strstr passes None to solver.

Question

strstr passes None to solver.

Mic92 opened this issue 6 years ago · 9 comments

Traceback (most recent call last):
  File "/local/incoop/hase/hase/symbex/tracer.py", line 371, in execute
    state, num_inst=1  # , force_addr=addr
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/factory.py", line 49, in successors
    return self.project.engines.successors(*args, **kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/hub.py", line 128, in successors
    r = engine.process(state, **kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/hook.py", line 51, in process
    return self.project.factory.procedure_engine.process(state, procedure, force_addr=force_addr, **kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/procedure.py", line 31, in process
    force_addr=force_addr)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/engine.py", line 55, in process
    self._process(new_state, successors, *args, **kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/procedure.py", line 65, in _process
    inst = procedure.execute(state, successors, ret_to=ret_to)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/sim_procedure.py", line 174, in execute
    r = getattr(inst, inst.run_func)(*sim_args, **inst.kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/procedures/libc/strstr.py", line 78, in run
    super().run(haystack_strlen, needle_addr, haystack_strlen, needle_strlen)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/procedures/libc/strstr.py", line 19, in run
    haystack_strlen = self.inline_call(strlen, haystack_addr) if haystack_strlen is None else haystack_strlen
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/sim_procedure.py", line 289, in inline_call
    return p.execute(self.state, None, arguments=e_args)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/sim_procedure.py", line 174, in execute
    r = getattr(inst, inst.run_func)(*sim_args, **inst.kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/procedures/libc/strlen.py", line 81, in run
    return super().run(s, wchar)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/procedures/libc/strlen.py", line 56, in run
    r, c, i = self.state.memory.find(s, null_seq, search_len, max_symbolic_bytes=max_symbolic_bytes, step=step, chunk_size=chunk_size)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/storage/memory.py", line 869, in find
    step=step, disable_actions=disable_actions, inspect=inspect, chunk_size=chunk_size)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/state_plugins/symbolic_memory.py", line 592, in _find
    disable_actions=disable_actions, inspect=inspect)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/storage/memory.py", line 764, in load
    events=not disable_actions, ret_on_segv=ret_on_segv)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/state_plugins/symbolic_memory.py", line 531, in _load
    if self.state.solver.symbolic(dst) and options.AVOID_MULTIVALUED_READS in self.state.options:
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/state_plugins/solver.py", line 814, in symbolic
    return e.symbolic
AttributeError: 'NoneType' object has no attribute 'symbolic'

Answer 1 · 2018-11-28T14:58:52.000Z

ERROR   | 2018-11-28 15:58:12,811 | root | Error while finding successor for recordings/file-3-4a51454.tar.gz
Traceback (most recent call last):
  File "/local/incoop/hase/hase/symbex/tracer.py", line 378, in execute
    state, num_inst=1  # , force_addr=addr
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/factory.py", line 49, in successors
    return self.project.engines.successors(*args, **kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/hub.py", line 128, in successors
    r = engine.process(state, **kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/hook.py", line 51, in process
    return self.project.factory.procedure_engine.process(state, procedure, force_addr=force_addr, **kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/procedure.py", line 31, in process
    force_addr=force_addr)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/engine.py", line 55, in process
    self._process(new_state, successors, *args, **kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/engines/procedure.py", line 65, in _process
    inst = procedure.execute(state, successors, ret_to=ret_to)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/sim_procedure.py", line 174, in execute
    r = getattr(inst, inst.run_func)(*sim_args, **inst.kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/procedures/libc/strstr.py", line 78, in run
    super().run(haystack_strlen, needle_addr, haystack_strlen, needle_strlen)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/procedures/libc/strstr.py", line 19, in run
    haystack_strlen = self.inline_call(strlen, haystack_addr) if haystack_strlen is None else haystack_strlen
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/sim_procedure.py", line 289, in inline_call
    return p.execute(self.state, None, arguments=e_args)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/sim_procedure.py", line 174, in execute
    r = getattr(inst, inst.run_func)(*sim_args, **inst.kwargs)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/procedures/libc/strlen.py", line 81, in run
    return super().run(s, wchar)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/procedures/libc/strlen.py", line 56, in run
    r, c, i = self.state.memory.find(s, null_seq, search_len, max_symbolic_bytes=max_symbolic_bytes, step=step, chunk_size=chunk_size)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/storage/memory.py", line 869, in find
    step=step, disable_actions=disable_actions, inspect=inspect, chunk_size=chunk_size)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/state_plugins/symbolic_memory.py", line 592, in _find
    disable_actions=disable_actions, inspect=inspect)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/storage/memory.py", line 764, in load
    events=not disable_actions, ret_on_segv=ret_on_segv)
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/state_plugins/symbolic_memory.py", line 531, in _load
    if self.state.solver.symbolic(dst) and options.AVOID_MULTIVALUED_READS in self.state.options:
  File "/local/incoop/hase/.direnv/python-3.6.6/lib/python3.6/site-packages/angr/state_plugins/solver.py", line 814, in symbolic
    return e.symbolic
AttributeError: 'NoneType' object has no attribute 'symbolic'

Answer 2 · 2018-11-28T16:36:52.000Z

Is your angr version updated to current hack? That may be the strlen not return error solved in previous angr hack commits

Answer 3 · 2018-11-28T16:37:57.000Z

To be precise, is angr/**/libc/strlen.py has return before super()?

Answer 4 · 2018-11-28T16:46:33.000Z

If you made fixes to angr, can you put the updated hash here?
https://github.com/hase-project/hase/blob/master/setup.py#L14

Answer 5 · 2018-11-28T17:42:31.000Z

Oh it's not the case. What are the problematic traces?

Answer 6 · 2018-11-28T22:42:08.000Z

It should be in file-3-4a51454.tar.gz. But I saw the same error in other file bugs.

Answer 7 · 2018-11-28T23:01:43.000Z

Oh it's misspelling error here. https://github.com/hase-project/angr/blob/angr-hacks-8.18.10.25/angr/procedures/libc/strstr.py#L78

Answer 8 · 2018-11-28T23:16:29.000Z

solved in hase-project/angr#2

Answer 9 · 2018-11-29T17:42:49.000Z

Btw. you can also write fixes #<issuenumber> in the commit message to automatically close issues.