From ce6f08d71f6e41a0a3ff4377a3cc08db6fff9579 Mon Sep 17 00:00:00 2001 From: H1ghC0ntr4sT Date: Thu, 2 Jul 2026 22:51:45 +0700 Subject: [PATCH] Reset emu state after a failing DllMain call_dll_entrypoint() caught the DllMain UcError and restored registers but left ql._state at STARTED, since emu_start() only clears it on success. The 'emu_state is not STARTED' gate then silently skipped DllMain for every DLL loaded afterward. Reset the state to STOPPED on the exception path. --- qiling/loader/pe.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/qiling/loader/pe.py b/qiling/loader/pe.py index 30959d0f8..f9ac1bb65 100644 --- a/qiling/loader/pe.py +++ b/qiling/loader/pe.py @@ -462,6 +462,10 @@ def call_dll_entrypoint(self, dll: pefile.PE, dll_base: int, dll_len: int, dll_n self.ql.log.error(f'Error encountered while running {dll_name} DllMain, bailing') self.ql.arch.regs.restore(regs_state) + + # emu_start leaves the state at STARTED when it raises; reset it so a single + # failing DllMain does not gate every subsequently loaded DLL's entry point. + self.ql._state = QL_STATE.STOPPED else: fcall.cc.unwind(len(args))