qilingframework / qilingframework/qiling
Emulate Golang compiled executables
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Description
Hi.
I was testing Qiling with a standard Hello World written in GO. There are several unimplemented APIs and every Go executables I've tested resulted in the same error. Sorry that I'm a newbie to Qiling and I don't know how to implement the APIs.
hello.go
package main
import "fmt"
func main() {
fmt.Println("Hello, World")
}
Compiled on Ubuntu 22.04 as Windows x86 and x86_64 executables,
$ go version
go version go1.19 linux/amd64
$ env GOOS=windows GOARCH=386 go build ./hello.go
$ env GOOS=windows GOARCH=amd64 go build -o hello_x64.exe ./hello.go
Qiling is the latest Dev branch on Python 3.10. I have manually copied mscoree.dll to rootfs.
In [1]: from qiling import *
In [2]: ql = Qiling(['/home/user/qiling/rootfs/x86_windows/bin/hello.exe'], '/home/user/qiling/rootfs/x86_windows/')
...
[!] api GlobalMemoryStatus (kernel32) is not implemented
[!] api GlobalMemoryStatusEx (kernelbase) is not implemented
[!] api RtlNtStatusToDosError (ntdll) is not implemented
[!] api RtlSetLastWin32Error (ntdll) is not implemented
[x] Error encountered while running mscoree.dll DllMain, bailing
[!] api _initialize_onexit_table (ucrtbase) is not implemented
...
In [3]: ql.run()
...
[x] eax : 0x0
...
[x] Hexdump:
[x] 8b 80 00 00 00 00 8b 40
[x] Disassembly:
[=] 00432232 [hello.exe + 0x032232] 8b 80 00 00 00 00 mov eax, dword ptr [eax]
...
[x] PC = 0x00432232 (/home/phil/qiling/rootfs/x86_windows/bin/hello.exe + 0x32232)
...
UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)
x86_64 targets are slightly different, but still crashed in the same way.
I have copied api-ms-win-*.dll to rootfs, but they are still not resolved.
In [4]: ql = Qiling(['/home/user/qiling/rootfs/x8664_windows/bin/hello.exe'], '/home/user/qiling/rootfs/x8664_windows/')
...
[!] api _CorImageUnloading (mscoree) is not implemented
[!] api _initialize_onexit_table (ucrtbase) is not implemented
...
In [5]: ql.run()
...
[=] Loading advapi32.dll ...
[=] Loading msvcrt.dll ...
[=] Done loading msvcrt.dll
[!] Failed to resolve api-ms-win-eventing-controller-l1-1-0.dll
[!] Failed to resolve api-ms-win-eventing-consumer-l1-1-0.dll
[!] Failed to resolve api-ms-win-eventing-consumer-l1-1-1.dll
[=] Loading sechost.dll ...
[=] Loading rpcrt4.dll ...
[=] Done loading rpcrt4.dll
[=] Done loading sechost.dll
[!] Failed to resolve api-ms-win-service-core-l1-1-0.dll
[!] Failed to resolve api-ms-win-service-core-l1-1-1.dll
[!] Failed to resolve api-ms-win-service-core-l1-1-2.dll
...
[!] api AddVectoredContinueHandler (kernel32) is not implemented
...
[x] rdi : 0x6000000
[x] rbp : 0x80000001cee0
[x] Hexdump:
[x] 65 63 74 6f 72 65 64 43
[x] Disassembly:
[=] 0000000180282e71 [kernel32.dll + 0x092e71] 65 63 74 6f 72 movsxd rsi, dword ptr gs:[rdi + rbp*2 + 0x72]
[x] 007ffffffde000 - 0080000001e000 rwx [stack]
...
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the supplied hello.go builds and the Qiling constructor followed by ql.run() for Windows x86 and x86_64. Start by examining the listed unresolved APIs, DLL-resolution failures, and crash traces; done means both compiled Hello World executables run without the reported unmapped-memory or equivalent crash.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, python
- Domain
- operating-systems, reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100