rocky / rocky/python-xdis

load_module failing for Python 3.12.0 sample (magic_int 3531)

Open
#185 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
371
Forks
106
PR merge metrics
No merged PRs in 30d

Description

Description

Using Python 3.14 on a Windows system, the attached sample (password "infected" - NOTE: This is malware and should be handled with care) can successfully be loaded using xdis==6.1.8 but throws an error with xdis==6.3.0.

7e257e269e08677d6abfbebce761d339.zip

How to Reproduce

from xdis import load_module

print(load_module("/pathtosample/7e257e269e08677d6abfbebce761d339"))

Output Given

For xdis==6.1.8:

((3, 12, 0), 0, 3531, <Code311 code object <module> at 0x1fc21885220, file <string>>, line 1, False, 0, None)

For xdis==6.3.0:

Traceback (most recent call last):
  File "C:\Python\Python314\Lib\site-packages\xdis\load.py", line 349, in load_module_from_file_object
    co = xdis.unmarshal.load_code(fp, magic_int, code_objects)
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 826, in load_code
    return um_gen.load()
           ~~~~~~~~~~~^^
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 231, in load
    return self.r_object()
           ~~~~~~~~~~~~~^^
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 286, in r_object
    return unmarshal_func(save_ref, bytes_for_s)
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarsh_rust.py", line 198, in t_code_rust
    source_path = self.read_string(src_len, False)
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarsh_rust.py", line 304, in read_string
    s = self.read_slice(n)
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 211, in read_slice
    return self.fp.read(n)
           ~~~~~~~~~~~~^^^
ValueError: read length must be non-negative or -1
Traceback (most recent call last):
  File "C:\Python\Python314\Lib\site-packages\xdis\load.py", line 349, in load_module_from_file_object
    co = xdis.unmarshal.load_code(fp, magic_int, code_objects)
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 826, in load_code
    return um_gen.load()
           ~~~~~~~~~~~^^
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 231, in load
    return self.r_object()
           ~~~~~~~~~~~~~^^
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 286, in r_object
    return unmarshal_func(save_ref, bytes_for_s)
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarsh_rust.py", line 198, in t_code_rust
    source_path = self.read_string(src_len, False)
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarsh_rust.py", line 304, in read_string
    s = self.read_slice(n)
  File "C:\Python\Python314\Lib\site-packages\xdis\unmarshal.py", line 211, in read_slice
    return self.fp.read(n)
           ~~~~~~~~~~~~^^^
ValueError: read length must be non-negative or -1

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Scripts\xdis_info.py", line 44, in <module>
    main()
    ~~~~^^
  File "C:\Scripts\xdis_info.py", line 38, in main
    print(load_module(args.sample))
          ~~~~~~~~~~~^^^^^^^^^^^^^
  File "C:\Python\Python314\Lib\site-packages\xdis\load.py", line 199, in load_module
    return load_module_from_file_object(
        fp,
    ...<4 lines>...
        save_file_offsets=save_file_offsets,
    )
  File "C:\Python\Python314\Lib\site-packages\xdis\load.py", line 360, in load_module_from_file_object
    raise ImportError(f"Ill-formed bytecode file {filename}\n{kind}; {msg}")
ImportError: Ill-formed bytecode file 7e257e269e08677d6abfbebce761d339
<class 'ValueError'>; read length must be non-negative or -1

Expected behavior

For 6.3.0, expect to receive the same output as for 6.1.8

Environment

  • xdis version: Tested using 6.1.8 and 6.3.0
  • Python version 3.14
  • OS: Microsoft Windows 11

Workarounds

Priority

Additional Context

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with the attached sample through xdis.load_module in xdis/load.py. Read the traceback paths in xdis/unmarshal.py and xdis/unmarsh_rust.py, especially the code handling source_path. Done means the Python 3.14 sample loads under xdis 6.3.0 with output matching 6.1.8.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
43/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.