unicorn callable arg types

Describe the bug. When passing different types of args to a callable, the call can fail with “Got STOP_NOSTART but a positive number of steps. This indicates a serious unicorn bug.” The calls work fine without adding unicorn to the base state.

Environment Information. Platform: linux-x86_64 Python version: 3.8.10 (default, Mar 15 2022, 12:22:08) Pip version angr 9.1.12332 Pip version ailment 9.1.12332 Pip version cle 9.1.12332 Pip version pyvex 9.1.12332 Pip version claripy 9.1.12332 Pip version archinfo 9.1.12332 Pip version z3-solver 4.8.10.0 Pip version unicorn 1.0.3

To Reproduce. https://github.com/cromulencellc/hackasat-qualifier-2020/blob/master/rfmagic/public/firmware.bin

p = angr.Project('firmware.bin', main_opts={'backend':'blob','arch':'mipsel','base_addr':0xbfc00000,'entry_point':0xbfc00400})

state = p.factory.blank_state(add_options=angr.sim_options.unicorn)

init = b'\x01'*0x80
msg = b'hello'

state.memory.store(0x1000, init)
state.memory.store(0x2000, msg)

func = p.factory.callable(0xbfc00a30, base_state=state)


print( func(0x1000, 0x2000,    5) ) # works
print( func(init,   0x2000,    5) ) # works
print( func(init,   msg,       5) ) # works
print( func(0x1000, msg,       5) ) # doesn't

[f4c31e55]

I was previously using 1.0.2rc4. I updated to check if it would fix this issue.

Apologies, yes. That exception throws before result_path_group is populated in the callable. The actual errored state is in caller in callable.py:80. You can move the self.result_path_group = caller.copy() above the raise in order to access the state.

[github-actions[bot]]

This issue has been marked as stale because it has no recent activity. Please comment or add the pinned tag to prevent this issue from being closed.