qiling not recognize CMOVZ series?
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- python
- Domain
- reverse-engineering
Research direction
Start in qilingida.py, especially _force_execution_by_parsing_assembly and the ql.run path shown in the traceback. Reproduce the CMOVZ sample and trace how the instruction is parsed and executed; done means the sample no longer fails while handling CMOVZ and the reported register error is addressed.
Written by the indexing model from the issue text.
Description
*Describe the bug
qiling not recognize CMOVZ series?
Sample Code
__text:000000010127AED0 lea rdi, [rbp+var_54A0]
__text:000000010127AED7 mov [rbp+var_22E0], rdi
__text:000000010127AEDE mov rax, [rbp+var_22E0]
__text:000000010127AEE5 call sub_1012BD8F2
__text:000000010127AEEA lea rdi, [rbp+var_5488]
__text:000000010127AEF1 mov [rbp+var_22E8], rdi
__text:000000010127AEF8 mov rax, [rbp+var_22E8]
__text:000000010127B225 mov [rax+rdx], cl
__text:000000010127B228 inc rax
__text:000000010127B22B cmp rax, 4
__text:000000010127B22F mov ecx, 6EA755C0h
__text:000000010127B234 mov edx, 0C7FC21BEh
__text:000000010127B239 cmovz ecx, edx
__text:000000010127B23C mov [rbp+var_324], ecx
__text:000000010127B242 mov [rbp+var_1B20], rax
__text:000000010127B249 jmp loc_10127B0C8
Actual behavior
[INFO][qilingida:1393] A block with only one instruction which is `mov #imm, reg` at 0x10127b239.
[WARNING][qilingida:1371] The address 0x10127aeea where jmp_mbb goes isn't pre_dispatcher or dispatcher block!
[INFO][qilingida:1432] Switch the jmp_bb and next_bb and try again...
[WARNING][qilingida:1360] jmp_mbb at 0x10127b239 the opcode of last instruction mov #0xC7FC21BE.4 , ecx.4 isn't goto
[ERROR][qilingida:1436] Fail to identify microcode blocks at 0x10127b239
[WARNING][qilingida:1519] Fail to force execution by microcode at 0x10127b239, trying legacy approach
Traceback (most recent call last):
File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 809, in activate
self.action_handler.ql_handle_menu_action(self.action_type)
File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 2096, in ql_handle_menu_action
[x.handler() for x in self.menuitems if x.action == action]
File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 2096, in <listcomp>
[x.handler() for x in self.menuitems if x.action == action]
File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 1840, in ql_deflat
if not self._search_path():
File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 1656, in _search_path
ql.run(begin=ql_bb_start_ea, end=0, count=0xFFF)
File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\core.py", line 572, in run
self.os.run()
File "C:\Program Files (x86)\Hex-Rays IDA Professionalpython-3\Lib\site-packages\qiling\os\macos\macos.py", line 207, in run
self.ql.emu_start(self.ql.loader.entry_point, self.exit_point, self.ql.timeout, self.ql.count)
File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\core.py", line 708, in emu_start
raise self._internal_exception
File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\utils.py", line 37, in wrapper
return func(*args, **kw)
File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\core_hooks.py", line 91, in _hook_trace_cb
ret = hook.call(ql, addr, size)
File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\core_hooks_types.py", line 25, in call
return self.callback(ql, *args)
File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 1520, in _guide_hook
result = self._force_execution_by_parsing_assembly(ql, ida_addr)
File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 1469, in _force_execution_by_parsing_assembly
reg2_val = ql.arch.regs.__getattribute__(reg2)
AttributeError: 'QlRegisterManager' object has no attribute 'edx'
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from qilingframework/qiling
-
Difficulty 2/5 Half a day Newbie friendliness 82/100
qilingframework/qiling#1640 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
qilingframework/qiling#1628 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
qilingframework/qiling#1460 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
qilingframework/qiling#1458 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 70/100
qilingframework/qiling#1665 ·
All issues in qilingframework/qiling
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
bancolombia/sentinel#23 ·
-
test md OpenCI
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
langchain-ai/deepagents#6450 ·
-
bug client
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100