Code

ViperMonkey update May 2021#111

Code

Open

decalage2 wants to merge 162 commits intodecalage2:masterdecalage2/ViperMonkey:masterfrom

kirk-sayre-work:masterkirk-sayre-work/ViperMonkey:masterCopy head branch name to clipboard

Commits

Commits on Mar 25, 2021

• Code cleanup.

  kirk-sayre-work

  committed
  15cfb31

  Copy full SHA for 15cfb31

• Code cleanup/

  kirk-sayre-work

  committed
  6b929fd

  Copy full SHA for 6b929fd

Commits on Mar 30, 2021

• Merge branch 'master' into python3_port

  kirk-sayre-work

  committed
  733e3a5

  Copy full SHA for 733e3a5

• Code documentation.

  kirk-sayre-work

  committed
  1aa354d

  Copy full SHA for 1aa354d

Commits on Apr 2, 2021

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  15e6d1a

  Copy full SHA for 15e6d1a

• Improve Regex::Test() emulation.

  kirk-sayre-work

  committed
  2815af3

  Copy full SHA for 2815af3

• Code documentation.

  kirk-sayre-work

  committed
  e690300

  Copy full SHA for e690300

• Code cleanup.

  kirk-sayre-work

  committed
  c06d9e0

  Copy full SHA for c06d9e0

• Code cleanup.

  kirk-sayre-work

  committed
  48154ab

  Copy full SHA for 48154ab

• Code cleanup.

  kirk-sayre-work

  committed
  5bad23b

  Copy full SHA for 5bad23b

• Code cleanup.

  kirk-sayre-work

  committed
  08de05e

  Copy full SHA for 08de05e

• Code cleanup.

  kirk-sayre-work

  committed
  9282336

  Copy full SHA for 9282336

• Code cleanup.

  kirk-sayre-work

  committed
  14ad411

  Copy full SHA for 14ad411

• Code cleanup.

  kirk-sayre-work

  committed
  766b49f

  Copy full SHA for 766b49f

• Refactoring bug fix.

  kirk-sayre-work

  committed
  2da5e03

  Copy full SHA for 2da5e03

Commits on Apr 5, 2021

• Code documentation.

  kirk-sayre-work

  committed
  7a8fb54

  Copy full SHA for 7a8fb54

• Code cleanup

  kirk-sayre-work

  committed
  db37041

  Copy full SHA for db37041

• Code documentation.

  kirk-sayre-work

  committed
  c8776a4

  Copy full SHA for c8776a4

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  3190d34

  Copy full SHA for 3190d34

• Code refactoring.

  kirk-sayre-work

  committed
  434d694

  Copy full SHA for 434d694

• Code documentation.

  kirk-sayre-work

  committed
  d7e3719

  Copy full SHA for d7e3719

• Code cleanup.

  kirk-sayre-work

  committed
  9b95c79

  Copy full SHA for 9b95c79

• Code documentation.

  kirk-sayre-work

  committed
  1c7ce9a

  Copy full SHA for 1c7ce9a

• Code cleanup.

  kirk-sayre-work

  committed
  4030597

  Copy full SHA for 4030597

Commits on Apr 6, 2021

• Documentation update.

  kirk-sayre-work

  committed
  27f8070

  Copy full SHA for 27f8070

• Documentation update.

  kirk-sayre-work

  committed
  0cf2520

  Copy full SHA for 0cf2520

• Code cleanup.

  kirk-sayre-work

  committed
  9d36bde

  Copy full SHA for 9d36bde

• Documentation update.

  kirk-sayre-work

  committed
  7173330

  Copy full SHA for 7173330

• Documentation update.

  kirk-sayre-work

  committed
  2b8b1f4

  Copy full SHA for 2b8b1f4

Commits on Apr 7, 2021

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  0eadfcc

  Copy full SHA for 0eadfcc

Commits on Apr 8, 2021

• Fix missing args.

  kirk-sayre-work

  committed
  0267a3d

  Copy full SHA for 0267a3d

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  4d5dcc4

  Copy full SHA for 4d5dcc4

• Code cleanup.

  kirk-sayre-work

  committed
  244156c

  Copy full SHA for 244156c

• Code documentation.

  kirk-sayre-work

  committed
  00607d1

  Copy full SHA for 00607d1

• Fixed bugs from refactoring.

  kirk-sayre-work

  committed
  7c1e962

  Copy full SHA for 7c1e962

Commits on Apr 9, 2021

• Code Cleanup.

  kirk-sayre-work

  committed
  8f5449f

  Copy full SHA for 8f5449f

Commits on Apr 12, 2021

• Code documentation.

  kirk-sayre-work

  committed
  365e767

  Copy full SHA for 365e767

• Track base64 encoded PEs broken up over multiple Excel cells.

  kirk-sayre-work

  committed
  ac26d45

  Copy full SHA for ac26d45

Commits on Apr 13, 2021

• Don't add b64 twice to reassembled b64 encoded PE blobs.

  kirk-sayre-work

  committed
  a11120c

  Copy full SHA for a11120c

• Code cleanup.

  kirk-sayre-work

  committed
  890c48c

  Copy full SHA for 890c48c

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  8601787

  Copy full SHA for 8601787

• Code documentation.

  kirk-sayre-work

  committed
  d12b9f0

  Copy full SHA for d12b9f0

Commits on Apr 14, 2021

• Code cleanup.

  kirk-sayre-work

  committed
  74998ec

  Copy full SHA for 74998ec

• Code documentation.

  kirk-sayre-work

  committed
  f0da156

  Copy full SHA for f0da156

• Code cleanup.

  kirk-sayre-work

  committed
  e06c1fa

  Copy full SHA for e06c1fa

Commits on Apr 16, 2021

• Code cleanup.

  kirk-sayre-work

  committed
  af16d33

  Copy full SHA for af16d33

• Code cleanup.

  kirk-sayre-work

  committed
  30fc06a

  Copy full SHA for 30fc06a

• Make sure whitespace chars needed for VBA properly overriden in pyparsing.

  kirk-sayre-work

  committed
  d0f8204

  Copy full SHA for d0f8204

Commits on Apr 19, 2021

• Fixed bug in reading in Excel cell value.

  kirk-sayre-work

  committed
  889d4bf

  Copy full SHA for 889d4bf

• Don't download docker image from docker repo unless --upgrade option is given.

  Show description for 5e642bb
  kirk-sayre-work

  committed
  5e642bb

  Copy full SHA for 5e642bb

Commits on Apr 20, 2021

• Added more Office enums.

  kirk-sayre-work

  committed
  c20d1f9

  Copy full SHA for c20d1f9

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  4d9d933

  Copy full SHA for 4d9d933

• Merged with master.

  kirk-sayre-work

  committed
  8c7077b

  Copy full SHA for 8c7077b

Commits on Apr 21, 2021

• Fix bug in Join() emulation.

  kirk-sayre-work

  committed
  f1cec34

  Copy full SHA for f1cec34

Commits on Apr 26, 2021

• Don't mark func arg vars as globals in Python JIT code.

  kirk-sayre-work

  committed
  8794494

  Copy full SHA for 8794494

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  5711ffa

  Copy full SHA for 5711ffa

• Code documentation.

  kirk-sayre-work

  committed
  be65d8f

  Copy full SHA for be65d8f

Commits on Apr 28, 2021

• Fixed Excel enum value.

  kirk-sayre-work

  committed
  1514a55

  Copy full SHA for 1514a55

• Code documentation.

  kirk-sayre-work

  committed
  02d47ce

  Copy full SHA for 02d47ce

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  e96a5b1

  Copy full SHA for e96a5b1

• Code cleanup.

  kirk-sayre-work

  committed
  107944a

  Copy full SHA for 107944a

Commits on Apr 29, 2021

• Code cleanup.

  kirk-sayre-work

  committed
  4b4d43a

  Copy full SHA for 4b4d43a

Commits on Apr 30, 2021

• Code cleanup.

  kirk-sayre-work

  committed
  cdcf8d8

  Copy full SHA for cdcf8d8

• Code documentation.

  kirk-sayre-work

  committed
  a0d9e3b

  Copy full SHA for a0d9e3b

• Code cleanup.

  kirk-sayre-work

  committed
  7c258b4

  Copy full SHA for 7c258b4

• Code documentation.

  kirk-sayre-work

  committed
  999bf2c

  Copy full SHA for 999bf2c

• Code cleanup.

  kirk-sayre-work

  committed
  868e9ab

  Copy full SHA for 868e9ab

• Code documentation.

  kirk-sayre-work

  committed
  623d4f4

  Copy full SHA for 623d4f4

• Code cleanup.

  kirk-sayre-work

  committed
  c8cd26d

  Copy full SHA for c8cd26d

Commits on May 3, 2021

• Code cleanup, code documentation.

  kirk-sayre-work

  committed
  475c66b

  Copy full SHA for 475c66b

• Code cleanup.

  kirk-sayre-work

  committed
  6723dd7

  Copy full SHA for 6723dd7

• Code documentation.

  kirk-sayre-work

  committed
  dbc2e40

  Copy full SHA for dbc2e40

• Code documentation.

  kirk-sayre-work

  committed
  38d26fb

  Copy full SHA for 38d26fb

• Code documentation.

  kirk-sayre-work

  committed
  7ff6f44

  Copy full SHA for 7ff6f44

Commits on May 4, 2021

• Code cleanup.

  kirk-sayre-work

  committed
  0fc9631

  Copy full SHA for 0fc9631

• Code cleanup.

  kirk-sayre-work

  committed
  4923c30

  Copy full SHA for 4923c30

Commits on May 5, 2021

• Speculative emulation. Emulate with wild card values always matching and never matching.

  kirk-sayre-work

  committed
  c41f0af

  Copy full SHA for c41f0af

• Code cleanup.

  kirk-sayre-work

  committed
  fcf1464

  Copy full SHA for fcf1464

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  4cf4eda

  Copy full SHA for 4cf4eda

Commits on May 6, 2021

• Code cleanup.

  kirk-sayre-work

  committed
  7f9af76

  Copy full SHA for 7f9af76

• Code documentation.

  kirk-sayre-work

  committed
  6382ff3

  Copy full SHA for 6382ff3

• Bug fixes from regression testing.

  kirk-sayre-work

  committed
  1e62ac5

  Copy full SHA for 1e62ac5

• Code cleanup.

  kirk-sayre-work

  committed
  94d38c9

  Copy full SHA for 94d38c9

• Code documentation.

  kirk-sayre-work

  committed
  eff9523

  Copy full SHA for eff9523

Commits on May 7, 2021

• Added functionality to handle Property Get definitions.

  Show description for bb495a6
  kirk-sayre-work

  committed
  bb495a6

  Copy full SHA for bb495a6

• Fix parsing of VBS in Execute() emulation.

  kirk-sayre-work

  committed
  2cf7323

  Copy full SHA for 2cf7323

Commits on May 10, 2021

• Fixed a GOTO in loop handling bug.

  kirk-sayre-work

  committed
  0673957

  Copy full SHA for 0673957

• Added missing import.

  kirk-sayre-work

  committed
  05d1631

  Copy full SHA for 05d1631

• Code cleanup.

  kirk-sayre-work

  committed
  e5c104a

  Copy full SHA for e5c104a

• Trying to get ready to merge.

  kirk-sayre-work

  committed
  f9da1ce

  Copy full SHA for f9da1ce

• Merge branch 'python3_port' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  9c46bdb

  Copy full SHA for 9c46bdb

• Merge branch 'master' of https://github.com/kirk-sayre-work/ViperMonkey into python3_port

  kirk-sayre-work

  committed
  bc97d3c

  Copy full SHA for bc97d3c

• Added missing imports.

  kirk-sayre-work

  committed
  0dec29e

  Copy full SHA for 0dec29e

Commits on May 11, 2021

• Track GET/PUTs to just domains, not full URLs.

  kirk-sayre-work

  committed
  c81cfbb

  Copy full SHA for c81cfbb

Commits on May 12, 2021

• Paragraphs(NN) VBA access is 1-based.

  kirk-sayre-work

  committed
  41ef964

  Copy full SHA for 41ef964

• Look for embedded object vals minus OLE stream info if needed.

  kirk-sayre-work

  committed
  6186847

  Copy full SHA for 6186847

• In Python JIT code sometimes initialize unititialized int vars to "NULL".

  kirk-sayre-work

  committed
  a22a7d1

  Copy full SHA for a22a7d1

• Break recursion in Context.contains() by calling __get() rather than get().

  kirk-sayre-work

  committed
  baa75fe

  Copy full SHA for baa75fe

Commits on May 13, 2021

• Another attempt at getting VBA extended ASCII to process correctly.

  kirk-sayre-work

  committed
  46b7efc

  Copy full SHA for 46b7efc

• Code cleanup.

  kirk-sayre-work

  committed
  d253a2a

  Copy full SHA for d253a2a

• Code documentation.

  kirk-sayre-work

  committed
  b1c07ed

  Copy full SHA for b1c07ed

• Code cleanup.

  kirk-sayre-work

  committed
  8776a6a

  Copy full SHA for 8776a6a

• Code documentation.

  kirk-sayre-work

  committed
  50d00d4

  Copy full SHA for 50d00d4

• Code documentation.

  kirk-sayre-work

  committed
  de5cc04

  Copy full SHA for de5cc04

Commits on May 14, 2021

• Fixed bug in embedded object text extraction.

  kirk-sayre-work

  committed
  bfdf24e

  Copy full SHA for bfdf24e

• Speed up reading in CSV Excel file contents.

  kirk-sayre-work

  committed
  de84fd0

  Copy full SHA for de84fd0

• Fix bug with creating a Context() object.

  kirk-sayre-work

  committed
  da884d7

  Copy full SHA for da884d7

• Fixed bug in CreateTextFile() emulation.

  kirk-sayre-work

  committed
  45e0694

  Copy full SHA for 45e0694

• Fixed rewriting of #...# expressions.

  kirk-sayre-work

  committed
  dc00383

  Copy full SHA for dc00383

• Fixed parsing of Property Get constructs.

  kirk-sayre-work

  committed
  d0cfe79

  Copy full SHA for d0cfe79

• Fixed bug rewriting scientific notation floats.

  kirk-sayre-work

  committed
  23876b7

  Copy full SHA for 23876b7

• Added parsing for Property Set.

  kirk-sayre-work

  committed
  872527b

  Copy full SHA for 872527b

• Fix bug in fixing missing 1st arguments in calls.

  kirk-sayre-work

  committed
  d4cc616

  Copy full SHA for d4cc616

Commits on May 17, 2021

• Fixed bug in checking if statement was exited with a GOTO.

  kirk-sayre-work

  committed
  a62f36a

  Copy full SHA for a62f36a

• Form text extraction tweak.

  kirk-sayre-work

  committed
  1e4b9e9

  Copy full SHA for 1e4b9e9

• Turn off debugging.

  kirk-sayre-work

  committed
  0b8ec8b

  Copy full SHA for 0b8ec8b

Commits on May 18, 2021

• Tell user if embedded PE file is extracted.

  kirk-sayre-work

  committed
  e832a43

  Copy full SHA for e832a43

• Handle reading .Text field in Python JIT code.

  kirk-sayre-work

  committed
  fa5c19d

  Copy full SHA for fa5c19d

Commits on May 19, 2021

• Fixed logic in autoconversion of strings to/from byte arrays.

  kirk-sayre-work

  committed
  2d3ac7a

  Copy full SHA for 2d3ac7a

• Fixed extraction of base64 encoded payloads.

  kirk-sayre-work

  committed
  39bee6a

  Copy full SHA for 39bee6a

Commits on May 20, 2021

• Switch all str() string conversions to utils.safe_str_convert().

  kirk-sayre-work

  committed
  49fc595

  Copy full SHA for 49fc595

• Fixed some bugs from safe_str_convert() change.

  kirk-sayre-work

  committed
  e163ee0

  Copy full SHA for e163ee0

• Break out Python JIT code from vba_object.py into it's own package.

  kirk-sayre-work

  committed
  a447588

  Copy full SHA for a447588

• Break out type conversion functions into seperate package.

  kirk-sayre-work

  committed
  32fc6c1

  Copy full SHA for 32fc6c1

• Finished refactoring type coercion code.

  kirk-sayre-work

  committed
  ecce50c

  Copy full SHA for ecce50c

• Refactoring import bug fix.

  kirk-sayre-work

  committed
  0371dc7

  Copy full SHA for 0371dc7

• Working Doxygen documentation generation.

  kirk-sayre-work

  committed
  26ee1bd

  Copy full SHA for 26ee1bd

• Updated README to include how to generate code documentation.

  kirk-sayre-work

  committed
  9954c6c

  Copy full SHA for 9954c6c

• README tweak.

  kirk-sayre-work

  committed
  0ae8041

  Copy full SHA for 0ae8041

Commits on May 21, 2021

• Throttle the reporting of repeated actions.

  kirk-sayre-work

  committed
  724d275

  Copy full SHA for 724d275

• Updated code documentation.

  kirk-sayre-work

  committed
  b7e981a

  Copy full SHA for b7e981a

• Merge pull request #38 from kirk-sayre-work/python3_port

  Show description for 196c0fe
  kirk-sayre-work

  authored
  196c0fe

  Copy full SHA for 196c0fe

Commits on May 26, 2021

• Added ExcelWorkbook method for getting all cells.

  kirk-sayre-work

  committed
  028f8a6

  Copy full SHA for 028f8a6

• Removed some debug prints.

  kirk-sayre-work

  committed
  00e752a

  Copy full SHA for 00e752a

Commits on May 27, 2021

• Better handling of logic on wildcarded file names.

  kirk-sayre-work

  committed
  fe0142e

  Copy full SHA for fe0142e

Commits on Jun 2, 2021

• Allow 0 element enums.

  kirk-sayre-work

  committed
  01ed99f

  Copy full SHA for 01ed99f

Commits on Jun 11, 2021

• Don't analyze extracted HTA that is pure HTML.

  Show description for 1f04353
  kirk-sayre-work

  committed
  1f04353

  Copy full SHA for 1f04353

• Added missing import to generated JIT code.

  kirk-sayre-work

  committed
  7ad66d2

  Copy full SHA for 7ad66d2

• Reduce iterations for detecting infinite loop.

  kirk-sayre-work

  committed
  33a1e32

  Copy full SHA for 33a1e32

Commits on Jun 23, 2021

• Improved HTA VBScript extraction.

  kirk-sayre-work

  committed
  c7ed2c0

  Copy full SHA for c7ed2c0

• Special handling of Dir() when vbDirectory is given in attribute arg.

  kirk-sayre-work

  committed
  c90d715

  Copy full SHA for c90d715

Commits on Jun 24, 2021

• Modified upper iteration bound for infinite loop checking in JIT loops.

  kirk-sayre-work

  committed
  be95499

  Copy full SHA for be95499

Commits on Jun 25, 2021

• Fixed redim emulation bug.

  kirk-sayre-work

  committed
  06fce89

  Copy full SHA for 06fce89

Commits on Jun 28, 2021

• Cells() returns a String.

  Show description for f191d68
  kirk-sayre-work

  committed
  f191d68

  Copy full SHA for f191d68

• Keep longest b64 IOCs if we have too many.

  kirk-sayre-work

  committed
  b646620

  Copy full SHA for b646620

Commits on Jun 29, 2021

• Fix accessing table cells in Word document.

  kirk-sayre-work

  committed
  24dd5d2

  Copy full SHA for 24dd5d2

Commits on Jun 30, 2021

• Fixed bug in saving file.

  kirk-sayre-work

  committed
  4953a3e

  Copy full SHA for 4953a3e

• Fixed a bug with Python JIT code generation for member access expressions.

  kirk-sayre-work

  committed
  f823d45

  Copy full SHA for f823d45

Commits on Jul 2, 2021

• Give info about explicit function exits.

  kirk-sayre-work

  committed
  4883003

  Copy full SHA for 4883003

Commits on Jul 8, 2021

• Fix comparison bug.

  Show description for 749f03c
  kirk-sayre-work

  committed
  749f03c

  Copy full SHA for 749f03c

• Fixed bug with breaking out of loops due to index errors in JIT code.

  kirk-sayre-work

  committed
  de4472f

  Copy full SHA for de4472f

Commits on Jul 9, 2021

• Better handling on form control text.

  kirk-sayre-work

  committed
  f15cf62

  Copy full SHA for f15cf62

Commits on Jul 14, 2021

• Handle loosley typed <, >, <=, and >= in Python JIT code.

  kirk-sayre-work

  committed
  2da7e2f

  Copy full SHA for 2da7e2f

Commits on Jul 19, 2021

• Fixed dynamic code execution check in Python JIT code generation.

  kirk-sayre-work

  committed
  c981f0a

  Copy full SHA for c981f0a

• Handle things like 'a + + "ff"'.

  kirk-sayre-work

  committed
  e12c3e6

  Copy full SHA for e12c3e6

Commits on Jul 22, 2021

• Improved HTA extraction.

  kirk-sayre-work

  committed
  64c844e

  Copy full SHA for 64c844e

Commits on Jul 23, 2021

• Read doc text from XML Word docs.

  kirk-sayre-work

  committed
  b681ebb

  Copy full SHA for b681ebb

Commits on Jul 26, 2021

• Convert numeric Excel cell comments to numbers.

  kirk-sayre-work

  committed
  3e72787

  Copy full SHA for 3e72787

• Read last row in Range() Excel emulation.

  kirk-sayre-work

  committed
  791cdb9

  Copy full SHA for 791cdb9

Commits on Jul 27, 2021

• Added functionality to extract files embedded in Windows 97 samples.

  kirk-sayre-work

  committed
  af8cf7c

  Copy full SHA for af8cf7c

Commits on Jul 28, 2021

• Track decoded strings.

  kirk-sayre-work

  committed
  3425f71

  Copy full SHA for 3425f71

Commits on Aug 4, 2021

• Gracefully handle running export_all_excel_sheets.py on an OOXML Word file.

  kirk-sayre-work

  committed
  29078c1

  Copy full SHA for 29078c1