Repository: angr/angr

Issue:
Type error in in string_references()
*Disclaimer: The angr suite is maintained by a small team of volunteers. While we cannot guarantee any timeliness for fixes and enhancements, we will do our best. For more real-time help with angr, from us and the community, join our [Slack.](http://angr.io/invite/)*

---

**Describe the bug**
Please include a clear and concise description of what the bug is.
There is a type error occurred in string_references() function
Here is the log
```
Traceback (most recent call last):
  File ".\src\gaeInputGeneration.py", line 109, in <module>
    for offset, strRef in func.string_references(vex_only=True):
  File "C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\angr\knowledge_plugins\functions\function.py", line 301, in string_references
    while current_char in string.printable:
TypeError: 'in <string>' requires string as left operand, not int
```
And here is a snapshot of your code in function.py
```python
for addr in self.local_runtime_values if not vex_only else self.code_constants:
    if not isinstance(addr, claripy.fp.FPV) and addr in memory:
        # check that the address isn't an pointing to known executable code
        # and that it isn't an indirect pointer to known executable code
        try:
            possible_pointer = memory.unpack_word(addr)
            if addr not in known_executable_addresses and possible_pointer not in known_executable_addresses:
                # build string
                stn = ""
                offset = 0
                current_char = memory[addr + offset]
                while current_char in string.printable:
                    stn += current_char
                    offset += 1
                    current_char = memory[addr + offset]

                # check that the string was a null terminated string with minimum length
                if current_char == "\x00" and len(stn) >= minimum_length:
                    strings.append((addr, stn))
        except KeyError:
            pass
return strings
```
In this piece of code, the ``current_char`` from ``memory[addr + offset]`` is a integer instead of <string>.
However, it cannot be transformed to string by `` current_char = str(memory[addr + offset])`` directly. (It might be unicode or sthing? idk)
This code works well under python2

**Environment Information**
Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
>angr environment report
=============================
Date: 2018-10-02 11:04:42.897143
!!! runninng in global environment.  Are you sure? !!!
Platform: win-amd64
Python version: 3.6.4rc1 (v3.6.4rc1:3398dcb, Dec  5 2017, 20:41:32) [MSC v.1900 64 bit (AMD64)]
######## angr #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\angr
Pip version angr 8.18.10.1
Couldn't find git info
######## ailment #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\ailment
Pip version ailment 8.18.10.1
Couldn't find git info
######## cle #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\cle
Pip version cle 8.18.10.1
Couldn't find git info
######## pyvex #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\pyvex
Pip version pyvex 8.18.10.1
Couldn't find git info
######## claripy #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\claripy
Pip version claripy 8.18.10.1
Couldn't find git info
######## archinfo #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\archinfo
Pip version archinfo 8.18.10.1
Couldn't find git info
######## ana #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\ana
Pip version ana 0.5
Couldn't find git info
######## z3 #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\z3
Pip version not found!
Couldn't find git info
######## unicorn #########
Python found it in C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\unicorn
Pip version unicorn 1.0.1
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL 'C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\angr\lib\angr_native.dll', handle 7ffee8a40000
at 0x255a60aff60>
unicorn: <CDLL 'C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\unicorn\lib\unicorn.dll', handle 6afc0000 at 0x255a5998630>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x00000255A4F25240>
z3: <CDLL 'C:\Users\lixue\AppData\Local\Programs\Python\Python36\lib\site-packages\z3\lib\libz3.dll', handle 7ffeae270000 at 0x255b6a971d0>

**To Reproduce**
Please include *both a script to reproduce the crash, and attach the binary used, if possible*
```python
for func in cfg1.functions.values():
    if func.binary_name == binary1:
        for offset, strRef in func.string_references(vex_only=True):
            offset = hex(offset)
            if (offsetConstMapping in offset) is not True:
                print("offset: {} to str: {}".format(offset, strRef))
                offsetConstMapping[offset] = strRef


for func in cfg2.functions.values():
    if func.binary_name == binary2:
        for offset, strRef in func.string_references(vex_only=True):
            offset = hex(offset)
            if (offsetConstMapping in offset) is not True:
                print("offset: {} to str: {}".format(offset, strRef))
                offsetConstMapping[offset] = strRef
```
**Additional context**
Add any other context about the problem here.



Discussion:
Thanks for reporting!

Resolving patch:
diff --git a/angr/knowledge_plugins/functions/function.py b/angr/knowledge_plugins/functions/function.py
--- a/angr/knowledge_plugins/functions/function.py
+++ b/angr/knowledge_plugins/functions/function.py
@@ -298,11 +298,11 @@ def string_references(self, minimum_length=2, vex_only=False):
                         # build string
                         stn = ""
                         offset = 0
-                        current_char = memory[addr + offset]
-                        while chr(current_char) in string.printable:
+                        current_char = chr(memory[addr + offset])
+                        while current_char in string.printable:
                             stn += current_char
                             offset += 1
-                            current_char = memory[addr + offset]
+                            current_char = chr(memory[addr + offset])
 
                         # check that the string was a null terminated string with minimum length
                         if current_char == "\x00" and len(stn) >= minimum_length:


Test patch: