+
Skip to content

Callsite analysis may fail to preserve return value info #5676

@mborgerson

Description

@mborgerson

Description

Minimal example:

global f0
global f1

section .text

f0:
    mov eax, 0
    ret

f1:
    call f0
    ret

With CompleteCallingConventions parameter analyze_callsites=True:

$ angr ./callsite_retval.o dec
void f0()                                                                                                                                                                                                                                     
{                                                                                                                                                                                                                                             
    return;                                                                                                                                                                                                                                   
}                                                                                                                                                                                                                                             
                                                                                                                                                                                                                                              
void f1()                                                                                                                                                                                                                                     
{                                                                                                                                                                                                                                             
    f0();                                                                                                                                                                                                                                     
    return;                                                                                                                                                                                                                                   
}         

With CompleteCallingConventions parameter analyze_callsites=False, the return value is preserved:

$ angr ./callsite_retval.o dec
long long f0()                                                                                                                                                                                                                                
{                                                                                                                                                                                                                                             
    return 0;                                                                                                                                                                                                                                 
}                                                                                                                                                                                                                                             
                                                                                                                                                                                                                                              
long long f1()                                                                                                                                                                                                                                
{                                                                                                                                                                                                                                             
    return f0();                                                                                                                                                                                                                              
}                                                                                                                                                                                                                                             

Steps to reproduce the bug

callsite_retval.o.zip

Environment

angr @ f9677c6

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething is broken

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      点击 这是indexloc提供的php浏览器服务,不要输入任何密码和下载