qilingframework / qilingframework/qiling

Shellcode does not have an entry_point set

Open
#1,608 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

Describe the bug

Shellcode does not have an entry_point set. This amongst other things prevents the usage of qdb on shellcode. Through experimentation I found that in my example below the shellcode is loaded at 0x11ff000, if set manually qdb works.

Sample Code

from qiling import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS

X86_LIN = bytes.fromhex('31c050682f2f7368682f62696e89e3505389e1b00bcd80')
ql = Qiling(code=X86_LIN, archtype=QL_ARCH.X86, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.DEBUG)
ql.debugger = "qdb"
assert ql.entry_point == None # entry_point not set
assert not "entry_point" in dir(ql.loader) # entry_point does not exist
ql.loader.entry_point = 0x11ff000 # set entry_point manually
ql.run()

Expected behavior
The entry_point of shellcode should be set automatically

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the supplied Python sample with the shellcode, Qiling, and qdb configuration, confirming that the loader lacks an entry_point and that manually setting 0x11ff000 makes qdb work. Done means the shellcode entry point is set automatically and the sample runs under qdb without the manual loader assignment.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.