Skip to content

Abstract calls to native functions#1013

Merged
xwings merged 5 commits intoqilingframework:devfrom
elicn:call_native
Nov 19, 2021
Merged

Abstract calls to native functions#1013
xwings merged 5 commits intoqilingframework:devfrom
elicn:call_native

Conversation

@elicn
Copy link
Member

@elicn elicn commented Nov 18, 2021

Users may now stage and call native functions without having to do manual frame setup.
This code abstracts away the need to create a new frame, write the arguments, set the return address and pc.

Example:

from qiling.os.const import *

# the address of the function we are about to call
func_entry = 0xdeadc0de

# save current pc value and use it to resume execution
retaddr = ql.reg.arch_pc

# call a function that recieves 3 arguments, whose entry is at 'func_entry'
ql.os.fcall.call_native(func_entry, (
    (POINTER, x),
    (POINTER, y),
    (POINTER, z)
), retaddr)

Notes:

  • Currently supports plain arguments types (i.e. integer values tagged with POINTER, INT, etc.); support for complex types like STRING and GUID may be added in the future
  • Implemented for Intel and ARM architectures, not yet for MIPS and RISC
  • The retaddr arg may be used to either resume execution from an arbitrary address, or force the execution flow into a hook to regain control (e.g. in case a cleanup is needed)

Copy link
Member

@xwings xwings left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah, this is nice

@xwings xwings merged commit dcc64f7 into qilingframework:dev Nov 19, 2021
@elicn elicn deleted the call_native branch November 25, 2021 12:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants