Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed bug in unwraping of string #109

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

cccs-ay
Copy link

@cccs-ay cccs-ay commented Mar 22, 2022

For an example of the previous bad behavior, see sample 7a99e0ff0d7f0951c53a21dfabc03fb9e06d1c585de62cc71d962c1c4dde4190

The bug pertains to the unwrapping of strings. A string that should not
have been unwrapped was stripped of it's quotes, leading to this
situation :

Correct evaluation :
=IF(MFCO5<0, CALL("urlmon","URLDownloadToFileA","JJCCBB",0, (...)

Evaluation prior to fix :
=IF(MFCO5<0, CALL("urlmon","URLDownloadToFileA,"JJCCBB,0," (...)

because the string ","JJCCBB" was being stripped to "JJCCBB

This caused an error in the parsing of the formula, crashing the
program.

To fix it, I have changed the unwrapping function to avoid unwrapping
when the count of quotes is uneven

see sample 7a99e0ff0d7f0951c53a21dfabc03fb9e06d1c585de62cc71d962c1c4dde4190

The bug pertains to the unwrapping of strings. A string that should not
have been unwrapped was stripped of it's quotes, leading to this
situation :

Correct evaluation :
=IF(MFCO5<0, CALL("urlmon","URLDownloadToFileA","JJCCBB",0, (...)

Evaluation prior to fix :
=IF(MFCO5<0, CALL("urlmon","URLDownloadToFileA,"JJCCBB,0,"  (...)

because the string ","JJCCBB" was being stripped to "JJCCBB

This caused an error in the parsing of the formula, crashing the
program.

To fix it, I have change the unwrapping function to avoid unwrapping
when the count of quotes is uneven
@DissectMalware
Copy link
Owner

I will check the PR soon, sorry for the late response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants