We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
SimSegfaultException due to collision of stack and heap when tracing a binary
**Describe the bug.**

When tracing a CGC binary using a PoV for it, a `SimSegfaultException` is raised due to the collision of stack and heap.

**Environment Information.**

Platform: linux-x86_64
Python version: 3.8.5 (default, Jan 27 2021, 15:41:15) 
[GCC 9.3.0]
######## angr #########
Python found it in /home/dnivra/angr-dev/angr/angr
Pip version angr 9.0.gitrolling
Git info:
        Current commit 762becbf9c66d4798b8c23cfa512a7f893e2bcf9 from branch master
        Checked out from remote origin: https://github.com/angr/angr
######## ailment #########
Python found it in /home/dnivra/angr-dev/ailment/ailment
Pip version ailment 9.0.gitrolling
Git info:
        Current commit 4e2bba6f0299d1eda6ae570ceabd91eb8a0c72be from branch master
        Checked out from remote origin: https://github.com/angr/ailment
######## cle #########
Python found it in /home/dnivra/angr-dev/cle/cle
Pip version cle 9.0.gitrolling
Git info:
        Current commit 80dcd50abfaa70cbd5b2e360fe41b71406acbfb4 from branch master
        Checked out from remote origin: https://github.com/angr/cle
######## pyvex #########
Python found it in /home/dnivra/angr-dev/pyvex/pyvex
Pip version pyvex 9.0.gitrolling
Git info:
        Current commit 969ec1f10d3e3b15407ee986052aa4b6f2e9df05 from branch master
        Checked out from remote origin: https://github.com/angr/pyvex
######## claripy #########
Python found it in /home/dnivra/angr-dev/claripy/claripy
Pip version claripy 9.0.gitrolling
Git info:
        Current commit 34f31c487f7453f4666cd6fd1d529f417ff6ca08 from branch master
        Checked out from remote origin: https://github.com/angr/claripy
######## archinfo #########
Python found it in /home/dnivra/angr-dev/archinfo/archinfo
Pip version archinfo 9.0.gitrolling
Git info:
        Current commit 437b194538ccb0bf118b4b674613b88832b0b342 from branch master
        Checked out from remote origin: https://github.com/angr/archinfo
######## z3 #########
Python found it in /home/dnivra/.virtualenvs/angr-dev/lib/python3.8/site-packages/z3
Pip version z3-solver 4.8.9.0
Couldn't find git info
######## unicorn #########
Python found it in /home/dnivra/.virtualenvs/angr-dev/lib/python3.8/site-packages/unicorn
Pip version unicorn 1.0.2rc4
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/home/dnivra/angr-dev/angr/angr/lib/angr_native.so', handle 3375570 at 0x7f938b7ee220>
unicorn: <CDLL '/home/dnivra/.virtualenvs/angr-dev/lib/python3.8/site-packages/unicorn/lib/libunicorn.so', handle 2aa9f70 at 0x7f93913291c0>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f9391f39130>
z3: <CDLL '/home/dnivra/.virtualenvs/angr-dev/lib/python3.8/site-packages/z3/lib/libz3.so', handle 2d099d0 at 0x7f938ea3a340>

**To Reproduce.**

[CROMU_00004-stack-heap-collision-repro.zip](https://github.com/angr/angr/files/6481681/CROMU_00004-stack-heap-collision-repro.zip) has script, input and binary to reproduce the issue. `SimSegfaultException` is raised in the `receive` syscall after block 0x804b87b is executed for first time in the VEX engine(13th overall execution). It takes about 10 minutes for execution to reach this location

.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `angr/simos/cgc.py`
Content:
```
1 import logging
2 
3 import claripy
4 from cle import BackedCGC
5 
6 from ..procedures import SIM_LIBRARIES as L
7 from ..state_plugins import SimActionData
8 from .. import sim_options as o
9 from .userland import SimUserland
10 
11 _l = logging.getLogger(name=__name__)
12 
13 
14 class SimCGC(SimUserland):
15     """
16     Environment configuration for the CGC DECREE platform
17     """
18 
19     def __init__(self, project, **kwargs):
20         super(SimCGC, self).__init__(project,
21                 syscall_library=L['cgcabi'],
22                 syscall_addr_alignment=1,
23                 name="CGC",
24                 **kwargs)
25 
26     # pylint: disable=arguments-differ
27     def state_blank(self, flag_page=None, **kwargs):
28         """
29         :param flag_page:   Flag page content, either a string or a list of BV8s
30         """
31         # default stack as specified in the cgc abi
32         if kwargs.get('stack_end', None) is None:
33             kwargs['stack_end'] = 0xbaaab000
34         if kwargs.get('stack_size', None) is None:
35             kwargs['stack_size'] = 1024*1024*8
36 
37         s = super(SimCGC, self).state_blank(**kwargs)  # pylint:disable=invalid-name
38 
39         # pre-grow the stack by 20 pages. unsure if this is strictly required or just a hack around a compiler bug
40         if hasattr(s.memory, 'allocate_stack_pages'):
41             s.memory.allocate_stack_pages(kwargs['stack_end'] - 1, 20 * 0x1000)
42 
43         # Map the flag page
44         if o.ABSTRACT_MEMORY not in s.options:
45             s.memory.map_region(0x4347c000, 4096, 1)
46 
47         # Create the CGC plugin
48         s.get_plugin('cgc')
49 
50         # Set up the flag page
51         if flag_page is None:
52             flag_page = [s.solver.BVS("cgc-flag-byte-%d" % i, 8, key=('flag', i), eternal=True) for i in range(0x1000)]
53         elif type(flag_page) is bytes:
54             flag_page = [s.solver.BVV(c, 8) for c in flag_page]
55         elif type(flag_page) is list:
56             pass
57         else:
58             raise ValueError("Bad flag page: expected None, bytestring, or list, but got %s" % type(flag_page))
59 
60         s.cgc.flag_bytes = flag_page
61         if s.mode != 'static':
62             s.memory.store(0x4347c000, claripy.Concat(*s.cgc.flag_bytes), priv=True)
63 
64         # set up the address for concrete transmits
65         s.unicorn.transmit_addr = self.syscall_from_number(2).addr
66 
67         s.libc.max_str_len = 1000000
68         s.libc.max_strtol_len = 10
69         s.libc.max_memcpy_size = 0x100000
70         s.libc.max_buffer_size = 0x100000
71 
72         return s
73 
74     def state_entry(self, add_options=None, **kwargs):
75         if isinstance(self.project.loader.main_object, BackedCGC):
76             kwargs['permissions_backer'] = (True, self.project.loader.main_object.permissions_map)
77         if add_options is None:
78             add_options = set()
79         add_options.add(o.ZERO_FILL_UNCONSTRAINED_MEMORY)
80 
81         state = super(SimCGC, self).state_entry(add_options=add_options, **kwargs)
82 
83         if isinstance(self.project.loader.main_object, BackedCGC):
84             # Update allocation base
85             state.cgc.allocation_base = self.project.loader.main_object.current_allocation_base
86 
87             # Do all the writes
88             writes_backer = self.project.loader.main_object.writes_backer
89             stdout = state.posix.get_fd(1)
90             pos = 0
91             for size in writes_backer:
92                 if size == 0:
93                     continue
94                 str_to_write = state.solver.BVS('file_write', size*8)
95                 a = SimActionData(
96                         state,
97                         'file_1_0',
98                         'write',
99                         addr=claripy.BVV(pos, state.arch.bits),
100                         data=str_to_write,
101                         size=size)
102                 stdout.write_data(str_to_write)
103                 state.history.add_action(a)
104                 pos += size
105 
106         else:
107             # Set CGC-specific variables
108             state.regs.eax = 0
109             state.regs.ebx = 0
110             state.regs.ecx = 0x4347c000
111             state.regs.edx = 0
112             state.regs.edi = 0
113             state.regs.esi = 0
114             state.regs.esp = 0xbaaaaffc
115             state.regs.ebp = 0
116             state.regs.cc_dep1 = 0x202  # default eflags
117             state.regs.cc_op = 0  # OP_COPY
118             state.regs.cc_dep2 = 0  # doesn't matter
119             state.regs.cc_ndep = 0  # doesn't matter
120 
121             # fpu values
122             state.regs.mm0 = 0
123             state.regs.mm1 = 0
124             state.regs.mm2 = 0
125             state.regs.mm3 = 0
126             state.regs.mm4 = 0
127             state.regs.mm5 = 0
128             state.regs.mm6 = 0
129             state.regs.mm7 = 0
130             state.regs.fpu_tags = 0
131             state.regs.fpround = 0
132             state.regs.fc3210 = 0x0300
133             state.regs.ftop = 0
134 
135             # sse values
136             state.regs.sseround = 0
137             state.regs.xmm0 = 0
138             state.regs.xmm1 = 0
139             state.regs.xmm2 = 0
140             state.regs.xmm3 = 0
141             state.regs.xmm4 = 0
142             state.regs.xmm5 = 0
143             state.regs.xmm6 = 0
144             state.regs.xmm7 = 0
145 
146             # segmentation registers
147             state.regs.ds = 0
148             state.regs.es = 0
149             state.regs.fs = 0
150             state.regs.gs = 0
151             state.regs.ss = 0
152             state.regs.cs = 0
153 
154         return state
155
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/angr/simos/cgc.py b/angr/simos/cgc.py
--- a/angr/simos/cgc.py
+++ b/angr/simos/cgc.py
@@ -24,9 +24,10 @@
                 **kwargs)
 
     # pylint: disable=arguments-differ
-    def state_blank(self, flag_page=None, **kwargs):
+    def state_blank(self, flag_page=None, allocate_stack_page_count=0x100, **kwargs):
         """
-        :param flag_page:   Flag page content, either a string or a list of BV8s
+        :param flag_page:                   Flag page content, either a string or a list of BV8s
+        :param allocate_stack_page_count:   Number of pages to pre-allocate for stack
         """
         # default stack as specified in the cgc abi
         if kwargs.get('stack_end', None) is None:
@@ -36,9 +37,9 @@
 
         s = super(SimCGC, self).state_blank(**kwargs)  # pylint:disable=invalid-name
 
-        # pre-grow the stack by 20 pages. unsure if this is strictly required or just a hack around a compiler bug
+        # pre-grow the stack. unsure if this is strictly required or just a hack around a compiler bug
         if hasattr(s.memory, 'allocate_stack_pages'):
-            s.memory.allocate_stack_pages(kwargs['stack_end'] - 1, 20 * 0x1000)
+            s.memory.allocate_stack_pages(kwargs['stack_end'] - 1, allocate_stack_page_count * 0x1000)
 
         # Map the flag page
         if o.ABSTRACT_MEMORY not in s.options:

{"golden_diff": "diff --git a/angr/simos/cgc.py b/angr/simos/cgc.py\n--- a/angr/simos/cgc.py\n+++ b/angr/simos/cgc.py\n@@ -24,9 +24,10 @@\n                 **kwargs)\n \n     # pylint: disable=arguments-differ\n-    def state_blank(self, flag_page=None, **kwargs):\n+    def state_blank(self, flag_page=None, allocate_stack_page_count=0x100, **kwargs):\n         \"\"\"\n-        :param flag_page:   Flag page content, either a string or a list of BV8s\n+        :param flag_page:                   Flag page content, either a string or a list of BV8s\n+        :param allocate_stack_page_count:   Number of pages to pre-allocate for stack\n         \"\"\"\n         # default stack as specified in the cgc abi\n         if kwargs.get('stack_end', None) is None:\n@@ -36,9 +37,9 @@\n \n         s = super(SimCGC, self).state_blank(**kwargs)  # pylint:disable=invalid-name\n \n-        # pre-grow the stack by 20 pages. unsure if this is strictly required or just a hack around a compiler bug\n+        # pre-grow the stack. unsure if this is strictly required or just a hack around a compiler bug\n         if hasattr(s.memory, 'allocate_stack_pages'):\n-            s.memory.allocate_stack_pages(kwargs['stack_end'] - 1, 20 * 0x1000)\n+            s.memory.allocate_stack_pages(kwargs['stack_end'] - 1, allocate_stack_page_count * 0x1000)\n \n         # Map the flag page\n         if o.ABSTRACT_MEMORY not in s.options:\n", "issue": "SimSegfaultException due to collision of stack and heap when tracing a binary\n**Describe the bug.**\r\n\r\nWhen tracing a CGC binary using a PoV for it, a `SimSegfaultException` is raised due to the collision of stack and heap.\r\n\r\n**Environment Information.**\r\n\r\nPlatform: linux-x86_64\r\nPython version: 3.8.5 (default, Jan 27 2021, 15:41:15) \r\n[GCC 9.3.0]\r\n######## angr #########\r\nPython found it in /home/dnivra/angr-dev/angr/angr\r\nPip version angr 9.0.gitrolling\r\nGit info:\r\n        Current commit 762becbf9c66d4798b8c23cfa512a7f893e2bcf9 from branch master\r\n        Checked out from remote origin: https://github.com/angr/angr\r\n######## ailment #########\r\nPython found it in /home/dnivra/angr-dev/ailment/ailment\r\nPip version ailment 9.0.gitrolling\r\nGit info:\r\n        Current commit 4e2bba6f0299d1eda6ae570ceabd91eb8a0c72be from branch master\r\n        Checked out from remote origin: https://github.com/angr/ailment\r\n######## cle #########\r\nPython found it in /home/dnivra/angr-dev/cle/cle\r\nPip version cle 9.0.gitrolling\r\nGit info:\r\n        Current commit 80dcd50abfaa70cbd5b2e360fe41b71406acbfb4 from branch master\r\n        Checked out from remote origin: https://github.com/angr/cle\r\n######## pyvex #########\r\nPython found it in /home/dnivra/angr-dev/pyvex/pyvex\r\nPip version pyvex 9.0.gitrolling\r\nGit info:\r\n        Current commit 969ec1f10d3e3b15407ee986052aa4b6f2e9df05 from branch master\r\n        Checked out from remote origin: https://github.com/angr/pyvex\r\n######## claripy #########\r\nPython found it in /home/dnivra/angr-dev/claripy/claripy\r\nPip version claripy 9.0.gitrolling\r\nGit info:\r\n        Current commit 34f31c487f7453f4666cd6fd1d529f417ff6ca08 from branch master\r\n        Checked out from remote origin: https://github.com/angr/claripy\r\n######## archinfo #########\r\nPython found it in /home/dnivra/angr-dev/archinfo/archinfo\r\nPip version archinfo 9.0.gitrolling\r\nGit info:\r\n        Current commit 437b194538ccb0bf118b4b674613b88832b0b342 from branch master\r\n        Checked out from remote origin: https://github.com/angr/archinfo\r\n######## z3 #########\r\nPython found it in /home/dnivra/.virtualenvs/angr-dev/lib/python3.8/site-packages/z3\r\nPip version z3-solver 4.8.9.0\r\nCouldn't find git info\r\n######## unicorn #########\r\nPython found it in /home/dnivra/.virtualenvs/angr-dev/lib/python3.8/site-packages/unicorn\r\nPip version unicorn 1.0.2rc4\r\nCouldn't find git info\r\n######### Native Module Info ##########\r\nangr: <CDLL '/home/dnivra/angr-dev/angr/angr/lib/angr_native.so', handle 3375570 at 0x7f938b7ee220>\r\nunicorn: <CDLL '/home/dnivra/.virtualenvs/angr-dev/lib/python3.8/site-packages/unicorn/lib/libunicorn.so', handle 2aa9f70 at 0x7f93913291c0>\r\npyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7f9391f39130>\r\nz3: <CDLL '/home/dnivra/.virtualenvs/angr-dev/lib/python3.8/site-packages/z3/lib/libz3.so', handle 2d099d0 at 0x7f938ea3a340>\r\n\r\n**To Reproduce.**\r\n\r\n[CROMU_00004-stack-heap-collision-repro.zip](https://github.com/angr/angr/files/6481681/CROMU_00004-stack-heap-collision-repro.zip) has script, input and binary to reproduce the issue. `SimSegfaultException` is raised in the `receive` syscall after block 0x804b87b is executed for first time in the VEX engine(13th overall execution). It takes about 10 minutes for execution to reach this location\r\n\r\n.\n", "before_files": [{"content": "import logging\n\nimport claripy\nfrom cle import BackedCGC\n\nfrom ..procedures import SIM_LIBRARIES as L\nfrom ..state_plugins import SimActionData\nfrom .. import sim_options as o\nfrom .userland import SimUserland\n\n_l = logging.getLogger(name=__name__)\n\n\nclass SimCGC(SimUserland):\n    \"\"\"\n    Environment configuration for the CGC DECREE platform\n    \"\"\"\n\n    def __init__(self, project, **kwargs):\n        super(SimCGC, self).__init__(project,\n                syscall_library=L['cgcabi'],\n                syscall_addr_alignment=1,\n                name=\"CGC\",\n                **kwargs)\n\n    # pylint: disable=arguments-differ\n    def state_blank(self, flag_page=None, **kwargs):\n        \"\"\"\n        :param flag_page:   Flag page content, either a string or a list of BV8s\n        \"\"\"\n        # default stack as specified in the cgc abi\n        if kwargs.get('stack_end', None) is None:\n            kwargs['stack_end'] = 0xbaaab000\n        if kwargs.get('stack_size', None) is None:\n            kwargs['stack_size'] = 1024*1024*8\n\n        s = super(SimCGC, self).state_blank(**kwargs)  # pylint:disable=invalid-name\n\n        # pre-grow the stack by 20 pages. unsure if this is strictly required or just a hack around a compiler bug\n        if hasattr(s.memory, 'allocate_stack_pages'):\n            s.memory.allocate_stack_pages(kwargs['stack_end'] - 1, 20 * 0x1000)\n\n        # Map the flag page\n        if o.ABSTRACT_MEMORY not in s.options:\n            s.memory.map_region(0x4347c000, 4096, 1)\n\n        # Create the CGC plugin\n        s.get_plugin('cgc')\n\n        # Set up the flag page\n        if flag_page is None:\n            flag_page = [s.solver.BVS(\"cgc-flag-byte-%d\" % i, 8, key=('flag', i), eternal=True) for i in range(0x1000)]\n        elif type(flag_page) is bytes:\n            flag_page = [s.solver.BVV(c, 8) for c in flag_page]\n        elif type(flag_page) is list:\n            pass\n        else:\n            raise ValueError(\"Bad flag page: expected None, bytestring, or list, but got %s\" % type(flag_page))\n\n        s.cgc.flag_bytes = flag_page\n        if s.mode != 'static':\n            s.memory.store(0x4347c000, claripy.Concat(*s.cgc.flag_bytes), priv=True)\n\n        # set up the address for concrete transmits\n        s.unicorn.transmit_addr = self.syscall_from_number(2).addr\n\n        s.libc.max_str_len = 1000000\n        s.libc.max_strtol_len = 10\n        s.libc.max_memcpy_size = 0x100000\n        s.libc.max_buffer_size = 0x100000\n\n        return s\n\n    def state_entry(self, add_options=None, **kwargs):\n        if isinstance(self.project.loader.main_object, BackedCGC):\n            kwargs['permissions_backer'] = (True, self.project.loader.main_object.permissions_map)\n        if add_options is None:\n            add_options = set()\n        add_options.add(o.ZERO_FILL_UNCONSTRAINED_MEMORY)\n\n        state = super(SimCGC, self).state_entry(add_options=add_options, **kwargs)\n\n        if isinstance(self.project.loader.main_object, BackedCGC):\n            # Update allocation base\n            state.cgc.allocation_base = self.project.loader.main_object.current_allocation_base\n\n            # Do all the writes\n            writes_backer = self.project.loader.main_object.writes_backer\n            stdout = state.posix.get_fd(1)\n            pos = 0\n            for size in writes_backer:\n                if size == 0:\n                    continue\n                str_to_write = state.solver.BVS('file_write', size*8)\n                a = SimActionData(\n                        state,\n                        'file_1_0',\n                        'write',\n                        addr=claripy.BVV(pos, state.arch.bits),\n                        data=str_to_write,\n                        size=size)\n                stdout.write_data(str_to_write)\n                state.history.add_action(a)\n                pos += size\n\n        else:\n            # Set CGC-specific variables\n            state.regs.eax = 0\n            state.regs.ebx = 0\n            state.regs.ecx = 0x4347c000\n            state.regs.edx = 0\n            state.regs.edi = 0\n            state.regs.esi = 0\n            state.regs.esp = 0xbaaaaffc\n            state.regs.ebp = 0\n            state.regs.cc_dep1 = 0x202  # default eflags\n            state.regs.cc_op = 0  # OP_COPY\n            state.regs.cc_dep2 = 0  # doesn't matter\n            state.regs.cc_ndep = 0  # doesn't matter\n\n            # fpu values\n            state.regs.mm0 = 0\n            state.regs.mm1 = 0\n            state.regs.mm2 = 0\n            state.regs.mm3 = 0\n            state.regs.mm4 = 0\n            state.regs.mm5 = 0\n            state.regs.mm6 = 0\n            state.regs.mm7 = 0\n            state.regs.fpu_tags = 0\n            state.regs.fpround = 0\n            state.regs.fc3210 = 0x0300\n            state.regs.ftop = 0\n\n            # sse values\n            state.regs.sseround = 0\n            state.regs.xmm0 = 0\n            state.regs.xmm1 = 0\n            state.regs.xmm2 = 0\n            state.regs.xmm3 = 0\n            state.regs.xmm4 = 0\n            state.regs.xmm5 = 0\n            state.regs.xmm6 = 0\n            state.regs.xmm7 = 0\n\n            # segmentation registers\n            state.regs.ds = 0\n            state.regs.es = 0\n            state.regs.fs = 0\n            state.regs.gs = 0\n            state.regs.ss = 0\n            state.regs.cs = 0\n\n        return state\n", "path": "angr/simos/cgc.py"}], "after_files": [{"content": "import logging\n\nimport claripy\nfrom cle import BackedCGC\n\nfrom ..procedures import SIM_LIBRARIES as L\nfrom ..state_plugins import SimActionData\nfrom .. import sim_options as o\nfrom .userland import SimUserland\n\n_l = logging.getLogger(name=__name__)\n\n\nclass SimCGC(SimUserland):\n    \"\"\"\n    Environment configuration for the CGC DECREE platform\n    \"\"\"\n\n    def __init__(self, project, **kwargs):\n        super(SimCGC, self).__init__(project,\n                syscall_library=L['cgcabi'],\n                syscall_addr_alignment=1,\n                name=\"CGC\",\n                **kwargs)\n\n    # pylint: disable=arguments-differ\n    def state_blank(self, flag_page=None, allocate_stack_page_count=0x100, **kwargs):\n        \"\"\"\n        :param flag_page:                   Flag page content, either a string or a list of BV8s\n        :param allocate_stack_page_count:   Number of pages to pre-allocate for stack\n        \"\"\"\n        # default stack as specified in the cgc abi\n        if kwargs.get('stack_end', None) is None:\n            kwargs['stack_end'] = 0xbaaab000\n        if kwargs.get('stack_size', None) is None:\n            kwargs['stack_size'] = 1024*1024*8\n\n        s = super(SimCGC, self).state_blank(**kwargs)  # pylint:disable=invalid-name\n\n        # pre-grow the stack. unsure if this is strictly required or just a hack around a compiler bug\n        if hasattr(s.memory, 'allocate_stack_pages'):\n            s.memory.allocate_stack_pages(kwargs['stack_end'] - 1, allocate_stack_page_count * 0x1000)\n\n        # Map the flag page\n        if o.ABSTRACT_MEMORY not in s.options:\n            s.memory.map_region(0x4347c000, 4096, 1)\n\n        # Create the CGC plugin\n        s.get_plugin('cgc')\n\n        # Set up the flag page\n        if flag_page is None:\n            flag_page = [s.solver.BVS(\"cgc-flag-byte-%d\" % i, 8, key=('flag', i), eternal=True) for i in range(0x1000)]\n        elif type(flag_page) is bytes:\n            flag_page = [s.solver.BVV(c, 8) for c in flag_page]\n        elif type(flag_page) is list:\n            pass\n        else:\n            raise ValueError(\"Bad flag page: expected None, bytestring, or list, but got %s\" % type(flag_page))\n\n        s.cgc.flag_bytes = flag_page\n        if s.mode != 'static':\n            s.memory.store(0x4347c000, claripy.Concat(*s.cgc.flag_bytes), priv=True)\n\n        # set up the address for concrete transmits\n        s.unicorn.transmit_addr = self.syscall_from_number(2).addr\n\n        s.libc.max_str_len = 1000000\n        s.libc.max_strtol_len = 10\n        s.libc.max_memcpy_size = 0x100000\n        s.libc.max_buffer_size = 0x100000\n\n        return s\n\n    def state_entry(self, add_options=None, **kwargs):\n        if isinstance(self.project.loader.main_object, BackedCGC):\n            kwargs['permissions_backer'] = (True, self.project.loader.main_object.permissions_map)\n        if add_options is None:\n            add_options = set()\n        add_options.add(o.ZERO_FILL_UNCONSTRAINED_MEMORY)\n\n        state = super(SimCGC, self).state_entry(add_options=add_options, **kwargs)\n\n        if isinstance(self.project.loader.main_object, BackedCGC):\n            # Update allocation base\n            state.cgc.allocation_base = self.project.loader.main_object.current_allocation_base\n\n            # Do all the writes\n            writes_backer = self.project.loader.main_object.writes_backer\n            stdout = state.posix.get_fd(1)\n            pos = 0\n            for size in writes_backer:\n                if size == 0:\n                    continue\n                str_to_write = state.solver.BVS('file_write', size*8)\n                a = SimActionData(\n                        state,\n                        'file_1_0',\n                        'write',\n                        addr=claripy.BVV(pos, state.arch.bits),\n                        data=str_to_write,\n                        size=size)\n                stdout.write_data(str_to_write)\n                state.history.add_action(a)\n                pos += size\n\n        else:\n            # Set CGC-specific variables\n            state.regs.eax = 0\n            state.regs.ebx = 0\n            state.regs.ecx = 0x4347c000\n            state.regs.edx = 0\n            state.regs.edi = 0\n            state.regs.esi = 0\n            state.regs.esp = 0xbaaaaffc\n            state.regs.ebp = 0\n            state.regs.cc_dep1 = 0x202  # default eflags\n            state.regs.cc_op = 0  # OP_COPY\n            state.regs.cc_dep2 = 0  # doesn't matter\n            state.regs.cc_ndep = 0  # doesn't matter\n\n            # fpu values\n            state.regs.mm0 = 0\n            state.regs.mm1 = 0\n            state.regs.mm2 = 0\n            state.regs.mm3 = 0\n            state.regs.mm4 = 0\n            state.regs.mm5 = 0\n            state.regs.mm6 = 0\n            state.regs.mm7 = 0\n            state.regs.fpu_tags = 0\n            state.regs.fpround = 0\n            state.regs.fc3210 = 0x0300\n            state.regs.ftop = 0\n\n            # sse values\n            state.regs.sseround = 0\n            state.regs.xmm0 = 0\n            state.regs.xmm1 = 0\n            state.regs.xmm2 = 0\n            state.regs.xmm3 = 0\n            state.regs.xmm4 = 0\n            state.regs.xmm5 = 0\n            state.regs.xmm6 = 0\n            state.regs.xmm7 = 0\n\n            # segmentation registers\n            state.regs.ds = 0\n            state.regs.es = 0\n            state.regs.fs = 0\n            state.regs.gs = 0\n            state.regs.ss = 0\n            state.regs.cs = 0\n\n        return state\n", "path": "angr/simos/cgc.py"}]}