search

DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
Apache License 2.0
568 stars 115 forks source link

Decodes are slightly off #24

Closed enzok closed 4 years ago

enzok commented 4 years ago

Excellent work with this decoder.

The following sample: 75767ed0ff097ac5628270468e4e6b7d6e4991388e55c7651a02937ff513e2c7

appears to have some rounding errors that are leading to char ordinals that are off by 1. For instance CLOSE is decoding to BLOSE and FALSE to FAKSE.

DissectMalware commented 4 years ago

It seems the issue is solved by another change in the project. Please update your code from the master branch and test it.

Maijin commented 4 years ago

I tried using the sample - https://pastebin.com/asZaxg9t can't reproduce the issue, seems fixed.