VBA Seismograph is a tool for detecting VBA stomping. It has been developed and tested under Ubuntu 16.04. This is done by checking for:
- Functions and variables that are defined in the compiled p-code that do not appear in the VBA source code.
- String literals that are used in the compiled p-code that do not appear in the VBA source code.
- Comments that appear in the compiled p-code that do not appear in the VBA source code.
VBA Seismograph makes use of two external packages, pcodedmp and olevba. To install these (under Ubuntu):
pcodemp.py is a p-code disassembler. To install it do the following:
git clone https://github.com/bontchev/pcodedmp.git
olevba is a tool for dumping the compressed VBA source code from an Office file. To install olevba under Ubuntu do the following:
sudo pip install oletools
PCODEDMP_DIR Environment Variable
VBA Seismograph reads the install directory for pcodedmp from the PCODEDMP_DIR environment variable. To set this under csh add something like the following (modified for where you installed pcodedmp) to your .cshrc file:
setenv PCODEDMP_DIR /home/sayre/Software/pcodedmp
To set this under bash add something like the following (modified for where you installed pcodedmp) to your .bashrc file:
To get help run:
To check the Office file FOO (Excel or Word file) run:
To get details about differences between the p-code and the VBA source code run:
vba_seismograph.py -v FOO