(self, state)
return state
Append state into successor lists.

        :param state: a SimState instance
        :param target: The target (of the jump/call/ret)
        :return: The state
Append state into successor lists.
Append state into successor lists .
def _categorize_successor(self, state):
        """
        Append state into successor lists.

        :param state: a SimState instance
        :param target: The target (of the jump/call/ret)
        :return: The state
        """

        self.all_successors.append(state)
        target = state.scratch.target

        # categorize the state
        if o.APPROXIMATE_GUARDS in state.options and state.solver.is_false(state.scratch.guard, exact=False):
            if o.VALIDATE_APPROXIMATIONS in state.options:
                if state.satisfiable():
                    raise Exception('WTF')
            self.unsat_successors.append(state)
        elif o.APPROXIMATE_SATISFIABILITY in state.options and not state.solver.satisfiable(exact=False):
            if o.VALIDATE_APPROXIMATIONS in state.options:
                if state.solver.satisfiable():
                    raise Exception('WTF')
            self.unsat_successors.append(state)
        elif not state.scratch.guard.symbolic and state.solver.is_false(state.scratch.guard):
            self.unsat_successors.append(state)
        elif o.LAZY_SOLVES not in state.options and not state.satisfiable():
            self.unsat_successors.append(state)
        elif o.NO_SYMBOLIC_JUMP_RESOLUTION in state.options and state.solver.symbolic(target):
            self.unconstrained_successors.append(state)
        elif not state.solver.symbolic(target) and not state.history.jumpkind.startswith("Ijk_Sys"):
            # a successor with a concrete IP, and it's not a syscall
            self.successors.append(state)
            self.flat_successors.append(state)
        elif state.history.jumpkind.startswith("Ijk_Sys"):
            # syscall
            self.successors.append(state)

            # Misuse the ip_at_syscall register to save the return address for this syscall
            # state.ip *might be* changed to be the real address of syscall SimProcedures by syscall handling code in
            # angr
            state.regs.ip_at_syscall = state.ip

            try:
                symbolic_syscall_num, concrete_syscall_nums = self._resolve_syscall(state)
                if concrete_syscall_nums is not None:
                    for i, n in enumerate(concrete_syscall_nums):
                        split_state = state if i == len(concrete_syscall_nums) - 1 else state.copy()
                        split_state.add_constraints(symbolic_syscall_num == n)
                        if split_state.supports_inspect:
                            split_state.inspect.downsize()
                        self._fix_syscall_ip(split_state)

                        self.flat_successors.append(split_state)
                else:
                    # We cannot resolve the syscall number
                    # However, we still put it to the flat_successors list, and angr.SimOS.handle_syscall will pick it
                    # up, and create a "unknown syscall" stub for it.
                    self._fix_syscall_ip(state)
                    self.flat_successors.append(state)
            except (AngrUnsupportedSyscallError, AngrSyscallError):
                self.unsat_successors.append(state)

        else:
            # a successor with a symbolic IP
            _max_targets = state.options.symbolic_ip_max_targets
            _max_jumptable_targets = state.options.jumptable_symbolic_ip_max_targets
            try:
                skip_max_targets_warning = False
                if o.NO_IP_CONCRETIZATION in state.options:
                    # Don't try to concretize the IP
                    cond_and_targets = [ (claripy.true, target) ]
                    max_targets = 0
                    skip_max_targets_warning = True  # don't warn
                elif o.KEEP_IP_SYMBOLIC in state.options:
                    s = claripy.Solver()
                    addrs = s.eval(target, _max_targets + 1, extra_constraints=tuple(state.ip_constraints))
                    if len(addrs) > _max_targets:
                        # It is not a library
                        l.debug("It is not a Library")
                        addrs = state.solver.eval_upto(target, _max_targets + 1)
                        l.debug("addrs :%s", addrs)
                    cond_and_targets = [ (target == addr, addr) for addr in addrs ]
                    max_targets = _max_targets
                else:
                    cond_and_targets = self._eval_target_jumptable(state, target, _max_jumptable_targets + 1)
                    if cond_and_targets is None:
                        # Fallback to the traditional and slow method
                        cond_and_targets = self._eval_target_brutal(state, target, _max_targets + 1)
                        max_targets = _max_targets
                    else:
                        max_targets = _max_jumptable_targets

                if len(cond_and_targets) > max_targets:
                    if not skip_max_targets_warning:
                        l.warning(
                            "Exit state has over %d possible solutions. Likely unconstrained; skipping. %s",
                            max_targets,
                            target.shallow_repr()
                        )
                    self.unconstrained_successors.append(state)
                else:
                    for cond, a in cond_and_targets:
                        split_state = state.copy()
                        if o.KEEP_IP_SYMBOLIC in split_state.options:
                            split_state.regs.ip = target
                        else:
                            split_state.add_constraints(cond, action=True)
                            split_state.regs.ip = a
                        if split_state.supports_inspect:
                            split_state.inspect.downsize()
                        self.flat_successors.append(split_state)
                    self.successors.append(state)
            except SimSolverModeError:
                self.unsat_successors.append(state)

        return state
def _categorize_successor ( self , state ) : self . all_successors . append ( state ) target = state . scratch . target # categorize the state if o . APPROXIMATE_GUARDS in state . options and state . solver . is_false ( state . scratch . guard , exact = False ) : if o . VALIDATE_APPROXIMATIONS in state . options : if state . satisfiable ( ) : raise Exception ( 'WTF' ) self . unsat_successors . append ( state ) elif o . APPROXIMATE_SATISFIABILITY in state . options and not state . solver . satisfiable ( exact = False ) : if o . VALIDATE_APPROXIMATIONS in state . options : if state . solver . satisfiable ( ) : raise Exception ( 'WTF' ) self . unsat_successors . append ( state ) elif not state . scratch . guard . symbolic and state . solver . is_false ( state . scratch . guard ) : self . unsat_successors . append ( state ) elif o . LAZY_SOLVES not in state . options and not state . satisfiable ( ) : self . unsat_successors . append ( state ) elif o . NO_SYMBOLIC_JUMP_RESOLUTION in state . options and state . solver . symbolic ( target ) : self . unconstrained_successors . append ( state ) elif not state . solver . symbolic ( target ) and not state . history . jumpkind . startswith ( "Ijk_Sys" ) : # a successor with a concrete IP, and it's not a syscall self . successors . append ( state ) self . flat_successors . append ( state ) elif state . history . jumpkind . startswith ( "Ijk_Sys" ) : # syscall self . successors . append ( state ) # Misuse the ip_at_syscall register to save the return address for this syscall # state.ip *might be* changed to be the real address of syscall SimProcedures by syscall handling code in # angr state . regs . ip_at_syscall = state . ip try : symbolic_syscall_num , concrete_syscall_nums = self . _resolve_syscall ( state ) if concrete_syscall_nums is not None : for i , n in enumerate ( concrete_syscall_nums ) : split_state = state if i == len ( concrete_syscall_nums ) - 1 else state . copy ( ) split_state . add_constraints ( symbolic_syscall_num == n ) if split_state . supports_inspect : split_state . inspect . downsize ( ) self . _fix_syscall_ip ( split_state ) self . flat_successors . append ( split_state ) else : # We cannot resolve the syscall number # However, we still put it to the flat_successors list, and angr.SimOS.handle_syscall will pick it # up, and create a "unknown syscall" stub for it. self . _fix_syscall_ip ( state ) self . flat_successors . append ( state ) except ( AngrUnsupportedSyscallError , AngrSyscallError ) : self . unsat_successors . append ( state ) else : # a successor with a symbolic IP _max_targets = state . options . symbolic_ip_max_targets _max_jumptable_targets = state . options . jumptable_symbolic_ip_max_targets try : skip_max_targets_warning = False if o . NO_IP_CONCRETIZATION in state . options : # Don't try to concretize the IP cond_and_targets = [ ( claripy . true , target ) ] max_targets = 0 skip_max_targets_warning = True # don't warn elif o . KEEP_IP_SYMBOLIC in state . options : s = claripy . Solver ( ) addrs = s . eval ( target , _max_targets + 1 , extra_constraints = tuple ( state . ip_constraints ) ) if len ( addrs ) > _max_targets : # It is not a library l . debug ( "It is not a Library" ) addrs = state . solver . eval_upto ( target , _max_targets + 1 ) l . debug ( "addrs :%s" , addrs ) cond_and_targets = [ ( target == addr , addr ) for addr in addrs ] max_targets = _max_targets else : cond_and_targets = self . _eval_target_jumptable ( state , target , _max_jumptable_targets + 1 ) if cond_and_targets is None : # Fallback to the traditional and slow method cond_and_targets = self . _eval_target_brutal ( state , target , _max_targets + 1 ) max_targets = _max_targets else : max_targets = _max_jumptable_targets if len ( cond_and_targets ) > max_targets : if not skip_max_targets_warning : l . warning ( "Exit state has over %d possible solutions. Likely unconstrained; skipping. %s" , max_targets , target . shallow_repr ( ) ) self . unconstrained_successors . append ( state ) else : for cond , a in cond_and_targets : split_state = state . copy ( ) if o . KEEP_IP_SYMBOLIC in split_state . options : split_state . regs . ip = target else : split_state . add_constraints ( cond , action = True ) split_state . regs . ip = a if split_state . supports_inspect : split_state . inspect . downsize ( ) self . flat_successors . append ( split_state ) self . successors . append ( state ) except SimSolverModeError : self . unsat_successors . append ( state ) return state