Non-terminating _excavate_ite
- Lenguaje dominante
- Python
- Estrellas
- 334
- Forks
- 105
- Merge medio
- 6 h 1 min
- PR fusionados (30 d)
- 3
Descripción
### Description
A SimState.step() was stuck in claripy's _excavate_ite when I symbolically executed an ARM Cortex-M firmware. During the non-terminating _excavate_ite (running for at least an hour), the size of the "ast_queue" remained below 90, and the depth of each "ast" remained below 40. The caller of the _excavate_ite is op_concretize in angr. The "op" therein has depth 95.
### Steps to reproduce the bug
There are four files in the zip file:
1. mini_hang.py: the Python script for reproducing the hang
2. Robot.elf: the firmware's binary image
3. Robot.objdump.disasm: the firmware's disassembly (for manual inspection)
4. mmio_access_state_bbid_0001cae9_pc_080025a8_addr_40005410: the initial SimState
One may reproduce the hang with the following command:
`python3 mini_hang.py Robot.elf mmio_access_state_bbid_0001cae9_pc_080025a8_addr_40005410`
The script may take 10~20 minutes to reach the basic block (0x08000268 in <__adddf3>) causing the hang.
script for reproducing the hang: [claripy_hang.zip](https://github.com/angr/claripy/files/13700903/claripy_hang.zip)
### Environment
angr 9.2.61
claripy 9.2.61
z3-solver 4.10.2.0.
### Additional context
I discussed the related questions on angr's Slack channel with @rhelmot 2~3 days ago. At that time, I was working on another ARM Cortex-M firmware whose symbolic execution was also stuck in claripy's _excavate_ite. The symbolic execution code for that firmware (Thermostat.elf) is a bit too complicated for me to write a simple script that reproduces the hang. So, here I report the hang with the Robot.elf firmware.
In the case of Thermostat.elf, the "op" in op_concretize before calling _excavate_ite has a depth 1, each "ast" in the loop of _excavate_ite has a depth below 30, and most of the ast depths are below 5. The following is the basic block (0xa51e in <__cmpdf2>) causing the hang:
`0000a4e8 <__cmpdf2>:`
`......`
`a51e: cmn.w r0, #0`
`a522: teq r1, r3`
`a526: it pl`
`a528: cmppl r1, r3`
`a52a: it eq`
`a52c: cmpeq r0, r2`
`a52e: ite cs`
`a530: asrcs r0, r3, #31`
`a532: mvncc.w r0, r3, asr #31`
`a536: orr.w r0, r0, #1`
`a53a: bx lr`
`......`
firmware binary: [uEmu_thermostat.zip](https://github.com/angr/claripy/files/13701209/uEmu_thermostat.zip)
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Evaluación
Este issue todavía no se ha evaluado.