UnicodeDecodeError on BinaryParser
还没有人认领这个 Issue。
评估
调研方向
Start with Evtx/BinaryParser.py, especially unpack_wstring and explicit_length_handler, which the traceback identifies as the failing decode path. Check how callers handle malformed UTF-16 and whether a decoding fallback can preserve parsing results; the issue’s proposed fallback is a starting point. Done means a huge EVTX with an invalid surrogate can be parsed without aborting and produces usable results.
由索引模型根据 Issue 内容生成。
描述
Sometimes, when parsing huge EVTX I get this error
in xml_records for xml, record in evtx_file_xml_view(evtx.get_file_header()): File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 240, in evtx_file_xml_view record_str = evtx_record_xml_view(record) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 204, in evtx_record_xml_view return render_root_node(record.root()) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 191, in render_root_node return render_root_node_with_subs(root_node, subs) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 176, in render_root_node_with_subs rec(c, acc) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 126, in rec rec(child, acc) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 166, in rec sub = render_root_node(sub.root()) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 191, in render_root_node return render_root_node_with_subs(root_node, subs) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 176, in render_root_node_with_subs rec(c, acc) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 126, in rec rec(child, acc) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 126, in rec rec(child, acc) File "/usr/local/lib/python3.7/site-packages/Evtx/Views.py", line 159, in rec sub = escape_value(sub.string()) File "/usr/local/lib/python3.7/site-packages/Evtx/Nodes.py", line 1118, in string return self._string().rstrip("\x00") File "/usr/local/lib/python3.7/site-packages/Evtx/BinaryParser.py", line 211, in explicit_length_handler return f(offset, length) File "/usr/local/lib/python3.7/site-packages/Evtx/BinaryParser.py", line 490, in unpack_wstring return bytes(self._buf[start:end]).decode("utf16") UnicodeDecodeError: 'utf-16-le' codec can't decode bytes in position 104-105: illegal UTF-16 surrogate
I think that is a good point to try/except decode issues, and return a NULL or default 2byte. If not all processing time is wasted without no results.
- 主要语言
- Python
- 星标
- 785
- 派生
- 170
- 平均合并
- 2 天 21 小时
- 30 天内合并 PR
- 1
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
williballenthin/python-evtx 的其他 Issue
-
Infinite loop in ChunkHeader._load_strings / _load_templates on a crafted chunk (cyclic next_offset)可能已有人在做 @memx13 于 2 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
williballenthin/python-evtx#101 ·
-
难度 5/5 一周以上 新手友好度 25/100
-
难度 4/5 3-5 天 新手友好度 35/100
-
难度 2/5 1-3 小时 新手友好度 42/100
williballenthin/python-evtx#94 · 2 条评论 ·
-
bug
难度 4/5 3-5 天 新手友好度 35/100
williballenthin/python-evtx#85 · 2 条评论 ·
查看 williballenthin/python-evtx 的全部 Issue
相似的 Issue
-
The changelog workflow excludes otelbot but not dependabot, so every Dependabot pull request fails the changelog check可能已有人在做 @ocelotl 今天认领。 未关闭
难度 1/5 1 小时以内 新手友好度 82/100
open-telemetry/opentelemetry-python#5825 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
cuga-project/cuga-agent#1020 ·
维护者通常 2 天内回复
-
难度 1/5 1 小时以内 新手友好度 70/100
microsoft/playwright#43640 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
stac-utils/stac-fastapi-elasticsearch-opensearch#965 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复