Skip to content

Exception when doing pcap capture #1

@jcopenha

Description

@jcopenha

I occasionally get the following traceback when capturing to pcap

Traceback (most recent call last):
  File "C:\Users\copewin\AppData\Local\Programs\Python\Python39\lib\site-packages\frida\core.py", line 450, in _on_message
    callback(message, data)
  File "C:\Users\copewin\AppData\Local\Programs\Python\Python39\lib\site-packages\hallucinate-1.0.0-py3.9.egg\hallucinate\handler.py", line 75, in handle
    self.handle_payload(p, self.script.post)
  File "C:\Users\copewin\AppData\Local\Programs\Python\Python39\lib\site-packages\hallucinate-1.0.0-py3.9.egg\hallucinate\handler.py", line 50, in handle_payload
    self.process_shutdown(p, rhandle)
  File "C:\Users\copewin\AppData\Local\Programs\Python\Python39\lib\site-packages\hallucinate-1.0.0-py3.9.egg\hallucinate\handler.py", line 41, in process_shutdown
    self.handler.shutdown(p)
  File "C:\Users\copewin\AppData\Local\Programs\Python\Python39\lib\site-packages\hallucinate-1.0.0-py3.9.egg\hallucinate\handlers\multi.py", line 45, in shutdown
    handler.shutdown(p, d)
  File "C:\Users\copewin\AppData\Local\Programs\Python\Python39\lib\site-packages\hallucinate-1.0.0-py3.9.egg\hallucinate\handlers\pcap.py", line 37, in shutdown
    self.fp.write(c.shutdown(time.time_ns()))
TypeError: a bytes-like object is required, not 'NoneType'

It appears that TCPState.shtudown is being called on a TCPState that has never had send called on it. so TCPState.shutdown returns nothing

https://github.com/SySS-Research/hallucinate/blob/main/hallucinate/pcap.py#L191

In my instance this is not being called on the default TCPState object created at https://github.com/SySS-Research/hallucinate/blob/main/hallucinate/handlers/pcap.py#L23 but on a valid connection. The application I'm using is hooking OpenSSL.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions