Closed michaelweber closed 4 years ago
i have just tested latest version from the repo, and i don't have this error with your file, try to upgrade maybe?
I am also not able to get the error, however the program should face a problem as it considers them as separate columns. I will take a look.
GAH - I uploaded the wrong file. That would be why. I uploaded a version after I'd run my deobfuscator on it 🤦. Here's the actual sample.
Though I'm getting the error for both versions of the file after I patch using
pip install -U https://github.com/DissectMalware/XLMMacroDeobfuscator/archive/master.zip
Probably have some sort of local environment issue on my end - not sure exactly what's going on - will need to dig into it a bit.
Yeah - I did a fresh install on a linux machine and this seems to work as intended:
administrator@devmachine:/usr/local/lib/python3.5/dist-packages/XLMMacroDeobfuscator$ python3 deobfuscator.py -f colBitStuffing.xls -n -2 -x | grep FORMULA
CELL:A245 , =FORMULA($A$244,$B$5),
CELL:A99 , =FORMULA($A$98,$B$2),
CELL:A617 , =FORMULA($A$616,$B$14),
CELL:A679 , =FORMULA($A$678,$B$17),
CELL:A300 , =FORMULA($A$299,$B$7),
CELL:A1156 , =FORMULA($A$1155,$C$4),
CELL:A670 , =FORMULA($A$669,$B$16),
CELL:A556 , =FORMULA($A$555,$B$12),
CELL:A645 , =FORMULA($A$644,$B$15),
CELL:A1051 , =FORMULA($A$1050,$C$3),
CELL:A392 , =FORMULA($A$391,$B$9),
CELL:A841 , =FORMULA($A$840,$C$1),
CELL:A1209 , =FORMULA($A$1208,$C$5),
CELL:A273 , =FORMULA($A$272,$B$6),
CELL:A608 , =FORMULA($A$607,$B$13),
CELL:A43 , =FORMULA($A$42,$B$1),
CELL:A1214 , =FORMULA($A$1213,$C$6),
CELL:A457 , =FORMULA($A$456,$B$10),
CELL:A221 , =FORMULA($A$220,$B$4),
CELL:A499 , =FORMULA($A$498,$B$11),
CELL:A946 , =FORMULA($A$945,$C$2),
CELL:A352 , =FORMULA($A$351,$B$8),
CELL:A157 , =FORMULA($A$156,$B$3),
For all of these cases the second argument is actually pointing at a much later column than B or C but Excel treats it normal. It looks like this is fixed / might have never been an issue in the first place though. Sorry for the headaches!
Legacy XLS BIFF8 files can only have up to 256 columns (the max column is IV - if you try to define IX or beyond in an XLS2003 document like "=$IX$255", it will throw an error). The BIFF8 format allows up to 14 bits to describe column values though - so if you save a column number like 0x101 - Excel will drop any values above 0xFF and use that instead. So 0x101 is in fact column 1. I created a document which does this for its Formula destinations and while the Excel COM parser works, the XLRD2 parser will crash.
Ex:
colBitStuffingDeob.xls.zip