qilingframework/qiling
1
0
Fork 0
mirror of https://github.com/qilingframework/qiling.git synced 2026-10-12 02:21:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

archtype and ostype no longer support string values

Browse Source
This commit is contained in:
elicn
2023-06-16 17:08:27 +03:00
parent 86b8b6fee7
commit 38a8622f91
30 changed files with 149 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/adcache_x86_windows_debug.py
+2 -2
View File
@@ -8,12 +8,12 @@ sys.path.append("..")
from zipfile import ZipFile
from qiling import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
if __name__ == "__main__":
with ZipFile("shellcodes/win32_https_download.zip") as zip_reader:
with zip_reader.open('win32_https_download.bin', 'r', b'infected') as f:
sc = f.read()
ql = Qiling(code=sc, archtype="x86", ostype="windows", rootfs="rootfs/x86_windows", verbose=QL_VERBOSE.DEBUG)
ql = Qiling(code=sc, archtype=QL_ARCH.X86, ostype=QL_OS.WINDOWS, rootfs="rootfs/x86_windows", verbose=QL_VERBOSE.DEBUG)
ql.run()
examples/evm/evm_Hexagon_overflow.py
+2 -1
View File
@@ -10,11 +10,12 @@ import sys
sys.path.append("../..")
from qiling import *
from qiling.const import QL_ARCH
def example_run_evm():
contract = '0x606060405266017dfcdece4000600055341561001a57600080fd5b600160a060020a033316600090815260016020526040902066017dfcdece400090556106eb8061004b6000396000f3006060604052600436106100c45763ffffffff7c010000000000000000000000000000000000000000000000000000000060003504166306fdde0381146100c9578063095ea7b31461015357806318160ddd1461018957806323b872dd146101ae57806327edf097146101d6578063313ce567146101ff578063378dc3dc1461021257806342966c681461022557806370a082311461023b578063771282f61461025a57806395d89b411461026d578063a9059cbb14610280578063dd62ed3e146102a2575b600080fd5b34156100d457600080fd5b6100dc6102c7565b60405160208082528190810183818151815260200191508051906020019080838360005b83811015610118578082015183820152602001610100565b50505050905090810190601f1680156101455780820380516001836020036101000a031916815260200191505b509250505060405180910390f35b341561015e57600080fd5b610175600160a060020a03600435166024356102fe565b604051901515815260200160405180910390f35b341561019457600080fd5b61019c6103a4565b60405190815260200160405180910390f35b34156101b957600080fd5b610175600160a060020a03600435811690602435166044356103aa565b34156101e157600080fd5b6101e9610422565b60405160ff909116815260200160405180910390f35b341561020a57600080fd5b6101e9610427565b341561021d57600080fd5b61019c61042c565b341561023057600080fd5b610175600435610437565b341561024657600080fd5b61019c600160a060020a03600435166104ea565b341561026557600080fd5b61019c6104fc565b341561027857600080fd5b6100dc610502565b341561028b57600080fd5b610175600160a060020a0360043516602435610539565b34156102ad57600080fd5b61019c600160a060020a036004358116906024351661054f565b60408051908101604052600781527f48657861676f6e00000000000000000000000000000000000000000000000000602082015281565b60008115806103305750600160a060020a03338116600090815260026020908152604080832093871683529290522054155b151561033b57600080fd5b600160a060020a03338116600081815260026020908152604080832094881680845294909152908190208590557f8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b9259085905190815260200160405180910390a350600192915050565b60005490565b600160a060020a03808416600090815260026020908152604080832033909416835292905290812054829010156103e057600080fd5b600160a060020a038085166000908152600260209081526040808320339094168352929052208054839003905561041884848461056c565b5060019392505050565b600281565b600481565b66017dfcdece400081565b600160a060020a0333166000908152600160205260408120548290101561045d57600080fd5b600160a060020a033316600081815260016020526040808220805486900390558180527fa6eef7e35abe7026729641147f7915573c7e97b47efa546f5f6e3230263bcb4980548601905581548590039091557fcc16f5dbb4873280815c1ee09dbd06736cffcc184412cf7a71a0fdb75d397ca59084905190815260200160405180910390a2506001919050565b60016020526000908152604090205481565b60005481565b60408051908101604052600381527f4858470000000000000000000000000000000000000000000000000000000000602082015281565b600061054633848461056c565b50600192915050565b600260209081526000928352604080842090915290825290205481565b600160a060020a038216151561058157600080fd5b600160a060020a038316600090815260016020526040902054600282019010156105aa57600080fd5b600160a060020a038216600090815260016020526040902054818101116105d057600080fd5b600160a060020a03808416600081815260016020526040808220805460011990879003810190915593861682528082208054860190558180527fa6eef7e35abe7026729641147f7915573c7e97b47efa546f5f6e3230263bcb4980546002908101909155825490940190915590917fcc16f5dbb4873280815c1ee09dbd06736cffcc184412cf7a71a0fdb75d397ca5915160ff909116815260200160405180910390a281600160a060020a031683600160a060020a03167fddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef8360405190815260200160405180910390a35050505600a165627a7a72305820fbef5b10322242b8659b5de8e24ec1cf5e809831f6f7c08e52112f76daa31aef0029'
ql = Qiling(code=contract, archtype="evm")
ql = Qiling(code=contract, archtype=QL_ARCH.EVM)
user1 = ql.arch.evm.create_account(balance=100*10**18)
user2 = ql.arch.evm.create_account(balance=100*10**18)
examples/evm/evm_debugger.py
+4 -2
View File
@@ -6,11 +6,13 @@
import sys
sys.path.append("../..")
from qiling import *
from qiling import Qiling
from qiling.const import QL_ARCH
if __name__ == '__main__':
contract = '0x6060604052341561000f57600080fd5b60405160208061031c833981016040528080519060200190919050508060018190556000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000208190555050610299806100836000396000f300606060405260043610610057576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806318160ddd1461005c57806370a0823114610085578063a9059cbb146100d2575b600080fd5b341561006757600080fd5b61006f61012c565b6040518082815260200191505060405180910390f35b341561009057600080fd5b6100bc600480803573ffffffffffffffffffffffffffffffffffffffff16906020019091905050610132565b6040518082815260200191505060405180910390f35b34156100dd57600080fd5b610112600480803573ffffffffffffffffffffffffffffffffffffffff1690602001909190803590602001909190505061017a565b604051808215151515815260200191505060405180910390f35b60015481565b60008060008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001908152602001600020549050919050565b600080826000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000205403101515156101cb57600080fd5b816000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008282540392505081905550816000808573ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000206000828254019250508190555060019050929150505600a165627a7a7230582098f1551a391a3e65b3ce45cfa2b3fa5f91eea9a3e7181a81454e025ea0d7151c0029'
ql = Qiling(code=contract, archtype="evm")
ql = Qiling(code=contract, archtype=QL_ARCH.EVM)
ql.debugger = True
# Add Balance Var to the contract
examples/evm/evm_reentrancy.py
+2 -1
View File
@@ -10,13 +10,14 @@ from qiling import *
from qiling.arch.evm.vm.utils import bytecode_to_bytes, runtime_code_detector
from qiling.arch.evm.vm.vm import BaseVM
from qiling.arch.evm.constants import CREATE_CONTRACT_ADDRESS
from qiling.const import QL_ARCH
if __name__ == '__main__':
# Attack_contract = '0x608060405234801561001057600080fd5b5060405160208061046d83398101806040528101908080519060200190929190505050806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550506103ea806100836000396000f300608060405260043610610057576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff1680636289d38514610152578063acd2e6e51461015c578063ff11e1db146101b3575b670de0b6b3a76400006000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16311115610150576000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663155dd5ee670de0b6b3a76400006040518263ffffffff167c010000000000000000000000000000000000000000000000000000000002815260040180828152602001915050600060405180830381600087803b15801561013757600080fd5b505af115801561014b573d6000803e3d6000fd5b505050505b005b61015a6101ca565b005b34801561016857600080fd5b50610171610339565b604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390f35b3480156101bf57600080fd5b506101c861035e565b005b670de0b6b3a764000034101515156101e157600080fd5b6000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663e2c41dbc670de0b6b3a76400006040518263ffffffff167c01000000000000000000000000000000000000000000000000000000000281526004016000604051808303818588803b15801561026e57600080fd5b505af1158015610282573d6000803e3d6000fd5b50505050506000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663155dd5ee670de0b6b3a76400006040518263ffffffff167c010000000000000000000000000000000000000000000000000000000002815260040180828152602001915050600060405180830381600087803b15801561031f57600080fd5b505af1158015610333573d6000803e3d6000fd5b50505050565b6000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1681565b3373ffffffffffffffffffffffffffffffffffffffff166108fc3073ffffffffffffffffffffffffffffffffffffffff16319081150290604051600060405180830381858888f193505050501580156103bb573d6000803e3d6000fd5b505600a165627a7a723058204ad3139b1085c12112b76e9eab70c6589942d6e84eb3d8329a644eca757c19d00029'
Attack_contract = '0x608060405234801561001057600080fd5b506040516020806104b883398101806040528101908080519060200190929190505050806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555050610435806100836000396000f30060806040526004361061004c576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff168063a75e462514610179578063ff11e1db146101e1575b670de0b6b3a76400006000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16311115610177576000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16600060149054906101000a90047c0100000000000000000000000000000000000000000000000000000000027c01000000000000000000000000000000000000000000000000000000009004670de0b6b3a76400006040518263ffffffff167c0100000000000000000000000000000000000000000000000000000000028152600401808267ffffffffffffffff1681526020019150506000604051808303816000875af192505050505b005b6101df60048036038101908080357bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916906020019092919080357bffffffffffffffffffffffffffffffffffffffffffffffffffffffff191690602001909291905050506101f8565b005b3480156101ed57600080fd5b506101f66103a9565b005b80600060146101000a81548163ffffffff02191690837c010000000000000000000000000000000000000000000000000000000090040217905550670de0b6b3a7640000341015151561024a57600080fd5b6000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16670de0b6b3a7640000837c01000000000000000000000000000000000000000000000000000000009004906040518263ffffffff167c010000000000000000000000000000000000000000000000000000000002815260040160006040518083038185885af19350505050506000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16817c01000000000000000000000000000000000000000000000000000000009004670de0b6b3a76400006040518263ffffffff167c0100000000000000000000000000000000000000000000000000000000028152600401808267ffffffffffffffff1681526020019150506000604051808303816000875af192505050505050565b3373ffffffffffffffffffffffffffffffffffffffff166108fc3073ffffffffffffffffffffffffffffffffffffffff16319081150290604051600060405180830381858888f19350505050158015610406573d6000803e3d6000fd5b505600a165627a7a723058205aacb19a5864d2c460aed6c844f2aca575d87de6477ac757a72511bb2975b3f80029'
ql = Qiling(code=Attack_contract, archtype="evm")
ql = Qiling(code=Attack_contract, archtype=QL_ARCH.EVM)
vm:BaseVM = ql.arch.evm.vm
C1 = b'\xaa' * 20
examples/evm/evm_reentrancy_vol.py
+2 -1
View File
@@ -10,12 +10,13 @@ from qiling import *
from qiling.arch.evm.vm.utils import bytecode_to_bytes, runtime_code_detector
from qiling.arch.evm.vm.vm import BaseVM
from qiling.arch.evm.constants import CREATE_CONTRACT_ADDRESS
from qiling.const import QL_ARCH
def template(vic_contract, deposit, withdraw):
Attack_contract = '0x608060405234801561001057600080fd5b506040516020806104b883398101806040528101908080519060200190929190505050806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555050610435806100836000396000f30060806040526004361061004c576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff168063a75e462514610179578063ff11e1db146101e1575b670de0b6b3a76400006000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16311115610177576000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16600060149054906101000a90047c0100000000000000000000000000000000000000000000000000000000027c01000000000000000000000000000000000000000000000000000000009004670de0b6b3a76400006040518263ffffffff167c0100000000000000000000000000000000000000000000000000000000028152600401808267ffffffffffffffff1681526020019150506000604051808303816000875af192505050505b005b6101df60048036038101908080357bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916906020019092919080357bffffffffffffffffffffffffffffffffffffffffffffffffffffffff191690602001909291905050506101f8565b005b3480156101ed57600080fd5b506101f66103a9565b005b80600060146101000a81548163ffffffff02191690837c010000000000000000000000000000000000000000000000000000000090040217905550670de0b6b3a7640000341015151561024a57600080fd5b6000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16670de0b6b3a7640000837c01000000000000000000000000000000000000000000000000000000009004906040518263ffffffff167c010000000000000000000000000000000000000000000000000000000002815260040160006040518083038185885af19350505050506000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16817c01000000000000000000000000000000000000000000000000000000009004670de0b6b3a76400006040518263ffffffff167c0100000000000000000000000000000000000000000000000000000000028152600401808267ffffffffffffffff1681526020019150506000604051808303816000875af192505050505050565b3373ffffffffffffffffffffffffffffffffffffffff166108fc3073ffffffffffffffffffffffffffffffffffffffff16319081150290604051600060405180830381858888f19350505050158015610406573d6000803e3d6000fd5b505600a165627a7a723058205aacb19a5864d2c460aed6c844f2aca575d87de6477ac757a72511bb2975b3f80029'
ql = Qiling(code=Attack_contract, archtype="evm")
ql = Qiling(code=Attack_contract, archtype=QL_ARCH.EVM)
vm:BaseVM = ql.arch.evm.vm
C1 = b'\xaa' * 20
examples/evm/evm_simple_sc.py
+3 -2
View File
@@ -6,13 +6,14 @@
import sys
sys.path.append("../..")
from qiling import *
from qiling import Qiling
from qiling.const import QL_ARCH
def example_run_evm():
contract = '0x6060604052341561000f57600080fd5b60405160208061031c833981016040528080519060200190919050508060018190556000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000208190555050610299806100836000396000f300606060405260043610610057576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806318160ddd1461005c57806370a0823114610085578063a9059cbb146100d2575b600080fd5b341561006757600080fd5b61006f61012c565b6040518082815260200191505060405180910390f35b341561009057600080fd5b6100bc600480803573ffffffffffffffffffffffffffffffffffffffff16906020019091905050610132565b6040518082815260200191505060405180910390f35b34156100dd57600080fd5b610112600480803573ffffffffffffffffffffffffffffffffffffffff1690602001909190803590602001909190505061017a565b604051808215151515815260200191505060405180910390f35b60015481565b60008060008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001908152602001600020549050919050565b600080826000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000205403101515156101cb57600080fd5b816000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008282540392505081905550816000808573ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000206000828254019250508190555060019050929150505600a165627a7a7230582098f1551a391a3e65b3ce45cfa2b3fa5f91eea9a3e7181a81454e025ea0d7151c0029'
ql = Qiling(code=contract, archtype="evm")
ql = Qiling(code=contract, archtype=QL_ARCH.EVM)
# Add Balance Var to the contract
bal = ql.arch.evm.abi.convert(['uint256'], [20])
examples/evm/fuzzing/underflow_test.py
+3 -1
View File
@@ -8,10 +8,12 @@ import sys
sys.path.append("../../../..")
from qiling import *
from qiling import Qiling
from qiling.const import QL_ARCH
def underflow(fuzz_balance):
code = '0x6060604052341561000f57600080fd5b60405160208061031c833981016040528080519060200190919050508060018190556000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000208190555050610299806100836000396000f300606060405260043610610057576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806318160ddd1461005c57806370a0823114610085578063a9059cbb146100d2575b600080fd5b341561006757600080fd5b61006f61012c565b6040518082815260200191505060405180910390f35b341561009057600080fd5b6100bc600480803573ffffffffffffffffffffffffffffffffffffffff16906020019091905050610132565b6040518082815260200191505060405180910390f35b34156100dd57600080fd5b610112600480803573ffffffffffffffffffffffffffffffffffffffff1690602001909190803590602001909190505061017a565b604051808215151515815260200191505060405180910390f35b60015481565b60008060008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001908152602001600020549050919050565b600080826000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000205403101515156101cb57600080fd5b816000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008282540392505081905550816000808573ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000206000828254019250508190555060019050929150505600a165627a7a7230582098f1551a391a3e65b3ce45cfa2b3fa5f91eea9a3e7181a81454e025ea0d7151c0029'
ql = Qiling(code=code, archtype="evm")
ql = Qiling(code=code, archtype=QL_ARCH.EVM)
# Add Balance Var to the contract
bal = ql.arch.evm.abi.convert(['uint256'], [20])
examples/extensions/r2/hello_r2.py
+2 -2
View File
@@ -7,7 +7,7 @@ import sys
sys.path.append('..')
from qiling import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.r2 import R2
@@ -43,7 +43,7 @@ if __name__ == "__main__":
# test shellcode mode
ARM64_LIN = bytes.fromhex('420002ca210080d2400080d2c81880d2010000d4e60300aa01020010020280d2681980d2010000d4410080d2420002cae00306aa080380d2010000d4210400f165ffff54e0000010420002ca210001caa81b80d2010000d4020004d27f0000012f62696e2f736800')
print("\nLinux ARM 64bit Shellcode")
ql = Qiling(code=ARM64_LIN, archtype="arm64", ostype="linux", verbose=QL_VERBOSE.DEBUG)
ql = Qiling(code=ARM64_LIN, archtype=QL_ARCH.ARM64, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.DEBUG)
r2 = R2(ql)
# disassemble 32 instructions
print(r2._cmd('pd 32'))
examples/fuzzing/stm32f429/fuzz.py
+3 -6
View File
@@ -10,7 +10,7 @@ from typing import Any, Optional
sys.path.append("../../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.afl import ql_afl_fuzz_custom
from qiling.extensions.mcu.stm32f4 import stm32f429
@@ -18,11 +18,8 @@ from qiling.extensions.mcu.stm32f4 import stm32f429
from unicorn import UC_ERR_OK, UcError
def main(input_file: str):
ql = Qiling(["../../rootfs/mcu/stm32f429/bof.elf"],
archtype="cortex_m",
env=stm32f429,
ostype='mcu',
verbose=QL_VERBOSE.DISABLED)
ql = Qiling(["../../rootfs/mcu/stm32f429/bof.elf"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f429, verbose=QL_VERBOSE.DISABLED)
ql.hw.create('rcc')
ql.hw.create('usart2')
examples/hello_arm_uboot.py
+2 -2
View File
@@ -7,7 +7,7 @@ import sys
sys.path.append("..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.os.const import STRING
def get_kaimendaji_password():
@@ -60,7 +60,7 @@ def get_kaimendaji_password():
with open("../examples/rootfs/blob/u-boot.bin.img", "rb") as f:
uboot_code = f.read()
ql = Qiling(code=uboot_code[0x40:], archtype="arm", ostype="blob", profile="uboot_bin.ql", verbose=QL_VERBOSE.OFF)
ql = Qiling(code=uboot_code[0x40:], archtype=QL_ARCH.ARM, ostype=QL_OS.BLOB, profile="uboot_bin.ql", verbose=QL_VERBOSE.OFF)
image_base_addr = ql.loader.load_address
ql.hook_address(my_getenv, image_base_addr + 0x13AC0)
examples/mcu/gd32vf103_blink.py
+3 -2
View File
@@ -9,9 +9,10 @@ sys.path.append("../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.extensions.mcu.gd32vf1 import gd32vf103
from qiling.const import QL_ARCH, QL_OS
ql = Qiling(['../rootfs/mcu/gd32vf103/blink.hex'], archtype="riscv64", ostype="mcu",
env=gd32vf103, verbose=QL_VERBOSE.DEBUG)
ql = Qiling(['../rootfs/mcu/gd32vf103/blink.hex'], archtype=QL_ARCH.RISCV64, ostype=QL_OS.MCU,
env=gd32vf103, verbose=QL_VERBOSE.DEBUG)
ql.hw.create('rcu')
ql.hw.create('gpioa').watch()
examples/mcu/stm32f407_gpio_hook.py
+2 -1
View File
@@ -10,10 +10,11 @@ from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f407
from qiling.hw.external_device.oled.ssd1306 import PyGameSSD1306Spi
from qiling.const import QL_ARCH, QL_OS
ql = Qiling(["../rootfs/mcu/stm32f407/ai-sine-test.elf"],
archtype="cortex_m", ostype="mcu", env=stm32f407, verbose=QL_VERBOSE.DEFAULT)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f407, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('rcc')
ql.hw.create('pwr')
examples/mcu/stm32f407_hack_lock.py
+4 -4
View File
@@ -11,7 +11,7 @@ from multiprocessing import Process
sys.path.append("../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f407
@@ -26,9 +26,9 @@ def dicts():
# Cracking the passwd of lock
def crack(passwd):
ql = Qiling(["../../examples/rootfs/mcu/stm32f407/backdoorlock.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f407, verbose=QL_VERBOSE.DISABLED)
ql = Qiling(["../../examples/rootfs/mcu/stm32f407/backdoorlock.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f407, verbose=QL_VERBOSE.DISABLED)
ql.hw.create('spi2')
ql.hw.create('gpioe')
ql.hw.create('gpiof')
examples/mcu/stm32f407_mnist_oled.py
+2 -2
View File
@@ -7,13 +7,13 @@ import sys
sys.path.append("../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f407
from qiling.hw.external_device.oled.ssd1306 import PyGameSSD1306Spi
ql = Qiling(["../rootfs/mcu/stm32f407/mnist.bin", 0x8000000],
archtype="cortex_m", ostype="mcu", env=stm32f407, verbose=QL_VERBOSE.DEFAULT)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f407, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('rcc')
ql.hw.create('gpiod')
examples/mcu/stm32f411_dma_logger.py
+3 -3
View File
@@ -7,12 +7,12 @@ import sys
sys.path.append("../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f411
def stm32f411_dma():
ql = Qiling(["../rootfs/mcu/stm32f411/dma-clock.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEBUG)
ql = Qiling(["../rootfs/mcu/stm32f411/dma-clock.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEBUG)
ql.hw.create('usart2').watch()
ql.hw.create('dma1').watch()
examples/mcu/stm32f411_freertos.py
+3 -3
View File
@@ -7,13 +7,13 @@ import sys
sys.path.append("../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f411
def stm32f411_freertos():
ql = Qiling(["../rootfs/mcu/stm32f411/os-demo.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEBUG)
ql = Qiling(["../rootfs/mcu/stm32f411/os-demo.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEBUG)
ql.hw.create('usart2').watch()
ql.hw.create('gpioa').watch()
examples/mcu/stm32f411_gpio_hook.py
+3 -3
View File
@@ -7,12 +7,12 @@ import sys
sys.path.append("../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f411
def test_mcu_gpio_stm32f411():
ql = Qiling(["../../examples/rootfs/mcu/stm32f411/hello_gpioA.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEBUG)
ql = Qiling(["../../examples/rootfs/mcu/stm32f411/hello_gpioA.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEBUG)
ql.hw.create('usart2').watch()
ql.hw.create('rcc').watch()
examples/mcu/stm32f411_i2c_lcd.py
+2 -2
View File
@@ -8,12 +8,12 @@ import sys
sys.path.append("../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.hw.external_device.lcd.lcd1602 import PyGameLCD1602
from qiling.extensions.mcu.stm32f4 import stm32f411
def create(path, lcd):
ql = Qiling([path], archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEBUG)
ql = Qiling([path], archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEBUG)
ql.hw.create('i2c1')
ql.hw.create('rcc')
examples/mcu/stm32f411_interact_usart.py
+3 -3
View File
@@ -11,12 +11,12 @@ import time
import threading
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f411
ql = Qiling(["../../examples/rootfs/mcu/stm32f411/md5_server.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.OFF)
ql = Qiling(["../../examples/rootfs/mcu/stm32f411/md5_server.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.OFF)
ql.hw.create('usart2')
ql.hw.create('rcc')
examples/mcu/stm32f411_spi_oled12864.py
+4 -3
View File
@@ -7,12 +7,13 @@ import sys
sys.path.append("../..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f411
from qiling.hw.external_device.oled.ssd1306 import PyGameSSD1306Spi
ql = Qiling(['../rootfs/mcu/stm32f411/oled12864.hex'],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql = Qiling(['../rootfs/mcu/stm32f411/oled12864.hex'],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('rcc')
ql.hw.create('gpioa')
qiling/core.py
+7 -12
View File
@@ -36,8 +36,8 @@ class Qiling(QlCoreHooks, QlCoreStructs):
rootfs: str = r'.',
env: MutableMapping[AnyStr, AnyStr] = {},
code: Optional[bytes] = None,
ostype: Union[str, QL_OS] = None,
archtype: Union[str, QL_ARCH] = None,
ostype: Optional[QL_OS] = None,
archtype: Optional[QL_ARCH] = None,
verbose: QL_VERBOSE = QL_VERBOSE.DEFAULT,
profile: str = None,
console: bool = True,
@@ -117,13 +117,8 @@ class Qiling(QlCoreHooks, QlCoreStructs):
#################
# arch os setup #
#################
if type(archtype) is str:
archtype = arch_convert(archtype)
if type(ostype) is str:
ostype = os_convert(ostype)
# if provided arch was invalid or not provided, guess arch and os
# if arch was not provided, guess arch and os
if archtype is None:
guessed_archtype, guessed_ostype, guessed_archendian = ql_guess_emu_env(self.path)
@@ -140,12 +135,12 @@ class Qiling(QlCoreHooks, QlCoreStructs):
ostype = arch_os_convert(archtype)
# arch should have been determined by now; fail if not
if type(archtype) is not QL_ARCH:
raise QlErrorArch(f'Unknown or unsupported architecture: "{archtype}"')
if archtype is None:
raise QlErrorArch(f'Unknown or unsupported architecture')
# os should have been determined by now; fail if not
if type(ostype) is not QL_OS:
raise QlErrorOsType(f'Unknown or unsupported operating system: "{ostype}"')
if ostype is None:
raise QlErrorOsType(f'Unknown or unsupported operating system')
# if endianess is still undetermined, set it to little-endian.
# this setting is ignored for architectures with predefined endianess
qltool
+27 -8
View File
@@ -9,6 +9,7 @@ import sys
import ast
import pickle
from pprint import pprint
from typing import TYPE_CHECKING, Mapping, Type
from unicorn import __version__ as uc_ver
from qiling import __version__ as ql_ver
@@ -16,11 +17,15 @@ from qiling import __version__ as ql_ver
from qiling import Qiling
from qiling.arch import utils as arch_utils
from qiling.debugger.qdb import QlQdb
from qiling.utils import arch_convert
from qiling.const import QL_VERBOSE, QL_ENDIAN, os_map, arch_map, verbose_map
from qiling.extensions.coverage import utils as cov_utils
from qiling.extensions import report
if TYPE_CHECKING:
from enum import Enum
# read code from file
def read_file(fname: str):
with open(fname, "rb") as f:
@@ -38,9 +43,24 @@ class __arg_env(argparse.Action):
setattr(namespace, self.dest, env or {})
class __arg_verbose(argparse.Action):
def __call__(self, parser, namespace, values, option_string):
setattr(namespace, self.dest, verbose_map[values])
def __make_enum_arg(enum_rmap: Mapping[str, 'Enum'], aliases: Mapping[str, str] = {}) -> Type[argparse.Action]:
class __enum_arg(argparse.Action):
def __call__(self, parser, namespace, values: str, option_string):
values = values.casefold()
if values in aliases:
values = aliases[values]
setattr(namespace, self.dest, enum_rmap[values])
return __enum_arg
__arg_archtype = __make_enum_arg(arch_map, {'x86_64': 'x8664', 'riscv32': 'riscv'})
__arg_ostype = __make_enum_arg(os_map, {'darwin': 'macos'})
__arg_verbose = __make_enum_arg(verbose_map)
def handle_code(options: argparse.Namespace):
archendian = {
@@ -67,9 +87,8 @@ def handle_code(options: argparse.Namespace):
elif options.format == 'asm':
print ("Load ASM from FILE")
assembly = read_file(options.filename)
archtype = arch_convert(options.arch)
assembler = arch_utils.assembler(archtype, archendian, options.thumb)
assembler = arch_utils.assembler(options.arch, archendian, options.thumb)
code, _ = assembler.asm(assembly)
code = bytes(code)
@@ -185,10 +204,10 @@ if __name__ == '__main__':
code_parser = commands.add_parser('code', help='execute a shellcode')
code_parser.add_argument('-f', '--filename', metavar="FILE", help="filename")
code_parser.add_argument('-i', '--input', metavar="INPUT", dest="input", help='input hex value')
code_parser.add_argument('--arch', required=True, choices=arch_map)
code_parser.add_argument('--arch', required=True, choices=arch_map, action=__arg_archtype)
code_parser.add_argument('--thumb', action='store_true', default=False, help='specify thumb mode for ARM')
code_parser.add_argument('--endian', choices=('little', 'big'), default='little', help='specify endianess for bi-endian archs')
code_parser.add_argument('--os', required=True, choices=os_map)
code_parser.add_argument('--os', required=True, choices=os_map, action=__arg_ostype)
code_parser.add_argument('--rootfs', default='.', help='emulated root filesystem, that is where all libraries reside')
code_parser.add_argument('--format', choices=('asm', 'hex', 'bin'), default='bin', help='input file format')
tests/test_blob.py
+2 -2
View File
@@ -7,7 +7,7 @@ import sys, unittest
sys.path.append("..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.os.const import STRING
class BlobTest(unittest.TestCase):
@@ -51,7 +51,7 @@ class BlobTest(unittest.TestCase):
with open("../examples/rootfs/blob/u-boot.bin.img", "rb") as f:
uboot_code = f.read()
ql = Qiling(code=uboot_code[0x40:], archtype="arm", ostype="blob", profile="profiles/uboot_bin.ql", verbose=QL_VERBOSE.DEBUG)
ql = Qiling(code=uboot_code[0x40:], archtype=QL_ARCH.ARM, ostype=QL_OS.BLOB, profile="profiles/uboot_bin.ql", verbose=QL_VERBOSE.DEBUG)
image_base_addr = ql.loader.load_address
ql.hook_address(my_getenv, image_base_addr + 0x13AC0)
tests/test_debugger.py
+2 -2
View File
@@ -7,7 +7,7 @@ import sys, threading, unittest, socket, time
sys.path.append("..")
from qiling import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
class SimpleGdbClient:
DELAY = 0.6
@@ -165,7 +165,7 @@ class DebuggerTest(unittest.TestCase):
def test_gdbdebug_shellcode_server(self):
X8664_LIN = bytes.fromhex('31c048bbd19d9691d08c97ff48f7db53545f995257545eb03b0f05')
ql = Qiling(code=X8664_LIN, archtype='x8664', ostype='linux')
ql = Qiling(code=X8664_LIN, archtype=QL_ARCH.X8664, ostype=QL_OS.LINUX)
ql.debugger = 'gdb:127.0.0.1:9998'
def gdb_test_client():
tests/test_elf.py
+2 -2
View File
@@ -7,7 +7,7 @@ import sys, unittest, string, random, os, io, re
sys.path.append("..")
from qiling import Qiling
from qiling.const import QL_OS, QL_INTERCEPT, QL_STOP, QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_INTERCEPT, QL_STOP, QL_VERBOSE
from qiling.exception import *
from qiling.extensions import pipe
from qiling.os.const import STRING
@@ -1113,7 +1113,7 @@ class ELFTest(unittest.TestCase):
del ql
def test_memory_search(self):
ql = Qiling(code = b"\xCC", archtype = "x8664", ostype = "linux", verbose=QL_VERBOSE.DEBUG)
ql = Qiling(code=b"\xCC", archtype=QL_ARCH.X8664, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.DEBUG)
ql.mem.map(0x1000, 0x1000)
ql.mem.map(0x2000, 0x1000)
tests/test_evm.py
+4 -3
View File
@@ -4,6 +4,7 @@ import os, platform, sys, unittest
sys.path.append("..")
from qiling import Qiling
from qiling.const import QL_ARCH, QL_VERBOSE
SECRET_KEY = os.environ.get('AM_I_IN_A_DOCKER_CONTAINER', False)
@@ -27,7 +28,7 @@ class Checklist:
class EVMTest(unittest.TestCase):
def test_underflow_code(self):
ql = Qiling(code="0x6060604052341561000f57600080fd5b60405160208061031c833981016040528080519060200190919050508060018190556000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000208190555050610299806100836000396000f300606060405260043610610057576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806318160ddd1461005c57806370a0823114610085578063a9059cbb146100d2575b600080fd5b341561006757600080fd5b61006f61012c565b6040518082815260200191505060405180910390f35b341561009057600080fd5b6100bc600480803573ffffffffffffffffffffffffffffffffffffffff16906020019091905050610132565b6040518082815260200191505060405180910390f35b34156100dd57600080fd5b610112600480803573ffffffffffffffffffffffffffffffffffffffff1690602001909190803590602001909190505061017a565b604051808215151515815260200191505060405180910390f35b60015481565b60008060008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001908152602001600020549050919050565b600080826000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000205403101515156101cb57600080fd5b816000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008282540392505081905550816000808573ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000206000828254019250508190555060019050929150505600a165627a7a7230582098f1551a391a3e65b3ce45cfa2b3fa5f91eea9a3e7181a81454e025ea0d7151c0029",archtype="evm", verbose=4)
ql = Qiling(code="0x6060604052341561000f57600080fd5b60405160208061031c833981016040528080519060200190919050508060018190556000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000208190555050610299806100836000396000f300606060405260043610610057576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806318160ddd1461005c57806370a0823114610085578063a9059cbb146100d2575b600080fd5b341561006757600080fd5b61006f61012c565b6040518082815260200191505060405180910390f35b341561009057600080fd5b6100bc600480803573ffffffffffffffffffffffffffffffffffffffff16906020019091905050610132565b6040518082815260200191505060405180910390f35b34156100dd57600080fd5b610112600480803573ffffffffffffffffffffffffffffffffffffffff1690602001909190803590602001909190505061017a565b604051808215151515815260200191505060405180910390f35b60015481565b60008060008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001908152602001600020549050919050565b600080826000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000205403101515156101cb57600080fd5b816000803373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008282540392505081905550816000808573ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000206000828254019250508190555060019050929150505600a165627a7a7230582098f1551a391a3e65b3ce45cfa2b3fa5f91eea9a3e7181a81454e025ea0d7151c0029",archtype=QL_ARCH.EVM, verbose=QL_VERBOSE.DEBUG)
testcheck = Checklist()
argu = ql.arch.evm.abi.convert(['uint256'], [20])
code = ql.code + argu
@@ -83,7 +84,7 @@ class EVMTest(unittest.TestCase):
self.assertTrue(testcheck.visited_hookinsn)
def test_underflow_filename(self):
ql = Qiling(["../examples/rootfs/evm/Hexagon.hex"], archtype="evm", verbose=4)
ql = Qiling(["../examples/rootfs/evm/Hexagon.hex"], archtype=QL_ARCH.EVM, verbose=QL_VERBOSE.DEBUG)
user1 = ql.arch.evm.create_account(balance=100*10**18)
user2 = ql.arch.evm.create_account(balance=100*10**18)
@@ -118,7 +119,7 @@ class EVMTest(unittest.TestCase):
self.assertEqual(int(result.output.hex()[2:], 16), 452312848583266388373324160190187140051835877600158453279131187530910662654)
def test_abi_encoding(self):
ql = Qiling(code="0x608060405234801561001057600080fd5b506101a4806100206000396000f3fe608060405234801561001057600080fd5b506004361061002b5760003560e01c8063ead710c414610030575b600080fd5b6100e96004803603602081101561004657600080fd5b810190808035906020019064010000000081111561006357600080fd5b82018360208201111561007557600080fd5b8035906020019184600183028401116401000000008311171561009757600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610164565b6040518080602001828103825283818151815260200191508051906020019080838360005b8381101561012957808201518184015260208101905061010e565b50505050905090810190601f1680156101565780820380516001836020036101000a031916815260200191505b509250505060405180910390f35b606081905091905056fea2646970667358221220cf43353b75256fc42aaffd9632e06963c5c2aad72a91004bfd2f98cd56ae1a0c64736f6c63430006000033",archtype="evm", verbose=4)
ql = Qiling(code="0x608060405234801561001057600080fd5b506101a4806100206000396000f3fe608060405234801561001057600080fd5b506004361061002b5760003560e01c8063ead710c414610030575b600080fd5b6100e96004803603602081101561004657600080fd5b810190808035906020019064010000000081111561006357600080fd5b82018360208201111561007557600080fd5b8035906020019184600183028401116401000000008311171561009757600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610164565b6040518080602001828103825283818151815260200191508051906020019080838360005b8381101561012957808201518184015260208101905061010e565b50505050905090810190601f1680156101565780820380516001836020036101000a031916815260200191505b509250505060405180910390f35b606081905091905056fea2646970667358221220cf43353b75256fc42aaffd9632e06963c5c2aad72a91004bfd2f98cd56ae1a0c64736f6c63430006000033",archtype=QL_ARCH.EVM, verbose=QL_VERBOSE.DEBUG)
user1 = ql.arch.evm.create_account(balance=100*10**18)
c1 = ql.arch.evm.create_account()
tests/test_mcu.py
+32 -32
View File
@@ -8,7 +8,7 @@ import sys, unittest
sys.path.append("..")
from qiling.core import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
from qiling.extensions.mcu.stm32f4 import stm32f407, stm32f411, stm32f429
from qiling.extensions.mcu.stm32f1 import stm32f103
from qiling.extensions.mcu.atmel import sam3x8e
@@ -16,8 +16,8 @@ from qiling.extensions.mcu.gd32vf1 import gd32vf103
class MCUTest(unittest.TestCase):
def test_mcu_led_stm32f411(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f411/rand_blink.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DISASM)
ql = Qiling(["../examples/rootfs/mcu/stm32f411/rand_blink.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DISASM)
# Set verbose=QL_VERBOSE.DEFAULT to find warning
ql.run(count=1000)
@@ -26,9 +26,9 @@ class MCUTest(unittest.TestCase):
def test_mcu_snapshot_stm32f411(self):
def create_qiling():
ql = Qiling(["../examples/rootfs/mcu/stm32f411/hello_usart.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411)
ql = Qiling(["../examples/rootfs/mcu/stm32f411/hello_usart.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411)
ql.hw.create('usart2')
ql.hw.create('rcc')
@@ -53,8 +53,8 @@ class MCUTest(unittest.TestCase):
del ql1, ql2
def test_mcu_usart_input_stm32f411(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f411/md5_server.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.OFF)
ql = Qiling(["../examples/rootfs/mcu/stm32f411/md5_server.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.OFF)
ql.hw.create('usart2')
ql.hw.create('rcc')
@@ -74,8 +74,8 @@ class MCUTest(unittest.TestCase):
del ql
def test_mcu_patch_stm32f411(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f411/patch_test.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql = Qiling(["../examples/rootfs/mcu/stm32f411/patch_test.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('usart2')
ql.hw.create('rcc')
@@ -88,7 +88,7 @@ class MCUTest(unittest.TestCase):
def test_mcu_freertos_stm32f411(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f411/os-demo.elf"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DISABLED)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DISABLED)
ql.hw.create('usart2')
ql.hw.create('rcc')
@@ -110,8 +110,8 @@ class MCUTest(unittest.TestCase):
del ql
def test_mcu_dma_stm32f411(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f411/dma-clock.elf"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql = Qiling(["../examples/rootfs/mcu/stm32f411/dma-clock.elf"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('usart2')
ql.hw.create('dma1')
@@ -129,7 +129,7 @@ class MCUTest(unittest.TestCase):
def test_mcu_i2c_stm32f411(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f411/i2c-lcd.bin", 0x8000000],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('i2c1')
ql.hw.create('rcc')
@@ -161,7 +161,7 @@ class MCUTest(unittest.TestCase):
def test_mcu_spi_stm32f411(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f411/spi-test.bin", 0x8000000],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('spi1')
ql.hw.create('rcc')
@@ -175,7 +175,7 @@ class MCUTest(unittest.TestCase):
def test_mcu_led_rust_stm32f411(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f411/led-rust.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
count = 0
def counter():
@@ -192,9 +192,9 @@ class MCUTest(unittest.TestCase):
def test_mcu_hacklock_stm32f407(self):
def crack(passwd):
ql = Qiling(["../examples/rootfs/mcu/stm32f407/backdoorlock.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f407, verbose=QL_VERBOSE.OFF)
ql = Qiling(["../examples/rootfs/mcu/stm32f407/backdoorlock.hex"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f407, verbose=QL_VERBOSE.OFF)
ql.hw.create('spi2')
ql.hw.create('gpioe')
ql.hw.create('gpiof')
@@ -221,8 +221,8 @@ class MCUTest(unittest.TestCase):
self.assertFalse(crack('123456'))
def test_mcu_tim_speed_stm32f411(self):
ql = Qiling(['../examples/rootfs/mcu/stm32f411/basic-timer.elf'],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql = Qiling(['../examples/rootfs/mcu/stm32f411/basic-timer.elf'],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('rcc')
ql.hw.create('flash interface')
@@ -260,8 +260,8 @@ class MCUTest(unittest.TestCase):
self.assertTrue(ql.hw.usart2.recv().startswith(b'hello\n'))
def test_mcu_i2c_interrupt_stm32f411(self):
ql = Qiling(['../examples/rootfs/mcu/stm32f411/i2cit-lcd.elf'],
archtype="cortex_m", ostype="mcu", env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql = Qiling(['../examples/rootfs/mcu/stm32f411/i2cit-lcd.elf'],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f411, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('i2c1')
ql.hw.create('rcc').watch()
@@ -295,8 +295,8 @@ class MCUTest(unittest.TestCase):
def test_mcu_blink_gd32vf103(self):
ql = Qiling(['../examples/rootfs/mcu/gd32vf103/blink.hex'], archtype="riscv",
env=gd32vf103, ostype="mcu", verbose=QL_VERBOSE.DEFAULT)
ql = Qiling(['../examples/rootfs/mcu/gd32vf103/blink.hex'],
archtype=QL_ARCH.RISCV, ostype=QL_OS.MCU, env=gd32vf103, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('rcu')
ql.hw.create('gpioa')
@@ -322,7 +322,7 @@ class MCUTest(unittest.TestCase):
def test_mcu_crc_stm32f407(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f407/ai-sine-test.elf"],
archtype="cortex_m", ostype="mcu", env=stm32f407, verbose=QL_VERBOSE.DEFAULT)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f407, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('rcc')
ql.hw.create('pwr')
@@ -350,7 +350,7 @@ class MCUTest(unittest.TestCase):
def test_mcu_usart_stm32f103(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f103/sctf2020-password-lock-plus.hex"],
archtype="cortex_m", ostype="mcu", env=stm32f103, verbose=QL_VERBOSE.DEFAULT)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f103, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('rcc')
ql.hw.create('flash interface')
@@ -378,7 +378,7 @@ class MCUTest(unittest.TestCase):
def test_mcu_serial_sam3x8e(self):
ql = Qiling(["../examples/rootfs/mcu/sam3x8e/serial.ino.hex"],
archtype="cortex_m", ostype="mcu", env=sam3x8e, verbose=QL_VERBOSE.DEFAULT)
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=sam3x8e, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('wdt')
ql.hw.create('efc0')
@@ -400,8 +400,8 @@ class MCUTest(unittest.TestCase):
del ql
def test_mcu_hackme_stm32f429(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f429/bof.elf"],
archtype="cortex_m", env=stm32f429, ostype='mcu', verbose=QL_VERBOSE.DISABLED)
ql = Qiling(["../examples/rootfs/mcu/stm32f429/bof.elf"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f429, verbose=QL_VERBOSE.DISABLED)
ql.hw.create('rcc')
ql.hw.create('usart2')
@@ -424,8 +424,8 @@ class MCUTest(unittest.TestCase):
self.assertEqual(ql.hw.usart3.recv(), b'Welcome to the world of Hacking!\naaaaaaaaaaaaaaaaaaaa\xa9\x05\n')
def test_mcu_fastmode_stm32f429(self):
ql = Qiling(["../examples/rootfs/mcu/stm32f429/bof.elf"],
archtype="cortex_m", env=stm32f429, ostype='mcu', verbose=QL_VERBOSE.DEFAULT)
ql = Qiling(["../examples/rootfs/mcu/stm32f429/bof.elf"],
archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f429, verbose=QL_VERBOSE.DEFAULT)
ql.hw.create('rcc')
ql.hw.create('usart2')
tests/test_peshellcode.py
+5 -4
View File
@@ -7,6 +7,7 @@ import sys, unittest
sys.path.append("..")
from qiling import Qiling
from qiling.const import QL_ARCH, QL_OS, QL_VERBOSE
X86_WIN = bytes.fromhex('''
fce8820000006089e531c0648b50308b520c8b52148b72280fb74a2631ffac3c
@@ -34,18 +35,18 @@ POINTER_TEST = bytes.fromhex('1122334455667788')
class PEShellcodeTest(unittest.TestCase):
def test_windowssc_x86(self):
ql = Qiling(code=X86_WIN, archtype="x86", ostype="windows", rootfs="../examples/rootfs/x86_windows")
ql = Qiling(code=X86_WIN, rootfs=r'../examples/rootfs/x86_windows', archtype=QL_ARCH.X86, ostype=QL_OS.WINDOWS, verbose=QL_VERBOSE.OFF)
ql.run()
del ql
def test_windowssc_x64(self):
ql = Qiling(code=X8664_WIN, archtype="x8664", ostype="windows", rootfs="../examples/rootfs/x8664_windows")
ql = Qiling(code=X8664_WIN, rootfs=r'../examples/rootfs/x8664_windows', archtype=QL_ARCH.X8664, ostype=QL_OS.WINDOWS, verbose=QL_VERBOSE.OFF)
ql.run()
del ql
def test_read_ptr32(self):
ql = Qiling(code=POINTER_TEST, archtype="x86", ostype="windows", rootfs="../examples/rootfs/x86_windows")
ql = Qiling(code=POINTER_TEST, rootfs=r'../examples/rootfs/x86_windows', archtype=QL_ARCH.X86, ostype=QL_OS.WINDOWS, verbose=QL_VERBOSE.OFF)
addr = ql.loader.entry_point
self.assertEqual(0x11, ql.mem.read_ptr(addr, 1))
@@ -56,7 +57,7 @@ class PEShellcodeTest(unittest.TestCase):
del ql
def test_read_ptr64(self):
ql = Qiling(code=POINTER_TEST, archtype="x8664", ostype="windows", rootfs="../examples/rootfs/x8664_windows")
ql = Qiling(code=POINTER_TEST, rootfs=r'../examples/rootfs/x8664_windows', archtype=QL_ARCH.X8664, ostype=QL_OS.WINDOWS, verbose=QL_VERBOSE.OFF)
addr = ql.loader.entry_point
self.assertEqual(0x11, ql.mem.read_ptr(addr, 1))
tests/test_r2.py
+2 -2
View File
@@ -4,7 +4,7 @@ import sys, unittest
sys.path.append("..")
from qiling import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_VERBOSE
try:
from qiling.extensions.r2.r2 import R2
@@ -19,7 +19,7 @@ EVM_CODE = bytes.fromhex("6060604052341561000f57600080fd5b60405160208061031c8339
@unittest.skipUnless(test_r2, 'libr is missing')
class R2Test(unittest.TestCase):
def test_shellcode_disasm(self):
ql = Qiling(code=EVM_CODE, archtype="evm", verbose=QL_VERBOSE.DISABLED)
ql = Qiling(code=EVM_CODE, archtype=QL_ARCH.EVM, verbose=QL_VERBOSE.DISABLED)
r2 = R2(ql)
pd = r2._cmd("pd 32")
self.assertTrue('callvalue' in pd)
tests/test_shellcode.py
+12 -20
View File
@@ -8,7 +8,7 @@ import unittest
sys.path.append("..")
from qiling import Qiling
from qiling.const import QL_INTERCEPT, QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS, QL_INTERCEPT, QL_VERBOSE
# test = bytes.fromhex('cccc')
@@ -89,17 +89,17 @@ def graceful_execve(ql: Qiling, pathname: int, argv: int, envp: int, retval: int
class TestShellcode(unittest.TestCase):
def test_linux_x86(self):
print("Linux X86 32bit Shellcode")
ql = Qiling(code=X86_LIN, archtype="x86", ostype="linux", verbose=QL_VERBOSE.OFF)
ql = Qiling(code=X86_LIN, archtype=QL_ARCH.X86, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)
ql.run()
def test_linux_x64(self):
print("Linux X86 64bit Shellcode")
ql = Qiling(code=X8664_LIN, archtype="x8664", ostype="linux", verbose=QL_VERBOSE.OFF)
ql = Qiling(code=X8664_LIN, archtype=QL_ARCH.X8664, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)
ql.run()
def test_linux_mips32(self):
print("Linux MIPS 32bit EL Shellcode")
ql = Qiling(code=MIPS32EL_LIN, archtype="mips", ostype="linux", verbose=QL_VERBOSE.OFF)
ql = Qiling(code=MIPS32EL_LIN, archtype=QL_ARCH.MIPS, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)
ql.os.set_syscall('execve', graceful_execve, QL_INTERCEPT.EXIT)
ql.run()
@@ -107,17 +107,17 @@ class TestShellcode(unittest.TestCase):
# This shellcode needs to be changed to something non-blocking
def test_linux_arm(self):
print("Linux ARM 32bit Shellcode")
ql = Qiling(code=ARM_LIN, archtype="arm", ostype="linux", verbose=QL_VERBOSE.OFF)
ql = Qiling(code=ARM_LIN, archtype=QL_ARCH.ARM, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)
ql.run()
def test_linux_arm_thumb(self):
print("Linux ARM Thumb Shllcode")
ql = Qiling(code=ARM_THUMB, archtype="arm", ostype="linux", verbose=QL_VERBOSE.OFF, thumb=True)
ql = Qiling(code=ARM_THUMB, archtype=QL_ARCH.ARM, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF, thumb=True)
ql.run()
def test_linux_arm64(self):
print("Linux ARM 64bit Shellcode")
ql = Qiling(code=ARM64_LIN, archtype="arm64", ostype="linux", verbose=QL_VERBOSE.OFF)
ql = Qiling(code=ARM64_LIN, archtype=QL_ARCH.ARM64, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)
ql.os.set_syscall('execve', graceful_execve, QL_INTERCEPT.EXIT)
ql.run()
@@ -125,37 +125,29 @@ class TestShellcode(unittest.TestCase):
# #This shellcode needs to be changed to something simpler not requiring rootfs
# def test_windows_x86(self):
# print("Windows X86 32bit Shellcode")
# ql = Qiling(code=X86_WIN, archtype="x86", ostype="windows", rootfs="../examples/rootfs/x86_reactos", verbose=QL_VERBOSE.OFF)
# ql = Qiling(code=X86_WIN, archtype=QL_ARCH.X86, ostype=QL_OS.WINDOWS, rootfs="../examples/rootfs/x86_reactos", verbose=QL_VERBOSE.OFF)
# ql.run()
# #This shellcode needs to be changed to something simpler not requiring rootfs
# def test_windows_x64(self):
# print("\nWindows X8664 64bit Shellcode")
# ql = Qiling(code=X8664_WIN, archtype="x8664", ostype="windows", rootfs="../examples/rootfs/x86_reactos", verbose=QL_VERBOSE.OFF)
# ql = Qiling(code=X8664_WIN, archtype=QL_ARCH.X8664, ostype=QL_OS.WINDOWS, rootfs="../examples/rootfs/x86_reactos", verbose=QL_VERBOSE.OFF)
# ql.run()
# #This shellcode needs to be changed to something simpler, listen is blocking
# def test_freebsd_x64(self):
# print("FreeBSD X86 64bit Shellcode")
# ql = Qiling(code=X8664_FBSD, archtype="x8664", ostype="freebsd", verbose=QL_VERBOSE.OFF)
# ql = Qiling(code=X8664_FBSD, archtype=QL_ARCH.X8664, ostype=QL_OS.FREEBSD, verbose=QL_VERBOSE.OFF)
# ql.run()
# def test_macos_x64(self):
# print("macos X86 64bit Shellcode")
# ql = Qiling(code=X8664_macos, archtype="x8664", ostype="macos", verbose=QL_VERBOSE.OFF)
# ql = Qiling(code=X8664_macos, archtype=QL_ARCH.X8664, ostype=QL_OS.MACOS, verbose=QL_VERBOSE.OFF)
# ql.run()
# def test_invalid_os(self):
# print("Testing Unknown OS")
# self.assertRaises(QlErrorOsType, Qiling, code=test, archtype="arm64", ostype="qilingos", verbose=QL_VERBOSE.DEFAULT )
# def test_invalid_arch(self):
# print("Testing Unknown Arch")
# self.assertRaises(QlErrorArch, Qiling, code=test, archtype="qilingarch", ostype="linux", verbose=QL_VERBOSE.DEFAULT )
# def test_invalid_output(self):
# print("Testing Invalid output")
# self.assertRaises(QlErrorOutput, Qiling, code=test, archtype="arm64", ostype="linux", verbose=QL_VERBOSE.DEFAULT )
# self.assertRaises(QlErrorOutput, Qiling, code=test, archtype=QL_ARCH.ARM, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.DEFAULT)
if __name__ == "__main__":