scanner-bypass-long-desync

picklescan & ModelScan bypass: LONG-opcode parser desync (read_decimalnl_long base-10 vs C base-0)

Benign security-research PoC for the huntr Model File Format program. The payload only writes a nonce marker file (echo / io.open) — no real harm, no network, no secrets (huntr §benign).

Vulnerability

The L (LONG) opcode's newline-terminated int is parsed base-10 by pickletools.read_decimalnl_long but base-0 by the C unpickler. L0x10L\n makes both scanners' genops walk raise+abort before the payload, while pickle/torch.load run it. Distinct opcode + distinct reader from the INT-opcode (int-desync) variant.

Measured evidence (2026-07-24)

Against picklescan 1.0.5 + ModelScan 0.8.8: both fail to flag; on load the benign marker fires. Re-verify: python -m nomos_redteam scanbypass.

Reproduce

import torch  # or: import pickle
obj = torch.load("model.pt", weights_only=False)   # fires the benign marker at load

Scan first to confirm the bypass:

picklescan -p model.pt      # exit 0 / no dangerous global
modelscan -p model.pt        # no issue reported