qiling
qiling copied to clipboard
LoadLibraryEx Error
*Describe the bug hook_LoadLibraryExA failed
Error Report
SetErrorMode(uMode = 0x8001) = 0x0 GetVersion() = 0x40004 GetModuleHandleA(lpModuleName = "KERNEL32") = 0x10551000 GetProcAddress(hModule = 0x10551000, lpProcName = "SetDefaultDllDirectories") = 0x106110d8 SetDefaultDllDirectories(DirectoryFlags = 0xc00) GetSystemDirectoryA(lpBuffer = 0xffffcd44, uSize = 0x104) = 0x14 wsprintfA(format = '%s%s.dll', "", "verifying installer: %d%%") = 0x1e \verifying installer: %d%%.dllwsprintfA() = 0x1e
[!] LoadLibraryExA Exception Found
Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/qiling/os/windows/windows.py", line 111, in hook_winapi winapi_func(self.ql, address, {}) File "/usr/local/lib/python3.6/site-packages/qiling/os/windows/fncc.py", line 90, in wrapper return ql.os.x86_stdcall(param_num, params, func, args, kwargs, passthru) File "/usr/local/lib/python3.6/site-packages/qiling/os/os.py", line 300, in x86_stdcall result, param_num = self.__x86_cc(param_num, params, func, args, kwargs) File "/usr/local/lib/python3.6/site-packages/qiling/os/os.py", line 266, in __x86_cc result = func(*args, **kwargs) File "/usr/local/lib/python3.6/site-packages/qiling/os/windows/dlls/kernel32/libloaderapi.py", line 179, in hook_LoadLibraryExA dll_base = ql.loader.load_dll(lpLibFileName.encode()) File "/usr/local/lib/python3.6/site-packages/qiling/loader/pe.py", line 48, in load_dll raise QlErrorFileNotFound("[!] Cannot find dll in %s" % path) qiling.exception.QlErrorFileNotFound: [!] Cannot find dll in /qiling/examples/rootfs/x86_windows//Windows/System32
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "test.py", line 5, in
Have you need to setup the dll and register?
https://docs.qiling.io/en/latest/install/#important-note-on-windows-dlls-and-registry
I have copied the entire Windows 7 32bit system folder that is actually used.
debug ->
??... loadlibraryEX parameter C:\Windows\System32\ is displayed expection : C:\Windows\System32\UXTHEME.dll
Can't load dll name in wsprintf function check memory operation function.
TEST MD5 : 6bf409ca842d7b129ae573d3d95c091e
This should be solved with the latest version of Qiling.