qilingframework / qilingframework/qiling
unicorn.unicorn.UcError when using timeout
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Description
Describe the bug
I want to use Qiling to track the block nodes of the binary hited by the input file. I hope to use the timeout mechanism when calling qiling.run, so I set the timeout parameter to 10000 (10 seconds). As a result, I encountered the following error.
[x] 000000000000400000 - 000000000000403000 r-- re2 /home/test/re2
[x] 000000000000403000 - 000000000000425000 r-x re2 /home/test/re2
[x] 000000000000425000 - 000000000000438000 r-- re2 /home/test/re2
[x] 000000000000439000 - 00000000000043b000 rw- re2 /home/test/re2
[x] 00000000000043b000 - 00000000000043d000 rwx [hook_mem]
[x] 0000007ffff7dd5000 - 0000007ffff7dfc000 r-x ld-linux-x86-64.so.2 /home/rootfs/x8664_linux/lib64/ld-linux-x86-64.so.2
[x] 0000007ffff7ffc000 - 0000007ffff7fff000 rw- ld-linux-x86-64.so.2 /home/rootfs/x8664_linux/lib64/ld-linux-x86-64.so.2
[x] 0000007ffffffde000 - 00000080000000e000 rwx [stack]
[x] 00ffffffffff600000 - 00ffffffffff601000 rwx [vsyscall]
Traceback (most recent call last):
File "/home/source/cfg.py", line 220, in analyze_corpus
self.tracer.trace_corpus(file_path)
File "/home/source/cfg.py", line 117, in trace_corpus
ql.run(timeout=10000)
File "/home/angr/lib/python3.8/site-packages/qiling/core.py", line 595, in run
self.os.run()
File "/home/angr/lib/python3.8/site-packages/qiling/os/linux/linux.py", line 184, in run
self.ql.emu_start(self.ql.loader.elf_entry, self.exit_point, self.ql.timeout, self.ql.count)
File "/home/angr/lib/python3.8/site-packages/qiling/core.py", line 769, in emu_start
self.uc.emu_start(begin, end, timeout, count)
File "/home/angr/lib/python3.8/site-packages/unicorn/unicorn.py", line 547, in emu_start
raise UcError(status)
unicorn.unicorn.UcError: Invalid memory fetch (UC_ERR_FETCH_UNMAPPED)
When I remove the timeout parameter, the program runs normally.
Sample Code
ql = Qiling([target, os.path.abspath(corpus)], rootfs=rootfs, verbose=QL_VERBOSE.OFF)
ql.add_fs_mapper(os.path.abspath(corpus), os.path.abspath(corpus))
ql.os.stdout = open(os.devnull, 'wb')
ql.hook_block(hook_for_trace)
ql.run(timeout=10000)
Expected behavior
I want Qiling to forcibly terminate after running for more than 10 seconds, but I haven't found a method to stop it, so I used the timeout parameter.
I was originally expecting it to end after 10 seconds, and then I would check whether Qiling ended abnormally, but now it's throwing an error directly.
Additional context
Version: 1.4.6
May I ask why the timeout triggered this error? If the timeout cannot be used, how should I handle the timeout situation?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the sample with Qiling 1.4.6, then trace the timeout path through qiling/core.py, qiling/os/linux/linux.py, and Unicorn's emu_start call shown in the traceback. Compare runs with and without timeout and determine how the timeout result should be handled. Done means the timeout behavior is consistent with the documented expectation without an unexpected uncaught error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100