Repository: angr/angr

Issue:
RuntimeError: ffi_prep_cif_var failed on x86_64 when trying to use unicorn
<!--
*Disclaimer:
The angr suite is maintained by a small team of volunteers.
While we cannot guarantee any timeliness for fixes and enhancements, we will do our best.
For more real-time help with angr, from us and the community, join our [Slack.](https://angr.io/invite/)*
-->
---

**Describe the bug.**
<!--
Please include a clear and concise description of what the bug is.
-->
Since angr 9.2.0, unicorn does not work on x86_64. It fails with `RuntimeError: ffi_prep_cif_var failed`


**Environment Information.**
<!--
Many common issues are caused by problems with the local Python environment.
Before submitting, double-check that your versions of all modules in the angr suite (angr, cle, pyvex, ...) are up to date.
Please include the output of `python -m angr.misc.bug_report` here.
-->

```
=============================
Date: 2022-05-04 10:49:00.922942
Running in virtual environment at .venv
Platform: linux-x86_64
Python version: 3.9.7 (default, Sep 10 2021, 14:59:43)
[GCC 11.2.0]
######## angr #########
Python found it in .venv/lib/python3.9/site-packages/angr
Pip version angr 9.2.1
Git info --- wrong, contained PII - stripped
######## ailment #########
Python found it in .venv/lib/python3.9/site-packages/ailment
Pip version ailment 9.2.1
Git info --- wrong, contained PII - stripped
######## cle #########
Python found it in .venv/lib/python3.9/site-packages/cle
Pip version cle 9.2.1
Git info --- wrong, contained PII - stripped
######## pyvex #########
Python found it in .venv/lib/python3.9/site-packages/pyvex
Pip version pyvex 9.2.1
Git info --- wrong, contained PII - stripped
######## claripy #########
Python found it in .venv/lib/python3.9/site-packages/claripy
Pip version claripy 9.2.1
Git info --- wrong, contained PII - stripped
######## archinfo #########
Python found it in .venv/lib/python3.9/site-packages/archinfo
Pip version archinfo 9.2.1
Git info --- wrong, contained PII - stripped
######## z3 #########
Python found it in .venv/lib/python3.9/site-packages/z3
Pip version z3-solver 4.8.16.0
Git info --- wrong, contained PII - stripped
######## unicorn #########
Python found it in .venv/lib/python3.9/site-packages/unicorn
Pip version unicorn 1.0.2rc4
Git info --- wrong, contained PII - stripped
######### Native Module Info ##########
angr: <CDLL '.venv/lib/python3.9/site-packages/angr/state_plugins/../lib/angr_native.so', handle 2bf5570 at 0x7ff2efbf7a60>
unicorn: <CDLL '.venv/lib/python3.9/site-packages/unicorn/lib/libunicorn.so', handle 249e640 at 0x7ff2f3fe8d60>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7ff2f4bdd310>
z3: NOT FOUND
```


**To Reproduce.**
<!--
Please include *both a script to reproduce the crash, and attach the binary used, if possible*
-->
Run https://github.com/angr/angr-doc/blob/9f803b24598bea3a0f9cc9c728e1465291b5259d/examples/tumctf2016_zwiebel/solve.py with angr >=9.2,<=9.2.2


**Additional context.**
```
Traceback (most recent call last):
  File "/tmp/solve.py", line 37, in <module>
    print(main())
  File "/tmp/solve.py", line 21, in main
    sm.run(n=20)
  File "/tmp/venv/lib/python3.9/site-packages/angr/sim_manager.py", line 298, in run
    self.step(stash=stash, **kwargs)
  File "/tmp/venv/lib/python3.9/site-packages/angr/sim_manager.py", line 383, in step
    successors = self.step_state(state, successor_func=successor_func, **run_args)
  File "/tmp/venv/lib/python3.9/site-packages/angr/sim_manager.py", line 423, in step_state
    successors = self.successors(state, successor_func=successor_func, **run_args)
  File "/tmp/venv/lib/python3.9/site-packages/angr/sim_manager.py", line 467, in successors
    return self._project.factory.successors(state, **run_args)
  File "/tmp/venv/lib/python3.9/site-packages/angr/factory.py", line 60, in successors
    return self.default_engine.process(*args, **kwargs)
  File "/tmp/venv/lib/python3.9/site-packages/angr/engines/vex/light/slicing.py", line 19, in process
    return super().process(*args, **kwargs)
  File "/tmp/venv/lib/python3.9/site-packages/angr/engines/engine.py", line 158, in process
    self.process_successors(self.successors, **kwargs)
  File "/tmp/venv/lib/python3.9/site-packages/angr/engines/failure.py", line 21, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/tmp/venv/lib/python3.9/site-packages/angr/engines/syscall.py", line 18, in process_successors
    return super().process_successors(successors, **kwargs)
  File "/tmp/venv/lib/python3.9/site-packages/angr/engines/hook.py", line 54, in process_successors
    return super().process_successors(successors, procedure=procedure, **kwargs)
  File "/tmp/venv/lib/python3.9/site-packages/angr/engines/unicorn.py", line 338, in process_successors
    state.unicorn.setup()
  File "/tmp/venv/lib/python3.9/site-packages/angr/state_plugins/unicorn_engine.py", line 1100, in setup
    self._uc_state = _UC_NATIVE.alloc(self.uc._uch, self.cache_key, simos_val, handle_symb_addrs, handle_symb_conds)
RuntimeError: ffi_prep_cif_var failed
```


Discussion:

Resolving patch:
diff --git a/angr/state_plugins/unicorn_engine.py b/angr/state_plugins/unicorn_engine.py
--- a/angr/state_plugins/unicorn_engine.py
+++ b/angr/state_plugins/unicorn_engine.py
@@ -408,7 +408,7 @@ def _setup_prototype_explicit(handle, func, restype, *argtypes):
             getattr(handle, func).argtypes = argtypes
 
         #_setup_prototype_explicit(h, 'logSetLogLevel', None, ctypes.c_uint64)
-        _setup_prototype(h, 'alloc', state_t, uc_engine_t, ctypes.c_uint64, ctypes.c_uint64, ctypes.c_bool)
+        _setup_prototype(h, 'alloc', state_t, uc_engine_t, ctypes.c_uint64, ctypes.c_uint64, ctypes.c_bool, ctypes.c_bool)
         _setup_prototype(h, 'dealloc', None, state_t)
         _setup_prototype(h, 'hook', None, state_t)
         _setup_prototype(h, 'unhook', None, state_t)


Test patch: