Skip to content

Fixing 64 bit identification by User Agent #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
thiagomayllart wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fixing 64 bit identification by User Agent #40

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 11 additions & 8 deletions evilclippy.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
// Date: 20200415
// Version: 1.3 (added GUI unhide option)
//
// Special thanks to Carrie Roberts (@OrOneEqualsOne) from Walmart for her contributions to this project.
// Special thanks to Carrie Robberts (@OrOneEqualsOne) from Walmart for her contributions to this project.
//
// Compilation instructions
// Mono: mcs /reference:OpenMcdf.dll,System.IO.Compression.FileSystem.dll /out:EvilClippy.exe *.cs
Expand Down Expand Up @@ -445,7 +445,14 @@ static public byte[] SendFile(HttpListenerRequest request)
CFStream streamData = cf.RootStorage.GetStorage("Macros").GetStorage("VBA").GetStream("_VBA_PROJECT");
byte[] streamBytes = streamData.GetData();

string targetOfficeVersion = UserAgentToOfficeVersion(request.UserAgent);
string UACpu = "";
if (request.Headers["UA-CPU"] != null)
{
UACpu = request.Headers["UA-CPU"];

}

string targetOfficeVersion = UserAgentToOfficeVersion(request.UserAgent, UACpu);

ReplaceOfficeVersionInVBAProject(streamBytes, targetOfficeVersion);

Expand All @@ -459,7 +466,7 @@ static public byte[] SendFile(HttpListenerRequest request)
return File.ReadAllBytes(outFilename);
}

static string UserAgentToOfficeVersion(string userAgent)
static string UserAgentToOfficeVersion(string userAgent, string UACpu)
{
string officeVersion = "";

Expand All @@ -472,7 +479,7 @@ static string UserAgentToOfficeVersion(string userAgent)
officeVersion = "unknown";

// Determine architecture
if (userAgent.Contains("x64") || userAgent.Contains("Win64"))
if (userAgent.Contains("x64") || userAgent.Contains("Win64") || UACpu.Contains("64"))
officeVersion += "x64";
else
officeVersion += "x86";
Expand Down Expand Up @@ -523,10 +530,6 @@ private static byte[] ReplaceOfficeVersionInVBAProject(byte[] moduleStream, stri
version[0] = 0xAF;
version[1] = 0x00;
break;
case "2019x86":
version[0] = 0xAF;
version[1] = 0x00;
break;
case "2013x64":
version[0] = 0xA6;
version[1] = 0x00;
Expand Down