python-javaobj icon indicating copy to clipboard operation
python-javaobj copied to clipboard

"Unknown type code: 0x50" when trying to load ghidra data type archive

Open madebr opened this issue 8 months ago • 0 comments

When trying to load a ghidra data type archive using the V2 implementation (V1 returns a clearly-wrong garbled string), the following error appears:

ValueError: Unknown type code: 0x50

Running file on the archive gives:

$ file ghidra/Ghidra/Features/Base/data/typeinfo/win32/windows_vs12_32.gdt
ghidra/Ghidra/Features/Base/data/typeinfo/win32/windows_vs12_32.gdt: Java serialization data, version 5

Example file: win32/windows_vs12_32.gdt There are more available here.

javaobj V1
with open("windows_vs12_64.gdt", "rb") as fd:
    jobj = fd.read()
pobj = javaobj.loads(jobj)
print(pobj)

This prints the string:

".0!&4é, \x00\x00\x00\x01\x00\tDTArchive\x00\x07Archive\x00\x00\x00\x00\x00\x00\x00\x00\x01ê@\x00"
javaobj V2
Traceback (most recent call last):
  File "/home/maarten/.local/lib/python3.12/site-packages/javaobj/v2/core.py", line 302, in _read_content
    handler = self.__type_code_handlers[type_code]
              ~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^
KeyError: 80

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/tmp/a.py", line 5, in <module>
    pobj = javaobj.load(fd)
           ^^^^^^^^^^^^^^^^
  File "/home/maarten/.local/lib/python3.12/site-packages/javaobj/v2/main.py", line 61, in load
    contents = parser.run()
               ^^^^^^^^^^^^
  File "/home/maarten/.local/lib/python3.12/site-packages/javaobj/v2/core.py", line 162, in run
    parsed_content = self._read_content(type_code, True)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/maarten/.local/lib/python3.12/site-packages/javaobj/v2/core.py", line 314, in _read_content
    raise ValueError("Unknown type code: 0x{0:x}".format(type_code))
ValueError: Unknown type code: 0x50

I used python-obj 0.4.4, installed through pypi

madebr avatar Jun 16 '24 16:06 madebr