Add fuzz stm32f407_hacklock example#1108
Conversation
elicn
left a comment
elicn
left a comment
There was a problem hiding this comment.
A good example has to be minimalistic [to avoid confusion] and descriptive [to let people learn from it]. Please comment the example as much as you can and clean up residuals or unnecessary code.
| from qiling.arch.arm import QlArchARM | ||
|
|
||
|
|
||
| def watch(ql:Qiling): |
There was a problem hiding this comment.
The usage of this function is commented out.
Consider commenting out the function as well, or remove it altogether.
|
|
||
| def watch(ql:Qiling): | ||
| r0 = hex(ql.arch.regs.read('r0')) | ||
| if r0 != '0x0': |
There was a problem hiding this comment.
Why comparing strings when you can compare integers..?
| ql.emu_stop() | ||
|
|
||
| def fuzz_cb(ql:Qiling): | ||
| if isinstance(ql.arch, QlArchARM): |
There was a problem hiding this comment.
Could use ql.ostype to determine this, or just hasattr(ql.arch, 'effective_pc') if you want to avoid the extra import.
| ql.hw.create('usart1') | ||
| ql.hw.create('rcc') | ||
|
|
||
| # ql.hw.show_info() |
There was a problem hiding this comment.
Remove unnecessary leftovers to keep the example as clear as possible.
| # ql.hw.show_info() | ||
| # ql.hook_address(watch, 0x08003232) | ||
|
|
||
| ql.patch(0x8000238, b'\x00\xBF' * 4) |
There was a problem hiding this comment.
What is that..? What are we patching here and why?
Comments are critical for users to understand the example.
|
|
||
| def disasm(count, ql, address, size): | ||
| buf = ql.mem.read(address, size) | ||
| try: |
There was a problem hiding this comment.
Unnecessary try / exept.
There is nothing to catch here really.
| buf = ql.mem.read(address, size) | ||
| try: | ||
| for i in md.disasm(buf, address): | ||
| return "{:08X}\t{:08X}: {:24s} {:10s} {:16s}".format(count[0], i.address, spaced_hex(buf), i.mnemonic, |
There was a problem hiding this comment.
The loop doesn't make much sense if you return unconditionally.
Perhaps you mean yield..?
| rtn = '{:100s}'.format(disasm(count, ql, address, size)) | ||
| print(rtn) | ||
| count[0] += 1 | ||
| # pass |
| # ql.run(end=0x8003236, count=-1) | ||
| ql.run(end=0x080031DC) | ||
|
|
||
| exits = [0x08003270, 0x08003222] |
There was a problem hiding this comment.
Comments?
No idea what this is about.
|
@elicn This example is an experimental test yet and depending on some unpublished interface, converting it to draft for now. |
2 participants
Checklist
Which kind of PR do you create?
Coding convention?
Extra tests?
Changelog?
Target branch?
One last thing