angr/analyses/backward_slice.py
def _construct_default(self, targets):
        """
        Create a backward slice from a specific statement in a specific block. This is done by traverse the CFG
        backwards, and mark all tainted statements based on dependence graphs (CDG and DDG) provided initially. The
        traversal terminated when we reach the entry point, or when there is no unresolved dependencies.

        :param targets: A list of tuples like (cfg_node, stmt_idx), where cfg_node is a CFGNode instance where the
                        backward slice starts, and it must be included in CFG and CDG. stmt_idx is the ID of the target
                        statement where the backward slice starts.
        """

        # TODO: Support context-sensitivity

        l.debug("Constructing a default backward program slice")

        self.taint_graph = networkx.DiGraph()

        taints = set()
        accessed_taints = set()

        # Fill in the taint set

        for cfg_node, stmt_idx in targets:
            if cfg_node not in self._cfg.graph:
                raise AngrBackwardSlicingError('Target CFGNode %s is not in the CFG.' % cfg_node)

            if stmt_idx == -1:
                new_taints = self._handle_control_dependence(cfg_node)
                taints |= new_taints

            else:
                cl = CodeLocation(cfg_node.addr, stmt_idx)
                taints.add(cl)

        while taints:
            # Pop a tainted code location
            tainted_cl = taints.pop()

            l.debug("Checking taint %s...", tainted_cl)

            # Mark it as picked
            if tainted_cl.block_addr is not None and tainted_cl.stmt_idx is not None:
                # Skip SimProcedures
                self._pick_statement(tainted_cl.block_addr, tainted_cl.stmt_idx)

            # Mark it as accessed
            accessed_taints.add(tainted_cl)

            # Pick all its data dependencies from data dependency graph
            if self._ddg is not None and tainted_cl in self._ddg:
                if isinstance(self._ddg, networkx.DiGraph):
                    predecessors = list(self._ddg.predecessors(tainted_cl))
                else:
                    # angr.analyses.DDG
                    predecessors = list(self._ddg.get_predecessors(tainted_cl))
                l.debug("Returned %d predecessors for %s from data dependence graph", len(predecessors), tainted_cl)

                for p in predecessors:
                    if p not in accessed_taints:
                        taints.add(p)

                    self.taint_graph.add_edge(p, tainted_cl)

            # Handle the control dependence
            for n in self._cfg.model.get_all_nodes(tainted_cl.block_addr):
                new_taints = self._handle_control_dependence(n)

                l.debug("Returned %d taints for %s from control dependence graph", len(new_taints), n)

                for taint in new_taints:
                    if taint not in accessed_taints:
                        taints.add(taint)

                    self.taint_graph.add_edge(taint, tainted_cl)

        # In the end, map the taint graph onto CFG
        self._map_to_cfg()

        Create a backward slice from a specific statement in a specific block. This is done by traverse the CFG
        backwards, and mark all tainted statements based on dependence graphs (CDG and DDG) provided initially. The
        traversal terminated when we reach the entry point, or when there is no unresolved dependencies.

        :param targets: A list of tuples like (cfg_node, stmt_idx), where cfg_node is a CFGNode instance where the
                        backward slice starts, and it must be included in CFG and CDG. stmt_idx is the ID of the target
                        statement where the backward slice starts.
        
Create a backward slice from a specific statement in a specific block. This is done by traverse the CFG
backwards, and mark all tainted statements based on dependence graphs (CDG and DDG) provided initially. The
traversal terminated when we reach the entry point, or when there is no unresolved dependencies.
Create a backward slice from a specific statement in a specific block . This is done by traverse the CFG backwards and mark all tainted statements based on dependence graphs ( CDG and DDG ) provided initially . The traversal terminated when we reach the entry point or when there is no unresolved dependencies .
def _construct_default(self, targets):
        l.debug("Constructing a default backward program slice")
        self.taint_graph = networkx.DiGraph()
        taints = set()
        accessed_taints = set()
        for cfg_node, stmt_idx in targets:
            if cfg_node not in self._cfg.graph:
                raise AngrBackwardSlicingError('Target CFGNode %s is not in the CFG.' % cfg_node)
            if stmt_idx == -1:
                new_taints = self._handle_control_dependence(cfg_node)
                taints |= new_taints
            else:
                cl = CodeLocation(cfg_node.addr, stmt_idx)
                taints.add(cl)
        while taints:
            tainted_cl = taints.pop()
            l.debug("Checking taint %s...", tainted_cl)
            if tainted_cl.block_addr is not None and tainted_cl.stmt_idx is not None:
                self._pick_statement(tainted_cl.block_addr, tainted_cl.stmt_idx)
            accessed_taints.add(tainted_cl)
            if self._ddg is not None and tainted_cl in self._ddg:
                if isinstance(self._ddg, networkx.DiGraph):
                    predecessors = list(self._ddg.predecessors(tainted_cl))
                else:
                    predecessors = list(self._ddg.get_predecessors(tainted_cl))
                l.debug("Returned %d predecessors for %s from data dependence graph", len(predecessors), tainted_cl)
                for p in predecessors:
                    if p not in accessed_taints:
                        taints.add(p)
                    self.taint_graph.add_edge(p, tainted_cl)
            for n in self._cfg.model.get_all_nodes(tainted_cl.block_addr):
                new_taints = self._handle_control_dependence(n)
                l.debug("Returned %d taints for %s from control dependence graph", len(new_taints), n)
                for taint in new_taints:
                    if taint not in accessed_taints:
                        taints.add(taint)
                    self.taint_graph.add_edge(taint, tainted_cl)
        self._map_to_cfg()
def _construct_default ( self , targets ) : l . debug ( "Constructing a default backward program slice" ) self . taint_graph = networkx . DiGraph ( ) taints = set ( ) accessed_taints = set ( ) for cfg_node , stmt_idx in targets : if cfg_node not in self . _cfg . graph : raise AngrBackwardSlicingError ( 'Target CFGNode %s is not in the CFG.' % cfg_node ) if stmt_idx == - 1 : new_taints = self . _handle_control_dependence ( cfg_node ) taints |= new_taints else : cl = CodeLocation ( cfg_node . addr , stmt_idx ) taints . add ( cl ) while taints : tainted_cl = taints . pop ( ) l . debug ( "Checking taint %s..." , tainted_cl ) if tainted_cl . block_addr is not None and tainted_cl . stmt_idx is not None : self . _pick_statement ( tainted_cl . block_addr , tainted_cl . stmt_idx ) accessed_taints . add ( tainted_cl ) if self . _ddg is not None and tainted_cl in self . _ddg : if isinstance ( self . _ddg , networkx . DiGraph ) : predecessors = list ( self . _ddg . predecessors ( tainted_cl ) ) else : predecessors = list ( self . _ddg . get_predecessors ( tainted_cl ) ) l . debug ( "Returned %d predecessors for %s from data dependence graph" , len ( predecessors ) , tainted_cl ) for p in predecessors : if p not in accessed_taints : taints . add ( p ) self . taint_graph . add_edge ( p , tainted_cl ) for n in self . _cfg . model . get_all_nodes ( tainted_cl . block_addr ) : new_taints = self . _handle_control_dependence ( n ) l . debug ( "Returned %d taints for %s from control dependence graph" , len ( new_taints ) , n ) for taint in new_taints : if taint not in accessed_taints : taints . add ( taint ) self . taint_graph . add_edge ( taint , tainted_cl ) self . _map_to_cfg ( )
Create a backward slice from a specific statement in a specific block.
Create a backward slice from a specific statement in a specific block .
"""
        Create a backward slice from a specific statement in a specific block. This is done by traverse the CFG
        backwards, and mark all tainted statements based on dependence graphs (CDG and DDG) provided initially. The
        traversal terminated when we reach the entry point, or when there is no unresolved dependencies.

        :param targets: A list of tuples like (cfg_node, stmt_idx), where cfg_node is a CFGNode instance where the
                        backward slice starts, and it must be included in CFG and CDG. stmt_idx is the ID of the target
                        statement where the backward slice starts.
        """ # TODO: Support context-sensitivity # Fill in the taint set # Pop a tainted code location # Mark it as picked # Skip SimProcedures # Mark it as accessed # Pick all its data dependencies from data dependency graph # angr.analyses.DDG # Handle the control dependence # In the end, map the taint graph onto CFG
self
targets
A list of tuples like (cfg_node, stmt_idx), where cfg_node is a CFGNode instance where the
backward slice starts, and it must be included in CFG and CDG. stmt_idx is the ID of the target
statement where the backward slice starts.
A list of tuples like ( cfg_node stmt_idx ) where cfg_node is a CFGNode instance where the backward slice starts and it must be included in CFG and CDG . stmt_idx is the ID of the target statement where the backward slice starts .