Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

\r character in filename appears to cause crash in compare mode #1

Open
ajroca opened this issue Feb 24, 2021 · 2 comments
Open

\r character in filename appears to cause crash in compare mode #1

ajroca opened this issue Feb 24, 2021 · 2 comments

Comments

@ajroca
Copy link

ajroca commented Feb 24, 2021

I've attached the digest file that I've been using which contains the \r characters in some of the filenames for the digests:
Win32.MuddyWaterC.txt.zip

Attached is the digest file created by digesting the malware archive obtained from TheZoo here: https://github.com/ytisf/theZoo/blob/master/malwares/Source/Original/Win32.MuddyWaterC/Win32.MuddyWaterC.zip

Note that the original, non-digested file is actual malware so be cautious if you decide to create the digest directly. Within the Win32.MuddyWaterC archive, there are three files with the name "Icon\r", within the core/, lib/, and lib/web/ directories.

When running the compare mode of jLZJD between the digest file and another digest file, the following error appears:

Exception in thread "main" java.lang.StringIndexOutOfBoundsException: begin 5, end 4, length 49
at java.base/java.lang.String.checkBoundsBeginEnd(String.java:3319)
at java.base/java.lang.String.substring(String.java:1874)
at com.edwardraff.jlzjd.Main.readHashesFromFile(Main.java:190)
at com.edwardraff.jlzjd.Main.run(Main.java:115)
at com.edwardraff.jlzjd.Main.main(Main.java:85)

Renaming the three Icon files to remove the \r character and creating a new digest file results in the above error going away and the program running normally.

@EdwardRaff
Copy link
Owner

Can you attach the digest file that is created? I'm guessing its because the \r in the name makes a new line in the file, and the readHashesFromFile pareses by new lines.... \r in a file name is evil.

@ajroca
Copy link
Author

ajroca commented Feb 26, 2021

The first link in the issue should have the digest file. I zipped it thinking that the \r was causing issues with Github, but I think it actually turned out to just be my script blocker. Let me know if you have issues getting it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants