You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I tried running a c program compiled with tdmgcc through qiling's windows_trace.py.
python windows_trace.py -r -t target_program.exe
The program just outputs the string hello to puts.
However, inside the _initterm function, it stores certain values in memory, which is not executed by qiling, so the puts were not executed.
After that, when I ran it again, it entered the original instruction of the _initterm api, stored the value in memory normally, and executed until puts. So I want to make the code execute the original instruction without hooking the execution of _initterm in the code instead of commenting out the dll code like this.
Is there an API that does this without hooking that is provided by qiling itself? I can implement an additional hooking function to execute it, but I would like to utilize the api of qiling.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
-
I tried running a c program compiled with tdmgcc through qiling's windows_trace.py.
The program just outputs the string hello to puts.
However, inside the _initterm function, it stores certain values in memory, which is not executed by qiling, so the puts were not executed.
This error is raised.
So I commented out the implementation part of the _intterm api in qiling\os\windows\dlls\msvcrt.py.
After that, when I ran it again, it entered the original instruction of the _initterm api, stored the value in memory normally, and executed until puts. So I want to make the code execute the original instruction without hooking the execution of _initterm in the code instead of commenting out the dll code like this.
Is there an API that does this without hooking that is provided by qiling itself? I can implement an additional hooking function to execute it, but I would like to utilize the api of qiling.
Beta Was this translation helpful? Give feedback.
All reactions