0

I am experimenting with VBA stomping in microsoft word documents. I have done it manually but also with the evilClippy tool aswell. What i have noticed is that, although the original vba code stays hidden at first (the p-code in other words stays intact), as soon as the user clicks on "Enable Macros", if he navigates to the developer panel (where the vba code exists) he can actually see the original vba code.

So i was wondering, is there any way that can prevet the original vba code re-appear after Macros have been enabled?

P.s. i basically want the only option for someone to analyse the macros to be with tools such as pcodedmp and not simply running the word doc inside a vm where he does not care if macros are enabled.

Improve this question

1 Answer 1

Reset to default
1

When Office opens a document with a VBA macro:

  1. If the user doesn't enable the content, the compressed source code is used in the Macros editor (and as the code to run).
  2. If the user enables the content and the VBA version of the compiled pcode is compatible with the current Office runtime, the pcode is decompiled and used as the source code in the Macros editor (and as the code to run).
  3. If the user enables the content and the VBA version of the compiled pcode is not compatible with the current Office runtime, the compressed source code is used in the Macros editor (and as the code to run).

So VBA stomping works only with a compatible VBA runtime and the users can always see the real code if it enables the macro content.

Luckily for us cybersecurity analysts, there are plenty of tools that can handle VBA stomping, including the always foolproof Office run in a VM, as you noticed.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .