SVC not implemented (correctly)
See original GitHub issueDescribe the bug.
I think that SVC command for ARM LE isn’t correctly implemented. I have 2 binary examples. One calls svc 0x0090000a
, and the other svc 0x00000000
. Running symbolic execution over the first throws IR decoding error at 0x13954.
, second one runs fine. In the matter of fact, I’ve run symb. analysis over 100 binaries, and previous statement holds for this population.
Maybe the definition of svc instruction is incorrectly written in pyvex, but I cannot decipher it. I’ve been looking into /vex/priv/guest_arm_toIR.c
.
Environment Information.
/home/johnq/angr_proj/angr-dev/angr/angr/misc/bug_report.py:1: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
import imp
angr environment report
=============================
Date: 2021-05-06 16:22:08.402843
Running in virtual environment at /home/johnq/.virtualenvs/angr
Platform: linux-x86_64
Python version: 3.8.5 (default, Jan 27 2021, 15:41:15)
[GCC 9.3.0]
######## angr #########
Python found it in /home/johnq/angr_proj/angr-dev/angr/angr
Pip version angr 9.0.gitrolling
Git info:
Current commit 32fb4c53fb147ab2e6b5d55aa59bf6ebdd5ecbd6 from branch master
Checked out from remote origin: https://github.com/angr/angr
######## ailment #########
Python found it in /home/johnq/angr_proj/angr-dev/ailment/ailment
Pip version ailment 9.0.gitrolling
Git info:
Current commit 14482b7fc1af40e4af294feed929cb1340564231 from branch master
Checked out from remote origin: https://github.com/angr/ailment
######## cle #########
Python found it in /home/johnq/angr_proj/angr-dev/cle/cle
Pip version cle 9.0.gitrolling
Git info:
Current commit 80dcd50abfaa70cbd5b2e360fe41b71406acbfb4 from branch master
Checked out from remote origin: https://github.com/angr/cle
######## pyvex #########
Python found it in /home/johnq/angr_proj/angr-dev/pyvex/pyvex
Pip version pyvex 9.0.gitrolling
Git info:
Current commit 372f808843d1fda54d8f1eb5431a437bb3ae66ad from branch master
Checked out from remote origin: https://github.com/angr/pyvex
######## claripy #########
Python found it in /home/johnq/angr_proj/angr-dev/claripy/claripy
Pip version claripy 9.0.gitrolling
Git info:
Current commit fe614e61564636bb118c8514b8b08e525aa670bb from branch master
Checked out from remote origin: https://github.com/angr/claripy
######## archinfo #########
Python found it in /home/johnq/angr_proj/angr-dev/archinfo/archinfo
Pip version archinfo 9.0.gitrolling
Git info:
Current commit 437b194538ccb0bf118b4b674613b88832b0b342 from branch master
Checked out from remote origin: https://github.com/angr/archinfo
######## z3 #########
Python found it in /home/johnq/.virtualenvs/angr/lib/python3.8/site-packages/z3
Pip version z3-solver 4.8.10.0
Couldn't find git info
######## unicorn #########
Python found it in /home/johnq/.virtualenvs/angr/lib/python3.8/site-packages/unicorn
Pip version unicorn 1.0.2rc4
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/home/johnq/angr_proj/angr-dev/angr/angr/lib/angr_native.so', handle 235fb10 at 0x7f8af8d95460>
unicorn: <CDLL '/home/johnq/.virtualenvs/angr/lib/python3.8/site-packages/unicorn/lib/libunicorn.so', handle 1aa84e0 at 0x7f8afea5b6d0>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f8aff679f40>
z3: <CDLL '/home/johnq/.virtualenvs/angr/lib/python3.8/site-packages/z3/lib/libz3.so', handle 1d07490 at 0x7f8afc1a0550>
To Reproduce.
I’ve been using this code: https://github.com/angr/angr/issues/2603#issuecomment-818564282
Binaries can be found here: https://drive.google.com/file/d/1Hkn4R5Liis8f8Bc76BVDCzHhUpR0CO2R/view?usp=sharing
Password is infected
Binary in which bug occurs is: 3386f7760ab40af90aa65d656a6dfe5eee33041c36235b3e6db0a9d0990c60f2
Binary in which bug doesn’t occure is: 0df9dc6ce70a9ad93be51c2c1acfada9821481ba4a8826db97b9368f3f207e44
Additional context.
readelf
reveals that ABI/OS for the first binary is ARM, and for second UNIX
Issue Analytics
- State:
- Created 2 years ago
- Comments:11 (10 by maintainers)
Top GitHub Comments
@degrigis can you please make a PR with that branch on angr and vex? if tests pass, we’ll merge it.
This issue has been marked as
stale
because it has no recent activity. Please comment or add thepinned
tag to prevent this issue from being closed.