examples not working

[zhaotianxing]

Hi~,
here is my cmd history, please help me, thanks!

(angr) angr@dc084db635ac:~/BootStomp$ python taint_analysis/bootloadertaint.py config/config.huawei
Traceback:
xxxxxx
xxxxxx
xxxxxx
ImportError: No module named bintrees

(angr) angr@dc084db635ac:~/BootStomp$ pip install bintrees
Building wheels for collected packages: bintrees
Running setup.py bdist_wheel for bintrees ... done
Stored in directory: /home/angr/.cache/pip/wheels/e2/0b/af/2289f41b07ff6c4f838e19d11ca201ce3cb7f8d766623c1317
Successfully built bintrees
Installing collected packages: bintrees
Successfully installed bintrees-2.0.7

(angr) angr@dc084db635ac:~/BootStomp$ python taint_analysis/bootloadertaint.py config/config.huawei
WARNING | 2018-07-16 09:06:48,819 | cle.blob | No custom_entry_point was specified for blob, assuming 0
Traceback (most recent call last):
File "taint_analysis/bootloadertaint.py", line 330, in
bt.run()
File "taint_analysis/bootloadertaint.py", line 271, in run
self._preprocess_taint_file()
File "taint_analysis/bootloadertaint.py", line 199, in _preprocess_taint_file
line = patch_fucking_idapython(line, base_addr)
File "taint_analysis/bootloadertaint.py", line 155, in patch_fucking_idapython
bl = self._p.factory.block(int(call_addr, 16) - base_addr, thumb=True)
File "/home/angr/angr-dev/angr/angr/factory.py", line 324, in block
backup_state=backup_state, opt_level=opt_level, num_inst=num_inst, traceflags=traceflags
File "/home/angr/angr-dev/angr/angr/block.py", line 60, in init
traceflags=traceflags)
File "/home/angr/angr-dev/simuvex/simuvex/engines/vex/engine.py", line 464, in lift
opt_level=opt_level)
File "/home/angr/angr-dev/pyvex/pyvex/block.py", line 64, in init
lift(self, data, max_bytes, max_inst, bytes_offset, opt_level, traceflags)
File "/home/angr/angr-dev/pyvex/pyvex/lift/init.py", line 91, in lift
if lifter_inst.lift():
File "/home/angr/angr-dev/pyvex/pyvex/lift/libvex.py", line 32, in lift
c_irsb = pvc.vex_lift(vex_arch, self.irsb.arch.vex_archinfo, self.data + self.bytes_offset, self.irsb._addr, self.max_inst, self.max_bytes, self.opt_level, self.traceflags, self.allow_lookback)
TypeError: 'IRSB ()(VexArch, VexArchInfo, unsigned char *, unsigned long long, unsigned int, unsigned int, int, int, int, int)' expects 10 arguments, got 9

[badnack]

Are you running this within the provided docker container?

[zhaotianxing]

Thank you for your reply.

No, I installed docker with apt-get (https://docs.docker.com/install/linux/docker-ce/ubuntu/#install-docker-ce-1),
when I run hello-world in docker, it works well,

but when I exec python taint_analysis/bootloadertaint.py config/config.huawei, it tells me "No module named bintrees", I do not know why...

Thanks

[raviwithu]

Do pip install bintrees from docker

[zhaotianxing]

Thanks, I'm a newbie, but it is not working...

c_irsb = pvc.vex_lift(vex_arch, self.irsb.arch.vex_archinfo, self.data + self.bytes_offset, self.irsb._addr, self.max_inst, self.max_bytes, self.opt_level, self.traceflags, self.allow_lookback)
TypeError: 'IRSB ()(VexArch, VexArchInfo, unsigned char *, unsigned long long, unsigned int, unsigned int, int, int, int, int)' expects 10 arguments, got 9

[jonthn4411]

not working for me either.. i was getting the same messeges when i tried running it as zhaotianxing. i am a newbie too.

[badnack]

This seems to be an angr issue @HolmesSherlock or @zardus: could you give it a look?

[scintill]

Another python/angr newbie here... The stack trace includes patch_fucking_idapython. Should that even be called in this case? Could be buggy logic.

If I install bintrees and comment out that call, I get a bit further, but have these errors:

ERROR   | 2018-08-25 12:02:49,291 | simuvex.plugins.unicorn | You are attempting to use unicorn engine support even though it or the simuvex compatibility layer isn't installed
ERROR   | 2018-08-25 12:02:49,317 | _CoreTaint | 'Function check path errored out:
Traceback (most recent call last):
  File "/home/angr/BootStomp/taint_analysis/_coretaint.py", line 762, in _flat_explore
    check_path_fun(current_path, guards_info, current_depth, **kwargs)
  File "/home/angr/BootStomp/taint_analysis/_coretaint.py", line 516, in _check_if_sink_or_source
    if any([x for x in bb.vex.statements if x.tag == 'Ist_IMark' and x.addr == source]):
AttributeError: 'NoneType' object has no attribute 'vex'

The second occurs a lot, for each block tested. I guess the first error is causing the second. This is with the provided Dockerfile.

[badnack]

Commit fcad448 fix this issue, please re-build the docker container first.