Aug-17-2020, 05:45 PM
(This post was last modified: Aug-17-2020, 06:42 PM by DreamingInsanity.)
Hopefully I'm not being stupid here.
I am searching through a MacOS executable for a certain string (base64 encoded) like so:
Maybe I'm missing something obvious but how come .find() is not returning the correct index?
I've been messing around with it. It seems no matter what I search for, everything is coming up in the wrong place. When I print the contents of 't' to the console, it am able to search for the string. Yet when I use index it just gives total junk.
I am searching through a MacOS executable for a certain string (base64 encoded) like so:
with open(self.dir, 'r', encoding="ascii", errors="ignore") as f: t = f.read() if(b64link in t): location = t.find(b64link) elif(link in t): location = t.find(link) else: passIf I open the executable in a hex-editor and search for the string manually, I find that the string is at about lines 5220996 to 5221048. However if I run the above python code, it gets me an index of
2944053
which is totally off. If I open the file, seek to that location and read the length of the string, I get:Output:vv=>2q=G>2waQ$S
y$S
y$?
v;<s>2t=ek>6h6}E&U
>6}
which, I'm gonna be honest, doesn't look like a base64 string to me. There is absolutely no other places in the file where this string could be found. If there was then the output above would be correct.Maybe I'm missing something obvious but how come .find() is not returning the correct index?
I've been messing around with it. It seems no matter what I search for, everything is coming up in the wrong place. When I print the contents of 't' to the console, it am able to search for the string. Yet when I use index it just gives total junk.