Search bytes pattern from memory
- Search for a pattern from entire memory
address = ql.mem.search(b"\xFF\xFE\xFD\xFC\xFB\xFA")
- Search for a pattern from entire memory range
address = ql.mem.search(b"\xFF\xFE\xFD\xFC\xFB\xFA", begin= 0x1000, end= 0x2000)
Read from a memory address
Write to a memory address
Map a memory area
map a memory before writing into it. Info can be empty.
ql.mem.map(addr,size,info = [my_first_map])
You need to align the memory offset and address for mapping.
The amounts of memory that should be mapped
This parameter is OS dependant; If you use a linux system, consider at least a multiple of 4096 for alignment
[..] def memory_fix(ql, access, addr, size, value): ql.nprint("[_] Mapping "+str(size)+" bytes at "+hex(addr)+" | access: "+ str(access)+" | value: "+ str(value)) ql.mem.map(addr//4096*4096, 4096) ql.mem.write(addr, struct.pack(">I",value)) # memory packing is OS dependant return [...] ql.hook_mem_unmapped(memory_fix) [...]
See qiling/loader/elf.py for a proper mapping example
read and write string
to read a string from memory
to write a string to memory
Show all the mapped area
Unmap a mapped area
ql.mem.unmap(self, addr, size)
Unmap all mapped area
find a free space
Find a specific free space size.
check for availablity
The main function of is_available is to determine whether the memory starting with addr and having a size of length can be used for allocation. If it can be allocated, returns True. If it cannot be allocated, it returns False.
check for is the memory area being mapped
The main function of is_mmaped is to determine whether the memory starting with addr and size has been mapped. Returns true if it has already been allocated. If unassigned, returns False.
Find a matching size of unmapped usable space
Finds a region of memory that is free, larger than 'size' arg, and aligned.
ql.mem.find_free_space(size, min_addr=0, max_addr = 0, alignment=0x10000)
Find a matching size of unmapped usable space and map it
Maps a region of memory with requested size, within the addresses specified. The size and start address will respect the alignment.