Rust hello world crashes with UC_ERR_READ_UNMAPPED during UCRT startup on Windows x8664

Open
#1,627 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
python, rust
Domain
operating-systems, reverse-engineering

Research direction

Start by running the provided Qiling Python sample with the Rust hello.exe under the x8664_windows rootfs and reviewing output.log. Trace the UCRT/CRT startup from the listed unimplemented APIs to the read at hello.exe + 0x3da9. Done means the sample starts without UC_ERR_READ_UNMAPPED and prints “Hello, World!”.

Written by the indexing model from the issue text.

Description

Describe the bug
Running a minimal Rust Windows hello-world PE under Qiling on x8664_windows crashes during UCRT/CRT startup with UC_ERR_READ_UNMAPPED. The sample never reaches user code. Before the crash, Qiling reports several unimplemented Windows/UCRT APIs such as _initialize_narrow_environment, _initterm, _set_new_mode, FlsGetValue2, and IsThreadAFiber.

Sample Code

from qiling import Qiling

rootfs = r"qiling\examples\rootfs\x8664_windows"
ql = Qiling([rootfs + r"\bin\hello.exe"], rootfs)
ql.run()

Expected behavior
The Rust hello-world sample should start normally and print Hello, World!.

Screenshots
N/A

Additional context
Environment:

  • Qiling: 1.4.10
  • Python: 3.10
  • OS: Windows
  • Rootfs: x8664_windows

Observed crash:

  • unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)
  • Crash location: hello.exe + 0x3da9
  • Disassembly at crash:
    mov rax, qword ptr [rcx + rax*8]
    mov rdx, qword ptr [rax + 0x30]
  • At the crash point:
    rcx = 0x0
    rax = 0x0

Relevant logs before crash:

  • api _configthreadlocale (ucrtbase) is not implemented
  • api FlsGetValue2 (kernel32) is not implemented
  • api RestoreLastError (kernel32) is not implemented
  • api IsThreadAFiber (kernelbase) is not implemented
  • api _initialize_narrow_environment (ucrtbase) is not implemented
  • api _initterm (ucrtbase) is not implemented
  • api _set_new_mode (ucrtbase) is not implemented

This appears to be a Windows runtime startup compatibility issue for Rust binaries.

rust src

fn main() {
    println!("Hello, world!");
}

output.log

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from qilingframework/qiling

All issues in qilingframework/qiling

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.