Error: unpack_from requires a buffer of at least 4 bytes about pcodedmp

[bontchev]

LOL. This isn't exactly my problem - the ThisWorkbook stream has been fucked up by Kaspersky's anti-virus program, zapping with zeroes all the structures that pcodedmp normally parses:

I should probably add some kind of sanity check and abort the processing of the stream if this kind of idiocy is encountered, but it's not too urgent; the current error is probably good enough.

[decalage2]

Good catch, I hadn't looked at it in a hex viewer... :-)
So if we get an error in pcodedmp and if the stream starts with zeroes and contains "Kaspersky", then we know what it is. ;-)
However, it's strange the pcode is wiped but not the compressed VBA (I mean, not fully).

[bontchev]

I am more and more inclined not to do anything about this... I mean, if I add a specific check that a pointer I'm trying to read from points outside the stream everywhere where this can happen, the program will become twice the size and much less readable. Now it just has a catch-all error.

Honestly, I had a better opinion of Kaspersky's ability to handle VBA. They seemed to be doing better than this in the past.

The source is not malicious. This makes me think that this is not the original source. Most likely, there was something malicious in the module - that's why KAV zapped the p-code area (and lots of stuff before it) and overwrote the source code area with some innocent source.

Seems stupid, though. In such cases (when you can't remove the module, because ThisWorkbook has to be present), we overwrite it with a complete, valid, empty module that our scanner carries within itself.

[bontchev]

I've pushed a change to the develop branch that makes the program display are more meaningful error message when trying to read past the end of a stream. Merging with master and releasing a new version o PyPi will have to wait until there are more substantial changes.