UnicodeDecode Error on OSX 10.9.4 with python 2.7.5

[varun06]

I ran the osxauditor and got following error:

Traceback (most recent call last):
  File "osxauditor.py", line 1702, in 
    Main()
  File "osxauditor.py", line 1657, in Main
    ParseQuarantines()
  File "osxauditor.py", line 440, in ParseQuarantines
    JointLSQuarantineEvent += u";" + unicode(Q)
UnicodeDecodeError: 'ascii' codec can't decode byte 0x9c in position 4: ordinal not in range(128)

I am also trying to figure out and fix it, but thought to log it so that you are aware of this.

[aemonfly]

came across the same error

[BeastsMC]

Got same error. Could not install pyobjc so had to install biplist and plist separately, not sure if related.

[varun06]

There is a PR := #16

I made those changes and not getting endcodedecode error anymore, but I am getting some other error. So yeah, I will keep looking for the changes and see if it works.

[mishu-]

I got it on a different line, OSX 10.7.5:

Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1651, in Main
    ParseStartup()
  File "osxauditor.py", line 553, in ParseStartup
    PrintAndLog(CustomListItem["Name"].decode("utf-8") + u" - " + binascii.hexlify(CustomListItem["Alias"]).decode("hex").decode("utf-8", "ignore"), "INFO")
  File "osxauditor.py", line 224, in PrintAndLog
    print(u"[INFO] " + LogStr)
UnicodeEncodeError: 'ascii' codec can't encode character u'\u0408' in position 52: ordinal not in range(128)

[joaquinmoreira]

Same here:

Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1657, in Main
    ParseQuarantines()
  File "osxauditor.py", line 440, in ParseQuarantines
    JointLSQuarantineEvent += u";" + unicode(Q)
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc4 in position 248: ordinal not in range(128)

[superponible]

Got the same error. Bit of a hack, but here's what I did to get around it:

                try:
                    JointLSQuarantineEvent += u";" + unicode(Q)
                except UnicodeDecodeError as e:
                    JointLSQuarantineEvent += u";" + unicode("NONASCII")
                    PrintAndLog(unicode(e).decode("utf-8") + u"\n".decode("utf-8"), "ERROR")

[superponible]

I also received it on

PrintAndLog(CustomListItem["Name"].decode("utf-8", "ignore") + u" - " + binascii.hexlify(CustomListItem["Alias"]).decode("hex").decode("utf-8", "ignore"), "INFO")

But only when redirecting output to a file. I fixed it by running like this:

PYTHONIOENCODING=UTF-8 python osxauditor.py ...

See https://stackoverflow.com/questions/4545661/unicodedecodeerror-when-redirecting-to-file for reference.

[cklein]

"Sometimes" the strings are encoded using UTF-16.
It would be nice to let CoreFoundation do the dirty work.
So far, I only got some results with the old and deprecated Carbon module