hello_linuxx8664_intercept.py

#!/usr/bin/env python3
# 
# Cross Platform and Multi Architecture Advanced Binary Emulation Framework
#

import sys
sys.path.append("..")

from qiling import Qiling
from qiling.const import QL_INTERCEPT
from qiling.os.linux.syscall_nums import SYSCALL_NR

def write_onenter(ql: Qiling, fd: int, buf: int, count: int):
    print("enter write syscall!")

    ql.arch.regs.rsi = buf + 1
    ql.arch.regs.rdx = count - 1

def write_onexit(ql: Qiling, fd: int, buf: int, count: int, retval: int):
    print("exit write syscall!")

    ql.arch.regs.rax = count + 1

if __name__ == "__main__":
    ql = Qiling(["rootfs/x8664_linux/bin/x8664_hello"], "rootfs/x8664_linux")

    ql.os.set_syscall(SYSCALL_NR.write, write_onenter, QL_INTERCEPT.ENTER)
    ql.os.set_syscall(SYSCALL_NR.write, write_onexit, QL_INTERCEPT.EXIT)

    ql.run()