kirk-sayre-work / ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.
90 stars 14 forks source link

Make vmonkey.py a little more OS agnostic #29

Open dmoore44 opened 4 years ago

dmoore44 commented 4 years ago
malvidin commented 3 years ago

What about using the tempfile make to make the entire filename?

temp_prefix= 'tmp_word_file_' or 'tmp_excel_file_' or 'tmp_file_'
tempfile.mkstemp(prefix=temp_prefix, dir=tempfile.tempdir)

Is there a requirement to have the file name end with numbers?

Is the current code base Python 3 compatible already? Or is #30 redundant?

malvidin commented 3 years ago

Adding .exe to the executable name doesn't appear necessary. https://github.com/python/cpython/blob/master/Lib/distutils/spawn.py#L99

Since subprocess.check_output is where python3 is used, perhaps checking the outputs of these commands would be effective:

version = subprocess.check_output(['python3', '--version']) or subprocess.check_output(['python', '--version'])
if version is None or 'Python 3'  not in version.lower():
    print("Can't find python3 - make sure it's installed, then try again.")
    sys.exit()

Since subprocess.check_output(['python3', ...]) is the only command that appears to be used later, checking 'python' without storing it for later use may not be helpful.

kirk-sayre-work commented 3 years ago

The current code base does a lot of work with strings, so I'm not sure what the level of effort would be for getting it to work under Python 3.

I'll take a look at the OS-specific behavior since that would not be too hard to fix.