Skip to content

Rust hello world crashes with UC_ERR_READ_UNMAPPED during UCRT startup on Windows x8664 #1627

Open

Description

@Synex93

Describe the bug
Running a minimal Rust Windows hello-world PE under Qiling on x8664_windows crashes during UCRT/CRT startup with UC_ERR_READ_UNMAPPED. The sample never reaches user code. Before the crash, Qiling reports several unimplemented Windows/UCRT APIs such as _initialize_narrow_environment, _initterm, _set_new_mode, FlsGetValue2, and IsThreadAFiber.

Sample Code

from qiling import Qiling

rootfs = r"qiling\examples\rootfs\x8664_windows"
ql = Qiling([rootfs + r"\bin\hello.exe"], rootfs)
ql.run()

Expected behavior
The Rust hello-world sample should start normally and print Hello, World!.

Screenshots
N/A

Additional context
Environment:

  • Qiling: 1.4.10
  • Python: 3.10
  • OS: Windows
  • Rootfs: x8664_windows

Observed crash:

  • unicorn.unicorn_py3.unicorn.UcError: Invalid memory read (UC_ERR_READ_UNMAPPED)
  • Crash location: hello.exe + 0x3da9
  • Disassembly at crash:
    mov rax, qword ptr [rcx + rax*8]
    mov rdx, qword ptr [rax + 0x30]
  • At the crash point:
    rcx = 0x0
    rax = 0x0

Relevant logs before crash:

  • api _configthreadlocale (ucrtbase) is not implemented
  • api FlsGetValue2 (kernel32) is not implemented
  • api RestoreLastError (kernel32) is not implemented
  • api IsThreadAFiber (kernelbase) is not implemented
  • api _initialize_narrow_environment (ucrtbase) is not implemented
  • api _initterm (ucrtbase) is not implemented
  • api _set_new_mode (ucrtbase) is not implemented

This appears to be a Windows runtime startup compatibility issue for Rust binaries.

rust src

fn main() {
    println!("Hello, world!");
}

output.log

Activity

  1. JFarAur commented on Oct 9, 2026

    @JFarAur
    Contributor

    I was able to replicate the issue using the latest Qiling dev branch, and the default Rust Hello World project compiled with latest stable Rust.

    The "not implemented" warnings are not necessarily indicative of the problem, this simply means that Qiling lacks hooks for those functions, and the native implementations of those functions are allowed to run. The native functions may or may not be working correctly. Most of the time they are, so this is not always a concern.

    I did a bit of debugging and the issue is related to Qiling's emulation of TLS on Windows. The Rust runtime init attempts to look up TLS entries via the TLS directory pointer in the TEB. However Qiling makes the assumption that programs will access the TLS via the winapi functions such as TlsSetValue and TlsGetValue. Qiling does not initialize the TLS directory pointer in the TEB, so the pointer the program retrieves from the TEB is null, causing the program to crash.

    I am doing some work on it currently, I will put up a PR if I manage to fix it.

  2. JFarAur commented on Oct 16, 2026

    @JFarAur
    Contributor

    Issue is addressed in this PR: #1670

    Just awaiting review and revision.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions