| 55 | |
| 56 | |
| 57 | def partial_run_init(ql: Qiling): |
| 58 | # argv prepare |
| 59 | ql.arch.regs.arch_sp -= 0x30 |
| 60 | arg0_ptr = ql.arch.regs.arch_sp |
| 61 | ql.mem.write(arg0_ptr, b"kaimendaji") |
| 62 | |
| 63 | ql.arch.regs.arch_sp -= 0x10 |
| 64 | arg1_ptr = ql.arch.regs.arch_sp |
| 65 | ql.mem.write(arg1_ptr, b"000000") # arbitrary password |
| 66 | |
| 67 | ql.arch.regs.arch_sp -= 0x20 |
| 68 | argv_ptr = ql.arch.regs.arch_sp |
| 69 | ql.mem.write_ptr(argv_ptr, arg0_ptr) |
| 70 | ql.mem.write_ptr(argv_ptr + ql.arch.pointersize, arg1_ptr) |
| 71 | |
| 72 | ql.arch.regs.r2 = 2 |
| 73 | ql.arch.regs.r3 = argv_ptr |
| 74 | |
| 75 | |
| 76 | if __name__ == "__main__": |