(self)
| 70 | super().__init__(ql) |
| 71 | |
| 72 | def run(self): |
| 73 | if self.ql.code: |
| 74 | self.ql.mem.map(self.ql.os.entry_point, self.ql.os.code_ram_size, info="[shellcode_stack]") |
| 75 | |
| 76 | shellcode_base = self.ql.os.entry_point + 0x200000 - 0x1000 |
| 77 | self.ql.mem.write(shellcode_base, self.ql.code) |
| 78 | |
| 79 | self.ql.arch.regs.arch_sp = shellcode_base |
| 80 | self.ql.os.entry_point = shellcode_base |
| 81 | self.load_address = shellcode_base |
| 82 | |
| 83 | return |
| 84 | |
| 85 | self.profile = self.ql.os.profile[f'OS{self.ql.arch.bits}'] |
| 86 | |
| 87 | # setup program stack |
| 88 | stack_address = self.profile.getint('stack_address') |
| 89 | stack_size = self.profile.getint('stack_size') |
| 90 | top_of_stack = stack_address + stack_size |
| 91 | self.ql.mem.map(stack_address, stack_size, info='[stack]') |
| 92 | |
| 93 | self.path = self.ql.path |
| 94 | |
| 95 | with open(self.path, 'rb') as infile: |
| 96 | fstream = io.BytesIO(infile.read()) |
| 97 | |
| 98 | elffile = ELFFile(fstream) |
| 99 | elftype = elffile['e_type'] |
| 100 | |
| 101 | # is it a driver? |
| 102 | if elftype == 'ET_REL': |
| 103 | self.load_driver(elffile, top_of_stack, loadbase=0x8000000) |
| 104 | self.ql.hook_code(hook_kernel_api) |
| 105 | |
| 106 | # is it an executable? |
| 107 | elif elftype == 'ET_EXEC': |
| 108 | load_address = 0 |
| 109 | |
| 110 | self.load_with_ld(elffile, top_of_stack, load_address, self.argv, self.env) |
| 111 | |
| 112 | # is it a shared object? |
| 113 | elif elftype == 'ET_DYN': |
| 114 | load_address = self.profile.getint('load_address') |
| 115 | |
| 116 | self.load_with_ld(elffile, top_of_stack, load_address, self.argv, self.env) |
| 117 | |
| 118 | else: |
| 119 | raise QlErrorELFFormat(f'unexpected elf type value (e_type = {elftype})') |
| 120 | |
| 121 | self.is_driver = (elftype == 'ET_REL') |
| 122 | |
| 123 | self.ql.arch.regs.arch_sp = self.stack_address |
| 124 | |
| 125 | # No idea why. |
| 126 | if self.ql.os.type == QL_OS.FREEBSD: |
| 127 | # self.ql.arch.regs.rbp = self.stack_address + 0x40 |
| 128 | self.ql.arch.regs.rdi = self.stack_address |
| 129 | self.ql.arch.regs.r14 = self.stack_address |
nothing calls this directly
no test coverage detected