{"id":6960,"library":"ailment","title":"Ailment: Angr Intermediate Language","description":"Ailment is the Intermediate Language (IL) used by the angr binary analysis framework. It provides a higher-level, more abstract representation of program execution than traditional assembly or micro-code, aiding in static analysis and program transformation. Currently at version 9.2.158, it is actively maintained as a core component of the angr ecosystem, with frequent updates tied to angr's release cadence.","status":"active","version":"9.2.158","language":"en","source_language":"en","source_url":"https://github.com/angr/ailment","tags":["angr","reverse-engineering","intermediate-representation","binary-analysis","static-analysis"],"install":[{"cmd":"pip install ailment","lang":"bash","label":"Install Ailment"}],"dependencies":[],"imports":[{"note":"Core AIL components like Block, Statement, and Expression are located in specific submodules, not directly under the top-level 'ailment' package.","wrong":"from ailment import Block","symbol":"Block","correct":"from ailment.block import Block"},{"note":"Core AIL components like Block, Statement, and Expression are located in specific submodules, not directly under the top-level 'ailment' package.","wrong":"from ailment import Statement","symbol":"Statement","correct":"from ailment.statement import Statement, Assignment"},{"note":"Core AIL components like Block, Statement, and Expression are located in specific submodules, not directly under the top-level 'ailment' package.","wrong":"from ailment import Expression","symbol":"Expression","correct":"from ailment.expression import Expression, Const, Register, BinaryOp"}],"quickstart":{"code":"from ailment.expression import Const, Register\nfrom ailment.statement import Assignment\nfrom ailment.block import Block\n\n# Create a 64-bit constant expression with value 0x123\nconstant_expr = Const(0, None, 64, 0x123)\n\n# Create a 64-bit register expression representing RAX (offset 0 in an abstract context)\n# In AIL, registers are often identified by their size and offset within a CPU context.\nrax_reg = Register(0, None, 64, 0) # stmt_idx=0, ins_addr=None, size=64 bits, reg_offset=0\n\n# Create an assignment statement: RAX = 0x123\n# Arguments: stmt_idx, dst_expression, src_expression\nassignment_stmt = Assignment(0, rax_reg, constant_expr)\n\n# Create an AIL block containing the assignment statement\n# Arguments: addr, size, statements (must be a list), idx (optional)\n# 'addr' and 'size' are the abstract address and size of the block.\nail_block = Block(0x400000, 10, [assignment_stmt])\n\nprint(f\"Created AIL Block at 0x{ail_block.addr:x}:\")\nprint(f\"  Statements: {len(ail_block.statements)}\")\nprint(f\"  First statement: {ail_block.statements[0]}\")\nprint(f\"    Destination: {ail_block.statements[0].dst}\")\nprint(f\"    Source: {ail_block.statements[0].src}\")\n","lang":"python","description":"This quickstart demonstrates how to manually construct basic AIL objects: a constant expression, a register expression, an assignment statement, and finally a block containing that statement. It highlights the modular nature of AIL components and their hierarchical structure."},"warnings":[{"fix":"Always install 'angr' and 'ailment' together, preferably by running `pip install angr`, which will pull the compatible 'ailment' version as a dependency. If installing separately, ensure their major versions align.","message":"Ailment is tightly coupled with the angr framework. Mismatched major versions between 'ailment' and 'angr' (e.g., ailment 8.x with angr 9.x) can lead to runtime errors due to API incompatibilities.","severity":"breaking","affected_versions":"All major version changes (e.g., 8.x to 9.x)"},{"fix":"If you need to 'modify' an AIL object, you must create a new object with the desired changes. Some AIL objects might provide `.copy()` or `.replace()` methods for convenience, but the underlying principle is immutability.","message":"All AIL objects (Block, Statement, Expression, etc.) are immutable after creation. Attempting to modify their attributes directly will not work or will result in unexpected behavior.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Update your code to use `Load` and `Store` as expressions. For example, to read from memory into a register, you would use `Assignment(..., dst=Register(...), src=Load(...))` instead of a standalone `Load` statement. Consult the Ailment 9.x API documentation for the new usage patterns.","message":"The representation of memory loads and stores changed significantly in Ailment 9.x. Previously, `Load` and `Store` were standalone statements. In 9.x, they are 'expressions' representing memory access within other statements (e.g., an `Assignment`'s source or destination).","severity":"breaking","affected_versions":"Versions prior to 9.0.0 when upgrading to 9.x"}],"env_vars":null,"last_verified":"2026-04-16T00:00:00.000Z","next_check":"2026-07-15T00:00:00.000Z","problems":[{"fix":"Import these classes from their specific submodules. For example: `from ailment.block import Block`, `from ailment.statement import Assignment`, `from ailment.expression import Const`.","cause":"You are trying to import AIL core classes (like Block, Statement, Expression) directly from the top-level 'ailment' package.","error":"AttributeError: module 'ailment' has no attribute 'Block'"},{"fix":"Wrap your single statement in a list: `Block(addr, size, [my_statement])`.","cause":"The `statements` argument for the `Block` constructor expects a list of statement objects, even if there's only one statement.","error":"TypeError: argument of type 'Assignment' is not iterable"},{"fix":"Refactor your code to treat `Load` and `Store` as expressions representing memory accesses within other statements (e.g., an `Assignment`). Consult the Ailment 9.x documentation for the updated API. You'll generally find them as the source or destination of an `Assignment` expression.","cause":"Your code is likely trying to use the `Load` or `Store` objects with an API compatible with Ailment 8.x, while running on Ailment 9.x or later. In 9.x, `Load` and `Store` are expressions, not statements, and their structure changed.","error":"AttributeError: 'Load' object has no attribute 'addr' (or similar errors when manipulating Load/Store objects)"}]}