Partial Execution

  • sleep_hello will sleep for 3600 seconds and "print helloworld"
  • This is the C code, it will sleep for 3600 seconds before print helloworld
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

void func_hello()
    printf("Hello, World!\n");

int main(int argc, const char **argv)
    printf("sleep 3600 seconds...\n");
    printf("wake up.\n");
    return 0;
  • The example below will stop at 0x1094, right before sleep() and save the current emulation state
  • Rerun sleep_hello and start at 0x10bc which is right after the sleep 3600 seconds
def dump(ql, *args, **kw):, cpu_context=True, snapshot="/tmp/snapshot.bin")

ql = Qiling(["../examples/rootfs/x8664_linux/bin/sleep_hello"], "../examples/rootfs/x8664_linux", output= "default")
X64BASE = int(ql.profile.get("OS64", "load_address"), 16)
ql.hook_address(dump, X64BASE + 0x1094)

ql = Qiling(["../examples/rootfs/x8664_linux/bin/sleep_hello"], "../examples/rootfs/x8664_linux", output= "debug", verbose=4)
X64BASE = int(ql.profile.get("OS64", "load_address"), 16)
begin_point = X64BASE + 0x109e
end_point = X64BASE + 0x10bc = begin_point, end = end_point)

Qiling: save and restore

  • save and restore current Qiling state
ql_all =

Additional save options are: True, reg= True, fd= True, cpu_ctx= False)

File Descriptor: save and restore

  • Save and restore current file descriptor state
all_fd =

CPU State: save and restore

  • context_save and context_restore are interfaces to uc_context_save and uc_context_restore.
    • Save all the current running CPU state
all_registers_context = ql.reg.context_save()
  • Restore all the saved CPU state

Memory: save and restore

  • Save and restore current memory state
all_mem =

Register: save and restore

  • Save all the current running state register
  • replace eip with new value
all_registers =
all_registers["eip"] = 0xaabbccdd
  • Restore all the saved registers from "all_registers"