Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Incorrect arm (32 bits) CFG

See original GitHub issue

Describe the bug.

I got the following error when running CFGFast()

ERROR   | 2020-06-27 00:49:02,806 | angr.analyses.cfg.cfg_fast | Decoding error occurred at address 0x10338 of function 0x10338.
ERROR   | 2020-06-27 00:49:02,807 | angr.analyses.cfg.cfg_fast | Decoding error occurred at address 0x1033b of function 0x1033b.
ERROR   | 2020-06-27 00:49:02,807 | angr.analyses.cfg.cfg_fast | Decoding error occurred at address 0x1033b of function 0x1033b.

In addition, it seems that the CFG generated by angr is incorrect after comparing the results with disassembly from Ghidra.

CFG node addresses generated by angr ['0x102c8', '0x102d0', '0x102d4', '0x102e8', '0x102f4', '0x10300', '0x1030c', '0x10319', '0x10348', '0x10360', '0x1036d', '0x10381', '0x1038b', '0x1038d', '0x1038f', '0x10391', '0x103ad', '0x103b7', '0x103b9', '0x103bb', '0x103bd', '0x103cb', '0x103cf', '0x103d3', '0x103d5', '0x103d7', '0x103d9', '0x103ed', '0x103f3', '0x103fd', '0x10411', '0x10419', '0x1041d', '0x1042b', '0x1042f', '0x10433', '0x1043d', '0x10440', '0x100000', '0x100004', '0x100008', '0x201044', '0x201048']

disassembly from Ghidra

As can be seen from the screenshot, at least '0x103d7', '0x103d9', '0x103ed' shouldn’t be starting address of nodes, the correct addresses should be 0x103d8, 0x103ec (if only the instructions in the screenshot are considered).

Environment Information.

Ubuntu Server 18.04 LTS (x86_64)

$ arm-linux-gnueabihf-gcc --version
arm-linux-gnueabihf-gcc (Ubuntu/Linaro 7.5.0-3ubuntu1~18.04) 7.5.0

$ python3 --version
Python 3.6.9

To Reproduce.

example.zip (simple.c, printf_nopie, cfg.py)

$ cat simple.c 
#include <stdio.h>
int main() {
    printf("%s", "Hi");
    return 0;
}

$ arm-linux-gnueabihf-gcc simple.c -o printf_nopie -no-pie

$ cat cfg.py 
import angr

project = angr.Project("printf_nopie", load_options={"auto_load_libs": False})
cfg = project.analyses.CFGFast(normalize=True, data_references=True)

print([hex(n.addr) for n in sorted(cfg.model.nodes(), key=lambda x: x.addr)])

$ python3 cfg.py
ERROR   | 2020-06-27 00:55:15,866 | angr.analyses.cfg.cfg_fast | Decoding error occurred at address 0x10338 of function 0x10338.
ERROR   | 2020-06-27 00:55:15,866 | angr.analyses.cfg.cfg_fast | Decoding error occurred at address 0x1033b of function 0x1033b.
ERROR   | 2020-06-27 00:55:15,867 | angr.analyses.cfg.cfg_fast | Decoding error occurred at address 0x1033b of function 0x1033b.
['0x102c8', '0x102d0', '0x102d4', '0x102e8', '0x102f4', '0x10300', '0x1030c', '0x10319', '0x10348', '0x10360', '0x1036d', '0x10381', '0x1038b', '0x1038d', '0x1038f', '0x10391', '0x103ad', '0x103b7', '0x103b9', '0x103bb', '0x103bd', '0x103cb', '0x103cf', '0x103d3', '0x103d5', '0x103d7', '0x103d9', '0x103ed', '0x103f3', '0x103fd', '0x10411', '0x10419', '0x1041d', '0x1042b', '0x1042f', '0x10433', '0x1043d', '0x10440', '0x100000', '0x100004', '0x100008', '0x201044', '0x201048']

Additional context.