Skip to content

Commit

Permalink
UPDATE - preparing v2.0
Browse files Browse the repository at this point in the history
  • Loading branch information
DissectMalware committed Nov 23, 2021
1 parent d035e46 commit a4bb762
Show file tree
Hide file tree
Showing 3 changed files with 17 additions and 11 deletions.
22 changes: 14 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ You can also find XLM grammar in [xlm-macro-lark.template](XLMMacroDeobfuscator/

# Installing the emulator

1. Install using pip (not recommended)
1. Install using pip

```
pip install XLMMacroDeobfuscator
Expand Down Expand Up @@ -84,18 +84,22 @@ default.config file must be a valid json file, such as:
(______/ (_______/(_______)|/ \___/ |/ (_______)\_______)(_______/|/ \| )_( (_______)|/ \__/
XLMMacroDeobfuscator(v0.1.9) - https://github.com/DissectMalware/XLMMacroDeobfuscator
XLMMacroDeobfuscator(v0.2.0) - https://github.com/DissectMalware/XLMMacroDeobfuscator
usage: deobfuscator.py [-h] [-c FILE_PATH] [-f FILE_PATH] [-n] [-x] [-2]
Error: --file is missing
usage: deobfuscator.py [-h] [-c FILE_PATH] [-f FILE_PATH] [-n] [-x]
[--sort-formulas] [--defined-names] [-2]
[--with-ms-excel] [-s] [-d DAY]
[--output-formula-format OUTPUT_FORMULA_FORMAT]
[--no-indent] [--export-json FILE_PATH]
[--extract-formula-format EXTRACT_FORMULA_FORMAT]
[--no-indent] [--silent] [--export-json FILE_PATH]
[--start-point CELL_ADDR] [-p PASSWORD]
[-o OUTPUT_LEVEL]
[-o OUTPUT_LEVEL] [--timeout N]
optional arguments:
-h, --help show this help message and exit
-c FILE_PATH, --config_file FILE_PATH
-c FILE_PATH, --config-file FILE_PATH
Specify a config file (must be a valid JSON file)
-f FILE_PATH, --file FILE_PATH
The path of a XLSM file
Expand All @@ -114,9 +118,10 @@ optional arguments:
Specify the format for output formulas ([[CELL-ADDR]],
[[INT-FORMULA]], and [[STATUS]]
--extract-formula-format EXTRACT_FORMULA_FORMAT
Specify the format for extracted formulas ([[CELL-ADDR]],
[[CELL-FORMULA]], and [[CELL-VALUE]]
Specify the format for extracted formulas ([[CELL-
ADDR]], [[CELL-FORMULA]], and [[CELL-VALUE]]
--no-indent Do not show indent before formulas
--silent Do not print output
--export-json FILE_PATH
Export the output to JSON
--start-point CELL_ADDR
Expand Down Expand Up @@ -166,6 +171,7 @@ XLMMacroDeofuscator is adopted in the following projects:
* [REMNUX](https://remnux.org/)
* [IntelOwl](https://github.com/intelowlproject/IntelOwl)
* [Assemblyline 4](https://cybercentrecanada.github.io/assemblyline4_docs/) by Canadian Centre for Cyber Security
* [oletools](https://github.com/decalage2/oletools) by [@decalage2](https://twitter.com/decalage2)

Please contact me if you incorporated XLMMacroDeofuscator in your project.

Expand Down
2 changes: 1 addition & 1 deletion XLMMacroDeobfuscator/__init__.py
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = '0.1.9'
__version__ = '0.2.0'
4 changes: 2 additions & 2 deletions setup.py
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,9 @@
license='Apache License 2.0',
python_requires='>=3.4',
install_requires=[
"pyxlsb2@https://github.com/DissectMalware/pyxlsb2/archive/master.zip",
"pyxlsb2",
"lark-parser",
"xlrd2@https://github.com/DissectMalware/xlrd2/archive/master.zip",
"xlrd2",
"untangle==1.1.1",
"msoffcrypto-tool"
],
Expand Down

0 comments on commit a4bb762

Please sign in to comment.