qiling not recognize CMOVZ series?

Open
#1,149 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
python

Research direction

Start in qilingida.py, especially _force_execution_by_parsing_assembly and the ql.run path shown in the traceback. Reproduce the CMOVZ sample and trace how the instruction is parsed and executed; done means the sample no longer fails while handling CMOVZ and the reported register error is addressed.

Written by the indexing model from the issue text.

Description

*Describe the bug
qiling not recognize CMOVZ series?

Sample Code

__text:000000010127AED0                 lea     rdi, [rbp+var_54A0]
__text:000000010127AED7                 mov     [rbp+var_22E0], rdi
__text:000000010127AEDE                 mov     rax, [rbp+var_22E0]
__text:000000010127AEE5                 call    sub_1012BD8F2
__text:000000010127AEEA                 lea     rdi, [rbp+var_5488]
__text:000000010127AEF1                 mov     [rbp+var_22E8], rdi
__text:000000010127AEF8                 mov     rax, [rbp+var_22E8]


__text:000000010127B225                 mov     [rax+rdx], cl
__text:000000010127B228                 inc     rax
__text:000000010127B22B                 cmp     rax, 4
__text:000000010127B22F                 mov     ecx, 6EA755C0h
__text:000000010127B234                 mov     edx, 0C7FC21BEh
__text:000000010127B239                 cmovz   ecx, edx
__text:000000010127B23C                 mov     [rbp+var_324], ecx
__text:000000010127B242                 mov     [rbp+var_1B20], rax
__text:000000010127B249                 jmp     loc_10127B0C8

Actual behavior

[INFO][qilingida:1393] A block with only one instruction which is `mov #imm, reg` at 0x10127b239.
[WARNING][qilingida:1371] The address 0x10127aeea where jmp_mbb goes isn't pre_dispatcher or dispatcher block!
[INFO][qilingida:1432] Switch the jmp_bb and next_bb and try again...
[WARNING][qilingida:1360] jmp_mbb at 0x10127b239 the opcode of last instruction  mov     	#0xC7FC21BE.4		,	 ecx.4 isn't goto
[ERROR][qilingida:1436] Fail to identify microcode blocks at 0x10127b239
[WARNING][qilingida:1519] Fail to force execution by microcode at 0x10127b239, trying legacy approach
Traceback (most recent call last):
  File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 809, in activate
    self.action_handler.ql_handle_menu_action(self.action_type)
  File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 2096, in ql_handle_menu_action
    [x.handler() for x in self.menuitems if x.action == action]
  File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 2096, in <listcomp>
    [x.handler() for x in self.menuitems if x.action == action]
  File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 1840, in ql_deflat
    if not self._search_path():
  File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 1656, in _search_path
    ql.run(begin=ql_bb_start_ea, end=0, count=0xFFF)
  File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\core.py", line 572, in run
    self.os.run()
  File "C:\Program Files (x86)\Hex-Rays IDA Professionalpython-3\Lib\site-packages\qiling\os\macos\macos.py", line 207, in run
    self.ql.emu_start(self.ql.loader.entry_point, self.exit_point, self.ql.timeout, self.ql.count)
  File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\core.py", line 708, in emu_start
    raise self._internal_exception
  File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\utils.py", line 37, in wrapper
    return func(*args, **kw)
  File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\core_hooks.py", line 91, in _hook_trace_cb
    ret = hook.call(ql, addr, size)
  File "C:\Program Files (x86)\Hex-Rays IDA Professional\python-3\Lib\site-packages\qiling\core_hooks_types.py", line 25, in call
    return self.callback(ql, *args)
  File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 1520, in _guide_hook
    result = self._force_execution_by_parsing_assembly(ql, ida_addr)
  File "C:/Program Files (x86)/Hex-Rays IDA Professional/plugins/qilingida.py", line 1469, in _force_execution_by_parsing_assembly
    reg2_val = ql.arch.regs.__getattribute__(reg2)
AttributeError: 'QlRegisterManager' object has no attribute 'edx'
Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from qilingframework/qiling

All issues in qilingframework/qiling

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.