Merge remote-tracking branch 'kijeong/add/projectcompatversion_record'

# Conflicts: # tests/olevba/test_basic.py

Merge remote-tracking branch 'kijeong/add/projectcompatversion_record'
# Conflicts: # tests/olevba/test_basic.py
decalage2
2 parents fd821f0f 5f333b04
Showing 4 changed files with 45 additions and 3 deletions
oletools/olevba.py
tests/oleid/test_basic.py
tests/olevba/test_basic.py
tests/test-data/olevba/sample_with_vba.ppt
@@ -234,6 +234,7 @@ from __future__ import print_function
 # 2020-09-28       PL: - added VBA_Parser.get_vba_code_all_modules (partial fix
 #                        for issue #619)
 # 2021-04-14       PL: - added detection of Workbook_BeforeClose (issue #518)
+# 2021-11-09       KJ: - added PROJECTCOMPATVERSION Record on dir Stream
 __version__ = '0.60.2dev1'
@@ -1701,9 +1702,25 @@ class VBA_Project(object):
         if self.syskind not in SYSKIND_NAME:
             log.error("invalid PROJECTSYSKIND_SysKind {0:04X}".format(self.syskind))
-        # PROJECTLCID Record
+        # PROJECTLCID Record or PROJECTCOMPATVERSION Record
+        project_id = struct.unpack("<H", dir_stream.read(2))[0]
+        if project_id == 0x004A:
+            # PROJECTCOMPATVERSION Record
+            # Specifies the VBA project's compat version.
+            projectcompatversion_id = project_id
+            self.check_value('PROJETCOMPATVERSION_Id', 0x004A, projectcompatversion_id)
+            projectcompatversion_size = struct.unpack("<L", dir_stream.read(4))[0]
+            self.check_value('PROJECTCOMPATVERSION_Size', 0x0004, projectcompatversion_size)
+            projectcompatversion_compatversion = struct.unpack("<L", dir_stream.read(4))[0]
+            # compat version: A 32-bit number that identifies the Office Model version used by a VBA project.
+            log.debug("compat version: {compat_version}".format(compat_version=projectcompatversion_compatversion))
+
+            # PROJECTLCID Record
+            project_id = struct.unpack("<H", dir_stream.read(2))[0]
+
+        projectlcid_id = project_id
+
         # Specifies the VBA project's LCID.
-        projectlcid_id = struct.unpack("<H", dir_stream.read(2))[0]
         self.check_value('PROJECTLCID_Id', 0x0002, projectlcid_id)
         projectlcid_size = struct.unpack("<L", dir_stream.read(4))[0]
         self.check_value('PROJECTLCID_Size', 0x0004, projectlcid_size)
@@ -67,6 +67,11 @@ class TestOleIDBasic(unittest.TestCase):
                                  '949: ANSI/OEM Korean (Unified Hangul Code)')
                 self.assertEqual(value_dict['author'],
                                  b'\xb1\xe8\xb1\xe2\xc1\xa4;kijeong')
+            elif 'olevba/sample_with_vba.ppt' in filename:
+                self.assertEqual(value_dict['codepage'],
+                                 '949: ANSI/OEM Korean (Unified Hangul Code)')
+                self.assertEqual(value_dict['author'],
+                                 b'\xb1\xe8 \xb1\xe2\xc1\xa4')
             else:
                 self.assertEqual(value_dict['codepage'],
                                  '1252: ANSI Latin 1; Western European (Windows)')
@@ -120,7 +125,9 @@ class TestOleIDBasic(unittest.TestCase):
                             'msodde/dde-in-excel2003.xml',   # same as above
                             'oleform/oleform-PR314.docm',
                             'basic/empty',                   # WTF?
-                            'basic/text'):                   # no macros!
+                            'basic/text',                    # no macros!
+                            'olevba/sample_with_vba.ppt',
+                            ):
                 self.assertEqual(value_dict['vba'], 'Yes')
             else:
                 self.assertEqual(value_dict['vba'], 'No')
@@ -147,6 +147,24 @@ class TestOlevbaBasic(unittest.TestCase):
                 self.assertIn('AutoExec', types)
                 self.assertIn('Suspicious', types)
+    def test_dir_stream_record_project_compat_version(self):
+        """Test PROJECTCOMPATVERSION record on dir stream with a ppt file."""
+        input_file = join(DATA_BASE_DIR, 'olevba', 'sample_with_vba.ppt')
+        output, ret_code = call_and_capture('olevba', args=(input_file, "--loglevel", "debug"))
+
+        # check return code
+        self.assertEqual(ret_code, 0)
+
+        # not expected string:
+        self.assertNotIn('invalid value for PROJECTLCID_Id expected 0002 got', output)
+        self.assertNotIn('Error in _extract_vba', output)
+
+        # compat version in debug mode:
+        self.assertIn('compat version: 2', output)
+
+        # vba contents:
+        self.assertIn('Sub Action_Click()\n  MsgBox "The action button clicked!"\nEnd Sub', output)
+
 # just in case somebody calls this file as a script
 if __name__ == '__main__':