Peter M. Groen / oletools

Commit 450782767774a1db8700d89f8707b33f57072f21

Authored by decalage2
1 parent 2f9505d9

olevba: fixed issue #148 for option --reveal

Inline Side-by-side
Showing 1 changed file with 6 additions and 3 deletions
oletools/olevba.py
  View file @4507827
@@ -191,8 +191,9 @@ from __future__ import print_function @@ -191,8 +191,9 @@ from __future__ import print_function
191 # 2017-02-07 PL: - temporary fix for issue #132 191 # 2017-02-07 PL: - temporary fix for issue #132
192 # - added keywords for Mac-specific macros (issue #130) 192 # - added keywords for Mac-specific macros (issue #130)
193 # 2017-03-08 PL: - fixed absolute imports 193 # 2017-03-08 PL: - fixed absolute imports
  194 +# 2017-03-16 PL: - fixed issue #148 for option --reveal
194 195
195 -__version__ = '0.51dev2' 196 +__version__ = '0.51dev3'
196 197
197 #------------------------------------------------------------------------------ 198 #------------------------------------------------------------------------------
198 # TODO: 199 # TODO:
@@ -1902,7 +1903,8 @@ def detect_dridex_strings(vba_code): @@ -1902,7 +1903,8 @@ def detect_dridex_strings(vba_code):
1902 :param vba_code: str, VBA source code 1903 :param vba_code: str, VBA source code
1903 :return: list of str tuples (encoded string, decoded string) 1904 :return: list of str tuples (encoded string, decoded string)
1904 """ 1905 """
1905 - from .thirdparty.DridexUrlDecoder.DridexUrlDecoder import DridexUrlDecode 1906 + # TODO: move this at the beginning of script
  1907 + from oletools.thirdparty.DridexUrlDecoder.DridexUrlDecoder import DridexUrlDecode
1906 1908
1907 results = [] 1909 results = []
1908 found = set() 1910 found = set()
@@ -2837,7 +2839,8 @@ class VBA_Parser(object): @@ -2837,7 +2839,8 @@ class VBA_Parser(object):
2837 # based on the length of the encoded string, in reverse order: 2839 # based on the length of the encoded string, in reverse order:
2838 analysis = sorted(analysis, key=lambda type_decoded_encoded: len(type_decoded_encoded[2]), reverse=True) 2840 analysis = sorted(analysis, key=lambda type_decoded_encoded: len(type_decoded_encoded[2]), reverse=True)
2839 # normally now self.vba_code_all_modules contains source code from all modules 2841 # normally now self.vba_code_all_modules contains source code from all modules
2840 - deobf_code = self.vba_code_all_modules 2842 + # Need to collapse long lines:
  2843 + deobf_code = vba_collapse_long_lines(self.vba_code_all_modules)
2841 for kw_type, decoded, encoded in analysis: 2844 for kw_type, decoded, encoded in analysis:
2842 if kw_type == 'VBA string': 2845 if kw_type == 'VBA string':
2843 #print '%3d occurences: %r => %r' % (deobf_code.count(encoded), encoded, decoded) 2846 #print '%3d occurences: %r => %r' % (deobf_code.count(encoded), encoded, decoded)