Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

msodde: Fix detecting DDE in the nested field. #807

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

kijeong
Copy link
Contributor

@kijeong kijeong commented Feb 23, 2023

Hello.

I checked DDE in some malware .doc samples and found a malware doc that contained DDE but was not detected by the msodde.

I did a little research and It was because it nested.
It means, A field can contain another.

So I fixed that when DDE is detected, it collects characters in the buffer until it meets the END symbol, even if there's another BEGIN symbol in the middle.

I made a sample like this with the MS Office 365 Word.
(version: Microsoft® Word Microsoft 365 MSO(Version 2301 Build 16.0.16026.20196) 64bit, Korean)

ref:

  1. [MS-DOC] 2.8.25 PlcFld
    Field = <Begin> *<Field> [Sep] *<Field> <End>

thanks

@decalage2 decalage2 self-requested a review February 25, 2023 21:34
@decalage2 decalage2 self-assigned this Feb 25, 2023
@decalage2 decalage2 added this to the oletools 0.60 milestone Feb 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants