Live process snapshots

[kr1tzy]

I'm attempting to load a Qiling snapshot from a live process on a simple 'hello' binary and keep getting the qiling.exception.QlErrorCoreHook: _hook_intr_cb : catched == False error. The save/restore works when dumping only the memory and registers through Qiling itself but restoring from a modified unicorn dumper script poses problems (similar to #593). I modified the restore function in Qiling to accept a live process context in the same fashion the default snapshot is saved/restored. Screenshots of the live process restore function, the emulation script, output, and binary information are attached. Please excuse code quality, this is POC code.

qiling/os/memory.py restore functionality

'hello' binary emulation script

emulation output for 'hello'

'hello' binary / compilation info

Additional context Running on an ARM aarch64 Raspberry Pi. Tested on dev and master.

[wtdcode]

Hi, thanks for your interest. Could you post your scripts as texts and post the exact steps to reproduce?

[kr1tzy]

Github didn't like the file types i was uploading so i threw everything needed on Google drive. The readme has steps for reproducing. @wtdcode

https://drive.google.com/drive/folders/10BICusaZ9JObxpYev7cO_KtRA5KL0cxr?usp=sharing

[wtdcode]

ACK. Would have a look this weekend.

---

From: Noah Kritz @.> Sent: Friday, May 28, 2021 3:43:07 PM To: qilingframework/qiling @.> Cc: lazymio @.>; Mention @.> Subject: Re: [qilingframework/qiling] Live process snapshots (#806)

Github didn't like the file types i was uploading so i threw everything needed on Google drive. The readme has steps for reproducing. @wtdcodehttps://github.com/wtdcode

https://drive.google.com/drive/folders/10BICusaZ9JObxpYev7cO_KtRA5KL0cxr?usp=sharing

― You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/qilingframework/qiling/issues/806#issuecomment-850220026, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AHJULO76EPSWE67UBOAGCUDTP5CQXANCNFSM45R2HUXA.

[wtdcode]

Github didn't like the file types i was uploading so i threw everything needed on Google drive. The readme has steps for reproducing. @wtdcode

https://drive.google.com/drive/folders/10BICusaZ9JObxpYev7cO_KtRA5KL0cxr?usp=sharing

Hi, I have no access to this sharing.

[kr1tzy]

@wtdcode just changed the permissions. Sorry about that

[wtdcode]

Hello, note that you dumped the memory and registers as the time of hitting the breakpoints at main when ld.so has done with various setup and restore them before ql.loader.run. I suggest you trying to restore your live snapshot between ql.loader.run and ql.os.run.

[D0nYu]

Hello @kr1tzy , Have you ever solved this issue? I encounter a similar one when loading a snapshot generated by unicorn_dumper_gdb.py (https://github.com/Battelle/afl-unicorn/blob/master/unicorn_mode/helper_scripts/unicorn_dumper_gdb.py)

[kr1tzy]

@D0nYu I don't believe this is feasible unless a mapping of OS & kernel specific structures to Qiling internal memory structures exists. I ended up setting this down after coming to that conclusion. It would be an incredible feature but there's a lot of overhead required to bring it alive.

[xwings]

Close for now.

We updated the codebase for Qiling and Unicorn since this issue being posted.

Feel free to try the latest version.