Skip to content

Add AArch64 code-range blob example with UDF trapping - #1663

Open
warsang wants to merge 6 commits into
qilingframework:devfrom
warsang:feat/aarch64-range-blob-example
Open

warsang wants to merge 6 commits into
qilingframework:devfrom
warsang:feat/aarch64-range-blob-example

Conversation

@warsang

@warsang warsang commented Sep 10, 2026

Copy link
Copy Markdown

Adds a small examples/hello_arm64_range_blob.py example. Used QL_ARCH.ARM64

(Did that to emulate the ARM stub of an ARM64EC PE file).

Tested locally on a small ARM binary blob:

blob expected observed
8x NOP clean return RETURNED, steps=8
UDF #0 single UDF fault UDF pc=0x20000000 imm=0x0 word=0xd4200000
UDF #0x1234 immediate decoded imm=0x1234 word=0xd4224680
RET with lr=0 stop at unmapped UNMAPPED pc=0x0 addr=0x0 size=4
B ., max-steps 100 step cap STEP-CAP steps=100
no args usage + exit code usage printed, exit 2

dependabot Bot and others added 4 commits July 22, 2026 14:09
Bumps [setuptools](https://github.com/pypa/setuptools) from 78.1.1 to 83.0.0.
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v78.1.1...v83.0.0)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
…ot/pip/setuptools-83.0.0

Bump setuptools from 78.1.1 to 83.0.0
Maps a raw AArch64 blob executable with scratch stack plus stub page,
logs invalid instructions as structured UDF faults and stops at
unmapped accesses instead of misexecuting.
@warsang
warsang marked this pull request as draft September 14, 2026 07:50
hello_arm64_range_blob.py printed qiling_aarch64_chpe.py in --help/usage. Align both docstring and runtime message with the actual filename per hello_arm_blob_raw.py conventions. No behavior change.
Comment thread examples/hello_arm64_range_blob.py Outdated
Comment thread examples/hello_arm64_range_blob.py Outdated
Comment thread examples/hello_arm64_range_blob.py Outdated
QL_ARCH.AARCH64 does not exist, use QL_ARCH.ARM64. Code hooks receive (ql, address, size), accept all three. Qiling _hook_mem_cb ignores the unmapped-hook return value, so stop explicitly with emu_stop() and return True; track intentional stops so exactly one terminal event is recorded (no RETURNED/STOP after UNMAPPED/STEP-CAP). Verified: NOP blob returns, UDF blob logs single UDF fault, ret-to-unmapped stops with single UNMAPPED, tight loop hits STEP-CAP at cap.
@warsang
warsang marked this pull request as ready for review September 17, 2026 12:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants