From 6361eb407ac3899beb130f2b8136afe5a04ac6b2 Mon Sep 17 00:00:00 2001 From: Kevin Phoenix Date: Mon, 18 Dec 2023 15:08:45 -0700 Subject: [PATCH 1/2] Comment out overly-generic function prologs and epliogs for riscv --- angr_platforms/risc_v/arch_riscv.py | 42 +++++++++++++++++------------ 1 file changed, 25 insertions(+), 17 deletions(-) diff --git a/angr_platforms/risc_v/arch_riscv.py b/angr_platforms/risc_v/arch_riscv.py index 588b9f9..403c8d3 100644 --- a/angr_platforms/risc_v/arch_riscv.py +++ b/angr_platforms/risc_v/arch_riscv.py @@ -68,23 +68,31 @@ def __init__(self, endness=Endness.LE): max_inst_bytes = 4 instruction_alignment = 4 persistent_regs = [] - function_prologs = { - br'[\x00-\xff][\x00-\xf1]\x01\x13', - # addi sp, sp, xxx - # 0b000000000000_00010_000_00010_0010011 0x00010113 - # 0b111111111111_00010_000_00010_0010011 0xfff10113 - br'[\x00-\xff][\x00-\xf1][\x20-\x2f][\x23-\xa3]' - # sw xx, xx(sp) - # 0b0000000_00000_00010_010_00000_0100011 0x00012023 - # 0b1111111_11111_00010_010_11111_0100011 0xfff12fa3 - } - function_epilogs = { - br'[\x00-\xff][\x00-\xf1][\x20-\x2f][\x23-\x83]', - # ld xx, xx(sp) - # 0b0000000_00000_00010_010_00000_0000011 0x00012003 - # 0b1111111_11111_00010_010_11111_0000011 0xfff12f83 - br'[\x00-\xff][\x00-\xf1]\x01\x13' # addi sp, sp, xxx - } + # These prologs and eplilogs had to be commented out because they are a bit + # too generic and match a log of false positives. This has the effect of + # poisoning the BoyScout analysis in angr when used for any other arch. + # If you need this, please uncomment and add more specific regexes if + # possible, or open an issue on github to discuss. + # + # function_prologs = { + # br'[\x00-\xff][\x00-\xf1]\x01\x13', + # # addi sp, sp, xxx + # # 0b000000000000_00010_000_00010_0010011 0x00010113 + # # 0b111111111111_00010_000_00010_0010011 0xfff10113 + # br'[\x00-\xff][\x00-\xf1][\x20-\x2f][\x23-\xa3]' + # # sw xx, xx(sp) + # # 0b0000000_00000_00010_010_00000_0100011 0x00012023 + # # 0b1111111_11111_00010_010_11111_0100011 0xfff12fa3 + # } + # function_epilogs = { + # br'[\x00-\xff][\x00-\xf1][\x20-\x2f][\x23-\x83]', + # # ld xx, xx(sp) + # # 0b0000000_00000_00010_010_00000_0000011 0x00012003 + # # 0b1111111_11111_00010_010_11111_0000011 0xfff12f83 + # br'[\x00-\xff][\x00-\xf1]\x01\x13' # addi sp, sp, xxx + # } + function_prologs = set() + function_epilogs = set() ret_instruction = b'\x00\x00\x80\x67' nop_instruction = b'\x13\x00\x00\x00' From dd9b0af5dc73793a830bb3c1552e492c5b7e24aa Mon Sep 17 00:00:00 2001 From: Kevin Phoenix Date: Mon, 18 Dec 2023 15:18:04 -0700 Subject: [PATCH 2/2] Fix typos --- angr_platforms/risc_v/arch_riscv.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/angr_platforms/risc_v/arch_riscv.py b/angr_platforms/risc_v/arch_riscv.py index 403c8d3..74d6894 100644 --- a/angr_platforms/risc_v/arch_riscv.py +++ b/angr_platforms/risc_v/arch_riscv.py @@ -69,7 +69,7 @@ def __init__(self, endness=Endness.LE): instruction_alignment = 4 persistent_regs = [] # These prologs and eplilogs had to be commented out because they are a bit - # too generic and match a log of false positives. This has the effect of + # too generic and match a lot of false positives. This has the effect of # poisoning the BoyScout analysis in angr when used for any other arch. # If you need this, please uncomment and add more specific regexes if # possible, or open an issue on github to discuss.