Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Defined name value type #5

Open
DissectMalware opened this issue Jan 20, 2021 · 2 comments
Open

Defined name value type #5

DissectMalware opened this issue Jan 20, 2021 · 2 comments
Assignees
Labels
enhancement New feature or request

Comments

@DissectMalware
Copy link
Owner

DissectMalware commented Jan 20, 2021

Defined name can reference to a cell, int, float, string and array

Currently, xlrd2 cannot parse array value type

f9adf499bc16bfd096e00bc59c3233f022dec20c20440100d56e58610e4aded3

Name:

SbhipD

Value:

b'`\x00\x11\x00\x00\x00\x00\x00\x00\x11\x00\x02\x18\x00\x00PcWs3NqZ8mTrRlTgf23I>K:O\x02\x1f\x00\x00HVo^2gXn7vZ_l]ZaV_1P?6_=CP<E:R;\x02\x1b\x00\x00JjX^HZ_]Mb\\sU]pT]NG??J35QEK\x02\x1b\x00\x00FhYaIQOtAqXqV`qKMe;KBH48R<=\x02\x1e\x00\x00]\\h]GRRu8aoee\\oLPf2;S<XAO;6LCB\x02\x06\x00\x00]ai`G4\x02\x17\x00\x00JxKSt;hXv36L,:PMJ9Y;>C3\x02\x06\x00\x00Gnbq1H\x02"\x00\x00HVo^2HeK@SNEN\\;WE]AH5>Q::PCX:H6>RB\x02\x1e\x00\x00z]5]C{`"(|}|c1k-tp}Ny%*)n/!"},\x02\n\x00\x00x]VbJq3>T3\x02]\x00\x00GdX`RmP;oKWe;<byU%y,6@5W&A1_R@AcK@+Z-3s;@XVR/AF/G\\;VL]AE-HC0\\QJJLW1/\\,0rDQ:bC3CE,FeK@TNEG,)B<\x02\x1f\x00\x00WMdQVoO8nTgNG-`%rs2W<57z\'9nqpUC\x02\x1b\x00\x00FcPSjXONa[Vd3/iUUs\'guA7>Y?3\x02\x00\x00\x00\x02\x1a\x00\x00]W_OhYROXKmXB+4xXxtLlX<5O4\x02\x17\x00\x00JeOPia_7mLZf2,n&g{8-9Q3\x02\x0f\x00\x00G,+/"*Xy$K^w%B2'

image

Name:
YZJvX

Value:

image

image

@DissectMalware DissectMalware added the enhancement New feature or request label Jan 20, 2021
@DissectMalware DissectMalware self-assigned this Jan 20, 2021
@DissectMalware
Copy link
Owner Author

DissectMalware commented Jan 20, 2021

60H (96) is an array

image

rgVal (data) starts at index 11

image

can be double or unicode string

image

image

image

@DissectMalware
Copy link
Owner Author

Code:

if opcode == 0x00: # tArray

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant