7cc76cffb9
Make SReachingDefinitions reuse per-block virtual-variable definition/use scans across runs instead of re-scanning every block on every invocation. A new BlockDefUses holds the vvar definitions, phi sources, and explicit uses found by scanning a single AIL block; a decompilation-scoped BlockDefUsesCache (owned by Clinic) maps (block addr, block idx) to it and is threaded through every function-mode SRDA call site (AILSimplifier, _make_callsites, ConditionConstProp, RegisterSaveAreaSimplifierAdvanced, GraphDephicationVVarMapping). The cross-block work (observe-based call-site implicit uses, extern/arg reconciliation, phi maps) is unchanged and still runs each time; only the per-block scan is cached. Cache entries are validated by statement-list identity: every block mutation in the decompiler replaces block.statements with a freshly allocated list (Block.copy slices it; dead-assignment removal builds a new list), so a stale entry for a rebuilt block is recomputed automatically. BlockSimplifier can peephole-optimize expressions in place without replacing the list, so Clinic marks those blocks dirty explicitly. update_after_block_edits keeps the cache warm after incremental dead-assignment removal. Standalone SRDA callers that pass no cache (outliner, rust mixin, tests) and block-mode/track_tmps callers keep the original whole-graph scan, byte for byte. An env-gated harness (VERIFY_BLOCK_DEFUSES_CACHE) checks every cache-served collection against a fresh scan. Behavior-preserving: 216 decompiler tests pass, including with both VERIFY_BLOCK_DEFUSES_CACHE and VERIFY_INCREMENTAL_RD enabled. Cache hit rate is 64-75% on the functions measured. Note: profiling shows per-block scanning is only ~2% of decompile time (structuring ~24-46%, typehoon ~15%, SRDA total ~7%), so this is wall-clock-neutral as measured; it is groundwork for further incremental-SRDA work rather than a standalone speedup. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mw6khRGdin2yLi8KLRsQCF |
||
|---|---|---|
| .github | ||
| angr | ||
| corpus_tests | ||
| docs | ||
| native | ||
| tests | ||
| .dockerignore | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| .readthedocs.yml | ||
| Cargo.lock | ||
| Cargo.toml | ||
| COPYRIGHT | ||
| LICENSE | ||
| MANIFEST.in | ||
| pyproject.toml | ||
| README.md | ||
| rust-toolchain.toml | ||
| SECURITY.md | ||
| setup.py | ||
angr
angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot.
Project Links
Homepage: https://angr.io
Project repository: https://github.com/angr/angr
Documentation: https://docs.angr.io
API Documentation: https://docs.angr.io/en/latest/api.html
What is angr?
angr is a suite of Python 3 libraries that let you load a binary and do a lot of cool things to it:
- Disassembly and intermediate-representation lifting
- Program instrumentation
- Symbolic execution
- Control-flow analysis
- Data-dependency analysis
- Value-set analysis (VSA)
- Decompilation
The most common angr operation is loading a binary: p = angr.Project('/bin/bash') If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the top-level-accessible methods and their docstrings.
The short version of "how to install angr" is mkvirtualenv --python=$(which python3) angr && python -m pip install angr.
Example
angr does a lot of binary analysis stuff. To get you started, here's a simple example of using symbolic execution to get a flag in a CTF challenge.
import angr
project = angr.Project("angr-doc/examples/defcamp_r100/r100", auto_load_libs=False)
@project.hook(0x400844)
def print_flag(state):
print("FLAG SHOULD BE:", state.posix.dumps(0))
project.terminate_execution()
project.execute()
Quick Start
- Install Instructions
- Documentation as HTML and sources in the angr Github repository
- Dive right in: top-level-accessible methods
- Examples using angr to solve CTF challenges.
- API Reference
- awesome-angr repo