From 6ef2211e30744ba577de7cbf5ff817947d39b358 Mon Sep 17 00:00:00 2001
From: 0xPhoenix <0xPhoeniX@users.noreply.github.com>
Date: Sat, 10 Apr 2021 17:03:59 -0400
Subject: [PATCH] support dylib in mem unmap

---
 examples/rootfs                 | 1 +
 qiling/os/posix/syscall/mman.py | 3 ++-
 tests/test_macho.py             | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)
 create mode 160000 examples/rootfs

diff --git a/examples/rootfs b/examples/rootfs
new file mode 160000
index 00000000..498b100f
--- /dev/null
+++ b/examples/rootfs
@@ -0,0 +1 @@
+Subproject commit 498b100f17b7ed24ff7cfb24d46205aba47339b2
diff --git a/qiling/os/posix/syscall/mman.py b/qiling/os/posix/syscall/mman.py
index d2eb4757..3bb28681 100644
--- a/qiling/os/posix/syscall/mman.py
+++ b/qiling/os/posix/syscall/mman.py
@@ -23,13 +23,14 @@ from qiling.exception import *
 def ql_syscall_munmap(ql, munmap_addr, munmap_len, *args, **kw):
 
     # get all mapped fd with flag MAP_SHARED and we definitely dont want to wipe out share library
-    mapped_fd = [fd for fd in ql.os.fd if fd != 0 and isinstance(fd, ql_file) and fd._is_map_shared and not fd.name.endswith(".so")]
+    mapped_fd = [fd for fd in ql.os.fd if fd != 0 and isinstance(fd, ql_file) and fd._is_map_shared and not (fd.name.endswith(".so") or fd.name.endswith(".dylib"))]
 
     if len(mapped_fd):
         all_mem_info = [_mem_info for _, _, _, _mem_info in ql.mem.map_info if _mem_info not in ("[mapped]", "[stack]", "[hook_mem]")]
 
         for _fd in mapped_fd:
             if _fd.name in [each.split()[-1] for each in all_mem_info]:
+                ql.log.debug("Flushing file: %s" % _fd.name)
                 # flushes changes to disk file
                 _buff = ql.mem.read(munmap_addr, munmap_len)
                 _fd.lseek(_fd._mapped_offset)
diff --git a/tests/test_macho.py b/tests/test_macho.py
index 5e400269..ae766915 100644
--- a/tests/test_macho.py
+++ b/tests/test_macho.py
@@ -16,7 +16,7 @@ class MACHOTest(unittest.TestCase):
         ql.run()
 
     def test_usercorn_x8664(self):
-        ql = Qiling(["../examples/rootfs/x8664_macos/bin/x8664_hello_usercorn"], "../examples/rootfs/x8664_macos", output = "debug")
+        ql = Qiling(["../examples/rootfs/x8664_macos/bin/x8664_hello_usercorn"], "../examples/rootfs/x8664_macos", verbose=QL_VERBOSE.DEBUG)
         ql.run()
 
 if __name__ == "__main__":