(self,
                 binary=None,
                 objects=None,
                 regions=None,
                 pickle_intermediate_results=False,
                 symbols=True,
                 function_prologues=True,
                 resolve_indirect_jumps=True,
                 force_segment=False,
                 force_smart_scan=True,
                 force_complete_scan=False,
                 indirect_jump_target_limit=100000,
                 data_references=True,
                 cross_references=False,
                 normalize=False,
                 start_at_entry=True,
                 function_starts=None,
                 extra_memory_regions=None,
                 data_type_guessing_handlers=None,
                 arch_options=None,
                 indirect_jump_resolvers=None,
                 base_state=None,
                 exclude_sparse_regions=True,
                 skip_specific_regions=True,
                 heuristic_plt_resolving=None,
                 detect_tail_calls=False,
                 low_priority=False,
                 cfb=None,
                 model=None,
                 use_patches=False,
                 elf_eh_frame=True,
                 exceptions=True,
                 nodecode_window_size=512,
                 nodecode_threshold=0.3,
                 nodecode_step=16483,
                 start=None,  # deprecated
                 end=None,  # deprecated
                 collect_data_references=None, # deprecated
                 extra_cross_references=None, # deprecated
                 **extra_arch_options
                 )
:param binary:                  The binary to recover CFG on. By default the main binary is used.
        :param objects:                 A list of objects to recover the CFG on. By default it will recover the CFG of
                                        all loaded objects.
        :param iterable regions:        A list of tuples in the form of (start address, end address) describing memory
                                        regions that the CFG should cover.
        :param bool pickle_intermediate_results: If we want to store the intermediate results or not.
        :param bool symbols:            Get function beginnings from symbols in the binary.
        :param bool function_prologues: Scan the binary for function prologues, and use those positions as function
                                        beginnings
        :param bool resolve_indirect_jumps: Try to resolve indirect jumps. This is necessary to resolve jump targets
                                            from jump tables, etc.
        :param bool force_segment:      Force CFGFast to rely on binary segments instead of sections.
        :param bool force_complete_scan:    Perform a complete scan on the binary and maximize the number of identified
                                            code blocks.
        :param bool data_references:    Enables the collection of references to data used by individual instructions.
                                        This does not collect 'cross-references', particularly those that involve
                                        multiple instructions.  For that, see `cross_references`
        :param bool cross_references:   Whether CFGFast should collect "cross-references" from the entire program or
                                        not. This will populate the knowledge base with references to and from each
                                        recognizable address constant found in the code. Note that, because this
                                        performs constant propagation on the entire program, it may be much slower and
                                        consume more memory.
                                        This option implies `data_references=True`.
        :param bool normalize:          Normalize the CFG as well as all function graphs after CFG recovery.
        :param bool start_at_entry:     Begin CFG recovery at the entry point of this project. Setting it to False
                                        prevents CFGFast from viewing the entry point as one of the starting points of
                                        code scanning.
        :param list function_starts:    A list of extra function starting points. CFGFast will try to resume scanning
                                        from each address in the list.
        :param list extra_memory_regions: A list of 2-tuple (start-address, end-address) that shows extra memory
                                          regions. Integers falling inside will be considered as pointers.
        :param list indirect_jump_resolvers: A custom list of indirect jump resolvers. If this list is None or empty,
                                             default indirect jump resolvers specific to this architecture and binary
                                             types will be loaded.
        :param base_state:              A state to use as a backer for all memory loads
        :param bool detect_tail_calls:  Enable aggressive tail-call optimization detection.
        :param bool elf_eh_frame:       Retrieve function starts (and maybe sizes later) from the .eh_frame of ELF
                                        binaries.
        :param int start:               (Deprecated) The beginning address of CFG recovery.
        :param int end:                 (Deprecated) The end address of CFG recovery.
        :param CFGArchOptions arch_options: Architecture-specific options.
        :param dict extra_arch_options: Any key-value pair in kwargs will be seen as an arch-specific option and will
                                        be used to set the option value in self._arch_options.

        Extra parameters that angr.Analysis takes:

        :param progress_callback:       Specify a callback function to get the progress during CFG recovery.
        :param bool show_progressbar:   Should CFGFast show a progressbar during CFG recovery or not.
        :return: None
:param binary:                  The binary to recover CFG on. By default the main binary is used.
        :param objects:                 A list of objects to recover the CFG on. By default it will recover the CFG of
                                        all loaded objects.
        :param iterable regions:        A list of tuples in the form of (start address, end address) describing memory
                                        regions that the CFG should cover.
        :param bool pickle_intermediate_results: If we want to store the intermediate results or not.
        :param bool symbols:            Get function beginnings from symbols in the binary.
        :param bool function_prologues: Scan the binary for function prologues, and use those positions as function
                                        beginnings
        :param bool resolve_indirect_jumps: Try to resolve indirect jumps. This is necessary to resolve jump targets
                                            from jump tables, etc.
        :param bool force_segment:      Force CFGFast to rely on binary segments instead of sections.
        :param bool force_complete_scan:    Perform a complete scan on the binary and maximize the number of identified
                                            code blocks.
        :param bool data_references:    Enables the collection of references to data used by individual instructions.
                                        This does not collect 'cross-references', particularly those that involve
                                        multiple instructions.  For that, see `cross_references`
        :param bool cross_references:   Whether CFGFast should collect "cross-references" from the entire program or
                                        not. This will populate the knowledge base with references to and from each
                                        recognizable address constant found in the code. Note that, because this
                                        performs constant propagation on the entire program, it may be much slower and
                                        consume more memory.
                                        This option implies `data_references=True`.
        :param bool normalize:          Normalize the CFG as well as all function graphs after CFG recovery.
        :param bool start_at_entry:     Begin CFG recovery at the entry point of this project. Setting it to False
                                        prevents CFGFast from viewing the entry point as one of the starting points of
                                        code scanning.
        :param list function_starts:    A list of extra function starting points. CFGFast will try to resume scanning
                                        from each address in the list.
        :param list extra_memory_regions: A list of 2-tuple (start-address, end-address) that shows extra memory
                                          regions. Integers falling inside will be considered as pointers.
        :param list indirect_jump_resolvers: A custom list of indirect jump resolvers. If this list is None or empty,
                                             default indirect jump resolvers specific to this architecture and binary
                                             types will be loaded.
        :param base_state:              A state to use as a backer for all memory loads
        :param bool detect_tail_calls:  Enable aggressive tail-call optimization detection.
        :param bool elf_eh_frame:       Retrieve function starts (and maybe sizes later) from the .eh_frame of ELF
                                        binaries.
        :param int start:               (Deprecated) The beginning address of CFG recovery.
        :param int end:                 (Deprecated) The end address of CFG recovery.
        :param CFGArchOptions arch_options: Architecture-specific options.
        :param dict extra_arch_options: Any key-value pair in kwargs will be seen as an arch-specific option and will
                                        be used to set the option value in self._arch_options.
: param binary : The binary to recover CFG on . By default the main binary is used . : param objects : A list of objects to recover the CFG on . By default it will recover the CFG of all loaded objects . : param iterable regions : A list of tuples in the form of ( start address end address ) describing memory regions that the CFG should cover . : param bool pickle_intermediate_results : If we want to store the intermediate results or not . : param bool symbols : Get function beginnings from symbols in the binary . : param bool function_prologues : Scan the binary for function prologues and use those positions as function beginnings : param bool resolve_indirect_jumps : Try to resolve indirect jumps . This is necessary to resolve jump targets from jump tables etc . : param bool force_segment : Force CFGFast to rely on binary segments instead of sections . : param bool force_complete_scan : Perform a complete scan on the binary and maximize the number of identified code blocks . : param bool data_references : Enables the collection of references to data used by individual instructions . This does not collect cross - references particularly those that involve multiple instructions . For that see cross_references : param bool cross_references : Whether CFGFast should collect cross - references from the entire program or not . This will populate the knowledge base with references to and from each recognizable address constant found in the code . Note that because this performs constant propagation on the entire program it may be much slower and consume more memory . This option implies data_references = True . : param bool normalize : Normalize the CFG as well as all function graphs after CFG recovery . : param bool start_at_entry : Begin CFG recovery at the entry point of this project . Setting it to False prevents CFGFast from viewing the entry point as one of the starting points of code scanning . : param list function_starts : A list of extra function starting points . CFGFast will try to resume scanning from each address in the list . : param list extra_memory_regions : A list of 2 - tuple ( start - address end - address ) that shows extra memory regions . Integers falling inside will be considered as pointers . : param list indirect_jump_resolvers : A custom list of indirect jump resolvers . If this list is None or empty default indirect jump resolvers specific to this architecture and binary types will be loaded . : param base_state : A state to use as a backer for all memory loads : param bool detect_tail_calls : Enable aggressive tail - call optimization detection . : param bool elf_eh_frame : Retrieve function starts ( and maybe sizes later ) from the . eh_frame of ELF binaries . : param int start : ( Deprecated ) The beginning address of CFG recovery . : param int end : ( Deprecated ) The end address of CFG recovery . : param CFGArchOptions arch_options : Architecture - specific options . : param dict extra_arch_options : Any key - value pair in kwargs will be seen as an arch - specific option and will be used to set the option value in self . _arch_options .
def __init__(self,
                 binary=None,
                 objects=None,
                 regions=None,
                 pickle_intermediate_results=False,
                 symbols=True,
                 function_prologues=True,
                 resolve_indirect_jumps=True,
                 force_segment=False,
                 force_smart_scan=True,
                 force_complete_scan=False,
                 indirect_jump_target_limit=100000,
                 data_references=True,
                 cross_references=False,
                 normalize=False,
                 start_at_entry=True,
                 function_starts=None,
                 extra_memory_regions=None,
                 data_type_guessing_handlers=None,
                 arch_options=None,
                 indirect_jump_resolvers=None,
                 base_state=None,
                 exclude_sparse_regions=True,
                 skip_specific_regions=True,
                 heuristic_plt_resolving=None,
                 detect_tail_calls=False,
                 low_priority=False,
                 cfb=None,
                 model=None,
                 use_patches=False,
                 elf_eh_frame=True,
                 exceptions=True,
                 nodecode_window_size=512,
                 nodecode_threshold=0.3,
                 nodecode_step=16483,
                 start=None,  # deprecated
                 end=None,  # deprecated
                 collect_data_references=None, # deprecated
                 extra_cross_references=None, # deprecated
                 **extra_arch_options
                 ):
        """
        :param binary:                  The binary to recover CFG on. By default the main binary is used.
        :param objects:                 A list of objects to recover the CFG on. By default it will recover the CFG of
                                        all loaded objects.
        :param iterable regions:        A list of tuples in the form of (start address, end address) describing memory
                                        regions that the CFG should cover.
        :param bool pickle_intermediate_results: If we want to store the intermediate results or not.
        :param bool symbols:            Get function beginnings from symbols in the binary.
        :param bool function_prologues: Scan the binary for function prologues, and use those positions as function
                                        beginnings
        :param bool resolve_indirect_jumps: Try to resolve indirect jumps. This is necessary to resolve jump targets
                                            from jump tables, etc.
        :param bool force_segment:      Force CFGFast to rely on binary segments instead of sections.
        :param bool force_complete_scan:    Perform a complete scan on the binary and maximize the number of identified
                                            code blocks.
        :param bool data_references:    Enables the collection of references to data used by individual instructions.
                                        This does not collect 'cross-references', particularly those that involve
                                        multiple instructions.  For that, see `cross_references`
        :param bool cross_references:   Whether CFGFast should collect "cross-references" from the entire program or
                                        not. This will populate the knowledge base with references to and from each
                                        recognizable address constant found in the code. Note that, because this
                                        performs constant propagation on the entire program, it may be much slower and
                                        consume more memory.
                                        This option implies `data_references=True`.
        :param bool normalize:          Normalize the CFG as well as all function graphs after CFG recovery.
        :param bool start_at_entry:     Begin CFG recovery at the entry point of this project. Setting it to False
                                        prevents CFGFast from viewing the entry point as one of the starting points of
                                        code scanning.
        :param list function_starts:    A list of extra function starting points. CFGFast will try to resume scanning
                                        from each address in the list.
        :param list extra_memory_regions: A list of 2-tuple (start-address, end-address) that shows extra memory
                                          regions. Integers falling inside will be considered as pointers.
        :param list indirect_jump_resolvers: A custom list of indirect jump resolvers. If this list is None or empty,
                                             default indirect jump resolvers specific to this architecture and binary
                                             types will be loaded.
        :param base_state:              A state to use as a backer for all memory loads
        :param bool detect_tail_calls:  Enable aggressive tail-call optimization detection.
        :param bool elf_eh_frame:       Retrieve function starts (and maybe sizes later) from the .eh_frame of ELF
                                        binaries.
        :param int start:               (Deprecated) The beginning address of CFG recovery.
        :param int end:                 (Deprecated) The end address of CFG recovery.
        :param CFGArchOptions arch_options: Architecture-specific options.
        :param dict extra_arch_options: Any key-value pair in kwargs will be seen as an arch-specific option and will
                                        be used to set the option value in self._arch_options.

        Extra parameters that angr.Analysis takes:

        :param progress_callback:       Specify a callback function to get the progress during CFG recovery.
        :param bool show_progressbar:   Should CFGFast show a progressbar during CFG recovery or not.
        :return: None
        """

        ForwardAnalysis.__init__(self, allow_merging=False)
        CFGBase.__init__(
            self,
            'fast',
            0,
            normalize=normalize,
            binary=binary,
            force_segment=force_segment,
            base_state=base_state,
            resolve_indirect_jumps=resolve_indirect_jumps,
            indirect_jump_resolvers=indirect_jump_resolvers,
            indirect_jump_target_limit=indirect_jump_target_limit,
            detect_tail_calls=detect_tail_calls,
            low_priority=low_priority,
            model=model,
        )

        # necessary warnings
        regions_not_specified = regions is None and binary is None and not objects
        if self.project.loader._auto_load_libs is True and end is None and len(self.project.loader.all_objects) > 3 \
                and regions_not_specified:
            l.warning('"auto_load_libs" is enabled. With libraries loaded in project, CFGFast will cover libraries, '
                      'which may take significantly more time than expected. You may reload the binary with '
                      '"auto_load_libs" disabled, or specify "regions" to limit the scope of CFG recovery.'
                      )

        if collect_data_references is not None:
            l.warning('"collect_data_references" is deprecated and will be removed soon. Please use '
                      '"data_references" instead')
            data_references = collect_data_references
        if extra_cross_references is not None:
            l.warning('"extra_cross_references" is deprecated and will be removed soon. Please use '
                      '"cross_references" instead')
            cross_references = extra_cross_references

        if start is not None or end is not None:
            l.warning('"start" and "end" are deprecated and will be removed soon. Please use "regions" to specify one '
                      'or more memory regions instead.'
                      )
            if regions is None:
                regions = [ (start, end) ]
            else:
                l.warning('"regions", "start", and "end" are all specified. Ignoring "start" and "end".')

        # data references collection and force smart scan mst be enabled at the same time. otherwise decoding errors
        # caused by decoding data will lead to incorrect cascading re-lifting, which is suboptimal
        if force_smart_scan and not data_references:
            l.warning('It is recommended to enable "data_references" if "force_smart_scan" is enabled for best '
                      'result. Otherwise you may want to disable "force_smart_scan" or enable '
                      '"force_complete_scan".')

        # smart complete scanning and naive complete scanning cannot be enabled at the same time
        if force_smart_scan and force_complete_scan:
            l.warning('You cannot enable "force_smart_scan" and "force_complete_scan" at the same time. I am disabling '
                      '"force_complete_scan".')
            force_complete_scan = False

        if binary is not None and not objects:
            objects = [ binary ]
        regions = regions if regions is not None else self._executable_memory_regions(objects=objects,
                                                                                      force_segment=force_segment
                                                                                      )

        if exclude_sparse_regions:
            new_regions = [ ]
            for start_, end_ in regions:
                if not self._is_region_extremely_sparse(start_, end_, base_state=base_state):
                    new_regions.append((start_, end_))
            regions = new_regions
        if skip_specific_regions:
            if base_state is not None:
                l.warning("You specified both base_state and skip_specific_regions. They may conflict with each other.")
            new_regions = [ ]
            for start_, end_ in regions:
                if not self._should_skip_region(start_):
                    new_regions.append((start_, end_))
            regions = new_regions
        if not regions and self.project.arch.name != 'Soot':
            raise AngrCFGError("Regions are empty or all regions are skipped. You may want to manually specify regions.")
        # sort the regions
        regions = sorted(regions, key=lambda x: x[0])
        self._regions_size = sum((b - a) for a, b in regions)
        # initial self._regions as a sorted dict
        self._regions = SortedDict(regions)

        self._pickle_intermediate_results = pickle_intermediate_results

        self._use_symbols = symbols
        self._use_function_prologues = function_prologues
        self._force_smart_scan = force_smart_scan
        self._force_complete_scan = force_complete_scan
        self._use_elf_eh_frame = elf_eh_frame
        self._use_exceptions = exceptions

        self._nodecode_window_size = nodecode_window_size
        self._nodecode_threshold = nodecode_threshold
        self._nodecode_step = nodecode_step

        if heuristic_plt_resolving is None:
            # If unspecified, we only enable heuristic PLT resolving when there is at least one binary loaded with the
            # ELF backend
            self._heuristic_plt_resolving = len(self.project.loader.all_elf_objects) > 0
        else:
            self._heuristic_plt_resolving = heuristic_plt_resolving

        self._start_at_entry = start_at_entry
        self._extra_function_starts = function_starts

        self._extra_memory_regions = extra_memory_regions

        self._cross_references = cross_references
        # You need data refs to get cross refs
        self._collect_data_ref = data_references or self._cross_references

        self._use_patches = use_patches

        self._arch_options = arch_options if arch_options is not None else CFGArchOptions(
                self.project.arch, **extra_arch_options)

        self._data_type_guessing_handlers = [ ] if data_type_guessing_handlers is None else data_type_guessing_handlers

        self._cfb = cfb

        l.debug("CFG recovery covers %d regions:", len(self._regions))
        for start_addr in self._regions:
            l.debug("... %#x - %#x", start_addr, self._regions[start_addr])

        # mapping to all known thunks
        self._known_thunks = {}

        self._initial_state = None
        self._next_addr = None

        # Create the segment list
        self._seg_list = SegmentList()

        self._read_addr_to_run = defaultdict(list)
        self._write_addr_to_run = defaultdict(list)

        self._function_prologue_addrs = None
        self._remaining_function_prologue_addrs = None

        # exception handling
        self._exception_handling_by_endaddr = SortedDict()

        #
        # Variables used during analysis
        #
        self._pending_jobs = None
        self._traced_addresses = None
        self._function_returns = None
        self._function_exits = None
        self._gp_value: Optional[int] = None
        self._ro_region_cdata_cache: Optional[List] = None

        # A mapping between address and the actual data in memory
        # self._memory_data = { }
        # A mapping between address of the instruction that's referencing the memory data and the memory data itself
        # self.insn_addr_to_memory_data = { }
        # self._graph = None

        # Start working!
        self._analyze()
def __init__ ( self , binary = None , objects = None , regions = None , pickle_intermediate_results = False , symbols = True , function_prologues = True , resolve_indirect_jumps = True , force_segment = False , force_smart_scan = True , force_complete_scan = False , indirect_jump_target_limit = 100000 , data_references = True , cross_references = False , normalize = False , start_at_entry = True , function_starts = None , extra_memory_regions = None , data_type_guessing_handlers = None , arch_options = None , indirect_jump_resolvers = None , base_state = None , exclude_sparse_regions = True , skip_specific_regions = True , heuristic_plt_resolving = None , detect_tail_calls = False , low_priority = False , cfb = None , model = None , use_patches = False , elf_eh_frame = True , exceptions = True , nodecode_window_size = 512 , nodecode_threshold = 0.3 , nodecode_step = 16483 , start = None , # deprecated end = None , # deprecated collect_data_references = None , # deprecated extra_cross_references = None , # deprecated * * extra_arch_options ) : ForwardAnalysis . __init__ ( self , allow_merging = False ) CFGBase . __init__ ( self , 'fast' , 0 , normalize = normalize , binary = binary , force_segment = force_segment , base_state = base_state , resolve_indirect_jumps = resolve_indirect_jumps , indirect_jump_resolvers = indirect_jump_resolvers , indirect_jump_target_limit = indirect_jump_target_limit , detect_tail_calls = detect_tail_calls , low_priority = low_priority , model = model , ) # necessary warnings regions_not_specified = regions is None and binary is None and not objects if self . project . loader . _auto_load_libs is True and end is None and len ( self . project . loader . all_objects ) > 3 and regions_not_specified : l . warning ( '"auto_load_libs" is enabled. With libraries loaded in project, CFGFast will cover libraries, ' 'which may take significantly more time than expected. You may reload the binary with ' '"auto_load_libs" disabled, or specify "regions" to limit the scope of CFG recovery.' ) if collect_data_references is not None : l . warning ( '"collect_data_references" is deprecated and will be removed soon. Please use ' '"data_references" instead' ) data_references = collect_data_references if extra_cross_references is not None : l . warning ( '"extra_cross_references" is deprecated and will be removed soon. Please use ' '"cross_references" instead' ) cross_references = extra_cross_references if start is not None or end is not None : l . warning ( '"start" and "end" are deprecated and will be removed soon. Please use "regions" to specify one ' 'or more memory regions instead.' ) if regions is None : regions = [ ( start , end ) ] else : l . warning ( '"regions", "start", and "end" are all specified. Ignoring "start" and "end".' ) # data references collection and force smart scan mst be enabled at the same time. otherwise decoding errors # caused by decoding data will lead to incorrect cascading re-lifting, which is suboptimal if force_smart_scan and not data_references : l . warning ( 'It is recommended to enable "data_references" if "force_smart_scan" is enabled for best ' 'result. Otherwise you may want to disable "force_smart_scan" or enable ' '"force_complete_scan".' ) # smart complete scanning and naive complete scanning cannot be enabled at the same time if force_smart_scan and force_complete_scan : l . warning ( 'You cannot enable "force_smart_scan" and "force_complete_scan" at the same time. I am disabling ' '"force_complete_scan".' ) force_complete_scan = False if binary is not None and not objects : objects = [ binary ] regions = regions if regions is not None else self . _executable_memory_regions ( objects = objects , force_segment = force_segment ) if exclude_sparse_regions : new_regions = [ ] for start_ , end_ in regions : if not self . _is_region_extremely_sparse ( start_ , end_ , base_state = base_state ) : new_regions . append ( ( start_ , end_ ) ) regions = new_regions if skip_specific_regions : if base_state is not None : l . warning ( "You specified both base_state and skip_specific_regions. They may conflict with each other." ) new_regions = [ ] for start_ , end_ in regions : if not self . _should_skip_region ( start_ ) : new_regions . append ( ( start_ , end_ ) ) regions = new_regions if not regions and self . project . arch . name != 'Soot' : raise AngrCFGError ( "Regions are empty or all regions are skipped. You may want to manually specify regions." ) # sort the regions regions = sorted ( regions , key = lambda x : x [ 0 ] ) self . _regions_size = sum ( ( b - a ) for a , b in regions ) # initial self._regions as a sorted dict self . _regions = SortedDict ( regions ) self . _pickle_intermediate_results = pickle_intermediate_results self . _use_symbols = symbols self . _use_function_prologues = function_prologues self . _force_smart_scan = force_smart_scan self . _force_complete_scan = force_complete_scan self . _use_elf_eh_frame = elf_eh_frame self . _use_exceptions = exceptions self . _nodecode_window_size = nodecode_window_size self . _nodecode_threshold = nodecode_threshold self . _nodecode_step = nodecode_step if heuristic_plt_resolving is None : # If unspecified, we only enable heuristic PLT resolving when there is at least one binary loaded with the # ELF backend self . _heuristic_plt_resolving = len ( self . project . loader . all_elf_objects ) > 0 else : self . _heuristic_plt_resolving = heuristic_plt_resolving self . _start_at_entry = start_at_entry self . _extra_function_starts = function_starts self . _extra_memory_regions = extra_memory_regions self . _cross_references = cross_references # You need data refs to get cross refs self . _collect_data_ref = data_references or self . _cross_references self . _use_patches = use_patches self . _arch_options = arch_options if arch_options is not None else CFGArchOptions ( self . project . arch , * * extra_arch_options ) self . _data_type_guessing_handlers = [ ] if data_type_guessing_handlers is None else data_type_guessing_handlers self . _cfb = cfb l . debug ( "CFG recovery covers %d regions:" , len ( self . _regions ) ) for start_addr in self . _regions : l . debug ( "... %#x - %#x" , start_addr , self . _regions [ start_addr ] ) # mapping to all known thunks self . _known_thunks = { } self . _initial_state = None self . _next_addr = None # Create the segment list self . _seg_list = SegmentList ( ) self . _read_addr_to_run = defaultdict ( list ) self . _write_addr_to_run = defaultdict ( list ) self . _function_prologue_addrs = None self . _remaining_function_prologue_addrs = None # exception handling self . _exception_handling_by_endaddr = SortedDict ( ) # # Variables used during analysis # self . _pending_jobs = None self . _traced_addresses = None self . _function_returns = None self . _function_exits = None self . _gp_value : Optional [ int ] = None self . _ro_region_cdata_cache : Optional [ List ] = None # A mapping between address and the actual data in memory # self._memory_data = { } # A mapping between address of the instruction that's referencing the memory data and the memory data itself # self.insn_addr_to_memory_data = { } # self._graph = None # Start working! self . _analyze ( )