Implement kernel ARM emulation #1531
Conversation
|
Hi, there is a conflict in elf.py. You might want to take a look ? |
| @@ -57,7 +58,7 @@ class AUXV(IntEnum): | |||
|
|
|||
| # start area memory for API hooking | |||
| # we will reserve 0x1000 bytes for this (which contains multiple slots of 4/8 bytes, each for one api) | |||
| API_HOOK_MEM = 0x1000000 | |||
| API_HOOK_MEM = 0x2000000 | |||
| @@ -87,6 +88,9 @@ def run(self): | |||
| stack_size = self.profile.getint('stack_size') | |||
| self.ql.mem.map(stack_address, stack_size, info='[stack]') | |||
|
|
|||
| # Setup heap | |||
| self.ql.os.heap = QlMemoryHeap(self.ql, 0x3000000, 0x3000000 + 0x1000000) | |||
There was a problem hiding this comment.
Heap base and size should be set based on the value configured in the profile file. Using hardcoded values is not a good idea.
| @@ -97,7 +101,7 @@ def run(self): | |||
|
|
|||
| # is it a driver? | |||
| if elftype == 'ET_REL': | |||
| self.load_driver(elffile, stack_address + stack_size, loadbase=0x8000000) | |||
| self.load_driver(elffile, stack_address + stack_size, loadbase=0x1000000) | |||
There was a problem hiding this comment.
Any reason for this change here?
Keep in mind this module serves all ELF files on all architectures, not only ARM.
|
|
||
| # Cache | ||
| if self._symbol_name_map == None: |
There was a problem hiding this comment.
This could be simplified with an internal function decorated with @cache (available from Python 3.9) or @lru_cache (available earlier).
from functools import cache
@cache
def __get_cached_symbol(name: str) -> int:
# access symtab symbol here and return the result
...Also, I am not sure that _symbol_name_map should be assigned to self, but stay local.
| @@ -25,6 +25,11 @@ def hook_kernel_api(ql: Qiling, address: int, size): | |||
| if api_func: | |||
| try: | |||
| api_func(ql, address, api_name) | |||
|
|
|||
| # Restore PC | |||
| if ql.arch.type == QL_ARCH.ARM: | |||
There was a problem hiding this comment.
I think function calls are automatically unwinded.
Have you checked this is?
Checklist
Which kind of PR do you create?
Coding convention?
Extra tests?
Changelog?
Target branch?
One last thing
These fixes add support for emulating a ARM kernel object by implementing
R_ARM_CALLandR_ARM_JUMP24. Additionally, the__get_symbolfunction now has caching in order to speed up loading ARM kernel objects as elftoolsget_symbol_by_namefunction is slow when iterating each time.