load_module failing for Python 3.12.0 sample (magic_int 3531)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 371
- Forks
- 106
- PR merge metrics
- No merged PRs in 30d
Description
Description
Using Python 3.14 on a Windows system, the attached sample (password "infected" - NOTE: This is malware and should be handled with care) can successfully be loaded using xdis==6.1.8 but throws an error with xdis==6.3.0.
7e257e269e08677d6abfbebce761d339.zip
How to Reproduce
from xdis import load_module
print(load_module("/pathtosample/7e257e269e08677d6abfbebce761d339"))
Output Given
For xdis==6.1.8:
((3, 12, 0), 0, 3531, <Code311 code object <module> at 0x1fc21885220, file <string>>, line 1, False, 0, None)
For xdis==6.3.0:
Traceback (most recent call last):
File "C:\Python\Python314\Lib\site-packages\xdis\load.py", line 349, in load_module_from_file_object
co = xdis.unmarshal.load_code(fp, magic_int, code_objects)
File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 826, in load_code
return um_gen.load()
~~~~~~~~~~~^^
File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 231, in load
return self.r_object()
~~~~~~~~~~~~~^^
File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 286, in r_object
return unmarshal_func(save_ref, bytes_for_s)
File "C:\Python\Python314\Lib\site-packages\xdis\unmarsh_rust.py", line 198, in t_code_rust
source_path = self.read_string(src_len, False)
File "C:\Python\Python314\Lib\site-packages\xdis\unmarsh_rust.py", line 304, in read_string
s = self.read_slice(n)
File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 211, in read_slice
return self.fp.read(n)
~~~~~~~~~~~~^^^
ValueError: read length must be non-negative or -1
Traceback (most recent call last):
File "C:\Python\Python314\Lib\site-packages\xdis\load.py", line 349, in load_module_from_file_object
co = xdis.unmarshal.load_code(fp, magic_int, code_objects)
File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 826, in load_code
return um_gen.load()
~~~~~~~~~~~^^
File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 231, in load
return self.r_object()
~~~~~~~~~~~~~^^
File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 286, in r_object
return unmarshal_func(save_ref, bytes_for_s)
File "C:\Python\Python314\Lib\site-packages\xdis\unmarsh_rust.py", line 198, in t_code_rust
source_path = self.read_string(src_len, False)
File "C:\Python\Python314\Lib\site-packages\xdis\unmarsh_rust.py", line 304, in read_string
s = self.read_slice(n)
File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 211, in read_slice
return self.fp.read(n)
~~~~~~~~~~~~^^^
ValueError: read length must be non-negative or -1
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "C:\Scripts\xdis_info.py", line 44, in <module>
main()
~~~~^^
File "C:\Scripts\xdis_info.py", line 38, in main
print(load_module(args.sample))
~~~~~~~~~~~^^^^^^^^^^^^^
File "C:\Python\Python314\Lib\site-packages\xdis\load.py", line 199, in load_module
return load_module_from_file_object(
fp,
...<4 lines>...
save_file_offsets=save_file_offsets,
)
File "C:\Python\Python314\Lib\site-packages\xdis\load.py", line 360, in load_module_from_file_object
raise ImportError(f"Ill-formed bytecode file {filename}\n{kind}; {msg}")
ImportError: Ill-formed bytecode file 7e257e269e08677d6abfbebce761d339
<class 'ValueError'>; read length must be non-negative or -1
Expected behavior
For 6.3.0, expect to receive the same output as for 6.1.8
Environment
- xdis version: Tested using
6.1.8and6.3.0 - Python version 3.14
- OS: Microsoft Windows 11
Workarounds
Priority
Additional Context
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure with the attached sample through xdis.load_module in xdis/load.py. Read the traceback paths in xdis/unmarshal.py and xdis/unmarsh_rust.py, especially the code handling source_path. Done means the Python 3.14 sample loads under xdis 6.3.0 with output matching 6.1.8.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 43/100