Windows Emulator goes wrong...
brutebee opened this issue · comments
When running code for Windows Dynamic analysis, seems the script is looking for the file to be present at '/Qu1cksc0pe-master/Systems/Windows/x86_windows' instead elsewhere. I then place the file in there and emulator still goes wrong. What shall be done?
python qu1cksc0pe.py --file malware.exe --watch
Error:
[x] 'malware.exe' is not in the subpath of '/home/linux/Desktop/Qu1cksc0pe-master/Systems/Windows/x86_windows' OR one path is relative and the other is absolute.
Traceback (most recent call last):
File "/home/linux/.local/lib/python3.9/site-packages/qiling/os/windows/windows.py", line 193, in hook_winapi
api_func(ql, address, api_name)
File "/home/linux/.local/lib/python3.9/site-packages/qiling/os/windows/fncc.py", line 26, in wrapper
return ql.os.call(pc, func, params, onenter, onexit, passthru=passthru)
File "/home/linux/.local/lib/python3.9/site-packages/qiling/os/os.py", line 187, in call
targs, retval, retaddr = self.fcall.call(func, proto, args, onenter, onexit, passthru)
File "/home/linux/.local/lib/python3.9/site-packages/qiling/os/fcall.py", line 159, in call
retval = func(ql, pc, params)
File "/home/linux/.local/lib/python3.9/site-packages/qiling/os/windows/dlls/kernel32/libloaderapi.py", line 110, in hook_GetModuleFileNameA
return __GetModuleFileName(ql, address, params, wide=False)
File "/home/linux/.local/lib/python3.9/site-packages/qiling/os/windows/dlls/kernel32/libloaderapi.py", line 88, in __GetModuleFileName
vpath = ql.os.path.host_to_virtual_path(hpath)
File "/home/linux/.local/lib/python3.9/site-packages/qiling/os/path.py", line 273, in host_to_virtual_path
virtpath = self._cwd_anchor / resolved.relative_to(self._rootfs_path)
File "/usr/lib/python3.9/pathlib.py", line 928, in relative_to
raise ValueError("{!r} is not in the subpath of {!r}"
ValueError: 'malware.exe' is not in the subpath of '/home/linux/Desktop/M-Analysis/Qu1cksc0pe-master/Systems/Windows/x86_windows' OR one path is relative and the other is absolute.
[!] An error occurred while performing x86 emulation.
Hmm did you entered absolute path of the file instead of using its name?
For example: /home/user/malware.exe
If your answer is yes what environment did you used? Docker, Venv or something?
By the way Qiling based dynamic analysis is unstable. It gave me lots of errors I'll need to take care of it
Yeah, Both absolute path and filename tried, I even place the file inside Windows Folde, the issue seems to be due to kernel in ParrotOS? what do you think?
I manually installed from source;
I'll look for how can i fix this issue. By the way If you want to help feel free to make a pull request :)
I'll definitely help on this one :) I am having a look at what the issue might be, ok?
Thank you very much for helping Qu1cksc0pe project :)