| license: apache-2.0 | |
| tags: [security-research, huntr, model-file-security, scanner-bypass] | |
| # picklescan & ModelScan bypass: LONG-opcode parser desync (read_decimalnl_long base-10 vs C base-0) | |
| **Benign security-research PoC** for the huntr Model File Format program. The payload only writes a nonce marker file (`echo` / `io.open`) — no real harm, no network, no secrets (huntr §benign). | |
| ## Vulnerability | |
| The L (LONG) opcode's newline-terminated int is parsed base-10 by pickletools.read_decimalnl_long but base-0 by the C unpickler. `L0x10L\n` makes both scanners' genops walk raise+abort before the payload, while pickle/torch.load run it. Distinct opcode + distinct reader from the INT-opcode (int-desync) variant. | |
| ## Measured evidence (2026-07-24) | |
| Against picklescan 1.0.5 + ModelScan 0.8.8: both fail to flag; on load the benign marker fires. Re-verify: `python -m nomos_redteam scanbypass`. | |
| ## Reproduce | |
| ```python | |
| import torch # or: import pickle | |
| obj = torch.load("model.pt", weights_only=False) # fires the benign marker at load | |
| ``` | |
| Scan first to confirm the bypass: | |
| ```bash | |
| picklescan -p model.pt # exit 0 / no dangerous global | |
| modelscan -p model.pt # no issue reported | |
| ``` | |