danielplohmann / apiscout

This project aims at simplifying Windows API import recovery on arbitrary memory dumps
BSD 2-Clause "Simplified" License
241 stars 41 forks source link

Fix wrong zero-padding when compressing some ApiVectors #16

Closed rikyoz closed 4 years ago

rikyoz commented 5 years ago

Hi! First, thank you for this useful project! I've had some issues in using ApiVectors when having particular lengths, and I think it's due to an error in the zero-padding of vectors. Specifically, ApiVectors whose length is an odd power of 2 (e.g., 211=2048) require padding of 4 zeros instead of 2 (as it currently happens); if not, the length of the padded vector is not a multiple of 6, and an exception like the following is raised:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "C:\Users\rik20\AppData\Local\Programs\Python\Python37\lib\site-packages\apiscout-1.0.1-py3.7.egg\apiscout\ApiVector.py", line 132, in getApiVectorFromApiList
    return self.getApiVectors(scout_format)
  File "C:\Users\rik20\AppData\Local\Programs\Python\Python37\lib\site-packages\apiscout-1.0.1-py3.7.egg\apiscout\ApiVector.py", line 111, in getApiVectors
    "vector": self.compress(api_vectors[api_map_name]),
  File "C:\Users\rik20\AppData\Local\Programs\Python\Python37\lib\site-packages\apiscout-1.0.1-py3.7.egg\apiscout\ApiVector.py", line 187, in compress
    uncompressed_b64 = "".join(self._bin2base64[chunk] for chunk in self._chunks("".join(["%d" % bit for bit in api_vector]) + "00", 6))
  File "C:\Users\rik20\AppData\Local\Programs\Python\Python37\lib\site-packages\apiscout-1.0.1-py3.7.egg\apiscout\ApiVector.py", line 187, in <genexpr>
    uncompressed_b64 = "".join(self._bin2base64[chunk] for chunk in self._chunks("".join(["%d" % bit for bit in api_vector]) + "00", 6))
KeyError: '0000'

This pull request addresses the issue by correcting the size of the padding added in the compress function and removed in decompress/n_decompress functions.

danielplohmann commented 4 years ago

Thank you very much for the contribution and sorry for being a bit slow for processing it! ;)

rikyoz commented 4 years ago

Thank you very much for the contribution and sorry for being a bit slow for processing it! ;)

No problem, you are welcome. Thanks for accepting it! ;)