Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Exception can't concatenate str to bytes python 3 #587

Closed
ANT1993 opened this issue Jun 29, 2020 · 2 comments
Closed

Exception can't concatenate str to bytes python 3 #587

ANT1993 opened this issue Jun 29, 2020 · 2 comments

Comments

@ANT1993
Copy link

ANT1993 commented Jun 29, 2020

Affected tool:
olevba

Describe the bug
With a specific document the olevba.analyze_macros() raise a exception in line 3413 and/or 3735 because vba_code is bytes.

self.vba_code_all_modules += vba_code + '\n'

vba_code_all_modules += vba_code + '\n'

File/Malware sample to reproduce the bug
https://www.virustotal.com/gui/file/1e6d72e0cbe34cf8e016857317b9f98050f492c3098971644ccef8b6c7db77c8/details
It's malware. If you want the file you can contact me.

(https://github.com/decalage2/oletools/files/4846132/1e6d72e0cbe34cf8e016857317b9f98050f492c3098971644ccef8b6c7db77c8.docx)

How To Reproduce the bug
Extract macros with olevba:
vbaparser = VBA_Parser(file_path) if vbaparser: if vbaparser.detect_vba_macros(): vbaparser.analyze_macros()

Version information:

  • Ubuntu 16.04 64 bits
  • Python 3.8 64 bits
  • oletools version: 0.55.1

Additional context
I've solved the error decoding bytes to string if it's instance of bytes in line 3359.

# TODO vba_code = self.encode_string(vba_code)

Solved with:
if isinstance(vba_code, bytes): vba_code = bytes2str(vba_code)

@decalage2
Copy link
Owner

I finally found the bug and fixed it: see #455 (comment)

decalage2 added a commit that referenced this issue Sep 16, 2020
…tect_vba_macros to always return VBA code as unicode on Python 3 (issues #455, #477, #587, #593)
c-rosenberg pushed a commit to HeinleinSupport/oletools that referenced this issue Sep 28, 2020
…ge2#593), fixed detect_vba_macros to always return VBA code as unicode on Python 3 (issues  decalage2#455, decalage2#477, decalage2#587, decalage2#593)
@decalage2
Copy link
Owner

This issue is now fixed in oletools 0.56.

# for free to join this conversation on GitHub. Already have an account? # to comment
Projects
None yet
Development

No branches or pull requests

2 participants