Greg Linares (Laughing Mantis) Profile picture
20+ yrs in Infosec. Malware Influencer. I turn Malware into Art and Music. Art @MalwareArt. 4x Pwnie Nominee. 𝕍𝕏. GameDev. Autistic.

Jun 30, 2020, 5 tweets

VBA is a totally fair and balanced language and does not need nerfs at all =)

Enjoy some code that I have dug up from a certain vault and try to guess what the debug output says.

Cookies and #respect rewards

#obfuscation #homoglyph #infosec #nerfvba #hephaestus #cordyceps

Debug.Output of the 2 cases above:

The reasoning for all of this fun stuff is the acceptable range of characters withing VBA variable space.

You can have not only homography issues within VBA but you can also have nonprintable characters (ie right to left change) as a valid variable name.

So in the end result this has quite a desirable affect on not only human reverse engineers, but also as i have recently found out certain tools that output details to sandbox reports.

The most effective ways to use this strategies are
A.) Variable generation to cause eye cancer for Reverse engineers
B.) is to create code paths and branches that move throughout the code as much as possible depending on checks with this variables to hydra out and make RE a pain

Share this Scrolly Tale with your friends.

A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.

Keep scrolling