qilingframework / qilingframework/qiling

Rust hello world crashes with UC_ERR_READ_UNMAPPED during UCRT startup on Windows x8664

Open
#1,627 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

Describe the bug
Running a minimal Rust Windows hello-world PE under Qiling on x8664_windows crashes during UCRT/CRT startup with UC_ERR_READ_UNMAPPED. The sample never reaches user code. Before the crash, Qiling reports several unimplemented Windows/UCRT APIs such as _initialize_narrow_environment, _initterm, _set_new_mode, FlsGetValue2, and IsThreadAFiber.

Sample Code

from qiling import Qiling

rootfs = r"qiling\examples\rootfs\x8664_windows"
ql = Qiling([rootfs + r"\bin\hello.exe"], rootfs)
ql.run()

Expected behavior
The Rust hello-world sample should start normally and print Hello, World!.

Screenshots
N/A

Additional context
Environment:

  • Qiling: 1.4.10
  • Python: 3.10
  • OS: Windows
  • Rootfs: x8664_windows

Observed crash:

  • unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)
  • Crash location: hello.exe + 0x3da9
  • Disassembly at crash:
    mov rax, qword ptr [rcx + rax*8]
    mov rdx, qword ptr [rax + 0x30]
  • At the crash point:
    rcx = 0x0
    rax = 0x0

Relevant logs before crash:

  • api _configthreadlocale (ucrtbase) is not implemented
  • api FlsGetValue2 (kernel32) is not implemented
  • api RestoreLastError (kernel32) is not implemented
  • api IsThreadAFiber (kernelbase) is not implemented
  • api _initialize_narrow_environment (ucrtbase) is not implemented
  • api _initterm (ucrtbase) is not implemented
  • api _set_new_mode (ucrtbase) is not implemented

This appears to be a Windows runtime startup compatibility issue for Rust binaries.

rust src

fn main() {
    println!("Hello, world!");
}

output.log

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the provided Qiling Python sample with the Rust hello.exe under the x8664_windows rootfs and reviewing output.log. Trace the UCRT/CRT startup from the listed unimplemented APIs to the read at hello.exe + 0x3da9. Done means the sample starts without UC_ERR_READ_UNMAPPED and prints “Hello, World!”.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, rust
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.