var_10= qword ptr -10h
var_4= dword ptr -4

; __unwind {
push rbp
mov rbp, rsp
sub rsp, 10h
mov [rbp+var_4], edi
mov [rbp+var_10], rsi
mov eax, 0
call start
mov eax, 0
leave
retn
; } // starts at 15CA
main endp

.text:0000000000000BAC mov rax, [rbp+var_18]
.text:0000000000000BB0 mov byte ptr [rax], 1

ql.pack16(0x1234) # 这个函数专门用于16位整数

if __name__ == '__main__':
path = ["qilinglab-x86_64"]
rootfs = "rootfs/x8664_linux"
ql = Qiling(path, rootfs)
challenge1(ql)
ql.run()

[=] write(fd = 0x1, buf = 0x55555575a260, count = 0x1) = 0x1
[=] uname(buf = 0x80000000db70) = 0x0
Challenge 1: SOLVED
[=] write(fd = 0x1, buf = 0x55555575a260, count = 0x14) = 0x14
[=] openat(fd = 0xffffff9c, path = 0x555555555698, flags = 0x0, mode = 0x0) = -0x2 (ENOENT)
[=] read(fd = 0xffffffff, buf = 0x80000000dce0, length = 0x20) = -0x9 (EBADF)
[=] read(fd = 0xffffffff, buf = 0x80000000dcdf, length = 0x1) = -0x9 (EBADF)
[=] close(fd = 0xffffffff) = -0x1 (EPERM)
[=] getrandom(buf = 0x80000000dd00, buflen = 0x20, flags = 0x1) = 0x20
Challenge 2: NOT SOLVED
[=] write(fd = 0x1, buf = 0x55555575a260, count = 0x18) = 0x18
Challenge 3: NOT SOLVED
[=] write(fd = 0x1, buf = 0x55555575a260, count = 0x18) = 0x18
[=] time() = 0x64704df9
Challenge 4: NOT SOLVED
[=] write(fd = 0x1, buf = 0x55555575a260, count = 0x18) = 0x18

if __name__ == '__main__':
path = ["rootfs/x8664_linux/qilinglab-x86_64"]
rootfs = "rootfs/x8664_linux"
ql = Qiling(path, rootfs)
challenge1(ql)
ql.debugger = 'gdb:0.0.0.0:12345'
ql.run()

def challenge2(ql):
# 使用QL_INTERCEPT.EXIT在系统调用执行完成之后立即执行hook函数，ql.os.set_syscall 使用方法在官方文档 Hijack 部分
ql.os.set_syscall("uname", my_uname_on_exit_hook, QL_INTERCEPT.EXIT)

if __name__ == '__main__':
path = ["rootfs/x8664_linux/qilinglab-x86_64"]
rootfs = "rootfs/x8664_linux"
ql = Qiling(path, rootfs)
# 记得加上challenge1
challenge2(ql)
ql.run()

返回值：
如果成功获取随机数据，getrandom 返回实际读取的字节数。
如果出错，返回 -1 并设置 errno。常见的错误包括 EAGAIN（系统熵池中没有足够的熵，且 flags 设置为非阻塞模式）和 EFAULT（buf 指针无效或指向不可访问的内存区域）。

def read(self, size: int) -> bytes:
if size == 1:
return b"x42" # v5的长度为1
# return a constant value upon reading
else:
return b"x41"

def fstat(self) -> int: # fstat() 是Linux/Unix系统调用之一，用来获取文件的状态信息
# return -1 to let syscall fstat ignore it
return -1

def close(self) -> int:
return 0

if __name__ == "__main__":
ql = Qiling([r'rootfs/x86_linux/bin/x86_fetch_urandom'], r'rootfs/x86_linux')

ql.add_fs_mapper(r'/dev/urandom', FakeUrandom())
ql.run()

def read(self, size: int) -> bytes:
if size == 1:
return b"x42"
else:
return b"x41" * size

def close(self) -> int:
return 0

def hook_getrandom(ql, buf, buflen, flags):
# 自定义 getrandom 函数实现
if buflen == 32:
data = b'x41' * buflen # b'x41' = A
ql.mem.write(buf, data)
ql.os.set_syscall_return(buflen)
else:
ql.os.set_syscall_return(-1)

def challenge3(ql):
ql.add_fs_mapper(r'/dev/urandom', FakeUrandom())
ql.os.set_syscall("getrandom", hook_getrandom)

if __name__ == '__main__':
path = ["rootfs/x8664_linux/qilinglab-x86_64"]
rootfs = "rootfs/x8664_linux"
ql = Qiling(path, rootfs)
# 记得加上challenge1
challenge2(ql)
ql.run()

mov eax, [rbp+var_8]
cmp [rbp+var_4], eax
add [rbp+var_4], 1

# 在内存中寻找魔数
MAGIC = 0x3DFCD6EA00000539
'''
魔数由结构体中 value1 与 value2 构成。
1. 将 value1 转换为 16 进制表示：1337 的 16 进制表示为 0x539。
2. 将 value2 转换为 16 进制表示：1039980266 的 16 进制表示为 0x3DFCD6EA。
3. 将 value2 字段左移 32 位，这相当于将其乘以 2^32：0x3DFCD6EA * 2^32 = 0x3DFCD6EA00000000。
4. 将 value2 与 alue1 的值相加：0x3DFCD6EA00000000 + 0x539 = 0x3DFCD6EA00000539。
所以，将 value1 和 value2 字段组合得到的魔数是 0x3DFCD6EA00000539。
'''

magic_addrs = ql.mem.search(ql.pack64(MAGIC)) # 转换魔数成为字节序列

for magic_addr in magic_addrs: # 为了避免重复，循环检测

# Dump and unpack the candidate structure
candidate_heap_struct_addr = magic_addr - 8 # 魔数距离堆头指针距离为 8 bytes
candidate_heap_struct = ql.mem.read(candidate_heap_struct_addr, 24) # 获取结构体地址结构

string_addr, _ , check_addr = struct.unpack('QQQ', candidate_heap_struct)
# struct.unpack() 是一个 Python 函数，用于将字节序列解包为多个值，解包 candidate_heap_struct 地址结构。
# 'QQQ' 是一个格式字符串，表示要解包的数据结构包含3个64位（8 字节）无符号整数。
# string_addr, _ , check_addr：只关注 string_addr 与 check_addr，最后得到相应地址

if ql.mem.string(string_addr) == "Random data":
# 修改*a1为1
ql.mem.write(check_addr, b"x01")
break

def challenge8(ql):
base_addr = ql.mem.get_lib_base(os.path.split(ql.path)[-1])
end_of_challenge8 = base_addr + 0xFB5 # 程序运行结束时的地址

ql.hook_address(challenge8_hook, end_of_challenge8)

def challenge10(ql):
ql.add_fs_mapper('/proc/self/cmdline', Fake_cmdline())

// 打开/proc/self/cmdline文件
file = fopen("/proc/self/cmdline", "r");
if (file == NULL) {
printf("无法打开/proc/self/cmdline文件。n");
exit(EXIT_FAILURE);
}
printf("读取/proc/self/cmdline：n");
// 逐个字符读取文件内容并输出到终端
while ((ch = fgetc(file)) != EOF) {
// 将空字符替换为换行符以提高可读性
if (ch == '') {
putchar('n');
} else {
putchar(ch);
}
}

// 关闭文件
fclose(file);

return 0;
}

class Fake_cmdline(QlFsMappedObject):
def read(self, expected_len):
return b'qilinglab'

def close(self):
return 0

def challenge10(ql):
ql.add_fs_mapper('/proc/self/cmdline', Fake_cmdline())

if __name__ == '__main__':
path = ["test_cmdline"]
rootfs = "rootfs/x8664_linux"
ql = Qiling(path, rootfs)
challenge10(ql)
ql.run()

def challenge11(ql):
begin, end = 0, 0
for info in ql.mem.map_info:
print(info)
if info[2] == 5 and 'qilinglab-x86_64' in info[3]:
begin, end = info[:2]
print(f"{begin} -> {end}")

ql.hook_code(hook_cpuid, begin=begin, end=end)

def challenge1(ql):
ql.mem.map(0x1000, 0x1000, info='[challenge1]')
ql.mem.write(0x1337, ql.pack16(1337))

def my_uname_on_exit_hook(ql, *args):
rdi = ql.arch.regs.rdi
print(f"utsname address: {hex(rdi)}")
ql.mem.write(rdi, b'QilingOSx00')
ql.mem.write(rdi + 65 * 3, b'ChallengeStartx00')

def challenge2(ql):
ql.os.set_syscall("uname", my_uname_on_exit_hook, QL_INTERCEPT.EXIT)

class FakeUrandom(QlFsMappedObject):

def read(self, size: int) -> bytes:
if size == 1:
print("*************3**************")
return b"x42"
else:
return b"x41" * size

def close(self) -> int:
return 0

def hook_getrandom(ql, buf, buflen, flags):
# 自定义 getrandom 函数实现
if buflen == 32:
data = b'x41' * buflen # b'x41' = A
ql.mem.write(buf, data)
ql.os.set_syscall_return(buflen)
else:
ql.os.set_syscall_return(-1)

def challenge3(ql):
ql.add_fs_mapper(r'/dev/urandom', FakeUrandom())
ql.os.set_syscall("getrandom", hook_getrandom)

def enter_forbidden_loop_hook(ql):
ql.arch.regs.eax = 1

def challenge4(ql):
"""
.text:0000555555554E40 mov eax, [rbp+var_8]
.text:0000555555554E43 cmp [rbp+var_4], eax <-- 在运行此命令前hook eax，使得eax = 1
.text:0000555555554E46 jl short loc_555555554E35
"""
base = ql.mem.get_lib_base(os.path.split(ql.path)[-1]) # 根据文件路径查找已经加载的文件，获取对应文件的基地址
hook_addr = base + 0xE43
ql.hook_address(enter_forbidden_loop_hook, hook_addr) # 当执行流程到达hook_addr时，该函数将被调用。此时hook_addr处的代码还未被执行。

def hook_rand(ql):
ql.arch.regs.rax = 0

def challenge5(ql):
ql.os.set_api('rand', hook_rand)

def hook_rax(ql):
ql.arch.regs.rax = 0
def challenge6(ql):
base = ql.mem.get_lib_base(os.path.split(ql.path)[-1])
hook_addr = base + 0xF16
ql.hook_address(hook_rax, hook_addr)

def hook_sleep(ql):
return 0
def challenge7(ql):
ql.os.set_api('sleep', hook_sleep)

def challenge8_hook(ql):

# Find all occurrences of the magic in memory
MAGIC = 0x3DFCD6EA00000539
magic_addrs = ql.mem.search(ql.pack64(MAGIC))

for magic_addr in magic_addrs:

# Dump and unpack the candidate structure
candidate_heap_struct_addr = magic_addr - 8
candidate_heap_struct = ql.mem.read(candidate_heap_struct_addr, 24)

string_addr, _ , check_addr = struct.unpack('QQQ', candidate_heap_struct)
# struct.unpack() 是一个 Python 函数，用于将字节序列解包为多个值，解包 candidate_heap_struct 变量中的数据。
# 'QQQ' 是一个格式字符串，表示要解包的数据结构包含3个64位（8 字节）无符号整数。
# string_addr, _ , check_addr：只关注 string_addr 与 check_addr

if ql.mem.string(string_addr) == "Random data":
# 修改*a1为1
ql.mem.write(check_addr, b"x01")
break

def challenge8(ql):
base_addr = ql.mem.get_lib_base(os.path.split(ql.path)[-1])
end_of_challenge8 = base_addr + 0xFB5 # 程序运行结束时的地址

ql.hook_address(challenge8_hook, end_of_challenge8)

def hook_tolower(ql):
return 0

def challenge9(ql):
ql.os.set_api('tolower', hook_tolower)

class Fake_cmdline(QlFsMappedObject):
def read(self, expected_len):
return b'qilinglab'

def close(self):
return 0

def challenge10(ql):
# ql.add_fs_mapper('/proc/self/cmdline', Fake_cmdline())
ql.add_fs_mapper('/proc/self/cmdline', QlFsMappedCallable(Fake_cmdline))

def hook_cpuid(ql, address, size):
if ql.mem.read(address, size) == b'x0FxA2':
regs = ql.arch.regs
regs.ebx = 0x696C6951
regs.ecx = 0x614C676E
regs.edx = 0x20202062
regs.rip += 2

def challenge11(ql):
begin, end = 0, 0
for info in ql.mem.map_info:
print(info)
if info[2] == 5 and 'qilinglab-x86_64' in info[3]:
begin, end = info[:2]
print(f"{begin} -> {end}")

ql.hook_code(hook_cpuid, begin=begin, end=end)

if __name__ == '__main__':
path = ["rootfs/x8664_linux/qilinglab-x86_64"]
rootfs = "rootfs/x8664_linux"
ql = Qiling(path, rootfs, enable_procfs=False)
challenge1(ql)
challenge2(ql)
challenge3(ql)
challenge4(ql)
challenge5(ql)
challenge6(ql)
challenge7(ql)
challenge8(ql)
challenge9(ql)
challenge10(ql)
challenge11(ql)
ql.run()