(self)
return False
Test if there is any (suspicious) pointer decryption in the code.

        :return: True if there is any pointer decryption, False otherwise.
        :rtype: bool
Test if there is any (suspicious) pointer decryption in the code.
Test if there is any ( suspicious ) pointer decryption in the code .
def _has_integer_used_as_pointers(self):
        """
        Test if there is any (suspicious) pointer decryption in the code.

        :return: True if there is any pointer decryption, False otherwise.
        :rtype: bool
        """

        # check all integer accesses and see if there is any integer being used as a pointer later, but it wasn't
        # classified as a pointer reference

        # we only care about unknown memory data that are 4 bytes long, and is directly referenced from an IRSB
        candidates = [ i for i in self.cfg.memory_data.values() if
                       i.sort in ('unknown', 'integer') and
                       i.size == self.project.arch.bytes and
                       i.irsb_addr is not None
                       ]

        if not candidates:
            return False

        for candidate in candidates:

            # if the candidate is in .bss, we don't care about it
            sec = self.cfg.project.loader.find_section_containing(candidate.address)
            if sec.name in ('.bss', '.got.plt'):
                continue

            # execute the single basic block and see how the value is used
            base_graph = networkx.DiGraph()
            candidate_node = self.cfg.model.get_any_node(candidate.irsb_addr)  # type: angr.analyses.cfg_node.CFGNode
            if candidate_node is None:
                continue
            base_graph.add_node(candidate_node)
            tmp_kb = KnowledgeBase(self.project)
            cfg = self.project.analyses.CFGEmulated(kb=tmp_kb,
                                                    starts=(candidate.irsb_addr,),
                                                    keep_state=True,
                                                    base_graph=base_graph
                                                    )
            candidate_irsb = cfg.get_any_irsb(candidate.irsb_addr)  # type: SimIRSB
            ddg = self.project.analyses.DDG(kb=tmp_kb, cfg=cfg)

            mem_var_node = None
            for node in ddg.simplified_data_graph.nodes():
                if isinstance(node.variable, SimMemoryVariable) and node.location.ins_addr == candidate.insn_addr:
                    # found it!
                    mem_var_node = node
                    break
            else:
                # mem_var_node is not found
                continue

            # get a sub graph
            subgraph = ddg.data_sub_graph(mem_var_node,
                                          simplified=False,
                                          killing_edges=False,
                                          excluding_types={'mem_addr'},
                                          )

            # is it used as a memory address anywhere?
            # TODO:

            # is it used as a jump target?
            next_tmp = None
            if isinstance(candidate_irsb.irsb.next, pyvex.IRExpr.RdTmp):
                next_tmp = candidate_irsb.irsb.next.tmp

            if next_tmp is not None:
                next_tmp_node = next((node for node in subgraph.nodes()
                                      if isinstance(node.variable, SimTemporaryVariable) and
                                         node.variable.tmp_id == next_tmp),
                                     None
                                     )
                if next_tmp_node is not None:
                    # ouch it's used as a jump target
                    return True

        return False
def _has_integer_used_as_pointers ( self ) : # check all integer accesses and see if there is any integer being used as a pointer later, but it wasn't # classified as a pointer reference # we only care about unknown memory data that are 4 bytes long, and is directly referenced from an IRSB candidates = [ i for i in self . cfg . memory_data . values ( ) if i . sort in ( 'unknown' , 'integer' ) and i . size == self . project . arch . bytes and i . irsb_addr is not None ] if not candidates : return False for candidate in candidates : # if the candidate is in .bss, we don't care about it sec = self . cfg . project . loader . find_section_containing ( candidate . address ) if sec . name in ( '.bss' , '.got.plt' ) : continue # execute the single basic block and see how the value is used base_graph = networkx . DiGraph ( ) candidate_node = self . cfg . model . get_any_node ( candidate . irsb_addr ) # type: angr.analyses.cfg_node.CFGNode if candidate_node is None : continue base_graph . add_node ( candidate_node ) tmp_kb = KnowledgeBase ( self . project ) cfg = self . project . analyses . CFGEmulated ( kb = tmp_kb , starts = ( candidate . irsb_addr , ) , keep_state = True , base_graph = base_graph ) candidate_irsb = cfg . get_any_irsb ( candidate . irsb_addr ) # type: SimIRSB ddg = self . project . analyses . DDG ( kb = tmp_kb , cfg = cfg ) mem_var_node = None for node in ddg . simplified_data_graph . nodes ( ) : if isinstance ( node . variable , SimMemoryVariable ) and node . location . ins_addr == candidate . insn_addr : # found it! mem_var_node = node break else : # mem_var_node is not found continue # get a sub graph subgraph = ddg . data_sub_graph ( mem_var_node , simplified = False , killing_edges = False , excluding_types = { 'mem_addr' } , ) # is it used as a memory address anywhere? # TODO: # is it used as a jump target? next_tmp = None if isinstance ( candidate_irsb . irsb . next , pyvex . IRExpr . RdTmp ) : next_tmp = candidate_irsb . irsb . next . tmp if next_tmp is not None : next_tmp_node = next ( ( node for node in subgraph . nodes ( ) if isinstance ( node . variable , SimTemporaryVariable ) and node . variable . tmp_id == next_tmp ) , None ) if next_tmp_node is not None : # ouch it's used as a jump target return True return False