angr / angr/angr

CFB crashes when loading a binary in angr-management

Aperta
#6,305 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub
bug
Lingua principale
Python
Stelle
9.1k
Fork
1.2k
Merge medio
16h 20m
PR unite (30g)
169

Descrizione

### Description

When building CFG for a Cortex-M firmware in angr-management, CFG recovery completes successfuily , but the subsequent `CFB` construction crashes. The crash happens during function spilling/LMDB serialization, where a `BlockNode` with `bytestr is None` is serialized.

## Trace

```
ERROR | 2026-03-31 18:58:48,080 | angrmanagement.logic.jobmanager | Exception while running job "CFG generation":
Traceback (most recent call last):
File "/home/cosmos/workspace/open_src/angr-dev/angr-management/angrmanagement/logic/jobmanager.py", line 82, in execute_job
job.start(ctx)
File "/home/cosmos/workspace/open_src/angr-dev/angr-management/angrmanagement/data/jobs/job.py", line 89, in start
self.result = self.run(ctx)
File "/home/cosmos/workspace/open_src/angr-dev/angr-management/angrmanagement/data/jobs/cfg_generation.py", line 195, in run
cfb = self.instance.project.analyses.CFB(kb=cfg.kb, exclude_region_types=exclude_region_types)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/analyses/analysis.py", line 266, in __call__
r = w(*args, **kwargs)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/analyses/analysis.py", line 251, in wrapper
oself.__init__(*args, **kwargs)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/analyses/cfg/cfb.py", line 115, in __init__
for func in self.kb.functions.values():
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 1118, in values
yield self._function_map.get(addr, meta_only=meta_only)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 390, in get
func = self._load_from_lmdb(addr, meta_only=meta_only)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 597, in _load_from_lmdb
return self._load_from_lmdb_core(addr, meta_only=meta_only)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 631, in _load_from_lmdb_core
self._on_function_stored(addr)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 479, in _on_function_stored
self._evict_lru()
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 490, in _evict_lru
if self._evict_n(min(self._db_batch_size, self.cached_count)) == 0:
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 534, in _evict_n
self._save_to_lmdb(funcs_to_evict)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_manager.py", line 569, in _save_to_lmdb
cmsg = func.serialize_to_cmessage()
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function.py", line 607, in serialize_to_cmessage
return FunctionParser.serialize(self)
File "/home/cosmos/workspace/open_src/angr-dev/angr/angr/knowledge_plugins/functions/function_parser.py", line 120, in serialize
block.bytes = b.bytestr
TypeError: expected bytes, NoneType found
```

### Steps to reproduce the bug

Binary: [ARM_binary.tar.gz](https://github.com/user-attachments/files/26393921/ARM_binary.tar.gz)

Load the binary in angr-management and see the traceback error in the terminal.

Could only reproduce the issue with some binaries while others loaded fine, I'm not sure why, will look into this.

### Environment

- angr: 9.2.207
- angr-management: 9.2.207
- Python: 3.10.17
- OS: Arch Linux

### Additional context

_No response_

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.