Skip to content

Rust hello world crashes with UC_ERR_READ_UNMAPPED during UCRT startup on Windows x8664 #1627

@Synex93

Description

@Synex93

Describe the bug
Running a minimal Rust Windows hello-world PE under Qiling on x8664_windows crashes during UCRT/CRT startup with UC_ERR_READ_UNMAPPED. The sample never reaches user code. Before the crash, Qiling reports several unimplemented Windows/UCRT APIs such as _initialize_narrow_environment, _initterm, _set_new_mode, FlsGetValue2, and IsThreadAFiber.

Sample Code

from qiling import Qiling

rootfs = r"qiling\examples\rootfs\x8664_windows"
ql = Qiling([rootfs + r"\bin\hello.exe"], rootfs)
ql.run()

Expected behavior
The Rust hello-world sample should start normally and print Hello, World!.

Screenshots
N/A

Additional context
Environment:

  • Qiling: 1.4.10
  • Python: 3.10
  • OS: Windows
  • Rootfs: x8664_windows

Observed crash:

  • unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)
  • Crash location: hello.exe + 0x3da9
  • Disassembly at crash:
    mov rax, qword ptr [rcx + rax*8]
    mov rdx, qword ptr [rax + 0x30]
  • At the crash point:
    rcx = 0x0
    rax = 0x0

Relevant logs before crash:

  • api _configthreadlocale (ucrtbase) is not implemented
  • api FlsGetValue2 (kernel32) is not implemented
  • api RestoreLastError (kernel32) is not implemented
  • api IsThreadAFiber (kernelbase) is not implemented
  • api _initialize_narrow_environment (ucrtbase) is not implemented
  • api _initterm (ucrtbase) is not implemented
  • api _set_new_mode (ucrtbase) is not implemented

This appears to be a Windows runtime startup compatibility issue for Rust binaries.

rust src

fn main() {
    println!("Hello, world!");
}

output.log

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions