search

angr / archr

Target-centric program analysis.
BSD 2-Clause "Simplified" License
72 stars 20 forks source link

coredump load failed in shellphish-qemu-linux-arm with a KeyError #156

Closed xrivendell7 closed 1 year ago

xrivendell7 commented 1 year ago

Description

I use rex to exploit a simple arm bug with dumbtracer I add the following code in test_rex.py

def test_linux_armel_stacksmash_jump_dumb():
    path = bin_location
    bin_path = os.path.join(path, "vuln_stacksmash_withjump")
    ld_path = os.path.join(path, "ld-linux.so.3")
    libc_path = os.path.join(path,"libc.so.6")
    env = 'LD_PRELOAD='+ld_path
    lib_path = path
    inp = b"A" * 0x100

    input("Let's go to run "+str(bin_path))
    from rex.crash_tracer import TraceMode
    with archr.targets.LocalTarget([ld_path, '--library-path', lib_path, bin_path], bin_path, target_arch='arm').build().start() as target:
        print("Success")
        trace_mode = TraceMode.DUMB
        crash = rex.Crash(target, inp, trace_mode=trace_mode)

with load the coredump it failed

(rex-lastest) lxw@ubuntu2004:~/rex/tests$ python test_rex.py linux_armel_stacksmash_jump_dumb
Let's go to run /home/lxw/rex/tests/../../binaries/vuln_stacksmash_withjump
DEBUG    | 2023-08-20 20:08:33,767 | archr.targets  | target OS not specified, using `linux` by default
Success
DEBUG    | 2023-08-20 20:08:34,571 | archr.targets  | Running command: 'mkdir' '/tmp/tracer_target_l9qsjyud'
DEBUG    | 2023-08-20 20:08:34,576 | archr.targets  | Running command: 'chmod' '777' '/tmp/tracer_target_l9qsjyud'
DEBUG    | 2023-08-20 20:08:34,579 | archr.analyzers.qemu_tracer | launch QEMU with command: /tmp/archr_local_2e6snvhd/shellphish_qemu/fire /tmp/archr_local_2e6snvhd/shellphish_qemu/shellphish-qemu-linux-arm -C /tmp/tracer_target_l9qsjyud -d nochain,exec,page,strace -D /tmp/tracer-daqgestg.trace -- /home/lxw/rex/tests/../../binaries/ld-linux.so.3 --library-path /home/lxw/rex/tests/../../binaries /home/lxw/rex/tests/../../binaries/vuln_stacksmash_withjump
DEBUG    | 2023-08-20 20:08:34,579 | archr.targets  | Running command: '/tmp/archr_local_2e6snvhd/shellphish_qemu/fire' '/tmp/archr_local_2e6snvhd/shellphish_qemu/shellphish-qemu-linux-arm' '-C' '/tmp/tracer_target_l9qsjyud' '-d' 'nochain,exec,page,strace' '-D' '/tmp/tracer-daqgestg.trace' '--' '/home/lxw/rex/tests/../../binaries/ld-linux.so.3' '--library-path' '/home/lxw/rex/tests/../../binaries' '/home/lxw/rex/tests/../../binaries/vuln_stacksmash_withjump'
INFO     | 2023-08-20 20:08:34,581 | archr.analyzers | sleep for 15 seconds waiting for the target to initialize
DEBUG    | 2023-08-20 20:08:49,582 | archr.target.actions | [OpenChannelAction] openning channel: stdio
DEBUG    | 2023-08-20 20:08:49,583 | archr.target.actions | [SendAction] sending data to channel stdio: b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
INFO     | 2023-08-20 20:08:49,583 | archr.log      | ======= Sending 256 bytes =======

INFO     | 2023-08-20 20:08:49,583 | archr.log      | >> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%

DEBUG    | 2023-08-20 20:08:49,698 | archr.analyzers.qemu_tracer | Qemu tracer returned with code=-11 timed_out=False crashed=True signal=Signals.SIGSEGV
DEBUG    | 2023-08-20 20:08:49,740 | archr.analyzers.qemu_tracer | Detected the tainted fd to be 0
DEBUG    | 2023-08-20 20:08:49,741 | archr.analyzers.qemu_tracer | Detected the crashing address at 0x41414140
DEBUG    | 2023-08-20 20:08:49,741 | archr.analyzers.qemu_tracer | Trace consists of 19046 basic blocks
DEBUG    | 2023-08-20 20:08:49,741 | archr.targets  | Running command: 'rm' '/tmp/tracer-daqgestg.trace'
DEBUG    | 2023-08-20 20:08:49,745 | archr.targets  | Running command: 'rm' '-rf' '/tmp/tracer_target_l9qsjyud'
Traceback (most recent call last):
  File "test_rex.py", line 487, in <module>
    globals()['test_' + sys.argv[1]]()
  File "test_rex.py", line 463, in test_linux_armel_stacksmash_jump_dumb
    crash = rex.Crash(target, inp, trace_mode=trace_mode)
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/rex-0.2-py3.8.egg/rex/crash.py", line 618, in __init__
    self._initialize()
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/rex-0.2-py3.8.egg/rex/crash.py", line 1001, in _initialize
    self.concrete_trace()
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/rex-0.2-py3.8.egg/rex/crash.py", line 405, in concrete_trace
    self.trace_result, self.core_registers = self.tracer.concrete_trace(testcase, channel,
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/rex-0.2-py3.8.egg/rex/crash_tracer/dumb_tracer.py", line 189, in concrete_trace
    self.crash_addr, times = self._identify_crash_addr(testcase, channel, pre_fire_hook,
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/rex-0.2-py3.8.egg/rex/crash_tracer/dumb_tracer.py", line 171, in _identify_crash_addr
    project = self.angr_project_bow.fire(core_path=r.core_path)
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/archr/analyzers/angr_project.py", line 141, in fire
    self.project = angr.Project(core_path, main_opts=bin_opts, rebase_granularity=0x1000, **project_kwargs)
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/angr/project.py", line 147, in __init__
    self.loader = cle.Loader(self.filename, concrete_target=concrete_target, **load_options)
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/cle/loader.py", line 188, in __init__
    self.initial_load_objects = self._internal_load(
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/cle/loader.py", line 782, in _internal_load
    obj = self._load_object_isolated(main_spec)
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/cle/loader.py", line 986, in _load_object_isolated
    result = backend_cls(binary, binary_stream, is_main_bin=self._main_object is None, loader=self, **options)
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/cle/backends/elf/elfcore.py", line 66, in __init__
    self.__extract_note_info()
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/cle/backends/elf/elfcore.py", line 112, in __extract_note_info
    self.__parse_auxv(n_desc)
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/cle/backends/elf/elfcore.py", line 400, in __parse_auxv
    byte = self.__dummy_clemory[pos]
  File "/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/cle/memory.py", line 287, in __getitem__
    raise KeyError(k)
KeyError: 15

Steps to reproduce the bug

I upload all my environment and coredump file to google cloud https://drive.google.com/drive/folders/15ms9I8QG-Pc477LfJWO7kRIBgx1TY2cl?usp=share_link

Environment

python -m angr.misc.bug_report
/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/angr/misc/bug_report.py:1: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
  import imp
angr environment report
=============================
Date: 2023-08-20 21:27:08.696405
Running in virtual environment at /home/lxw/.virtualenvs/rex-lastest
/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/angr/misc/bug_report.py:88: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  import pkg_resources  # pylint:disable=import-outside-toplevel
Platform: linux-x86_64
Python version: 3.8.10 (default, May 26 2023, 14:05:08)
[GCC 9.4.0]
######## angr #########
Python found it in /home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/angr
Pip version angr 9.2.64
Couldn't find git info
######## ailment #########
Python found it in /home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/ailment
Pip version ailment 9.2.64
Couldn't find git info
######## cle #########
Python found it in /home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/cle
Pip version cle 9.2.64
Couldn't find git info
######## pyvex #########
Python found it in /home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/pyvex
Pip version pyvex 9.2.64
Couldn't find git info
######## claripy #########
Python found it in /home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/claripy
Pip version claripy 9.2.64
Couldn't find git info
######## archinfo #########
Python found it in /home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/archinfo
Pip version archinfo 9.2.64
Couldn't find git info
######## z3 #########
Python found it in /home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/z3
Pip version z3-solver 4.10.2.0
Couldn't find git info
######## unicorn #########
Python found it in /home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/unicorn
Pip version unicorn 2.0.1.post1
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/angr/state_plugins/../lib/angr_native.so', handle 3175af0 at 0x7f3205e2fc10>
unicorn: <CDLL '/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/unicorn/lib/libunicorn.so.2', handle 2bf8710 at 0x7f3208ed3940>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f3209ae3820>
z3: <CDLL '/home/lxw/.virtualenvs/rex-lastest/lib/python3.8/site-packages/z3/lib/libz3.so', handle 28b8bf0 at 0x7f320b9a7e20>

all the environment rex is the lasted and I installed with git folder

Additional context

No response

Kyle-Kyle commented 1 year ago

I just tried it. It seems to be a bug in QEMU itself. It seems that if you run the program by "(loader) (the actual program)", QEMU will dump the wrong AUXV (confirmed in gdb). I tested it with qemu 6.2.0 (the one on Ubuntu 22.04), it is still the same.

For my own notes: to replicate the issue, you only need to invoke qemu-arm-static -- ./ld-linux.so.3 --library-path . ./vuln_stacksmash_withjump and crash the program with 'A'*0x100. Then trying to load the generated coredump in angr like angr.Project("core_path")will fail.

Kyle-Kyle commented 1 year ago

to bypass the issue, I'd suggest you to do patchelf --set-interpreter ./ld-linux.so.3 --set-rpath . ./vuln_stacksmash_withjump and then run ./vuln_stacksmash_withjump directly

xrivendell7 commented 1 year ago

Yeh, I'm sure this can bypass the bug, and now I can run the patched arm binary successfully.

(angr) vmware@ubuntu2004:~/angr-dev/rex/tests$ python test_rex.py
Let's go to run /home/vmware/angr-dev/rex/tests/../my_binaries/vuln_stacksmash_withjump_fix
DEBUG    | 2023-08-22 00:48:08,002 | archr.targets  | target OS not specified, using `linux` by default
Success
DEBUG    | 2023-08-22 00:48:08,435 | archr.analyzers.qemu_tracer | launch QEMU with command: /tmp/archr_local_h18ymkuk/shellphish_qemu/fire /tmp/archr_local_h18ymkuk/shellphish_qemu/shellphish-qemu-linux-arm -C /tmp/tracer_target_ex59r_kq -d nochain,exec,page,strace -D /tmp/tracer-5vazzn2x.trace -- /home/vmware/angr-dev/rex/tests/../my_binaries/vuln_stacksmash_withjump_fix
INFO     | 2023-08-22 00:48:08,438 | archr.analyzers | sleep for 10 seconds waiting for the target to initialize
DEBUG    | 2023-08-22 00:48:18,449 | archr.target.actions | [OpenChannelAction] openning channel: stdio
DEBUG    | 2023-08-22 00:48:18,451 | archr.target.actions | [SendAction] sending data to channel stdio: b'aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaac'
INFO     | 2023-08-22 00:48:18,451 | archr.log      | ======= Sending 256 bytes =======

INFO     | 2023-08-22 00:48:18,452 | archr.log      | >> aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaac%

DEBUG    | 2023-08-22 00:48:18,568 | archr.analyzers.qemu_tracer | Qemu tracer returned with code=-11 timed_out=False crashed=True signal=Signals.SIGSEGV
DEBUG    | 2023-08-22 00:48:18,607 | archr.analyzers.qemu_tracer | Detected the tainted fd to be 0
DEBUG    | 2023-08-22 00:48:18,607 | archr.analyzers.qemu_tracer | Detected the crashing address at 0x6161616a
DEBUG    | 2023-08-22 00:48:18,607 | archr.analyzers.qemu_tracer | Trace consists of 18225 basic blocks
WARNING  | 2023-08-22 00:48:19,397 | cle.backends.tls.elfcore_tls | TLS for coredumps won't be right for this arch - idk how to do it
INFO     | 2023-08-22 00:48:19,402 | rex.crash_tracer.dumb_tracer | DumbTracer identified the crash_addr @ 0x103fc:1
DEBUG    | 2023-08-22 00:48:19,412 | archr.analyzers.qemu_tracer | launch QEMU with command: /tmp/archr_local_h18ymkuk/shellphish_qemu/fire /tmp/archr_local_h18ymkuk/shellphish_qemu/shellphish-qemu-linux-arm -C /tmp/tracer_target_3e6f2fym -A 0x103fc:1 -T 0x103fc:1 -d nochain,exec,page,strace -D /tmp/tracer-g58_c66k.trace -- /home/vmware/angr-dev/rex/tests/../my_binaries/vuln_stacksmash_withjump_fix
DEBUG    | 2023-08-22 00:48:19,415 | archr.target.actions | [OpenChannelAction] openning channel: stdio
DEBUG    | 2023-08-22 00:48:19,416 | archr.target.actions | [SendAction] sending data to channel stdio: b'aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaac'
INFO     | 2023-08-22 00:48:19,416 | archr.log      | ======= Sending 256 bytes =======

INFO     | 2023-08-22 00:48:19,416 | archr.log      | >> aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaac%

DEBUG    | 2023-08-22 00:48:19,532 | archr.analyzers.qemu_tracer | Qemu tracer returned with code=-11 timed_out=False crashed=True signal=Signals.SIGSEGV
DEBUG    | 2023-08-22 00:48:19,568 | archr.analyzers.qemu_tracer | Detected the tainted fd to be 0
DEBUG    | 2023-08-22 00:48:19,569 | archr.analyzers.qemu_tracer | Detected the crashing address at 0x6161616a
DEBUG    | 2023-08-22 00:48:19,569 | archr.analyzers.qemu_tracer | Trace consists of 1 basic blocks
DEBUG    | 2023-08-22 00:48:19,575 | rex.crash_tracer.dumb_tracer | Loading the core dump @ /tmp/tracer-g58_c66k.halfway_0x103fc_1.core into angr...
WARNING  | 2023-08-22 00:48:20,345 | cle.backends.tls.elfcore_tls | TLS for coredumps won't be right for this arch - idk how to do it
WARNING  | 2023-08-22 00:48:20,693 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV32 Reverse(taint_word_257_32)>
DEBUG    | 2023-08-22 00:48:20,694 | rex.crash_tracer.dumb_tracer | identify saved ip addr @ 0x407fffa4
DEBUG    | 2023-08-22 00:48:20,695 | rex.crash_tracer.dumb_tracer | Input is at 0x407fff80 in memory. We control at most 256 bytes. The controllable chunk starts at offset 0 in the given test case.
INFO     | 2023-08-22 00:48:20,695 | rex.Crash      | Preconstraining file stream <rex.preconstrained_file_stream.SimPreconstrainedFileStream object at 0x7fb8d090f7f0> upon the first read().
DEBUG    | 2023-08-22 00:48:20,696 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_0_0_8 == 97>
DEBUG    | 2023-08-22 00:48:20,710 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_1_1_8 == 97>
DEBUG    | 2023-08-22 00:48:20,710 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_2_2_8 == 97>
DEBUG    | 2023-08-22 00:48:20,711 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_3_3_8 == 97>
DEBUG    | 2023-08-22 00:48:20,711 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_4_4_8 == 98>
DEBUG    | 2023-08-22 00:48:20,712 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_5_5_8 == 97>
DEBUG    | 2023-08-22 00:48:20,712 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_6_6_8 == 97>
DEBUG    | 2023-08-22 00:48:20,713 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_7_7_8 == 97>
DEBUG    | 2023-08-22 00:48:20,714 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_8_8_8 == 99>
DEBUG    | 2023-08-22 00:48:20,714 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_9_9_8 == 97>
DEBUG    | 2023-08-22 00:48:20,715 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_a_10_8 == 97>
DEBUG    | 2023-08-22 00:48:20,715 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_b_11_8 == 97>
DEBUG    | 2023-08-22 00:48:20,716 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_c_12_8 == 100>
DEBUG    | 2023-08-22 00:48:20,716 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_d_13_8 == 97>
DEBUG    | 2023-08-22 00:48:20,717 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_e_14_8 == 97>
DEBUG    | 2023-08-22 00:48:20,717 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_f_15_8 == 97>
DEBUG    | 2023-08-22 00:48:20,718 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_10_16_8 == 101>
DEBUG    | 2023-08-22 00:48:20,719 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_11_17_8 == 97>
DEBUG    | 2023-08-22 00:48:20,719 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_12_18_8 == 97>
DEBUG    | 2023-08-22 00:48:20,720 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_13_19_8 == 97>
DEBUG    | 2023-08-22 00:48:20,720 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_14_20_8 == 102>
DEBUG    | 2023-08-22 00:48:20,721 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_15_21_8 == 97>
DEBUG    | 2023-08-22 00:48:20,721 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_16_22_8 == 97>
DEBUG    | 2023-08-22 00:48:20,722 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_17_23_8 == 97>
DEBUG    | 2023-08-22 00:48:20,723 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_18_24_8 == 103>
DEBUG    | 2023-08-22 00:48:20,723 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_19_25_8 == 97>
DEBUG    | 2023-08-22 00:48:20,724 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_1a_26_8 == 97>
DEBUG    | 2023-08-22 00:48:20,724 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_1b_27_8 == 97>
DEBUG    | 2023-08-22 00:48:20,725 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_1c_28_8 == 104>
DEBUG    | 2023-08-22 00:48:20,725 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_1d_29_8 == 97>
DEBUG    | 2023-08-22 00:48:20,726 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_1e_30_8 == 97>
DEBUG    | 2023-08-22 00:48:20,727 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_1f_31_8 == 97>
DEBUG    | 2023-08-22 00:48:20,727 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_20_32_8 == 105>
DEBUG    | 2023-08-22 00:48:20,728 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_21_33_8 == 97>
DEBUG    | 2023-08-22 00:48:20,728 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_22_34_8 == 97>
DEBUG    | 2023-08-22 00:48:20,729 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_23_35_8 == 97>
DEBUG    | 2023-08-22 00:48:20,729 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_24_36_8 == 106>
DEBUG    | 2023-08-22 00:48:20,730 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_25_37_8 == 97>
DEBUG    | 2023-08-22 00:48:20,731 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_26_38_8 == 97>
DEBUG    | 2023-08-22 00:48:20,731 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_27_39_8 == 97>
DEBUG    | 2023-08-22 00:48:20,732 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_28_40_8 == 107>
DEBUG    | 2023-08-22 00:48:20,732 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_29_41_8 == 97>
DEBUG    | 2023-08-22 00:48:20,733 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_2a_42_8 == 97>
DEBUG    | 2023-08-22 00:48:20,734 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_2b_43_8 == 97>
DEBUG    | 2023-08-22 00:48:20,735 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_2c_44_8 == 108>
DEBUG    | 2023-08-22 00:48:20,735 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_2d_45_8 == 97>
DEBUG    | 2023-08-22 00:48:20,736 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_2e_46_8 == 97>
DEBUG    | 2023-08-22 00:48:20,736 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_2f_47_8 == 97>
DEBUG    | 2023-08-22 00:48:20,737 | angr.state_plugins.preconstrainer | Preconstraint: <Bool aeg_input_default_30_48_8 == 109>
Kyle-Kyle commented 1 year ago

I'll close the issue for now. Let me know if you encounter further issues.