Skip to content

elf: set the mmap floor for shellcode instances - #1679

Open
Henglie wants to merge 1 commit into
qilingframework:devfrom
Henglie:fix/shellcode-mmap-address
Open

Henglie wants to merge 1 commit into
qilingframework:devfrom
Henglie:fix/shellcode-mmap-address

Conversation

@Henglie

@Henglie Henglie commented Nov 14, 2026

Copy link
Copy Markdown

Fixes #1444.

Checklist

Which kind of PR do you create?

  • This PR only contains minor fixes.
  • This PR contains major feature update.
  • This PR introduces a new function/api for Qiling Framework.

Coding convention?

  • The new code conforms to Qiling Framework naming convention.
  • The imports are arranged properly.
  • Essential comments are added.
  • The reference of the new code is pointed out.

Extra tests?

  • No extra tests are needed for this PR.
  • I have added enough tests for this PR.
  • Tests will be added after some discussion and review.

Changelog?

  • This PR doesn't need to update Changelog.
  • Changelog will be updated after some proper review.
  • Changelog has been updated in my PR.

Target branch?

  • The target branch is dev branch.

One last thing


What was wrong

QlLoaderELF.run() returns early when Qiling is built from raw code:

if self.ql.code:
    ...
    return

self.profile = self.ql.os.profile[f'OS{self.ql.arch.bits}']

The profile is loaded only after that branch, so mmap_address is never set on a code-only instance. A guest that invokes mmap then hits:

AttributeError: 'QlLoaderELF' object has no attribute 'mmap_address'

from syscall_mmap_impl() (qiling/os/posix/syscall/mman.py:138, ql.loader.mmap_address). This is the failure reported in #1444 with an Android ARM64 shellcode.

Change

  • Load the profile before the code branch, so both paths use the same section.
  • Set self.mmap_address from the profile in the code branch, next to the other shellcode loader fields.

The file-backed ELF paths are unchanged: they derive mmap_address in load_with_ld() as before.

Verification

  • Reproduction on current dev (23ad4fd): Qiling(code=b"\xCC", archtype=QL_ARCH.X8664, ostype=QL_OS.LINUX) had no ql.loader.mmap_address; calling ql_syscall_mmap(ql, 0, 0x1000, 3, 0x22, -1, 0) raised the reported AttributeError.
  • After the fix the same instance reports mmap_address = 0x7fffb7dd6000 (the [OS64] profile value) and ql_syscall_mmap(...) returns 0x7fffb7dd6000.
  • New test tests/test_elf.py::ELFTest::test_shellcode_mmap_address checks the loader attribute against the profile and invokes the mmap syscall:
python -m unittest test_elf.ELFTest.test_shellcode_mmap_address -v
Ran 1 test in 0.230s
OK
  • Revert proof: reverting only qiling/loader/elf.py makes the new test fail with the exact reported error (AttributeError: 'QlLoaderELF' object has no attribute 'mmap_address'); restoring the fix passes.
  • python -m py_compile qiling/loader/elf.py tests/test_elf.py passes; git diff --check is clean.

Not run

  • The rest of tests/test_elf.py was not run: it needs the examples/rootfs submodule, which is not checked out on this Windows host (examples/rootfs is empty). The targeted regression test is code-only by design.
  • Verification was on Windows 11 with CPython 3.11.9 and unicorn 2.1.3; Linux/macOS were not run.

QlLoaderELF returns early when Qiling is built from raw code, before the
profile is loaded and mmap_address is derived. A guest mmap syscall then
fails with AttributeError: 'QlLoaderELF' object has no attribute
'mmap_address'.

Load the profile before the code branch and set mmap_address from it, so
code-only instances expose the same floor as file-backed ones. Add a
regression test that creates a code-only x86_64 Linux instance, checks
mmap_address and invokes the mmap syscall.

Fixes qilingframework#1444
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant