* Fix signed division and remainder in the pcode engine
OpBehaviorIntSdiv and OpBehaviorIntSrem used Claripy's `/` and `%`, which are
unsigned bit-vector operations. For negative operands they therefore produced
the same results as the unsigned INT_DIV and INT_REM behaviors.
INT_SDIV now uses claripy.SDiv (truncation toward zero). INT_SREM is defined as
in1 - SDiv(in1, in2) * in2, giving a remainder with the dividend's sign, which
matches the p-code semantics documented in the class comments.
For 64-bit -5 and 2, INT_SDIV now yields -2 (0xfffffffffffffffe) and INT_SREM
yields -1 (0xffffffffffffffff) instead of large unsigned values.
The arithmetic behavior test table enables both INT_SDIV and INT_SREM with the
matching signed reference expressions, and a new concrete test checks mixed-sign
combinations (-5/2, 5/-2, -5/-2, ...) that an unsigned implementation cannot
satisfy.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Use claripy.SMod for INT_SREM
Per review, INT_SREM uses claripy.SMod directly instead of the equivalent
in1 - claripy.SDiv(in1, in2) * in2. Verified identical to a truncated-toward-zero
reference over 100k random 64-bit pairs, including the INT_MIN / -1 corner.
* Address pcode signed arithmetic review comments
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Enable ruff isort rule
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
When CALLLESS option is enabled, the engine skips function calls by
converting Ijk_Call successors to simulate an immediate return. Previously
this was done by setting jumpkind to Ijk_Ret, which caused
CFGEmulated._update_function_transition_graph to treat it as a real
cross-function return, invoking _add_return_from instead of _add_fakeret_to.
As a result, em_ret.graph remained correct (since _graph_add_edge is
jumpkind-agnostic), but function.graph was broken: call blocks had no
predecessors or successors, making function.graph inconsistent with
em_ret.graph.
Fix by changing the jumpkind from Ijk_Ret to Ijk_FakeRet in both
heavy.py and engine.py. This matches the true semantic intent of
CALLLESS — "assume the function returns, continue after the call site"
— and causes _update_function_transition_graph to invoke _add_fakeret_to,
correctly building intra-function edges in function.graph.
Affected files:
- angr/engines/vex/heavy/heavy.py
- angr/engines/engine.py
* Preliminary implementation of a spilling CFG graph.
* Fix some test cases.
* Fix another test case.
* Fixes.
* Lint code.
* Implement InEdgeView and OutEdgeView.
* Implement InDegreeView and OutDegreeView.
* Fixes.
* Use (Node.addr, Node.size) as key.
* Fix test cases.
* More fixes.
* Fix CFGENode support.
* Fix the remaining issues.
* Get rid of SpillingCFGGraph.reverse().
* Some refactoring.
* Oops
* Fix perf issue.
* Fix set size change error during key iteration.
* Fix db_batch_size assignment. Fix some test cases.
* SpillingCFGNodeDict.__setstate__: Initialize self._all_keys.
* Getting rid of the nodes dictionary.
* Fix logic in cfg_emulated.py
* Multiple fixes.
* Type annotation fix.
* Fix missing edges after merging CFGNodes.
* Fix more logic.
* Add Soot CFGNodes to the CFG model.
* Lint and type check.
* Add USE_SPILLING_CFGNODE_DICT and CFGNode.dirty.
* Oops
* Lint code.
* No more pickling of CFGNodes.
* Fix no_ret being None.
* Lint code.
* Some refactor; Destroy the fallback mechanism.
* Fix node dirty bug after deserialization.
* zero extend in OpBehaviorIntRight
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Make pypcode required
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* whoops
* Double whoops
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Altered pcode emulator to take fallthrough jumpkind from IRSB
Previously, this assumed the jumpkind would be "Ijk_Boring";
a good assumption, since that's what pcode always generates.
However, this made it impossible for analyses
to rewrite an IRSB to introduce behavior not modeled by pcode;
for example, syscalls.
* Made it possible to syscall without ip_at_syscall
Pcode-based architectures don't have an ip_at_syscall register,
so existing code would raise an exception if you tried to force one.
Altered code just warns that you may run into problems
on such an architecture. Test your syscall handlers
before your rely on them.
* Added missing field to Pcode test mock
* Fixed linter errors
* Fixed whitespace
* Bump min Python to 3.10
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Remove broken docs run
* Satisfy ruff
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Kevin Phoenix <kevin@kphoenix.us>
* Skip tests if a dependency is missing rather than failing them
* Linter fixes
* Fix typo
* Revert do_trace but raise unittest.SkipTest instead of generic exception
Co-authored-by: Kevin Phoenix <kevin@kphoenix.us>
