Repository: angr/angr

Issue:
CFGFast produce incorrect successors information for some mips binaries
<!--
*Disclaimer:
The angr suite is maintained by a small team of volunteers.
While we cannot guarantee any timeliness for fixes and enhancements, we will do our best.
For more real-time help with angr, from us and the community, join our [Slack.](http://angr.io/invite/)*
-->
---

**Describe the bug.**
<!--
Please include a clear and concise description of what the bug is.
-->
CFGFast fails to produce correct successors information when calling a plt function.
For example, I took a mips binary from karonte testset (TP-LINK TL-WA701ND_V2_140324):
```python
import angr

example = "./httpd"

proj = angr.Project(example, auto_load_libs=False)

cfg = proj.analyses.CFGFast(show_progressbar=True)

node1 = cfg.model.get_any_node(0x4544f0)
print(node1.successors)
print(node1.successors[0].name)

node2 = cfg.model.get_any_node(0x41c198)
print(node2.successors)
print(node2.successors[0].name)

```
This script generate following output:
```
[<CFGNode 0x4adcdc[44]>]
None
[<CFGNode strcmp [0]>]
strcmp
```
If we use Binary Ninja open the binary, we can see that these two blocks call `strcmp`, but the successor information is wrong.
Also `CFGNode.name` is missing for most of cases in mips binaries.
![image](https://user-images.githubusercontent.com/9366279/85999995-81b43b80-ba3f-11ea-92a2-b79539a279b2.png)
![image](https://user-images.githubusercontent.com/9366279/86000091-a4deeb00-ba3f-11ea-95a5-6299fa265e5b.png)


**Environment Information.**
<!--
Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
-->
```
angr environment report
=============================
Date: 2020-06-29 19:46:29.748095
Running in virtual environment at /home/angr/.virtualenvs/karonte3
Platform: linux-x86_64
Python version: 3.6.9 (default, Apr 18 2020, 01:56:04)
[GCC 8.4.0]
######## angr #########
Python found it in /mnt/data/karonte_proj/angr-dev/angr/angr
Pip version angr 8.20.6.1
Git info:
        Current commit a1a9b8630cd7026cfa1b39ab74ec74d191411b8d from branch master
        Checked out from remote origin: https://github.com/angr/angr
######## ailment #########
Python found it in /home/angr/.virtualenvs/karonte3/lib/python3.6/site-packages/ailment
Pip version ailment 8.20.6.8
Couldn't find git info
######## cle #########
Python found it in /mnt/data/karonte_proj/angr-dev/cle/cle
Pip version cle 8.20.6.1
Git info:
        Current commit d12e604bdb45f6d962378e2134292a80a1c05f1d from branch master
        Checked out from remote origin: https://github.com/angr/cle
######## pyvex #########
Python found it in /home/angr/.virtualenvs/karonte3/lib/python3.6/site-packages/pyvex
Pip version pyvex 8.20.6.8
Couldn't find git info
######## claripy #########
Python found it in /home/angr/.virtualenvs/karonte3/lib/python3.6/site-packages/claripy
Pip version claripy 8.20.6.8
Couldn't find git info
######## archinfo #########
Python found it in /home/angr/.virtualenvs/karonte3/lib/python3.6/site-packages/archinfo
Pip version archinfo 8.20.6.8
Couldn't find git info
######## z3 #########
Python found it in /home/angr/.virtualenvs/karonte3/lib/python3.6/site-packages/z3
Pip version z3-solver 4.8.8.0
Couldn't find git info
######## unicorn #########
Python found it in /home/angr/.virtualenvs/karonte3/lib/python3.6/site-packages/unicorn
Pip version unicorn 1.0.2rc4
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/mnt/data/karonte_proj/angr-dev/angr/angr/lib/angr_native.so', handle 1f998e0 at 0x7f12d21a7b38>
unicorn: <CDLL '/home/angr/.virtualenvs/karonte3/lib/python3.6/site-packages/unicorn/lib/libunicorn.so', handle 11667e0 at 0x7f12d111dbe0>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f12d2086668>
z3: <CDLL '/home/angr/.virtualenvs/karonte3/lib/python3.6/site-packages/z3/lib/libz3.so', handle 136a0c0 at 0x7f12cecf9f28>
```
**To Reproduce.**
<!--
Please include *both a script to reproduce the crash, and attach the binary used, if possible*
-->
The binary is provided here:
[httpd_wa701.zip](https://github.com/angr/angr/files/4845272/httpd_wa701.zip)

**Additional context.**
<!--
Add any other context about the problem here.
-->
This is maybe related to the `$gp` register, when calling a plt function, this register is involved, and CFGFast fails to generate correct information.



Discussion:
Another minor related bug here:
`CFGNode.name` returns `None` for many plt function but `proj.loader.describe_addr` works.
```
In[5]: n = cfg.get_any_node(0x514bf0)
In[6]: n
Out[6]: <CFGNode 0x514bf0[16]>
In[7]: print(n.name)
Out[7]: None
In[8]: proj.loader.describe_addr(0x514bf0)
Out[8]: 'PLT.strcmp+0x0 in httpd (0x514bf0)'
```

Resolving patch:
diff --git a/angr/analyses/cfg/cfg_fast.py b/angr/analyses/cfg/cfg_fast.py
--- a/angr/analyses/cfg/cfg_fast.py
+++ b/angr/analyses/cfg/cfg_fast.py
@@ -3692,7 +3692,6 @@ def _mips_determine_function_gp(self, addr: int, irsb: pyvex.IRSB, func_addr: in
                     break
             elif isinstance(stmt, pyvex.IRStmt.Put) and stmt.offset == self.project.arch.registers['gp'][0]:
                 last_gp_setting_insn_id = insn_ctr
-                break
 
         if last_gp_setting_insn_id is None:
             return None


Test patch: