search

hase-project / hase

Timeless debugging with symbolic execution and processor trace
BSD 2-Clause "Simplified" License
74 stars 8 forks source link

Make ip concrete #65

Closed Mic92 closed 5 years ago

Mic92 commented 5 years ago

Multiple successors are ignored at the moment. They are not so common and this is an optimization after all. From my understanding block guards should be still triggered by writing to ip= https://github.com/hase-project/angr/blob/angr-hacks-8.18.10.25/angr/sim_state.py#L202 and new constraint that access ip should receive the concrete value. Am I am missing something else here?

Airtnp commented 5 years ago

Every branch will have multiple successors with guard (control flow constraints) carried with the successor (https://github.com/angr/angr/blob/ac28923eea519c681598158d976f7901ceb2b37d/angr/engines/successors.py#L150). So ignore multiple successors will give wrong constraints set.

Directly assign to ip will not trigger add constraints (https://github.com/angr/angr/blob/ac28923eea519c681598158d976f7901ceb2b37d/angr/engines/successors.py#L322)

Mic92 commented 5 years ago

By ignoring I mean that it only sets the ip if there is a single successor: https://github.com/hase-project/hase/pull/65/files#diff-300213ee387938c49ef527bffedb3ce8R435

Mic92 commented 5 years ago

Should be fixed in https://github.com/hase-project/hase/pull/68/files However I still look for a test case to include in the test suite. It also should no longer have multiple successor since the state.ip is also concrete.