QBDI 0.7.0

$ readelf -d libshellx-3.0.0.0.so
...
0x00000019 (INIT_ARRAY)                 0x3e88
0x0000001b (INIT_ARRAYSZ)               8 (bytes)
...

$ python
>>> import lief
>>> lib = lief.parse("libshellx-3.0.0.0.so")
>>> print(lib.get(lief.ELF.DYNAMIC_TAGS.INIT_ARRAY))
INIT_ARRAY          3e88      [0x931, 0x0]

$ readelf -d libshellx-3.0.0.0_WITHOUT_CONSTR.so
...
0x00000019 (INIT_ARRAY)                 0x3e88
0x0000001b (INIT_ARRAYSZ)               0 (bytes)
...

#include <dlfcn.h>
#include <QBDI.h>
#include <LIEF/LIEF.hpp>

int main(int argc, char** argv) {
  const char path[] = "/data/local/tmp/libshellx-3.0.0.0_WITHOUT_CTOR.so";

  // Library loading
  std::unique_ptr<LIEF::ELF::Binary> lib_lief = LIEF::ELF::Parser::parse(path);
  void* handle = dlopen(path, RTLD_NOW | RTLD_LOCAL);

  QBDI::rword ctr_addr = libshell_base_addr + /* constructor */ 0x931;

  // QBDI initialization
  QBDI::VM vm;
  uint8_t *fakestack = nullptr;

  // Allocate a stack for QBDI
  QBDI::allocateVirtualStack(vm.getGPRState(), 1 << 20, &fakestack);

  // Setup QBDI callbacks (see next sections)
  ...

  // Only instrument the library
  vm.addInstrumentedModuleFromAddr(libshell_base_addr);

  // Run the constructor in QBDI
  QBDI::rword ret;
  vm.call(&ret, ctr_addr, /* no arguments */{});

  // Free the constructor stack
  QBDI::alignedFree(fakestack);

  return 0;
}

int main(int argc, char** argv) {
   ...
   // Setup the onExecBroker callback to catch external calls
   vm.addVMEventCB(QBDI::EXEC_TRANSFER_CALL, onExecBroker, nullptr);
   ...
}

QBDI::VMAction onExecBroker(QBDI::VMInstanceRef vm, const QBDI::VMState *vmState, QBDI::GPRState *gprState, ...) {

   std::string function;
   bool name_found = false;

   // Find the library with full path that contains EIP
   for (const QBDI::MemoryMap& map : QBDI::getCurrentProcessMaps(/* fullpath */true)) {
      if ((map.permission & QBDI::PF_EXEC) and map.range.contains(gprState->eip)) {
         std::unique_ptr<LIEF::ELF::Binary> externlib = LIEF::ELF::Parser::parse(map.name);
         const uintptr_t sym_offset = gprState->eip - map.range.start;

         // Resolve the offset into a symbol name using LIEF
         for (const LIEF::ELF::Symbol& sym : externlib->exported_symbols()) {
            if (sym_offset == sym.value()) {
               function = sym.demangled_name();
               name_found = true;
               break;
            }
         }
         break;
       }
   }

   if (name_found) {
      printf("External call to: %s", function.c_str());
      ...
   } else {
      printf("Cannot resolve the address %p\n", (void*) gprState->eip);
   }

   return QBDI::CONTINUE;
}

struct context_t {
   LIEF::ELF::Binary* lib_lief;
   QBDI::Range<QBDI::rword>& patch_range;
   QBDI::rword libshell_base_addr;
};

int main(int argc, char** argv) {
   ...
   // find .text range
   ...

   // Setup analysis context
   context_t ctx = {
      lib_lief.get(),       // Handler on LIEF's ELF::Binary*
      libshellx_code_range, // Code range of the .text section
      libshell_base_addr
    };

   // Setup the callback
   vm.addMemRangeCB(libshellx_code_range.start, libshellx_code_range.end, QBDI::MEMORY_WRITE, onWrite, &ctx);

   // Run through QBDI
   QBDI::rword ret;
   vm.call(&ret, ctr_addr, /* no argument */{});
   ...
}

QBDI::VMAction onWrite(QBDI::VMInstanceRef vm, QBDI::GPRState *gprState, QBDI::FPRState *fprState, void *raw_data) {
   context_t *data = reinterpret_cast<context_t*>(raw_data);
   std::vector<QBDI::MemoryAccess> mem_access = vm->getInstMemoryAccess();

   for (const QBDI::MemoryAccess& access: mem_access) {
      if (access.type == QBDI::MEMORY_WRITE and data->patch_range.contains(access.accessAddress)) {
         data->lib_lief->patch_address(
            access.accessAddress - data->libshell_base_addr,
            access.value,
            access.size);
      }
   }

   return QBDI::CONTINUE;
}

int main(int argc, char** argv) {
   ...
   // After run in QBDI, rewrite the library
   lib_lief->write("out.so");
   ...
}