diff --git a/.gitbook/assets/image (152).png b/.gitbook/assets/image (152).png new file mode 100644 index 000000000..7234000fa Binary files /dev/null and b/.gitbook/assets/image (152).png differ diff --git a/.gitbook/assets/image (153).png b/.gitbook/assets/image (153).png new file mode 100644 index 000000000..f7bf7e3fd Binary files /dev/null and b/.gitbook/assets/image (153).png differ diff --git a/SUMMARY.md b/SUMMARY.md index f9bfa3f01..81cf4b3df 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -365,6 +365,7 @@ * [Common API used in Malware](reversing/common-api-used-in-malware.md) * [Reversing Tools](reversing/reversing-tools.md) * [Cryptographic Algorithms](reversing/cryptographic-algorithms.md) +* [Word Macros](reversing/word-macros.md) ## Exploiting diff --git a/reversing/word-macros.md b/reversing/word-macros.md new file mode 100644 index 000000000..8ea4c0979 --- /dev/null +++ b/reversing/word-macros.md @@ -0,0 +1,15 @@ +# Word Macros + +### Junk Code + +It's very common to find **junk code that is never used** to make the reversing of the macro more difficult. +For example, in the following image you can see that and If that is never going to be true is used to execute some junk and useless code. + +![](../.gitbook/assets/image%20%28152%29.png) + +### Macro Forms + +Using the **GetObject** function it's possible to obtain data from forms of the macro. This can be used to difficult the analysis. The following is a photo of a macro form used to **hide data inside text boxes** \(a text box can be hiding other text boxes\): + +![](../.gitbook/assets/image%20%28153%29.png) +