Hook is called at started of function

[et-ness]

I have a test elf compiled for mips el, here the source:

source test.c

#include <stdlib.h>
#include <stdio.h>

int testfun(int, int);
int testfun1(int, int);
int testfun2(int, int);

int testfun1(int a, int b)
{
    printf("testfun1 print a %d b %d\n", a, b);
}

int testfun2(int a, int b)
{
    printf("testfun2 before call testfun in libtest a %d b %d\n", a, b);
    testfun(a, b);
}

int main()
{
    printf("in main before testfun1\n");
    testfun1(10, 15);
    printf("in main before testfun1\n");
}

This is my test script:

source test.py

#!/usr/bin/env python3

import argparse

from qiling import Qiling
from qiling.const import QL_VERBOSE, QL_INTERCEPT, QL_CALL_BLOCK

def partial_run(ql):
    print("main")
    ql.arch.regs.a0 = int(args.param1)
    ql.arch.regs.a1 = int(args.param2)
    ql.arch.regs.arch_pc = 0x400818 # testfun2 never called function

def hook_testfun(ql: Qiling):
    print(f'hook_testfun')
    return QL_CALL_BLOCK

if __name__ == "__main__":
    global args

    parser = argparse.ArgumentParser(description='test')
    parser.add_argument('param1', help='Arg1')
    parser.add_argument('param2', help='Arg2')
    args = parser.parse_args()

    ql = Qiling([r'./rootfs/bin/test'], r'./rootfs', verbose=QL_VERBOSE.OFF)

    print(f"elf entry {ql.loader.elf_entry:04X}")

    ql.hook_address(partial_run, 0x4008a0) # main
    ql.os.set_api('testfun', hook_testfun, QL_INTERCEPT.CALL)

    ql.run()

Here the output:

$ ./run_testlib.py  1 2 
elf entry 400600
main
hook_testfun       <<<<<<<<<<<<<<<<<<<< Why is printed before the other print?
testfun2 before call testfun in libtest a 1 b 2

print in hook_testfun is executed before the print test message. Why?
I think the correct behaviout is print my test message and when the function testfun is called the hook should start with: replace, hook on enter, hook on exit.

Is wrong my code or is it an issue?

I tested with latest stable version 1.4.6 and with lastest dev commit.

[ucgJhe]

Hi @et-ness, the source you provided is incomplete. Please update it if this is still the case on your end.

[et-ness]

Hi @ucgJhe, thanks I stopped using qiling I think it's not a good project, there are too many issues, no one seems to use it.