olevba: detect and display special characters such as backspace

[decalage2]

Stan Hegt (@stanhegt) and Pieter Ceelen (@pieterceelen) have found an issue with olevba: Some special characters such as backspace may be inserted into the VBA source code or comments, to manipulate what is displayed on the console by olevba:

• https://twitter.com/StanHacked/status/1049130449937809410
• Video: http://www.irongeek.com/i.php?page=videos/derbycon8/track-3-18-the-ms-office-magic-show-stan-hegt-pieter-ceelen
• Slides: https://github.com/outflanknl/Presentations/blob/master/DerbyCon_2018_The_MS_Office_Magic_Show.pdf
• A post on a similar topic: https://isc.sans.edu/forums/diary/Malware+analysis+output+sanitization/22804/

Solution:

• olevba should detect special characters in the VBA code before displaying them on the console, and replace them with something printable such as \x08 for backspace. They could be colored in red using colorclass. This should not be applied to VBA code returned by the python API, since the issue only applies to console output.
• When special characters are detected, an additional indicator should be added to the list, since this is not expected in normal VBA code.

[decalage2]

This also needs to be added to olevba3, of course.

[decalage2]

olevba3 is now merged with olevba.