qiling icon indicating copy to clipboard operation
qiling copied to clipboard

Wrong type sizes in qiling.os.windows.structs.WindowsStruct ???

Open crass opened this issue 3 years ago • 1 comments

I think the following type sizes are incorrect. But possibly they are correct for some version of windows (eg. 64-bit vs 32-bit), although I have a hard time believing both of the following are correct for any version of windows.

https://github.com/qilingframework/qiling/blob/4cae8b6cca92ec9423ba0d8e9a8bb814be2ace10/qiling/os/windows/structs.py#L1636

According to Microsoft docs, ULONG should be 4 bytes.

https://github.com/qilingframework/qiling/blob/4cae8b6cca92ec9423ba0d8e9a8bb814be2ace10/qiling/os/windows/structs.py#L1639

And here the docs suggest that int is 4 bytes also. I've read that int could be 2 bytes for 16-bit compilers, but who is running 16-bit windows (would that be pre-win95 windows?). This also contradicts the previous version of this code for ShellExecuteInfoA which has the member size, which is an int, at 4 bytes.

https://github.com/qilingframework/qiling/blob/c9e25f57938d6171fef0f29e3d49d33807e368e6/qiling/os/windows/structs.py#L840

Did this code ever work? I don't think we are testing ShellExecuteExA in any way.

crass avatar Aug 21 '21 04:08 crass

I am not too sure. Maybe a test need to be added to prove the code is wrong ?

xwings avatar Aug 31 '21 02:08 xwings

There is a code work for Windows module, will you be able to help to test it again ? Please feel free to open a new issue if needed.

xwings avatar Oct 06 '22 03:10 xwings