angr.analyses.decompiler.decompiler¶

class angr.analyses.decompiler.decompiler.Decompiler¶

Bases: Analysis

The decompiler analysis.

Run this on a Function object for which a normalized CFG has been constructed. The fully processed output can be found in result.codegen.text

AIL graphs exposed on the result (both on a fresh run and on a cache hit, including caches reloaded from angrdb or the runtime-db spill):

ail_graph (= clinic.cc_graph): the simplified graph before region identification.
clinic.graph: the final graph after region identification and region simplification.
unoptimized_ail_graph (= clinic.unoptimized_graph): a snapshot before the first structure-altering optimization pass; use it for an exact instruction-to-AIL mapping. Only built when save_unoptimized_graph=True is passed; otherwise this attribute is None on both fresh runs and cache hits.

__init__(func, cfg=None, options=None, preset=None, optimization_passes=None, sp_tracker_track_memory=True, peephole_optimizations=None, vars_must_struct=None, flavor='pseudocode', expr_comments=None, stmt_comments=None, ite_exprs=None, binop_operators=None, decompile=True, regen_clinic=False, inline_functions=None, desired_variables=None, update_memory_data=True, want_full_graph=False, generate_code=True, use_cache=True, update_cache=True, expr_collapse_depth=16, clinic_graph=None, clinic_arg_vvars=None, clinic_start_stage=None, clinic_end_stage=None, clinic_skip_stages=(), static_vvars=None, static_buffers=None, codegen_cls=<class 'angr.analyses.decompiler.structured_codegen.c.CStructuredCodeGenerator'>, save_unoptimized_graph=False)¶

Parameters:

func (Function | str | int)
cfg (CFGFast | CFGModel | None)
preset (str | DecompilationPreset | None)
peephole_optimizations (Iterable[type[PeepholeOptimizationStmtBase] | type[PeepholeOptimizationExprBase]] | None)
vars_must_struct (set[str] | None)
update_memory_data (bool)
want_full_graph (bool)
generate_code (bool)
use_cache (bool)
update_cache (bool)
expr_collapse_depth (int)
static_vvars (dict | None)
static_buffers (dict | None)
save_unoptimized_graph (bool)

reflow_variable_types(cache)¶

Re-run type inference on an existing variable recovery result, then rerun codegen to generate new results.

Returns:
Parameters:: cache (DecompilationCache)

find_data_references_and_update_memory_data(seq_node)¶

Parameters:: seq_node (SequenceNode)

transform_graph_from_ssa(ail_graph)¶

Translate an SSA AIL graph out of SSA form. This is useful for producing a non-SSA AIL graph for displaying in angr management.

Parameters:: ail_graph (DiGraph) – The AIL graph to transform out of SSA form.
Return type:: DiGraph
Returns:: The translated AIL graph.

transform_seqnode_from_ssa(seq_node)¶

Return type:: SequenceNode
Parameters:: seq_node (SequenceNode)

llm_refine()¶

Use the configured LLM to suggest improved variable names, function names, and variable types. Returns True if any changes were made.

Return type:: bool

llm_suggest_variable_names(llm_client=None, code_text=None, raise_exc=False)¶

Ask the LLM to suggest better variable names for the decompiled code. Returns True if any variables were renamed.

Parameters:

raise_exc (bool) – If True, exceptions from the LLM call are propagated to the caller. If False (default), exceptions are caught and the method returns False.
code_text (str | None)

Return type:

bool

llm_suggest_function_name(llm_client=None, code_text=None, raise_exc=False)¶

Ask the LLM to suggest a better function name. Only suggests rename for auto-generated names (starting with sub_ or fcn.). Returns True if the function was renamed.

Parameters:

raise_exc (bool) – If True, exceptions from the LLM call are propagated to the caller.
code_text (str | None)

Return type:

bool

llm_suggest_variable_types(llm_client=None, code_text=None, raise_exc=False)¶

Ask the LLM to suggest better C types for variables. Returns True if any variable types were changed.

Parameters:

raise_exc (bool) – If True, exceptions from the LLM call are propagated to the caller.
code_text (str | None)

Return type:

bool

llm_summarize_function(llm_client=None, code_text=None, raise_exc=False)¶

Ask the LLM to produce a natural-language summary of what the decompiled function does. The summary is stored in the DecompilationCache and returned.

Returns the summary string, or None if summarization failed.

Parameters:

raise_exc (bool) – If True, exceptions from the LLM call are propagated to the caller.
code_text (str | None)

Return type:

str | None

static options_to_params(options)¶

Convert decompilation options to a dict of params.

Parameters:: options (list[tuple[DecompilationOption, Any]]) – The decompilation options.
Return type:: dict[str, Any]
Returns:: A dict of keyword arguments.