TracerDesyncError: Address mismatch during single-stepping

I’ve been trying to use tracer on CROMU_00030 (a CGC sample) to dynamically execute the trace generated by the provided pov input. The sample can be found here https://github.com/CyberGrandChallenge/samples/tree/master/cqe-challenges/CROMU_00030

This is the code I’m using:

import tracer

from angr.exploration_techniques.tracer import TracingMode

target = "/root/cgc/CROMU_00030/bin/CROMU_00030"

accepted_inp = "/root/cgc/CROMU_00030/pov/POV_00000.xml"

t = tracer.Tracer(binary=target, pov_file=accepted_inp, mode=TracingMode.Permissive, copy_states=True)

t.simgr.run()

Without mode=TracingMode.Permissive it throws the following error: angr.exploration_techniques.tracer.TracerDesyncError: Oops! angr did not follow the trace

While by adding this mode, the error changes to: angr.exploration_techniques.tracer.TracerDesyncError: Address mismatch during single-stepping.

To make tracer.py correctly parse an xml pov file I added the following line to https://github.com/angr/tracer/blob/master/tracer/tracer.py#L80 -> s.preconstrainer.preconstrain_file(input.writes, s.posix.stdin, True) making it preconstrain input.writes in case the input is a pov_file, input otherwise.

I’m using the updated version of angr-dev.

Do you know how to solve this issue?

I’ve attached CROMU30.zip which contains the binary, the script and POV_00000.xml.

Thank you in advance!

[rhelmot]

okay! I actually see the problem. the thing is that the binary actually runs through the point where it crashes several times before actually crashing, and the tracer is being too cautious about stopping early as to not run through the crash. 2b441b766 fixes this.

[Brucedh]

Great, thank you very much rhelmot!