qilingframework / qilingframework/qiling
Shellcode does not have an entry_point set
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Description
Describe the bug
Shellcode does not have an entry_point set. This amongst other things prevents the usage of qdb on shellcode. Through experimentation I found that in my example below the shellcode is loaded at 0x11ff000, if set manually qdb works.
Sample Code
from qiling import Qiling
from qiling.const import QL_VERBOSE
from qiling.const import QL_ARCH, QL_OS
X86_LIN = bytes.fromhex('31c050682f2f7368682f62696e89e3505389e1b00bcd80')
ql = Qiling(code=X86_LIN, archtype=QL_ARCH.X86, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.DEBUG)
ql.debugger = "qdb"
assert ql.entry_point == None # entry_point not set
assert not "entry_point" in dir(ql.loader) # entry_point does not exist
ql.loader.entry_point = 0x11ff000 # set entry_point manually
ql.run()
Expected behavior
The entry_point of shellcode should be set automatically
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the supplied Python sample with the shellcode, Qiling, and qdb configuration, confirming that the loader lacks an entry_point and that manually setting 0x11ff000 makes qdb work. Done means the shellcode entry point is set automatically and the sample runs under qdb without the manual loader assignment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100