qilingframework / qilingframework/qiling

Un-Imported DLL throwing an error

Open
#1,582 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

*Describe the bug
I'm trying to emulate a Windows sys driver http.sys from Windows Core 2019. I use dllcollector.bat to collect DLLs. Here is the error:

  File "C:\Users\User\Desktop\curiosity\http_driver_winserver_emufuzz\testQiling.py", line 32, in <module>
    ql = Qiling([DRIVER], ROOTFS,
                ostype=QL_OS.WINDOWS,
                verbose=QL_VERBOSE.DEFAULT)
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\core.py", line 190, in __init__
    self.loader.run()
    ~~~~~~~~~~~~~~~^^
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\loader\pe.py", line 725, in run
    self.load(pe)
    ~~~~~~~~~^^^^
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\loader\pe.py", line 808, in load
    super().init_imports(pe, self.is_driver)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\loader\pe.py", line 536, in init_imports
    dll_base = self.load_dll(entry.dll.decode(), is_driver)
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\loader\pe.py", line 250, in load_dll
    self.init_imports(dll, is_driver)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\loader\pe.py", line 536, in init_imports
    dll_base = self.load_dll(entry.dll.decode(), is_driver)
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\loader\pe.py", line 128, in load_dll
    dll_casefold_path = self.ql.os.path.host_casefold_path(dll_path)
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\os\path.py", line 363, in host_casefold_path
    return QlOsPath.__host_casefold_path(hostpath)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\site-packages\qiling\os\path.py", line 335, in __host_casefold_path
    for elem in p.relative_to(norm).parts:
                ~~~~~~~~~~~~~^^^^^^
  File "C:\Users\User\AppData\Local\Programs\Python\Python313\Lib\pathlib\_local.py", line 385, in relative_to
    raise ValueError(f"{str(self)!r} is not in the subpath of {str(other)!r}")
ValueError: 'C:\\Users\\User\\Desktop\\curiosity\\http_driver_winserver_emufuzz\\x8664+windowsIis\\x8664+windowsIis\\examples\\rootfs\\x8664_windows\\Windows\\System32\\ext-ms-win-ntos-tm-l1-1-0.dll' is not in the subpath of '.'

It complains ext-ms-win-ntos-tm-l1-1-0.dll is not there; however driver is not even importing mentioned DLL and it is not even in the system. I tried to get it from my own system but it is not there either. Is there a programmatic way to tell Qiling not to load some DLLs? Do I need to get every DLL it asks for from somewhere?

Sample Code

from qiling import Qiling
from qiling.const import QL_OS, QL_VERBOSE

ROOTFS  = "C:\\Users\\User\\Desktop\\curiosity\\http_driver_winserver_emufuzz\\x8664+windowsIis\\x8664+windowsIis\\examples\\rootfs\\x8664_windows"
DRIVER  = f"{ROOTFS}\\http_winserver.sys"


def _stub_success(ql, *args, **kwargs):
    # NTSTATUS STATUS_SUCCESS
    return 0

MISSING_KERNEL_APIS = [
    "KeBugCheckEx",              # bluescreen – just ignore
    "KeInitializeSpinLock",
    "KeAcquireSpinLockRaiseToDpc",
    "KeReleaseSpinLock",
    "IofCompleteRequest",
    # add more as the log complains
]

if __name__ == "__main__":
    ql = Qiling([DRIVER], ROOTFS,
                ostype=QL_OS.WINDOWS,
                verbose=QL_VERBOSE.DEFAULT)

    # register dummy implementations for the APIs Qiling doesn’t have yet
    for api in MISSING_KERNEL_APIS:
        ql.set_api(api, _stub_success)

    # locate exported DriverEntry
    drv_entry = ql.loader.find_export("DriverEntry")
    print(f"[+] DriverEntry found @ 0x{drv_entry:X}")

    # Fake arguments (DriverObject and RegistryPath) – both NULL
    ql.reg.rcx = 0
    ql.reg.rdx = 0

    # optional: stop as soon as we enter DriverEntry
    def _on_entry(ql):
        print("[+] Reached DriverEntry – emulation looks OK so far.")
        ql.emu_stop()
    ql.hook_address(_on_entry, drv_entry)

    # run a very small slice just to prove it starts
    ql.run(begin=drv_entry, timeout=10_000)  # 10 ms wall clock guard

Expected behavior
I don't know; couldn't go far yet

Screenshots
Driver not importing this dll:
Image

Additional context
None

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the sample with Python 3.13 and the Windows rootfs, then inspect qiling/loader/pe.py around load_dll/init_imports and qiling/os/path.py around host_casefold_path. Trace why ext-ms-win-ntos-tm-l1-1-0.dll is requested and how missing imports are intended to be handled. Done means the reported failure has a verified resolution or a clearly documented limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.