1

I'm having trouble decoding a ASP.NET view state string in Python 3. When I try decoding the string using bash's base64 command, it decodes the string successfully and I'm able to see all the information I need (most of it is in Hebrew, meaning UTF-8). The view state is of course base64-encoded only and not encrypted.

However, when I try do decode the string using Python's base64 library and then decoding the byte array to a UTF-8 string, I get an error message:

UnicodeDecodeError: 'utf-8' codec can't decode byte 0xff in position 0: invalid start byte

I should mention that since the string is a view state, the first few bytes are binary data and "0xff" makes sense, however after these bytes the data is readable.

Python 3 code segment:

b = "The_ViewState"
print(base64.b64decode(b).decode("utf-8"))

Why does decoding work in bash and not in Python? How can this be resolved?

4
  • Presumably Bash is ignoring bytes it cannot decode, not a good option in a programming environment where invalid input may be an error. Why not just skip those first few bytes?
    – Martijn Pieters
    Mar 26, 2015 at 17:44
  • You did not share your Bash code, however, nor any sample viewstate string.
    – Martijn Pieters
    Mar 26, 2015 at 17:44
  • Besides, the viewstate contains a whole object graph, you need to actually parse those binary bits to get to the interesting data.
    – Martijn Pieters
    Mar 26, 2015 at 17:50
  • In short, you'd need to write a parser for the Microsoft LOS format; this is not necessarily trivial! See msdn.microsoft.com/en-us/library/… for a starting point; the binary values are probably object type identifiers.
    – Martijn Pieters
    Mar 26, 2015 at 17:55

2 Answers 2

2

After a little bit of research I found the answer:

b = "The_ViewState"
print(base64.b64decode(b).decode("utf-8", "ignore"))

Adding the "ignore" flag causes decode() to discard any invalid byte sequences, thus leaving the irrelevant bytes out of the decoded string.

-1

Best way is use this link.

A small Python 3.5+ library for decoding ASP.NET viewstate.

First install that: pip install viewstate

>>> from viewstate import ViewState
>>> base64_encoded_viewstate = '/wEPBQVhYmNkZQ9nAgE='
>>> vs = ViewState(base64_encoded_viewstate)
>>> vs.decode()
('abcde', (True, 1))
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.