-
Notifications
You must be signed in to change notification settings - Fork 561
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
detect_vba_macros() false positives? #856
Comments
Hi @xme, indeed the method detect_vba_macros only checks for the presence of specific storages (folders) in the structure of OLE files, or streams with specific bytes that are found in VBA projects. So it will return True if a file contains those storages or streams, even if the VBA project streams are corrupt. (this may happen when a document is "cleaned" by some antivirus, for example) Maybe you can try |
Tx! I'll investigate this way! |
Affected tool:
olevba
Describe the bug
I'm using the olevba Python module to process files from multiple source. I'm using the following code to detect interesting files (with macros):
Many files are detected as containing macros even if they don't contain valid OLE streams.
Is there another way to properly detect the presence of VBA macros?
The text was updated successfully, but these errors were encountered: