Duplicate item extracted during NSIS parsing

[gdesmar]

Came across this rare exception and thought you may be interested: Using debloat 1.5.6.5, I get a ValueError when debloating/parsing 39d17f33b47863330d407ea0e4b2fe7b676c3708dd00ae65432ad21a1ceef997

>>> import debloat.processor
>>> import pefile
>>> import os
>>> file_path = "39d17f33b47863330d407ea0e4b2fe7b676c3708dd00ae65432ad21a1ceef997"
>>> binary = pefile.PE(file_path, fast_load=True)
>>> file_size = os.path.getsize(file_path)
>>> debloat.processor.process_pe(binary, out_path="out", last_ditch_processing=False, cert_preservation=True, log_message=print, beginning_file_size=file_size)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File ".../debloat/processor.py", line 523, in process_pe
    nsis_extracted = check_and_extract_NSIS(possible_header, pe)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../debloat/processor.py", line 114, in check_and_extract_NSIS
    extracted_files = extractor.unpack(memoryview(pe.__data__))
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../debloat/utilities/nsisParser.py", line 1312, in unpack
    raise _error
  File ".../debloat/utilities/nsisParser.py", line 1314, in unpack
    archive = NSArchive(memory[offset:])
              ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../debloat/utilities/readers.py", line 575, in wrapped__init__
    original__init__(self, reader, *args, **kwargs)
  File ".../debloat/utilities/nsisParser.py", line 1150, in __init__
    self.header = NSHeader(header_data, size=header_size)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../debloat/utilities/readers.py", line 575, in wrapped__init__
    original__init__(self, reader, *args, **kwargs)
  File ".../debloat/utilities/nsisParser.py", line 1023, in __init__
    raise ValueError(F'Duplicate item: {item.path} at 0x{item.offset:08X}')
ValueError: Duplicate item: $PLUGINSDIR\installer-helper.dll at 0x001B4063

I don't know if you want to verify that the files are the same, as if they are you may not need to get both. If they aren't, then maybe change the file path?

[Squiblydoo]

Thanks for opening the issue and making the suggestion. Based off of the logic, they should be the same. It appears that the NSIS header points to the same offset twice.

This error and issue was inherited through implementing the extraction feature from Binary Refinery, but it seems reasonable to find an alternative, such as de-duping or providing the user with the duplicate. We'll explore this file and situation more closely to better understand.

[Squiblydoo]

Solved in 1.5.6.6. More details here: https://github.com/Squiblydoo/debloat/pull/43