qilingframework / qiling

A True Instrumentable Binary Emulation Framework
https://qiling.io
GNU General Public License v2.0
5.14k stars 744 forks source link

Error raised when emulating Windows EXE on a Linux machine. #699

Closed andreia-oca closed 3 years ago

andreia-oca commented 3 years ago

Describe the bug I am trying to run the demo code from the documentation regarding emulating an Windows EXE on a Linux machine and it is raising QlErrorFileNotFound.

Sample Code

from qiling import *

def my_sandbox(path, rootfs):
    ql = Qiling(path, rootfs)
    ql.run()

if __name__ == "__main__":
    my_sandbox(["rootfs/x86_windows/bin/x86_hello.exe"], "rootfs/x86_windows")

The output received

Traceback (most recent call last):
  File "my_hello_windows.py", line 12, in <module>
    my_sandbox(["rootfs/x86_windows/bin/x86_hello.exe"], "rootfs/x86_windows")
  File "my_hello_windows.py", line 6, in my_sandbox
    ql = Qiling(path, rootfs)
  File "/home/andreia/.local/lib/python3.8/site-packages/qiling/core.py", line 215, in __init__
    self.loader.run()
  File "/home/andreia/.local/lib/python3.8/site-packages/qiling/loader/pe.py", line 437, in run
    self.ql.os.setupComponents()
  File "/home/andreia/.local/lib/python3.8/site-packages/qiling/os/windows/windows.py", line 67, in setupComponents
    self.registry_manager = RegistryManager(self.ql)
  File "/home/andreia/.local/lib/python3.8/site-packages/qiling/os/windows/registry.py", line 44, in __init__
    raise QlErrorFileNotFound(f"Error: Registry files not found in '{self.hive}'!")
qiling.exception.QlErrorFileNotFound: Error: Registry files not found in 'rootfs/x86_windows/Windows/registry'!

I looked under rootfs/x86_windows and there I have only bin folder. I am not able to find Windows/registry anywhere on the repo.

I have the same behaviour on all the scripts related to windows from examples.

Just a couple of mentions:

Do you have any advice?

xwings commented 3 years ago

https://docs.qiling.io/en/latest/install/#important-note-on-windows-dlls-and-registry