateLibc method), 231 with_condition (angr.sim_state.SimState property),
widen() (angr.state_plugins.SimStateLog method), 251
223
widen()(angr.state_plugins.SimStateLoopData with_condition (angr.SimState property), 180
method), 273
with_type() (angr.state_plugins.debug_variables.SimDebugVariablewiden() (angr.state_plugins.SimStatePlugin method),
method), 381
228
with_type()(angr.state_plugins.SimDebugVariablewiden()(angr.state_plugins.SimStatePreconstrainer
method), 297
method), 271
with_type()(angr.state_plugins.SimMemView
widen() (angr.state_plugins.SimStateScratch method),
method), 278256
with_type()(angr.state_plugins.view.SimMemView
widen() (angr.state_plugins.SimSystemPosix method),
method), 389
241
work() (angr.analyses.complete_calling_conventions.CompleteCallingConv
widen() (angr.state_plugins.solver.SimSolver method),
method), 856
323
work() (angr.analyses.CompleteCallingConventionsAnalysis
widen() (angr.state_plugins.trace_additions.ChallRespInfo
method), 828
method), 341
Worker (class in angr.distributed.worker), 1206
widen() (angr.state_plugins.trace_additions.ZenPlugin WRITE (angr.knowledge_plugins.variables.variable_access.VariableAccessS
method), 343
attribute), 727
widen() (angr.state_plugins.Unicorn method), 261
Write (angr.knowledge_plugins.xrefs.xref_types.XRefTypewiden()(angr.state_plugins.unicorn_engine.Unicorn
attribute), 779
method), 355
Write(angr.knowledge_plugins.xrefs.XRefType
atwiden()(angr.state_plugins.view.SimMemView
tribute), 777
method), 390
WRITE (angr.state_plugins.sim_action.SimActionData atwiden()(angr.state_plugins.view.SimRegNameView
tribute), 596
method), 386
WRITE (angr.state_plugins.SimActionData attribute), 264
widen() (angr.storage.file.SimFile method), 395
write() (angr.SimFile method), 186
widen() (angr.storage.file.SimFileDescriptor method), write() (angr.SimFileBase method), 185405
write() (angr.SimFileStream method), 190
widen()(angr.storage.file.SimFileDescriptorDuplex write() (angr.SimPackets method), 188
method), 407
write() (angr.SimPacketsStream method), 192
widen()

1408

Index

angr

write() (angr.storage.file.SimFile method), 394
X86GccGetPcSimplifier(classinwrite() (angr.storage.file.SimFileBase method), 392
angr.analyses.decompiler.optimization_passes.x86_gcc_getpc_sim
write()(angr.storage.file.SimFileDescriptorBase
985
method), 401
X86PeIatResolver(classinwrite() (angr.storage.file.SimFileStream method), 396
angr.analyses.cfg.indirect_jump_resolvers),
write() (angr.storage.file.SimPackets method), 398
909
write() (angr.storage.file.SimPacketsSlots method), 408 X86PeIatResolver(classinwrite() (angr.storage.file.SimPacketsStream method),angr.analyses.cfg.indirect_jump_resolvers.x86_pe_iat),
400
896
write() (angr.storage.SimFile method), 383
Xor (angr.engines.light.ArithmeticExpression attribute),
write_data() (angr.SimFileDescriptor method), 1941031
write_data() (angr.SimFileDescriptorDuplex method), Xor(angr.engines.light.data.ArithmeticExpression
196
attribute), 1030
write_data()(angr.storage.file.SimFileDescriptor XRef (class in angr.knowledge_plugins.xrefs), 775
method), 403
XRef (class in angr.knowledge_plugins.xrefs.xref ), 777
write_data() (angr.storage.file.SimFileDescriptorBase XRefManager (class in angr.knowledge_plugins), 668
method), 401
XRefManager (class in angr.knowledge_plugins.xrefs),
write_data() (angr.storage.file.SimFileDescriptorDuplex
776
method), 405
XRefManager(classinwrite_msr() (angr.state_plugins.Unicorn method), 262
angr.knowledge_plugins.xrefs.xref_manager),
write_msr() (angr.state_plugins.unicorn_engine.Unicorn
779
method), 356
XRefs (angr.analyses.analysis.KnownAnalysesPlugin atwrite_pos (angr.SimFileDescriptor property), 195
tribute), 833
write_pos (angr.SimFileDescriptorDuplex property), xrefs(angr.angrdb.models.DbKnowledgeBase
at197
tribute), 920
write_pos (angr.storage.file.SimFileDescriptor prop- xrefs (angr.knowledge_base.KnowledgeBase attribute),erty), 404
655
write_pos(angr.storage.file.SimFileDescriptorBase xrefs (angr.knowledge_plugins.Function property), 659
property), 402
xrefs (angr.knowledge_plugins.functions.Function propwrite_pos (angr.storage.file.SimFileDescriptorDuplex
erty), 706
property), 406
xrefs (angr.knowledge_plugins.functions.function.Function
write_storage (angr.SimFileDescriptor property), 194
property), 718
write_storage (angr.SimFileDescriptorDuplex prop- xrefs (angr.KnowledgeBase attribute), 207erty), 197
XRefsAnalysis (class in angr.analyses), 826
write_storage(angr.storage.file.SimFileDescriptor XRefsAnalysis (class in angr.analyses.xrefs), 1156
property), 404
XRefsSerializer(classinwrite_storage (angr.storage.file.SimFileDescriptorBase
angr.angrdb.serializers.xrefs), 928
property), 402
XRefType (class in angr.knowledge_plugins.xrefs), 777
write_storage (angr.storage.file.SimFileDescriptorDuplexXRefType (class in angr.knowledge_plugins.xrefs.xref_types),
property), 406
779
write_to() (angr.knowledge_plugins.variables.variable_manager.VariableManagerInternalZ
method), 729
zen_hook()(inmoduleX
angr.state_plugins.trace_additions), 342(inmoduleX86ElfPicPltResolver(classin zen_memory_write()angr.state_plugins.trace_additions), 342
angr.analyses.cfg.indirect_jump_resolvers),
zen_register_write()(inmodule907
angr.state_plugins.trace_additions), 342
X86ElfPicPltResolver(classin
ZenPlugin (class in angr.state_plugins.trace_additions),
angr.analyses.cfg.indirect_jump_resolvers.x86_elf_pic_plt),
342
897
X86GccGetPcSimplifier(classinangr.analyses.decompiler.optimization_passes),
967

Index

1409