Wunkolo / UWPDumper

DLL and Injector for dumping UWP applications at run-time to bypass encrypted file system protection.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

DUMP Folder can't be resolved.

DiamondSphinx opened this issue · comments

Microsoft.WindowsCalculator_8wekyb3d8bbwe 20210402T075435.txt
I was trying to dump Nier Automata and I got the error 'The name of the file cannot be resolved by the system.' I then tried to dump Calculator since that is the example. As seen below, I have the same error with dumping Calculator.

Enter ProcessID: 11764
Injecting into remote process: Success!
Waiting for remote thread IPC:
Remote Dumper thread found: 0x7f8
DLL Attached to process 11764
Creating dumper thread1951667488
UWPDumper Build date(Nov 1 2020 : 17:40:30)
-https://github.com/Wunkolo/UWPDumper
Publisher:
CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Publisher ID:
8wekyb3d8bbwe
Publisher Path:
\AppData\Local\Publishers\8wekyb3d8bbwe
Package Path:
C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2101.10.0_x64__8wekyb3d8bbwe
Package Name:
Microsoft.WindowsCalculator_10.2101.10.0_x64__8wekyb3d8bbwe
Family Name:
Microsoft.WindowsCalculator_8wekyb3d8bbwe
Dump Path:
C:\Users\Dark Matter02\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\DUMP
Dumping 220 files
sCalculator_10.2101.10.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 49489 bytes 1/220
Error creating subfolder: C:\Users\Dark Matter02\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\DUMP
The name of the file cannot be resolved by the system.
sCalculator_10.2101.10.0_x64__8wekyb3d8bbwe\AppxManifest.xml 4884 bytes 2/220
Error creating subfolder: C:\Users\Dark Matter02\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\DUMP
The name of the file cannot be resolved by the system.

This was ran through the newest x64 .exe

commented

I'm curious if this is because of the apparent space/line-break in the user's path name between Dark(space)Matter02 causing path resolution issues? I wonder if this is how others have been encountering DUMP folder issues.

Im afraid that regediting to make a user folder w/o a space is a bit more in-depth than what I am comfortable with.
Do you have any other ideas I could test out?

commented

The code seems to be failing here in particular:

if( fs::create_directories(WritePath.parent_path(), ErrorCode) == false && ErrorCode )
{
const std::string ErrorMessage(ErrorCode.message());
std::wstring WErrorMessage;
WErrorMessage.assign(ErrorMessage.begin(), ErrorMessage.end());
IPC::PushMessage(
L"Error creating subfolder: %s\n\t%s\n",
WritePath.parent_path().c_str(),
WErrorMessage.c_str()
);
continue;
}

And I can only fathom that it is due to the fact that your username has a space in it. Though in my testing it seems to work just fine to have spaces and . characters and such mixed into the path.

#include <filesystem>
namespace fs = std::filesystem;

int main()
{
    fs::path WritePath = L".\\Test Space\\Path.With.Dot\\File";
    std::wprintf(L"Writing to path: %s\n", WritePath.c_str());
    std::error_code ErrorCode;
    if( fs::create_directories(WritePath.parent_path(), ErrorCode) == false && ErrorCode )
    {
        const std::string ErrorMessage(ErrorCode.message());
        std::wstring WErrorMessage;
        WErrorMessage.assign(ErrorMessage.begin(), ErrorMessage.end());
        std::wprintf(
            L"Error creating subfolder: %s\n\t%s\n",
            WritePath.parent_path().c_str(),
            WErrorMessage.c_str()
        );
    }
}

So this is likely not the case.. I'm at a bit of a loss as to what part of the path it is failing to resolve. Somewhere in the MSVC implementation of create_directories is causing ERROR_CANT_RESOLVE_FILENAME to be called when resolving paths such as C:\Users\Dark Matter02\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\DUMP. At least from within UWP...

On a whim I tried to dump calculator again today and it worked. I have no clue why it works now. I have made no changes to anything at all.
Update: It worked twice before failing again.
Update2: After rebooting it is working consistently....

commented

Curious if there is any kind of consistency to pick out from this in case anyone else runs into this. Def don't want to have an rng-based dumper.