Skip to content

Rust hello world crashes with UC_ERR_READ_UNMAPPED during UCRT startup on Windows x8664 #1627

Description

@Synex93

Describe the bug
Running a minimal Rust Windows hello-world PE under Qiling on x8664_windows crashes during UCRT/CRT startup with UC_ERR_READ_UNMAPPED. The sample never reaches user code. Before the crash, Qiling reports several unimplemented Windows/UCRT APIs such as _initialize_narrow_environment, _initterm, _set_new_mode, FlsGetValue2, and IsThreadAFiber.

Sample Code

from qiling import Qiling

rootfs = r"qiling\examples\rootfs\x8664_windows"
ql = Qiling([rootfs + r"\bin\hello.exe"], rootfs)
ql.run()

Expected behavior
The Rust hello-world sample should start normally and print Hello, World!.

Screenshots
N/A

Additional context
Environment:

  • Qiling: 1.4.10
  • Python: 3.10
  • OS: Windows
  • Rootfs: x8664_windows

Observed crash:

  • unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)
  • Crash location: hello.exe + 0x3da9
  • Disassembly at crash:
    mov rax, qword ptr [rcx + rax*8]
    mov rdx, qword ptr [rax + 0x30]
  • At the crash point:
    rcx = 0x0
    rax = 0x0

Relevant logs before crash:

  • api _configthreadlocale (ucrtbase) is not implemented
  • api FlsGetValue2 (kernel32) is not implemented
  • api RestoreLastError (kernel32) is not implemented
  • api IsThreadAFiber (kernelbase) is not implemented
  • api _initialize_narrow_environment (ucrtbase) is not implemented
  • api _initterm (ucrtbase) is not implemented
  • api _set_new_mode (ucrtbase) is not implemented

This appears to be a Windows runtime startup compatibility issue for Rust binaries.

rust src

fn main() {
    println!("Hello, world!");
}

output.log

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions