Commit 1281a509688153c0f2f91c353f8900ab9d9d9678
1 parent
957ac61c
olevba: improved display for empty macros
Showing
1 changed file
with
19 additions
and
16 deletions
oletools/olevba.py
| @@ -85,6 +85,7 @@ Usage: olevba.py <file> | @@ -85,6 +85,7 @@ Usage: olevba.py <file> | ||
| 85 | # - detect auto-executable macros | 85 | # - detect auto-executable macros |
| 86 | # - ignore empty macros | 86 | # - ignore empty macros |
| 87 | # 2014-12-14 v0.07 PL: - detect_autoexec() is now case-insensitive | 87 | # 2014-12-14 v0.07 PL: - detect_autoexec() is now case-insensitive |
| 88 | +# 2014-12-15 v0.08 PL: - improved display for empty macros | ||
| 88 | 89 | ||
| 89 | __version__ = '0.07' | 90 | __version__ = '0.07' |
| 90 | 91 | ||
| @@ -931,6 +932,7 @@ if __name__ == '__main__': | @@ -931,6 +932,7 @@ if __name__ == '__main__': | ||
| 931 | print '='*79 | 932 | print '='*79 |
| 932 | print 'File:', fname | 933 | print 'File:', fname |
| 933 | try: | 934 | try: |
| 935 | + #TODO: handle olefile errors, when an OLE file is malformed | ||
| 934 | vba = VBA_Parser(fname) | 936 | vba = VBA_Parser(fname) |
| 935 | print 'Type:', vba.type | 937 | print 'Type:', vba.type |
| 936 | if vba.detect_vba_macros(): | 938 | if vba.detect_vba_macros(): |
| @@ -938,28 +940,29 @@ if __name__ == '__main__': | @@ -938,28 +940,29 @@ if __name__ == '__main__': | ||
| 938 | for (filename, stream_path, vba_filename, vba_code) in vba.extract_macros(): | 940 | for (filename, stream_path, vba_filename, vba_code) in vba.extract_macros(): |
| 939 | # hide attribute lines: | 941 | # hide attribute lines: |
| 940 | vba_code = filter_vba(vba_code) | 942 | vba_code = filter_vba(vba_code) |
| 941 | - # ignore empty macros: | ||
| 942 | - if vba_code.strip() == '': | ||
| 943 | - continue | ||
| 944 | print '-'*79 | 943 | print '-'*79 |
| 945 | print 'Filename :', filename | 944 | print 'Filename :', filename |
| 946 | print 'OLE stream :', stream_path | 945 | print 'OLE stream :', stream_path |
| 947 | print 'VBA filename:', vba_filename | 946 | print 'VBA filename:', vba_filename |
| 948 | print '- '*39 | 947 | print '- '*39 |
| 949 | - print filter_vba(vba_code) | ||
| 950 | - print '- '*39 | ||
| 951 | - autoexec_keywords = detect_autoexec(vba_code) | ||
| 952 | - if autoexec_keywords: | ||
| 953 | - print 'Auto-executable macro keywords found:' | ||
| 954 | - t = prettytable.PrettyTable(('Keyword', 'Description')) | ||
| 955 | - t.align = 'l' | ||
| 956 | - t.max_width['Keyword'] = 20 | ||
| 957 | - t.max_width['Description'] = 59 | ||
| 958 | - for keyword, description in autoexec_keywords: | ||
| 959 | - t.add_row((keyword, description)) | ||
| 960 | - print t | 948 | + # detect empty macros: |
| 949 | + if vba_code.strip() == '': | ||
| 950 | + print '(empty macro)' | ||
| 961 | else: | 951 | else: |
| 962 | - print 'Auto-executable macro keywords: None found' | 952 | + print vba_code |
| 953 | + print '- '*39 | ||
| 954 | + autoexec_keywords = detect_autoexec(vba_code) | ||
| 955 | + if autoexec_keywords: | ||
| 956 | + print 'Auto-executable macro keywords found:' | ||
| 957 | + t = prettytable.PrettyTable(('Keyword', 'Description')) | ||
| 958 | + t.align = 'l' | ||
| 959 | + t.max_width['Keyword'] = 20 | ||
| 960 | + t.max_width['Description'] = 59 | ||
| 961 | + for keyword, description in autoexec_keywords: | ||
| 962 | + t.add_row((keyword, description)) | ||
| 963 | + print t | ||
| 964 | + else: | ||
| 965 | + print 'Auto-executable macro keywords: None found' | ||
| 963 | 966 | ||
| 964 | else: | 967 | else: |
| 965 | print 'No VBA macros found.' | 968 | print 'No VBA macros found.' |