qilingframework / qilingframework/qiling
Question about ql.emu_start using the count parameter (stepi debug command)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Description
Describe the bug
I've tried to debug programs in different setups and spotted sometimes a behavior that I think to be unicorn related but not sure so here's my question. I've debugged using the qiling gdbserver, tried also qdb and in both cases the thing is the same. Sometimes, when executing the stepi command more than one assembly instruction is actually executed (two, three, four... depends on the case).
I've digged a bit the thing and what I found is that in all cases, call to ql.emu_start is done with the count=1 parameter and at unicorn level, the call uc.emu_start is also done with count=1.
I assume this could be related to QEMU TCG cache under unicorn but not so sure. (Here the links to the unicorn github https://github.com/unicorn-engine/unicorn/wiki/FAQ#editing-an-instruction-doesnt-take-effecthooks-added-during-emulation-are-not-called)
Is this a thing that you aware of ? If yes do you know how to deal with this at qiling level ?
Thanks in advance.
(I've always work with ARM targets)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the ARM stepi behavior through Qiling's gdbserver and qdb, tracing ql.emu_start and the Unicorn uc.emu_start call with count=1. Read the linked Unicorn FAQ on TCG cache and hook behavior, then determine whether multiple instructions are expected and document a Qiling-level workaround or required change. Done means a confirmed explanation and reproducible guidance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100