Re: [Clamav-users] VBA decoding, update

2004-01-23 Thread Tomasz Kojm
On Fri, 23 Jan 2004 06:41:01 GMT Tomasz Klim <[EMAIL PROTECTED]> wrote: > Think about what will happen, if an unpacked OLE2 part will be > scanned and recursively unpacked as OLE2. That's not possible - there are no nested OLE2 files. But of course global variables should be eliminated. > ---

Re: [Clamav-users] VBA decoding, update

2004-01-23 Thread Trog
Quoting Tomasz Kojm <[EMAIL PROTECTED]>: > > I'm impressed. I just implemented your code in clamav and it seems to > work very well (I've only found a few documents that cause a segfault > and will try to debug the problem ASAP (and will send you them)). > > Great work !! Hope the community will

Re: [Clamav-users] VBA decoding, update

2004-01-23 Thread Tomasz Kojm
On Thu, 22 Jan 2004 21:31:26 + (GMT) Trog <[EMAIL PROTECTED]> wrote: > Hi Tomasz/all > > I have been working on extracting VBA code from the MS Office document > component parts that the OLE2 unpacker I sent a couple of weeks ago > generates. Hello Trog, I'm impressed. I just implemented yo

Re: [Clamav-users] VBA decoding, update

2004-01-23 Thread Trog
Quoting Tomasz Klim <[EMAIL PROTECTED]>: > > Trog, what do you think about rewriting these programs (at least > ole2_extract.c) to not use global variables: > Done. In the same place as before: http://www.uncon.org/files/ole2_extract.c -trog

Re: [Clamav-users] VBA decoding, update

2004-01-23 Thread Trog
Quoting Tomasz Klim <[EMAIL PROTECTED]>: > > Trog, what do you think about rewriting these programs (at least > ole2_extract.c) to not use global variables: > > int big_block_size, small_block_size; > int sbat_start=-1; > > Think about what will happen, if an unpacked OLE2 part will be > scanne

Re: [Clamav-users] VBA decoding, update

2004-01-23 Thread Tomasz Klim
> I have been working on extracting VBA code from the MS Office document component > parts that the OLE2 unpacker I sent a couple of weeks ago generates. > > The code linked below should work on files from Office97 onwards, VBA 5 and 6. I > have tested some Word and Excel files, and things look

[Clamav-users] VBA decoding, update

2004-01-22 Thread Trog
Hi Tomasz/all I have been working on extracting VBA code from the MS Office document component parts that the OLE2 unpacker I sent a couple of weeks ago generates. The code linked below should work on files from Office97 onwards, VBA 5 and 6. I have tested some Word and Excel files, and things lo