angr/angr

tracer: resync logic needed for conditional instructions

Open

#2 527 ouverte le 11 févr. 2021

Voir sur GitHub
 (13 commentaires) (0 réactions) (1 assigné)Python (1 031 forks)batch import
bughelp wanted

Métriques du dépôt

Stars
 (6 947 stars)
Métriques de merge PR
 (Merge moyen 23h 17m) (98 PRs mergées en 30 j)

Description

This may be I don't understand ARM.

In the following snippet, the block should end at 0x3DB38

text:0003DB14                 CMN             R2, #0x10
.text:0003DB18                 LDMGE           R1!, {R3,R4,R12,LR}
.text:0003DB1C                 STMGE           R0!, {R3,R4,R12,LR}
.text:0003DB20                 SUBGE           R2, R2, #0x10
.text:0003DB24                 POP             {R4}
.text:0003DB28
.text:0003DB28 loc_3DB28                               ; CODE XREF: memcpy_0+34↑j
.text:0003DB28                 ADDS            R2, R2, #0x14
.text:0003DB2C
.text:0003DB2C loc_3DB2C                               ; CODE XREF: memcpy_0+78↓j
.text:0003DB2C                 LDMGE           R1!, {R3,R12,LR}
.text:0003DB30                 STMGE           R0!, {R3,R12,LR}
.text:0003DB34                 SUBSGE          R2, R2, #0xC
.text:0003DB38                 BGE             loc_3DB2C

angr generates the correct basic block. However, when trying to execute the snippet, somehow angr can stop execution prematurely at 0x0003DB1C which confuses me.

Everything to replicate the issue is attached as follow

https://gist.github.com/Kyle-Kyle/92371cad52f772a38e9a0eed9cf0551b

Guide contributeur