*Describe the bug
The snapshot "save" and "restore" functions use different names for "os". ("os" and "os_context")
See this line vs this one.
Sample Code
count=[0]
def trace_cb(ql: Qiling, address: int, size: int, count):
ql.save(reg=True, mem=True, hw=False, fd=False, cpu_context=True, os=True, loader=True,snapshot="savestate")
ql = Qiling(["x86_windows/test.exe"], "x86_windows")
ql.hook_code(trace_cb, count)
ql.run()
Then, after crash
ql = Qiling(["x86_windows/test.exe"], "x86_windows")
ql.restore("savestate")
ql.run(begin=ql.arch.regs.eip)
Expected behavior
"restore" loads os heap data.
Additional context
I had to add heap saving to windows to avoid "memory not available" errors when running restored emulation.
def save(self) :
ret={}
ret["heap"]=self.heap.save()
return ret
def restore(self, saved_state):
if "heap" in saved_state:
self.heap.restore(saved_state["heap"])
*Describe the bug
The snapshot "save" and "restore" functions use different names for "os". ("os" and "os_context")
See this line vs this one.
Sample Code
Then, after crash
Expected behavior
"restore" loads os heap data.
Additional context
I had to add heap saving to windows to avoid "memory not available" errors when running restored emulation.