Describe the bug
Running a minimal Rust Windows hello-world PE under Qiling on x8664_windows crashes during UCRT/CRT startup with UC_ERR_READ_UNMAPPED. The sample never reaches user code. Before the crash, Qiling reports several unimplemented Windows/UCRT APIs such as _initialize_narrow_environment, _initterm, _set_new_mode, FlsGetValue2, and IsThreadAFiber.
Sample Code
from qiling import Qiling
rootfs = r"qiling\examples\rootfs\x8664_windows"
ql = Qiling([rootfs + r"\bin\hello.exe"], rootfs)
ql.run()
Expected behavior
The Rust hello-world sample should start normally and print Hello, World!.
Screenshots
N/A
Additional context
Environment:
- Qiling: 1.4.10
- Python: 3.10
- OS: Windows
- Rootfs:
x8664_windows
Observed crash:
unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)
- Crash location:
hello.exe + 0x3da9
- Disassembly at crash:
mov rax, qword ptr [rcx + rax*8]
mov rdx, qword ptr [rax + 0x30]
- At the crash point:
rcx = 0x0
rax = 0x0
Relevant logs before crash:
api _configthreadlocale (ucrtbase) is not implemented
api FlsGetValue2 (kernel32) is not implemented
api RestoreLastError (kernel32) is not implemented
api IsThreadAFiber (kernelbase) is not implemented
api _initialize_narrow_environment (ucrtbase) is not implemented
api _initterm (ucrtbase) is not implemented
api _set_new_mode (ucrtbase) is not implemented
This appears to be a Windows runtime startup compatibility issue for Rust binaries.
rust src
fn main() {
println!("Hello, world!");
}
output.log
Describe the bug
Running a minimal Rust Windows hello-world PE under Qiling on
x8664_windowscrashes during UCRT/CRT startup withUC_ERR_READ_UNMAPPED. The sample never reaches user code. Before the crash, Qiling reports several unimplemented Windows/UCRT APIs such as_initialize_narrow_environment,_initterm,_set_new_mode,FlsGetValue2, andIsThreadAFiber.Sample Code
Expected behavior
The Rust hello-world sample should start normally and print
Hello, World!.Screenshots
N/A
Additional context
Environment:
x8664_windowsObserved crash:
unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)hello.exe + 0x3da9mov rax, qword ptr [rcx + rax*8]mov rdx, qword ptr [rax + 0x30]rcx = 0x0rax = 0x0Relevant logs before crash:
api _configthreadlocale (ucrtbase) is not implementedapi FlsGetValue2 (kernel32) is not implementedapi RestoreLastError (kernel32) is not implementedapi IsThreadAFiber (kernelbase) is not implementedapi _initialize_narrow_environment (ucrtbase) is not implementedapi _initterm (ucrtbase) is not implementedapi _set_new_mode (ucrtbase) is not implementedThis appears to be a Windows runtime startup compatibility issue for Rust binaries.
rust src
output.log