Comments (6)
It probably means that your computer ran out of ram, and the angr process was killed by your operating system.
from angr-doc.
Many thanks for your reply.
I thought of another similar question.
As the SoK paper demonstrates, angr implements the dynamic symbolic execution as Mayhem.
To my knowledge, Mayhem set a checkpoint to check the number of executors. If the number of executors exceeds the configured number, then Mayhem will not fork to generate new executors.
I am wandering, could I set the number of maximum executors when running the DSE in angr?
Thanks.
from angr-doc.
It's been a while since I've read Mayhem, but this question is talking about concurrency in the symbolic executor, right?
angr does not use concurrency by default. This is because python code is very very hard to parallelize correctly. There is a threading mixin that you can enable for a path group with a defined number of worker threads, but this is only useful for paths that take a long time in the constraint solving phase, since only one thread can be running python code (as opposed to C code) at once due to the GIL. The code to enable this mixin is path_group.use_technique(angr.exploration_techniques.Threading(num_threads)
.
from angr-doc.
Sorry, I did mean the concurrency.
For the problem of ram exhausting I encountered, the reason should be the number of paths or states are very large, say path explosion.
To address the path explosion problem, Mayhem employs a checkpoint to check whether the number of states has exceeded the threshold. If so, Mayhem will not generate new paths or states. Instead, Mayhem will generate a concrete input and store it into the disk. Whenever the ram is not busy, then Mayhem reloads the concrete the input, and performs a trace-based dynamic symbolic execution.
As the demonstration in the paper of Mayhem, there should not be the problem of space explosion as I encountered, with the cost that Mayhem may run a long time.
Is my understanding right?
from angr-doc.
I can't comment on your understanding of Mayhem other than to say it sounds about right.
Our implementation of Mayhem is not publicly available, but it was written a pretty long time ago - these days, it might be pretty trivial to re-implement using the new Exploration Technique (also known as "otiegnqwvk") interface. The Threading mixin I showed you earlier is an otiegnqwvk.
One simple solution to the out-of-memory problem is the depth-first search otiegnqwvk, found in angr.exploration_techniques.DFS
. The default path group behavior is to keep all active paths and step every active path at each step, clearly leading to an OOM unless you deal with it, so using DFS is a cheap way to only use O(n) memory, where n is the length of the longest path.
The DFS is obviously pretty primitive, but if you wanted to write a more complicated otiegnqwvk it's a good place to start. The full otiegnqwvk API reference is here: http://angr.io/api-doc/angr.html#angr.exploration_techniques.ExplorationTechnique
One thing to keep in mind is that veritesting is also implemented as an otiegnqwvk. Multiple otiegnqwvks can be applied to a single path group and their affects will combine, but the results can be unexpected.
I hope all this was helpful! Please let me know if you have any more specific questions about writing otiegnqwvks or using angr efficiently.
from angr-doc.
Thank you very much, Andrew.
All your comments make sense.
from angr-doc.
Related Issues (20)
- Unexpected behaviour between different versions while analyzing "beginner" binary HOT 1
- [help] why no solutions?
- why input length must multiply 4 in examples/b01lersctf2020_little_engine HOT 1
- Question: BVS, bytes, ASCII, constraints HOT 3
- Resolve automatically HOT 15
- Remove references to Layer7 and other Surveyor solves HOT 1
- CFG Emulated "None type" Node HOT 2
- Swapped find and avoid on sim_mgr.explore when using argv claripy HOT 1
- where can i find the source code of the folder "example"? HOT 1
- little_engine example not working for me HOT 9
- Error/inconsistency handling arm code between angr versions
- Add concatenating constraints to cheatsheet HOT 2
- insomnihack fail to find a symbolic buffer HOT 2
- `test_apidoc.test_lint_docstrings` fails under python 3.8 HOT 5
- `test_examples.test_defcon2016quals_baby_re` is timing out in CI HOT 3
- Testing the java_androidnative1 example failed with error HOT 3
- Move API docs to project repos. HOT 5
- Install information is out of date and sometimes incorrect HOT 1
- Migrate gitbook docs to api docs HOT 1
- driller's approach page cannot find HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from angr-doc.