Peter M. Groen / oletools

Commit 1d7e6144e25546f4dcad257980dac2090c1bd38b

Authored by decalage2
1 parent ca0087b0

oleform/olevba: fixed a few issues related to #218 (work in progress)

Inline Side-by-side
Showing 2 changed files with 12 additions and 8 deletions
oletools/oleform.py
  View file @1d7e614
... ... @@ -94,7 +94,7 @@ class ExtendedStream(object):
94 94 return self.unpacks(format, size)[0]
95 95  
96 96 def raise_error(self, reason, back=0):
97   - raise OleFormParsingError('{0}:{1}: {2}'.format(self.path, self._pos - back))
  97 + raise OleFormParsingError('{0}:{1}: {2}'.format(self._path, self._pos - back, reason))
98 98  
99 99 def check_values(self, name, format, size, expected):
100 100 value = self.unpacks(format, size)
... ... @@ -283,6 +283,7 @@ def consume_MorphDataControl(stream):
283 283 def extract_OleFormVariables(ole_file, stream_dir):
284 284 control = ExtendedStream.open(ole_file, '/'.join(stream_dir + ['f']))
285 285 variables = list(consume_FormControl(control))
  286 + print('/'.join(stream_dir + ['o']))
286 287 data = ExtendedStream.open(ole_file, '/'.join(stream_dir + ['o']))
287 288 for var in variables:
288 289 if var['ClsidCacheIndex'] != 23:
... ...
oletools/olevba.py
  View file @1d7e614
... ... @@ -198,8 +198,9 @@ from __future__ import print_function
198 198 # 2017-06-15 PL: - deobfuscation line by line to handle large files
199 199 # 2017-07-11 v0.52 PL: - raise exception instead of sys.exit (issue #180)
200 200 # 2017-11-08 VB: - PR #124 adding user form parsing (Vincent Brillault)
  201 +# 2017-11-17 PL: - fixed a few issues with form parsing
201 202  
202   -__version__ = '0.52dev3'
  203 +__version__ = '0.52dev4'
203 204  
204 205 #------------------------------------------------------------------------------
205 206 # TODO:
... ... @@ -266,7 +267,6 @@ except ImportError:
266 267 + "see http://codespeak.net/lxml " \
267 268 + "or http://effbot.org/zone/element-index.htm")
268 269  
269   -from oleform import extract_OleFormVariables
270 270  
271 271 # IMPORTANT: it should be possible to run oletools directly as scripts
272 272 # in any directory without installing them with pip or setup.py.
... ... @@ -289,6 +289,7 @@ from oletools.thirdparty.pyparsing.pyparsing import \
289 289 alphanums, alphas, hexnums,nums, opAssoc, srange, \
290 290 infixNotation, ParserElement
291 291 from oletools import ppt_parser
  292 +from oletools import oleform
292 293  
293 294  
294 295 # monkeypatch email to fix issue #32:
... ... @@ -3005,7 +3006,7 @@ class VBA_Parser(object):
3005 3006 self.find_vba_forms()
3006 3007 ole = self.ole_file
3007 3008 for form_storage in self.vba_forms:
3008   - for variable in extract_OleFormVariables(ole, form_storage):
  3009 + for variable in oleform.extract_OleFormVariables(ole, form_storage):
3009 3010 yield (self.filename, '/'.join(form_storage), variable)
3010 3011  
3011 3012 def close(self):
... ... @@ -3137,10 +3138,12 @@ class VBA_Parser_CLI(VBA_Parser):
3137 3138 print('- ' * 39)
3138 3139 print(form_string)
3139 3140 for (subfilename, stream_path, form_variables) in self.extract_form_strings_extended():
3140   - print('-' * 79)
3141   - print('VBA FORM Variable "%s" IN %r - OLE stream: %r' % (form_variables['name'], subfilename, stream_path))
3142   - print('- ' * 39)
3143   - print(str(form_variables['value']))
  3141 + if form_variables is not None:
  3142 + print('-' * 79)
  3143 + print('VBA FORM Variable "%s" IN %r - OLE stream: %r' % (form_variables['name'], subfilename, stream_path))
  3144 + print('- ' * 39)
  3145 + print(str(form_variables['value']))
  3146 + # TODO: display error message otherwise (form parsing error)
3144 3147 if not vba_code_only:
3145 3148 # analyse the code from all modules at once:
3146 3149 self.print_analysis(show_decoded_strings, deobfuscate)
... ...