Can angr ignore function calls?

Example:

push eax
push ebx
call some_func
test eax, eax
jne 0xxxxx

I do not want angr to execute the some_func body, so angr can skip it?

thanks.

[schieb]

Obligatory warning that may not apply in your case: Depending on the calling convention, skipping function calls can result in the stack pointer becoming corrupted.

For example, in your example there are two pushes before the call. If the callee is responsible for cleaning up the stack (e.g., ret 8) then simply NOPing out the call instruction with an empty hook will cause the stack to become corrupt. The correct thing to do in that case is to stub the function with a SimProcedure while specifying the calling convention.

@rhelmot has some code that can help to automatically detect calling conventions. In particular it will attempt to determine the size of the stack that the callee will cleanup before returning. It is mostly helpful when stubbing functions in a Windows binary. It works very well. The only discrepancy I have had was for a function in a dll that takes one of two paths: It either returns to the caller, or calls a function that does not return. This is more of a CFG problem though.

[yangshouguo]

You can also ignore all function calls by adding the CALLLESS state option. It’ll unconstrained the return value register, though. On Oct 24, 2017 10:22 AM, “Fish” [e-mail] wrote: There are two ways to achieve your goal. - Hook the call some_func instruction with a hook (project.Hook()) with a length of the size of the call instruction. - Hook the some_func function with the ReturnUnconstrained stub SimProcedure. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#723 (comment)>, or mute the thread https://github.com/notifications/unsubscribe-auth/ADSzl4Ln90rGoHkgXhEdG1TfOydsspZZks5svfKQgaJpZM4QEeWw .

would you provide an example code?