angr.exploration_techniques.tracer.TracerDesyncError: BUG! Please investigate the claim in the comment above me

[Techno-Fox]

Hello (Guess who's back) I don't know if this is a error or a bug. However I believe that I should report it. I'm running this on a dynamic binary, testing this on a simple buffer overflow program.

P.S. Thanks for working on this project

I get this error : angr.exploration_techniques.tracer.TracerDesyncError: BUG! Please investigate the claim in the comment above me

The full error is :

WARNING | 2019-10-24 15:40:06,666 | cle.loader | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000. [DEBUG] Diction Set To : /dev/shm/work/bof/dictionary/bof.dict WARNING | 2019-10-24 15:40:09,094 | fuzzer.fuzzer | not forced [] Starting fuzzer... [DEBUG] IN DIR : - [DEBUG] ARGS: ['/usr/local/bin/afl-fuzz', '-i', '-', '-o', '/dev/shm/work/bof/sync', '-m', '8G', '-Q', '-M', 'fuzzer-master', '--', './bof', '>', '/dev/shm/work/bof/fuzzer-master.log'] [DEBUG] IN DIR : - [DEBUG] ARGS: ['/usr/local/bin/afl-fuzz', '-i', '-', '-o', '/dev/shm/work/bof/sync', '-m', '8G', '-Q', '-S', 'fuzzer-1', '--', './bof', '>', 'fuzzer-1.log'] [] Waiting for fuzzer completion (timeout: None, first_crash: False). WARNING | 2019-10-24 15:41:39,116 | local_callback | Driller stuck callback triggered! WARNING | 2019-10-24 15:41:39,127 | local_callback | starting drilling of bof, id:000000,orig:seed-0 /opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/cffi/cparser.py:164: UserWarning: Declaration of global variable 'r' in cdef() should be marked 'extern' for consistency (or possibly 'static' in API mode) "'static' in API mode)" % (decl.name,)) /opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/pysmt/walkers/generic.py:43: DeprecationWarning: Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated, and in 3.8 it will stop working if len(nodetypes) == 1 and isinstance(nodetypes[0], collections.Iterable): WARNING | 2019-10-24 15:41:43,153 | cle.loader | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000. WARNING | 2019-10-24 15:41:47,530 | cle.loader | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000. Traceback (most recent call last): File "/opt/fuzzer/driller/local_callback.py", line 122, in for new_input in d.drill_generator(): File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/driller/driller_main.py", line 101, in drill_generator for i in self._drill_input(): File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/driller/driller_main.py", line 141, in _drill_input simgr.step() File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/misc/hookset.py", line 75, in call result = current_hook(self.func.self, *args, **kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/exploration_techniques/driller_core.py", line 39, in step simgr.step(stash=stash, **kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/misc/hookset.py", line 75, in call result = current_hook(self.func.self, *args, **kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/exploration_techniques/tracer.py", line 225, in step return simgr.step(stash=stash, **kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/misc/hookset.py", line 80, in call return self.func(*args, **kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/sim_manager.py", line 344, in step successors = self.step_state(state, successor_func=successor_func, **run_args) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/misc/hookset.py", line 75, in call result = current_hook(self.func.self, *args, **kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/exploration_techniques/tracer.py", line 275, in step_state self._update_state_tracking(succs[0]) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/exploration_techniques/tracer.py", line 386, in _update_state_tracking deviating_trace_idx=idx) angr.exploration_techniques.tracer.TracerDesyncError: BUG! Please investigate the claim in the comment above me (b'', None)

[rhelmot]

oh shit. yes this is a real bug. can you please attach the binaries you're running with as well as a script to reproduce this issue? you will also need to include the dynamic library dependencies if the program is not statically linked.

[Techno-Fox]

Sorry never checked. I will send over a zip file and instructions shortly

[Techno-Fox]

suffarring.zip

Edit :

was working with some input however would have been to big to send over github. I just ran driller with the normal stdin. This this happend

[TheBlueMatt]

Got the same error (backtrace is identical, +/-) with a static binary (though with pthread, and maybe a few other bits linked in). bug80_target.gz