decalage2 / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
1.04k stars 185 forks source link

Added support for Write #x call #117

Open lap1nou opened 2 years ago

lap1nou commented 2 years ago

Hey,

I had a bug with a simple VBA macro like this one:

Sub Auto_Open()
    FileTest = "C:\Users\test\test.txt"

    Open FileTest For Output As #1
    Write #1, "Test"
    Close #1
End Sub

The actual ViperMonkey commit transformed the source code into this:

Sub Auto_Open()
    FileTest = "C:\Users\test\test.txt"

    Open FileTest For Output As #1
    Write 1, "Test"
    Close #1
End Sub

As you can see there is a missing # in the Write call, to fix this I've added these two lines:

vba_code = re.sub(r"[Ww]rite\s+#", "write__HASH", vba_code)
r = r.replace("write__HASH", "Write #")

I also had to modify the Write class defined in vba_library.py, the original file had this:

# Get the data.
        data = str(params[0])

But the data are actually stored in the second parameter like the Put call:

# Get the data.
        data = str(params[1])

I have tested with the code I've put above and it seems to work fine.

Like the Put call they may be more than on input so we might need to mimic Put class regarding this.