def run_vfg_0(arch):
    proj = angr.Project(os.path.join(os.path.join(test_location, arch), "basic_buffer_overflows"),
                 use_sim_procedures=True,
                 default_analysis_mode='symbolic')

    cfg = proj.analyses.CFG(context_sensitivity_level=1)

    # For this test case, OPTIMIZE_IR does not work due to the way we are widening the states: an index variable
    # directly goes to 0xffffffff, and when OPTIMIZE_IR is used, it does a signed comparison with 0x27, which
    # eventually leads to the merged index variable covers all negative numbers and [0, 27]. This analysis result is
    # correct but not accurate, and we suffer from it in this test case.
    # The ultimate solution is to widen more carefully, or implement lookahead widening support.
    # TODO: Solve this issue later

    start = time.time()
    function_start = vfg_0_addresses[arch]
    vfg = proj.analyses.VFG(cfg, function_start=function_start, context_sensitivity_level=2, interfunction_level=4,
                            remove_options={ simuvex.s_options.OPTIMIZE_IR }
                            )
    end = time.time()
    duration = end - start

    l.info("VFG generation done in %f seconds.", duration)

    # TODO: These are very weak conditions. Make them stronger!
    nose.tools.assert_greater(len(vfg.final_states), 0)
    states = vfg.final_states
    nose.tools.assert_equal(len(states), 2)
    stack_check_fail = proj._extern_obj.get_pseudo_addr('symbol hook: __stack_chk_fail')
    nose.tools.assert_equal(set([ s.se.exactly_int(s.ip) for s in states ]),
                            {
                                stack_check_fail,
                                0x4005b4
                            })

    state = [ s for s in states if s.se.exactly_int(s.ip) == 0x4005b4 ][0]
    nose.tools.assert_true(claripy.backends.vsa.is_true(state.stack_read(12, 4) >= 0x28))
dataset/ETHPy150Open angr/angr/tests/test_vfg.py/run_vfg_0/original