Repository: angr/angr

Issue:
Result of massive experiment: exception angr.errors.AngrSyscallError during CFG creation
From the CFG and decompilation experiment across architectures on Debian. Results attached, which have the packages and binaries and exceptions in question.

Attached is a 7zip renamed as a PNG because github doesn't accept xz. Warning: might expand to many gigabytes.
![CFG_FAIL-angr errors AngrSyscallError xz](https://user-images.githubusercontent.com/3453847/68734691-6cfe6280-0598-11ea-8332-59cc5d5bea0d.png)



Discussion:

Resolving patch:
diff --git a/angr/engines/successors.py b/angr/engines/successors.py
--- a/angr/engines/successors.py
+++ b/angr/engines/successors.py
@@ -288,7 +288,7 @@ def _categorize_successor(self, state):
                     # up, and create a "unknown syscall" stub for it.
                     self._fix_syscall_ip(state)
                     self.flat_successors.append(state)
-            except AngrUnsupportedSyscallError:
+            except (AngrUnsupportedSyscallError, AngrSyscallError):
                 self.unsat_successors.append(state)
 
         else:
@@ -514,7 +514,7 @@ def _eval_target_brutal(state, ip, limit):
 
 
 from ..state_plugins.inspect import BP_BEFORE, BP_AFTER
-from ..errors import SimSolverModeError, AngrUnsupportedSyscallError, SimValueError
+from ..errors import SimSolverModeError, AngrUnsupportedSyscallError, AngrSyscallError, SimValueError
 from ..calling_conventions import SYSCALL_CC
 from ..state_plugins.sim_action_object import _raw_ast
 from ..state_plugins.callstack import CallStack
diff --git a/angr/simos/linux.py b/angr/simos/linux.py
--- a/angr/simos/linux.py
+++ b/angr/simos/linux.py
@@ -188,7 +188,7 @@ def state_blank(self, fs=None, concrete_fs=False, chroot=None,
 
         state.register_plugin('fs', SimFilesystem(files=fs, pathsep=pathsep, cwd=cwd, mountpoints=mounts))
 
-        if self.project.loader.main_object.is_ppc64_abiv1:
+        if isinstance(self.project.loader.main_object, MetaELF) and self.project.loader.main_object.is_ppc64_abiv1:
             state.libc.ppc64_abiv = 'ppc64_1'
 
         return state


Test patch:
diff --git a/tests/test_state.py b/tests/test_state.py
--- a/tests/test_state.py
+++ b/tests/test_state.py
@@ -249,6 +249,23 @@ def test_global_condition():
         nose.tools.assert_sequence_equal(s.solver.eval_upto(s.regs.rax, 10), [ 25 ])
 
 
+def test_successors_catch_arbitrary_interrupts():
+
+    # int 0xd2 should fail on x86/amd64 since it's an unsupported interrupt
+    block_bytes = b"\xcd\xd2"
+
+    proj = angr.load_shellcode(block_bytes, "amd64")
+    proj.simos = angr.simos.SimLinux(proj)
+    state = proj.factory.blank_state(addr=0)
+    simgr = proj.factory.simgr(state)
+
+    simgr.step()
+
+    nose.tools.assert_equal(len(simgr.errored), 0, msg="The state should not go to the errored stash. Is "
+                                                       "AngrSyscallError handled in SimSuccessors?")
+    nose.tools.assert_equal(len(simgr.unsat), 1)
+
+
 if __name__ == '__main__':
     test_state()
     test_state_merge()
@@ -258,3 +275,4 @@ def test_global_condition():
     test_state_merge_static()
     test_state_pickle()
     test_global_condition()
+    test_successors_catch_arbitrary_interrupts()