Malwrologist

Results 50 comments of Malwrologist

Seems a problem in xlrd2 parser (xls). It doesn't support parsing shared formula. Will test soon. https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/984826cc-8bb7-412b-9907-7bbb9b08b4ad

Thank you for the sample, I added INDIRECT and ABSREF functions. Also, I fixed a few bugs. So far, we have: ![image](https://user-images.githubusercontent.com/9646319/108173661-68dec000-70cc-11eb-90ba-903716cefce6.png) It still needs more work.

Thank you very much for your post. I skimmed over it and I think I got the main points. But I need to read it more carefully. The test2.xlsb is...

Thank you Kirk, I will check and merge your pr soon. Regarding breaking the infinite loop, that's an awesome feature. However, I think the reason that the emulator caught in...

(apologies for the long overdue) The real issue in v0.1.5 is the way the code is fetching the next macro. I tried to change it in [version-2.0 branch](https://github.com/DissectMalware/XLMMacroDeobfuscator/tree/version-2.0), this should...

Interesting. I will add these functions. No need to update the grammar I suppose SET.NAME is used to define a name... SET.NAME is partially implemented

> Generated an alternate document which can also cause some issues by abusing user defined functions combined with variables set using SET.NAME. > > By hiding a subroutine in the...

That make sense to be honest. The same for À (can be represented with two characters in ASCII or one unicode)

Thank you very much for the PR. However, it may take a while for me to review the PR and merge. Please bear with me. @wmetcalf can you also take...

Thank you @gdesmar for your PR. Thank you @wmetcalf for the review. The PR is merged.