angr/analyses/girlscout.py
def _process_indirect_jumps(self):
        """
        Execute each basic block with an indeterminiable exit target
        :returns:
        """

        function_starts = set()
        l.info("We have %d indirect jumps", len(self._indirect_jumps))

        for jumpkind, irsb_addr in self._indirect_jumps:
            # First execute the current IRSB in concrete mode

            if len(function_starts) > 20:
                break

            if jumpkind == "Ijk_Call":
                state = self.project.factory.blank_state(addr=irsb_addr, mode="concrete",
                                                    add_options={o.SYMBOLIC_INITIAL_VALUES}
                                                   )
                path = self.project.factory.path(state)
                l.debug(hex(irsb_addr))

                try:
                    r = (path.next_run.successors + path.next_run.unsat_successors)[0]
                    ip = r.solver.eval_one(r.ip)

                    function_starts.add(ip)
                    continue
                except SimSolverModeError as ex:
                    pass

                # Not resolved
                # Do a backward slicing from the call
                irsb = self.project.factory.block(irsb_addr).vex
                stmts = irsb.statements
                # Start slicing from the "next"

                b = Blade(self.cfg, irsb.addr, -1, project=self.project)

                # Debugging output
                for addr, stmt_idx in sorted(list(b.slice.nodes())):
                    irsb = self.project.factory.block(addr).vex
                    stmts = irsb.statements
                    l.debug("%x: %d | %s %d", (addr, stmt_idx), stmts[stmt_idx], b.slice.in_degree((addr, stmt_idx)))

                # Get all sources
                sources = [n for n in b.slice.nodes() if b.slice.in_degree(n) == 0]

                # Create the annotated CFG
                annotatedcfg = AnnotatedCFG(self.project, None, target_irsb_addr=irsb_addr, detect_loops=False)
                annotatedcfg.from_digraph(b.slice)

                for src_irsb, src_stmt_idx in sources:
                    # Use slicecutor to execute each one, and get the address
                    # We simply give up if any exception occurs on the way

                    start_state = self.project.factory.blank_state(addr=src_irsb,
                                                              add_options=
                                                              {o.DO_RET_EMULATION,
                                                               o.TRUE_RET_EMULATION_GUARD}
                                                             )

                    start_path = self.project.factory.path(start_state)

                    # Create the slicecutor
                    slicecutor = Slicecutor(self.project, annotatedcfg, start=start_path, targets=(irsb_addr,))

                    # Run it!
                    try:
                        slicecutor.run()
                    except KeyError as ex:
                        # This is because the program slice is incomplete.
                        # Blade will support more IRExprs and IRStmts
                        l.debug("KeyError occurred due to incomplete program slice.", exc_info=ex)
                        continue

                    # Get the jumping targets
                    for r in slicecutor.reached_targets:
                        if r.next_run.successors:
                            target_ip = r.next_run.successors[0].ip
                            se = r.next_run.successors[0].se

                            if not se.symbolic(target_ip):
                                concrete_ip = se.eval_one(target_ip)
                                function_starts.add(concrete_ip)
                                l.info("Found a function address %x", concrete_ip)

        return function_starts

        Execute each basic block with an indeterminiable exit target
        :returns:
        
Execute each basic block with an indeterminiable exit target
Execute each basic block with an indeterminiable exit target
def _process_indirect_jumps(self):
        function_starts = set()
        l.info("We have %d indirect jumps", len(self._indirect_jumps))
        for jumpkind, irsb_addr in self._indirect_jumps:
            if len(function_starts) > 20:
                break
            if jumpkind == "Ijk_Call":
                state = self.project.factory.blank_state(addr=irsb_addr, mode="concrete",
                                                    add_options={o.SYMBOLIC_INITIAL_VALUES}
                                                   )
                path = self.project.factory.path(state)
                l.debug(hex(irsb_addr))
                try:
                    r = (path.next_run.successors + path.next_run.unsat_successors)[0]
                    ip = r.solver.eval_one(r.ip)
                    function_starts.add(ip)
                    continue
                except SimSolverModeError as ex:
                    pass
                irsb = self.project.factory.block(irsb_addr).vex
                stmts = irsb.statements
                b = Blade(self.cfg, irsb.addr, -1, project=self.project)
                for addr, stmt_idx in sorted(list(b.slice.nodes())):
                    irsb = self.project.factory.block(addr).vex
                    stmts = irsb.statements
                    l.debug("%x: %d | %s %d", (addr, stmt_idx), stmts[stmt_idx], b.slice.in_degree((addr, stmt_idx)))
                sources = [n for n in b.slice.nodes() if b.slice.in_degree(n) == 0]
                annotatedcfg = AnnotatedCFG(self.project, None, target_irsb_addr=irsb_addr, detect_loops=False)
                annotatedcfg.from_digraph(b.slice)
                for src_irsb, src_stmt_idx in sources:
                    start_state = self.project.factory.blank_state(addr=src_irsb,
                                                              add_options=
                                                              {o.DO_RET_EMULATION,
                                                               o.TRUE_RET_EMULATION_GUARD}
                                                             )
                    start_path = self.project.factory.path(start_state)
                    slicecutor = Slicecutor(self.project, annotatedcfg, start=start_path, targets=(irsb_addr,))
                    try:
                        slicecutor.run()
                    except KeyError as ex:
                        l.debug("KeyError occurred due to incomplete program slice.", exc_info=ex)
                        continue
                    for r in slicecutor.reached_targets:
                        if r.next_run.successors:
                            target_ip = r.next_run.successors[0].ip
                            se = r.next_run.successors[0].se
                            if not se.symbolic(target_ip):
                                concrete_ip = se.eval_one(target_ip)
                                function_starts.add(concrete_ip)
                                l.info("Found a function address %x", concrete_ip)
        return function_starts
def _process_indirect_jumps ( self ) : function_starts = set ( ) l . info ( "We have %d indirect jumps" , len ( self . _indirect_jumps ) ) for jumpkind , irsb_addr in self . _indirect_jumps : if len ( function_starts ) > 20 : break if jumpkind == "Ijk_Call" : state = self . project . factory . blank_state ( addr = irsb_addr , mode = "concrete" , add_options = { o . SYMBOLIC_INITIAL_VALUES } ) path = self . project . factory . path ( state ) l . debug ( hex ( irsb_addr ) ) try : r = ( path . next_run . successors + path . next_run . unsat_successors ) [ 0 ] ip = r . solver . eval_one ( r . ip ) function_starts . add ( ip ) continue except SimSolverModeError as ex : pass irsb = self . project . factory . block ( irsb_addr ) . vex stmts = irsb . statements b = Blade ( self . cfg , irsb . addr , - 1 , project = self . project ) for addr , stmt_idx in sorted ( list ( b . slice . nodes ( ) ) ) : irsb = self . project . factory . block ( addr ) . vex stmts = irsb . statements l . debug ( "%x: %d | %s %d" , ( addr , stmt_idx ) , stmts [ stmt_idx ] , b . slice . in_degree ( ( addr , stmt_idx ) ) ) sources = [ n for n in b . slice . nodes ( ) if b . slice . in_degree ( n ) == 0 ] annotatedcfg = AnnotatedCFG ( self . project , None , target_irsb_addr = irsb_addr , detect_loops = False ) annotatedcfg . from_digraph ( b . slice ) for src_irsb , src_stmt_idx in sources : start_state = self . project . factory . blank_state ( addr = src_irsb , add_options = { o . DO_RET_EMULATION , o . TRUE_RET_EMULATION_GUARD } ) start_path = self . project . factory . path ( start_state ) slicecutor = Slicecutor ( self . project , annotatedcfg , start = start_path , targets = ( irsb_addr , ) ) try : slicecutor . run ( ) except KeyError as ex : l . debug ( "KeyError occurred due to incomplete program slice." , exc_info = ex ) continue for r in slicecutor . reached_targets : if r . next_run . successors : target_ip = r . next_run . successors [ 0 ] . ip se = r . next_run . successors [ 0 ] . se if not se . symbolic ( target_ip ) : concrete_ip = se . eval_one ( target_ip ) function_starts . add ( concrete_ip ) l . info ( "Found a function address %x" , concrete_ip ) return function_starts
Execute each basic block with an indeterminiable exit target
Execute each basic block with an indeterminiable exit target
"""
        Execute each basic block with an indeterminiable exit target
        :returns:
        """ # First execute the current IRSB in concrete mode # Not resolved # Do a backward slicing from the call # Start slicing from the "next" # Debugging output # Get all sources # Create the annotated CFG # Use slicecutor to execute each one, and get the address # We simply give up if any exception occurs on the way # Create the slicecutor # Run it! # This is because the program slice is incomplete. # Blade will support more IRExprs and IRStmts # Get the jumping targets
None
self