qilingframework / qilingframework/qiling

execve EPERM with system syscall

Open
#1,451 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

*Describe the bug
I have 2 elf MIPS LE, the main elf run the child with system.

#include <stdlib.h>
#include <stdio.h>

int main()
{
    printf("run system\n");
    system("./testrun");
    return 0;
}
#include <stdlib.h>
#include <stdio.h>

int main()
{
    printf("testrun\n");
    return 0;
}

child is never executed when I use qiling and I see the error execve (EPERM)

Sample Code

#!/usr/bin/env python3

from qiling import Qiling
from qiling.const import QL_VERBOSE, QL_INTERCEPT

if __name__ == "__main__":
    ql = Qiling([r'./testsystem'], r'./', verbose=QL_VERBOSE.DISASM)

    print(f"elf entry {ql.loader.elf_entry:04X}")
    ql.run()

Expected behavior
qiling should run the elf child

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the supplied Python reproducer with ./testsystem and ./testrun, using ql.run() as the entry point. Trace Qiling's MIPS execve handling and the EPERM path; done means the child ./testrun executes under system() instead of failing with EPERM.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.