From 4984d587429dec8aa6511e7f1bc8f1e23f8e6a9e Mon Sep 17 00:00:00 2001 From: Sébastien Larinier Date: Fri, 22 Jul 2016 15:59:40 +0200 Subject: [PATCH] fixed mht cases to compliant python3.5 in olevba --- oletools/olevba.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/oletools/olevba.py b/oletools/olevba.py index e3358db..4977036 100755 --- a/oletools/olevba.py +++ b/oletools/olevba.py @@ -404,7 +404,7 @@ TYPE2TAG = { # MSO files ActiveMime header magic -MSO_ACTIVEMIME_HEADER = 'ActiveMime' +MSO_ACTIVEMIME_HEADER = b'ActiveMime' MODULE_EXTENSION = "bas" CLASS_EXTENSION = "cls" @@ -2333,6 +2333,8 @@ class VBA_Parser(object): """ log.info('Opening MHTML file %s' % self.filename) try: + if isinstance(data,bytes): + data = data.decode('utf8', 'replace') # parse the MIME content # remove any leading whitespace or newline (workaround for issue in email package) stripped_data = data.lstrip('\r\n\t ') @@ -2362,7 +2364,8 @@ class VBA_Parser(object): # using the ActiveMime/MSO format (zlib-compressed), and Base64 encoded. # decompress the zlib data starting at offset 0x32, which is the OLE container: # check ActiveMime header: - if isinstance(part_data, str) and is_mso_file(part_data): + + if (isinstance(part_data, str) or isinstance(part_data, bytes)) and is_mso_file(part_data): log.debug('Found ActiveMime header, decompressing MSO container') try: ole_data = mso_file_extract(part_data) -- libgit2 0.21.4