Closed lain3d closed 11 months ago
Can you try to remove the call to st.concrete.sync()
right before the st.memory.store(symbolic_buffer_address, flag)
?
If you set use_sim_procedures
to False
you are basically going to execute the code of all the functions in the linked libraries inside angr
, this can easily lead to errors and state explosions if not handled carefully.
I manually pathed it at angr/engines/vex/lifter.py
:
# phase 4: get bytes
if buff is NO_OVERRIDE:
if insn_bytes is not None:
buff, size = insn_bytes, len(insn_bytes)
# offset stays unchanged
else:
_suppose_size = size
buff, size, offset = self._load_bytes(addr, size, state, clemory)
if size == 0 and state is not None:
buff = state.project.concrete_target.read_memory(addr, _suppose_size)
size = len(buff)
Hope it works for you.
Hi,
I was using the example at https://github.com/angr/angr-doc/tree/master/examples/csaw_wyvern and wanted to try symbion out on it.
Here's the entire script
I get
Note: I tried using use_sim_procedures=False and True. There were some libraries that it complained about like libgcc_s so I switched it to off to see what would happen.