Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve handling of NSIS archives in debloat #55

Merged
merged 2 commits into from
Feb 6, 2024
Merged

Conversation

nazywam
Copy link
Member

@nazywam nazywam commented Feb 5, 2024

  • In some scenarios the directory containing some unpacked files can have the same name as the original executable
  • File containing the NSIS setup script can have various capitalizations
[2024-02-04 12:46:36,012][INFO] The files are being written to /tmp/tmpxv8g0wj6/Steup The Damned.exe
[2024-02-04 12:46:36,013][INFO] File: $PLUGINSDIR/StdUtils.dll
[2024-02-04 12:46:36,014][INFO] File: $PLUGINSDIR/System.dll
[2024-02-04 12:46:36,079][INFO] File: $PLUGINSDIR/app-64.7z
[2024-02-04 12:46:36,081][INFO] File: $PLUGINSDIR/nsis7z.dll
[2024-02-04 12:46:36,082][INFO] File: setup.nsis
[2024-02-04 12:46:36,082][INFO]
[2024-02-04 12:46:36,082][INFO] The user will need to determine which file is malicious if any.
[2024-02-04 12:46:36,083][INFO] If a file is bloated: resubmit it through the tool to debloat it.
[2024-02-04 12:46:36,083][INFO] Consider reviewing the 'setup.nsis' from the installer to determine how the files were meant to be used.
[2024-02-04 12:46:36,097][ERROR] Failed to process task - e25994f0-8a5e-45c0-9e25-9cb26ef97e2b
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/karton/core/karton.py", line 181, in internal_process
    self.process(self.current_task)
  File "/usr/local/lib/python3.10/site-packages/karton/archive_extractor/archive_extractor.py", line 179, in process
    debloated = self.debloat_pe(fname, contents)
  File "/usr/local/lib/python3.10/site-packages/karton/archive_extractor/archive_extractor.py", line 91, in debloat_pe
    return (f_name, unpacked_file.read_bytes())
  File "/usr/local/lib/python3.10/pathlib.py", line 1126, in read_bytes
    with self.open(mode='rb') as f:
  File "/usr/local/lib/python3.10/pathlib.py", line 1119, in open
    return self._accessor.open(self, mode, buffering, encoding, errors,
IsADirectoryError: [Errno 21] Is a directory: '/tmp/tmpxv8g0wj6/Steup The Damned.exe'

@nazywam nazywam requested a review from a team February 5, 2024 10:45
@nazywam nazywam merged commit a67bc4b into master Feb 6, 2024
5 checks passed
@nazywam nazywam deleted the bugfix/handle-nsis branch February 6, 2024 18:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants