search

NickstaDB / SerializationDumper

A tool to dump Java serialization streams in a more human readable form.
MIT License
994 stars 125 forks source link

Invalid content element type 0x12 #22

Closed mifritscher closed 2 years ago

mifritscher commented 2 years ago

I got a idev file from the "Statistisches Bundesamt" in Germany, the file command says "Java serialization data, version 5"

While trying to parse, the tool (using the 1.13 binary) says

STREAM_MAGIC - 0xac ed
STREAM_VERSION - 0x00 05
Contents
  TC_BLOCKDATA - 0x77
    Length - 48 - 0x30
    Contents - 0x0000019300000000000000<snip>
  Invalid content element type 0x12
Exception in thread "main" java.lang.RuntimeException: Error: Illegal content element type.
    at nb.deser.SerializationDumper.readContentElement(SerializationDumper.java:410)
    at nb.deser.SerializationDumper.parseStream(SerializationDumper.java:331)
    at nb.deser.SerializationDumper.main(SerializationDumper.java:113)

Sadly, I can't make the file public because it contains foreign confident data.

Any clues how to proceed? ;-)

P.S. also happens with current master.

NickstaDB commented 2 years ago

The file command is almost certainly just picking up on the 0xACED0005 signature at the beginning of the file.

The exception you're seeing is due to invalid/corrupt data in your input file. The Java Serialization format consists of a header (0xACED0005), followed by a series of content elements. The first byte of each content element indicates the type, for example 0x73 indicates an object (TC_OBJECT).

In your case, the program is reading a TC_BLOCKDATA content element (type 0x77), then attempting to read the next content element in the input file. It reads the byte 0x12, which is not a valid content element type, and cannot continue.

If you're able to provide a sample file, or you can demonstrate reading the unmodified file yourself with ObjectInputStream then please provide more detail. Otherwise, I can only conclude that your input is invalid or corrupt.