angr
angr copied to clipboard
Make KnowledgeBase state-specific
The current concept of the KnowledgeBase is knowledge about a program/project, typically the initial state of the program, but not exclusively. angr supports creating new KB's, and some analyses take a state argument for analysis, so you can attempt to make a KB state-specific, however subsequent analyses may refer to initial program state when adding knowledge to the KB, eventually creating inconsistencies in knowledge artifacts.
Take for example a program that modifies itself at runtime, a program which dynamically loads or re-loads code at runtime, programs that conditionally dlopen
one library or another, or the concept of patches in angr, which can be applied during CFG analysis, but are not respected elsewhere when lifting blocks, e.g. during execution. Today there is no organized way to represent knowledge about the program after these events.
To support these (and more) cases, KnowledgeBase should be changed from being a container for knowledge about a program, to being knowledge about a given state, with a new immutable state
property. All analyses should be performed on a KB's immutable state, and update the associated KB. The initial KB would of course be based upon the initial program state. With this approach, we can cleanly organize knowledge about a program at any given state (like before and after it unpacks/dlopen
s some code).