qilingframework / qilingframework/qiling

The exe compiled with VS2019 cannot be emulated.

Open
#1,486 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

*Describe the bug
The exe compiled with VS2019 cannot be emulated.

Sample Code

from qiling import Qiling
from qiling.extensions import trace
ql = Qiling(["../examples/rootfs/x86_windows/bin/2.cm1.exe"],"../examples/rootfs/x86_windows")# ../examples/rootfs/x86_windows
trace.enable_full_trace(ql)
ql.run()

Expected behavior

[x]     Error encountered while running bcrypt.dll DllMain, bailing
[!]     Failed to resolve api-ms-win-service-core-l1-1-0.dll
[!]     Failed to resolve api-ms-win-service-core-l1-1-1.dll
[!]     Failed to resolve api-ms-win-service-core-l1-1-2.dll
[!]     Failed to resolve api-ms-win-service-management-l1-1-0.dll
[!]     Failed to resolve api-ms-win-service-management-l2-1-0.dll
[!]     Failed to resolve api-ms-win-service-private-l1-1-4.dll
[!]     Failed to resolve api-ms-win-service-private-l1-1-2.dll
[!]     Failed to resolve api-ms-win-service-private-l1-1-3.dll
[!]     Failed to resolve api-ms-win-service-private-l1-1-0.dll
[!]     Failed to resolve api-ms-win-service-winsvc-l1-1-0.dll
[!]     Failed to resolve api-ms-win-security-audit-l1-1-1.dll
[!]     Failed to resolve api-ms-win-security-audit-l1-1-0.dll

cm2022.zip

Screenshots
image
image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the report with the Python sample using examples/rootfs/x86_windows/bin/2.cm1.exe and the x86_windows rootfs, with full tracing enabled. Investigate the emulator's handling of the VS2019-built executable and its Windows DLL dependencies; done means the sample runs without the reported bcrypt.dll failure and unresolved api-ms-win errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.