search

namazso / OpenHashTab

📝 File hashing and checking shell extension
GNU General Public License v3.0
3.3k stars 128 forks source link

VirusTotal check doesn't support non-ASCII filenames #187

Closed zinalili closed 1 year ago

zinalili commented 1 year ago

Every time I click on VirusTotal icon, Windows Explorer restarts. Windows 10 22H2 OpenHashTab 3.0.4.0

namazso commented 1 year ago

Hm, works on my machine.

Can you reproduce it on the standalone version? Just export hashes, then double-click the file, that will open the standalone version.

If you can, then install procdump with procdump -i C:\my\dumps\folder -mt (with a path where you have write rights to) and get the standalone version to crash. A .dmp should appear in the folder, please send that to me by email. It is a triage level dump which should contain minimal personal information, but it will probably contain things like the file you're attempting to scan.

namazso commented 1 year ago

Okay, I think I figured it out. This happens when formatting the query string fails, which occurs when the file name contains characters that cannot be represented in your system locale. In that case _vscprintf returns -1, and we try to resize the string to (size_t)-1 long, also known as 18446744073709551615. Of course that results in "string too long" exception, which is uncaught, resulting in a crash.

Additionally it is also subtly wrong for non-ASCII filenames that are representable in the current locale, as it produces invalid UTF-8 which VirusTotal will just reject with an error:

image