onekey-sec/unblob

Add support for truncated CPIO archives

qkaiser opened this issue · 0 comments

We recently analyzed a sample containing a truncated CPIO archive, which led unblob to discard it.

Given that 7z is capable of extracting truncated CPIO archives, we should handle the EOFError that happens when unblob tries to parse the next CPIO header on a truncated file and cleanly break out of the parsing loop.