ailment — angr Intermediate Language#

class ailment.Block(addr, original_size, statements=None, idx=None)[source]#

Bases: object

Describes an AIL block.

addr#
original_size#
statements: List[Statement]#
idx#
copy(statements=None)[source]#
likes(other)[source]#
class ailment.Assignment(*args, **kwargs)[source]#

Bases: Statement

Assignment statement: expr_a = expr_b

dst#
src#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
Return type:

Assignment

eq(expr0, expr1)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.Expression(*args, **kwargs)[source]#

Bases: TaggedObject

The base class of all AIL expressions.

depth#
has_atom(atom, identity=True)[source]#
likes(atom)[source]#
replace(old_expr, new_expr)[source]#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.Const(*args, **kwargs)[source]#

Bases: Atom

value#
bits#
property size#
likes(other)[source]#
property sign_bit#
copy()[source]#
Return type:

Const

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
replace(old_expr, new_expr)#
property tags: Dict#
variable#
variable_offset#
class ailment.Tmp(*args, **kwargs)[source]#

Bases: Atom

tmp_idx#
bits#
property size#
likes(other)[source]#
copy()[source]#
Return type:

Tmp

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
replace(old_expr, new_expr)#
property tags: Dict#
variable#
variable_offset#
class ailment.Register(*args, **kwargs)[source]#

Bases: Atom

reg_offset#
bits#
property size#
likes(atom)[source]#
copy()[source]#
Return type:

Register

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
replace(old_expr, new_expr)#
property tags: Dict#
variable#
variable_offset#
class ailment.UnaryOp(*args, **kwargs)[source]#

Bases: Op

operand#
bits#
variable#
variable_offset#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
property operands#
property size#
copy()[source]#
Return type:

UnaryOp

has_atom(atom, identity=True)[source]#
depth#
idx#
initialize_tags(tags)#
op#
property tags: Dict#
property verbose_op#
class ailment.BinaryOp(*args, **kwargs)[source]#

Bases: Op

OPSTR_MAP = {'Add': '+', 'AddF': '+', 'And': '&', 'CmpEQ': '==', 'CmpF': 'CmpF', 'CmpGE': '>=', 'CmpGEs': '>=s', 'CmpGT': '>', 'CmpGTs': '>s', 'CmpLE': '<=', 'CmpLEs': '<=s', 'CmpLT': '<', 'CmpLTs': '<s', 'CmpNE': '!=', 'Concat': 'CONCAT', 'Div': '/', 'DivF': '/', 'DivMod': '/m', 'LogicalAnd': '&&', 'LogicalOr': '||', 'Mod': '%', 'Mul': '*', 'MulF': '*', 'Or': '|', 'Sar': '>>a', 'Shl': '<<', 'Shr': '>>', 'Sub': '-', 'SubF': '-', 'Xor': '^'}#
COMPARISON_NEGATION = {'CmpEQ': 'CmpNE', 'CmpGE': 'CmpLT', 'CmpGEs': 'CmpLTs', 'CmpGT': 'CmpLE', 'CmpGTs': 'CmpLEs', 'CmpLE': 'CmpGT', 'CmpLEs': 'CmpGTs', 'CmpLT': 'CmpGE', 'CmpLTs': 'CmpGEs', 'CmpNE': 'CmpEQ'}#
operands#
bits#
signed#
variable#
variable_offset#
floating_point#
rounding_mode#
likes(other)[source]#
has_atom(atom, identity=True)[source]#
replace(old_expr, new_expr)[source]#
property verbose_op#
property size#
copy()[source]#
Return type:

BinaryOp

depth#
idx#
initialize_tags(tags)#
op#
property tags: Dict#
class ailment.Manager(name=None, arch=None)[source]#

Bases: object

Parameters:

name (str | None) –

next_atom()[source]#
reset()[source]#
property ins_addr: int | None#
class ailment.IRSBConverter[source]#

Bases: Converter

static convert(irsb, manager)[source]#

Convert the given IRSB to an AIL block

Parameters:
  • irsb – The IRSB to convert

  • manager – The manager to use

Returns:

Returns the converted block

Converter#

exception ailment.converter_common.SkipConversionNotice[source]#

Bases: Exception

args#
with_traceback()#

Exception.with_traceback(tb) – set self.__traceback__ to tb and return self.

class ailment.converter_common.Converter[source]#

Bases: object

static convert(thing)[source]#

Expressions#

class ailment.expression.Expression(*args, **kwargs)[source]#

Bases: TaggedObject

The base class of all AIL expressions.

depth#
has_atom(atom, identity=True)[source]#
likes(atom)[source]#
replace(old_expr, new_expr)[source]#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.expression.Atom(*args, **kwargs)[source]#

Bases: Expression

variable#
variable_offset#
copy()[source]#
depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
likes(atom)#
replace(old_expr, new_expr)#
property tags: Dict#
class ailment.expression.Const(*args, **kwargs)[source]#

Bases: Atom

value#
bits#
property size#
likes(other)[source]#
property sign_bit#
copy()[source]#
Return type:

Const

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
replace(old_expr, new_expr)#
property tags: Dict#
variable#
variable_offset#
class ailment.expression.Tmp(*args, **kwargs)[source]#

Bases: Atom

tmp_idx#
bits#
property size#
likes(other)[source]#
copy()[source]#
Return type:

Tmp

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
replace(old_expr, new_expr)#
property tags: Dict#
variable#
variable_offset#
class ailment.expression.Register(*args, **kwargs)[source]#

Bases: Atom

reg_offset#
bits#
property size#
likes(atom)[source]#
copy()[source]#
Return type:

Register

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
replace(old_expr, new_expr)#
property tags: Dict#
variable#
variable_offset#
class ailment.expression.Op(*args, **kwargs)[source]#

Bases: Expression

op#
property verbose_op#
depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
likes(atom)#
replace(old_expr, new_expr)#
property tags: Dict#
class ailment.expression.UnaryOp(*args, **kwargs)[source]#

Bases: Op

operand#
bits#
variable#
variable_offset#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
property operands#
property size#
copy()[source]#
Return type:

UnaryOp

has_atom(atom, identity=True)[source]#
depth#
idx#
initialize_tags(tags)#
op#
property tags: Dict#
property verbose_op#
class ailment.expression.Convert(*args, **kwargs)[source]#

Bases: UnaryOp

TYPE_INT = 0#
TYPE_FP = 1#
from_bits#
to_bits#
bits#
is_signed#
from_type#
to_type#
rounding_mode#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
Return type:

Convert

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
op#
operand#
property operands#
property size#
property tags: Dict#
variable#
variable_offset#
property verbose_op#
class ailment.expression.Reinterpret(idx, from_bits, from_type, to_bits, to_type, operand, **kwargs)[source]#

Bases: UnaryOp

from_bits#
from_type#
to_bits#
to_type#
bits#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
Return type:

Reinterpret

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
op#
operand#
property operands#
property size#
property tags: Dict#
variable#
variable_offset#
property verbose_op#
class ailment.expression.BinaryOp(*args, **kwargs)[source]#

Bases: Op

OPSTR_MAP = {'Add': '+', 'AddF': '+', 'And': '&', 'CmpEQ': '==', 'CmpF': 'CmpF', 'CmpGE': '>=', 'CmpGEs': '>=s', 'CmpGT': '>', 'CmpGTs': '>s', 'CmpLE': '<=', 'CmpLEs': '<=s', 'CmpLT': '<', 'CmpLTs': '<s', 'CmpNE': '!=', 'Concat': 'CONCAT', 'Div': '/', 'DivF': '/', 'DivMod': '/m', 'LogicalAnd': '&&', 'LogicalOr': '||', 'Mod': '%', 'Mul': '*', 'MulF': '*', 'Or': '|', 'Sar': '>>a', 'Shl': '<<', 'Shr': '>>', 'Sub': '-', 'SubF': '-', 'Xor': '^'}#
COMPARISON_NEGATION = {'CmpEQ': 'CmpNE', 'CmpGE': 'CmpLT', 'CmpGEs': 'CmpLTs', 'CmpGT': 'CmpLE', 'CmpGTs': 'CmpLEs', 'CmpLE': 'CmpGT', 'CmpLEs': 'CmpGTs', 'CmpLT': 'CmpGE', 'CmpLTs': 'CmpGEs', 'CmpNE': 'CmpEQ'}#
operands#
bits#
signed#
variable#
variable_offset#
floating_point#
rounding_mode#
likes(other)[source]#
has_atom(atom, identity=True)[source]#
replace(old_expr, new_expr)[source]#
property verbose_op#
property size#
copy()[source]#
Return type:

BinaryOp

depth#
idx#
initialize_tags(tags)#
op#
property tags: Dict#
class ailment.expression.TernaryOp(*args, **kwargs)[source]#

Bases: Op

OPSTR_MAP = {}#
operands#
bits#
likes(other)[source]#
has_atom(atom, identity=True)[source]#
replace(old_expr, new_expr)[source]#
property verbose_op#
property size#
copy()[source]#
Return type:

TernaryOp

depth#
idx#
initialize_tags(tags)#
op#
property tags: Dict#
class ailment.expression.Load(*args, **kwargs)[source]#

Bases: Expression

addr#
size#
endness#
guard#
alt#
variable#
variable_offset#
property bits#
has_atom(atom, identity=True)[source]#
replace(old_expr, new_expr)[source]#
likes(other)[source]#
copy()[source]#
Return type:

Load

depth#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.expression.ITE(*args, **kwargs)[source]#

Bases: Expression

cond#
iffalse#
iftrue#
bits#
variable#
variable_offset#
likes(atom)[source]#
has_atom(atom, identity=True)[source]#
replace(old_expr, new_expr)[source]#
property size#
copy()[source]#
Return type:

ITE

depth#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.expression.DirtyExpression(*args, **kwargs)[source]#

Bases: Expression

dirty_expr#
bits#
likes(other)[source]#
copy()[source]#
Return type:

DirtyExpression

replace(old_expr, new_expr)[source]#
property size#
depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.expression.VEXCCallExpression(*args, **kwargs)[source]#

Bases: Expression

cee_name#
operands#
bits#
likes(other)[source]#
copy()[source]#
Return type:

VEXCCallExpression

replace(old_expr, new_expr)[source]#
property size#
depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.expression.MultiStatementExpression(idx, stmts, expr, **kwargs)[source]#

Bases: Expression

For representing comma-separated statements and expression in C.

stmts#
expr#
property bits#
property size#
replace(old_expr, new_expr)[source]#
depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
likes(atom)#
property tags: Dict#
class ailment.expression.BasePointerOffset(*args, **kwargs)[source]#

Bases: Expression

bits#
base#
offset#
variable#
variable_offset#
property size#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
Return type:

BasePointerOffset

depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.expression.StackBaseOffset(*args, **kwargs)[source]#

Bases: BasePointerOffset

base#
bits#
depth#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
likes(other)#
offset#
replace(old_expr, new_expr)#
property size#
property tags: Dict#
variable#
variable_offset#
copy()[source]#
Return type:

StackBaseOffset

Statement#

class ailment.statement.Statement(*args, **kwargs)[source]#

Bases: TaggedObject

The base class of all AIL statements.

replace(old_expr, new_expr)[source]#
eq(expr0, expr1)[source]#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.statement.Assignment(*args, **kwargs)[source]#

Bases: Statement

Assignment statement: expr_a = expr_b

dst#
src#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
Return type:

Assignment

eq(expr0, expr1)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.statement.Store(*args, **kwargs)[source]#

Bases: Statement

addr#
data#
size#
endness#
variable#
guard#
offset#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
Return type:

Store

eq(expr0, expr1)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.statement.Jump(idx, target, target_idx=None, **kwargs)[source]#

Bases: Statement

target#
target_idx#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
eq(expr0, expr1)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.statement.ConditionalJump(*args, **kwargs)[source]#

Bases: Statement

condition#
true_target#
false_target#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
Return type:

ConditionalJump

eq(expr0, expr1)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.statement.Call(idx, target, calling_convention=None, prototype=None, args=None, ret_expr=None, fp_ret_expr=None, **kwargs)[source]#

Bases: Expression, Statement

Call is both an expression and a statement. The return expression of a call is defined as the ret_expr if and only if the callee function has one return expression.

target#
calling_convention#
prototype#
args#
ret_expr#
fp_ret_expr#
likes(other)[source]#
property bits#
property size#
property verbose_op#
property op#
replace(old_expr, new_expr)[source]#
copy()[source]#
depth#
eq(expr0, expr1)#
has_atom(atom, identity=True)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.statement.Return(*args, **kwargs)[source]#

Bases: Statement

target#
ret_exprs#
likes(other)[source]#
replace(old_expr, new_expr)[source]#
copy()[source]#
eq(expr0, expr1)#
idx#
initialize_tags(tags)#
property tags: Dict#
class ailment.statement.DirtyStatement(*args, **kwargs)[source]#

Bases: Statement

Wrapper around the original statement, which is usually not convertible (temporarily).

dirty_stmt#
copy()[source]#
Return type:

DirtyStatement

eq(expr0, expr1)#
idx#
initialize_tags(tags)#
replace(old_expr, new_expr)#
property tags: Dict#
class ailment.statement.Label(idx, name, ins_addr, block_idx=None, **kwargs)[source]#

Bases: Statement

A dummy statement that indicates a label with a name.

name#
ins_addr#
block_idx#
likes(other)[source]#
Parameters:

other (Label) –

copy()[source]#
Return type:

Label

eq(expr0, expr1)#
idx#
initialize_tags(tags)#
replace(old_expr, new_expr)#
property tags: Dict#

Misc. Things#

class ailment.block.Block(addr, original_size, statements=None, idx=None)[source]#

Bases: object

Describes an AIL block.

Parameters:

statements (List[Statement]) –

addr#
original_size#
statements: List[Statement]#
idx#
copy(statements=None)[source]#
likes(other)[source]#
class ailment.manager.Manager(name=None, arch=None)[source]#

Bases: object

Parameters:

name (str | None) –

next_atom()[source]#
reset()[source]#
property ins_addr: int | None#
class ailment.tagged_object.TaggedObject(*args, **kwargs)[source]#

Bases: object

A class that takes arbitrary tags.

idx#
initialize_tags(tags)[source]#
property tags: Dict#
ailment.utils.get_bits(expr)[source]#
Return type:

Optional[int]

Parameters:

expr (int | Expression) –

ailment.utils.stable_hash(t)[source]#
Return type:

int

Parameters:

t (Tuple) –

ailment.utils.is_none_or_likeable(arg1, arg2, is_list=False)[source]#

Returns whether two things are both None or can like each other