Open ytournier opened 5 months ago
When u open a file , /proc/pid/fd/[N]
will be a symbol link to the file which is opened with fd [N].
It's done by linux kernel.
But qiling's procfs is not consistent with the real environment.
You can mock procfs by Hijacking VFS objects
Using Android binaries found in the rootfs, the
readlink
syscall does not find the binaries associated with file descriptors 3 and 4 which arelibdl.so
andlibc.so
respectively.Here's the warning message raise during the execution:
Creating symbolic links as shown below is enough to satisfy the linker: