question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Named function invocations can break deobfuscation

See original GitHub issue

Macro sheets allow Excel to replicate the effect of a RUN() invocation by defining a name and then referencing it in a sheet by appending () to the name.

For example:

=SET.NAME("InvokeMe",B1)
=InvokeMe()

is identical to calling RUN(B1). You can chain these expressions together as well, for example:

=SET.NAME("IndirectFunction","=B1")
=SET.NAME("IndirectInvocation",EVALUATE("IndirectFunction"))
=IndirectInvocation()

will also replicate calling RUN(B1). It looks like the invocation of a name and treating it as a RUN() expression hasn’t been added to the grammar for the tool yet. Here’s a small PoC for both of these cases that will help if maldoc authors start abusing this.

setname-obfuscation.xls.zip

Issue Analytics

  • State:open
  • Created 3 years ago
  • Comments:9 (3 by maintainers)

github_iconTop GitHub Comments

1reaction
DissectMalwarecommented, Jun 13, 2020

That make sense to be honest. The same for À (can be represented with two characters in ASCII or one unicode)

1reaction
DissectMalwarecommented, Jun 7, 2020

Generated an alternate document which can also cause some issues by abusing user defined functions combined with variables set using SET.NAME.

By hiding a subroutine in the sheet somewhere else (it can be simple like, =RETURN(CHAR(var))), we can fake pass an argument to the subroutine and invoke it by making a call like:

=IF(SET.NAME("var",73),InvokeChar(),)

Which is identical to =CHAR(73).

Right now this sort of approach will not be emulated, so once the GOTO() is reached, there’s no content shown.

charsub-method.xls.zip

This is addressed in v0.1.5 (currently on Master branch)

Read more comments on GitHub >

github_iconTop Results From Across the Web

Defeating Javascript Obfuscation - PerimeterX
I can write a more complicated search and replace script that extracts just the array and function and then deobfuscates the strings, but...
Read more >
Towards Generic Deobfuscation of Windows API Calls - arXiv
Deobfuscating API calls can be tackled in two broad ways: ... first obtains the name of an API function and then uses.
Read more >
How does this obfuscated javascript code work?
The code below assigns "return" and function Function() { [native code] } ... Eventually you will find that your code calls alert by...
Read more >
Live streaming JavaScript deobfuscation & reverse engineering
These sessions will be tackling how to deobfuscate JavaScript using open source obfuscators as examples.I use the Shift suite of tools: ...
Read more >
Solving an Obfuscated Crackme with Binary Ninja and Triton
We will cover the major techniques to deobfuscate the binary, ... If not, it calls strlen on it and jumps to another function,...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found