srch_strings on OS X

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

srch_strings on OS X

Postby jmonmane » Wed Jan 27, 2016 6:26 am

Anybody now having problems with srch_strings on OS X?
I first noticed it with my 10.10 machine but also got the same behavior with 10.11. I'm getting an error of this variant:

srch_strings(2275,0x7fff796d5000) malloc: *** error for object 0x7f95894032e0: pointer being freed was not allocated

Originally had sleuthkit installed via homebrew, I tried uninstalling and installing from source with same results. I've noticed it throws this error message whenever it encounters a new line character. If I do a search that yields no strings it won't throw an error, e.g. if I do
Code: Select all
srch_strings -e b newfile.txt
, (knowing the file is not big endian) it just doesn't give any results, as expected. However, if there are valid strings in a file it will give me the first line worth of strings until it encounters the first new line character and then throws the error. Caveat, if the file starts with a blank line it doesn't error until the next CR/LF.

Code: Select all
└─ $ ▶ cat newfile.txt
## first line of text here
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-gb" xml:lang="en-gb">
## end of text

└─ $ ▶ srch_strings newfile.txt
## first line of text here
srch_strings(3874,0x7fff796d5000) malloc: *** error for object 0x7f82d8f00100: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
<!DOAbort trap: 6


-Please let me know if you have any ideas :)
// jmonmane
jmonmane
 
Posts: 1
Joined: Wed Jan 27, 2016 6:04 am

Re: srch_strings on OS X

Postby bbowman » Sat Mar 18, 2017 8:29 pm

bumping this as I'm having the same thing on MacOS Sierra


srch_strings rip.pl > test.txt
srch_strings(50992,0x7fff73ba2000) malloc: *** error for object 0x7f9a0ac032f0: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
Abort trap: 6
bbowman
 
Posts: 1
Joined: Sat Mar 18, 2017 8:28 pm


Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: No registered users and 1 guest