Repository: angr/angr

Issue:
Bug about arm instruction VMUL VMLA. AttributeError: 'NotImplementedType' object has no attribute 'raw_to_bv'
<!--
*Disclaimer:
The angr suite is maintained by a small team of volunteers.
While we cannot guarantee any timeliness for fixes and enhancements, we will do our best.
For more real-time help with angr, from us and the community, join our [Slack.](http://angr.io/invite/)*
-->
---

**Describe the bug.**
<!--
Please include a clear and concise description of what the bug is.
-->
The execution of VMAX or VMLA instruction will throw a AttributeError: 'NotImplementedType' object has no attribute 'raw_to_bv'

**Environment Information.**
<!--
Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
-->

```
/home/xtyi/opensource/angr-dev/angr/angr/misc/bug_report.py:1: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
  import imp
angr environment report
=============================
Date: 2021-07-08 20:40:03.242296
Running in virtual environment at /home/xtyi/pyvenv/angr
Platform: linux-x86_64
Python version: 3.8.10 (default, Jun  2 2021, 10:49:15)
[GCC 9.4.0]
######## angr #########
Python found it in /home/xtyi/opensource/angr-dev/angr/angr
Pip version angr 9.0.gitrolling
Git info:
	Current commit 694053107552b9e1f4d7b997eaccab21a30f28d2 from branch master
	Checked out from remote origin: https://github.com/angr/angr
######## ailment #########
Python found it in /home/xtyi/opensource/angr-dev/ailment/ailment
Pip version ailment 9.0.gitrolling
Git info:
	Current commit 8d9374b8ee51d49f3808c3c8bbed11ad9979d165 from branch master
	Checked out from remote origin: https://github.com/angr/ailment
######## cle #########
Python found it in /home/xtyi/opensource/angr-dev/cle/cle
Pip version cle 9.0.gitrolling
Git info:
	Current commit d45d4b95d1c607d00d27b4896e6a1813ee3d34fb from branch master
	Checked out from remote origin: https://github.com/angr/cle
######## pyvex #########
Python found it in /home/xtyi/opensource/angr-dev/pyvex/pyvex
Pip version pyvex 9.0.gitrolling
Git info:
	Current commit b7006517fcb9fcd713b070315b7c18277c942113 from branch master
	Checked out from remote origin: https://github.com/angr/pyvex
######## claripy #########
Python found it in /home/xtyi/opensource/angr-dev/claripy/claripy
Pip version claripy 9.0.gitrolling
Git info:
	Current commit d372dd28bede388d44c018b06168239ca335329a from branch master
	Checked out from remote origin: https://github.com/angr/claripy
######## archinfo #########
Python found it in /home/xtyi/opensource/angr-dev/archinfo/archinfo
Pip version archinfo 9.0.gitrolling
Git info:
	Current commit b150db4c0a939140966df8b0056b6deb5b07efbf from branch master
	Checked out from remote origin: https://github.com/angr/archinfo
######## z3 #########
Python found it in /home/xtyi/pyvenv/angr/lib/python3.8/site-packages/z3
Pip version z3-solver 4.8.10.0
Couldn't find git info
######## unicorn #########
Python found it in /home/xtyi/pyvenv/angr/lib/python3.8/site-packages/unicorn
Pip version unicorn 1.0.2rc4
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/home/xtyi/opensource/angr-dev/angr/angr/lib/angr_native.so', handle 2f4f3a0 at 0x7f5c1ff54fd0>
unicorn: <CDLL '/home/xtyi/pyvenv/angr/lib/python3.8/site-packages/unicorn/lib/libunicorn.so', handle 260c0f0 at 0x7f5c25d73c40>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f5c26991970>
z3: <CDLL '/home/xtyi/pyvenv/angr/lib/python3.8/site-packages/z3/lib/libz3.so', handle 2861fc0 at 0x7f5c237eb760>
```


**To Reproduce.**
<!--
Please include *both a script to reproduce the crash, and attach the binary used, if possible*
-->
```
import angr
from angr.sim_options import ZERO_FILL_UNCONSTRAINED_REGISTERS


code_address = 0x10000
proj = angr.load_shellcode(
    b'\x63\xf9\xaa\xf2',
    arch="arm",
    thumb=False,
    load_address=code_address,
)

state: angr.SimState = proj.factory.call_state(addr=code_address)
state.options.add(ZERO_FILL_UNCONSTRAINED_REGISTERS)
succ = state.step(num_inst=1)
```



**Additional context.**
<!--
Add any other context about the problem here.
-->
Here are 4 example instructions, the hex representation is big endian.
aarch32_VMUL(floating-point)_A1    f35f0d3c
aarch32_VMUL(by scalar)_A1            f2aaf963
aarch32_VMLA(by scalar)_A1            f2e701c8
aarch32_VMLA(floating-point)_A1    f229fd91

The traceback of program using these instructions are same. 




Discussion:

Resolving patch:
diff --git a/angr/engines/vex/claripy/irop.py b/angr/engines/vex/claripy/irop.py
--- a/angr/engines/vex/claripy/irop.py
+++ b/angr/engines/vex/claripy/irop.py
@@ -433,6 +433,8 @@ def _op_mapped(self, args):
         if o == '__floordiv__' and self.is_signed:
             # yikes!!!!!!!
             return claripy.SDiv(*sized_args)
+        if o == 'Abs':
+            return claripy.If(sized_args[0].SLT(0), -sized_args[0], sized_args[0])
 
         return getattr(claripy.ast.BV, o)(*sized_args)
 
@@ -462,7 +464,8 @@ def _op_vector_mapped(self, args):
     def _op_vector_float_mapped(self, args):
         no_rm_arg = self._generic_name in self.NO_RM
         rm_part = [] if no_rm_arg else [args[0]]
-        if not no_rm_arg and self.name in {'Iop_Add32Fx2', 'Iop_Sub32Fx2'}:  # wtf is up with these guys
+        # wtf is up with these guys
+        if not no_rm_arg and self.name in {'Iop_Add32Fx2', 'Iop_Sub32Fx2', 'Iop_Mul32Fx2', 'Iop_PwAdd32Fx2'}:
             no_rm_arg = True
             rm_part = [claripy.BVV(0, 8)]
 
@@ -916,7 +919,7 @@ def _auto_vectorize(self, f, args, rm=None, rm_passed=False):
                 if self._float:
                     # HACK HACK HACK
                     # this is such a weird divergence. why do the fp generics take several args and the int generics take a list?
-                    result.append(f(*lane_args))
+                    result.append(f(*lane_args).raw_to_bv())
                 else:
                     result.append(f(lane_args))
             return claripy.Concat(*result)


Test patch: