DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
568 stars 116 forks source link

fix missing wrapping in t_handler() #110

Closed pyvain closed 2 years ago

pyvain commented 2 years ago

This is a proposition to fix #108. The fix proposed in #109 corrects the issue in most cases without properly identifying the cause, which might cause other issues.

The issue

When we deal with concatenation expressions in evaluate_parse_tree(), the retrieved value is always unwrapped (for example at lines 2274 and 2276).

However in t_handler(), the returned EvalResult does not wrap the value.

This is ok when the value does not start and end with quotes (this is the majority of cases), since unwrap_str_literal() does nothing if the string to unwrap does not start and end with quotes.

But if the result of t_handler() starts and ends with quotes, they are removed in evaluate_parse_tree(), and we get a wrong value to evaluate the rest of the formula, with missing quotes.

As a reference, here is the definition of the T() excel function: The Excel T function returns text when given a text value and an empty string ("") for numbers, dates, and the logical values TRUE and FALSE. You can use the T function to remove values that are not text.

The fix

The fix I'm proposing consists in always wrapping the result of t_handler() since it is text by definition. That way we do not loose quotes when unwrapping.

DissectMalware commented 2 years ago

thank you for the PR