Peter M. Groen / oletools

Commit 2fa61161d0c4b3cfb4333d5d89ef99b42f605a34

Authored by decalage2
1 parent 45db7680

olevba: disabled VBA stomping detection for files in memory, because it is not y… 

…et supported by pcodedmp (see issue #519)
Inline Side-by-side
Showing 2 changed files with 9 additions and 2 deletions
oletools/olevba.py
  View file @2fa6116
... ... @@ -225,7 +225,7 @@ from __future__ import print_function
225 225 # 2019-09-24 PL: - included DridexUrlDecode into olevba (issue #485)
226 226 # 2019-12-03 PL: - added support for SLK files and XLM macros in SLK
227 227  
228   -__version__ = '0.55.1'
  228 +__version__ = '0.55.2'
229 229  
230 230 #------------------------------------------------------------------------------
231 231 # TODO:
... ... @@ -2646,9 +2646,11 @@ class VBA_Parser(object):
2646 2646 if data is None:
2647 2647 # open file from disk:
2648 2648 _file = filename
  2649 + self.file_on_disk = True
2649 2650 else:
2650 2651 # file already read in memory, make it a file-like object for zipfile:
2651 2652 _file = BytesIO(data)
  2653 + self.file_on_disk = False
2652 2654 #self.file = _file
2653 2655 self.ole_file = None
2654 2656 self.ole_subfiles = []
... ... @@ -3636,6 +3638,11 @@ class VBA_Parser(object):
3636 3638 if self.type in (TYPE_SLK, TYPE_TEXT):
3637 3639 self.vba_stomping_detected = False
3638 3640 return False
  3641 + # TODO: Files in memory cannot be analysed with pcodedmp yet
  3642 + if not self.file_on_disk:
  3643 + log.info('For now, VBA stomping cannot be detected for files in memory')
  3644 + self.vba_stomping_detected = False
  3645 + return False
3639 3646 # only run it once:
3640 3647 if self.vba_stomping_detected is None:
3641 3648 log.debug('Analysing the P-code to detect VBA stomping')
... ...
setup.py
  View file @2fa6116
... ... @@ -52,7 +52,7 @@ import os, fnmatch
52 52 #--- METADATA -----------------------------------------------------------------
53 53  
54 54 name = "oletools"
55   -version = '0.55.1'
  55 +version = '0.55.2'
56 56 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
57 57 long_desc = open('oletools/README.rst').read()
58 58 author = "Philippe Lagadec"
... ...