oletools
oletools copied to clipboard
Olevba: Add switch parameter to choose either XLMMacroDeobfuscator or plugin_biff for XLM-macros analysis
At the moment XLMMacroDeobfuscator
can't process files like .slk
(it's not supported file extension there)
However, if XLMMacroDeobfuscator
is installed, it is automatically used for xlm-analysis in the current code, so one can't choose to use plugin_biff
(one can only disable XLM-analysis fully with --no-xlm
)
https://github.com/decalage2/oletools/blob/dfbcabb957644769d17dfbb367eb3a52167c0506/oletools/olevba.py#L321
Because of that, either slk
of xlsb
+ files are not processed in any case, missing some possible malware
I suggest having command line parameter allowing to choose what to use for XML-processing explicitly
OK, I need to rewrite the processing of XLM Macros, to fall back to plugin_biff/SLK parsing/XML parsing when XLMMacroDeobfuscator fails. And indeed, it could be useful to have a CLI parameter to control which parser is used.