Fake replacement VBA code not appearing in Editor

[evandrix]

I'm trying to hide the actual code in P-Code, and show a fake VBA code in the Editor, on Excel 365.

For some reason, this byte

EvilClippy/evilclippy.cs

Line 535 in fa610c6

version[0] = 0xB2;

is 0xB5, not 0xB2, on my copy.

• using 0xB2 in my target environment crashes Excel with VBA errors
• using 0xB5 shows the actual code in the Editor

Wondering if anyone has come across such a situation before?

[evandrix]

Hex dump of original _VBA_PROJECT stream:
00000000   CC 61 B5 00 00 03 00 FF  09 04 00 00 09 04 00 00   Ìaµ····ÿ········
...

[evandrix]