Inquiry about finding pointers, and points-to analysis

Question

Hello. I am new to angr and I heard that angr can find stack and heap pointers. So I looked it up on angr Documentation, angr api doc and some examples but I could not find it. It seems that VSA_DDG class give me the function but I am not sure.

Is there any examples or guide to how to find heap pointers using angr? Or if I missed something from the documents mentioned above, please let me know.

Thank you.

[ltfish]

I want to find a heap variable of a C++ class instance and its aliases.

It is definitely non-trivial. Depending on how much information you know about the binary, this problem has different difficulty levels.

For example, if function names are available in the binary, you may be able to rely on knowing where new is called, and track the returned pointers from new across the entire binary. It’s basically a full-binary points-to analysis.

Since as you mentioned, this C++ class instance (or its pointer) is assigned to a heap variable. It requires you to properly model the heap as well. You must be able to differentiate the heap variable for this class instance and other heap variables that store other values.

You can definitely use angr’s VFG analysis (value-flow graph that implements value-set analysis) to perform value propagation. However, you’ll need to implement heap support, customize its CFG traversal, and implement points-to analysis data structures (since VFG only tracks values, not aliasing information). You don’t want to use CFGEmulated because it does not perform proper state merging (for performance concern).

You can also build your own points-to analysis on top of angr’s modern static analysis framework. Take a look at the source code for Propagator and ReachingDefinitionAnalysis. They should give you an idea of the basics that are required.

Unfortunately angr doesn’t do full-binary points-to analysis (I haven’t found a real use case for it anywhere yet) at this point. But we do provide enough building blocks for you to do-it-yourself.

can I find a list of functions called by indirect calls?

Yes. By default angr’s CFG (CFGFast) does resolve indirect jumps (including indirect calls) with the help of indirect jump resolvers. We don’t have public code that resolves indirect C++ virtual table calls, and resolving indirect virtual table calls efficiently is very much a research project (if not two…) on its own. One of my students attempted it, but the project is currently on-hold.

All resolved and unresolved indirect jumps (including calls) are stored in CFG.indirect_jumps indexed using the basic block address of each indirect jump.

[weaver9651]

Thank you very much for your explanation! It is really helpful.