Question: explore a target address with cfg

I use the method explore in PathGroup, as the documents say, if I give a cfg to it, it can avoid some unreadchable blocks, but when I do this, I can not get the path to my target address any more, which returns <PathGroup with 1 avoid>, how ever if I don’t give the cfg to it, it can find the path to the my target address. is there any wrong with this? here is my code:

import angr
p = angr.Project("fauxware", load_options={"auto_load_libs":False})
cfg = p.analyses.CFG()
pg.explore(find=0x400729, cfg=cfg, num_find=10)

and I got this: <PathGroup with 1 avoid> if i don’t give the cfg, it works well. 0x400729 is an cfg node address, I read the source code, here should be a base block address. in the source code, if an cfg is given, it would visited the cfg tree, to find which node should be avoid.

[rhelmot]

Actually… this issue is on me, who tossed that functionality into the otiegnqwvk and then never bothered to test it!

I will look at this in the next few days.

On Wed, Dec 7, 2016 at 12:59 AM Fish [e-mail] wrote:

It might be astonishing for you to hear a core angr developer does not remember how a CFG is used in PathGroup. But it’s sadly true, I totally forget about it… @zardus https://github.com/zardus this issue is on you.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/angr/angr/issues/281#issuecomment-265392295, or mute the thread https://github.com/notifications/unsubscribe-auth/ACYg9buVsXK8nlHF-3o8e937ZS25h4jpks5rFnV-gaJpZM4LGRph .

[bertcug]

thank you very much @rhelmot