1

I'm having trouble decoding a ASP.NET view state string in Python 3. When I try decoding the string using bash's base64 command, it decodes the string successfully and I'm able to see all the information I need (most of it is in Hebrew, meaning UTF-8). The view state is of course base64-encoded only and not encrypted.

However, when I try do decode the string using Python's base64 library and then decoding the byte array to a UTF-8 string, I get an error message:

UnicodeDecodeError: 'utf-8' codec can't decode byte 0xff in position 0: invalid start byte

I should mention that since the string is a view state, the first few bytes are binary data and "0xff" makes sense, however after these bytes the data is readable.

Python 3 code segment:

b = "The_ViewState"
print(base64.b64decode(b).decode("utf-8"))

Why does decoding work in bash and not in Python? How can this be resolved?

mittelmania
  • 3,393
  • 4
  • 23
  • 48
  • Presumably Bash is ignoring bytes it cannot decode, not a good option in a programming environment where invalid input may be an error. Why not just skip those first few bytes? – Martijn Pieters Mar 26 '15 at 17:44
  • You did not share your Bash code, however, nor any sample viewstate string. – Martijn Pieters Mar 26 '15 at 17:44
  • Besides, the viewstate contains a whole *object graph*, you need to actually parse those binary bits to get to the interesting data. – Martijn Pieters Mar 26 '15 at 17:50
  • In short, you'd need to write a parser for the Microsoft LOS format; this is not necessarily trivial! See https://msdn.microsoft.com/en-us/library/ms972976.aspx#viewstate_topic11 for a starting point; the binary values are probably [object type identifiers](https://msdn.microsoft.com/en-us/library/system.web.ui.objectstateformatter(VS.80).aspx). – Martijn Pieters Mar 26 '15 at 17:55

2 Answers2

2

After a little bit of research I found the answer:

b = "The_ViewState"
print(base64.b64decode(b).decode("utf-8", "ignore"))

Adding the "ignore" flag causes decode() to discard any invalid byte sequences, thus leaving the irrelevant bytes out of the decoded string.

mittelmania
  • 3,393
  • 4
  • 23
  • 48
-1

Best way is use this link.

A small Python 3.5+ library for decoding ASP.NET viewstate.

First install that: pip install viewstate

>>> from viewstate import ViewState
>>> base64_encoded_viewstate = '/wEPBQVhYmNkZQ9nAgE='
>>> vs = ViewState(base64_encoded_viewstate)
>>> vs.decode()
('abcde', (True, 1))
henrry
  • 486
  • 6
  • 25