Peter M. Groen / oletools

Commit fdf415c7f32aa92d73ba2184a0be7d4592dc0005

Authored by Christian Herdtweck
1 parent e02ea888

add field to_deobfuscate to json_result; ensure that json always has same fields… 

… independent of options
Inline Side-by-side
Showing 1 changed file with 3 additions and 0 deletions
oletools/olevba.py
  View file @fdf415c
@@ -2889,6 +2889,7 @@ class VBA_Parser_CLI(VBA_Parser): @@ -2889,6 +2889,7 @@ class VBA_Parser_CLI(VBA_Parser):
2889 result['json_conversion_successful'] = False 2889 result['json_conversion_successful'] = False
2890 result['analysis'] = None 2890 result['analysis'] = None
2891 result['code_deobfuscated'] = None 2891 result['code_deobfuscated'] = None
  2892 + result['do_deobfuscate'] = deobfuscate
2892 2893
2893 try: 2894 try:
2894 #TODO: handle olefile errors, when an OLE file is malformed 2895 #TODO: handle olefile errors, when an OLE file is malformed
@@ -2908,6 +2909,8 @@ class VBA_Parser_CLI(VBA_Parser): @@ -2908,6 +2909,8 @@ class VBA_Parser_CLI(VBA_Parser):
2908 curr_macro['ole_stream'] = stream_path 2909 curr_macro['ole_stream'] = stream_path
2909 if display_code: 2910 if display_code:
2910 curr_macro['code'] = vba_code_filtered.strip() 2911 curr_macro['code'] = vba_code_filtered.strip()
  2912 + else:
  2913 + curr_macro['code'] = None
2911 macros.append(curr_macro) 2914 macros.append(curr_macro)
2912 if not vba_code_only: 2915 if not vba_code_only:
2913 # analyse the code from all modules at once: 2916 # analyse the code from all modules at once: