Downloads · 30 days
0
scanner-bypass-ptzip-int-desync
TESTforge42/scanner-bypass-ptzip-int-desync
scanner-bypass-ptzip-int-desync is a machine learning model from TESTforge42. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as apache-2.0.
Benign security-research PoC for the huntr Model File Format program. Payload writes only a nonce marker (echo) — no real harm. A modern PyTorch .pt is a ZIP archive; torch.load reads archive/data.pkl. Both picklescan…
Access
Public
Updated Jul 24, 2026
Repo size
874 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 42%
At a glance
- License
- apache-2.0
- Access
- Public
- Created
- Jul 24, 2026
- Updated
- Jul 24, 2026
- SHA
- 7a4bb10c
Model card
From the Hugging Face model README
picklescan & ModelScan bypass: PyTorch .pt ZIP archive with an INT-opcode desync in data.pkl
Benign security-research PoC for the huntr Model File Format program. Payload writes only a nonce marker (echo) — no real harm.
Vulnerability
A modern PyTorch .pt is a ZIP archive; torch.load reads archive/data.pkl. Both picklescan and ModelScan recurse into the .pt archive and scan data.pkl (control: BOTH catch a plain malicious .pt). This PoC is a REAL torch.save archive whose data.pkl carries the INT-opcode desync prefix "I0x10\n": pickletools.genops parses base-10 and aborts before the payload, while torch.load(weights_only=False) parses "0x10" base-0 and executes the reduce payload (arbitrary code execution at load). Defeats the archive-recursion scan on the exact format huntr receives ($1500 tier).
Measured (2026-07-24): picklescan 1.0.5 exit 0; ModelScan 0.8.8 no issue; torch.load(weights_only=False) fires the benign marker.
Reproduce
import torch
torch.load("model.pt", weights_only=False) # fires the benign marker
picklescan -p model.pt # exit 0
modelscan -p model.pt # no issue
- License
- apache-2.0
- Created
- Jul 24, 2026
- Updated
- Jul 24, 2026