Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

olevba.py - vba of normal office file decompressed stop by raise exception #72

Open
fooofei opened this issue Jul 26, 2016 · 0 comments

Comments

@fooofei
Copy link

fooofei commented Jul 26, 2016

test sample hash : 339cb2460f5b7dcf7122e01f95e8d112

use:
vbaparser = olevba.VBA_Parser(this_file_path)
for v in vbaparser.extract_all_macros():
pass

parse result error message:
File "C:\Python27\lib\site-packages\oletools\olevba.py", line 1051, in decompress_stream
raise ValueError('invalid signature byte {0:02X}'.format(sig_byte))
ValueError: invalid signature byte 00

my opinion :
this file in _VBA_PROJECT_CUR/VBA/StartUp is not contain vba macro , but , we suppose it contains macro , and then to decompressed it . in [ oletools\olevba.py, line 1051 ] , we force to check signature , if not passed , we raise exception . I think we should pre check signature in [ oletools\olevba.py , line 1598 ] , change code [ if len(code_data) > 0 :] to [if len(code_data) > 0 and ord(code_data[0])== 0x01:] , by this, if the stream not contains macro , it will continue decompress the rest stream .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants