You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
While parsing some fibratus http output, I noticed that in the raw UTF-8 there were some unexpected sequences, for example 0x30 followed by a 0x90.
I never used Go, but if I'm understanding correctly, strings are just like a byte array, and no underlying encoding is enforced.
In writeStringSlowPath(), if a byte that needs to be marshalled to json is > 0x7F, meaning that in UTF8 it's part of a multi-byte sequence, no extra marshalling is applied and it's written directly to the underlying json stream, which uses UTF-8, creating an "invalid" output if, for example, opened with python.
Is this an expected behavior or should these byte values marshalled in other ways?
The JSON payload you posted contains the REG_BINARY registry value parameter, which unsurprisingly is a binary blob. Thus, it would require some sort of encoding before transmitting over the wire.
While parsing some fibratus http output, I noticed that in the raw UTF-8 there were some unexpected sequences, for example
0x30
followed by a0x90
.I never used Go, but if I'm understanding correctly, strings are just like a byte array, and no underlying encoding is enforced.
In
writeStringSlowPath()
, if a byte that needs to be marshalled to json is> 0x7F
, meaning that in UTF8 it's part of a multi-byte sequence, no extra marshalling is applied and it's written directly to the underlying json stream, which uses UTF-8, creating an "invalid" output if, for example, opened with python.Is this an expected behavior or should these byte values marshalled in other ways?
Here an example of a problematic output: CyberChef - Missed Conversion
The text was updated successfully, but these errors were encountered: