Repository: angr/angr

Issue:
Trace seems ambiguous - ASLR slides
<!--
*Disclaimer:
The angr suite is maintained by a small team of volunteers.
While we cannot guarantee any timeliness for fixes and enhancements, we will do our best.
For more real-time help with angr, from us and the community, join our [Slack.](http://angr.io/invite/)*
-->
---

**Describe the bug.**
<!--
Please include a clear and concise description of what the bug is.
-->
When adding a Tracer technique to a simulation manager, I receive an error:
```AngrTracerError: Trace seems ambiguous with respect to what the ASLR slides are for <ELF Object simple_overflow_stdin, maps [0x555555554000:0x5555555580bf]>. This is surmountable, please open an issue.```

I believe this is related to the changes here: https://github.com/angr/angr/commit/579c50afb11463fba656392e2c2944db6a279d18?branch=579c50afb11463fba656392e2c2944db6a279d18&diff=split#diff-1bc096394f30f61699d3d320830286d1f1844485a65e52a7d9f7c48728af15e4

Specifically the new `_locate_entry_point` and `_filter_idx` functions.

**Environment Information.**
<!--
Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
-->
I've replicated this in two slightly different environments. Here is the report for one of them:
```
angr environment report
=============================
Date: 2021-01-05 15:48:02.741997
Running in virtual environment at /opt/venv
Platform: linux-x86_64
Python version: 3.7.9 (default, Oct 13 2020, 21:10:49) 
[GCC 8.3.0]
######## angr #########
Python found it in /opt/venv/lib/python3.7/site-packages/angr
Pip version angr 9.0.gitrolling
Couldn't find git info
######## ailment #########
Python found it in /opt/venv/lib/python3.7/site-packages/ailment
Pip version ailment 9.0.gitrolling
Couldn't find git info
######## cle #########
Python found it in /opt/venv/lib/python3.7/site-packages/cle
Pip version cle 9.0.gitrolling
Couldn't find git info
######## pyvex #########
Python found it in /opt/venv/lib/python3.7/site-packages/pyvex
Pip version pyvex 9.0.gitrolling
Couldn't find git info
######## claripy #########
Python found it in /opt/venv/lib/python3.7/site-packages/claripy
Pip version claripy 9.0.gitrolling
Couldn't find git info
######## archinfo #########
Python found it in /opt/venv/lib/python3.7/site-packages/archinfo
Pip version archinfo 9.0.gitrolling
Couldn't find git info
######## z3 #########
Python found it in /opt/venv/lib/python3.7/site-packages/z3
Pip version z3-solver 4.8.9.0
Couldn't find git info
######## unicorn #########
Python found it in /opt/venv/lib/python3.7/site-packages/unicorn
Pip version unicorn 1.0.2rc4
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/opt/venv/lib/python3.7/site-packages/angr/lib/angr_native.so', handle 5635c7e46e30 at 0x7fd6678f7950>
unicorn: <CDLL '/opt/venv/lib/python3.7/site-packages/unicorn/lib/libunicorn.so', handle 5635c70f2c80 at 0x7fd666b9b890>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7fd6677c3990>
z3: <CDLL '/opt/venv/lib/python3.7/site-packages/z3/lib/libz3.so', handle 5635c736db50 at 0x7fd6648a8290>
```

**To Reproduce.**
<!--
Please include *both a script to reproduce the crash, and attach the binary used, if possible*
-->
I've include a script and binary to replicate the issue, as well as the files to build the simple binary.
[simple_overflow_stdin.zip](https://github.com/angr/angr/files/5771247/simple_overflow_stdin.zip)


**Additional context.**
<!--
Add any other context about the problem here.
-->
I am trying to replicate some functionality that the Rex project performs. So the script is a mash up of code pulled from Rex and various test scripts.


Discussion:

Resolving patch:
diff --git a/angr/exploration_techniques/tracer.py b/angr/exploration_techniques/tracer.py
--- a/angr/exploration_techniques/tracer.py
+++ b/angr/exploration_techniques/tracer.py
@@ -193,7 +193,13 @@ def _filter_idx(self, angr_addr, idx):
         slide = self._trace[idx] - angr_addr
         block = self.project.factory.block(angr_addr)
         legal_next = block.vex.constant_jump_targets
-        return not legal_next or any(a + slide == self._trace[idx + 1] for a in legal_next)
+        if legal_next:
+            return any(a + slide == self._trace[idx + 1] for a in legal_next)
+        else:
+            # the intuition is that if the first block of an initializer does an indirect jump,
+            # it's probably a call out to another binary (notably __libc_start_main)
+            # this is an awful fucking heuristic but it's as good as we've got
+            return abs(self._trace[idx] - self._trace[idx + 1]) > 0x1000
 
     def setup(self, simgr):
         simgr.populate('missed', [])


Test patch: