Skip to content

olevba: detect macros hidden from MS VBA Editor #407

@decalage2

Description

@decalage2

Technique implemented in EvilClippy: https://github.com/outflanknl/EvilClippy

Hide all macro modules (except the default "ThisDocument" module) from the VBA GUI editor. This is achieved by removing module lines from the project stream [MS-OVBA 2.3.1].

Solution: compare modules in dir stream vs. lines in project stream

This should raise a warning.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions