Skip to content

structure.py is not working on Windows 11, 25H2 for srum.dat #2100

@wxt

Description

@wxt

Configuration

impacket version: 0.11.0 release
Python version: 3.6.9
Target OS: Windows 11, 25H2

Debug Output With Command String

Traceback (most recent call last) :
File "C:\src2\SrumParser_build \entry.py", line 261, in main
File "C:\src2\SrumParser build \entry.py", line 226, in run
File "C:\src2\SrumParser_build_\ese\ese.py", line 614, in init
File "C:\src2\SrumParser build \ese\ese.py", line 632, in mountDB
File "C:\src2\SrumParser_build_\ese\ese.py", line 721, in
parseCatalog
File "C:\src2\SrumParser_build \ese\ese.py", line 714, in
parseCatalog
File "C:\src2\SrumParser_build_\ese\ese.py", line 708, in parsePage
File "C:\src2\SrumParser_build \ese\ese.py", line 340, in init
File "C:\src2\SrumParser_build_\ese\structure.py", line 105, in
init
File "C:\src2\SrumParser_build_\ese\structure.py", line 170, in
fromString
File "C:\src2\SrumParser_build_\ese\structure.py", line 344, in
unpack
File "C:\src2\SrumParser_build_\ese\structure.py", line 403, in
unpack
struct.error: ('unpack requires a bytes object of length 2', "When unpacking field
LocalPageKeySize | <H=0 | b'' [: 2] '")

PCAP

Additional context

I am using the ese.py and structure.py file from this repo to parse Windows srum.dat file and getting the above error when running on Windows 11, 25H2. I've also tried on older Windows 10 and it seems to be working.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions