-
Notifications
You must be signed in to change notification settings - Fork 756
-
Hello, thank you for your work on this awesome library! I'd lke to use Qiling to override arguments to a function call with my own values. I'm running on Intel x86_64 instruction set.
This is easy to do for integer types:
from qiling import * def override_arguments(ql): ql.arch.regs.write("edi", 100) ql.arch.regs.write("esi", 200) if __name__ == "__main__": rootfs = "/" bin_fpath = "a.out" ql = Qiling([bin_fpath], rootfs) ba = ql.loader.images[0].base func_address = 0x1177 ql.hook_address(override_arguments, ba+func_address) ql.run()
And I got it to work for string types, though I'm not sure if this is the best way:
def override_arguments(ql): addr = 0x100000 # By the way, what is the best place to allocate memory like this? size = len(arg) + 1 size = ql.mem.align_up(size) ql.log.info(f"Reserving {size} bytes") ql.mem.map(addr, size) ql.log.info(f"Writing {repr(arg)} to 0x{addr:x}") ql.mem.string(addr, arg) ql.arch.regs.write("edi", addr)
However, I can't figure out how to supply floating-point values. As far as I can tell, the calling convention passes these values in the registers xmm0, xmm1, ... using the movss instruction. If I directly write data to xmm0, the value is printed as 0.0 in the inferior program.
def override_arguments(ql): ql.arch.regs.write("xmm0", 50)
I'd appreciate if you can help answer my questions: What's the best way to allocate memory for loading string data? How can I load floating-point values as a function's arguments?
Beta Was this translation helpful? Give feedback.