Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Olevba: Add switch parameter to choose either XLMMacroDeobfuscator or plugin_biff for XLM-macros analysis #748

Open
antmaxi opened this issue Feb 25, 2022 · 1 comment

Comments

@antmaxi
Copy link

antmaxi commented Feb 25, 2022

At the moment XLMMacroDeobfuscator can't process files like .slk (it's not supported file extension there)

However, if XLMMacroDeobfuscator is installed, it is automatically used for xlm-analysis in the current code, so one can't choose to use plugin_biff (one can only disable XLM-analysis fully with --no-xlm)

from XLMMacroDeobfuscator import deobfuscator as xlmdeobfuscator

Because of that, either slk of xlsb+ files are not processed in any case, missing some possible malware

I suggest having command line parameter allowing to choose what to use for XML-processing explicitly

@decalage2 decalage2 self-assigned this Feb 26, 2022
@decalage2 decalage2 added this to the oletools 0.60 milestone Feb 26, 2022
@decalage2
Copy link
Owner

OK, I need to rewrite the processing of XLM Macros, to fall back to plugin_biff/SLK parsing/XML parsing when XLMMacroDeobfuscator fails. And indeed, it could be useful to have a CLI parameter to control which parser is used.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants