Qiling Emulation: Save called APIs info and their params

1 week ago 5
ARTICLE AD BOX

I am new to Qiling and it is a great tool, the information I need is being printed in logs, but I am unable to find any method to access that information. I need the functions called by a PE during emulation and their params too. Example logs

[=] RegOpenKeyW(hKey = "HKEY_CURRENT_USER", lpSubKey = "Software",phkResult = 0xffffcfd0) = 0x0 [=]
lstrlenW(lpString = "123123") = 0x6 [=]
RegSetValueExW(hKey = "HKEY_CURRENT_USER\Software", lpValueName = "TEST_KEY", Reserved = 0, dwType = 0x1, lpData = 0x40215c, cbData = 0xe) = 0x0 [=]
lstrlenW(lpString = "2333333") = 0x7 [=]
RegSetValueExW(hKey = "HKEY_CURRENT_USER\Software", lpValueName = "TEST_KEY_2", Reserved = 0, dwType = 0x1, lpData = 0x402180, cbData = 0x10) = 0x0 [=]
RegDeleteValueW(hKey ="HKEY_CURRENT_USER\Software", lpValueName = "TEST_KEY") = 0x0 [=]
exit(status = 0) I get the required function calls RegOpenKeyW and their pramams i.e hKey in logs. My question is that is there any method that can give me all this information in a defined json method, as parsing this text will be difficult and I don't want to make a parser if there is some method defined for this. My code is

import os import argparse from qiling import * def main(path : str, rootfs : str): qil = Qiling(path, rootfs) qil.run() print("[+] Successfully emulated the binary.") if __name__ == "__main__": parser = argparse.ArgumentParser(description='DARTS Emulator') parser.add_argument('input_file', help="Input binary file.") parser.add_argument('-r', '--rootfs', help="Qiling RootFS path") args = vars(parser.parse_args()) qiling_rootfs = args['rootfs'] if not qiling_rootfs: qiling_rootfs = os.path.join(os.getcwd(), "examples", "rootfs", "x86_windows") bin_file = args['input_file'] print(f">> ROOTFS : {qiling_rootfs}") print(f">> Binary : {bin_file}") main([bin_file], qiling_rootfs)

I have tried report.generate_report(qil) method but it doesn't give necessary info

Read Entire Article