qilingframework / qiling

A True Instrumentable Binary Emulation Framework
https://qiling.io
GNU General Public License v2.0
5.14k stars 745 forks source link

ql.os.set_api 可以hook api 函数,但不能修改函数的参数? #1409

Closed readermall closed 11 months ago

readermall commented 11 months ago

*Describe the bug 我在使用qiling实现一个比较好用的sanitizer,用到ql.os.set_api接口,希望可以用其劫持api函数,并能够修改被劫持函数的参数,但实现中发现,ql.os.set_api接口仅可以观察被劫持函数的参数,而不能修改,不符合劫持的本意,请问一下对此有什么解决方案吗?

**Sample Code**
def on_malloc_enter(ql: Qiling):
    print("%s in..." %sys._getframe().f_code.co_name)

    params = ql.os.resolve_fcall_params({'size': int})
    for key, value in params.items():
        print(key + ": " + str(hex(value)))

    size = params['size']
    resize = size + 2*4
    print("resize: " + str(hex(resize)))

    return resize

if __name__ == "__main__":
    ql = Qiling([r"/home/ubuntu/qiling/arm/test"], "/usr/arm-linux-gnueabi")
    ql.os.set_api('malloc', on_malloc_enter, QL_INTERCEPT.ENTER)

输出信息:
[=]     write(fd = 0x1, buf = 0x24190, count = 0x3) = 0x3
on_malloc_enter in...
resize: 0x408

我想让resize代替size,让malloc开辟更多空间,但失败了,return resize 不起作用,并不能影响malloc的结果。请问有官方的解决方法吗?

newthis commented 11 months ago

去掉QL_INTERCEPT.ENTER试试

readermall commented 11 months ago

@newthis 去掉QL_INTERCEPT.ENTER不行,不过已找到解决方法,虽然不太优雅,谢谢