Repository navigation
Conversation
QlLoaderELF returns early when Qiling is built from raw code, before the profile is loaded and mmap_address is derived. A guest mmap syscall then fails with AttributeError: 'QlLoaderELF' object has no attribute 'mmap_address'. Load the profile before the code branch and set mmap_address from it, so code-only instances expose the same floor as file-backed ones. Add a regression test that creates a code-only x86_64 Linux instance, checks mmap_address and invokes the mmap syscall. Fixes qilingframework#1444
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1444.
Checklist
Which kind of PR do you create?
Coding convention?
Extra tests?
Changelog?
Target branch?
One last thing
What was wrong
QlLoaderELF.run()returns early when Qiling is built from raw code:The profile is loaded only after that branch, so
mmap_addressis never set on a code-only instance. A guest that invokesmmapthen hits:from
syscall_mmap_impl()(qiling/os/posix/syscall/mman.py:138,ql.loader.mmap_address). This is the failure reported in #1444 with an Android ARM64 shellcode.Change
self.mmap_addressfrom the profile in the code branch, next to the other shellcode loader fields.The file-backed ELF paths are unchanged: they derive
mmap_addressinload_with_ld()as before.Verification
dev(23ad4fd):Qiling(code=b"\xCC", archtype=QL_ARCH.X8664, ostype=QL_OS.LINUX)had noql.loader.mmap_address; callingql_syscall_mmap(ql, 0, 0x1000, 3, 0x22, -1, 0)raised the reportedAttributeError.mmap_address = 0x7fffb7dd6000(the[OS64]profile value) andql_syscall_mmap(...)returns0x7fffb7dd6000.tests/test_elf.py::ELFTest::test_shellcode_mmap_addresschecks the loader attribute against the profile and invokes the mmap syscall:qiling/loader/elf.pymakes the new test fail with the exact reported error (AttributeError: 'QlLoaderELF' object has no attribute 'mmap_address'); restoring the fix passes.python -m py_compile qiling/loader/elf.py tests/test_elf.pypasses;git diff --checkis clean.Not run
tests/test_elf.pywas not run: it needs theexamples/rootfssubmodule, which is not checked out on this Windows host (examples/rootfsis empty). The targeted regression test is code-only by design.