qilingframework/qiling
1
0
Fork 0
mirror of https://github.com/qilingframework/qiling.git synced 2026-10-12 02:21:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix example script issues

Browse Source
This commit is contained in:
kabeor
2022-07-14 14:33:58 +08:00
parent d1fdb19524
commit bc9680d08f
2 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/hello_x8664_linux_part_exec.py
+11 -4
View File
@@ -10,13 +10,20 @@ from qiling import Qiling
from qiling.const import QL_VERBOSE
if __name__ == "__main__":
ql = Qiling(["rootfs/x8664_linux/bin/sleep_hello"], "rootfs/x8664_linux", verbose=QL_VERBOSE.DEFAULT)
def dump(ql, *args, **kw):
ql.save(reg=False, cpu_context=True, snapshot="/tmp/snapshot.bin")
ql.emu_stop()
ql = Qiling(["rootfs/x8664_linux/bin/sleep_hello"], "rootfs/x8664_linux", verbose=QL_VERBOSE.DEBUG)
X64BASE = int(ql.profile.get("OS64", "load_address"), 16)
ql.hook_address(dump, X64BASE + 0x1094)
ql.run()
ql = Qiling(["rootfs/x8664_linux/bin/sleep_hello"], "rootfs/x8664_linux", verbose=QL_VERBOSE.DISASM)
# load base address from profile file
X64BASE = int(ql.profile.get("OS64", "load_address"), 16)
ql.restore(snapshot="/tmp/snapshot.bin")
# set execution starting and ending points
begin_point = X64BASE + 0x109e
end_point = X64BASE + 0x10bc
ql.run(begin=begin_point, end=end_point)
ql.run(begin = begin_point, end = end_point)
examples/uefi_sanitized_heap.py
+11 -6
View File
@@ -16,12 +16,17 @@ def my_abort(msg):
os.abort()
def enable_sanitized_heap(ql, fault_rate=0):
ql.os.heap = QlSanitizedMemoryHeap(ql, ql.os.heap, fault_rate=fault_rate)
heap = QlSanitizedMemoryHeap(ql, ql.os.heap, fault_rate=fault_rate)
ql.os.heap.oob_handler = lambda *args: my_abort("Out-of-bounds read detected")
ql.os.heap.bo_handler = lambda *args: my_abort("Buffer overflow/underflow detected")
ql.os.heap.bad_free_handler = lambda *args: my_abort("Double free or bad free detected")
ql.os.heap.uaf_handler = lambda *args: my_abort("Use-after-free detected")
heap.oob_handler = lambda *args: my_abort(f'Out-of-bounds read detected')
heap.bo_handler = lambda *args: my_abort(f'Buffer overflow/underflow detected')
heap.bad_free_handler = lambda *args: my_abort(f'Double free or bad free detected')
heap.uaf_handler = lambda *args: my_abort(f'Use-after-free detected')
# make sure future allocated buffers are not too close to UEFI data
heap.alloc(0x1000)
ql.os.heap = heap
def sanitized_emulate(path, rootfs, fault_type, verbose=QL_VERBOSE.DEBUG):
env = {'FaultType': fault_type}
@@ -39,7 +44,7 @@ Usage: ./uefi_santizied_heap.py <fault-type>
Valid fault types:
0 - POOL_OVERFLOW_MEMCPY
1 - POOL_UNDERFLOW_MEMCPY
2 - POOL_OVERFLOW_USER,
2 - POOL_OVERFLOW_USER
3 - POOL_UNDERFLOW_USER
4 - POOL_OOB_READ_AHEAD
5 - POOL_OOB_READ_BEHIND