qilingframework/qiling
1
0
Fork 0
mirror of https://github.com/qilingframework/qiling.git synced 2026-10-12 02:21:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev'

Browse Source
This commit is contained in:
naq
2019-11-15 01:55:09 +08:00
parent c8d4bb60fa 76888b1cb9
commit 5cb12d121a
18 changed files with 430 additions and 440 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/hello_arm_linux.py
+2 -1
View File
@@ -11,8 +11,9 @@
# YU tong (sp1ke) <[email protected]>
import sys
sys.path.append("..")
from qiling import *
if __name__ == "__main__":
ql = Qiling(["rootfs/arm_linux/bin/arm_hello"], "rootfs/arm_linux", output = "default")
ql.run()
ql.run()
qiling/arch/x86.py
+26 -26
View File
@@ -149,7 +149,7 @@ class X8664(Arch):
return self.ql.uc.reg_read(UC_X86_REG_RSP)
def ql_x86_setup_gdt_segment(ql, uc, GDT_ADDR, GDT_LIMIT, seg_reg, index, SEGMENT_ADDR, SEGMENT_SIZE, SPORT, RPORT, GDTTYPE):
def ql_x86_setup_gdt_segment(ql, GDT_ADDR, GDT_LIMIT, seg_reg, index, SEGMENT_ADDR, SEGMENT_SIZE, SPORT, RPORT, GDTTYPE):
# create segment index
def create_selector(idx, flags):
to_ret = flags
@@ -169,11 +169,11 @@ def ql_x86_setup_gdt_segment(ql, uc, GDT_ADDR, GDT_LIMIT, seg_reg, index, SEGMEN
# map GDT table
if ql.ostype in (QL_LINUX, QL_FREEBSD) and GDTTYPE == "DS":
ql.dprint("OS Type:", ql.ostype)
uc.mem_map(GDT_ADDR, GDT_LIMIT)
ql.uc.mem_map(GDT_ADDR, GDT_LIMIT)
if ql.ostype == QL_WINDOWS and GDTTYPE == "FS":
uc.mem_map(GDT_ADDR, GDT_LIMIT)
uc.mem_map(SEGMENT_ADDR, SEGMENT_SIZE)
ql.uc.mem_map(GDT_ADDR, GDT_LIMIT)
ql.uc.mem_map(SEGMENT_ADDR, SEGMENT_SIZE)
if ql.ostype == QL_MACOS and GDTTYPE == "DS":
if not ql.shellcoder:
@@ -183,56 +183,56 @@ def ql_x86_setup_gdt_segment(ql, uc, GDT_ADDR, GDT_LIMIT, seg_reg, index, SEGMEN
GDT_ADDR = GDT_ADDR + QL_X8664_GDT_ADDR_PADDING
ql.dprint ("GDT_ADDR is 0x%x" % GDT_ADDR)
uc.mem_map(GDT_ADDR, GDT_LIMIT)
ql.uc.mem_map(GDT_ADDR, GDT_LIMIT)
# create GDT entry, then write GDT entry into GDT table
gdt_entry = create_gdt_entry(SEGMENT_ADDR, SEGMENT_SIZE, SPORT, QL_X86_F_PROT_32)
uc.mem_write(GDT_ADDR + (index << 3), gdt_entry)
ql.uc.mem_write(GDT_ADDR + (index << 3), gdt_entry)
#ql.nprint(ql.arch)
# setup GDT by writing to GDTR
uc.reg_write(UC_X86_REG_GDTR, (0, GDT_ADDR, GDT_LIMIT, 0x0))
ql.uc.reg_write(UC_X86_REG_GDTR, (0, GDT_ADDR, GDT_LIMIT, 0x0))
# create segment index, point segment register to this selector
selector = create_selector(index, RPORT)
ql.dprint("[+] SET_THREAD_AREA selector : 0x%x" % selector)
uc.reg_write(seg_reg, selector)
ql.uc.reg_write(seg_reg, selector)
def ql_x86_setup_gdt_segment_ds(ql, uc):
ql_x86_setup_gdt_segment(ql, uc, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_DS, 16, 0, 0xfffff000, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "DS")
def ql_x86_setup_gdt_segment_ds(ql):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_DS, 16, 0, 0xfffff000, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "DS")
def ql_x86_setup_gdt_segment_cs(ql, uc):
ql_x86_setup_gdt_segment(ql, uc, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_CS, 17, 0, 0xfffff000, QL_X86_A_PRESENT | QL_X86_A_CODE | QL_X86_A_CODE_READABLE | QL_X86_A_PRIV_3 | QL_X86_A_EXEC | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "CS")
def ql_x86_setup_gdt_segment_cs(ql):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_CS, 17, 0, 0xfffff000, QL_X86_A_PRESENT | QL_X86_A_CODE | QL_X86_A_CODE_READABLE | QL_X86_A_PRIV_3 | QL_X86_A_EXEC | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "CS")
def ql_x86_setup_gdt_segment_ss(ql, uc):
ql_x86_setup_gdt_segment(ql, uc, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_SS, 18, 0, 0xfffff000, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_0 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_0, "SS")
def ql_x86_setup_gdt_segment_ss(ql):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_SS, 18, 0, 0xfffff000, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_0 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_0, "SS")
def ql_x8664_setup_gdt_segment_ds(ql, uc):
ql_x86_setup_gdt_segment(ql, uc, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_DS, 16, 0, 0xfffffffffffff000, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "DS")
def ql_x8664_setup_gdt_segment_ds(ql):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_DS, 16, 0, 0xfffffffffffff000, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "DS")
def ql_x8664_setup_gdt_segment_cs(ql, uc):
ql_x86_setup_gdt_segment(ql, uc, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_CS, 17, 0, 0xfffffffffffff000, QL_X86_A_PRESENT | QL_X86_A_CODE | QL_X86_A_CODE_READABLE | QL_X86_A_PRIV_3 | QL_X86_A_EXEC | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "CS")
def ql_x8664_setup_gdt_segment_cs(ql):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_CS, 17, 0, 0xfffffffffffff000, QL_X86_A_PRESENT | QL_X86_A_CODE | QL_X86_A_CODE_READABLE | QL_X86_A_PRIV_3 | QL_X86_A_EXEC | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "CS")
def ql_x8664_setup_gdt_segment_ss(ql, uc):
ql_x86_setup_gdt_segment(ql, uc, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_SS, 18, 0, 0xfffffffffffff000, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_0 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_0, "SS")
def ql_x8664_setup_gdt_segment_ss(ql):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_SS, 18, 0, 0xfffffffffffff000, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_0 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_0, "SS")
def ql_x86_setup_syscall_set_thread_area(ql, uc, base, limit):
ql_x86_setup_gdt_segment(ql, uc , QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_GS, 12, base, limit, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "STA")
def ql_x86_setup_syscall_set_thread_area(ql, base, limit):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_GS, 12, base, limit, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "STA")
def ql_x86_setup_gdt_segment_fs(ql, uc, FS_SEGMENT_ADDR, FS_SEGMENT_SIZE):
ql_x86_setup_gdt_segment(ql, ql.uc, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_FS, 14, FS_SEGMENT_ADDR, FS_SEGMENT_SIZE, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "FS")
def ql_x86_setup_gdt_segment_fs(ql, FS_SEGMENT_ADDR, FS_SEGMENT_SIZE):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_FS, 14, FS_SEGMENT_ADDR, FS_SEGMENT_SIZE, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "FS")
def ql_x86_setup_gdt_segment_gs(ql, uc, GS_SEGMENT_ADDR, GS_SEGMENT_SIZE):
ql_x86_setup_gdt_segment(ql, ql.uc, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_GS, 15, GS_SEGMENT_ADDR, GS_SEGMENT_SIZE, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "GS")
def ql_x86_setup_gdt_segment_gs(ql, GS_SEGMENT_ADDR, GS_SEGMENT_SIZE):
ql_x86_setup_gdt_segment(ql, QL_X86_GDT_ADDR, QL_X86_GDT_LIMIT, UC_X86_REG_GS, 15, GS_SEGMENT_ADDR, GS_SEGMENT_SIZE, QL_X86_A_PRESENT | QL_X86_A_DATA | QL_X86_A_DATA_WRITABLE | QL_X86_A_PRIV_3 | QL_X86_A_DIR_CON_BIT, QL_X86_S_GDT | QL_X86_S_PRIV_3, "GS")
qiling/loader/elf.py
+13 -24
View File
@@ -355,7 +355,6 @@ class ELFLoader(ELFParse):
else:
return ql.pack32(data)
def copy_str(self, uc, addr, l):
l_addr = []
s_addr = addr
@@ -389,7 +388,7 @@ class ELFLoader(ELFParse):
def NullStr(self, s):
return s[ : s.find(b'\x00')]
def load_with_ld(self, ql, uc, stack_addr, loadbase = -1, argv = [], env = {}):
def load_with_ld(self, ql, stack_addr, loadbase = -1, argv = [], env = {}):
if loadbase <= 0:
if ql.archbit == 64:
loadbase = 0x555555554000
@@ -413,23 +412,21 @@ class ELFLoader(ELFParse):
if i['p_type'] == PT_INTERP:
interp_path = self.NullStr(super().getelfdata(i['p_offset'], i['p_filesz']))
mem_start = int(mem_start // 0x1000) * 0x1000
mem_end = int(mem_end // 0x1000 + 1) * 0x1000
if elfhead['e_type'] == ET_EXEC:
loadbase = 0
elif elfhead['e_type'] != ET_DYN:
ql.nprint("[+] Some error in head e_type!")
return -1
uc.mem_map(loadbase + mem_start, mem_end - mem_start)
ql.uc.mem_map(loadbase + mem_start, mem_end - mem_start)
ql.insert_map_info(loadbase + mem_start, loadbase + mem_end, self.path)
for i in super().parse_program_header(ql):
if i['p_type'] == PT_LOAD:
uc.mem_write(loadbase + i['p_vaddr'], super().getelfdata(i['p_offset'], i['p_filesz']))
ql.uc.mem_write(loadbase + i['p_vaddr'], super().getelfdata(i['p_offset'], i['p_filesz']))
ql.dprint("[+] load 0x%x - 0x%x"%(loadbase + i['p_vaddr'], loadbase + i['p_vaddr'] + i['p_filesz']))
@@ -437,7 +434,6 @@ class ELFLoader(ELFParse):
ql.dprint("[+] mem_start: " + hex(mem_start) + " mem_end: " + hex(mem_end))
ql.brk_address = mem_end + loadbase
# Load interpreter if there is an interpreter
@@ -467,12 +463,12 @@ class ELFLoader(ELFParse):
else:
interp_base = 0xff7d5000
uc.mem_map(interp_base, int(interp_mem_size))
ql.uc.mem_map(interp_base, int(interp_mem_size))
ql.insert_map_info(interp_base, interp_base + int(interp_mem_size), os.path.abspath(interp_path))
for i in interp.parse_program_header(ql):
if i['p_type'] == PT_LOAD:
uc.mem_write(interp_base + i['p_vaddr'], interp.getelfdata(i['p_offset'], i['p_filesz']))
ql.uc.mem_write(interp_base + i['p_vaddr'], interp.getelfdata(i['p_offset'], i['p_filesz']))
entry_point = interphead['e_entry'] + interp_base
# Set MMAP addr
@@ -495,7 +491,7 @@ class ELFLoader(ELFParse):
# Set argv
if len(argv) != 0:
argv_addr, new_stack = self.copy_str(uc, stack_addr, argv)
argv_addr, new_stack = self.copy_str(ql.uc, stack_addr, argv)
if ql.archbit == 32:
elf_table += b''.join([ql.pack32(_) for _ in argv_addr])
@@ -507,10 +503,9 @@ class ELFLoader(ELFParse):
elif ql.archbit == 64:
elf_table += ql.pack64(0)
# Set env
if len(env) != 0:
env_addr, new_stack = self.copy_str(uc, new_stack, [key + '=' + value for key, value in env.items()])
env_addr, new_stack = self.copy_str(ql.uc, new_stack, [key + '=' + value for key, value in env.items()])
if ql.archbit == 32:
elf_table += b''.join([ql.pack32(_) for _ in env_addr])
elif ql.archbit == 64:
@@ -525,7 +520,7 @@ class ELFLoader(ELFParse):
randstr = 'a' * 0x10
cpustr = 'i686'
(addr, new_stack) = self.copy_str(uc, new_stack, [randstr, cpustr])
(addr, new_stack) = self.copy_str(ql.uc, new_stack, [randstr, cpustr])
new_stack = self.alignment(new_stack, ql)
randstraddr = addr[0]
cpustraddr = addr[1]
@@ -535,11 +530,10 @@ class ELFLoader(ELFParse):
if ql.arch == QL_MIPS32EL:
new_stack = new_stack - 4
# uc.mem_write(int(new_stack) - 4, ql.pack32(0x11111111))
# ql.uc.mem_write(int(new_stack) - 4, ql.pack32(0x11111111))
# new_stack = new_stack - 4
# rand_addr = new_stack - 4
elf_table += self.NEW_AUX_ENT(AT_PHDR, loadbase + mem_start + elfhead['e_phoff'], ql)
elf_table += self.NEW_AUX_ENT(AT_PHENT, elfhead['e_phentsize'], ql)
elf_table += self.NEW_AUX_ENT(AT_PHNUM, elfhead['e_phnum'], ql)
@@ -557,30 +551,25 @@ class ELFLoader(ELFParse):
elif ql.archbit == 32:
hwcap = 0x1fb8d7
elf_table += self.NEW_AUX_ENT(AT_HWCAP, hwcap, ql)
elf_table += self.NEW_AUX_ENT(AT_CLKTCK, 100, ql)
elf_table += self.NEW_AUX_ENT(AT_RANDOM, randstraddr, ql)
elf_table += self.NEW_AUX_ENT(AT_PLATFORM, cpustraddr, ql)
elf_table += self.NEW_AUX_ENT(AT_NULL, 0, ql)
uc.mem_write(int(new_stack - len(elf_table)), elf_table)
ql.uc.mem_write(int(new_stack - len(elf_table)), elf_table)
new_stack = new_stack - len(elf_table)
if ql.ostype == QL_FREEBSD:
new_stack = new_stack - 8
# print("rdi is : " + hex(uc.reg_read(UC_X86_REG_RDI)))
# uc.reg_write(UC_X86_REG_RDI, new_stack + 8)
# print("rdi is : " + hex(ql.uc.reg_read(UC_X86_REG_RDI)))
# ql.uc.reg_write(UC_X86_REG_RDI, new_stack + 8)
# for i in range(120):
# buf = uc.mem_read(new_stack + i * 0x8, 8)
# buf = ql.uc.mem_read(new_stack + i * 0x8, 8)
# ql.nprint("0x%08x : 0x%08x " % (new_stack + i * 0x4, ql.unpack64(buf)) + ' '.join(['%02x' % i for i in buf]) + ' ' + ''.join([chr(i) if i in string.printable[ : -5].encode('ascii') else '.' for i in buf]))
ql.entry_point = entry_point
ql.elf_entry = loadbase + elfhead['e_entry']
ql.new_stack = new_stack
ql.loadbase = loadbase
qiling/os/freebsd/syscall.py
+2 -2
View File
@@ -31,9 +31,9 @@ from qiling.os.utils import *
from qiling.arch.filetype import *
def ql_syscall_clock_gettime(ql, uc, clock_gettime_clock_id, clock_gettime_timespec, null2, null3, null4, null5):
def ql_syscall_clock_gettime(ql, clock_gettime_clock_id, clock_gettime_timespec, null2, null3, null4, null5):
ql.nprint("clock_gettime()")
regreturn = 0
ql_definesyscall_return(ql, uc, regreturn)
ql_definesyscall_return(ql, regreturn)
qiling/os/freebsd/x8664.py
+5 -5
View File
@@ -63,7 +63,7 @@ def hook_syscall(ql):
freebsd_syscall_index = freebsd_syscall_numb_list.index(syscall_num)
FREEBSD_SYSCALL_FUNC= eval(freebsd_syscall_func_list[freebsd_syscall_index])
try:
FREEBSD_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
FREEBSD_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except:
ql.errmsg = 1
ql.nprint("SYSCALL: ", freebsd_syscall_func_list[freebsd_syscall_index])
@@ -85,7 +85,7 @@ def loader_file(ql):
ql.stack_size = QL_X8664_FREEBSD_PREDEFINE_STACKSIZE
uc.mem_map(ql.stack_address, ql.stack_size)
loader = ELFLoader(ql.path, ql)
loader.load_with_ld(ql, ql.uc, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
loader.load_with_ld(ql, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
ql.stack_address =(int(ql.new_stack))
@@ -105,9 +105,9 @@ def runner(ql):
ql.uc.reg_write(UC_X86_REG_RDI, ql.stack_address + 8)
ql_setup(ql)
ql.hook_insn(hook_syscall, UC_X86_INS_SYSCALL)
ql_x8664_setup_gdt_segment_ds(ql, ql.uc)
ql_x8664_setup_gdt_segment_cs(ql, ql.uc)
ql_x8664_setup_gdt_segment_ss(ql, ql.uc)
ql_x8664_setup_gdt_segment_ds(ql)
ql_x8664_setup_gdt_segment_cs(ql)
ql_x8664_setup_gdt_segment_ss(ql)
if (ql.until_addr == 0):
ql.until_addr = QL_X8664_EMU_END
qiling/os/ios/arm64.py
+4 -4
View File
@@ -65,7 +65,7 @@ def hook_syscall(ql):
ios_syscall_index = ios_syscall_numb_list.index(syscall_num)
IOS_SYSCALL_FUNC = eval(ios_syscall_func_list[ios_syscall_index])
try:
IOS_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
IOS_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except:
ql.errmsg = 1
ql.nprint("SYSCALL: ", ios_syscall_func_list[ios_syscall_index])
@@ -109,9 +109,9 @@ def runner(ql):
ql.uc.reg_write(UC_X86_REG_RSP, ql.stack_address)
ql_setup(ql)
ql.hook_insn(hook_syscall, XXX_SYSCALL_INSN_FIXME)
ql_x8664_setup_gdt_segment_ds(ql, ql.uc)
ql_x8664_setup_gdt_segment_cs(ql, ql.uc)
ql_x8664_setup_gdt_segment_ss(ql, ql.uc)
ql_x8664_setup_gdt_segment_ds(ql)
ql_x8664_setup_gdt_segment_cs(ql)
ql_x8664_setup_gdt_segment_ss(ql)
if (ql.until_addr == 0):
ql.until_addr = QL_ARM64_EMU_END
qiling/os/linux/arm.py
+17 -17
View File
@@ -75,7 +75,7 @@ def hook_syscall(ql, intno):
linux_syscall_index = linux_syscall_numb_list.index(syscall_num)
LINUX_SYSCALL_FUNC= eval(linux_syscall_func_list[linux_syscall_index])
try:
LINUX_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
LINUX_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except KeyboardInterrupt:
raise
except:
@@ -99,11 +99,11 @@ def hook_syscall(ql, intno):
ql.uc.emu_stop()
def exec_shellcode(ql, uc, start, shellcode):
def exec_shellcode(ql, start, shellcode):
if ql.shellcode_init == 0:
uc.mem_map(QL_SHELLCODE_ADDR, QL_SHELLCODE_LEN)
ql.uc.mem_map(QL_SHELLCODE_ADDR, QL_SHELLCODE_LEN)
ql.shellcode_init = 1
uc.mem_write(QL_SHELLCODE_ADDR + start, shellcode)
ql.uc.mem_write(QL_SHELLCODE_ADDR + start, shellcode)
def ql_arm_enable_vfp(uc):
@@ -121,15 +121,15 @@ def ql_arm_init_kernel_get_tls(uc):
uc.mem_write(QL_KERNEL_GET_TLS_ADDR, sc)
def ql_syscall_arm_settls(ql, uc, address, null0, null1, null2, null3, null4):
def ql_syscall_arm_settls(ql, address, null0, null1, null2, null3, null4):
ql.nprint("settls(0x%x)" % address)
if ql.thread_management != None:
ql.thread_management.cur_thread.special_settings_arg = address
reg_cpsr = uc.reg_read(UC_ARM_REG_CPSR)
PC = uc.reg_read(UC_ARM_REG_PC)
SP = uc.reg_read(UC_ARM_REG_SP)
mode = ql_arm_check_thumb(uc, reg_cpsr)
reg_cpsr = ql.uc.reg_read(UC_ARM_REG_CPSR)
PC = ql.uc.reg_read(UC_ARM_REG_PC)
SP = ql.uc.reg_read(UC_ARM_REG_SP)
mode = ql_arm_check_thumb(ql.uc, reg_cpsr)
if mode == UC_MODE_THUMB:
sc = '''
@@ -155,16 +155,16 @@ def ql_syscall_arm_settls(ql, uc, address, null0, null1, null2, null3, null4):
sc = b'p\x0f\r\xee\x04\xf0\x9d\xe4'
codestart = 4
exec_shellcode(ql, uc, codestart, sc)
exec_shellcode(ql, codestart, sc)
codelen = 0
if mode == UC_MODE_THUMB:
codelen = 1
uc.mem_write(SP - 4, ql.pack32(PC + codelen))
uc.reg_write(UC_ARM_REG_SP, SP - 4)
uc.reg_write(UC_ARM_REG_PC, QL_SHELLCODE_ADDR + codestart + codelen)
ql.uc.mem_write(SP - 4, ql.pack32(PC + codelen))
ql.uc.reg_write(UC_ARM_REG_SP, SP - 4)
ql.uc.reg_write(UC_ARM_REG_PC, QL_SHELLCODE_ADDR + codestart + codelen)
uc.mem_write(QL_KERNEL_GET_TLS_ADDR + 12, ql.pack32(address))
uc.reg_write(UC_ARM_REG_R0, address)
ql.uc.mem_write(QL_KERNEL_GET_TLS_ADDR + 12, ql.pack32(address))
ql.uc.reg_write(UC_ARM_REG_R0, address)
def ql_arm_thread_set_tls(ql, th, arg):
@@ -202,7 +202,7 @@ def ql_arm_thread_set_tls(ql, th, arg):
sc = b'p\x0f\r\xee\x04\x00\x9d\xe4\x04\xf0\x9d\xe4'
codestart = 4
exec_shellcode(ql, uc, codestart, sc)
exec_shellcode(ql, codestart, sc)
codelen = 0
if mode == UC_MODE_THUMB:
codelen = 1
@@ -223,7 +223,7 @@ def loader_file(ql):
ql.stack_size = QL_ARM_LINUX_PREDEFINE_STACKSIZE
uc.mem_map(ql.stack_address, ql.stack_size)
loader = ELFLoader(ql.path, ql)
loader.load_with_ld(ql, ql.uc, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
loader.load_with_ld(ql, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
ql.stack_address = (int(ql.new_stack))
qiling/os/linux/arm64.py
+2 -2
View File
@@ -61,7 +61,7 @@ def hook_syscall(ql, intno):
linux_syscall_index = linux_syscall_numb_list.index(syscall_num)
LINUX_SYSCALL_FUNC= eval(linux_syscall_func_list[linux_syscall_index])
try:
LINUX_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
LINUX_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except KeyboardInterrupt:
raise
except:
@@ -91,7 +91,7 @@ def loader_file(ql):
ql.stack_size = QL_ARM64_LINUX_PREDEFINE_STACKSIZE
uc.mem_map(ql.stack_address, ql.stack_size)
loader = ELFLoader(ql.path, ql)
loader.load_with_ld(ql, ql.uc, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
loader.load_with_ld(ql, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
ql.stack_address = (int(ql.new_stack))
qiling/os/linux/mips32el.py
+5 -4
View File
@@ -73,7 +73,7 @@ def hook_syscall(ql, intno):
linux_syscall_index = linux_syscall_numb_list.index(syscall_num)
LINUX_SYSCALL_FUNC= eval(linux_syscall_func_list[linux_syscall_index])
try:
LINUX_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
LINUX_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except KeyboardInterrupt:
raise
except:
@@ -193,8 +193,9 @@ lab1:
uc.mem_write(sp - 4, ql.pack32(addr))
def ql_syscall_mips32el_set_thread_area(ql, uc, sta_area, null0, null1, null2, null3, null4):
def ql_syscall_mips32el_set_thread_area(ql, sta_area, null0, null1, null2, null3, null4):
ql.nprint ("set_thread_area(0x%x)" % sta_area)
uc = ql.uc
pc = uc.reg_read(UC_MIPS_REG_PC)
CONFIG3_ULR = (1 << 13)
uc.reg_write(UC_MIPS_REG_CP0_CONFIG3, CONFIG3_ULR)
@@ -210,7 +211,7 @@ def loader_file(ql):
ql.stack_size = QL_MIPSEL_LINUX_PREDEFINE_STACKSIZE
uc.mem_map(ql.stack_address, ql.stack_size)
loader = ELFLoader(ql.path, ql)
loader.load_with_ld(ql, uc, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
loader.load_with_ld(ql, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
ql.stack_address = (int(ql.new_stack))
@@ -248,4 +249,4 @@ def runner(ql):
ql.nprint("%s" % e)
if ql.internal_exception != None:
raise ql.internal_exception
raise ql.internal_exception
qiling/os/linux/syscall.py
+1 -2
View File
@@ -26,7 +26,6 @@ from unicorn.x86_const import *
from unicorn.arm64_const import *
from unicorn.mips_const import *
# impport read_string and other commom utils.
# impport read_string and other common utils.
from qiling.os.utils import *
from qiling.arch.filetype import *
qiling/os/linux/x86.py
+13 -13
View File
@@ -63,7 +63,7 @@ def hook_syscall(ql, intno):
linux_syscall_index = linux_syscall_numb_list.index(syscall_num)
LINUX_SYSCALL_FUNC= eval(linux_syscall_func_list[linux_syscall_index])
try:
LINUX_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
LINUX_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except KeyboardInterrupt:
raise
except:
@@ -90,25 +90,25 @@ def hook_syscall(ql, intno):
def ql_x86_thread_set_tls(ql, th, arg):
u_info = arg
# u_info = uc.mem_read(u_info_addr, 4 * 3)
# u_info = ql.uc.mem_read(u_info_addr, 4 * 3)
base = ql.unpack32(u_info[4 : 8])
limit = ql.unpack32(u_info[8 : 12])
ql_x86_setup_syscall_set_thread_area(ql, ql.uc, base, limit)
ql_x86_setup_syscall_set_thread_area(ql, base, limit)
def ql_x86_syscall_set_thread_area(ql, uc, u_info_addr, null0, null1, null2, null3, null4):
def ql_x86_syscall_set_thread_area(ql, u_info_addr, null0, null1, null2, null3, null4):
ql.nprint("set_thread_area(u_info_addr= 0x%x)" % u_info_addr)
u_info = uc.mem_read(u_info_addr, 4 * 3)
u_info = ql.uc.mem_read(u_info_addr, 4 * 3)
ql.thread_management.cur_thread.set_special_settings_arg(u_info)
base = ql.unpack32(u_info[4 : 8])
limit = ql.unpack32(u_info[8 : 12])
ql.nprint("[+] set_thread_area base : 0x%x limit is : 0x%x" % (base, limit))
ql_x86_setup_syscall_set_thread_area(ql, uc, base, limit)
uc.mem_write(u_info_addr, ql.pack32(12))
ql_x86_setup_syscall_set_thread_area(ql, base, limit)
ql.uc.mem_write(u_info_addr, ql.pack32(12))
regreturn = 0
ql_definesyscall_return(ql, uc, regreturn)
ql_definesyscall_return(ql, regreturn)
def loader_file(ql):
@@ -119,7 +119,7 @@ def loader_file(ql):
ql.stack_size = QL_X86_LINUX_PREDEFINE_STACKSIZE
uc.mem_map(ql.stack_address, ql.stack_size)
loader = ELFLoader(ql.path, ql)
loader.load_with_ld(ql, ql.uc, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
loader.load_with_ld(ql, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
ql.stack_address = (int(ql.new_stack))
@@ -138,9 +138,9 @@ def runner(ql):
ql.uc.reg_write(UC_X86_REG_ESP, ql.stack_address)
ql_setup(ql)
ql.hook_intr(hook_syscall)
ql_x86_setup_gdt_segment_ds(ql, ql.uc)
ql_x86_setup_gdt_segment_cs(ql, ql.uc)
ql_x86_setup_gdt_segment_ss(ql, ql.uc)
ql_x86_setup_gdt_segment_ds(ql)
ql_x86_setup_gdt_segment_cs(ql)
ql_x86_setup_gdt_segment_ss(ql)
if (ql.until_addr == 0):
ql.until_addr = QL_X86_EMU_END
@@ -170,4 +170,4 @@ def runner(ql):
ql.nprint("%s" % e)
if ql.internal_exception != None:
raise ql.internal_exception
raise ql.internal_exception
qiling/os/linux/x8664.py
+6 -6
View File
@@ -63,7 +63,7 @@ def hook_syscall(ql):
linux_syscall_index = linux_syscall_numb_list.index(syscall_num)
LINUX_SYSCALL_FUNC= eval(linux_syscall_func_list[linux_syscall_index])
try:
LINUX_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
LINUX_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except KeyboardInterrupt:
raise
except:
@@ -88,7 +88,7 @@ def loader_file(ql):
ql.stack_size = QL_X8664_LINUX_PREDEFINE_STACKSIZE
uc.mem_map(ql.stack_address, ql.stack_size)
loader = ELFLoader(ql.path, ql)
loader.load_with_ld(ql, ql.uc, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
loader.load_with_ld(ql, ql.stack_address + ql.stack_size, argv = ql.argv, env = ql.env)
ql.stack_address = (int(ql.new_stack))
@@ -108,9 +108,9 @@ def runner(ql):
ql_setup(ql)
ql.hook_insn(hook_syscall, UC_X86_INS_SYSCALL)
if not ql.shellcoder:
ql_x8664_setup_gdt_segment_ds(ql, ql.uc)
ql_x8664_setup_gdt_segment_cs(ql, ql.uc)
ql_x8664_setup_gdt_segment_ss(ql, ql.uc)
ql_x8664_setup_gdt_segment_ds(ql)
ql_x8664_setup_gdt_segment_cs(ql)
ql_x8664_setup_gdt_segment_ss(ql)
if (ql.until_addr == 0):
ql.until_addr = QL_X8664_EMU_END
@@ -132,4 +132,4 @@ def runner(ql):
if ql.internal_exception != None:
raise ql.internal_exception
raise ql.internal_exception
qiling/os/macos/syscall.py
+19 -19
View File
@@ -40,21 +40,21 @@ from qiling.arch.x86 import *
################
# 0x1a
def ql_x86_syscall_mach_reply_port(ql, uc, null0, null1, null2, null3, null4, null5):
def ql_x86_syscall_mach_reply_port(ql, null0, null1, null2, null3, null4, null5):
ql.nprint("syscall[mach] >> mach reply port")
# 0x1c
def ql_x86_syscall_task_self_trap(ql, uc, null0, null1, null2, null3, null4, null5):
def ql_x86_syscall_task_self_trap(ql, null0, null1, null2, null3, null4, null5):
ql.nprint("syscall[mach] >> task self trap")
# 0x1d
def ql_x86_syscall_host_self_trap(ql, uc, null0, null1, null2, null3, null4, null5):
def ql_x86_syscall_host_self_trap(ql, null0, null1, null2, null3, null4, null5):
ql.nprint("syscall[mach] >> host_self_trap")
# 0x1f
def ql_x86_syscall_mach_msg_trap(ql, uc, args, null1, null2, null3, null4, null5):
def ql_x86_syscall_mach_msg_trap(ql, args, null1, null2, null3, null4, null5):
ql.nprint("syscall[mach] >> mach_msg_trap(0x%X)" % args)
ql_definesyscall_return(ql, uc, MACH_MSG_SUCCESS)
ql_definesyscall_return(ql, MACH_MSG_SUCCESS)
#################
@@ -62,40 +62,40 @@ def ql_x86_syscall_mach_msg_trap(ql, uc, args, null1, null2, null3, null4, null5
#################
# 0x30
def ql_syscall_sigprocmask(ql, uc, how, mask, omask, null0, null1, null2):
def ql_syscall_sigprocmask(ql, how, mask, omask, null0, null1, null2):
ql.nprint("syscall >> sigprocmask(how: 0x%X, mask: 0x%X, omask: 0x%X)" % (how, mask, omask))
# 0x174
def ql_syscall_thread_selfid(ql, uc, null0, null1, null2, null3, null4, null5):
def ql_syscall_thread_selfid(ql, null0, null1, null2, null3, null4, null5):
ql.nprint("syscall >> thread selfid")
# 0xa9
def ql_syscall_csops(ql, uc, pid, ops, useraddr, usersize, null0, null1):
def ql_syscall_csops(ql, pid, ops, useraddr, usersize, null0, null1):
ql.nprint("syscall >> csops(pid: %d, ops: 0x%X, useraddr: 0x%X, usersize: 0x%X)" % (pid, ops, useraddr, usersize))
# 0x1e3
def ql_syscall_csrctl(ql, uc, op, useraddr, usersize, null0, null1, null2):
ql_definesyscall_return(ql, uc, 1)
def ql_syscall_csrctl(ql, op, useraddr, usersize, null0, null1, null2):
ql_definesyscall_return(ql, 1)
# 0x1f4
def ql_syscall_getentropy(ql, uc, buffer, size, null0, null1, null2, null3):
def ql_syscall_getentropy(ql, buffer, size, null0, null1, null2, null3):
ql.nprint("syscall >> getentropy(buffer: 0x%X, size: %d)" % (buffer, size))
ql_definesyscall_return(ql, uc, 0)
ql_definesyscall_return(ql, 0)
# 0x208
def ql_syscall_terminate_with_payload(ql, uc, pid, reason_namespace, reason_code, payload, payload_size, reason_string):
def ql_syscall_terminate_with_payload(ql, pid, reason_namespace, reason_code, payload, payload_size, reason_string):
ql.nprint("syscall >> terminate_with_payload(pid: %d, reason_namespace: 0x%X, reason_code: 0x%X, payload: 0x%X \
payload_size: 0x%X, reason_string: 0x%X)" % (pid, reason_namespace, reason_code,
payload, payload_size, reason_string))
ql_definesyscall_return(ql, uc, 0)
ql_definesyscall_return(ql, 0)
uc.emu_stop()
# 0x209
def ql_syscall_abort_with_payload(ql, uc, reason_namespace, reason_code, payload, payload_size, reason_string, reason_flags):
def ql_syscall_abort_with_payload(ql, reason_namespace, reason_code, payload, payload_size, reason_string, reason_flags):
ql.nprint("syscall >> abort_with_payload(reason_namespace: 0x%X, reason_code: 0x%X, payload: 0x%X, payload_size: 0x%X, reason_string: 0x%X,\
reason_flags: 0x%X)" % (reason_namespace, reason_code, payload, payload_size, reason_string, reason_flags))
ql_definesyscall_return(ql, uc, 0)
ql_definesyscall_return(ql, 0)
################
@@ -103,7 +103,7 @@ def ql_syscall_abort_with_payload(ql, uc, reason_namespace, reason_code, payload
################
# 0x3
def ql_x86_syscall_thread_set_tsd_base(ql, uc, u_info_addr, null0, null1, null2, null3, null4):
def ql_x86_syscall_thread_set_tsd_base(ql, u_info_addr, null0, null1, null2, null3, null4):
ql.nprint("syscall[mdep] >> thread set tsd base")
return
# ql.nprint("set_thread_area(u_info_addr= 0x%x)" % u_info_addr)
@@ -111,7 +111,7 @@ def ql_x86_syscall_thread_set_tsd_base(ql, uc, u_info_addr, null0, null1, null2,
# base = ql.unpack32(u_info[4 : 8])
# limit = ql.unpack32(u_info[8 : 12])
# ql.nprint("|-->>> set_thread_area base : 0x%x limit is : 0x%x" % (base, limit))
# ql_x86_setup_syscall_set_thread_area(ql, uc, base, limit)
# ql_x86_setup_syscall_set_thread_area(ql, base, limit)
# uc.mem_write(u_info_addr, ql.pack32(12))
# regreturn = 0
# ql_definesyscall_return(ql, uc, regreturn)
# ql_definesyscall_return(ql, regreturn)
qiling/os/macos/x86.py
+4 -4
View File
@@ -74,7 +74,7 @@ def hook_syscall(ql, intno):
macos_syscall_index = macos_syscall_numb_list.index(syscall_num)
MACOS_SYSCALL_FUNC = eval(macos_syscall_func_list[macos_syscall_index])
try:
MACOS_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
MACOS_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except:
ql.errmsg = 1
ql.nprint("SYSCALL: ", macos_syscall_func_list[macos_syscall_index])
@@ -118,9 +118,9 @@ def runner(ql):
ql.uc.reg_write(UC_X86_REG_ESP, ql.stack_address)
ql_setup(ql)
ql.hook_intr(hook_syscall)
ql_x86_setup_gdt_segment_ds(ql, ql.uc)
ql_x86_setup_gdt_segment_cs(ql, ql.uc)
ql_x86_setup_gdt_segment_ss(ql, ql.uc)
ql_x86_setup_gdt_segment_ds(ql)
ql_x86_setup_gdt_segment_cs(ql)
ql_x86_setup_gdt_segment_ss(ql)
if (ql.until_addr == 0):
ql.until_addr = QL_X86_EMU_END
qiling/os/macos/x8664.py
+5 -5
View File
@@ -65,7 +65,7 @@ def hook_syscall(ql):
macos_syscall_index = macos_syscall_numb_list.index(syscall_num)
MACOS_SYSCALL_FUNC = eval(macos_syscall_func_list[macos_syscall_index])
try:
MACOS_SYSCALL_FUNC(ql, ql.uc, param0, param1, param2, param3, param4, param5)
MACOS_SYSCALL_FUNC(ql, param0, param1, param2, param3, param4, param5)
except:
ql.errmsg = 1
ql.nprint("SYSCALL: ", macos_syscall_func_list[macos_syscall_index])
@@ -90,7 +90,7 @@ def loader_file(ql):
stack_esp = QL_X8664_MACOS_PREDEFINE_STACKADDRESS + QL_X8664_MACOS_PREDEFINE_STACKSIZE
envs = env_dict_to_array(ql.env)
# loader = MachoX8664(ql, ql.path, stack_esp, [ql.path], envs, "/bin/x8664_hello", 1)
apples = ql_real_to_vm_abspath(ql, uc, ql.path)
apples = ql_real_to_vm_abspath(ql, ql.path)
loader = MachoX8664(ql, ql.path, stack_esp, [ql.path], envs, apples, 1)
loader.loadMachoX8664()
ql.stack_address = (int(ql.stack_esp))
@@ -112,9 +112,9 @@ def runner(ql):
ql.uc.reg_write(UC_X86_REG_RSP, ql.stack_address)
ql_setup(ql)
ql.hook_insn(hook_syscall, UC_X86_INS_SYSCALL)
ql_x8664_setup_gdt_segment_ds(ql, ql.uc)
ql_x8664_setup_gdt_segment_cs(ql, ql.uc)
ql_x8664_setup_gdt_segment_ss(ql, ql.uc)
ql_x8664_setup_gdt_segment_ds(ql)
ql_x8664_setup_gdt_segment_cs(ql)
ql_x8664_setup_gdt_segment_ss(ql)
if (ql.until_addr == 0):
ql.until_addr = QL_X8664_EMU_END
qiling/os/posix/syscall.py
+280 -280
View File
File diff suppressed because it is too large Load Diff
qiling/os/utils.py
+21 -21
View File
@@ -36,19 +36,19 @@ import struct
import os
def ql_definesyscall_return(ql, uc, regreturn):
def ql_definesyscall_return(ql, regreturn):
if (ql.arch == QL_ARM): # QL_ARM
uc.reg_write(UC_ARM_REG_R0, regreturn)
ql.uc.reg_write(UC_ARM_REG_R0, regreturn)
#ql.nprint("-[+] Write %i to UC_ARM_REG_R0" % regreturn)
elif (ql.arch == QL_ARM64): # QL_ARM64
uc.reg_write(UC_ARM64_REG_X0, regreturn)
ql.uc.reg_write(UC_ARM64_REG_X0, regreturn)
elif (ql.arch == QL_X86): # QL_X86
uc.reg_write(UC_X86_REG_EAX, regreturn)
ql.uc.reg_write(UC_X86_REG_EAX, regreturn)
elif (ql.arch == QL_X8664): # QL_X86_64
uc.reg_write(UC_X86_REG_RAX, regreturn)
ql.uc.reg_write(UC_X86_REG_RAX, regreturn)
elif (ql.arch == QL_MIPS32EL): # QL_MIPSE32EL
if regreturn == -1:
@@ -60,8 +60,8 @@ def ql_definesyscall_return(ql, uc, regreturn):
a3return = 0
#if ql.output == QL_OUT_DEBUG:
# print("[+] A3 is %d" % a3return)
uc.reg_write(UC_MIPS_REG_V0, regreturn)
uc.reg_write(UC_MIPS_REG_A3, a3return)
ql.uc.reg_write(UC_MIPS_REG_V0, regreturn)
ql.uc.reg_write(UC_MIPS_REG_A3, a3return)
def ql_bin_to_ipv4(ip):
return "%d.%d.%d.%d" % (
@@ -71,14 +71,14 @@ def ql_bin_to_ipv4(ip):
(ip & 0xff))
def ql_read_string(ql, uc, address):
def ql_read_string(ql, address):
ret = ""
c = uc.mem_read(address, 1)[0]
c = ql.uc.mem_read(address, 1)[0]
read_bytes = 1
while c != 0x0:
ret += chr(c)
c = uc.mem_read(address + read_bytes, 1)[0]
c = ql.uc.mem_read(address + read_bytes, 1)[0]
read_bytes += 1
return ret
@@ -230,7 +230,7 @@ def ql_asm2bytes(ql, archtype, runcode, arm_thumb):
archtype, archmode = ks_convert(archtype)
return compile_instructions(runcode, archtype, archmode)
def ql_transform_to_link_path(ql, uc, path):
def ql_transform_to_link_path(ql, path):
if ql.thread_management != None:
cur_path = ql.thread_management.cur_thread.get_current_path()
else:
@@ -259,7 +259,7 @@ def ql_transform_to_link_path(ql, uc, path):
return real_path
def ql_transform_to_real_path(ql, uc, path):
def ql_transform_to_real_path(ql, path):
if ql.thread_management != None:
cur_path = ql.thread_management.cur_thread.get_current_path()
else:
@@ -292,14 +292,14 @@ def ql_transform_to_real_path(ql, uc, path):
if os.path.islink(real_path):
link_path = os.readlink(real_path)
if link_path[0] == '/':
real_path = ql_transform_to_real_path(ql, uc, link_path)
real_path = ql_transform_to_real_path(ql, link_path)
else:
real_path = ql_transform_to_real_path(ql, uc, os.path.dirname(relative_path) + '/' + link_path)
real_path = ql_transform_to_real_path(ql, os.path.dirname(relative_path) + '/' + link_path)
return real_path
def ql_transform_to_relative_path(ql, uc, path):
def ql_transform_to_relative_path(ql, path):
if ql.thread_management != None:
cur_path = ql.thread_management.cur_thread.get_current_path()
else:
@@ -312,32 +312,32 @@ def ql_transform_to_relative_path(ql, uc, path):
return relative_path
def ql_vm_to_vm_abspath(ql, uc, relative_path):
def ql_vm_to_vm_abspath(ql, relative_path):
if path[0] == '/':
# abspath input
abspath = relative_path
return os.path.abspath(abspath)
else:
# relative path input
cur_path = ql_get_vm_current_path(ql, uc)
cur_path = ql_get_vm_current_path(ql)
return os.path.abspath(cur_path + '/' + relative_path)
def ql_vm_to_real_abspath(ql, uc, path):
def ql_vm_to_real_abspath(ql, path):
# TODO:// check Directory traversal, we have the vul
if path[0] != '/':
# relative path input
cur_path = ql_get_vm_current_path(ql, uc)
cur_path = ql_get_vm_current_path(ql)
path = cur_path + '/' + path
return os.path.abspath(ql.rootfs + path)
def ql_real_to_vm_abspath(ql, uc, path):
def ql_real_to_vm_abspath(ql, path):
# rm ".." in path
abs_path = os.path.abspath(path)
abs_rootfs = os.path.abspath(ql.rootfs)
return '/' + abs_path.lstrip(abs_rootfs)
def ql_get_vm_current_path(ql, uc):
def ql_get_vm_current_path(ql):
if ql.thread_management != None:
return ql.thread_management.cur_thread.get_current_path()
else:
qiling/os/windows/x86.py
+5 -5
View File
@@ -77,11 +77,11 @@ def setup_windows32(ql):
ql.RUN = True
# New set GDT Share with Linux
ql_x86_setup_gdt_segment_fs(ql, ql.uc, ql.FS_SEGMENT_ADDR, ql.FS_SEGMENT_SIZE)
ql_x86_setup_gdt_segment_gs(ql, ql.uc, ql.GS_SEGMENT_ADDR, ql.GS_SEGMENT_SIZE)
ql_x86_setup_gdt_segment_ds(ql, ql.uc)
ql_x86_setup_gdt_segment_cs(ql, ql.uc)
ql_x86_setup_gdt_segment_ss(ql, ql.uc)
ql_x86_setup_gdt_segment_fs(ql, ql.FS_SEGMENT_ADDR, ql.FS_SEGMENT_SIZE)
ql_x86_setup_gdt_segment_gs(ql, ql.GS_SEGMENT_ADDR, ql.GS_SEGMENT_SIZE)
ql_x86_setup_gdt_segment_ds(ql)
ql_x86_setup_gdt_segment_cs(ql)
ql_x86_setup_gdt_segment_ss(ql)
# handle manager
ql.handle_manager = HandleManager()