ucgjhe / qdb

A multi-architecture and cross-platform debugger baked by Qiling Framework

Qiling Debugger

Introduction

A multi-architecture and cross-platform debugger baked by Qiling Framework

Installation

pip3 install qiling

git clone [email protected]:ucgJhe/Qdb.git

How to run example.py

make sure you install gcc-multilib-mipsel-linux-gnu gcc-multilib-arm-linux-gnueabihf

and make binary in src directory cd src; make

just uncomment the one you want to test in example.py and run it with python3 example.py

Usage

# simple setup
from qdb import Qdb

Qdb(["src/mips32el_hello"], "/usr/mipsel-linux-gnu", rr=True).interactive()

1. commandline-based user interface

• use command start and paused at the entry point

2. step-by-step execution

• use command step or s to execute one instruction at a time

3. breakpoints

• use command breakpoint or b to setup a breakpoint, and continue process with continue or c

4. dynamic memory examination

• use command examine or x to read data from memory

5. record and replay

• use command backward or p to step backward from current location
• Note:
  • 1. the address you want to step backward on it must be step-over before
  • 2. make sure run Qdb with option rr=True like the example above

Supported architecture for now

• MIPS32
• ARM/THUMB
• MIPS64
• ARM64
• x86/x86-64

P.S. tested on Ubuntu 20.04 only

qdb's Issues

ql.run(begin=begin)时，qdb的cur_addr不在begin

在某些场景下，只想调试指定范围的代码。
启用debuger后，ql.run(begin=begin)时，qdb的PC不在begin位置；而与此同时，gdb却可以正常跳到begin位置运行。

怀疑是qdb.py中，76行到82行之间，对self.ql.loader.entry_point的赋值逻辑有问题，可能没顾及到run中传入的begin即self.ql.entry_point的值。

if self.ql.os.type == QL_OS.BLOB:
            self.ql.loader.entry_point = self.ql.loader.load_address

        elif init_hook and self.ql.loader.entry_point != init_hook:
            self.do_breakpoint(init_hook)

        self.cur_addr = self.ql.loader.entry_point