Skip to content

Stack pointer in Atom.from_argument is improperly null with SimStackArg arguments when --rust is used. #6536

Description

@Windows81

Description

Command-line usage without the --rust flag does not error, and instead produces decompiled code. Appears to be a shortcoming with Oxidizer.

Per string analysis in IDA Pro, I can conclude that the StudioMCP.exe program was compiled with Rust. However, it didn't quite fit the qualifications for IDA to recognise as a Rust executable.

Steps to reproduce the bug

  1. Download https://archive.org/download/rblxstudio_live_version_3da9d00a092c4d59/LIVE-WindowsStudio64-version-3da9d00a092c4d59.zip/StudioMCP.exe
  2. angr dec "C:\Users\USER\Downloads\StudioMCP.exe"

Logs

ERROR    | 2026-06-23 23:22:10,860 | angr.state_plugins.unicorn_engine | failed loading "unicornlib.dll", unicorn support disabled ('NoneType' object has no attribute 'unicorn_py3')
ERROR    Unable to translate bytecode
ERROR    Unsupported Dirty amd64g_dirtyhelper_OUT.
Traceback (most recent call last):
  File "<frozen runpy>", line 203, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Scripts\angr.exe\__main__.py", line 5, in <module>
    sys.exit(main())
             ~~~~^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\__main__.py", line 584, in main
    args.func(args)
    ~~~~~~~~~^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\__main__.py", line 299, in decompile
    proj.analyses.CompleteCallingConventions(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        analyze_callsites=args.cca_callsites,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        progress_callback=progress_cb,  # pyright: ignore[reportCallIssue]
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\analysis.py", line 258, in __call__
    r = w(*args, **kwargs)
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\analysis.py", line 243, in wrapper
    oself.__init__(*args, **kwargs)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\complete_calling_conventions.py", line 138, in __init__
    self.work()
    ~~~~~~~~~^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\complete_calling_conventions.py", line 231, in work
    cc, proto, proto_libname, proto_source, _ = self._analyze_core(func_addr)
                                                ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\complete_calling_conventions.py", line 421, in _analyze_core
    cc_analysis = self.project.analyses[CallingConventionAnalysis].prep(kb=self.kb)(
        func,
    ...<4 lines>...
        collect_facts_arg_passthru=self.mode == CallingConventionAnalysisMode.FASTISH,
    )
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\analysis.py", line 243, in wrapper
    oself.__init__(*args, **kwargs)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\calling_convention\calling_convention.py", line 161, in __init__
    self._analyze()
    ~~~~~~~~~~~~~^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\calling_convention\calling_convention.py", line 290, in _analyze
    callsite_facts = self._extract_and_analyze_callsites(max_analyzing_callsites=3)
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\calling_convention\calling_convention.py", line 600, in _extract_and_analyze_callsites
    fact = self._analyze_callsite(
        caller.addr,
    ...<2 lines>...
        include_preds=include_callsite_preds,
    )
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\calling_convention\calling_convention.py", line 531, in _analyze_callsite
    rda = self.project.analyses[ReachingDefinitionsAnalysis].prep()(
        func,
        func_graph=subgraph,
        observation_points=observation_points,
    )
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\analysis.py", line 243, in wrapper
    oself.__init__(*args, **kwargs)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\reaching_definitions\reaching_definitions.py", line 205, in __init__
    self._analyze()
    ~~~~~~~~~~~~~^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\forward_analysis\forward_analysis.py", line 279, in _analyze
    self._analysis_core_graph()
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\forward_analysis\forward_analysis.py", line 297, in _analysis_core_graph
    changed, output_state = self._run_on_node(n, job_state)
                            ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\reaching_definitions\reaching_definitions.py", line 531, in _run_on_node
    state = engine.process(
        state,
    ...<4 lines>...
        model=self.model,
    )
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\reaching_definitions\engine_vex.py", line 69, in process
    return super().process(
           ~~~~~~~~~~~~~~~^
        state,
        ^^^^^^
        whitelist=whitelist,
        ^^^^^^^^^^^^^^^^^^^^
        block=block,
        ^^^^^^^^^^^^
    )
    ^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\engines\light\engine.py", line 278, in process
    result = self._process_block(whitelist=whitelist)
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\engines\light\engine.py", line 301, in _process_block
    return self._process_block_end(result, whitelist)
           ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\reaching_definitions\engine_vex.py", line 90, in _process_block_end
    self._handle_function(addr)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\reaching_definitions\engine_vex.py", line 1122, in _handle_function
    self._function_handler.handle_function(self.state, data)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\reaching_definitions\function_handler.py", line 407, in handle_function
    args_atoms_from_values = data.reset_prototype(data.prototype, state, soft_reset=True)
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\reaching_definitions\function_handler.py", line 214, in reset_prototype
    self.ret_atoms = FunctionHandler.c_return_as_atoms(state, self.cc, self.prototype)
                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\analyses\reaching_definitions\function_handler.py", line 624, in c_return_as_atoms
    Atom.from_argument(footprint_arg, state.arch, full_reg=True)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\USER\AppData\Local\Python\pythoncore-3.14-64\Lib\site-packages\angr\knowledge_plugins\key_definitions\atoms.py", line 86, in from_argument
    raise ValueError("You must provide a stack pointer to translate a SimStackArg")
ValueError: You must provide a stack pointer to translate a SimStackArg

Metadata

Metadata

Assignees

Labels

bugSomething is broken

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions