import angr
from dynpathresolver import DynPathResolver

# Load binary
project = angr.Project("./target_binary", auto_load_libs=False)

# Create DynPathResolver - NO library_paths needed for discovery
dpr = DynPathResolver(
    handle_syscall_loading=True,  # Detect mmap, memfd_create, etc.
    track_indirect_flow=True,     # Track indirect calls/jumps
)

# Run symbolic analysis
state = project.factory.entry_state()
simgr = project.factory.simgr(state)
simgr.use_technique(dpr)
simgr.run(n=1000)
dpr.complete(simgr)

# Get discovered libraries and dynamic code
for event in dpr.get_library_load_events():
    print(f"Found: {event.library_path}")
    print(f"  Method: {event.loading_method}")  # DLOPEN, MANUAL_ELF, MMAP_EXEC
    print(f"  Call site: 0x{event.call_site:x}")

# Export discoveries
dpr.export_json("discoveries.json")

from dynpathresolver.core import CompleteCFGBuilder

project = angr.Project("./target", auto_load_libs=False)

# Now provide paths where discovered libraries can be found
builder = CompleteCFGBuilder(
    project,
    library_paths=["./extracted_libs/", "/opt/plugins/"],
)

# Build unified CFG: main binary + all discovered libraries
cfg = builder.build_with_libraries(max_steps=500)

print(f"Total blocks: {cfg.total_basic_blocks}")
print(f"Static edges: {cfg.static_edges}")
print(f"Dynamic edges: {cfg.dynamic_edges}")  # Edges INTO loaded libraries
print(f"Libraries included: {cfg.discovered_libraries}")

# Export for visualization
cfg.export_dot("combined_cfg.dot")
cfg.export_json("combined_cfg.json")

from dynpathresolver import DynPathResolver
from dynpathresolver.core import RecursiveLibraryAnalyzer

project = angr.Project("./target", auto_load_libs=False)

dpr = DynPathResolver(library_paths=["./libs"])
analyzer = RecursiveLibraryAnalyzer(project, dpr)

# Analyze chained library loading (A loads B loads C)
chain = analyzer.analyze()

for lib in chain.discovered_libraries:
    print(f"{lib.path} (depth: {lib.depth})")

dpr = DynPathResolver(
    # Library search paths
    library_paths=["/opt/plugins", "./libs"],

    # Preload common libraries (libc, pthread, etc.)
    preload_common=True,

    # Syscall-level detection (mmap, memfd_create, etc.)
    handle_syscall_loading=True,

    # Control flow tracking
    track_indirect_flow=True,
    detect_rop=True,
    detect_jop=True,

    # Signal handler tracking
    track_signals=True,

    # Environment variable tracking
    track_environment=True,

    # Obfuscation detection
    detect_opaque_predicates=True,
    detect_cff=True,  # Control flow flattening
    detect_vm_obfuscation=True,
    track_smc=True,   # Self-modifying code

    # Taint tracking
    enable_taint_tracking=True,
    enable_decryption_detection=True,

    # Validation mode: 'none', 'record', or 'validate'
    validation_mode='none',
)

import angr
from dynpathresolver import DynPathResolver
from dynpathresolver.core import CompleteCFGBuilder

# ============================================
# PHASE 1: Discovery - find all dynamic code
# ============================================
project = angr.Project("./malware_sample", auto_load_libs=False)

dpr = DynPathResolver(
    handle_syscall_loading=True,
    track_indirect_flow=True,
)

state = project.factory.entry_state()
simgr = project.factory.simgr(state)
simgr.use_technique(dpr)
simgr.run(n=500)
dpr.complete(simgr)

# See what was discovered
print("=== Discovered Dynamic Code ===")
for event in dpr.get_library_load_events():
    print(f"{event.library_path} via {event.loading_method}")

# Export discoveries
dpr.export_json("discoveries.json")

# ============================================
# PHASE 2: Full CFG - after obtaining libraries
# ============================================
# Now that we know what libraries are needed, we can:
# 1. Extract them from the malware sample bundle
# 2. Download them from a repository
# 3. Use them from the analysis environment

builder = CompleteCFGBuilder(
    project,
    library_paths=["./extracted_libs/"],  # Where we put the libraries
)

cfg = builder.build_with_libraries(max_steps=500)

print(f"\n=== Complete CFG ===")
print(f"Static edges (main binary): {cfg.static_edges}")
print(f"Dynamic edges (into libraries): {cfg.dynamic_edges}")
print(f"Total coverage: {cfg.total_basic_blocks} blocks")

cfg.export_dot("complete_cfg.dot")

from dynpathresolver.core import RecursiveLibraryAnalyzer

analyzer = RecursiveLibraryAnalyzer(project, dpr)
chain = analyzer.analyze()

for lib in chain.discovered_libraries:
    print(f"{lib.path} (loaded by: {lib.loaded_by}, depth: {lib.depth})")

from dynpathresolver.validation import FridaValidator

validator = FridaValidator(
    binary_path="./target",
    timeout=30,
    library_paths=["./plugins"],
)

# Validate specific library
result = validator.validate_library("libplugin.so")
print(f"Status: {result.status}")  # VERIFIED, NOT_DETECTED, ERROR
print(f"Method: {result.loading_method}")  # dlopen, manual_elf, mmap_exec
print(f"Details: {result.details}")

DynPathResolver(
    max_forks: int = 8,
    preload_common: bool = True,
    library_paths: list[str] = None,
    handle_syscall_loading: bool = False,
    track_indirect_flow: bool = False,
    detect_rop: bool = False,
    detect_jop: bool = False,
    track_signals: bool = False,
    validation_mode: str = 'none',  # 'none', 'record', 'validate'
    ...
)

CompleteCFGBuilder(
    project: angr.Project,
    library_paths: list[str] = None,
    context_sensitivity_level: int = 1,
    keep_state: bool = True,
)

FridaValidator(
    binary_path: str,
    timeout: int = 30,
    library_paths: list[str] = None,
)

@dataclass
class LibraryLoadEvent:
    library_path: str
    library_name: str
    loading_method: LoadingMethod  # DLOPEN, MANUAL_ELF, MMAP_EXEC
    handle: int | None
    call_site: int | None
    register_snapshot: RegisterSnapshot | None
    arguments: dict[str, Any]
    constraints: list[str]
    call_stack: list[int]

@dataclass
class CompleteCFG:
    nodes: dict[int, CompleteCFGNode]
    edges: list[CompleteCFGEdge]
    discovered_libraries: list[str]

    @property
    def static_edges(self) -> int
    @property
    def dynamic_edges(self) -> int

    def export_dot(self, path: str)
    def export_json(self, path: str)