Base64 encode Input containing Null Bytes












0















A PHP based website returns me a base64 encoded string which is base64 encoding of serialized data. When I manually base64 encode the decoded string, I get a different result.



So, I looked into it further and realised that the serialized data contains null bytes.



Base64 encoded string:



TzoxMDoiRXhwcmVzc2lvbiI6Mzp7czoxNDoiAEV4cHJlc3Npb24Ab3AiO3M6MzoiZGl2IjtzOjE4OiIARXhwcmVzc2lvbgBwYXJhbXMiO2E6Mjp7aTowO2Q6ODtpOjE7ZDoyO31zOjk6InN0cmluZ2lmeSI7czo1OiI4IC8gMiI7fQ==



Below is the hexdump of the base64 decoded string:



$ echo "TzoxMDoiRXhwcmVzc2lvbiI6Mzp7czoxNDoiAEV4cHJlc3Npb24Ab3AiO3M6MzoiZGl2IjtzOjE4OiIARXhwcmVzc2lvbgBwYXJhbXMiO2E6Mjp7aTowO2Q6ODtpOjE7ZDoyO31zOjk6InN0cmluZ2lmeSI7czo1OiI4IC8gMiI7fQ==" | base64 -D | hexdump -C
00000000 4f 3a 31 30 3a 22 45 78 70 72 65 73 73 69 6f 6e |O:10:"Expression|
00000010 22 3a 33 3a 7b 73 3a 31 34 3a 22 00 45 78 70 72 |":3:{s:14:".Expr|
00000020 65 73 73 69 6f 6e 00 6f 70 22 3b 73 3a 33 3a 22 |ession.op";s:3:"|
00000030 64 69 76 22 3b 73 3a 31 38 3a 22 00 45 78 70 72 |div";s:18:".Expr|
00000040 65 73 73 69 6f 6e 00 70 61 72 61 6d 73 22 3b 61 |ession.params";a|
00000050 3a 32 3a 7b 69 3a 30 3b 64 3a 38 3b 69 3a 31 3b |:2:{i:0;d:8;i:1;|
00000060 64 3a 32 3b 7d 73 3a 39 3a 22 73 74 72 69 6e 67 |d:2;}s:9:"string|
00000070 69 66 79 22 3b 73 3a 35 3a 22 38 20 2f 20 32 22 |ify";s:5:"8 / 2"|
00000080 3b 7d |;}|


As you can see, it contains null bytes.



So, how can I base64 encode a string like this if it contains null bytes?



I would like to make some modifications to the serialized data and then base64 encode it again.



How can I include null bytes in a string before encoding it?



Because strings are terminated at null bytes in PHP and Python per my understanding.



If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.



$t = "O:10:"Expression":3:{s:14:"Expressionop";s:3:"div";s:18:"Expressionparams";a:2:{i:0;d:8;i:1;d:2;}s:9:"stringify";s:5:"8 / 2";}"



I am using to represent null bytes but looks like that is not the correct representation of null bytes.



A solution in PHP or Python would be great.



Thanks.










share|improve this question

























  • What actual problem are you trying to solve here? serialized PHP contains null bytes, and stripping them out is just going to mean the serialized string is no longer the same (or even valid). If you've resorted to a hex editor, you've probably gone a step further than you need to.

    – iainn
    Nov 23 '18 at 15:44













  • “If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.” - but why would you do that in the first place? If you want to modify something about the serialized object you got there, then unserialize it first, use the proper methods to change whatever has to change about this object - and then serialize and base64 encode it back …? (PHP itself introduces those NUL bytes, stackoverflow.com/q/45756514/10283047. but that is probably not something you should try and emulate yourself.)

    – misorude
    Nov 23 '18 at 15:44













  • “I am using to represent null bytes but looks like that is not the correct representation of null bytes.” - only in a double-quote string, not in a single-quoted one. FYI, chr(0) also exist. But again, that is probably not what you should be doing here in the first place …

    – misorude
    Nov 23 '18 at 15:48













  • Python does not use null-terminated strings; it has no problem working with strings containing null bytes.

    – PM 2Ring
    Nov 23 '18 at 17:19
















0















A PHP based website returns me a base64 encoded string which is base64 encoding of serialized data. When I manually base64 encode the decoded string, I get a different result.



So, I looked into it further and realised that the serialized data contains null bytes.



Base64 encoded string:



TzoxMDoiRXhwcmVzc2lvbiI6Mzp7czoxNDoiAEV4cHJlc3Npb24Ab3AiO3M6MzoiZGl2IjtzOjE4OiIARXhwcmVzc2lvbgBwYXJhbXMiO2E6Mjp7aTowO2Q6ODtpOjE7ZDoyO31zOjk6InN0cmluZ2lmeSI7czo1OiI4IC8gMiI7fQ==



Below is the hexdump of the base64 decoded string:



$ echo "TzoxMDoiRXhwcmVzc2lvbiI6Mzp7czoxNDoiAEV4cHJlc3Npb24Ab3AiO3M6MzoiZGl2IjtzOjE4OiIARXhwcmVzc2lvbgBwYXJhbXMiO2E6Mjp7aTowO2Q6ODtpOjE7ZDoyO31zOjk6InN0cmluZ2lmeSI7czo1OiI4IC8gMiI7fQ==" | base64 -D | hexdump -C
00000000 4f 3a 31 30 3a 22 45 78 70 72 65 73 73 69 6f 6e |O:10:"Expression|
00000010 22 3a 33 3a 7b 73 3a 31 34 3a 22 00 45 78 70 72 |":3:{s:14:".Expr|
00000020 65 73 73 69 6f 6e 00 6f 70 22 3b 73 3a 33 3a 22 |ession.op";s:3:"|
00000030 64 69 76 22 3b 73 3a 31 38 3a 22 00 45 78 70 72 |div";s:18:".Expr|
00000040 65 73 73 69 6f 6e 00 70 61 72 61 6d 73 22 3b 61 |ession.params";a|
00000050 3a 32 3a 7b 69 3a 30 3b 64 3a 38 3b 69 3a 31 3b |:2:{i:0;d:8;i:1;|
00000060 64 3a 32 3b 7d 73 3a 39 3a 22 73 74 72 69 6e 67 |d:2;}s:9:"string|
00000070 69 66 79 22 3b 73 3a 35 3a 22 38 20 2f 20 32 22 |ify";s:5:"8 / 2"|
00000080 3b 7d |;}|


As you can see, it contains null bytes.



So, how can I base64 encode a string like this if it contains null bytes?



I would like to make some modifications to the serialized data and then base64 encode it again.



How can I include null bytes in a string before encoding it?



Because strings are terminated at null bytes in PHP and Python per my understanding.



If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.



$t = "O:10:"Expression":3:{s:14:"Expressionop";s:3:"div";s:18:"Expressionparams";a:2:{i:0;d:8;i:1;d:2;}s:9:"stringify";s:5:"8 / 2";}"



I am using to represent null bytes but looks like that is not the correct representation of null bytes.



A solution in PHP or Python would be great.



Thanks.










share|improve this question

























  • What actual problem are you trying to solve here? serialized PHP contains null bytes, and stripping them out is just going to mean the serialized string is no longer the same (or even valid). If you've resorted to a hex editor, you've probably gone a step further than you need to.

    – iainn
    Nov 23 '18 at 15:44













  • “If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.” - but why would you do that in the first place? If you want to modify something about the serialized object you got there, then unserialize it first, use the proper methods to change whatever has to change about this object - and then serialize and base64 encode it back …? (PHP itself introduces those NUL bytes, stackoverflow.com/q/45756514/10283047. but that is probably not something you should try and emulate yourself.)

    – misorude
    Nov 23 '18 at 15:44













  • “I am using to represent null bytes but looks like that is not the correct representation of null bytes.” - only in a double-quote string, not in a single-quoted one. FYI, chr(0) also exist. But again, that is probably not what you should be doing here in the first place …

    – misorude
    Nov 23 '18 at 15:48













  • Python does not use null-terminated strings; it has no problem working with strings containing null bytes.

    – PM 2Ring
    Nov 23 '18 at 17:19














0












0








0








A PHP based website returns me a base64 encoded string which is base64 encoding of serialized data. When I manually base64 encode the decoded string, I get a different result.



So, I looked into it further and realised that the serialized data contains null bytes.



Base64 encoded string:



TzoxMDoiRXhwcmVzc2lvbiI6Mzp7czoxNDoiAEV4cHJlc3Npb24Ab3AiO3M6MzoiZGl2IjtzOjE4OiIARXhwcmVzc2lvbgBwYXJhbXMiO2E6Mjp7aTowO2Q6ODtpOjE7ZDoyO31zOjk6InN0cmluZ2lmeSI7czo1OiI4IC8gMiI7fQ==



Below is the hexdump of the base64 decoded string:



$ echo "TzoxMDoiRXhwcmVzc2lvbiI6Mzp7czoxNDoiAEV4cHJlc3Npb24Ab3AiO3M6MzoiZGl2IjtzOjE4OiIARXhwcmVzc2lvbgBwYXJhbXMiO2E6Mjp7aTowO2Q6ODtpOjE7ZDoyO31zOjk6InN0cmluZ2lmeSI7czo1OiI4IC8gMiI7fQ==" | base64 -D | hexdump -C
00000000 4f 3a 31 30 3a 22 45 78 70 72 65 73 73 69 6f 6e |O:10:"Expression|
00000010 22 3a 33 3a 7b 73 3a 31 34 3a 22 00 45 78 70 72 |":3:{s:14:".Expr|
00000020 65 73 73 69 6f 6e 00 6f 70 22 3b 73 3a 33 3a 22 |ession.op";s:3:"|
00000030 64 69 76 22 3b 73 3a 31 38 3a 22 00 45 78 70 72 |div";s:18:".Expr|
00000040 65 73 73 69 6f 6e 00 70 61 72 61 6d 73 22 3b 61 |ession.params";a|
00000050 3a 32 3a 7b 69 3a 30 3b 64 3a 38 3b 69 3a 31 3b |:2:{i:0;d:8;i:1;|
00000060 64 3a 32 3b 7d 73 3a 39 3a 22 73 74 72 69 6e 67 |d:2;}s:9:"string|
00000070 69 66 79 22 3b 73 3a 35 3a 22 38 20 2f 20 32 22 |ify";s:5:"8 / 2"|
00000080 3b 7d |;}|


As you can see, it contains null bytes.



So, how can I base64 encode a string like this if it contains null bytes?



I would like to make some modifications to the serialized data and then base64 encode it again.



How can I include null bytes in a string before encoding it?



Because strings are terminated at null bytes in PHP and Python per my understanding.



If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.



$t = "O:10:"Expression":3:{s:14:"Expressionop";s:3:"div";s:18:"Expressionparams";a:2:{i:0;d:8;i:1;d:2;}s:9:"stringify";s:5:"8 / 2";}"



I am using to represent null bytes but looks like that is not the correct representation of null bytes.



A solution in PHP or Python would be great.



Thanks.










share|improve this question
















A PHP based website returns me a base64 encoded string which is base64 encoding of serialized data. When I manually base64 encode the decoded string, I get a different result.



So, I looked into it further and realised that the serialized data contains null bytes.



Base64 encoded string:



TzoxMDoiRXhwcmVzc2lvbiI6Mzp7czoxNDoiAEV4cHJlc3Npb24Ab3AiO3M6MzoiZGl2IjtzOjE4OiIARXhwcmVzc2lvbgBwYXJhbXMiO2E6Mjp7aTowO2Q6ODtpOjE7ZDoyO31zOjk6InN0cmluZ2lmeSI7czo1OiI4IC8gMiI7fQ==



Below is the hexdump of the base64 decoded string:



$ echo "TzoxMDoiRXhwcmVzc2lvbiI6Mzp7czoxNDoiAEV4cHJlc3Npb24Ab3AiO3M6MzoiZGl2IjtzOjE4OiIARXhwcmVzc2lvbgBwYXJhbXMiO2E6Mjp7aTowO2Q6ODtpOjE7ZDoyO31zOjk6InN0cmluZ2lmeSI7czo1OiI4IC8gMiI7fQ==" | base64 -D | hexdump -C
00000000 4f 3a 31 30 3a 22 45 78 70 72 65 73 73 69 6f 6e |O:10:"Expression|
00000010 22 3a 33 3a 7b 73 3a 31 34 3a 22 00 45 78 70 72 |":3:{s:14:".Expr|
00000020 65 73 73 69 6f 6e 00 6f 70 22 3b 73 3a 33 3a 22 |ession.op";s:3:"|
00000030 64 69 76 22 3b 73 3a 31 38 3a 22 00 45 78 70 72 |div";s:18:".Expr|
00000040 65 73 73 69 6f 6e 00 70 61 72 61 6d 73 22 3b 61 |ession.params";a|
00000050 3a 32 3a 7b 69 3a 30 3b 64 3a 38 3b 69 3a 31 3b |:2:{i:0;d:8;i:1;|
00000060 64 3a 32 3b 7d 73 3a 39 3a 22 73 74 72 69 6e 67 |d:2;}s:9:"string|
00000070 69 66 79 22 3b 73 3a 35 3a 22 38 20 2f 20 32 22 |ify";s:5:"8 / 2"|
00000080 3b 7d |;}|


As you can see, it contains null bytes.



So, how can I base64 encode a string like this if it contains null bytes?



I would like to make some modifications to the serialized data and then base64 encode it again.



How can I include null bytes in a string before encoding it?



Because strings are terminated at null bytes in PHP and Python per my understanding.



If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.



$t = "O:10:"Expression":3:{s:14:"Expressionop";s:3:"div";s:18:"Expressionparams";a:2:{i:0;d:8;i:1;d:2;}s:9:"stringify";s:5:"8 / 2";}"



I am using to represent null bytes but looks like that is not the correct representation of null bytes.



A solution in PHP or Python would be great.



Thanks.







php python base64






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 23 '18 at 15:41







Neon Flash

















asked Nov 23 '18 at 15:32









Neon FlashNeon Flash

1,28183769




1,28183769













  • What actual problem are you trying to solve here? serialized PHP contains null bytes, and stripping them out is just going to mean the serialized string is no longer the same (or even valid). If you've resorted to a hex editor, you've probably gone a step further than you need to.

    – iainn
    Nov 23 '18 at 15:44













  • “If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.” - but why would you do that in the first place? If you want to modify something about the serialized object you got there, then unserialize it first, use the proper methods to change whatever has to change about this object - and then serialize and base64 encode it back …? (PHP itself introduces those NUL bytes, stackoverflow.com/q/45756514/10283047. but that is probably not something you should try and emulate yourself.)

    – misorude
    Nov 23 '18 at 15:44













  • “I am using to represent null bytes but looks like that is not the correct representation of null bytes.” - only in a double-quote string, not in a single-quoted one. FYI, chr(0) also exist. But again, that is probably not what you should be doing here in the first place …

    – misorude
    Nov 23 '18 at 15:48













  • Python does not use null-terminated strings; it has no problem working with strings containing null bytes.

    – PM 2Ring
    Nov 23 '18 at 17:19



















  • What actual problem are you trying to solve here? serialized PHP contains null bytes, and stripping them out is just going to mean the serialized string is no longer the same (or even valid). If you've resorted to a hex editor, you've probably gone a step further than you need to.

    – iainn
    Nov 23 '18 at 15:44













  • “If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.” - but why would you do that in the first place? If you want to modify something about the serialized object you got there, then unserialize it first, use the proper methods to change whatever has to change about this object - and then serialize and base64 encode it back …? (PHP itself introduces those NUL bytes, stackoverflow.com/q/45756514/10283047. but that is probably not something you should try and emulate yourself.)

    – misorude
    Nov 23 '18 at 15:44













  • “I am using to represent null bytes but looks like that is not the correct representation of null bytes.” - only in a double-quote string, not in a single-quoted one. FYI, chr(0) also exist. But again, that is probably not what you should be doing here in the first place …

    – misorude
    Nov 23 '18 at 15:48













  • Python does not use null-terminated strings; it has no problem working with strings containing null bytes.

    – PM 2Ring
    Nov 23 '18 at 17:19

















What actual problem are you trying to solve here? serialized PHP contains null bytes, and stripping them out is just going to mean the serialized string is no longer the same (or even valid). If you've resorted to a hex editor, you've probably gone a step further than you need to.

– iainn
Nov 23 '18 at 15:44







What actual problem are you trying to solve here? serialized PHP contains null bytes, and stripping them out is just going to mean the serialized string is no longer the same (or even valid). If you've resorted to a hex editor, you've probably gone a step further than you need to.

– iainn
Nov 23 '18 at 15:44















“If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.” - but why would you do that in the first place? If you want to modify something about the serialized object you got there, then unserialize it first, use the proper methods to change whatever has to change about this object - and then serialize and base64 encode it back …? (PHP itself introduces those NUL bytes, stackoverflow.com/q/45756514/10283047. but that is probably not something you should try and emulate yourself.)

– misorude
Nov 23 '18 at 15:44







“If I represent the string as shown below in PHP and base64 encode it, I get incorrect results.” - but why would you do that in the first place? If you want to modify something about the serialized object you got there, then unserialize it first, use the proper methods to change whatever has to change about this object - and then serialize and base64 encode it back …? (PHP itself introduces those NUL bytes, stackoverflow.com/q/45756514/10283047. but that is probably not something you should try and emulate yourself.)

– misorude
Nov 23 '18 at 15:44















“I am using to represent null bytes but looks like that is not the correct representation of null bytes.” - only in a double-quote string, not in a single-quoted one. FYI, chr(0) also exist. But again, that is probably not what you should be doing here in the first place …

– misorude
Nov 23 '18 at 15:48







“I am using to represent null bytes but looks like that is not the correct representation of null bytes.” - only in a double-quote string, not in a single-quoted one. FYI, chr(0) also exist. But again, that is probably not what you should be doing here in the first place …

– misorude
Nov 23 '18 at 15:48















Python does not use null-terminated strings; it has no problem working with strings containing null bytes.

– PM 2Ring
Nov 23 '18 at 17:19





Python does not use null-terminated strings; it has no problem working with strings containing null bytes.

– PM 2Ring
Nov 23 '18 at 17:19












0






active

oldest

votes











Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53449390%2fbase64-encode-input-containing-null-bytes%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes
















draft saved

draft discarded




















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53449390%2fbase64-encode-input-containing-null-bytes%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

404 Error Contact Form 7 ajax form submitting

How to know if a Active Directory user can login interactively

TypeError: fit_transform() missing 1 required positional argument: 'X'