qilingframework / qilingframework/qiling

Question about ql.emu_start using the count parameter (stepi debug command)

Open
#1,570 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

Describe the bug
I've tried to debug programs in different setups and spotted sometimes a behavior that I think to be unicorn related but not sure so here's my question. I've debugged using the qiling gdbserver, tried also qdb and in both cases the thing is the same. Sometimes, when executing the stepi command more than one assembly instruction is actually executed (two, three, four... depends on the case).
I've digged a bit the thing and what I found is that in all cases, call to ql.emu_start is done with the count=1 parameter and at unicorn level, the call uc.emu_start is also done with count=1.
I assume this could be related to QEMU TCG cache under unicorn but not so sure. (Here the links to the unicorn github https://github.com/unicorn-engine/unicorn/wiki/FAQ#editing-an-instruction-doesnt-take-effecthooks-added-during-emulation-are-not-called)
Is this a thing that you aware of ? If yes do you know how to deal with this at qiling level ?

Thanks in advance.
(I've always work with ARM targets)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the ARM stepi behavior through Qiling's gdbserver and qdb, tracing ql.emu_start and the Unicorn uc.emu_start call with count=1. Read the linked Unicorn FAQ on TCG cache and hook behavior, then determine whether multiple instructions are expected and document a Qiling-level workaround or required change. Done means a confirmed explanation and reproducible guidance.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.