EvilClippy icon indicating copy to clipboard operation
EvilClippy copied to clipboard

Error with targetversion

Open kafkaesqu3 opened this issue 5 years ago • 1 comments

I am trying to stomp the macro code to target 32 bit Office 2016 on a Windows 10 64 bit machine. When I stomp, I use the command -t 2016x86. My test VM gives me the error "Sub or function not defined", despite the install being the correct target. I hope you can shed some light on this, let me know if I can provide anything.

EDIT: I think i've figured this out. If you create a document in 64-bit version of word, and then stomp with -t 2016x86, it will give you the error message. You need to create the document with 32 bit version of Word in order to stomp targeting 32 bit. It might be helpful to document this somewhere so other people don't make the same mistake I did.

Thanks for the great tool!

kafkaesqu3 avatar Jul 24 '19 14:07 kafkaesqu3

Your assumption is correct. This is an undocumented edge case. The _VBA_PROJECT stream (which is crucial for interpretation of P-code) is different between 32 and 64 bit versions of Office. As a result, cross-platform stomping does not work well. I haven't yet been able to figure out what it is exactly that causes this.

I will leave this issue open until it has been properly documented. Thanks for your feedback!

stanhegt avatar Jul 25 '19 10:07 stanhegt