diff --git a/.github/workflows/regtest.yml b/.github/workflows/regtest.yml index df6f7a2..a258f75 100644 --- a/.github/workflows/regtest.yml +++ b/.github/workflows/regtest.yml @@ -3,7 +3,7 @@ name: Regression Test on: push: - branches: [main] + branches: [main, update-tests] jobs: regtest: diff --git a/oneshot/runtime.py b/oneshot/runtime.py index 1b4d54a..c2f3ba2 100644 --- a/oneshot/runtime.py +++ b/oneshot/runtime.py @@ -66,9 +66,21 @@ class RuntimeInfo: """ with open(self.file_path, "rb") as f: data = f.read(16 * 1024 * 1024) - cur = data.index(b"pyarmor-vax") + cur = data.find(b"pyarmor-vax") + if cur == -1: + # Specially, check UPX (GH-12, GH-35) + if data.find(b"UPX!") != -1 and data.find(b"UPX0") != -1: + logger.error( + f"{self.file_path} seems to be packed by UPX. Before it can be processed, you need to unpack it first: Download UPX from https://github.com/upx/upx, and run `upx -d {self.file_path}` (you may need to escape the file path) in the command line." + ) + else: + logger.error( + f"{self.file_path} does not contain 'pyarmor-vax'. Maybe it's packed, obfuscated, or generated by an unsupported version of Pyarmor." + ) + raise ValueError(f"{self.file_path} does not contain 'pyarmor-vax'") if data[cur + 11 : cur + 18] == b"\x00" * 7: + # Do not log. Skip this file silently and find another. raise ValueError(f"{self.file_path} is a runtime template") # Align with pyd file and executable address: @@ -78,7 +90,7 @@ class RuntimeInfo: if data[0x5C] & 1 != 0: logger.error( - 'External key file ".pyarmor.ikey" is not supported yet, but it will be supported once we get a sample (like this one). Please open an issue on https://github.com/Lil-House/Pyarmor-Static-Unpack-1shot/issues to make this tool stronger.' + f'External key file ".pyarmor.ikey" is not supported yet, but it will be supported once we get a sample (like this one). Please open an issue on https://github.com/Lil-House/Pyarmor-Static-Unpack-1shot/issues to make this tool stronger. ({self.file_path})' ) raise NotImplementedError(f'{self.file_path} uses ".pyarmor.ikey"')