search

decalage2 / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
1.04k stars 185 forks source link

Regression - bug in read_ole_fields #82

Closed Maijin closed 5 years ago

Maijin commented 5 years ago

Describe the bug

Traceback (most recent call last):
  File "/usr/local/bin/vmonkey", line 11, in <module>
    load_entry_point('vipermonkey==0.8', 'console_scripts', 'vmonkey')()
  File "/usr/local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 489, in load_entry_point
    return get_distribution(dist).load_entry_point(group, name)
  File "/usr/local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2843, in load_entry_point
    return ep.load()
  File "/usr/local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2434, in load
    return self.resolve()
  File "/usr/local/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2440, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
  File "/usr/local/lib/python2.7/site-packages/vipermonkey-0.8-py2.7.egg/vipermonkey/vmonkey.py", line 126, in <module>
    import core.read_ole_fields as read_ole_fields
  File "/usr/local/lib/python2.7/site-packages/vipermonkey-0.8-py2.7.egg/vipermonkey/core/read_ole_fields.py", line 316
    if ("            anchor = "            pad = 3
                                ^
SyntaxError: invalid syntax

To Reproduce Happens on all the document I have

Expected behavior No error

Desktop (please complete the following information):

decalage2 commented 5 years ago

There were strings containing non-printable characters. It should now be fixed with commit https://github.com/decalage2/ViperMonkey/commit/edb396b85048aca0db191c91735c8c211b80e708