qilingframework / qilingframework/qiling
Rust hello world crashes with UC_ERR_READ_UNMAPPED during UCRT startup on Windows x8664
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Description
Describe the bug
Running a minimal Rust Windows hello-world PE under Qiling on x8664_windows crashes during UCRT/CRT startup with UC_ERR_READ_UNMAPPED. The sample never reaches user code. Before the crash, Qiling reports several unimplemented Windows/UCRT APIs such as _initialize_narrow_environment, _initterm, _set_new_mode, FlsGetValue2, and IsThreadAFiber.
Sample Code
from qiling import Qiling
rootfs = r"qiling\examples\rootfs\x8664_windows"
ql = Qiling([rootfs + r"\bin\hello.exe"], rootfs)
ql.run()
Expected behavior
The Rust hello-world sample should start normally and print Hello, World!.
Screenshots
N/A
Additional context
Environment:
- Qiling: 1.4.10
- Python: 3.10
- OS: Windows
- Rootfs:
x8664_windows
Observed crash:
unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)- Crash location:
hello.exe + 0x3da9 - Disassembly at crash:
mov rax, qword ptr [rcx + rax*8]
mov rdx, qword ptr [rax + 0x30] - At the crash point:
rcx = 0x0
rax = 0x0
Relevant logs before crash:
api _configthreadlocale (ucrtbase) is not implementedapi FlsGetValue2 (kernel32) is not implementedapi RestoreLastError (kernel32) is not implementedapi IsThreadAFiber (kernelbase) is not implementedapi _initialize_narrow_environment (ucrtbase) is not implementedapi _initterm (ucrtbase) is not implementedapi _set_new_mode (ucrtbase) is not implemented
This appears to be a Windows runtime startup compatibility issue for Rust binaries.
rust src
fn main() {
println!("Hello, world!");
}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the provided Qiling Python sample with the Rust hello.exe under the x8664_windows rootfs and reviewing output.log. Trace the UCRT/CRT startup from the listed unimplemented APIs to the read at hello.exe + 0x3da9. Done means the sample starts without UC_ERR_READ_UNMAPPED and prints “Hello, World!”.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, rust
- Domain
- operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100