qilingframework/qiling
1
0
Fork 0
mirror of https://github.com/qilingframework/qiling.git synced 2026-10-12 02:21:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

take reg_diff file out, reg_diff is good enuf

Browse Source
This commit is contained in:
xwings
2020-01-03 15:27:39 +08:00
parent ad1c4923d4
commit 2a4894efca
4 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/API.md
-1
View File
@@ -22,7 +22,6 @@ mmap_start = 0xhexaddress
output = ["debug","off","disasm","dump"] // dump=(disam + debug)
log_console
reg_dir = /dir/path/to/clean_registery // must within rootfs
reg_diff = /file/path/to/registry_dump // must within rootfs
```
#### Pre-Execution Settings
APIs allow users to instuments a executeable file/shellcode before executions
examples/regdemo_x86_windows.py
-1
View File
@@ -9,7 +9,6 @@ from qiling import *
def my_sandbox(path, rootfs):
ql = Qiling(path, rootfs, output = "debug")
ql.reg_dir = "registry"
ql.reg_diff = "reg_diff.json"
ql.run()
qiling/os/freebsd/x8664.py
+13 -1
View File
@@ -91,13 +91,16 @@ def runner(ql):
ql.uc.reg_write(UC_X86_REG_RSP, ql.stack_address)
ql.uc.reg_write(UC_X86_REG_RDI, ql.stack_address)
ql.uc.reg_write(UC_X86_REG_RAX, 0x0)
#ql.uc.reg_write(UC_X86_REG_RAX, 0x0)
#ql.uc.reg_write(UC_X86_REG_R14D, 0xfffffffffffff000)
#ql.uc.reg_write(UC_X86_REG_R15D, 0xfffffffffffff000)
ql_setup(ql)
ql.hook_insn(hook_syscall, UC_X86_INS_SYSCALL)
# https://github.com/unicorn-engine/unicorn/blob/master/tests/regress/x86_64_msr.py
# some ref from unicorn.
# FSMSR = 0xC0000100
# GSMSR = 0xC0000101
@@ -141,8 +144,17 @@ def runner(ql):
# '''
# return set_msr(uc, FSMSR, addr)
# def set_gs(uc, addr):
# '''
# set the GS.base hidden descriptor-register field to the given address.
# this enables referencing the gs segment on x86-64.
# '''
# return set_msr(uc, GSMSR, addr)
# ql.uc.mem_map(SCRATCH_ADDR, SCRATCH_SIZE)
# ql.uc.mem_map(SEGMENT_ADDR, SEGMENT_SIZE)
# set_msr(ql.uc, FSMSR, 0x1000)
# set_gs(ql.uc, SEGMENT_ADDR)
# set_fs(ql.uc, SEGMENT_ADDR)
if (ql.until_addr == 0):
qiling/os/windows/registry.py
+6 -4
View File
@@ -41,11 +41,13 @@ class RegistryManager:
# config path
if config:
self.config = config
else:
if not ql.reg_diff:
ql.reg_diff = "reg_diff.json"
self.config = os.path.join(rootfs, ql.reg_dir, ql.reg_diff)
try:
os.makedirs((rootfs + "/" + ql.reg_dir + "/" +"diff"), 0o755)
except:
pass
self.config = os.path.join(rootfs, ql.reg_dir,"diff", "registry_diff.json")
if not os.path.exists(self.config):
self.registry_config = {}