#include <stdlib.h>
#include <stdio.h>

int testfun(int, int);
int testfun1(int, int);
int testfun2(int, int);

int testfun1(int a, int b)
{
    printf("testfun1 print a %d b %d\n", a, b);
}

int testfun2(int a, int b)
{
    printf("testfun2 before call testfun in libtest a %d b %d\n", a, b);
    testfun(a, b);
}

int main()
{
    printf("in main before testfun1\n");
    testfun1(10, 15);
    printf("in main before testfun1\n");
}

#!/usr/bin/env python3

import argparse

from qiling import Qiling
from qiling.const import QL_VERBOSE, QL_INTERCEPT, QL_CALL_BLOCK

def partial_run(ql):
    print("main")
    ql.arch.regs.a0 = int(args.param1)
    ql.arch.regs.a1 = int(args.param2)
    ql.arch.regs.arch_pc = 0x400818 # testfun2 never called function

def hook_testfun(ql: Qiling):
    print(f'hook_testfun')
    return QL_CALL_BLOCK

if __name__ == "__main__":
    global args

    parser = argparse.ArgumentParser(description='test')
    parser.add_argument('param1', help='Arg1')
    parser.add_argument('param2', help='Arg2')
    args = parser.parse_args()

    ql = Qiling([r'./rootfs/bin/test'], r'./rootfs', verbose=QL_VERBOSE.OFF)

    print(f"elf entry {ql.loader.elf_entry:04X}")

    ql.hook_address(partial_run, 0x4008a0) # main
    ql.os.set_api('testfun', hook_testfun, QL_INTERCEPT.CALL)

    ql.run()