{ "tool": "angr", "versions": { "angr": "10.0.3", "pyvex": "10.0.3", "cle": "10.0.3", "archinfo": "10.0.3" }, "fixture": "ledger-x86_64-O0.o", "command": "venv/bin/python capture_angr.py ledger-x86_64-O0.o OUT.json", "analysis": "angr.Project(path, auto_load_libs=False); project.analyses.CFGFast(normalize=True, data_references=True); project.analyses.Decompiler(function, cfg=cfg.model)", "loader": "ELF", "arch": "AMD64", "base": 4194304, "sections": { ".text": { "vaddr": 4194304, "size": 295 }, ".rodata": { "vaddr": 4194600, "size": 20 }, ".data": { "vaddr": 4194624, "size": 40 }, ".rodata.str1.1": { "vaddr": 4194664, "size": 10 } }, "relocations": 13, "functions": [ { "name": "percent_change", "addr": 4194304, "size": 46, "fromSymbol": true, "blocks": [ { "addr": 4194304, "size": 16, "instructions": [ { "addr": 4194304, "size": 1, "bytes": "55", "text": "push rbp" }, { "addr": 4194305, "size": 3, "bytes": "4889e5", "text": "mov rbp, rsp" }, { "addr": 4194308, "size": 3, "bytes": "897df8", "text": "mov dword ptr [rbp - 8], edi" }, { "addr": 4194311, "size": 3, "bytes": "8975f4", "text": "mov dword ptr [rbp - 0xc], esi" }, { "addr": 4194314, "size": 4, "bytes": "837df800", "text": "cmp dword ptr [rbp - 8], 0" }, { "addr": 4194318, "size": 2, "bytes": "7509", "text": "jne 0x400019" } ], "vexStatements": 42, "jumpkind": "Ijk_Boring" }, { "addr": 4194320, "size": 9, "instructions": [ { "addr": 4194320, "size": 7, "bytes": "c745fc00000000", "text": "mov dword ptr [rbp - 4], 0" }, { "addr": 4194327, "size": 2, "bytes": "eb10", "text": "jmp 0x400029" } ], "vexStatements": 5, "jumpkind": "Ijk_Boring" }, { "addr": 4194329, "size": 16, "instructions": [ { "addr": 4194329, "size": 3, "bytes": "8b45f4", "text": "mov eax, dword ptr [rbp - 0xc]" }, { "addr": 4194332, "size": 3, "bytes": "2b45f8", "text": "sub eax, dword ptr [rbp - 8]" }, { "addr": 4194335, "size": 3, "bytes": "6bc064", "text": "imul eax, eax, 0x64" }, { "addr": 4194338, "size": 1, "bytes": "99", "text": "cdq" }, { "addr": 4194339, "size": 3, "bytes": "f77df8", "text": "idiv dword ptr [rbp - 8]" }, { "addr": 4194342, "size": 3, "bytes": "8945fc", "text": "mov dword ptr [rbp - 4], eax" } ], "vexStatements": 46, "jumpkind": "Ijk_Boring" }, { "addr": 4194345, "size": 5, "instructions": [ { "addr": 4194345, "size": 3, "bytes": "8b45fc", "text": "mov eax, dword ptr [rbp - 4]" }, { "addr": 4194348, "size": 1, "bytes": "5d", "text": "pop rbp" }, { "addr": 4194349, "size": 1, "bytes": "c3", "text": "ret" } ], "vexStatements": 20, "jumpkind": "Ijk_Ret" } ], "edges": [ { "from": 4194304, "to": 4194320, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194304, "to": 4194329, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194320, "to": 4194345, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194329, "to": 4194345, "type": "transition", "outside": false, "target": "BlockNode" } ], "decompiled": "unsigned int percent_change(unsigned int a0, unsigned int a1)\n{\n unsigned int v0; // [bp-0xc]\n\n v0 = (!a0 ? 0 : (a1 - a0) * 100 / a0);\n return v0;\n}\n", "decompileError": null }, { "name": "sub_40002e", "addr": 4194350, "size": 2, "fromSymbol": false, "blocks": [ { "addr": 4194350, "size": 2, "instructions": [ { "addr": 4194350, "size": 2, "bytes": "6690", "text": "nop" } ], "vexStatements": 1, "jumpkind": "Ijk_Boring" } ], "edges": [ { "from": 4194350, "to": 4194352, "type": "transition", "outside": true, "target": "BlockNode" } ], "decompiled": null, "decompileError": null }, { "name": "grade", "addr": 4194352, "size": 118, "fromSymbol": true, "blocks": [ { "addr": 4194352, "size": 50, "instructions": [ { "addr": 4194352, "size": 1, "bytes": "55", "text": "push rbp" }, { "addr": 4194353, "size": 3, "bytes": "4889e5", "text": "mov rbp, rsp" }, { "addr": 4194356, "size": 3, "bytes": "897df8", "text": "mov dword ptr [rbp - 8], edi" }, { "addr": 4194359, "size": 4, "bytes": "486345f8", "text": "movsxd rax, dword ptr [rbp - 8]" }, { "addr": 4194363, "size": 7, "bytes": "4869c067666666", "text": "imul rax, rax, 0x66666667" }, { "addr": 4194370, "size": 3, "bytes": "4889c1", "text": "mov rcx, rax" }, { "addr": 4194373, "size": 4, "bytes": "48c1f922", "text": "sar rcx, 0x22" }, { "addr": 4194377, "size": 2, "bytes": "89ca", "text": "mov edx, ecx" }, { "addr": 4194379, "size": 4, "bytes": "48c1e83f", "text": "shr rax, 0x3f" }, { "addr": 4194383, "size": 2, "bytes": "89c1", "text": "mov ecx, eax" }, { "addr": 4194385, "size": 2, "bytes": "89d0", "text": "mov eax, edx" }, { "addr": 4194387, "size": 4, "bytes": "8d4408fa", "text": "lea eax, [rax + rcx - 6]" }, { "addr": 4194391, "size": 2, "bytes": "89c1", "text": "mov ecx, eax" }, { "addr": 4194393, "size": 4, "bytes": "48894df0", "text": "mov qword ptr [rbp - 0x10], rcx" }, { "addr": 4194397, "size": 3, "bytes": "83e804", "text": "sub eax, 4" }, { "addr": 4194400, "size": 2, "bytes": "7738", "text": "ja 0x40009a" } ], "vexStatements": 84, "jumpkind": "Ijk_Boring" }, { "addr": 4194402, "size": 20, "instructions": [ { "addr": 4194402, "size": 4, "bytes": "488b45f0", "text": "mov rax, qword ptr [rbp - 0x10]" }, { "addr": 4194406, "size": 7, "bytes": "488d0dbb000000", "text": "lea rcx, [rip + 0xbb]" }, { "addr": 4194413, "size": 4, "bytes": "48630481", "text": "movsxd rax, dword ptr [rcx + rax*4]" }, { "addr": 4194417, "size": 3, "bytes": "4801c8", "text": "add rax, rcx" }, { "addr": 4194420, "size": 2, "bytes": "ffe0", "text": "jmp rax" } ], "vexStatements": 20, "jumpkind": "Ijk_Boring" }, { "addr": 4194422, "size": 9, "instructions": [ { "addr": 4194422, "size": 7, "bytes": "c745fc04000000", "text": "mov dword ptr [rbp - 4], 4" }, { "addr": 4194429, "size": 2, "bytes": "eb22", "text": "jmp 0x4000a1" } ], "vexStatements": 5, "jumpkind": "Ijk_Boring" }, { "addr": 4194431, "size": 9, "instructions": [ { "addr": 4194431, "size": 7, "bytes": "c745fc03000000", "text": "mov dword ptr [rbp - 4], 3" }, { "addr": 4194438, "size": 2, "bytes": "eb19", "text": "jmp 0x4000a1" } ], "vexStatements": 5, "jumpkind": "Ijk_Boring" }, { "addr": 4194440, "size": 9, "instructions": [ { "addr": 4194440, "size": 7, "bytes": "c745fc02000000", "text": "mov dword ptr [rbp - 4], 2" }, { "addr": 4194447, "size": 2, "bytes": "eb10", "text": "jmp 0x4000a1" } ], "vexStatements": 5, "jumpkind": "Ijk_Boring" }, { "addr": 4194449, "size": 9, "instructions": [ { "addr": 4194449, "size": 7, "bytes": "c745fc01000000", "text": "mov dword ptr [rbp - 4], 1" }, { "addr": 4194456, "size": 2, "bytes": "eb07", "text": "jmp 0x4000a1" } ], "vexStatements": 5, "jumpkind": "Ijk_Boring" }, { "addr": 4194458, "size": 7, "instructions": [ { "addr": 4194458, "size": 7, "bytes": "c745fc00000000", "text": "mov dword ptr [rbp - 4], 0" } ], "vexStatements": 4, "jumpkind": "Ijk_Boring" }, { "addr": 4194465, "size": 5, "instructions": [ { "addr": 4194465, "size": 3, "bytes": "8b45fc", "text": "mov eax, dword ptr [rbp - 4]" }, { "addr": 4194468, "size": 1, "bytes": "5d", "text": "pop rbp" }, { "addr": 4194469, "size": 1, "bytes": "c3", "text": "ret" } ], "vexStatements": 20, "jumpkind": "Ijk_Ret" } ], "edges": [ { "from": 4194352, "to": 4194402, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194352, "to": 4194458, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194402, "to": 5242960, "type": "transition", "outside": true, "target": "HookNode" }, { "from": 4194422, "to": 4194465, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194431, "to": 4194465, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194440, "to": 4194465, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194449, "to": 4194465, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194458, "to": 4194465, "type": "transition", "outside": false, "target": "BlockNode" } ], "decompiled": "extern unsigned int g_400128[4];\n\nlong long grade(int a0)\n{\n unsigned int v2; // eax\n unsigned int v0; // [bp-0xc]\n\n v2 = ((long long)(a0 * 1717986919) >> 0x22 & 0xffffffff) + (a0 * 1717986919 >> 63 & 0xffffffff) - 6;\n if ((unsigned int)(((long long)(a0 * 1717986919) >> 0x22 & 0xffffffff) + (a0 * 1717986919 >> 63 & 0xffffffff) - 6) > 4)\n {\n v0 = 0;\n return v0;\n }\n goto *((void *)((long long)(g_400128[v2] + (char *)&g_400128[0])));\n}\n", "decompileError": null }, { "name": "sub_4000a6", "addr": 4194470, "size": 10, "fromSymbol": false, "blocks": [ { "addr": 4194470, "size": 10, "instructions": [ { "addr": 4194470, "size": 10, "bytes": "662e0f1f840000000000", "text": "nop word ptr cs:[rax + rax]" } ], "vexStatements": 1, "jumpkind": "Ijk_Boring" } ], "edges": [ { "from": 4194470, "to": 4194480, "type": "transition", "outside": true, "target": "BlockNode" } ], "decompiled": null, "decompileError": null }, { "name": "total", "addr": 4194480, "size": 66, "fromSymbol": true, "blocks": [ { "addr": 4194480, "size": 25, "instructions": [ { "addr": 4194480, "size": 1, "bytes": "55", "text": "push rbp" }, { "addr": 4194481, "size": 3, "bytes": "4889e5", "text": "mov rbp, rsp" }, { "addr": 4194484, "size": 4, "bytes": "48897df8", "text": "mov qword ptr [rbp - 8], rdi" }, { "addr": 4194488, "size": 3, "bytes": "8975f4", "text": "mov dword ptr [rbp - 0xc], esi" }, { "addr": 4194491, "size": 7, "bytes": "c745f000000000", "text": "mov dword ptr [rbp - 0x10], 0" }, { "addr": 4194498, "size": 7, "bytes": "c745ec00000000", "text": "mov dword ptr [rbp - 0x14], 0" } ], "vexStatements": 27, "jumpkind": "Ijk_Boring" }, { "addr": 4194505, "size": 8, "instructions": [ { "addr": 4194505, "size": 3, "bytes": "8b45ec", "text": "mov eax, dword ptr [rbp - 0x14]" }, { "addr": 4194508, "size": 3, "bytes": "3b45f4", "text": "cmp eax, dword ptr [rbp - 0xc]" }, { "addr": 4194511, "size": 2, "bytes": "7d1c", "text": "jge 0x4000ed" } ], "vexStatements": 31, "jumpkind": "Ijk_Boring" }, { "addr": 4194513, "size": 28, "instructions": [ { "addr": 4194513, "size": 4, "bytes": "488b45f8", "text": "mov rax, qword ptr [rbp - 8]" }, { "addr": 4194517, "size": 4, "bytes": "48634dec", "text": "movsxd rcx, dword ptr [rbp - 0x14]" }, { "addr": 4194521, "size": 3, "bytes": "8b0488", "text": "mov eax, dword ptr [rax + rcx*4]" }, { "addr": 4194524, "size": 3, "bytes": "0345f0", "text": "add eax, dword ptr [rbp - 0x10]" }, { "addr": 4194527, "size": 3, "bytes": "8945f0", "text": "mov dword ptr [rbp - 0x10], eax" }, { "addr": 4194530, "size": 3, "bytes": "8b45ec", "text": "mov eax, dword ptr [rbp - 0x14]" }, { "addr": 4194533, "size": 3, "bytes": "83c001", "text": "add eax, 1" }, { "addr": 4194536, "size": 3, "bytes": "8945ec", "text": "mov dword ptr [rbp - 0x14], eax" }, { "addr": 4194539, "size": 2, "bytes": "ebdc", "text": "jmp 0x4000c9" } ], "vexStatements": 49, "jumpkind": "Ijk_Boring" }, { "addr": 4194541, "size": 5, "instructions": [ { "addr": 4194541, "size": 3, "bytes": "8b45f0", "text": "mov eax, dword ptr [rbp - 0x10]" }, { "addr": 4194544, "size": 1, "bytes": "5d", "text": "pop rbp" }, { "addr": 4194545, "size": 1, "bytes": "c3", "text": "ret" } ], "vexStatements": 20, "jumpkind": "Ijk_Ret" } ], "edges": [ { "from": 4194480, "to": 4194505, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194505, "to": 4194513, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194505, "to": 4194541, "type": "transition", "outside": false, "target": "BlockNode" }, { "from": 4194513, "to": 4194505, "type": "transition", "outside": false, "target": "BlockNode" } ], "decompiled": "unsigned int total(unsigned int *a0, int a1)\n{\n int i; // [bp-0x1c]\n unsigned int v1; // [bp-0x18]\n\n v1 = 0;\n for (i = 0; i < a1; i += 1)\n {\n v1 += a0[i];\n }\n return v1;\n}\n", "decompileError": null }, { "name": "sub_4000f2", "addr": 4194546, "size": 14, "fromSymbol": false, "blocks": [ { "addr": 4194546, "size": 14, "instructions": [ { "addr": 4194546, "size": 14, "bytes": "66666666662e0f1f840000000000", "text": "nop word ptr cs:[rax + rax]" } ], "vexStatements": 1, "jumpkind": "Ijk_Boring" } ], "edges": [ { "from": 4194546, "to": 4194560, "type": "transition", "outside": true, "target": "BlockNode" } ], "decompiled": null, "decompileError": null }, { "name": "grade_label", "addr": 4194560, "size": 39, "fromSymbol": true, "blocks": [ { "addr": 4194560, "size": 19, "instructions": [ { "addr": 4194560, "size": 1, "bytes": "55", "text": "push rbp" }, { "addr": 4194561, "size": 3, "bytes": "4889e5", "text": "mov rbp, rsp" }, { "addr": 4194564, "size": 4, "bytes": "4883ec10", "text": "sub rsp, 0x10" }, { "addr": 4194568, "size": 3, "bytes": "897dfc", "text": "mov dword ptr [rbp - 4], edi" }, { "addr": 4194571, "size": 3, "bytes": "8b7dfc", "text": "mov edi, dword ptr [rbp - 4]" }, { "addr": 4194574, "size": 5, "bytes": "e81dffffff", "text": "call 0x400030" } ], "vexStatements": 34, "jumpkind": "Ijk_Call" }, { "addr": 4194579, "size": 20, "instructions": [ { "addr": 4194579, "size": 3, "bytes": "4863c8", "text": "movsxd rcx, eax" }, { "addr": 4194582, "size": 7, "bytes": "488d0523000000", "text": "lea rax, [rip + 0x23]" }, { "addr": 4194589, "size": 4, "bytes": "488b04c8", "text": "mov rax, qword ptr [rax + rcx*8]" }, { "addr": 4194593, "size": 4, "bytes": "4883c410", "text": "add rsp, 0x10" }, { "addr": 4194597, "size": 1, "bytes": "5d", "text": "pop rbp" }, { "addr": 4194598, "size": 1, "bytes": "c3", "text": "ret" } ], "vexStatements": 33, "jumpkind": "Ijk_Ret" } ], "edges": [ { "from": 4194560, "to": 4194352, "type": "call", "outside": false, "target": "FuncNode" }, { "from": 4194560, "to": 4194579, "type": "fake_return", "outside": false, "target": "BlockNode" } ], "decompiled": "extern unsigned long long labels[4];\n\nlong long grade_label(int a0)\n{\n return labels[(int)grade(a0)];\n}\n", "decompileError": null } ], "memoryData": [ { "addr": 4194352, "size": 247, "sort": "unknown" }, { "addr": 4194600, "size": 20, "sort": "unknown" }, { "addr": 4194624, "size": 40, "sort": "pointer-array" }, { "addr": 4194664, "size": 2, "sort": "string" }, { "addr": 4194666, "size": 2, "sort": "string" }, { "addr": 4194668, "size": 2, "sort": "string" }, { "addr": 4194670, "size": 2, "sort": "string" }, { "addr": 4194672, "size": 2, "sort": "string" } ] }