MacroToolsVBA icon indicating copy to clipboard operation
MacroToolsVBA copied to clipboard

Obfuscating Strings that are the same as Sub Names

Open FiSHonAUT opened this issue 2 years ago • 1 comments

Example:

Private Sub Login()
Dim s as String
    s = "Login"
End Sub

The obfuscator changes both Logins:

Private Sub o10101010101()
Dim s as String
    s = "o10101010101"
End Sub

It is because of this Pattern in your code: sPattern = "([\*\.\^\*\+\#\(\)\-\=\/\,\:\;\s\" & VBA.Chr$(34) & "])" & sFinde & "([\*\.\^\*\+\!\@\#\$\%\&\(\)\-\=\/\,\:\;\s\" & VBA.Chr$(34) & "]|$)" Why exactly is there this VBA.Chr$(34)? Because of that Strings get obfuscated.

FiSHonAUT avatar Dec 30 '22 12:12 FiSHonAUT

I worked on the problem and I think I found a nice solution for this problem. I changed the pattern to

sPattern = "([\*\.\^\*\+\#\(\)\-\=\/\,\:\;\s\""])" & _
           "(" & sFinde & "(?=([^""]*""[^""]*"")*[^""]*$))" & _
           "(?=([\*\.\^\*\+\!\@\#\$\%\&\(\)\-\=\/\,\:\;\s\""]|$))"

With (?=([^"]*"[^"]*")*[^"]*$) you exclude EVERYTHING inside of quotes. Of course, the Regex-Line also has to be changed to sCode = RegExpFindReplace(sCode, sPattern, "$1" & sReplace)

FiSHonAUT avatar Jan 02 '23 15:01 FiSHonAUT