(load_stmt, state)
return jump_addr
Parse a memory load VEX statement and get the jump target addresses.

        :param load_stmt:   The VEX statement for loading the jump target addresses.
        :param state:       The SimState instance (in static mode).
        :return:            An abstract value (or a concrete value) representing the jump target addresses. Return None
                            if we fail to parse the statement.
Parse a memory load VEX statement and get the jump target addresses.
Parse a memory load VEX statement and get the jump target addresses .
def _parse_load_statement(load_stmt, state):
        """
        Parse a memory load VEX statement and get the jump target addresses.

        :param load_stmt:   The VEX statement for loading the jump target addresses.
        :param state:       The SimState instance (in static mode).
        :return:            An abstract value (or a concrete value) representing the jump target addresses. Return None
                            if we fail to parse the statement.
        """

        # The jump table address is stored in a tmp. In this case, we find the jump-target loading tmp.
        load_addr_tmp = None

        if isinstance(load_stmt, pyvex.IRStmt.WrTmp):
            if type(load_stmt.data.addr) is pyvex.IRExpr.RdTmp:
                load_addr_tmp = load_stmt.data.addr.tmp
            elif type(load_stmt.data.addr) is pyvex.IRExpr.Const:
                # It's directly loading from a constant address
                # e.g.,
                #  ldr r0, =main+1
                #  blx r0
                # It's not a jump table, but we resolve it anyway
                jump_target_addr = load_stmt.data.addr.con.value
                return state.solver.BVV(jump_target_addr, state.arch.bits)
        elif isinstance(load_stmt, pyvex.IRStmt.LoadG):
            if type(load_stmt.addr) is pyvex.IRExpr.RdTmp:
                load_addr_tmp = load_stmt.addr.tmp
            elif type(load_stmt.addr) is pyvex.IRExpr.Const:
                # It's directly loading from a constant address
                # e.g.,
                #  4352c     SUB     R1, R11, #0x1000
                #  43530     LDRHI   R3, =loc_45450
                #  ...
                #  43540     MOV     PC, R3
                #
                # It's not a jump table, but we resolve it anyway
                # Note that this block has two branches: One goes to 45450, the other one goes to whatever the original
                # value of R3 is. Some intensive data-flow analysis is required in this case.
                jump_target_addr = load_stmt.addr.con.value
                return state.solver.BVV(jump_target_addr, state.arch.bits)
        else:
            raise TypeError("Unsupported address loading statement type %s." % type(load_stmt))

        if state.scratch.temps[load_addr_tmp] is None:
            # the tmp variable is not there... umm...
            return None

        jump_addr = state.scratch.temps[load_addr_tmp]

        if isinstance(load_stmt, pyvex.IRStmt.LoadG):
            # LoadG comes with a guard. We should apply this guard to the load expression
            guard_tmp = load_stmt.guard.tmp
            guard = state.scratch.temps[guard_tmp] != 0
            try:
                jump_addr = state.memory._apply_condition_to_symbolic_addr(jump_addr, guard)
            except Exception: # pylint: disable=broad-except
                l.exception("Error computing jump table address!")
                return None
        return jump_addr
def _parse_load_statement ( load_stmt , state ) : # The jump table address is stored in a tmp. In this case, we find the jump-target loading tmp. load_addr_tmp = None if isinstance ( load_stmt , pyvex . IRStmt . WrTmp ) : if type ( load_stmt . data . addr ) is pyvex . IRExpr . RdTmp : load_addr_tmp = load_stmt . data . addr . tmp elif type ( load_stmt . data . addr ) is pyvex . IRExpr . Const : # It's directly loading from a constant address # e.g., #  ldr r0, =main+1 #  blx r0 # It's not a jump table, but we resolve it anyway jump_target_addr = load_stmt . data . addr . con . value return state . solver . BVV ( jump_target_addr , state . arch . bits ) elif isinstance ( load_stmt , pyvex . IRStmt . LoadG ) : if type ( load_stmt . addr ) is pyvex . IRExpr . RdTmp : load_addr_tmp = load_stmt . addr . tmp elif type ( load_stmt . addr ) is pyvex . IRExpr . Const : # It's directly loading from a constant address # e.g., #  4352c     SUB     R1, R11, #0x1000 #  43530     LDRHI   R3, =loc_45450 #  ... #  43540     MOV     PC, R3 # # It's not a jump table, but we resolve it anyway # Note that this block has two branches: One goes to 45450, the other one goes to whatever the original # value of R3 is. Some intensive data-flow analysis is required in this case. jump_target_addr = load_stmt . addr . con . value return state . solver . BVV ( jump_target_addr , state . arch . bits ) else : raise TypeError ( "Unsupported address loading statement type %s." % type ( load_stmt ) ) if state . scratch . temps [ load_addr_tmp ] is None : # the tmp variable is not there... umm... return None jump_addr = state . scratch . temps [ load_addr_tmp ] if isinstance ( load_stmt , pyvex . IRStmt . LoadG ) : # LoadG comes with a guard. We should apply this guard to the load expression guard_tmp = load_stmt . guard . tmp guard = state . scratch . temps [ guard_tmp ] != 0 try : jump_addr = state . memory . _apply_condition_to_symbolic_addr ( jump_addr , guard ) except Exception : # pylint: disable=broad-except l . exception ( "Error computing jump table address!" ) return None return jump_addr