search

kevoreilly / CAPEv2

Malware Configuration And Payload Extraction
https://capesandbox.com/analysis/
Other
1.89k stars 408 forks source link

Python x64 versions crash the analysis process #1680

Open nbargnesi opened 1 year ago

nbargnesi commented 1 year ago

Both the docs and agent module say an x86 version of Python is required.

Under the covers the analysis process calls a bunch of low-level Windows libraries, unpacking the results of these calls into a series of structures defined in lib.common.defines. The analyzer assumes the structures use 32-bit sizes, and will crash if running under a 64-bit Python.

There are architecture independent ways of doing most of what the analyzer needs to do, but for now the x86 requirement is there based on how the analyzer is written.

Note, the agent module doesn't need to run under an x86 Python, only the analyzer process. CAPE just happens to use the same sys.executable for both.

nbargnesi commented 1 year ago

This commit fixes the struct unpacking crash when a 64-bit Python is used.

doomedraven commented 1 year ago

can you PR this commit?

nbargnesi commented 1 year ago

Done. I think we should keep this issue open for some time - there will be more crashes and issues running under a x64 Python analyzer.