Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Issue]: Angr CFG fast analysis fails and is not property try-caught #5

Open
ReversingWithMe opened this issue Apr 6, 2023 · 0 comments

Comments

@ReversingWithMe
Copy link
Collaborator

ReversingWithMe commented Apr 6, 2023

Summary

The disassembly utils in core libraries has imports that are invalid from capstone.

Steps to reproduce (if applicable)

  1. run fst_angr_disasm 08951f191dfb326ee66d2d17ae88357f2773c09e

Expected behavior (if applicable)

The import command should continue noting failed files, and print a list of corrupted or failed files at the end.

No output

Actual behavior (if applicable)

 
During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "oxide\core\oshell.py", line 68, in wrapper
    return f(self, *args, **kwargs)
  File "oxide\core\oshell.py", line 426, in default
    self.parse_pipe(commands)
  File "oxide\core\oshell.py", line 1193, in parse_pipe
    res = func(args, opts)
  File "oxide\plugins\compare.py", line 272, in compare_insns
    disasm = api.retrieve('disassembly', oid, options)
  File "oxide\core\oxide.py", line 275, in retrieve
    ret_val = single_call_module(module_type, mod_name, oid_list, opts)
  File "oxide\core\oxide.py", line 109, in single_call_module
    return initialized_modules[mod_name].results(oid_list, opts)
  File "oxide\modules\analyzers\disassembly\module_interface.py", line 91, in results
    tool_insns = api.get_field(disassembler, oid, "instructions", opts)
  File "oxide\core\oxide.py", line 355, in get_field
    ds = retrieve(mod_name, oid, opts)
  File "oxide\core\oxide.py", line 282, in retrieve
    ret_val = single_retrieve(mod_name, oid_list[0], opts, lock)
  File "oxide\core\oxide.py", line 205, in single_retrieve
    process(mod_name, oid, opts)
  File "oxide\core\oxide.py", line 170, in process
    if not single_call_module(module_type, mod_name, oid, opts):
  File "oxide\core\oxide.py", line 106, in single_call_module
    return initialized_modules[mod_name].process(oid_list, opts)
  File "oxide\modules\extractors\fst_angr_disasm\module_interface.py", line 62, in process
    result = fst_angr_extract.extract(f_name, header)
  File "oxide\modules\extractors\fst_angr_disasm\fst_angr_extract.py", line 47, in extract
    cfg = p.analyses.CFGFast(normalize=True)
  File "Python\Python310\site-packages\angr\analyses\analysis.py", line 138, in __call__
    r = w(*args, **kwargs)
  File "Python\Python310\site-packages\angr\analyses\analysis.py", line 122, in wrapper
    oself.__init__(*args, **kwargs)
  File "Python\Python310\site-packages\angr\analyses\cfg\cfg_fast.py", line 756, in __init__
    self._analyze()
  File "Python\Python310\site-packages\angr\analyses\forward_analysis\forward_analysis.py", line 236, in _analyze
  File "Python\Python310\site-packages\angr\analyses\forward_analysis\forward_analysis.py", line 383, in _analysis_core_baremetal
    self._process_job_and_get_successors(job_info)
  File "Python\Python310\site-packages\angr\analyses\forward_analysis\forward_analysis.py", line 401, in _process_job_and_get_successors
    successors = self._get_successors(job)
  File "Python\Python310\site-packages\angr\analyses\cfg\cfg_fast.py", line 1267, in _get_successors
    jobs = self._scan_block(job)
  File "Python\Python310\site-packages\angr\analyses\cfg\cfg_fast.py", line 1634, in _scan_block
    entries = self._scan_procedure(cfg_job, current_func_addr)
  File "Python\Python310\site-packages\angr\analyses\cfg\cfg_fast.py", line 1709, in _scan_procedure
    new_exits = procedure.static_exits(blocks_ahead, cfg=self)
  File "Python\Python310\site-packages\angr\procedures\posix\pthread.py", line 27, in static_exits
    irsb = self.project.factory.default_engine.process(state, b, force_addr=b.addr)
  File "Python\Python310\site-packages\angr\engines\vex\light\slicing.py", line 19, in process
    return super().process(*args, **kwargs)
  File "Python\Python310\site-packages\angr\engines\engine.py", line 159, in process
    self.process_successors(self.successors, **kwargs)
  File "Python\Python310\site-packages\angr\engines\failure.py", line 13, in process_successors
    raise AngrExitError("Cannot execute following jumpkind %s" % jumpkind)
angr.errors.AngrExitError: Cannot execute following jumpkind Ijk_MapFail
------------------------------------------------------------

Context/Environment

  • Project Version: latest (20230406)
  • Operating System: Windows 11
  • Compiler/Interpreter: Python 3.10.7
  • Library: angr==9.2.21

Possible solutions (optional)

File "oxide\modules\extractors\fst_angr_disasm\fst_angr_extract.py", line 47, in extract
cfg = p.analyses.CFGFast(normalize=True)

this operation should be wrapped in a try-catch, although the best solution would be identifying correct configuration so this is not a error that occurs. The module should be skipped and command exits gracefully alerting to failed analysis.

Additional information (optional)

The crash handles gracefully.

File is rpisec bomb lab, not relevant to error, input file is not crucial to reproduction.


Please make sure to:

  • [ x] Check if the issue/feature request already exists to avoid duplicates
  • [x ] Include clear steps to reproduce the problem, if applicable
  • [ x] Provide details about your environment, including the project version, operating system, and compiler/interpreter
  • [ x] Add any relevant labels or tags to help categorize the issue/feature request

Thank you for contributing to this open source project!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant