search

DissectMalware / pyOneNote

A python library to parse OneNote (.one) files
Apache License 2.0
123 stars 21 forks source link

Error- unpack requires a buffer of 16 bytes #12

Open milindsolage opened 1 year ago

milindsolage commented 1 year ago

Trying to execute this on a sample onenote file and it errors out. self.uintMagic, self.FileNodeListID, self.nFragmentSequence = struct.unpack('<8sII', file.read(16)) struct.error: unpack requires a buffer of 16 bytes

OS- Windows2019 with latest version of Python.

DissectMalware commented 1 year ago

Can you share the file with me? without the file I am not able to debug and see what the problem is.

If it is on VT or any other public repository you can just give me the sha256...

You can also DM me on Twitter if you do not want to share the details here

https://twitter.com/DissectMalware

milindsolage commented 1 year ago

1) This is not on VT, just a random onenote file. This was just a very large One note file with size ~134MB size. Has multiple word docs, ppts and other files embedded in it. Unfortunately, I cannot share this file. 2) Tried couple of other small one note files a) with word doc and excel embedded and it emitted the png screenshot and the actual doc and excel file in it. b) when there are no embedded files, it does not emit anything in output. 3) The output is always verbose. Consider adding /v flag to not output verbose. 4) Consider adding an output log file with json format to be able to parse the output programmatically. And add exit codes to determine success\error while unpacking.

DissectMalware commented 1 year ago

Make sense as I have not covered all filenode types. If the program cannot parse a filenode, it might result in jumping to a location in file that does not exist so read function returns zero bytes instead of 16 for example.

regarding other points, I will try to address them in next PR.

Matmaus commented 1 year ago

Hi, this sample is raising the same exception. Maybe it could help.

DissectMalware commented 1 year ago

Thank you for sharing the sample, will check soon