Closed emf closed 5 years ago
Since Format() with only one parameter (eg, no format specification string) behaves like Str(); I have temporarily worked around this with the following patch. This is probably not the right way to handle this, but it seems to work for the moment.
diff --git a/vipermonkey/core/vba_library.py b/vipermonkey/core/vba_library.py
index 5e6cd48..d97d9b7 100644
--- a/vipermonkey/core/vba_library.py
+++ b/vipermonkey/core/vba_library.py
@@ -1043,6 +1043,17 @@ class Str(VbaLibraryFunc):
log.debug("Str: %r returns %r" % (self, r))
return r
+class Format(VbaLibraryFunc):
+ """
+ Format(), when abused with no 2nd fmtstring parameter, behaves like Str().
+ """
+
+ def eval(self, context, params=None):
+ assert (len(params) == 1)
+ r = str(params[0])
+ log.debug("Format: %r returns %r" % (self, r))
+ return r
+
class Val(VbaLibraryFunc):
"""
Val() convert string to number function.
@@ -1746,7 +1757,7 @@ for _class in (MsgBox, Shell, Len, Mid, Left, Right,
BuiltInDocumentProperties, Array, UBound, LBound, Trim,
StrConv, Split, Int, Item, StrReverse, InStr, Replace,
Sgn, Sqr, Base64Decode, Abs, Fix, Hex, String, CByte, Atn,
- Dir, RGB, Log, Cos, Exp, Sin, Str, Val, CInt, Pmt, Day, Round,
+ Dir, RGB, Log, Cos, Exp, Sin, Str, Format, Val, CInt, Pmt, Day, Round,
UCase, Randomize, CBool, CDate, CStr, CSng, Tan, Rnd, Oct,
Environ, IIf, Base64DecodeString, CLng, Close, Put, Run, InStrRev,
LCase, RTrim, LTrim, AscW, AscB, CurDir, LenB, CreateObject,
Maybe this would be fixed by this PR: https://github.com/kirk-sayre-work/ViperMonkey/pull/1
Passes all my regressions. Far more comprehensive than the nasty hack I did. Good job, Harold!
This got pulled in for PR #55
A VBA obfuscation found in the wild uses the construct:
Format(Chr(3 + 10 + 5 + 5 + 44)) or Format(Chr(5 + 14 + 8 + 7 + 65)) to represent the characters "C" and "c", respectively.
VMonkey 0.07 drops this character from string reassemblies, due to not supporting Format()?
output dump of the run is