A client that resumes while a signal is pending sends a vCont action of the
form 'C<sig>' (continue and deliver) or 'S<sig>' (step and deliver), e.g.
'vCont;S0f:pa410.1996;c:pa410.-1' -- the exact packet reported in issue
#1377. handle_v matched only 'c'/'C05' and 's'/'S05', so any other signal
fell through to an empty reply and clients aborted the session with
'Invalid remote reply:'.
We do not deliver host signals to the guest, so the signal value carries no
meaning for us: accept any of them and carry the action out as a plain
resume or step, which is what the client asked for. This matters more now
that the stub can stop with SIGINT on an async interrupt, since a client
may well resume from such a stop with 'C02'.
Also stop assuming os.exit_code exists when reporting termination: bare-metal
os layers (QlOsMcu) do not define it, which turns the exit path into an
AttributeError (seen in issue #1276). The underlying MCU interrupt handling
of #1276 is out of scope here.
Add a regression test asserting the '#1377' packet is answered with a
SIGTRAP stop-reply and that a signalled continue runs the guest to
termination; both replies are empty without the fix.
Fixes#1377
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The stub drove continue by calling emu_start synchronously and only read
the socket again once the target stopped on its own, so the bare \x03 break
byte a client sends to pause a running target was never seen. A guest that
free-runs (e.g. an idle/event loop) could not be interrupted at all --
gdb/Ghidra reported 'Cannot execute this command while the target is running'.
Poll the client socket for the break byte from the per-instruction run hook
(dbg_hook), which does run on the emulation thread during emu_start:
- GdbSerialConn.poll_interrupt(): non-blocking select+recv, True on \x03.
- QlGdbUtils.dbg_hook: throttled (every INTR_POLL_INTERVAL insns) check of an
installed check_interrupt callback; on a break, stop emulation and record it.
- handle_c: reply SIGINT when the stop was an interrupt rather than a
breakpoint or normal exit.
Add a regression test that lets an infinite-loop guest free-run, sends the
bare break byte and asserts the stop-reply is 'S02' (SIGINT). Without the
fix no reply ever arrives, so the test stops the guest itself and fails
rather than hanging the run.
Also verified against a free-running MIPS64 BE guest: \x03 -> S02 in <1ms.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
handle_s answered every single-step ('s') with a SIGTERM stop-reply
whenever ql.emu_state was QL_STATE.STOPPED. But emu_start always leaves
the state STOPPED after running the requested step count, so the guard
was true on every step and gdb clients saw a spurious termination signal,
disconnecting mid-debug (issues #1377, #1538).
Give handle_s the same exit-vs-trap discrimination handle_c already uses:
a step reports SIGTRAP unless it carried pc to the emulation exit point,
in which case the guest has actually terminated and we reply W{exit_code}.
Also wrap the step in the same UcError/KeyboardInterrupt handling as
handle_c so a fault while stepping maps to a signal instead of crashing
the stub, and hoist the shared uc-error->signal map to a module constant.
Add a regression test that single-steps over the gdb stub and asserts the
stop-reply is 'S05' (SIGTRAP), which fails as 'S0f' (SIGTERM) without the fix.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The first line reads `from future import __annotations__`, with the
module name and the imported symbol swapped. The intent was clearly the
PEP 563 future statement `from __future__ import annotations`.
As written, the line fails in both possible situations:
- without the third-party `future` package installed (the common case),
the import raises `ModuleNotFoundError`, so `QILING_IDA` is never
defined;
- with that package installed, the import silently succeeds but binds
the module's empty `__annotations__` dict, so PEP 563 is *not*
enabled — while the annotations in this file (`ql: Qiling`) rely on
it, `Qiling` being imported under `TYPE_CHECKING` only.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Pru9dwqPVrDakERYZwzjUx
FiberManager.free/set/get set `self.last_error` on the FiberManager
instance, but nothing ever reads that attribute. The Windows last-error
that GetLastError returns lives on `ql.os.last_error`, so FlsFree,
FlsSetValue and FlsGetValue never actually reported ERROR_INVALID_PARAMETER
for an invalid FLS index. Route the three writes to `self.ql.os.last_error`,
consistent with every other kernel32 hook.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Modern glibc (recent toolchains) issues clone3 from pthread_create rather
than clone, so thread creation fails on any guest built against it: Qiling
does not return -ENOSYS for unimplemented syscalls (it logs a warning and
leaves the return register untouched), so glibc's clone3->clone fallback
never fires.
Add ql_syscall_clone3, which unpacks struct clone_args and delegates to the
existing clone() handler. Translations: child_stack = stack + stack_size
(clone3 passes the stack base plus a size; legacy clone wants the highest
address), exit_signal folded into the flags' CSIGNAL byte, and an x8664
pre-swap that cancels ql_syscall_clone's arch-specific newtls<->child_tidptr
swap.
Add a self-contained regression test (test_clone3_translates_to_clone) that
drives ql_syscall_clone3 directly and asserts the translation for both the
generic path and the x8664 swap. Runs on stock unicorn; no clone3 binary
needed.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
xwings