mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-22 04:33:28 +00:00
GitBook: [master] 2 pages and 2 assets modified
This commit is contained in:
parent
e5c039823f
commit
e71831645f
4 changed files with 16 additions and 0 deletions
BIN
.gitbook/assets/image (152).png
Normal file
BIN
.gitbook/assets/image (152).png
Normal file
Binary file not shown.
After Width: | Height: | Size: 76 KiB |
BIN
.gitbook/assets/image (153).png
Normal file
BIN
.gitbook/assets/image (153).png
Normal file
Binary file not shown.
After Width: | Height: | Size: 127 KiB |
|
@ -365,6 +365,7 @@
|
|||
* [Common API used in Malware](reversing/common-api-used-in-malware.md)
|
||||
* [Reversing Tools](reversing/reversing-tools.md)
|
||||
* [Cryptographic Algorithms](reversing/cryptographic-algorithms.md)
|
||||
* [Word Macros](reversing/word-macros.md)
|
||||
|
||||
## Exploiting
|
||||
|
||||
|
|
15
reversing/word-macros.md
Normal file
15
reversing/word-macros.md
Normal file
|
@ -0,0 +1,15 @@
|
|||
# Word Macros
|
||||
|
||||
### Junk Code
|
||||
|
||||
It's very common to find **junk code that is never used** to make the reversing of the macro more difficult.
|
||||
For example, in the following image you can see that and If that is never going to be true is used to execute some junk and useless code.
|
||||
|
||||
![](../.gitbook/assets/image%20%28152%29.png)
|
||||
|
||||
### Macro Forms
|
||||
|
||||
Using the **GetObject** function it's possible to obtain data from forms of the macro. This can be used to difficult the analysis. The following is a photo of a macro form used to **hide data inside text boxes** \(a text box can be hiding other text boxes\):
|
||||
|
||||
![](../.gitbook/assets/image%20%28153%29.png)
|
||||
|
Loading…
Reference in a new issue