search

mandiant / flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Apache License 2.0
3.18k stars 446 forks source link

hex() argument can't be converted to hex #212

Closed pilate closed 2 years ago

pilate commented 8 years ago

2ae50533676d56b7013f9972bcf95e76

Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/floss-1.2.0-py2.7.egg/floss/main.py", line 600, in main
    vw = viv_utils.getWorkspace(sample_file_path, should_save=options.save_workspace)
  File "/usr/local/lib/python2.7/dist-packages/viv_utils-0.3.5-py2.7.egg/viv_utils/__init__.py", line 33, in getWorkspace
    vw.analyze()
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/vivisect/__init__.py", line 645, in analyze
    self.makeFunction(eva)
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/vivisect/__init__.py", line 1117, in makeFunction
    self.cfctx.addEntryPoint(va, arch=arch)
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/envi/codeflow.py", line 270, in addEntryPoint
    calls_from = self.addCodeFlow(va, arch=arch)
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/envi/codeflow.py", line 251, in addCodeFlow
    self.addEntryPoint(fva, arch=arch)
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/envi/codeflow.py", line 270, in addEntryPoint
    calls_from = self.addCodeFlow(va, arch=arch)
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/envi/codeflow.py", line 184, in addCodeFlow
    bdest = self._mem.readMemoryFormat(ptrbase, '<P')[0]
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/envi/memory.py", line 157, in readMemoryFormat
    bytez = self.readMemory(va, size)
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/envi/memory.py", line 442, in readMemory
    raise envi.SegmentationViolation(va)
  File "/usr/local/lib/python2.7/dist-packages/vivisect-0.0.0-py2.7.egg/envi/__init__.py", line 207, in __init__
    msg = "Bad Memory Access: %s" % hex(va)
TypeError: hex() argument can't be converted to hex
ERROR:floss:Vivisect failed to load the input file: hex() argument can't be converted to hex
mr-tz commented 3 years ago

currently getting this new error:

Traceback (most recent call last):
  File "floss-script.py", line 33, in <module>
    sys.exit(load_entry_point('flare-floss', 'console_scripts', 'floss')())
  File "floss\main.py", line 737, in main
    result_document.strings.stack_strings = list(
  File "floss\stackstrings.py", line 171, in extract_stackstrings
    if len(s.s) > MAX_STRING_LENGTH:
AttributeError: 'StaticString' object has no attribute 's'
williballenthin commented 3 years ago

the new bug is fixed in #408

mr-tz commented 2 years ago

analysis completes now (although very slow)