Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python x64 versions crash the analysis process #1680

Open
nbargnesi opened this issue Jul 28, 2023 · 3 comments
Open

Python x64 versions crash the analysis process #1680

nbargnesi opened this issue Jul 28, 2023 · 3 comments

Comments

@nbargnesi
Copy link
Contributor

nbargnesi commented Jul 28, 2023

Both the docs and agent module say an x86 version of Python is required.

Under the covers the analysis process calls a bunch of low-level Windows libraries, unpacking the results of these calls into a series of structures defined in lib.common.defines. The analyzer assumes the structures use 32-bit sizes, and will crash if running under a 64-bit Python.

There are architecture independent ways of doing most of what the analyzer needs to do, but for now the x86 requirement is there based on how the analyzer is written.

Note, the agent module doesn't need to run under an x86 Python, only the analyzer process. CAPE just happens to use the same sys.executable for both.

nbargnesi added a commit to nbargnesi/CAPEv2 that referenced this issue Jul 28, 2023
nbargnesi added a commit to nbargnesi/CAPEv2 that referenced this issue Jul 28, 2023
This fixes the crash referenced in kevoreilly#1680 with a architecture-agnostic
strategy to process enumeration without NTDLL and struct unpacking.
@nbargnesi
Copy link
Contributor Author

This commit fixes the struct unpacking crash when a 64-bit Python is used.

doomedraven added a commit that referenced this issue Jul 30, 2023
@doomedraven
Copy link
Collaborator

can you PR this commit?

@nbargnesi
Copy link
Contributor Author

nbargnesi commented Aug 4, 2023

Done. I think we should keep this issue open for some time - there will be more crashes and issues running under a x64 Python analyzer.

doomedraven added a commit that referenced this issue Aug 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants