search

itm4n / VBA-RunPE

A VBA implementation of the RunPE technique or how to bypass application whitelisting.
MIT License
788 stars 180 forks source link

Procedure too large error #7

Open null-event opened 2 years ago

null-event commented 2 years ago

Hello,

When using VBA-RunPE as instructed in the readme:

./pe2vba.py

and inputting the generated .vba into the editor and trying to run I am receiving a "compile error: procedure too large."

Is this expected?

Thanks!

itm4n commented 2 years ago

Hello,

Here is the thing with VBA, the length of each line is limited and the length of each procedure is also limited. To work around that, the Python script splits the input EXE into chunks and then creates a procedure that collects all the chunks to reconstruct the EXE in memory. Without more details from your part about the error, I suspect that your input EXE is too large, which causes the last procedure to grow past the size limit. This code was never intended to be used to embed large executables. The Python script could surely be improved to address this kind of use case, but I won't do that. Or perhaps it's something else, but again, I cannot tell without more details.