search

nazywam / AutoIt-Ripper

Extract AutoIt scripts embedded in PE binaries
MIT License
160 stars 31 forks source link

Check for proper PEs #24

Closed nazywam closed 6 months ago

nazywam commented 7 months ago

sha256: fc17d887bb75a0d8eded67ca8b11aa662c7ea4071aa962b645054d4c3f627f67 / ddbb11b3fdf418eec1c07e8e993f951feb55e2ec3fbe7575d210061a549ed323

"error": [
    "Traceback (most recent call last):\n",
    "  File \"/usr/local/lib/python3.9/site-packages/karton/core/karton.py\", line 181, in internal_process\n    self.process(self.current_task)\n",
    "  File \"/usr/local/lib/python3.9/site-packages/karton/autoit_ripper/autoit_ripper_karton.py\", line 50, in process\n    resources = extract(data=sample.content, version=AutoItVersion.EA06)\n",
    "  File \"/usr/local/lib/python3.9/site-packages/autoit_ripper/autoit_unpack.py\", line 206, in extract\n    return unpack_ea06(data)\n",
    "  File \"/usr/local/lib/python3.9/site-packages/autoit_ripper/autoit_unpack.py\", line 176, in unpack_ea06\n    if not pe.DIRECTORY_ENTRY_RESOURCE:\n",
    "AttributeError: 'PE' object has no attribute 'DIRECTORY_ENTRY_RESOURCE'\n"
],
"error": [
    "Traceback (most recent call last):\n",
    "  File \"/usr/local/lib/python3.9/site-packages/karton/core/karton.py\", line 181, in internal_process\n    self.process(self.current_task)\n",
    "  File \"/usr/local/lib/python3.9/site-packages/karton/autoit_ripper/autoit_ripper_karton.py\", line 50, in process\n    resources = extract(data=sample.content, version=AutoItVersion.EA06)\n",
    "  File \"/usr/local/lib/python3.9/site-packages/autoit_ripper/autoit_unpack.py\", line 206, in extract\n    return unpack_ea06(data)\n",
    "  File \"/usr/local/lib/python3.9/site-packages/autoit_ripper/autoit_unpack.py\", line 170, in unpack_ea06\n    pe = pefile.PE(data=binary_data, fast_load=True)\n",
    "  File \"/usr/local/lib/python3.9/site-packages/pefile.py\", line 2895, in __init__\n    self.__parse__(name, data, fast_load)\n",
    "  File \"/usr/local/lib/python3.9/site-packages/pefile.py\", line 3031, in __parse__\n    raise PEFormatError(\"DOS Header magic not found.\")\n",
    "pefile.PEFormatError: 'DOS Header magic not found.'\n"
],