squiblydoo/debloat

A GUI and CLI tool for removing bloat from executables

debloat's Issues

Integration issue - NSIS processing path divergence

With 1.5.0 the ability to extract NSIS Installer contents the Debloat execution flow does not follow the normal execution path when a NSIS execution is detected. The plan is to solve this in a coming version (SOON).

Diverting from the normal execution path originally was intentional for the following reasons:

1. NSIS files will always result in multiple files. It is unclear how multiple file output is handled by karton or assembly-line.
2. With the multiple files, debloat is unable to determine if any are suspicious/malicious and chooses to return all of them to the user.
3. The current main execution flow is only expected to return 1 file. Normally a file that has had bytes removed.

Because of these reasons, Debloat has unique output and writes the files at a unique place.
The plan is to explore options to help maintain the expected return path for consistency and to maintain compatibility with tools like karton and assembly-line.

(I am writing about it here so that others are aware it is a problem, that is is a problem that I am aware of, and that it is a problem that I plan to solve.)

.NET Single File Binaries

Another method of bloat that cannot be solved at this time includes use of the .NET Single File feature.
Tony wrote about analyzing such a DuckTail sample here: https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/

The following samples are being used as a POC for a solution:
7b9779a86781667aef8bfd44225deb0aaa61e0e7dbaa1ec1f3d3e3ec99bf5282
9a55f8490f17e095899df8bd57cbc2e8a451f01573d3763fb87d9186addc7d4e

These samples both have 460 DLL included in the Single File .NET binary. The sample Tony analyzed had 94 PE. In my observation, this number is growing over time with the result of binaries getting larger.
The files identified by those hashes are 184 MB.

NSIS sample does not extract- failure not handled

In using debloat I identified that this NSIS installer did not extract properly: SHA256: F4A2677E8411FCE6307CDC54A814331BB281D3DD9EA797A4F4BB9D4A496A92CE

The NSIS file could be extracted with Binary Refinery.

• Review current errors, implement error handling for future.
• Resolve issue causing error.
• Find additional NSIS files to confirm that issue is resolved and confirm that other NSIS files extract successfully.

License file

Hi, great project, really useful!

Would you mind adding a license file to your project?
Github has a handy guide on it: https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/adding-a-license-to-a-repository
Using repositories without a proper license is a very gray area copyright-wise and we'd like to include it as a module in one of our projects

Thanks!