feat(handler): support NSIS Installers by jcrussell · Pull Request #1255 · onekey-sec/unblob

jcrussell · 2025-09-03T14:56:52Z

Searches for "Nullsoft" in the manifest to avoid false positives. Possibly too strict.

Fixes #1249

python/unblob/handlers/executable/pe.py

qkaiser · 2025-09-04T09:32:03Z

@jcrussell you should also create integration tests to check that the handler works as expected.

You have to create the following directories:

unblob/tests/integration/executable/pe/__input__
unblob/tests/integration/executable/pe/__output

I would put the following in the input directory:

a normal PE file
a normal PE file with prefix and suffix padding
a nullsoft PE file
a nullsoft PE file with prefix and suffix padding

To generate the output directory content, run the following:

find unblob/tests/integration/executable/pe/__input__ -type f -exec unblob -f -k -e unblob/tests/integration/executable/pe/__output__ {} \;

qkaiser · 2025-09-29T11:11:46Z

@jcrussell any update on this ? do you need assistance ?

jcrussell · 2025-10-07T22:12:10Z

@jcrussell any update on this ? do you need assistance ?

@qkaiser: I believe the code is close to final. Do you mind adding the integration test data? It is easier for me to release code than data. Here's what I have been testing with:

a nullsoft PE file -> https://prdownloads.sourceforge.net/nsis/nsis-3.11-setup.exe?download
a normal PE file -> I was testing on a random PE extracted from ^ (specifically, nsis-3.11-setup.exe_extract/Bin/zip2exe.exe`)

Thanks in advance!

qkaiser · 2025-10-15T06:55:05Z

python/unblob/handlers/executable/pe.py

+
+        return ValidChunk(
+            start_offset=start_offset,
+            end_offset=start_offset + binary.original_size,


original_size is the file size on disk, not the actual PE file size. Samples with suffix are carved with the suffix, which is incorrect. I'm looking into it.

@jcrussell did you get the opportunity to look into this ?

Maybe #1255 (comment) ?

qkaiser · 2025-10-15T07:09:30Z

@jcrussell had to figure out how to handle LFS on forks, looks like it's okay now. Made some adjustments to keep pyright happy given LIEF's ability to return completely different types for the same object.

We need to fix the way the end offset is calculated, it'll probably be based on sections size and header size. Without unblob considers everything after the PE as part of the PE chunk.

jcrussell · 2025-10-17T00:26:44Z

Thanks for moving this along!

We need to fix the way the end offset is calculated, it'll probably be based on sections size and header size. Without unblob considers everything after the PE as part of the PE chunk.

I started looking into this:

>>> pe = lief.PE.parse("tests/integration/executable/pe/__input__/nsis-3.11-setup.exe")
>>> pe.original_size
1564991
>>> pe.sizeof_headers
1024
>>> sum([s.sizeof_raw_data for s in pe.sections])
52224
>>> sum([v.size for v in pe.data_directories])
19456

Found this script that dumps a bunch of info, going to try a more complete look at all the parts tomorrow.

https://github.com/lief-project/LIEF/blob/main/api/python/examples/pe_reader.py

jcrussell · 2025-10-17T21:17:05Z

This works for (some) non-NSIS PEs but trims off the data that NSIS adds after the PE that contains what we actually want to extract. The "trimmed" data is not recognized by any handler. It seems like we need to detect if it's a NSIS installer incalculate_chunk to see if we need to increase the size for the NSIS data.

        size = sum([s.sizeof_raw_data for s in binary.sections]) + binary.sizeof_headers

        return ValidChunk(
            start_offset=start_offset,
            end_offset=start_offset + size
        )

jcrussell · 2025-11-28T23:13:03Z

@qkaiser: sorry for the delay, think this is finally fixed:

$ ls tests/integration/executable/pe/__output__/nsis-3.11-setup.exe.padded_extract/
0-16.padding  1565007-1565023.padding  16-1565007.pe  16-1565007.pe_extract
$ xxd tests/integration/executable/pe/__output__/nsis-3.11-setup.exe.padded_extract/0-16.padding 
00000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
$ xxd tests/integration/executable/pe/__output__/nsis-3.11-setup.exe.padded_extract/1565007-1565023.padding 
00000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
$ sha1sum tests/integration/executable/pe/__output__/nsis-3.11-setup.exe.padded_extract/16-1565007.pe
a64bbad73d4638d668ffdbd0887be7d6528d6a9d  tests/integration/executable/pe/__output__/nsis-3.11-setup.exe.padded_extract/16-1565007.pe
$ sha1sum tests/integration/executable/pe/__input__/nsis-3.11-setup.exe 
a64bbad73d4638d668ffdbd0887be7d6528d6a9d  tests/integration/executable/pe/__input__/nsis-3.11-setup.exe

…table Add support for PE file by relying on LIEF to parse PE file once matched on 'MZ' or 'PE' signature. If the file is a self-extractable NSIS executable ("Nullsoft.NSIS.exehead" present in manifest) we extract it with 7zip. Note: the DLL files within MSI extraction directory are no longer extracted since the PE handler takes care of them. This is an improvement over the RAR false positive being found in the DLL. Co-authored-by: Quentin Kaiser <quentin.kaiser@onekey.com>

qkaiser · 2026-01-25T15:46:58Z

@jcrussell sorry about the delay, plan is to finalize this next week

qkaiser · 2026-01-30T12:11:10Z

python/unblob/handlers/executable/pe.py

+        HexString(
+            """
+            // MZ header
+            4d 5a
+            """
+        ),


I'm worried this will lead to many false positive matches being fed to lief, which will have a significant performance impact. One way we limit impact with those small patterns is this:

Suggested change

HexString(

"""

// MZ header

4d 5a

"""

),

Regex("^\x4d\x5a"),

Forces the matched pattern to be at offset 0 of the file.

qkaiser · 2026-01-30T12:12:06Z

python/unblob/handlers/executable/pe.py

+            // PE header
+            50 45 00 00


Are there fields other than the magic we can do some decent pattern matching on ?

qkaiser · 2026-01-30T12:12:37Z

python/unblob/handlers/executable/pe.py

+    )
+
+    def calculate_chunk(self, file: File, start_offset: int) -> Optional[ValidChunk]:
+        file.seek(start_offset, io.SEEK_SET)


Not needed.

Suggested change

file.seek(start_offset, io.SEEK_SET)

qkaiser · 2026-01-30T12:14:29Z

python/unblob/handlers/executable/pe.py

+                _, _, _, _, archive_size = struct.unpack(
+                    "II12sII", overlay[header_start : header_start + 28]
+                )


What are those fields exactly ? If you turn this Handler into a StructHandler you can define C_DEFINITIONS, a HEADER_STRUCT and use the parse_header function to get a dissect.cstruct Structure with named fields.

qkaiser · 2026-01-30T12:16:21Z

python/unblob/handlers/executable/pe.py

+            overlay = bytes(binary.overlay)
+
+            magic_offset = overlay.find(b"NullsoftInst")


How big is the overlay ? Is there a way you can derive the start offset of that overlay ? If so you could call find on file which is mmap'ed. It should be faster. Also if you know the magic value is within the first X bytes of the overlay, I would set an upper bound on the content that is searched through.

So I would do something like this:

Suggested change

overlay = bytes(binary.overlay)

magic_offset = overlay.find(b"NullsoftInst")

magic_offset = file[binary.overlay_offset:binary.overlay_offset+SOME_UPPER_BOUND].find(b"NullSoftInst")

bonus point if the upper bound is less than a page

qkaiser · 2026-01-30T12:22:17Z

python/unblob/handlers/executable/pe.py

+                if "Nullsoft.NSIS.exehead" in manifest:
+                    return True


Suggested change

if "Nullsoft.NSIS.exehead" in manifest:

return True

return "Nullsoft.NSIS.exehead" in manifest

qkaiser · 2026-01-30T12:23:18Z

python/unblob/handlers/executable/pe.py

+
+        return ValidChunk(
+            start_offset=start_offset,
+            end_offset=start_offset + binary.original_size,


@jcrussell did you get the opportunity to look into this ?

jcrussell · 2026-02-18T23:59:59Z

@qkaiser: not yet, sorry. hoping to get to it by the end of the month.

qkaiser self-assigned this Sep 4, 2025

qkaiser self-requested a review September 4, 2025 07:45

qkaiser added enhancement New feature or request format:executable python Pull requests that update Python code labels Sep 4, 2025

qkaiser reviewed Sep 4, 2025

View reviewed changes

qkaiser force-pushed the nsis branch from 701ded3 to 9a4df88 Compare October 15, 2025 06:51

qkaiser reviewed Oct 15, 2025

View reviewed changes

qkaiser force-pushed the nsis branch from 9a4df88 to 12f0a99 Compare October 15, 2025 07:09

qkaiser force-pushed the nsis branch from 12f0a99 to 3b240d7 Compare October 15, 2025 07:19

qkaiser marked this pull request as draft November 25, 2025 12:44

qkaiser added this to the Internship 2026 milestone Nov 25, 2025

jcrussell marked this pull request as ready for review December 4, 2025 01:01

qkaiser force-pushed the nsis branch from 1399d1a to ebe084b Compare December 11, 2025 10:46

qkaiser force-pushed the nsis branch from ebe084b to 6e799ad Compare December 11, 2025 11:56

qkaiser self-requested a review December 11, 2025 12:14

qkaiser reviewed Jan 30, 2026

View reviewed changes

		overlay = bytes(binary.overlay)

		magic_offset = overlay.find(b"NullsoftInst")

	if "Nullsoft.NSIS.exehead" in manifest:
	return True
	return "Nullsoft.NSIS.exehead" in manifest

Conversation

jcrussell commented Sep 3, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

qkaiser commented Sep 4, 2025

Uh oh!

qkaiser commented Sep 29, 2025

Uh oh!

jcrussell commented Oct 7, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qkaiser commented Oct 15, 2025

Uh oh!

jcrussell commented Oct 17, 2025

Uh oh!

jcrussell commented Oct 17, 2025

Uh oh!

jcrussell commented Nov 28, 2025

Uh oh!

qkaiser commented Jan 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jcrussell commented Feb 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants