Skip to content

Commit bc48075

Browse files
committed
Merge branch 'dev' into stm32f4
2 parents 4a0dfae + b1d9216 commit bc48075

File tree

20 files changed

+479
-107
lines changed

20 files changed

+479
-107
lines changed

.github/workflows/build-ci.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,6 @@ jobs:
7878
wget https://github.com/qilingframework/rootfs/archive/refs/heads/master.zip
7979
unzip master.zip && mv rootfs-master rootfs
8080
cd ../qiling
81-
rm -rf engine
82-
wget https://github.com/qilingframework/engine/archive/refs/heads/main.zip
83-
unzip main.zip && mv engine-main engine
8481
cd ../examples/rootfs/x86_linux/kernel && unzip -P infected m0hamed_rootkit.ko.zip
8582
cd ../../../../
8683
pip3 install -e .[evm]

ChangeLog

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,24 @@
11
This file details the changelog of Qiling Framework.
22

3+
4+
------------------------------------
5+
[Version 1.4.2]: Jan 29th, 2022
6+
7+
New features:
8+
-
9+
-
10+
11+
Improvements:
12+
-
13+
-
14+
15+
Contributors:
16+
-
17+
-
18+
19+
320
------------------------------------
4-
[Version 1.4.1]: Nov 15th, 2021
21+
[Version 1.4.1]: Dec 29th, 2021
522

623
New features:
724
- Introduced riscv, both 32 and 64 (#980)
@@ -15,6 +32,7 @@ Improvements:
1532
- More update in MCU modules (#971)
1633
- Fix getpeername and getsockname syscalls (#986)
1734
- Qdb improvements (#999)
35+
- QNX improvements (#1054)
1836

1937
Contributors:
2038
- cq674350529
Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!/usr/bin/env python3
2+
#
3+
# Cross Platform and Multi Architecture Advanced Binary Emulation Framework
4+
#
5+
6+
import sys
7+
sys.path.append("..")
8+
9+
from qiling import Qiling
10+
from qiling.const import QL_INTERCEPT, QL_CALL_BLOCK, QL_VERBOSE
11+
from qiling.os.const import STRING
12+
13+
def my_puts_onenter(ql: Qiling):
14+
params = ql.os.resolve_fcall_params({'s': STRING})
15+
16+
print(f'puts("{params["s"]}")')
17+
return QL_CALL_BLOCK
18+
19+
def my_printf_onenter(ql: Qiling):
20+
params = ql.os.resolve_fcall_params({'s': STRING})
21+
22+
print(f'printf("{params["s"]}")')
23+
return QL_CALL_BLOCK
24+
25+
def my_puts_onexit(ql: Qiling):
26+
print(f'after puts')
27+
return QL_CALL_BLOCK
28+
29+
if __name__ == "__main__":
30+
ql = Qiling(["rootfs/arm_qnx/bin/hello_static"], "rootfs/arm_qnx")
31+
ql.set_api('puts', my_puts_onenter, QL_INTERCEPT.ENTER)
32+
ql.set_api('printf', my_printf_onenter, QL_INTERCEPT.ENTER)
33+
ql.set_api('puts', my_puts_onexit, QL_INTERCEPT.EXIT)
34+
ql.run()

examples/mem_invalid_access.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
def mem_crash(ql: Qiling, access: int, address: int, size: int, value: int):
1212
print(f'got crash')
1313

14-
PAGE_SIZE = 0x1000
15-
aligned = address & ~(PAGE_SIZE - 1)
14+
PAGE_SIZE = ql.mem.pagesize
15+
aligned = ql.mem.align(address)
1616

1717
# map the entire page containing the invalid address and fill it with 'Q's
1818
ql.mem.map(aligned, PAGE_SIZE)

examples/src/linux/vshttpd.c

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
/*
2+
AUTHOR: Abhijeet Rastogi (http://www.google.com/profiles/abhijeet.1989)
3+
4+
This is a very simple HTTP server. Default port is 10000 and ROOT for the server is your current working directory..
5+
6+
You can provide command line arguments like:- $./a.aout -p [port] -r [path]
7+
8+
for ex.
9+
$./a.out -p 50000 -r /home/
10+
to start a server at port 50000 with root directory as "/home"
11+
12+
$./a.out -r /home/shadyabhi
13+
starts the server at port 10000 with ROOT as /home/shadyabhi
14+
15+
*/
16+
17+
#include<stdio.h>
18+
#include<string.h>
19+
#include<stdlib.h>
20+
#include<unistd.h>
21+
#include<sys/types.h>
22+
#include<sys/stat.h>
23+
#include<sys/socket.h>
24+
#include<arpa/inet.h>
25+
#include<netdb.h>
26+
#include<signal.h>
27+
#include<fcntl.h>
28+
29+
#define CONNMAX 1000
30+
#define BYTES 1024
31+
32+
char *ROOT;
33+
int listenfd, clients[CONNMAX];
34+
void error(char *);
35+
void startServer(char *);
36+
void respond(int);
37+
38+
int main(int argc, char* argv[])
39+
{
40+
struct sockaddr_in clientaddr;
41+
socklen_t addrlen;
42+
char c;
43+
44+
//Default Values PATH = ~/ and PORT=10000
45+
char PORT[6];
46+
ROOT = getenv("PWD");
47+
strcpy(PORT,"10000");
48+
49+
int slot=0;
50+
51+
//Parsing the command line arguments
52+
while ((c = getopt (argc, argv, "p:r:")) != -1)
53+
switch (c)
54+
{
55+
case 'r':
56+
ROOT = malloc(strlen(optarg));
57+
strcpy(ROOT,optarg);
58+
break;
59+
case 'p':
60+
strcpy(PORT,optarg);
61+
break;
62+
case '?':
63+
fprintf(stderr,"Wrong arguments given!!!\n");
64+
exit(1);
65+
default:
66+
exit(1);
67+
}
68+
69+
printf("Server started at port no. %s%s%s with root directory as %s%s%s\n","\033[92m",PORT,"\033[0m","\033[92m",ROOT,"\033[0m");
70+
// Setting all elements to -1: signifies there is no client connected
71+
int i;
72+
for (i=0; i<CONNMAX; i++)
73+
clients[i]=-1;
74+
startServer(PORT);
75+
76+
// ACCEPT connections
77+
while (1)
78+
{
79+
addrlen = sizeof(clientaddr);
80+
clients[slot] = accept (listenfd, (struct sockaddr *) &clientaddr, &addrlen);
81+
82+
if (clients[slot]<0)
83+
error ("accept() error");
84+
else
85+
{
86+
if ( fork()==0 )
87+
{
88+
respond(slot);
89+
exit(0);
90+
}
91+
}
92+
93+
while (clients[slot]!=-1) slot = (slot+1)%CONNMAX;
94+
}
95+
96+
return 0;
97+
}
98+
99+
//start server
100+
void startServer(char *port)
101+
{
102+
struct addrinfo hints, *res, *p;
103+
104+
// getaddrinfo for host
105+
memset (&hints, 0, sizeof(hints));
106+
hints.ai_family = AF_INET;
107+
hints.ai_socktype = SOCK_STREAM;
108+
hints.ai_flags = AI_PASSIVE;
109+
if (getaddrinfo( NULL, port, &hints, &res) != 0)
110+
{
111+
perror ("getaddrinfo() error");
112+
exit(1);
113+
}
114+
// socket and bind
115+
for (p = res; p!=NULL; p=p->ai_next)
116+
{
117+
listenfd = socket (p->ai_family, p->ai_socktype, 0);
118+
if (listenfd == -1) continue;
119+
if (bind(listenfd, p->ai_addr, p->ai_addrlen) == 0) break;
120+
}
121+
if (p==NULL)
122+
{
123+
perror ("socket() or bind()");
124+
exit(1);
125+
}
126+
127+
freeaddrinfo(res);
128+
129+
// listen for incoming connections
130+
if ( listen (listenfd, 1000000) != 0 )
131+
{
132+
perror("listen() error");
133+
exit(1);
134+
}
135+
}
136+
137+
//client connection
138+
void respond(int n)
139+
{
140+
char mesg[99999], *reqline[3], data_to_send[BYTES], path[99999];
141+
int rcvd, fd, bytes_read;
142+
143+
memset( (void*)mesg, (int)'\0', 99999 );
144+
145+
rcvd=recv(clients[n], mesg, 99999, 0);
146+
147+
if (rcvd<0) // receive error
148+
fprintf(stderr,("recv() error\n"));
149+
else if (rcvd==0) // receive socket closed
150+
fprintf(stderr,"Client disconnected upexpectedly.\n");
151+
else // message received
152+
{
153+
printf("%s", mesg);
154+
reqline[0] = strtok (mesg, " \t\n");
155+
if ( strncmp(reqline[0], "GET\0", 4)==0 )
156+
{
157+
reqline[1] = strtok (NULL, " \t");
158+
reqline[2] = strtok (NULL, " \t\n");
159+
if ( strncmp( reqline[2], "HTTP/1.0", 8)!=0 && strncmp( reqline[2], "HTTP/1.1", 8)!=0 )
160+
{
161+
write(clients[n], "HTTP/1.0 400 Bad Request\n", 25);
162+
}
163+
else
164+
{
165+
if ( strncmp(reqline[1], "/\0", 2)==0 )
166+
reqline[1] = "/index.html"; //Because if no file is specified, index.html will be opened by default (like it happens in APACHE...
167+
168+
strcpy(path, ROOT);
169+
strcpy(&path[strlen(ROOT)], reqline[1]);
170+
printf("file: %s\n", path);
171+
172+
if ( (fd=open(path, O_RDONLY))!=-1 ) //FILE FOUND
173+
{
174+
send(clients[n], "HTTP/1.0 200 OK\n\n", 17, 0);
175+
while ( (bytes_read=read(fd, data_to_send, BYTES))>0 )
176+
write (clients[n], data_to_send, bytes_read);
177+
}
178+
else write(clients[n], "HTTP/1.0 404 Not Found\n", 23); //FILE NOT FOUND
179+
}
180+
}
181+
}
182+
183+
//Closing SOCKET
184+
shutdown (clients[n], SHUT_RDWR); //All further send and recieve operations are DISABLED...
185+
close(clients[n]);
186+
clients[n]=-1;
187+
}

qiling/__version__.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
# NOTE: use "-dev" for dev branch
2-
__version__ = "1.4.1" + "-dev"
3-
#__version__ = "1.4.0"
2+
#__version__ = "1.4.1"
3+
__version__ = "1.4.2" + "-dev"

qiling/arch/arm.py

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,3 +104,24 @@ def enable_vfp(self) -> None:
104104

105105
def check_thumb(self):
106106
return UC_MODE_THUMB if self.__is_thumb() else UC_MODE_ARM
107+
108+
"""
109+
set_tls
110+
"""
111+
def init_get_tls(self):
112+
self.ql.mem.map(0xFFFF0000, 0x1000, info="[arm_tls]")
113+
"""
114+
'adr r0, data; ldr r0, [r0]; mov pc, lr; data:.ascii "\x00\x00"'
115+
"""
116+
sc = b'\x04\x00\x8f\xe2\x00\x00\x90\xe5\x0e\xf0\xa0\xe1\x00\x00\x00\x00'
117+
118+
# if ql.archendian == QL_ENDIAN.EB:
119+
# sc = swap_endianess(sc)
120+
121+
self.ql.mem.write(self.ql.arch.arm_get_tls_addr, sc)
122+
self.ql.log.debug("Set init_kernel_get_tls")
123+
124+
def swap_endianess(self, s: bytes, blksize=4) -> bytes:
125+
blocks = (s[i:i + blksize] for i in range(0, len(s), blksize))
126+
127+
return b''.join(bytes(reversed(b)) for b in blocks)

qiling/debugger/qdb/qdb.py

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,6 @@ def _run(self: Qldbg, address: int = 0, end: int = 0, count: int = 0) -> None:
123123
else:
124124
print(f"{color.CYAN}[+] hit breakpoint at 0x{self.cur_addr:08x}{color.END}")
125125

126-
self.do_context()
127126
break
128127

129128
self.ql.arch.step()

0 commit comments

Comments
 (0)