qilingframework / qilingframework/qiling

Emulate Golang compiled executables

Open
#1,202 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

Hi.
I was testing Qiling with a standard Hello World written in GO. There are several unimplemented APIs and every Go executables I've tested resulted in the same error. Sorry that I'm a newbie to Qiling and I don't know how to implement the APIs.

hello.go

package main

import "fmt"

func main() {
    fmt.Println("Hello, World")
}

Compiled on Ubuntu 22.04 as Windows x86 and x86_64 executables,

$ go version
go version go1.19 linux/amd64
$ env GOOS=windows GOARCH=386 go build ./hello.go 
$ env GOOS=windows GOARCH=amd64 go build -o hello_x64.exe ./hello.go 

Qiling is the latest Dev branch on Python 3.10. I have manually copied mscoree.dll to rootfs.

In [1]: from qiling import *
In [2]: ql = Qiling(['/home/user/qiling/rootfs/x86_windows/bin/hello.exe'], '/home/user/qiling/rootfs/x86_windows/')
...
[!] 	api GlobalMemoryStatus (kernel32) is not implemented
[!] 	api GlobalMemoryStatusEx (kernelbase) is not implemented
[!] 	api RtlNtStatusToDosError (ntdll) is not implemented
[!] 	api RtlSetLastWin32Error (ntdll) is not implemented
[x] 	Error encountered while running mscoree.dll DllMain, bailing
[!] 	api _initialize_onexit_table (ucrtbase) is not implemented
...
In [3]: ql.run()
...
[x] 	eax	: 0x0
...
[x] 	Hexdump:
[x] 	8b 80 00 00 00 00 8b 40
[x] 	Disassembly:
[=] 	00432232 [hello.exe            + 0x032232]  8b 80 00 00 00 00    mov                  eax, dword ptr [eax]
...
[x] 	PC = 0x00432232 (/home/phil/qiling/rootfs/x86_windows/bin/hello.exe + 0x32232)
...
UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)

x86_64 targets are slightly different, but still crashed in the same way.
I have copied api-ms-win-*.dll to rootfs, but they are still not resolved.

In [4]: ql = Qiling(['/home/user/qiling/rootfs/x8664_windows/bin/hello.exe'], '/home/user/qiling/rootfs/x8664_windows/')
...
[!] 	api _CorImageUnloading (mscoree) is not implemented
[!] 	api _initialize_onexit_table (ucrtbase) is not implemented
...
In [5]: ql.run()
...
[=] 	Loading advapi32.dll ...
[=] 	Loading msvcrt.dll ...
[=] 	Done loading msvcrt.dll
[!] 	Failed to resolve api-ms-win-eventing-controller-l1-1-0.dll
[!] 	Failed to resolve api-ms-win-eventing-consumer-l1-1-0.dll
[!] 	Failed to resolve api-ms-win-eventing-consumer-l1-1-1.dll
[=] 	Loading sechost.dll ...
[=] 	Loading rpcrt4.dll ...
[=] 	Done loading rpcrt4.dll
[=] 	Done loading sechost.dll
[!] 	Failed to resolve api-ms-win-service-core-l1-1-0.dll
[!] 	Failed to resolve api-ms-win-service-core-l1-1-1.dll
[!] 	Failed to resolve api-ms-win-service-core-l1-1-2.dll
...
[!] 	api AddVectoredContinueHandler (kernel32) is not implemented
...
[x] 	rdi	: 0x6000000
[x] 	rbp	: 0x80000001cee0
[x] 	Hexdump:
[x] 	65 63 74 6f 72 65 64 43
[x] 	Disassembly:
[=] 	0000000180282e71 [kernel32.dll         + 0x092e71]  65 63 74 6f 72       movsxd               rsi, dword ptr gs:[rdi + rbp*2 + 0x72]
[x] 	007ffffffde000 - 0080000001e000   rwx     [stack]          
...

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the supplied hello.go builds and the Qiling constructor followed by ql.run() for Windows x86 and x86_64. Start by examining the listed unresolved APIs, DLL-resolution failures, and crash traces; done means both compiled Hello World executables run without the reported unmapped-memory or equivalent crash.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, python
Domain
operating-systems, reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.