Repository: angr/angr

Issue:
angr.errors.AngrSyscallError: Unknown syscall jumpkind Ijk_EmWarn
I was trying to following the angr tutorial section on the guinea pig Fauxware (both from an installation of the latest code via github and docker) but I am unable to run the Control-Flow Graph analysis:

    cfg = project.analyses.CFG()

however, the process errors out with the following:

    ERROR   | 2018-04-28 18:12:46,695 | angr.engines.vex.statements.dirty | Unsupported dirty helper amd64g_dirtyhelper_FSTENV
    ERROR   | 2018-04-28 18:12:46,696 | angr.engines.vex.statements.dirty | Unsupported dirty helper amd64g_dirtyhelper_FLDENV
    WARNING | 2018-04-28 18:12:46,704 | angr.procedures.definitions | unsupported syscall: rt_sigprocmask
    Traceback (most recent call last):
      File "<stdin>", line 1, in <module>
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/analysis.py", line 96, in make_analysis
        oself.__init__(*args, **kwargs)
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/cfg/cfg.py", line 58, in __init__
        CFGFast.__init__(self, **kwargs)
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/cfg/cfg_fast.py", line 819, in __init__
        self._analyze()
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/forward_analysis.py", line 508, in _analyze
        self._analysis_core_baremetal()
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/forward_analysis.py", line 633, in _analysis_core_baremetal
        self._process_job_and_get_successors(job_info)
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/forward_analysis.py", line 651, in _process_job_and_get_successors
        successors = self._get_successors(job)
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/cfg/cfg_fast.py", line 1210, in _get_successors
        jobs = self._scan_block(addr, current_function_addr, jumpkind, src_node, src_ins_addr, src_stmt_idx)
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/cfg/cfg_fast.py", line 1484, in _scan_block
        previous_src_ins_addr, previous_src_stmt_idx)
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/cfg/cfg_fast.py", line 1656, in _scan_irsb
        stmt_idx
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/cfg/cfg_fast.py", line 1818, in _create_jobs
        target_addr, jumpkind, is_syscall=is_syscall
      File "/usr/local/lib/python2.7/dist-packages/angr/analyses/cfg/cfg_fast.py", line 1886, in _create_job_call
        syscall_stub = self.project.simos.syscall(succ)
      File "/usr/local/lib/python2.7/dist-packages/angr/simos/userland.py", line 55, in syscall
        abi = self.syscall_abi(state)
      File "/usr/local/lib/python2.7/dist-packages/angr/simos/linux.py", line 147, in syscall_abi
        raise AngrSyscallError("Unknown syscall jumpkind %s" % state.history.jumpkind)
    angr.errors.AngrSyscallError: Unknown syscall jumpkind Ijk_EmWarn

I am running angr on an Ubuntu 16.04 TLS system whose kernel information is:

    Linux devlinux 4.4.0-122-generic #146-Ubuntu SMP Mon Apr 23 15:34:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux



Discussion:
This is definitely a @ltfish bug. In the meantime you can almost certainly work around it by loading your project with `auto_load_libs=False`.
Thanks!  I will give that a try......and it worked!  Thanks a ton.
Is that an ARM binary? I think you were recovering CFG for the entire ARM libc...

Anyways I really did not handle the jumpkind `Ijk_EmWarn` anywhere. This should be fixed, indeed.

I don't think it was an arm binary as it was in the x86_64 directory of the test files.  I can reboot my system and double check the file if you like
That's fine. I think I can reproduce this issue by generating a CFG on an x86_64 libc shipped with Ubuntu 16.04.
Hi! Is there any workaround for this problem? I want to load libc library and use CFGFast().

Resolving patch:
diff --git a/angr/analyses/cfg/cfg_fast.py b/angr/analyses/cfg/cfg_fast.py
--- a/angr/analyses/cfg/cfg_fast.py
+++ b/angr/analyses/cfg/cfg_fast.py
@@ -1974,16 +1974,22 @@ def _create_job_call(self, addr, irsb, cfg_node, stmt_idx, ins_addr, current_fun
         if is_syscall:
             # Fix the target_addr for syscalls
             tmp_state = self.project.factory.blank_state(mode="fastpath", addr=cfg_node.addr)
-            succ = self.project.factory.successors(tmp_state).flat_successors[0]
-            try:
-                syscall_stub = self.project.simos.syscall(succ)
-                if syscall_stub:  # can be None if simos is not a subclass of SimUserspac
-                    syscall_addr = syscall_stub.addr
-                    target_addr = syscall_addr
-                else:
-                    target_addr = self._unresolvable_target_addr
-            except AngrUnsupportedSyscallError:
+            # Find the first successor with a syscall jumpkind
+            succ = next(iter(succ for succ in self.project.factory.successors(tmp_state).flat_successors
+                             if succ.jumpkind and succ.jumpkind.startswith("Ijk_Sys")), None)
+            if succ is None:
+                # For some reason, there is no such successor with a syscall jumpkind
                 target_addr = self._unresolvable_target_addr
+            else:
+                try:
+                    syscall_stub = self.project.simos.syscall(succ)
+                    if syscall_stub:  # can be None if simos is not a subclass of SimUserspac
+                        syscall_addr = syscall_stub.addr
+                        target_addr = syscall_addr
+                    else:
+                        target_addr = self._unresolvable_target_addr
+                except AngrUnsupportedSyscallError:
+                    target_addr = self._unresolvable_target_addr
 
         new_function_addr = target_addr
         if irsb is None:


Test patch: