You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
test sample hash : 339cb2460f5b7dcf7122e01f95e8d112
use:
vbaparser = olevba.VBA_Parser(this_file_path)
for v in vbaparser.extract_all_macros():
pass
parse result error message:
File "C:\Python27\lib\site-packages\oletools\olevba.py", line 1051, in decompress_stream
raise ValueError('invalid signature byte {0:02X}'.format(sig_byte))
ValueError: invalid signature byte 00
my opinion :
this file in _VBA_PROJECT_CUR/VBA/StartUp is not contain vba macro , but , we suppose it contains macro , and then to decompressed it . in [ oletools\olevba.py, line 1051 ] , we force to check signature , if not passed , we raise exception . I think we should pre check signature in [ oletools\olevba.py , line 1598 ] , change code [ if len(code_data) > 0 :] to [if len(code_data) > 0 and ord(code_data[0])== 0x01:] , by this, if the stream not contains macro , it will continue decompress the rest stream .
The text was updated successfully, but these errors were encountered:
test sample hash : 339cb2460f5b7dcf7122e01f95e8d112
use:
vbaparser = olevba.VBA_Parser(this_file_path)
for v in vbaparser.extract_all_macros():
pass
parse result error message:
File "C:\Python27\lib\site-packages\oletools\olevba.py", line 1051, in decompress_stream
raise ValueError('invalid signature byte {0:02X}'.format(sig_byte))
ValueError: invalid signature byte 00
my opinion :
this file in _VBA_PROJECT_CUR/VBA/StartUp is not contain vba macro , but , we suppose it contains macro , and then to decompressed it . in [ oletools\olevba.py, line 1051 ] , we force to check signature , if not passed , we raise exception . I think we should pre check signature in [ oletools\olevba.py , line 1598 ] , change code [ if len(code_data) > 0 :] to [if len(code_data) > 0 and ord(code_data[0])== 0x01:] , by this, if the stream not contains macro , it will continue decompress the rest stream .
The text was updated successfully, but these errors were encountered: