Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Null Bytes in Auto_Open Lbl Results in Unprocessed Macros

See original GitHub issue

Example file @ nullbyte-autoopen-bug.xls.zip

When a binary XLS file with the Auto_Open label has null bytes injected into its contents, the Auto_Open field will no longer be discover-able when processed at https://github.com/DissectMalware/XLMMacroDeobfuscator/blob/master/XLMMacroDeobfuscator/xls_wrapper.py#L134. This results in the tool never processing any of the macro cells in the document.

\Path\To\Python\Python37\Scripts>xlmdeobfuscator.exe -f nullbyte-autoopen-bug.xls -n
[Loading Cells]
time elapsed: 1.6042091846466064

The provided file is the same as the file in issue #8, but the Auto_Open Lbl record has been modified such that it contains null bytes.

Issue Analytics

State:
Created 3 years ago
Comments:9 (5 by maintainers)

Top GitHub Comments

1reaction

DissectMalwarecommented, May 22, 2020

A few days ago, I realized the code for removing non-printable characters were deleted when I merged a pr. However, I reverted the removed code in https://github.com/DissectMalware/XLMMacroDeobfuscator/commit/823ebf04a1d17ca7a77bd02a0ce83787aae69d94. Please check once more

1reaction

DissectMalwarecommented, May 14, 2020

Thank you Michael.

I think I fixed it in

https://github.com/DissectMalware/XLMMacroDeobfuscator/commit/2e137f49c0aebe9a403ccbaa3853d0b8fb53969d

Please check it out

Top Results From Across the Web

How to Make a Macro Run Automatically? - Null Byte

unicorn.py says that if you name the macro Auto_Open, it would run automatically...but i tried it, and removed the underscore when using it...

Evading Detection with Excel 4.0 Macros and the BIFF8 XLS ...

A common trick in bypassing input validation is to try injecting null bytes to see if it results in the string being terminated...

Bascavr PDF | PDF | Computing | Computer Engineering - Scribd

responsibility for errors or omissions, or for damages resulting from the use ... The space used is 6 bytes because a string is...

The xlmmacrodeobfuscator from DissectMalware - Coder Social

Null Bytes in Auto_Open Lbl Results in Unprocessed Macros. Example file @ nullbyte-autoopen-bug.xls.zip. When a binary XLS file with the Auto_Open label has ......

- Accueil - Linux - doczz

Yeah, I know that those locations have null bytes in them and you can't put ... of any information stored on this system...