CFB crashes when loading a binary in angr-management
- Lingua principale
- Python
- Stelle
- 9.1k
- Fork
- 1.2k
- Merge medio
- 16h 20m
- PR unite (30g)
- 169
Descrizione
### Description
When building CFG for a Cortex-M firmware in angr-management, CFG recovery completes successfuily , but the subsequent `CFB` construction crashes. The crash happens during function spilling/LMDB serialization, where a `BlockNode` with `bytestr is None` is serialized.
## Trace
```
ERROR | 2026-03-31 18:58:48,080 | angrmanagement.logic.jobmanager | Exception while running job "CFG generation":
Traceback (most recent call last):
File "/home/cosmos/workspace/open_src/angr-dev/angr-management/angrmanagement/logic/jobmanager.py", line 82, in execute_job
job.start(ctx)
File "/home/cosmos/workspace/open_src/angr-dev/angr-management/angrmanagement/data/jobs/job.py", line 89, in start
self.result = self.run(ctx)
File "/home/cosmos/workspace/open_src/angr-dev/angr-management/angrmanagement/data/jobs/cfg_generation.py", line 195, in run
cfb = self.instance.project.analyses.CFB(kb=cfg.kb, exclude_region_types=exclude_region_types)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/analyses/analysis.py", line 266, in __call__
r = w(*args, **kwargs)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/analyses/analysis.py", line 251, in wrapper
oself.__init__(*args, **kwargs)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/analyses/cfg/cfb.py", line 115, in __init__
for func in self.kb.functions.values():
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 1118, in values
yield self._function_map.get(addr, meta_only=meta_only)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 390, in get
func = self._load_from_lmdb(addr, meta_only=meta_only)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 597, in _load_from_lmdb
return self._load_from_lmdb_core(addr, meta_only=meta_only)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 631, in _load_from_lmdb_core
self._on_function_stored(addr)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 479, in _on_function_stored
self._evict_lru()
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 490, in _evict_lru
if self._evict_n(min(self._db_batch_size, self.cached_count)) == 0:
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 534, in _evict_n
self._save_to_lmdb(funcs_to_evict)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 569, in _save_to_lmdb
cmsg = func.serialize_to_cmessage()
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function.py", line 607, in serialize_to_cmessage
return FunctionParser.serialize(self)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_parser.py", line 120, in serialize
block.bytes = b.bytestr
TypeError: expected bytes, NoneType found
```
### Steps to reproduce the bug
Binary: [ARM_binary.tar.gz](https://github.com/user-attachments/files/26393921/ARM_binary.tar.gz)
Load the binary in angr-management and see the traceback error in the terminal.
Could only reproduce the issue with some binaries while others loaded fine, I'm not sure why, will look into this.
### Environment
- angr: 9.2.207
- angr-management: 9.2.207
- Python: 3.10.17
- OS: Arch Linux
### Additional context
_No response_
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.