I am experimenting with VBA stomping in microsoft word documents. I have done it manually but also with the evilClippy tool aswell. What i have noticed is that, although the original vba code stays hidden at first (the p-code in other words stays intact), as soon as the user clicks on "Enable Macros", if he navigates to the developer panel (where the vba code exists) he can actually see the original vba code.
So i was wondering, is there any way that can prevet the original vba code re-appear after Macros have been enabled?
P.s. i basically want the only option for someone to analyse the macros to be with tools such as pcodedmp and not simply running the word doc inside a vm where he does not care if macros are enabled.