(self, targets)
Create a backward slice from a specific statement in a specific block. This is done by traverse the CFG
        backwards, and mark all tainted statements based on dependence graphs (CDG and DDG) provided initially. The
        traversal terminated when we reach the entry point, or when there is no unresolved dependencies.

        :param targets: A list of tuples like (cfg_node, stmt_idx), where cfg_node is a CFGNode instance where the
                        backward slice starts, and it must be included in CFG and CDG. stmt_idx is the ID of the target
                        statement where the backward slice starts.
Create a backward slice from a specific statement in a specific block. This is done by traverse the CFG
        backwards, and mark all tainted statements based on dependence graphs (CDG and DDG) provided initially. The
        traversal terminated when we reach the entry point, or when there is no unresolved dependencies.
Create a backward slice from a specific statement in a specific block . This is done by traverse the CFG backwards and mark all tainted statements based on dependence graphs ( CDG and DDG ) provided initially . The traversal terminated when we reach the entry point or when there is no unresolved dependencies .
def _construct_default(self, targets):
        """
        Create a backward slice from a specific statement in a specific block. This is done by traverse the CFG
        backwards, and mark all tainted statements based on dependence graphs (CDG and DDG) provided initially. The
        traversal terminated when we reach the entry point, or when there is no unresolved dependencies.

        :param targets: A list of tuples like (cfg_node, stmt_idx), where cfg_node is a CFGNode instance where the
                        backward slice starts, and it must be included in CFG and CDG. stmt_idx is the ID of the target
                        statement where the backward slice starts.
        """

        # TODO: Support context-sensitivity

        l.debug("Constructing a default backward program slice")

        self.taint_graph = networkx.DiGraph()

        taints = set()
        accessed_taints = set()

        # Fill in the taint set

        for cfg_node, stmt_idx in targets:
            if cfg_node not in self._cfg.graph:
                raise AngrBackwardSlicingError('Target CFGNode %s is not in the CFG.' % cfg_node)

            if stmt_idx == -1:
                new_taints = self._handle_control_dependence(cfg_node)
                taints |= new_taints

            else:
                cl = CodeLocation(cfg_node.addr, stmt_idx)
                taints.add(cl)

        while taints:
            # Pop a tainted code location
            tainted_cl = taints.pop()

            l.debug("Checking taint %s...", tainted_cl)

            # Mark it as picked
            if tainted_cl.block_addr is not None and tainted_cl.stmt_idx is not None:
                # Skip SimProcedures
                self._pick_statement(tainted_cl.block_addr, tainted_cl.stmt_idx)

            # Mark it as accessed
            accessed_taints.add(tainted_cl)

            # Pick all its data dependencies from data dependency graph
            if self._ddg is not None and tainted_cl in self._ddg:
                if isinstance(self._ddg, networkx.DiGraph):
                    predecessors = list(self._ddg.predecessors(tainted_cl))
                else:
                    # angr.analyses.DDG
                    predecessors = list(self._ddg.get_predecessors(tainted_cl))
                l.debug("Returned %d predecessors for %s from data dependence graph", len(predecessors), tainted_cl)

                for p in predecessors:
                    if p not in accessed_taints:
                        taints.add(p)

                    self.taint_graph.add_edge(p, tainted_cl)

            # Handle the control dependence
            for n in self._cfg.model.get_all_nodes(tainted_cl.block_addr):
                new_taints = self._handle_control_dependence(n)

                l.debug("Returned %d taints for %s from control dependence graph", len(new_taints), n)

                for taint in new_taints:
                    if taint not in accessed_taints:
                        taints.add(taint)

                    self.taint_graph.add_edge(taint, tainted_cl)

        # In the end, map the taint graph onto CFG
        self._map_to_cfg()
def _construct_default ( self , targets ) : # TODO: Support context-sensitivity l . debug ( "Constructing a default backward program slice" ) self . taint_graph = networkx . DiGraph ( ) taints = set ( ) accessed_taints = set ( ) # Fill in the taint set for cfg_node , stmt_idx in targets : if cfg_node not in self . _cfg . graph : raise AngrBackwardSlicingError ( 'Target CFGNode %s is not in the CFG.' % cfg_node ) if stmt_idx == - 1 : new_taints = self . _handle_control_dependence ( cfg_node ) taints |= new_taints else : cl = CodeLocation ( cfg_node . addr , stmt_idx ) taints . add ( cl ) while taints : # Pop a tainted code location tainted_cl = taints . pop ( ) l . debug ( "Checking taint %s..." , tainted_cl ) # Mark it as picked if tainted_cl . block_addr is not None and tainted_cl . stmt_idx is not None : # Skip SimProcedures self . _pick_statement ( tainted_cl . block_addr , tainted_cl . stmt_idx ) # Mark it as accessed accessed_taints . add ( tainted_cl ) # Pick all its data dependencies from data dependency graph if self . _ddg is not None and tainted_cl in self . _ddg : if isinstance ( self . _ddg , networkx . DiGraph ) : predecessors = list ( self . _ddg . predecessors ( tainted_cl ) ) else : # angr.analyses.DDG predecessors = list ( self . _ddg . get_predecessors ( tainted_cl ) ) l . debug ( "Returned %d predecessors for %s from data dependence graph" , len ( predecessors ) , tainted_cl ) for p in predecessors : if p not in accessed_taints : taints . add ( p ) self . taint_graph . add_edge ( p , tainted_cl ) # Handle the control dependence for n in self . _cfg . model . get_all_nodes ( tainted_cl . block_addr ) : new_taints = self . _handle_control_dependence ( n ) l . debug ( "Returned %d taints for %s from control dependence graph" , len ( new_taints ) , n ) for taint in new_taints : if taint not in accessed_taints : taints . add ( taint ) self . taint_graph . add_edge ( taint , tainted_cl ) # In the end, map the taint graph onto CFG self . _map_to_cfg ( )