Skip to content

Error- unpack requires a buffer of 16 bytes #12

Open
Open
Error- unpack requires a buffer of 16 bytes#12
Assignees
DissectMalware

Description

@milindsolage
milindsolage
opened on Feb 22, 2023

Trying to execute this on a sample onenote file and it errors out.
self.uintMagic, self.FileNodeListID, self.nFragmentSequence = struct.unpack('<8sII', file.read(16))
struct.error: unpack requires a buffer of 16 bytes

OS- Windows2019 with latest version of Python.

Activity

  1. DissectMalware commented on Feb 22, 2023

    @DissectMalware
    DissectMalware
    on Feb 22, 2023
    Owner

    Can you share the file with me? without the file I am not able to debug and see what the problem is.

    If it is on VT or any other public repository you can just give me the sha256...

    You can also DM me on Twitter if you do not want to share the details here

    https://twitter.com/DissectMalware

  2. DissectMalware
    self-assigned this
    on Feb 22, 2023

  3. milindsolage commented on Feb 23, 2023

    @milindsolage
    milindsolage
    on Feb 23, 2023
    Author
    1. This is not on VT, just a random onenote file. This was just a very large One note file with size ~134MB size. Has multiple word docs, ppts and other files embedded in it. Unfortunately, I cannot share this file.
    2. Tried couple of other small one note files a) with word doc and excel embedded and it emitted the png screenshot and the actual doc and excel file in it. b) when there are no embedded files, it does not emit anything in output.
    3. The output is always verbose. Consider adding /v flag to not output verbose.
    4. Consider adding an output log file with json format to be able to parse the output programmatically. And add exit codes to determine success\error while unpacking.

  4. DissectMalware commented on Feb 25, 2023

    @DissectMalware
    DissectMalware
    on Feb 25, 2023
    Owner

    Make sense as I have not covered all filenode types. If the program cannot parse a filenode, it might result in jumping to a location in file that does not exist so read function returns zero bytes instead of 16 for example.

    regarding other points, I will try to address them in next PR.

  5. Matmaus commented on Mar 13, 2023

    @Matmaus
    Matmaus
    on Mar 13, 2023

    Hi, this sample is raising the same exception. Maybe it could help.

  6. DissectMalware commented on Mar 14, 2023

    @DissectMalware
    DissectMalware
    on Mar 14, 2023
    Owner

    Thank you for sharing the sample, will check soon

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions