View constraints which led a state to be unsat

I was trying to find opaque predicates. This is a basic-block which is an opaque predicate:

>>> block.pp()
0x491bc9:       mov     dword ptr [esi + 0x3c], ebx
0x491bcc:       mov     edi, dword ptr [0x590d7c]
0x491bd2:       mov     ebx, dword ptr [0x590d78]
0x491bd8:       mov     eax, edi
0x491bda:       imul    eax, eax
0x491bdd:       imul    eax, eax, 7
0x491be0:       dec     eax
0x491be1:       imul    ebx, ebx
0x491be4:       cmp     eax, ebx
0x491be6:       je      0x491bf5

The cmp eax, ebx instruction just before the conditional jump will always be false since the condition is unsat.

The constraints are: eax * eax * 7 - 1 == ebx * ebx

I am trying to get the constraints using the following snippet:

import angr
import claripy

proj = angr.Project('samples/ac3e087e43be67bdc674747c665b46c2')
block = proj.factory.block(0x00491bc9)

state = proj.factory.blank_state(addr=0x00491bc9)
# state.regs.eax = claripy.BVS('eax', 32)
# state.regs.ebx = claripy.BVS('ebx', 32)

# using save_unsat to store unsat states in unsat stash
# instead of discarding them
simgr = proj.factory.simulation_manager(state, save_unsat=True)

simgr.step()

print(simgr.stashes)

x = simgr.stashes['active'][0]
y = simgr.stashes['unsat'][0]

print(x.solver.constraints)
print(y.solver.constraints)

The problem is, I’m getting the same constraints for both the state in the active stash as well as the one in the unsat stash…

defaultdict(<class 'list'>, {'active': [<SimState @ 0x491be8>], 'stashed': [], 'pruned': [], 'unsat': [<SimState @ 0x491bf5>], 'errored': [], 'deadended': [], 'unconstrained': []})
[<Bool reg_esi_0_32{UNINITIALIZED} + 0x3c <= 0xffffffff>, <Bool reg_esi_0_32{UNINITIALIZED} + 0x3c == 0xffffffff>]
[<Bool reg_esi_0_32{UNINITIALIZED} + 0x3c <= 0xffffffff>, <Bool reg_esi_0_32{UNINITIALIZED} + 0x3c == 0xffffffff>]

My question is, how can I get the constraints which caused the y state to go into the unsat stash?

[rhelmot]

Should be fixed by angr/claripy#220 😄

[r4dr3fr4d]

Thought I’d check in on this. Every now and then I have a want to see what’s specifically unsatisfiable and every time unsat_core() returns an empty list for me as well.