Peter M. Groen / oletools

Commit ed2251439d0578fea7ec3042c5cc2bd03fd2d4bb

Authored by Aaron McPhall
1 parent cd156ee5

Moved reveal to VBA_Parser class

Inline Side-by-side
Showing 1 changed file with 20 additions and 25 deletions
oletools/olevba.py
  View file @ed22514
... ... @@ -2142,7 +2142,23 @@ class VBA_Parser(object):
2142 2142 return self.analysis_results
2143 2143  
2144 2144  
2145   -
  2145 + def reveal(self):
  2146 + # we only want printable strings:
  2147 + analysis = self.analyze_macros(show_decoded_strings=False)
  2148 + # to avoid replacing short strings contained into longer strings, we sort the analysis results
  2149 + # based on the length of the encoded string, in reverse order:
  2150 + analysis = sorted(analysis, key=lambda type_decoded_encoded: len(type_decoded_encoded[2]), reverse=True)
  2151 + # normally now self.vba_code_all_modules contains source code from all modules
  2152 + deobf_code = self.vba_code_all_modules
  2153 + for kw_type, decoded, encoded in analysis:
  2154 + if kw_type == 'VBA string':
  2155 + #print '%3d occurences: %r => %r' % (deobf_code.count(encoded), encoded, decoded)
  2156 + # need to add double quotes around the decoded strings
  2157 + # after escaping double-quotes as double-double-quotes for VBA:
  2158 + decoded = decoded.replace('"', '""')
  2159 + deobf_code = deobf_code.replace(encoded, '"%s"' % decoded)
  2160 + return deobf_code
  2161 + #TODO: repasser l'analyse plusieurs fois si des chaines hex ou base64 sont revelees
2146 2162  
2147 2163  
2148 2164 def close(self):
... ... @@ -2218,28 +2234,6 @@ class VBA_Parser_CLI(VBA_Parser):
2218 2234 print 'No suspicious keyword or IOC found.'
2219 2235  
2220 2236  
2221   - def reveal(self):
2222   - #TODO: move this code to the VBA_Parser class (without print)
2223   - print 'MACRO SOURCE CODE WITH DEOBFUSCATED VBA STRINGS (EXPERIMENTAL):\n'
2224   - # we only want printable strings:
2225   - analysis = self.analyze_macros(show_decoded_strings=False)
2226   - # to avoid replacing short strings contained into longer strings, we sort the analysis results
2227   - # based on the length of the encoded string, in reverse order:
2228   - analysis = sorted(analysis, key=lambda type_decoded_encoded: len(type_decoded_encoded[2]), reverse=True)
2229   - # normally now self.vba_code_all_modules contains source code from all modules
2230   - deobf_code = self.vba_code_all_modules
2231   - for kw_type, decoded, encoded in analysis:
2232   - if kw_type == 'VBA string':
2233   - #print '%3d occurences: %r => %r' % (deobf_code.count(encoded), encoded, decoded)
2234   - # need to add double quotes around the decoded strings
2235   - # after escaping double-quotes as double-double-quotes for VBA:
2236   - decoded = decoded.replace('"', '""')
2237   - deobf_code = deobf_code.replace(encoded, '"%s"' % decoded)
2238   - print ''
2239   - print deobf_code
2240   - #TODO: repasser l'analyse plusieurs fois si des chaines hex ou base64 sont revelees
2241   -
2242   -
2243 2237 def process_file(self, show_decoded_strings=False,
2244 2238 display_code=True, global_analysis=True, hide_attributes=True,
2245 2239 vba_code_only=False, show_deobfuscated_code=False):
... ... @@ -2296,7 +2290,8 @@ class VBA_Parser_CLI(VBA_Parser):
2296 2290 # analyse the code from all modules at once:
2297 2291 self.print_analysis(show_decoded_strings)
2298 2292 if show_deobfuscated_code:
2299   - self.reveal()
  2293 + print 'MACRO SOURCE CODE WITH DEOBFUSCATED VBA STRINGS (EXPERIMENTAL):\n\n'
  2294 + print self.reveal()
2300 2295 else:
2301 2296 print 'No VBA macros found.'
2302 2297 except: #TypeError:
... ... @@ -2492,4 +2487,4 @@ def main():
2492 2487 if __name__ == '__main__':
2493 2488 main()
2494 2489  
2495   -# This was coded while listening to "Dust" from I Love You But I've Chosen Darkness
2496 2490 \ No newline at end of file
  2491 +# This was coded while listening to "Dust" from I Love You But I've Chosen Darkness
... ...