qilingframework / qiling

A True Instrumentable Binary Emulation Framework
https://qiling.io
GNU General Public License v2.0
5.14k stars 744 forks source link

failed to resolve multiple symbolic links #222

Closed cq674350529 closed 4 years ago

cq674350529 commented 4 years ago

When running a binary of Netgear R6400 firmware using qiling framework, it failed to resolve multiple symbolic links. Take the following as an example.

~/squashfs-root$ ls -l ./lib/libbdbroker.so 
lrwxrwxrwx 1 root root 48 Jul 29  2019 ./lib/libbdbroker.so -> /opt/bitdefender/patches/base/lib/libbdbroker.so

~/squashfs-root$ ls -l ./opt/bitdefender 
lrwxrwxrwx 1 root root 23 Jul 29  2019 ./opt/bitdefender -> /media/nand/bitdefender

As to /lib/libbdbroker.so, the ql_transform_to_real_path() will return ~/squashfs-root/opt/bitdefender/patches/base/lib/libbdbroker.so. And this path doesn't exist, thus causing fail to load the libbdbroker.so. Actually, it should resolve the symbolic link /opt/bitdefender again.

PS: all symbolic links work in chroot env.

Thanks!

xwings commented 4 years ago

two method,

  1. remove the symlink and replace with a real file. which you need to do that in IoT analysis most of the time.
  2. write a patch ?

i did not try symblock link, maybe we should consider that,

chroot will work, but chroot did not give you the power like what Qiling can give you.

cq674350529 commented 4 years ago

Yes, I can fix it manually. But as you said, with the powerful qiling framework, I prefer to be "lazy" and let the framework handle it. I'll have a try to see if I can work out a patch for it.

xwings commented 4 years ago

thanks !

xwings commented 4 years ago

thanks for the PR !