Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve b2s or replace with custom code (unneded wide strings support) #867

Open
mr-tz opened this issue Aug 28, 2023 · 2 comments · May be fixed by #885
Open

Improve b2s or replace with custom code (unneded wide strings support) #867

mr-tz opened this issue Aug 28, 2023 · 2 comments · May be fixed by #885
Labels
bug

Comments

@mr-tz
Copy link
Collaborator

mr-tz commented Aug 28, 2023 •
edited
Loading

binary2strings reads utf8 and wide strings (we don't expect or require the latter for Rust strings extraction).

In rust-hello64.exe we see
2023-08-28_15-09-13_ida64

Which parsed as wide string starting at offset 0x1400BD04F, b2s sees as:
2023-08-28_15-11-07_pycharm64

We then filter out the wide string and end up with args in the final Rust strings output.

Bumping the min_string length to 6 also mitigates this, but we could then miss shorter strings.
@mr-tz mr-tz added the bug label Aug 28, 2023
@Arker123
Copy link
Collaborator

So, should we work on implementing something similar to b2s using Python?

@mr-tz
Copy link
Collaborator Author

mr-tz commented Aug 29, 2023

Yes, currently we only require a function to find UTF-8 strings though.

@Arker123 Arker123 linked a pull request Sep 26, 2023 that will close this issue
Open
@mr-tz mr-tz mentioned this issue Nov 9, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Implement Custom UTF-8 Decoder Arker123/flare-floss
2 participants
@mr-tz @Arker123