angr/analyses/backward_slice.py
def is_taint_impacting_stack_pointers(self, simrun_addr, stmt_idx, taint_type, simrun_whitelist=None):
        """
        Query in taint graph to check if a specific taint will taint the stack pointer in the future or not.
        The taint is specified with the tuple (simrun_addr, stmt_idx, taint_type).

        :param simrun_addr:         Address of the SimRun.
        :param stmt_idx:            Statement ID.
        :param taint_type:          Type of the taint, might be one of the following: 'reg', 'tmp', 'mem'.
        :param simrun_whitelist:    A list of SimRun addresses that are whitelisted.
        :returns:                   True/False.
        """

        if simrun_whitelist is None:
            simrun_whitelist = set()
        if type(simrun_whitelist) is not set:
            simrun_whitelist = set(simrun_whitelist)

        # Find the specific taint in our graph
        taint = None
        for n in self.taint_graph.nodes():
            if n.type == taint_type and n.addr == simrun_addr and n.stmt_id == stmt_idx:
                taint = n
                break

        if taint is None:
            raise AngrBackwardSlicingError('The specific taint is not found')

        bfs_tree = networkx.bfs_tree(self.taint_graph, taint)

        # A node is tainting the stack pointer if one of the following criteria holds:
        # - a descendant register is the sp/bp itself

        for descendant in bfs_tree.nodes():
            if descendant.type == 'reg' and (
                        descendant.reg in (self.project.arch.sp_offset, self.project.arch.bp_offset)
            ):
                return True

        return False

        Query in taint graph to check if a specific taint will taint the stack pointer in the future or not.
        The taint is specified with the tuple (simrun_addr, stmt_idx, taint_type).

        :param simrun_addr:         Address of the SimRun.
        :param stmt_idx:            Statement ID.
        :param taint_type:          Type of the taint, might be one of the following: 'reg', 'tmp', 'mem'.
        :param simrun_whitelist:    A list of SimRun addresses that are whitelisted.
        :returns:                   True/False.
        
Query in taint graph to check if a specific taint will taint the stack pointer in the future or not.
The taint is specified with the tuple (simrun_addr, stmt_idx, taint_type).
Query in taint graph to check if a specific taint will taint the stack pointer in the future or not . The taint is specified with the tuple ( simrun_addr stmt_idx taint_type ) .
def is_taint_impacting_stack_pointers(self, simrun_addr, stmt_idx, taint_type, simrun_whitelist=None):
        if simrun_whitelist is None:
            simrun_whitelist = set()
        if type(simrun_whitelist) is not set:
            simrun_whitelist = set(simrun_whitelist)
        taint = None
        for n in self.taint_graph.nodes():
            if n.type == taint_type and n.addr == simrun_addr and n.stmt_id == stmt_idx:
                taint = n
                break
        if taint is None:
            raise AngrBackwardSlicingError('The specific taint is not found')
        bfs_tree = networkx.bfs_tree(self.taint_graph, taint)
        for descendant in bfs_tree.nodes():
            if descendant.type == 'reg' and (
                        descendant.reg in (self.project.arch.sp_offset, self.project.arch.bp_offset)
            ):
                return True
        return False
def is_taint_impacting_stack_pointers ( self , simrun_addr , stmt_idx , taint_type , simrun_whitelist = None ) : if simrun_whitelist is None : simrun_whitelist = set ( ) if type ( simrun_whitelist ) is not set : simrun_whitelist = set ( simrun_whitelist ) taint = None for n in self . taint_graph . nodes ( ) : if n . type == taint_type and n . addr == simrun_addr and n . stmt_id == stmt_idx : taint = n break if taint is None : raise AngrBackwardSlicingError ( 'The specific taint is not found' ) bfs_tree = networkx . bfs_tree ( self . taint_graph , taint ) for descendant in bfs_tree . nodes ( ) : if descendant . type == 'reg' and ( descendant . reg in ( self . project . arch . sp_offset , self . project . arch . bp_offset ) ) : return True return False
Query in taint graph to check if a specific taint will taint the stack pointer in the future or not.
Query in taint graph to check if a specific taint will taint the stack pointer in the future or not .
"""
        Query in taint graph to check if a specific taint will taint the stack pointer in the future or not.
        The taint is specified with the tuple (simrun_addr, stmt_idx, taint_type).

        :param simrun_addr:         Address of the SimRun.
        :param stmt_idx:            Statement ID.
        :param taint_type:          Type of the taint, might be one of the following: 'reg', 'tmp', 'mem'.
        :param simrun_whitelist:    A list of SimRun addresses that are whitelisted.
        :returns:                   True/False.
        """ # Find the specific taint in our graph # A node is tainting the stack pointer if one of the following criteria holds: # - a descendant register is the sp/bp itself
None
self
simrun_addr
Address of the SimRun.
Address of the SimRun .
stmt_idx
None
taint_type
Type of the taint, might be one of the following: 'reg', 'tmp', 'mem'.
Type of the taint might be one of the following : ' reg ' ' tmp ' ' mem ' .
simrun_whitelist
A list of SimRun addresses that are whitelisted.
A list of SimRun addresses that are whitelisted .