decalage2 / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
1.05k stars 186 forks source link

Alternative parser: test Lark #87

Open decalage2 opened 4 years ago

decalage2 commented 4 years ago

In practice, the current VBA parser implemented with pyparsing is very slow. In the past I made some tests with ANTLR4 (issue #19), but its python runtime is even slower than pyparsing. Other issues with pyparsing:

Lark is another parser for python that looks faster than pyparsing, and could allow us to separate the parser from the VBA emulation engine: https://github.com/lark-parser/lark

And there are other options: https://tomassetti.me/parsing-in-python/