Skip to content

Commit b313628

Browse files
authored
Merge pull request #606 from learn-more/ql_tweaks
Some minor usability tweaks
2 parents d43f4fd + abd423a commit b313628

File tree

5 files changed

+22
-17
lines changed

5 files changed

+22
-17
lines changed

.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,5 @@ test.file
3232
*.o
3333
core
3434
*.perf
35+
examples/rootfs/x86_windows/Windows/registry
36+
examples/rootfs/x8664_windows/Windows/registry

qiling/loader/pe.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -349,17 +349,17 @@ def __init__(self, ql):
349349
self.path = self.ql.path
350350

351351
def run(self):
352-
self.init_dlls = [b"ntoskrnl.exe", b"ntdll.dll", b"kernel32.dll", b"user32.dll"]
353-
self.sys_dlls = [b"ntoskrnl.exe", b"ntdll.dll", b"kernel32.dll"]
352+
self.init_dlls = [b"ntdll.dll", b"kernel32.dll", b"user32.dll"]
353+
self.sys_dlls = [b"ntdll.dll", b"kernel32.dll"]
354354
self.pe_entry_point = 0
355355
self.sizeOfStackReserve = 0
356356

357-
if self.ql.shellcoder:
358-
self.init_dlls.remove(b"ntoskrnl.exe")
359-
self.sys_dlls.remove(b"ntoskrnl.exe")
360-
else:
357+
if not self.ql.shellcoder:
361358
self.pe = pefile.PE(self.path, fast_load=True)
362359
self.is_driver = (self.pe.OPTIONAL_HEADER.Subsystem == 1)
360+
if self.is_driver:
361+
self.init_dlls = [b"ntoskrnl.exe"]
362+
self.sys_dlls = [b"ntoskrnl.exe"]
363363

364364
if self.ql.archtype == QL_ARCH.X86:
365365
self.stack_address = int(self.ql.os.profile.get("OS32", "stack_address"), 16)

qiling/os/os.py

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -92,32 +92,32 @@ def find_containing_image(self, pc):
9292
return image
9393

9494
def emu_error(self):
95-
logging.info("\n")
95+
logging.error("\n")
9696

9797
for reg in self.ql.reg.register_mapping:
9898
if isinstance(reg, str):
9999
REG_NAME = reg
100100
REG_VAL = self.ql.reg.read(reg)
101-
logging.info("[-] %s\t:\t 0x%x" % (REG_NAME, REG_VAL))
101+
logging.error("%s\t:\t 0x%x" % (REG_NAME, REG_VAL))
102102

103-
logging.info("\n")
104-
logging.info("[+] PC = 0x%x" % (self.ql.reg.arch_pc))
103+
logging.error("\n")
104+
logging.error("PC = 0x%x" % (self.ql.reg.arch_pc))
105105
containing_image = self.find_containing_image(self.ql.reg.arch_pc)
106106
if containing_image:
107107
offset = self.ql.reg.arch_pc - containing_image.base
108-
logging.info(" (%s+0x%x)" % (containing_image.path, offset))
108+
logging.error(" (%s+0x%x)" % (containing_image.path, offset))
109109
else:
110110
logging.info("\n")
111111
self.ql.mem.show_mapinfo()
112112

113113
try:
114114
buf = self.ql.mem.read(self.ql.reg.arch_pc, 8)
115-
logging.info("[+] %r" % ([hex(_) for _ in buf]))
115+
logging.error("%r" % ([hex(_) for _ in buf]))
116116

117117
logging.info("\n")
118118
self.disassembler(self.ql, self.ql.reg.arch_pc, 64)
119119
except:
120-
logging.info("[!] Error: PC(0x%x) Unreachable" % self.ql.reg.arch_pc)
120+
logging.error("Error: PC(0x%x) Unreachable" % self.ql.reg.arch_pc)
121121

122122

123123
def _x86_set_args(self, args):

qiling/os/utils.py

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -242,22 +242,23 @@ def disassembler(self, ql, address, size):
242242
insn = md.disasm(tmp, address)
243243
opsize = int(size)
244244

245-
logging.info( ("[+] 0x%x" % (address)).ljust( (self.ql.archbit // 8) + 15))
245+
log_data = ("0x%x" % (address)).ljust( (self.ql.archbit // 8) + 15)
246246

247247
temp_str = ""
248248
for i in tmp:
249249
temp_str += ("%02x " % i)
250-
logging.info(temp_str.ljust(30))
250+
log_data += temp_str.ljust(30)
251251

252252
for i in insn:
253-
logging.info("%s %s" % (i.mnemonic, i.op_str))
253+
log_data += "%s %s" % (i.mnemonic, i.op_str)
254+
logging.info(log_data)
254255

255256
if self.ql.output == QL_OUTPUT.DUMP:
256257
for reg in self.ql.reg.register_mapping:
257258
if isinstance(reg, str):
258259
REG_NAME = reg
259260
REG_VAL = self.ql.reg.read(reg)
260-
logging.debug("[-] %s\t:\t 0x%x" % (REG_NAME, REG_VAL))
261+
logging.debug("%s\t:\t 0x%x" % (REG_NAME, REG_VAL))
261262

262263
def setup_output(self):
263264
if self.output_ready:

tests/test_pe.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -365,6 +365,8 @@ def our_sandbox(path, rootfs):
365365

366366

367367
def test_pe_win_x86_sality(self):
368+
if 'QL_FAST_TEST' in os.environ:
369+
return
368370
def init_unseen_symbols(ql, address, name, ordinal, dll_name):
369371
ql.loader.import_symbols[address] = {"name": name, "ordinal": ordinal, "dll": dll_name.split('.')[0] }
370372
ql.loader.import_address_table[dll_name][name] = address

0 commit comments

Comments
 (0)