Possible fix for extended ASCII issue (#490)

oletools/olevba.py

@@ -1633,10 +1633,12 @@ def __init__(self, project, dir_stream, module_index):
                 code_data = decompress_stream(bytearray(code_data))
                 # store the raw code encoded as bytes with the project's code page:
                 self.code_raw = code_data
-                # decode it to unicode:
-                self.code = project.decode_bytes(code_data)
-                # also store a native str version:
-                self.code_str = unicode2str(self.code)
+                # Unicode conversion does nasty things to VBA extended ASCII
+                # characters. VBA payload decode routines work correctly with the
+                # raw byte values in payload strings in the decompressed VBA, so leave
+                # strings alone.
+                self.code = project.fix_bytes(code_data)
+                self.code_str = self.code
                 # case-insensitive search in the code_modules dict to find the file extension:
                 filext = self.project.module_ext.get(self.name.lower(), 'vba')
                 self.filename = u'{0}.{1}'.format(self.name, filext)
@@ -2083,8 +2085,28 @@ def decode_bytes(self, bytes_string, errors='replace'):
         :return: str/unicode, decoded string
         """
         return bytes_string.decode(self.codec, errors=errors)
-
-
+
+    def fix_bytes(self, bytes_string):
+        """
+        Change the escaping (value) of a few characters in decompressed VBA code.
+        :param bytes_string: bytes, bytes string to be fixed
+        :return: bytes, fixed string
+        """
+        if ('"' not in bytes_string):
+            return bytes_string
+        s = ""
+        in_str = False
+        for b in bytes_string:
+            # Track if we are in a string.
+            if (b == '"'):
+                in_str = not in_str
+            # Empirically looks like '\n' may be escaped in strings like this.
+            if ((b == "\n") and in_str):
+                s += chr(0x85)
+                continue
+            s += b
+        s = s.replace("\n" + chr(0x85), "\n")
+        return s
 
 def _extract_vba(ole, vba_root, project_path, dir_path, relaxed=True):
     """