Repository: angr/angr

Issue:
AttributeError: 'NotImplementedType' object has no attribute 'raw_to_bv'
<!--
*Disclaimer:
The angr suite is maintained by a small team of volunteers.
While we cannot guarantee any timeliness for fixes and enhancements, we will do our best.
For more real-time help with angr, from us and the community, join our [Slack.](http://angr.io/invite/)*
-->
---

**Describe the bug.**
<!--
Please include a clear and concise description of what the bug is.
-->
When angr executes some arm instructions, it will eventually result in accessing raw_to_bv from a NotImplementedType object. Maybe some checks are missing and angr should throw its own custom errors.

```
Traceback (most recent call last):
  File "../examiner/samples/angr_test_inst.py", line 15, in <module>
    succ = state.step(num_inst=1)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/sim_state.py", line 587, in step
    return self.project.factory.successors(self, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/factory.py", line 60, in successors
    return self.default_engine.process(*args, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/slicing.py", line 19, in process
    return super().process(*args, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/engine.py", line 149, in process
    self.process_successors(self.successors, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/failure.py", line 21, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/syscall.py", line 18, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/hook.py", line 54, in process_successors
    return super().process_successors(successors, procedure=procedure, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/unicorn.py", line 169, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/soot/engine.py", line 64, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/heavy/heavy.py", line 138, in process_successors
    self.handle_vex_block(irsb)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/heavy/super_fastpath.py", line 19, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/slicing.py", line 26, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/heavy/actions.py", line 30, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/heavy/inspect.py", line 45, in handle_vex_block
    super().handle_vex_block(irsb)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/light.py", line 446, in handle_vex_block
    self._handle_vex_stmt(stmt)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/slicing.py", line 30, in _handle_vex_stmt
    super()._handle_vex_stmt(stmt)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/heavy/inspect.py", line 40, in _handle_vex_stmt
    super()._handle_vex_stmt(stmt)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/resilience.py", line 36, in inner
    return getattr(super(VEXResilienceMixin, self), func)(*iargs, **ikwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/heavy/heavy.py", line 204, in _handle_vex_stmt
    super()._handle_vex_stmt(stmt)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/light.py", line 51, in _handle_vex_stmt
    handler(stmt)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/light.py", line 188, in _handle_vex_stmt_WrTmp
    self._analyze_vex_stmt_WrTmp_data(stmt.data)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/light.py", line 184, in _analyze_vex_stmt_WrTmp_data
    def _analyze_vex_stmt_WrTmp_data(self, *a, **kw): return self. _handle_vex_expr(*a, **kw)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/heavy/inspect.py", line 31, in _handle_vex_expr
    return super()._handle_vex_expr(expr)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/light.py", line 55, in _handle_vex_expr
    result = handler(expr)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/light.py", line 114, in _handle_vex_expr_Binop
    return self._handle_vex_expr_Op(expr)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/light.py", line 120, in _handle_vex_expr_Op
    return self._perform_vex_expr_Op(expr.op, [self._handle_vex_expr(arg) for arg in expr.args])
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/heavy/actions.py", line 49, in _perform_vex_expr_Op
    result = super()._perform_vex_expr_Op(op, exprs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/light/resilience.py", line 36, in inner
    return getattr(super(VEXResilienceMixin, self), func)(*iargs, **ikwargs)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/claripy/datalayer.py", line 104, in _perform_vex_expr_Op
    return simop.calculate(*args)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/claripy/irop.py", line 377, in calculate
    return self._calculate(args)
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/claripy/irop.py", line 470, in _op_vector_float_mapped
    return claripy.Concat(*(self._op_float_mapped(rm_part + ca).raw_to_bv() for ca in chopped_args))
  File "/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/engines/vex/claripy/irop.py", line 470, in <genexpr>
    return claripy.Concat(*(self._op_float_mapped(rm_part + ca).raw_to_bv() for ca in chopped_args))
AttributeError: 'NotImplementedType' object has no attribute 'raw_to_bv'
```

**Environment Information.**
<!--
Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
-->
```
/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/misc/bug_report.py:1: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
  import imp
angr environment report
=============================
Date: 2021-07-07 16:49:03.274869
Running in virtual environment at /home/xtyi/workspace/examiner/.venv
Platform: linux-x86_64
Python version: 3.8.10 (default, Jun  2 2021, 10:49:15) 
[GCC 9.4.0]
######## angr #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr
Pip version angr 9.0.8021
Git info:
        Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
        Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######## ailment #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/ailment
Pip version ailment 9.0.8021
Git info:
        Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
        Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######## cle #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/cle
Pip version cle 9.0.8021
Git info:
        Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
        Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######## pyvex #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/pyvex
Pip version pyvex 9.0.8021
Git info:
        Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
        Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######## claripy #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/claripy
Pip version claripy 9.0.8021
Git info:
        Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
        Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######## archinfo #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/archinfo
Pip version archinfo 9.0.8021
Git info:
        Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
        Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######## z3 #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/z3
Pip version z3-solver 4.8.10.0
Git info:
        Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
        Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######## unicorn #########
Python found it in /home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/unicorn
Pip version unicorn 1.0.2rc4
Git info:
        Current commit 496667ee2ec614c60d28000ba88f77a8303daeee from branch master
        Checked out from remote origin: ssh://git@git.secos.mobi:9932/all_projects/ins_emu/examiner.git
######### Native Module Info ##########
angr: <CDLL '/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/angr/lib/angr_native.so', handle 2c5d7b0 at 0x7f1ecdafecd0>
unicorn: <CDLL '/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/unicorn/lib/libunicorn.so', handle 23c35d0 at 0x7f1ed2ba2f40>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f1ed38dd640>
z3: <CDLL '/home/xtyi/workspace/examiner/.venv/lib/python3.8/site-packages/z3/lib/libz3.so', handle 26055a0 at 0x7f1ed0cf6730>
```

**To Reproduce.**
<!--
Please include *both a script to reproduce the crash, and attach the binary used, if possible*
-->
```python
import angr
from angr.sim_options import ZERO_FILL_UNCONSTRAINED_REGISTERS


code_address = 0x10000
proj = angr.load_shellcode(
    b'\x22\x0d\x30\xf2',
    arch="arm",
    thumb=False,
    load_address=code_address,
)

state: angr.SimState = proj.factory.call_state(addr=code_address)
state.options.add(ZERO_FILL_UNCONSTRAINED_REGISTERS)
succ = state.step(num_inst=1)
```

**Additional context.**
<!--
Add any other context about the problem here.
-->



Discussion:

Resolving patch:
diff --git a/angr/engines/vex/claripy/irop.py b/angr/engines/vex/claripy/irop.py
--- a/angr/engines/vex/claripy/irop.py
+++ b/angr/engines/vex/claripy/irop.py
@@ -460,11 +460,16 @@ def _op_vector_mapped(self, args):
         return claripy.Concat(*(self._op_mapped(ca) for ca in chopped_args))
 
     def _op_vector_float_mapped(self, args):
-        rm_part = [] if self._generic_name in self.NO_RM else [args[0]]
+        no_rm_arg = self._generic_name in self.NO_RM
+        rm_part = [] if no_rm_arg else [args[0]]
+        if not no_rm_arg and self.name in {'Iop_Add32Fx2', 'Iop_Sub32Fx2'}:  # wtf is up with these guys
+            no_rm_arg = True
+            rm_part = [claripy.BVV(0, 8)]
+
         chopped_args = (
                 [
                     claripy.Extract((i + 1) * self._vector_size - 1, i * self._vector_size, a).raw_to_fp()
-                    for a in (args if self._generic_name in self.NO_RM else args[1:])
+                    for a in (args if no_rm_arg else args[1:])
                 ] for i in reversed(range(self._vector_count))
             )
         return claripy.Concat(*(self._op_float_mapped(rm_part + ca).raw_to_bv() for ca in chopped_args))


Test patch: