Partial Execution
- sleep_hello will sleep for 3600 seconds and "print helloworld"
- This is the C code, it will sleep for 3600 seconds before print helloworld
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
void func_hello()
{
printf("Hello, World!\n");
return;
}
int main(int argc, const char **argv)
{
printf("sleep 3600 seconds...\n");
sleep(3600);
printf("wake up.\n");
func_hello();
return 0;
}
- The example below will stop at 0x1094, right before sleep() and save the current emulation state
- Rerun sleep_hello and start at 0x10bc which is right after the sleep 3600 seconds
from qiling.const import QL_VERBOSE
def dump(ql, *args, **kw):
ql.save(reg=False, cpu_context=True, snapshot="/tmp/snapshot.bin")
ql.emu_stop()
ql = Qiling(["../examples/rootfs/x8664_linux/bin/sleep_hello"], "../examples/rootfs/x8664_linux", verbose=QL_VERBOSE.DEFAULT)
X64BASE = int(ql.profile.get("OS64", "load_address"), 16)
ql.hook_address(dump, X64BASE + 0x1094)
ql.run()
ql = Qiling(["../examples/rootfs/x8664_linux/bin/sleep_hello"], "../examples/rootfs/x8664_linux", verbose=QL_VERBOSE.DEBUG)
X64BASE = int(ql.profile.get("OS64", "load_address"), 16)
ql.restore(snapshot="/tmp/snapshot.bin")
begin_point = X64BASE + 0x109e
end_point = X64BASE + 0x10bc
ql.run(begin = begin_point, end = end_point)
Qiling: save and restore
- save and restore current Qiling state
ql_all = ql.save()
ql.restore(ql_all)
Additional save options are:
ql.save(mem= True, reg= True, fd= True, cpu_ctx= False)
File Descriptor: save and restore
- Save and restore current file descriptor state
all_fd = ql.fd.save()
ql.fd.restore(all_fd)
CPU State: save and restore
- context_save and context_restore are interfaces to uc_context_save and uc_context_restore.
- Save all the current running CPU state
all_registers_context = ql.arch.regs.context_save()
- Restore all the saved CPU state
ql.arch.regs.context_restore(all_registers_context)
Memory: save and restore
- Save and restore current memory state
all_mem = ql.mem.save()
ql.mem.restore(all_mem)
Register: save and restore
- Save all the current running state register
- replace eip with new value
all_registers = ql.arch.regs.save()
all_registers["eip"] = 0xaabbccdd
- Restore all the saved registers from "all_registers"
ql.arch.regs.restore(all_registers)