+
Skip to content

Problems encountered when constructing RISC-V data flow graph #5564

Open
@GuMys-WanJS

Description

@GuMys-WanJS

Question

ERROR    | 2025-06-30 09:56:25,363 | angr.analyses.fcp.fcp.SimEngineFCPVEX | Unsupported Dirty riscv_dirtyhelper_CSR_s.
ERROR    | 2025-06-30 09:56:25,363 | angr.analyses.fcp.fcp.SimEngineFCPVEX | Unsupported Dirty riscv_dirtyhelper_CSR_rw.
Traceback (most recent call last):
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/misc/plugins.py", line 252, in request_plugin
    return self._default_plugins[name]
           ~~~~~~~~~~~~~~~~~~~~~^^^^^^
KeyError: 'ip'

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/misc/plugins.py", line 77, in __getattr__
    return self.get_plugin(name)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/sim_state.py", line 423, in get_plugin
    return super().get_plugin(name)
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/misc/plugins.py", line 161, in get_plugin
    plugin_cls: type[P] = self._active_preset.request_plugin(name)
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/misc/plugins.py", line 254, in request_plugin
    raise AngrNoPluginError(f"There is no plugin named {name}") from err
angr.errors.AngrNoPluginError: There is no plugin named ip

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/media/gmys/DB4DC1F4CB17C92A/zxl/riscv/cfa.py", line 7, in <module>
    cfg = project.analyses.CFGFast()
          ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/analysis.py", line 263, in __call__
    r = w(*args, **kwargs)
        ^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/analysis.py", line 248, in wrapper
    oself.__init__(*args, **kwargs)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/cfg_fast.py", line 869, in __init__
    self._analyze()
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/forward_analysis/forward_analysis.py", line 263, in _analyze
    self._analysis_core_baremetal()
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/forward_analysis/forward_analysis.py", line 408, in _analysis_core_baremetal
    self._process_job_and_get_successors(job_info)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/forward_analysis/forward_analysis.py", line 426, in _process_job_and_get_successors
    successors = self._get_successors(job)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/cfg_fast.py", line 1476, in _get_successors
    jobs = self._scan_block(job)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/cfg_fast.py", line 2101, in _scan_block
    entries = self._scan_irsb(cfg_job, current_func_addr)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/cfg_fast.py", line 2376, in _scan_irsb
    new_jobs = self._create_jobs(target, jumpkind, function_addr, irsb, addr, cfg_node, ins_addr, stmt_idx)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/cfg_fast.py", line 2608, in _create_jobs
    jobs += self._create_job_call(
            ^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/cfg_fast.py", line 2659, in _create_job_call
    resolved, resolved_targets, ij = self._indirect_jump_encountered(
                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/cfg_base.py", line 2807, in _indirect_jump_encountered
    resolved, resolved_targets = self._resolve_indirect_jump_timelessly(addr, irsb, func_addr, jumpkind)
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/cfg_base.py", line 2737, in _resolve_indirect_jump_timelessly
    r, resolved_targets = res.resolve(self, addr, func_addr, block, jumpkind)
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/indirect_jump_resolvers/syscall_resolver.py", line 41, in resolve
    stub = self._resolve_syscall_to_stub(cfg, addr, func_addr, block)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/indirect_jump_resolvers/syscall_resolver.py", line 59, in _resolve_syscall_to_stub
    successors = self._simulate_block_with_resilience(state)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/analyses/cfg/indirect_jump_resolvers/syscall_resolver.py", line 77, in _simulate_block_with_resilience
    successors = self.project.factory.successors(state, skip_stmts=stmt_idx)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/factory.py", line 107, in successors
    return self.default_engine.process(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/light/slicing.py", line 21, in process
    return super().process(state, block=block, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/successors.py", line 609, in process
    self.process_successors(self.successors, **kwargs)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/failure.py", line 27, in process_successors
    return super().process_successors(successors, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/syscall.py", line 28, in process_successors
    return super().process_successors(successors, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/hook.py", line 57, in process_successors
    return super().process_successors(successors, procedure=procedure, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/unicorn.py", line 396, in process_successors
    return super().process_successors(successors, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/soot/engine.py", line 69, in process_successors
    return super().process_successors(successors, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/heavy/heavy.py", line 165, in process_successors
    self.handle_vex_block(irsb)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/heavy/super_fastpath.py", line 26, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/light/slicing.py", line 27, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/heavy/actions.py", line 25, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/heavy/inspect.py", line 50, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/light/light.py", line 545, in handle_vex_block
    self._handle_vex_defaultexit(irsb.next, irsb.jumpkind)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/light/slicing.py", line 37, in _handle_vex_defaultexit
    super()._handle_vex_defaultexit(expr, jumpkind)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/light/light.py", line 548, in _handle_vex_defaultexit
    self._perform_vex_defaultexit(self._analyze_vex_defaultexit(expr) if expr is not None else None, jumpkind)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/heavy/actions.py", line 231, in _perform_vex_defaultexit
    super()._perform_vex_defaultexit(target, jumpkind)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/vex/heavy/heavy.py", line 359, in _perform_vex_defaultexit
    self.successors.add_successor(
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/successors.py", line 147, in add_successor
    self._categorize_successor(state)
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/engines/successors.py", line 303, in _categorize_successor
    state.regs.ip_at_syscall = state.ip
                               ^^^^^^^^
  File "/home/gmys/anaconda3/envs/riscv/lib/python3.11/site-packages/angr/misc/plugins.py", line 79, in __getattr__
    raise AttributeError(name) from err
AttributeError: ip. Did you mean: '_ip'?

How should I solve it

Metadata

Metadata

Assignees

No one assigned

    Labels

    needs-triageIssue has yet to be looked at by a maintainerquestionIssues that do not require code changes

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      点击 这是indexloc提供的php浏览器服务,不要输入任何密码和下载