examples/shellcode_run.py: skip the Windows stages when system DLLs are absent - #1630
examples/shellcode_run.py: skip the Windows stages when system DLLs are absent#1630retrocpugeek wants to merge 1 commit into
Conversation
|
Hey, Welcome to QIling Framework and thanks for the PR. PR looks good to me. Lets wait for second approval |
Hi, thanks for the welcome. Love the project. |
|
Hi, Welcome to QIling Framework. Except the ql.stop(), it would be better if we split into two differnt PR for two differnt code. |
The Windows shellcode stages need genuine Windows system DLLs, which are not redistributable and so are not shipped with Qiling; they must be collected from a licensed Windows host via examples/scripts/dllscollector.bat. Without them the loader failed to map ntdll.dll and the example crashed with an unhandled UC_ERR_READ_UNMAPPED traceback. Probe for ntdll.dll under each Windows rootfs and skip those stages with a message pointing at the collector script, so the example runs to completion on a stock checkout. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
47f1376 to
d55f91c
Compare
retrocpugeek
changed the title
|
Ok, using this PR for the 'skip if windows DLLs absent' part |
|
Hi, This PR seems like makes no different. if the rootfs does not exits. it will not run anyway. |
|
I think we're talking about two different cases here There's A/ rootfs directory absent user will get B/ rootfs directory present, but no Windows/System32/*.dll user will get |
2 participants
Split as requested — this PR is now only the
examples/shellcode_run.pychange. The framework-side illegal-instruction handling moved to #1661.shellcode_run.pyruns a Windows x86 and x86-64 stage that need genuine Windows system DLLs. Those cannot be redistributed, so they are not shipped with Qiling and must be collected from a licensed Windows host withexamples/scripts/dllscollector.bat.Without them the example does not fail gracefully — it crashes on an unmapped read partway through. This probes for
Windows/System32/ntdll.dllunder each Windows rootfs and, when it is missing, prints a message pointing at the collector script instead of running that stage.