Named function invocations can break deobfuscation
See original GitHub issueMacro sheets allow Excel to replicate the effect of a RUN() invocation by defining a name and then referencing it in a sheet by appending () to the name.
For example:
=SET.NAME("InvokeMe",B1)
=InvokeMe()
is identical to calling RUN(B1)
. You can chain these expressions together as well, for example:
=SET.NAME("IndirectFunction","=B1")
=SET.NAME("IndirectInvocation",EVALUATE("IndirectFunction"))
=IndirectInvocation()
will also replicate calling RUN(B1)
. It looks like the invocation of a name and treating it as a RUN() expression hasn’t been added to the grammar for the tool yet. Here’s a small PoC for both of these cases that will help if maldoc authors start abusing this.
Issue Analytics
- State:
- Created 3 years ago
- Comments:9 (3 by maintainers)
Top Results From Across the Web
Defeating Javascript Obfuscation - PerimeterX
I can write a more complicated search and replace script that extracts just the array and function and then deobfuscates the strings, but...
Read more >Towards Generic Deobfuscation of Windows API Calls - arXiv
Deobfuscating API calls can be tackled in two broad ways: ... first obtains the name of an API function and then uses.
Read more >How does this obfuscated javascript code work?
The code below assigns "return" and function Function() { [native code] } ... Eventually you will find that your code calls alert by...
Read more >Live streaming JavaScript deobfuscation & reverse engineering
These sessions will be tackling how to deobfuscate JavaScript using open source obfuscators as examples.I use the Shift suite of tools: ...
Read more >Solving an Obfuscated Crackme with Binary Ninja and Triton
We will cover the major techniques to deobfuscate the binary, ... If not, it calls strlen on it and jumps to another function,...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
That make sense to be honest. The same for À (can be represented with two characters in ASCII or one unicode)
This is addressed in v0.1.5 (currently on Master branch)