angr / angr/angr

tracer: resync logic needed for conditional instructions

Aberta
#2,527 13 comentários 0 reações 1 responsável Reivindicada por @ltfish Ver no GitHub
bug help wanted
Linguagem predominante
Python
Estrelas
9.1k
Forks
1.2k
Merge médio
16h 20min
PRs com merge (30d)
169

Descrição

This may be I don't understand ARM.

In the following snippet, the block should end at 0x3DB38
~~~
text:0003DB14 CMN R2, #0x10
.text:0003DB18 LDMGE R1!, {R3,R4,R12,LR}
.text:0003DB1C STMGE R0!, {R3,R4,R12,LR}
.text:0003DB20 SUBGE R2, R2, #0x10
.text:0003DB24 POP {R4}
.text:0003DB28
.text:0003DB28 loc_3DB28 ; CODE XREF: memcpy_0+34↑j
.text:0003DB28 ADDS R2, R2, #0x14
.text:0003DB2C
.text:0003DB2C loc_3DB2C ; CODE XREF: memcpy_0+78↓j
.text:0003DB2C LDMGE R1!, {R3,R12,LR}
.text:0003DB30 STMGE R0!, {R3,R12,LR}
.text:0003DB34 SUBSGE R2, R2, #0xC
.text:0003DB38 BGE loc_3DB2C
~~~

angr generates the correct basic block. However, when trying to execute the snippet, somehow angr can stop execution prematurely at 0x0003DB1C which confuses me.

Everything to replicate the issue is attached as follow

https://gist.github.com/Kyle-Kyle/92371cad52f772a38e9a0eed9cf0551b

Guia de contribuição

Nenhum guia de contribuição indexado para este repositório

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.