support dylib in mem unmap

qiling/os/posix/syscall/mman.py

@@ -23,13 +23,14 @@ from qiling.exception import *
 def ql_syscall_munmap(ql, munmap_addr, munmap_len, *args, **kw):
 
     # get all mapped fd with flag MAP_SHARED and we definitely dont want to wipe out share library
-    mapped_fd = [fd for fd in ql.os.fd if fd != 0 and isinstance(fd, ql_file) and fd._is_map_shared and not fd.name.endswith(".so")]
+    mapped_fd = [fd for fd in ql.os.fd if fd != 0 and isinstance(fd, ql_file) and fd._is_map_shared and not (fd.name.endswith(".so") or fd.name.endswith(".dylib"))]
 
     if len(mapped_fd):
         all_mem_info = [_mem_info for _, _, _, _mem_info in ql.mem.map_info if _mem_info not in ("[mapped]", "[stack]", "[hook_mem]")]
 
         for _fd in mapped_fd:
             if _fd.name in [each.split()[-1] for each in all_mem_info]:
+                ql.log.debug("Flushing file: %s" % _fd.name)
                 # flushes changes to disk file
                 _buff = ql.mem.read(munmap_addr, munmap_len)
                 _fd.lseek(_fd._mapped_offset)

tests/test_macho.py

@@ -16,7 +16,7 @@ class MACHOTest(unittest.TestCase):
         ql.run()
 
     def test_usercorn_x8664(self):
-        ql = Qiling(["../examples/rootfs/x8664_macos/bin/x8664_hello_usercorn"], "../examples/rootfs/x8664_macos", output = "debug")
+        ql = Qiling(["../examples/rootfs/x8664_macos/bin/x8664_hello_usercorn"], "../examples/rootfs/x8664_macos", verbose=QL_VERBOSE.DEBUG)
         ql.run()
 
 if __name__ == "__main__":