I am playing with some malicious MS Word documents which exploit a vulnerability in Word 2k3/2k7 to launch the shellcode. I am able to run it dynamically and get the drop-bys. However, I am interested in extracting the shellcode statically. I have tried to use Malscanner and some custom scripts for OLE to identify the start of the shellcode, so far no luck. Eventually I wanna do an ancient EB FE patching for easy debugging in Word.
Does anyone have experience playing with malicious docs? Or have a better way of debugging Word?