search

outflanknl / EvilClippy

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
GNU General Public License v3.0
2.13k stars 394 forks source link

Error with targetversion #17

Open kafkaesqu3 opened 5 years ago

kafkaesqu3 commented 5 years ago

I am trying to stomp the macro code to target 32 bit Office 2016 on a Windows 10 64 bit machine. When I stomp, I use the command -t 2016x86. My test VM gives me the error "Sub or function not defined", despite the install being the correct target. I hope you can shed some light on this, let me know if I can provide anything.

EDIT: I think i've figured this out. If you create a document in 64-bit version of word, and then stomp with -t 2016x86, it will give you the error message. You need to create the document with 32 bit version of Word in order to stomp targeting 32 bit. It might be helpful to document this somewhere so other people don't make the same mistake I did.

Thanks for the great tool!

stanhegt commented 5 years ago

Your assumption is correct. This is an undocumented edge case. The _VBA_PROJECT stream (which is crucial for interpretation of P-code) is different between 32 and 64 bit versions of Office. As a result, cross-platform stomping does not work well. I haven't yet been able to figure out what it is exactly that causes this.

I will leave this issue open until it has been properly documented. Thanks for your feedback!