Special character in Filename inside Payload-Folder breaks IPA analysis #2285

esoteric-programmer · 2023-11-14T12:35:46Z

ENVIRONMENT

OS and Version: macOS-14.1.1-arm64-arm-64bit (23B81)
Python Version: Python 3.11.6 (main, Oct  2 2023, 13:45:54) [Clang 15.0.0 (clang-1500.0.40.1)] on darwin
MobSF Version: v3.7.9 Beta (4685d8e73d5c23f8418767a24f3015160adbc6db)

EXPLANATION OF THE ISSUE

When analyzing an IPA file that contains a special character "β" and a whitespace in the Payload/[APPNAME].app filename, analysis fails. Running MobSF under MacOS (see above) is affected as well as the Docker image opensecurity/mobile-security-framework-mobsf:latest

STEPS TO REPRODUCE THE ISSUE

1. Create IPA file with special character in application filename
2. Analyze IPA with MobSF

LOG FILE

Username and application name partially censored, [...] inserted insetad; brpken encoding of special character "β" in the app name not censored.

[INFO] 14/Nov/2023 11:29:34 - Mobile Security Framework v3.7.9 Beta
[INFO] 14/Nov/2023 11:29:34 - OS: Darwin
[INFO] 14/Nov/2023 11:29:34 - Platform: macOS-14.1.1-arm64-arm-64bit
[INFO] 14/Nov/2023 11:29:34 - Dist: darwin 23.1.0
[INFO] 14/Nov/2023 11:29:34 - MobSF Basic Environment Check
[WARNING] 14/Nov/2023 11:29:34 - Dynamic Analysis related functions will not work.
Make sure a Genymotion Android VM/Android Studio Emulator is running before performing Dynamic Analysis.
[INFO] 14/Nov/2023 11:29:34 - Checking for Update.
[INFO] 14/Nov/2023 11:29:34 - No updates available.
[INFO] 14/Nov/2023 11:30:17 - MIME Type: application/octet-stream FILE: E[...]7.ipa
[INFO] 14/Nov/2023 11:30:17 - Performing Static Analysis of iOS IPA
[INFO] 14/Nov/2023 11:30:17 - iOS Binary (IPA) Analysis Started
[INFO] 14/Nov/2023 11:30:17 - Generating Hashes
[INFO] 14/Nov/2023 11:30:17 - Extracting IPA
[INFO] 14/Nov/2023 11:30:17 - Unzipping
[INFO] 14/Nov/2023 11:30:18 - Get Files, BIN Plist -> XML, and Normalize
[WARNING] 14/Nov/2023 11:30:18 - Failed to convert plist
[INFO] 14/Nov/2023 11:30:18 - iOS Info.plist Analysis Started
[INFO] 14/Nov/2023 11:30:18 - Finding Info.plist in iOS Binary
[INFO] 14/Nov/2023 11:30:18 - Checking Permissions
[INFO] 14/Nov/2023 11:30:18 - Checking for Insecure Connections
[INFO] 14/Nov/2023 11:30:18 - Fetching Details from App Store: io.[...]
[WARNING] 14/Nov/2023 11:30:19 - Unable to get app details.
[INFO] 14/Nov/2023 11:30:19 - Starting Binary Analysis
[INFO] 14/Nov/2023 11:30:19 - Running MachO Analysis on: ╬▓ E[...].app
[ERROR] 14/Nov/2023 11:30:19 - Running MachO Analysis
Traceback (most recent call last):
  File "/Users/[...]/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/ios/binary_analysis.py", line 61, in ipa_macho_analysis
    libs = cs.get_libraries()
           ^^^^^^^^^^^^^^^^^^
  File "/Users/[...]/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/common/binary/macho.py", line 274, in get_libraries
    for i in self.macho.libraries:
             ^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'libraries'
[INFO] 14/Nov/2023 11:30:19 - Getting Binary Information
[ERROR] 14/Nov/2023 11:30:19 - IPA Binary Analysis
Traceback (most recent call last):
  File "/Users/[...]/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/ios/binary_analysis.py", line 108, in binary_analysis
    bin_info = get_bin_info(bin_path)
               ^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/[...]/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/ios/binary_analysis.py", line 39, in get_bin_info
    m = MachO(bin_file.as_posix())
        ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/macholib/MachO.py", line 120, in __init__
    with open(filename, "rb") as fp:
         ^^^^^^^^^^^^^^^^^^^^
IsADirectoryError: [Errno 21] Is a directory: '/Users/[...]/.MobSF/uploads/07d37e4dd405eba1dd2d463f1ecc3e5f/Payload/╬▓ E[...].app'
[INFO] 14/Nov/2023 11:30:19 - Library Binary Analysis Started
[INFO] 14/Nov/2023 11:30:19 - Framework Binary Analysis Started
[INFO] 14/Nov/2023 11:30:19 - Analyzing Frameworks/PPRiskMagnes.framework/PPRiskMagnes
[INFO] 14/Nov/2023 11:30:21 - Analyzing Frameworks/CoWorkingNetwork.framework/CoWorkingNetwork
[INFO] 14/Nov/2023 11:30:22 - Fetching icon path
[WARNING] 14/Nov/2023 11:30:22 - Could not find app binary directory
[INFO] 14/Nov/2023 11:30:22 - Starting IPA URL and Email Extraction
[INFO] 14/Nov/2023 11:30:24 - Performing Malware Check on extracted Domains
[INFO] 14/Nov/2023 11:30:25 - Maltrail Database is outdated!
[INFO] 14/Nov/2023 11:30:25 - Updating Maltrail Database
[INFO] 14/Nov/2023 11:30:26 - Finished URL and Email Extraction
[INFO] 14/Nov/2023 11:30:27 - Trackers Database is up-to-date
[INFO] 14/Nov/2023 11:30:27 - Detecting Trackers from Domains
[INFO] 14/Nov/2023 11:30:27 - Detecting Firebase URL(s)
[INFO] 14/Nov/2023 11:30:27 - Connecting to DB
[INFO] 14/Nov/2023 11:30:27 - Saving to Database
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'arch' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [arch] in {}
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'subarch' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'subarch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'subarch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'subarch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [subarch] in {}
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'bit' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'bit'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'bit'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'bit'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [bit] in {}
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'endian' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'endian'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'endian'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'endian'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [endian] in {}
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'arch' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [arch] in {}
[INFO] 14/Nov/2023 11:30:27 - Analysis is already Done. Fetching data from the DB...
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'arch' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [arch] in {}
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'subarch' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'subarch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'subarch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'subarch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [subarch] in {}
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'bit' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'bit'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'bit'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'bit'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [bit] in {}
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'endian' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'endian'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'endian'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'endian'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [endian] in {}
[DEBUG] 14/Nov/2023 11:30:27 - Exception while resolving variable 'arch' in template 'static_analysis/ios_binary_analysis.html'.
Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 880, in _resolve_lookup
    current = current[bit]
              ~~~~~~~^^^^^
KeyError: 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 890, in _resolve_lookup
    current = getattr(current, bit)
              ^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'dict' object has no attribute 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 896, in _resolve_lookup
    current = current[int(bit)]
                      ^^^^^^^^
ValueError: invalid literal for int() with base 10: 'arch'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[...]/Library/Caches/pypoetry/virtualenvs/mobsf-u6ypDL8M-py3.11/lib/python3.11/site-packages/django/template/base.py", line 903, in _resolve_lookup
    raise VariableDoesNotExist(
django.template.base.VariableDoesNotExist: Failed lookup for key [arch] in {}

The text was updated successfully, but these errors were encountered:

github-actions · 2023-11-14T12:35:59Z

👋 @esoteric-programmer
Issues is only for reporting a bug/feature request. For limited support, questions, and discussions, please join MobSF Slack channel
Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.

ajinabraham · 2023-11-14T20:28:04Z

I don't think this is due to the file name, but something wrong with parsing the macho file. Can you share the IPA for troubleshooting?

esoteric-programmer · 2023-11-15T10:23:56Z

Thank you for your quick response.

Unfortunately, I cannot share the IPA file since it's an internal build that was provided by a customer to me exclusively for testing.

However, I am happy if you could investigate the issue, so maybe there is another way to provide the necessary support?

ajinabraham · 2023-12-02T22:35:51Z

This looks like MachO analysis failure. Can't proceed without access to binary. Hence closing the issue.

ajinabraham · 2024-03-09T21:11:54Z

CSF: I've stumbled upon the same issue as #2285 recently and I'd like to discuss possible solutions with you. The issue lies in Python's ZipFile class when parsing filenames.
Python's ZipFile checks if UTF8_BITS exist in the ZIP file. If they do, it parses metadata using UTF8. But if not, it defaults to cp437 encoding to parse strings.
In some special cases, e.g., when you repackage the IPA using the zip CLI tool in macOS (zip -qr test.ipa Payload), even if the filename contains Unicode characters, macOS's zip CLI doesn't add UTF8_BITS specifically. This causes garble filenames when Python extract it and binary analysis will fail.
Now, in Python 3.11 and above, ZipFile allows specifying the filename parsing method through the metadata_encoding parameter (check this out). But it seems like Python 3.10 doesn't have a native solution for this.

IPA Shared via DM

ajinabraham · 2024-03-09T21:13:30Z

[INFO] 09/Mar/2024 20:56:45 - Fetching Details from App Store: ****
[WARNING] 09/Mar/2024 20:56:45 - Unable to get app details
[INFO] 09/Mar/2024 20:56:45 - Starting Binary Analysis
[INFO] 09/Mar/2024 20:56:45 - Running MachO Analysis on: TWµèòΦ│çΣ║║Φíîσïòτ╢▓.app
Unknown format
[ERROR] 09/Mar/2024 20:56:45 - Running MachO Analysis
Traceback (most recent call last):
  File "/****/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/ios/binary_analysis.py", line 61, in ipa_macho_analysis
    libs = cs.get_libraries()
  File "/***/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/common/binary/macho.py", line 300, in get_libraries
    for i in self.macho.libraries:
AttributeError: 'NoneType' object has no attribute 'libraries'
[INFO] 09/Mar/2024 20:56:45 - Getting Binary Information
[ERROR] 09/Mar/2024 20:56:45 - IPA Binary Analysis
Traceback (most recent call last):
  File "/***/tools/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/ios/binary_analysis.py", line 108, in binary_analysis
    bin_info = get_bin_info(bin_path)
  File "/***/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/ios/binary_analysis.py", line 39, in get_bin_info
    m = MachO(bin_file.as_posix())
  File "/***/Library/Caches/pypoetry/virtualenvs/mobsf-***-py3.10/lib/python3.10/site-packages/macholib/MachO.py", line 120, in __init__
    with open(filename, "rb") as fp:
IsADirectoryError: [Errno 21] Is a directory: '/***/.MobSF/uploads/****/Payload/TWµèòΦ│çΣ║║Φíîσïòτ╢▓.app'

ajinabraham closed this as completed Dec 2, 2023

ajinabraham reopened this Mar 9, 2024

ajinabraham added a commit that referenced this issue Mar 26, 2024

Address #2285, prevent analysis failure, skip binary analysis

1ef1629

ajinabraham closed this as completed in 76187b8 May 21, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Special character in Filename inside Payload-Folder breaks IPA analysis #2285

Special character in Filename inside Payload-Folder breaks IPA analysis #2285

esoteric-programmer commented Nov 14, 2023

github-actions bot commented Nov 14, 2023

ajinabraham commented Nov 14, 2023

esoteric-programmer commented Nov 15, 2023

ajinabraham commented Dec 2, 2023

ajinabraham commented Mar 9, 2024

ajinabraham commented Mar 9, 2024

Special character in Filename inside Payload-Folder breaks IPA analysis #2285

Special character in Filename inside Payload-Folder breaks IPA analysis #2285

Comments

esoteric-programmer commented Nov 14, 2023

ENVIRONMENT

EXPLANATION OF THE ISSUE

STEPS TO REPRODUCE THE ISSUE

LOG FILE

github-actions bot commented Nov 14, 2023

ajinabraham commented Nov 14, 2023

esoteric-programmer commented Nov 15, 2023

ajinabraham commented Dec 2, 2023

ajinabraham commented Mar 9, 2024

ajinabraham commented Mar 9, 2024