You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In fact the relaxed mode was too relaxed, because no exception was raised when a VBA_Module object was not completely initialised due to a malformed compressed stream. In that case the VBA_Module.code_str was set to None, triggering the exception above.
Now VBA_Module.init raises the exception, and olevba can try other methods to get code to analyse (e.g. P-code).
error triggered by olevba 0.56.1.dev1 on Win10 both with Python 3.8.3 or Python 2.7.14, with this sample:
https://labs.inquest.net/dfi/hash/2bfb95bc1e1ff7801796cfb8c1047feebfd8576b8496030cd559d5bac804c9bb
https://www.virustotal.com/gui/file/2bfb95bc1e1ff7801796cfb8c1047feebfd8576b8496030cd559d5bac804c9bb
From this tweet: https://mobile.twitter.com/JohnLaTwC/status/1312433855056416768
First we get this error:
Then this:
So somewhere a function returns None instead of a string for the VBA code.
Interestingly, if I scan it with olevba 0.55.2, I get a different error, and the analysis continues with an empty macro and just P-code:
The text was updated successfully, but these errors were encountered: