How to use ElfCore backend?

Hello!

Trying to load a core-dump generated from gdb using the gcore command

python code angr.Project("./core_trivial_x86_args_BCD_no-heap_rand.core", main_opts={'backend': 'elfcore'})

output of file ./trivial trivial: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=df6e0829eb91f5b89ef2dc2b046c8dcd988875bb, not stripped

output of cat trivial.c

#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[]) {
  if(argc!=2)
    return -1;
  printf("Start!\n");
  if (argv[1][0] == 'A') {
    printf("WIN!\n");
  } else {
    printf("FAIL!\n");
  }
}

The runtime output is:

WARNING | 2017-12-23 08:52:55,209 | angr.analyses.disassembly_utils | Your verison of capstone does not support MIPS instruction groups.
WARNING | 2017-12-23 08:52:55,227 | cle.elfcore | No SSE registers could be loaded from core file
Traceback (most recent call last):
  File "use_core.py", line 3, in <module>
    angr.Project("./core_trivial_x86_args_BCD_no-heap_rand.core", main_opts={'backend': 'elfcore'})
  File "/mypath/angr-dev/angr/angr/project.py", line 231, in __init__
    self.simos.configure_project()
  File "/mypath/angr-dev/angr/angr/simos/linux.py", line 33, in configure_project
    self._loader_addr = self.project.loader.extern_object.allocate()
  File "/mypath/angr-dev/cle/cle/loader.py", line 195, in extern_object
    self._map_object(self._extern_object)
  File "/mypath/angr-dev/cle/cle/loader.py", line 583, in _map_object
    base_addr = self._find_safe_rebase_addr(obj_size)
  File "/mypath/angr-dev/cle/cle/loader.py", line 641, in _find_safe_rebase_addr
    raise CLEOperationError("Ran out of room in address space")
cle.errors.CLEOperationError: Ran out of room in address space

I made sure to compile with -m32 to avoid x86_64 addresses and also attempted to disable heap randomization using echo 0 | sudo tee /proc/sys/kernel/randomize_va_space Is ElfCore broken or do I need to do more some special handling while dumping/compiling to make it work?

I did not include the core file/binary as I am not sure what sorts of information they might contain. I could generate clean versions of the files if necessary.

[rhelmot]

Well it sure looks like we broke coredump loading with the latest cle refactor… This is an issue where cle needs to squeeze in a chunk of memory somewhere and it refuses to load below the main binary but the main binary in this case also reaches WAY up to the top of the address space.

In the meantime, you can work around this with these two steps:

• make sure randomization is enabled. This will ensure the stack isn’t mapped way up at 0xffff000.
• set rebase_granularity=0x1000 in the project constructor

[rhelmot]

I have finally relented and applied yan’s patch into cle. Kevin’s question is totally irrelevant and I will not answer it in this issue.