qilingframework/qiling

KeyError: 'kernel32'

1637848276 opened this issue · 2 comments

*Describe the bug
Problems with kernal32 were displayed after I ran MPRESS using qiling

Sample Code

def main():
    ql = qiling.Qiling([binary_path], rootfs_path, verbose=QL_VERBOSE.DEBUG)
    ql.run()

4d28ae128b1da30c5f65b6114c12ddd
cea2ed50b860d1d887f82e5a9e4b1a4
dd36b70ad959278966a3231b8dd9dfe

[+] 0x0000000180324d50: WideCharToMultiByte(CodePage = 0, dwFlags = 0, lpWideCharStr = 0x500005925, cchWideChar = 0x1, lpMultiByteStr = 0, cbMultiByte = 0, lpDefaultChar = 0, lpUsedDefaultChar = 0) = 0x1
[+] 0x0000000180721930: _malloc_base(size = 0x1) = 0x500001d1a
[+] 0x0000000180324d50: WideCharToMultiByte(CodePage = 0, dwFlags = 0, lpWideCharStr = 0x500005925, cchWideChar = 0x1, lpMultiByteStr = 0x500001d1a, cbMultiByte = 0x1, lpDefaultChar = 0, lpUsedDefaultChar = 0) = 0x1
[+] 0x0000000180723630: _free_base(address = 0)
[+] 0x000000018036bc10: FreeEnvironmentStringsW(penv = 0x500005925) = 0x1
[+] 0x0000000180723360: _calloc_base(num = 0x1, size = 0x8) = 0x500005927
[+] 0x0000000180723630: _free_base(address = 0)
[+] 0x0000000180723630: _free_base(address = 0)
[+] 0x0000000180723630: _free_base(address = 0x500001d1a)
[!] api _initialize_onexit_table (ucrtbase) is not implemented
[!] api _initialize_onexit_table (ucrtbase) is not implemented
[+] 0x000000018063c8b7: QueryPerformanceFrequency(lpFrequency = 0x80000001cf38) = 0x1
[+] 0x000000018063c87c: QueryPerformanceCounter(lpPerformanceCount = 0x80000001cf40) = 0x0
[+] 0x0000000180723360: _calloc_base(num = 0x200, size = 0x8) = 0x50000592f
[+] 0x0000000180723630: _free_base(address = 0)
[+] 0x00000001802402f0: InitializeCriticalSectionEx(lpCriticalSection = 0x18080f4d0, dwSpinCount = 0xfa0, Flags = 0) = 0x1
[+] 0x00000001802402f0: InitializeCriticalSectionEx(lpCriticalSection = 0x18080f528, dwSpinCount = 0xfa0, Flags = 0) = 0x1
[+] 0x00000001802402f0: InitializeCriticalSectionEx(lpCriticalSection = 0x18080f580, dwSpinCount = 0xfa0, Flags = 0) = 0x1
[=] Returned from ucrtbase.dll DllMain
[=] Done loading ucrtbase.dll
[+] Init imports for E:\b_project\qiling _new\qiling-master\qiling-master\examples\rootfs\x8664_windows\bin\x64_MPRESS2.19_vs2010_box.exe
[+] Requesting imports from kernel32
Traceback (most recent call last):
File "E:\b_project\qiling _new\qiling-master\qiling-master\tests\test_mypress2.py", line 12, in
main()
File "E:\b_project\qiling _new\qiling-master\qiling-master\tests\test_mypress2.py", line 8, in main
ql = qiling.Qiling([binary_path], rootfs_path, verbose=QL_VERBOSE.DEBUG)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "E:\b_project\qiling _new\qiling-master\qiling-master\qiling\core.py", line 190, in init
self.loader.run()
File "E:\b_project\qiling _new\qiling-master\qiling-master\qiling\loader\pe.py", line 725, in run
self.load(pe)
File "E:\b_project\qiling _new\qiling-master\qiling-master\qiling\loader\pe.py", line 808, in load
super().init_imports(pe, self.is_driver)
File "E:\b_project\qiling _new\qiling-master\qiling-master\qiling\loader\pe.py", line 542, in init_imports
iat = self.import_address_table[dll_name]
~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
KeyError: 'kernel32'

Managed to fix that by editing qiling/loader/pe.py:

                        iat = self.import_address_table[dll_name]

to

                    try:
                        iat = self.import_address_table[dll_name]
                    except KeyError:
                        iat = self.import_address_table[dll_name + ".dll"]