Broken BlockNode in Function Graphs

[RaghulPS32]

Description

I was accessing the function graph using angr, where I stumbled upon a issue, while traversing through a function graph I tried to access the successors of a BlockNode which raised a error. Cannot calculate successors for graphless node. Upon further debugging found the CodeNode object attribute self._graph to be None.

• But surprisingly this issue seems to resolve itself when I serialize the project using AngrDB ( code attached below ) and load it back again.
• Successor Access without DB Serialization Code:

import angr
binary = angr.Project("<path to binary>",auto_load_libs=False,load_debug_info=True)
binary.analyses.CFGFast(normalize=True)
main = binary.kb.functions['main']
block = [blk for blk in main.graph]
print(block[0].successors())

• Output

BlockNode:  <BlockNode at 0x40119a (size 20)>
Graph:  None
Cannot calculate successors for graphless node

• Successor Access with DB Serialization Code:

import angr
from angr.angrdb.db import AngrDB
binary  = angr.Project("<path to binary>",auto_load_libs=False,load_debug_info=True)
binary.analyses.CFGFast(normalize=True)
db = AngrDB(binary)
db.dump("binary.db")
new_db = AngrDB()
project = new_db.load("binary_db")
main = project.kb.functions['main']
block = [blk for blk in main.graph]
print(block[0].successors())

• Output

BlockNode:  <BlockNode at 0x40119a (size 20)>
[<Function sub_401310 (0x401310)>, <BlockNode at 0x4011fe (size 20)>]

• Binary used current-locale.out in findutils compiled in x86, clang-8. -O0

• Environment Used:
  angr==9.2.96
  pyvex==9.2.96
  cle==9.2.96

Steps to reproduce the bug

Steps to recreate the bug:

• Create a angr project of the attached binary
• Generate CFGFast(normalize=True)
• Use the code snippet in description
• It should raise the Cannot calculate successors for graphless node

Environment

angr==9.2.96
pyvex==9.2.96
cle==9.2.96

Additional context

No response

[ltfish]

Can you provide the binary for us to reproduce?

[RaghulPS32]

Hi, I am attaching the binary with this mail. Also if you are unable to replicate the issue just call the successors() in a loop. It should definitely cause the issue.

…

On Fri, Apr 19, 2024 at 9:55 PM Fish ***@***.***> wrote: Can you provide the binary for us to reproduce? — Reply to this email directly, view it on GitHub <#4591 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AP57VGXIO3HV7FGJZWLJHO3Y6FAO3AVCNFSM6AAAAABGM3POBOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANRWHEYDGMZSGY> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[ltfish]

@RaghulPS32 I don't think the binary went through. Can you please send it to [email protected]?