Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

olevba: improve parsing of XLM macros #751

Open
decalage2 opened this issue Mar 12, 2022 · 0 comments
Open

olevba: improve parsing of XLM macros #751

decalage2 opened this issue Mar 12, 2022 · 0 comments
Assignees
Labels
Milestone

Comments

@decalage2
Copy link
Owner

I need to improve the parsing of XLM macros, probably something like this:

  • if format = OLE:
    • if XLMMacroDeobfuscator is installed, use it.
    • if not, or if XLMMacroDeobfuscator triggered an error or found nothing, use plugin_biff.
    • if plugin_biff triggered an error, report it and check if there are XLM macros or not.
  • if format = OpenXML (not XLSB):
    • if XLMMacroDeobfuscator is installed, use it.
    • if not, or if XLMMacroDeobfuscator triggered an error or found nothing, use a simple XML parser to extract macrosheets.
  • if format = XLSB:
    • if XLMMacroDeobfuscator is installed, use it.
    • if not, or if XLMMacroDeobfuscator triggered an error, display warning that XLM macros cannot be detected.
  • if forrmat = SLK:
    • use internal parser

Related issues: #728, #742, #741

@decalage2 decalage2 added this to the oletools 0.60 milestone Mar 12, 2022
@decalage2 decalage2 self-assigned this Mar 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant