Comments (7)
It seems it's having a hard time reading the task XML. Can you do a print repr(xml)
just before xml = xml.decode('utf-16')
(line 466) and tell me what the results are?
from volatility-autoruns.
Comes back as empty...
Here's what I did (which does allow it to complete otherwise unaffected it would seem):
def parse_task_xml(self, xml):
raw = xml
xml = re.sub('\x00\x00+', '', xml) + '\x00'
try:
xml = xml.decode('utf-16')
xml = re.sub(r"<Task(.*?)>", "<Task>", xml)
xml = xml.encode('utf-16')
root = ET.fromstring(xml)
d = {}
for e in root.findall("./RegistrationInfo/Date"):
d['Date'] = e.text
for e in root.findall("./RegistrationInfo/Description"):
d['Description'] = e.text
for e in root.findall("./Actions"):
d['Actions'] = self.visit_all_children(e)
for e in root.findall("./Settings/Enabled"):
d['Enabled'] = e.text
for e in root.findall("./Settings/Hidden"):
d['Hidden'] = e.text
for t in root.findall("./Triggers/*"):
d['Triggers'] = self.visit_all_children(t)
if not d.get("Actions", {}).get('Exec', {}).get("Command", False):
return None
return d
except UnicodeDecodeError as e:
sys.stderr.write('UnicodeDecodeError for: {}\n'.format(repr(raw)))
from volatility-autoruns.
Tom,
The GrrCon2012 challenge is giving me what appears to be some unicode errors. I've put a copy of it up here if you want to download and try it on your end.
https://drive.google.com/file/d/0B_OPOV8sZBaYMjYwUTNRaGZYY1k/view?usp=sharing
from volatility-autoruns.
@jared703: thanks for the heads-up, I'll look into it.
from volatility-autoruns.
Hm, so I'm not getting unicode errors. Just seeing the service below which has two non-ASCII characters at the end of the name:
Services =========================================
Service: DcomLaunch (ntstobject.dll.123.Manifestp) - Share_Process, Auto Start
Image path: Adobe\Reader\9.3\ARM\AdbeRdr950_en_US.exeȞఎ (Last modified: 2012-04-28 01:56:26 UTC+0000)
PIDs: -
That said, there were some keys that were not properly parsed (missing values), so I fixed that. Care to give it another try and letting me know if you still get an error?
from volatility-autoruns.
Sorry meant to write back - it has been working wonderfully across memory samples with this same issue. Thanks again for the awesome work.
from volatility-autoruns.
Happy to help. Thanks for testing it so thoroughly ;)
from volatility-autoruns.
Related Issues (19)
- UnboundLocalError: local variable 'dllname' referenced before assignment HOT 2
- Catch NoneType within parse_service_key check HOT 2
- Unicode Encode Error: 'ascii' codec can't encode character u'\u1720' HOT 4
- Autoruns is not working HOT 12
- TypeError when analyzing memory HOT 1
- Autoruns issue HOT 2
- autoruns.py error HOT 13
- Error HOT 1
- Add shim extraction
- Add COM hijacking
- Migrate to volatility3
- Error for profile 19041 HOT 5
- autoruns.py not working HOT 5
- 'Autoruns' object has no attribute 'sdb'
- Extract services from memory
- crash HOT 1
- Autoruns.py error HOT 3
- Autoruns problems with Volatility 2.5 HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from volatility-autoruns.