Commit 5d3718da11d7892f010a6edd40cb3b838e085f46

Authored by Philippe Lagadec
1 parent 4c98aa7a

updated olefile to v0.42

oletools/thirdparty/olefile/LICENSE.txt
1 1 LICENSE for the olefile package:
2 2  
3   -olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec
  3 +olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec
4 4 (http://www.decalage.info)
5 5  
6 6 All rights reserved.
... ...
oletools/thirdparty/olefile/README.html
... ... @@ -8,25 +8,21 @@
8 8 </head>
9 9 <body>
10 10 <h1 id="olefile-formerly-olefileio_pl">olefile (formerly OleFileIO_PL)</h1>
11   -<p><a href="http://www.decalage.info/python/olefileio">olefile</a> is a Python package to parse, read and write [Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)] (http://en.wikipedia.org/wiki/Compound_File_Binary_Format), such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
  11 +<p><a href="http://www.decalage.info/olefile">olefile</a> is a Python package to parse, read and write <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, vbaProject.bin in MS Office 2007+ files, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
12 12 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/olefile">Home page</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/olefileio_pl">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
13   -<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>
14   -<p>As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>
15   -<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>
16   -<p>olefile can be used as an independent module or with PIL/Pillow.</p>
17   -<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my [python-oletools] (http://www.decalage.info/python/oletools), which are built upon olefile and provide a higher-level interface.</p>
18 13 <h2 id="news">News</h2>
19 14 <p>Follow all updates and news on Twitter: <a href="https://twitter.com/decalage2"><code class="url">https://twitter.com/decalage2</code></a></p>
20 15 <ul>
21   -<li><strong>2014-11-25 v0.41</strong>: OleFileIO.open and isOleFile now support OLE files stored in byte strings, fixed installer for python 3, added support for Jython (Niko Ehrenfeuchter)</li>
  16 +<li><strong>2015-01-25 v0.42</strong>: improved handling of special characters in stream/storage names on Python 2.x (using UTF-8 instead of Latin-1), fixed bug in listdir with empty storages.</li>
  17 +<li>2014-11-25 v0.41: OleFileIO.open and isOleFile now support OLE files stored in byte strings, fixed installer for python 3, added support for Jython (Niko Ehrenfeuchter)</li>
22 18 <li>2014-10-01 v0.40: renamed OleFileIO_PL to olefile, added initial write support for streams &gt;4K, updated doc and license, improved the setup script.</li>
23 19 <li>2014-07-27 v0.31: fixed support for large files with 4K sectors, thanks to Niko Ehrenfeuchter, Martijn Berger and Dave Jones. Added test scripts from Pillow (by hugovk). Fixed setup for Python 3 (Martin Panter)</li>
24 20 <li>2014-02-04 v0.30: now compatible with Python 3.x, thanks to Martin Panter who did most of the hard work.</li>
25 21 <li>2013-07-24 v0.26: added methods to parse stream/storage timestamps, improved listdir to include storages, fixed parsing of direntry timestamps</li>
26   -<li>2013-05-27 v0.25: improved metadata extraction, properties parsing and exception handling, fixed [issue #12] (https://bitbucket.org/decalage/olefileio_pl/issue/12/error-when-converting-timestamps-in-ole)</li>
  22 +<li>2013-05-27 v0.25: improved metadata extraction, properties parsing and exception handling, fixed <a href="https://bitbucket.org/decalage/olefileio_pl/issue/12/error-when-converting-timestamps-in-ole">issue #12</a></li>
27 23 <li>2013-05-07 v0.24: new features to extract metadata (get_metadata method and OleMetadata class), improved getproperties to convert timestamps to Python datetime</li>
28 24 <li>2012-10-09: published <a href="http://www.decalage.info/python/oletools">python-oletools</a>, a package of analysis tools based on OleFileIO_PL</li>
29   -<li>2012-09-11 v0.23: added support for file-like objects, fixed [issue #8] (https://bitbucket.org/decalage/olefileio_pl/issue/8/bug-with-file-object)</li>
  25 +<li>2012-09-11 v0.23: added support for file-like objects, fixed <a href="https://bitbucket.org/decalage/olefileio_pl/issue/8/bug-with-file-object">issue #8</a></li>
30 26 <li>2012-02-17 v0.22: fixed issues #7 (bug in getproperties) and #2 (added close method)</li>
31 27 <li>2011-10-20: code hosted on bitbucket to ease contributions and bug tracking</li>
32 28 <li>2010-01-24 v0.21: fixed support for big-endian CPUs, such as PowerPC Macs.</li>
... ... @@ -35,7 +31,9 @@
35 31 <li>see changelog in source code for more info.</li>
36 32 </ul>
37 33 <h2 id="downloadinstall">Download/Install</h2>
38   -<p>If you have pip or setuptools installed, you may simply run &quot;<strong>pip install olefile</strong>&quot; or &quot;<strong>easy_install olefile</strong>&quot;. Otherwise, see https://bitbucket.org/decalage/olefileio_pl/wiki/Install</p>
  34 +<p>If you have pip or setuptools installed (pip is included in Python 2.7.9+), you may simply run <strong>pip install olefile</strong> or <strong>easy_install olefile</strong> for the first installation.</p>
  35 +<p>To update olefile, run <strong>pip install -U olefile</strong>.</p>
  36 +<p>Otherwise, see https://bitbucket.org/decalage/olefileio_pl/wiki/Install</p>
39 37 <h2 id="features">Features</h2>
40 38 <ul>
41 39 <li>Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc</li>
... ... @@ -44,6 +42,12 @@
44 42 <li>Parse and read property streams, containing metadata of the file</li>
45 43 <li>Portable, pure Python module, no dependency</li>
46 44 </ul>
  45 +<p>olefile can be used as an independent package or with PIL/Pillow.</p>
  46 +<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my <a href="http://www.decalage.info/python/oletools">python-oletools</a>, which are built upon olefile and provide a higher-level interface.</p>
  47 +<h2 id="history">History</h2>
  48 +<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>
  49 +<p>As far as I know, olefile is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>
  50 +<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>
47 51 <h2 id="main-improvements-over-the-original-version-of-olefileio-in-pil">Main improvements over the original version of OleFileIO in PIL:</h2>
48 52 <ul>
49 53 <li>Compatible with Python 3.x and 2.6+</li>
... ... @@ -60,12 +64,12 @@
60 64 <li>Write features</li>
61 65 </ul>
62 66 <h2 id="documentation">Documentation</h2>
63   -<p>Please see the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online documentation</a> for more information, especially the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview">OLE overview</a> and the [API page] (https://bitbucket.org/decalage/olefileio_pl/wiki/API) which describe how to use olefile in Python applications. A copy of the same documentation is also provided in the doc subfolder of the olefile package.</p>
  67 +<p>Please see the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online documentation</a> for more information, especially the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview">OLE overview</a> and the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/API">API page</a> which describe how to use olefile in Python applications. A copy of the same documentation is also provided in the doc subfolder of the olefile package.</p>
64 68 <h2 id="real-life-examples">Real-life examples</h2>
65   -<p>A real-life example: [using OleFileIO_PL for malware analysis and forensics] (http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/).</p>
  69 +<p>A real-life example: <a href="http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/">using OleFileIO_PL for malware analysis and forensics</a>.</p>
66 70 <p>See also <a href="https://computer-forensics.sans.org/community/papers/gcfa/grow-forensic-tools-taxonomy-python-libraries-helpful-forensic-analysis_6879">this paper</a> about python tools for forensics, which features olefile.</p>
67 71 <h2 id="license">License</h2>
68   -<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
  72 +<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
69 73 <p>All rights reserved.</p>
70 74 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
71 75 <ul>
... ...
oletools/thirdparty/olefile/README.rst
1 1 olefile (formerly OleFileIO\_PL)
2 2 ================================
3 3  
4   -`olefile <http://www.decalage.info/python/olefileio>`_ is a Python
5   -package to parse, read and write [Microsoft OLE2 files (also called
6   -Structured Storage, Compound File Binary Format or Compound Document
7   -File Format)]
8   -(http://en.wikipedia.org/wiki/Compound\_File\_Binary\_Format), such as
9   -Microsoft Office 97-2003 documents, Image Composer and FlashPix files,
10   -Outlook messages, StickyNotes, several Microscopy file formats, McAfee
11   -antivirus quarantine files, etc.
  4 +`olefile <http://www.decalage.info/olefile>`_ is a Python package to
  5 +parse, read and write `Microsoft OLE2
  6 +files <http://en.wikipedia.org/wiki/Compound_File_Binary_Format>`_ (also
  7 +called Structured Storage, Compound File Binary Format or Compound
  8 +Document File Format), such as Microsoft Office 97-2003 documents,
  9 +vbaProject.bin in MS Office 2007+ files, Image Composer and FlashPix
  10 +files, Outlook messages, StickyNotes, several Microscopy file formats,
  11 +McAfee antivirus quarantine files, etc.
12 12  
13 13 **Quick links:** `Home page <http://www.decalage.info/olefile>`_ -
14 14 `Download/Install <https://bitbucket.org/decalage/olefileio_pl/wiki/Install>`_
... ... @@ -19,40 +19,17 @@ Issues/Suggestions/Questions &lt;https://bitbucket.org/decalage/olefileio_pl/issues
19 19 `Repository <https://bitbucket.org/decalage/olefileio_pl>`_ - `Updates
20 20 on Twitter <https://twitter.com/decalage2>`_
21 21  
22   -olefile is based on the OleFileIO module from
23   -`PIL <http://www.pythonware.com/products/pil/index.htm>`_, the excellent
24   -Python Imaging Library, created and maintained by Fredrik Lundh. The
25   -olefile API is still compatible with PIL, but since 2005 I have improved
26   -the internal implementation significantly, with new features, bugfixes
27   -and a more robust design. From 2005 to 2014 the project was called
28   -OleFileIO\_PL, and in 2014 I changed its name to olefile to celebrate
29   -its 9 years and its new write features.
30   -
31   -As far as I know, this module is the most complete and robust Python
32   -implementation to read MS OLE2 files, portable on several operating
33   -systems. (please tell me if you know other similar Python modules)
34   -
35   -Since 2014 olefile/OleFileIO\_PL has been integrated into
36   -`Pillow <http://python-imaging.github.io/>`_, the friendly fork of PIL.
37   -olefile will continue to be improved as a separate project, and new
38   -versions will be merged into Pillow regularly.
39   -
40   -olefile can be used as an independent module or with PIL/Pillow.
41   -
42   -olefile is mostly meant for developers. If you are looking for tools to
43   -analyze OLE files or to extract data (especially for security purposes
44   -such as malware analysis and forensics), then please also check my
45   -[python-oletools] (http://www.decalage.info/python/oletools), which are
46   -built upon olefile and provide a higher-level interface.
47   -
48 22 News
49 23 ----
50 24  
51 25 Follow all updates and news on Twitter: https://twitter.com/decalage2
52 26  
53   -- **2014-11-25 v0.41**: OleFileIO.open and isOleFile now support OLE
54   - files stored in byte strings, fixed installer for python 3, added
55   - support for Jython (Niko Ehrenfeuchter)
  27 +- **2015-01-25 v0.42**: improved handling of special characters in
  28 + stream/storage names on Python 2.x (using UTF-8 instead of Latin-1),
  29 + fixed bug in listdir with empty storages.
  30 +- 2014-11-25 v0.41: OleFileIO.open and isOleFile now support OLE files
  31 + stored in byte strings, fixed installer for python 3, added support
  32 + for Jython (Niko Ehrenfeuchter)
56 33 - 2014-10-01 v0.40: renamed OleFileIO\_PL to olefile, added initial
57 34 write support for streams >4K, updated doc and license, improved the
58 35 setup script.
... ... @@ -66,17 +43,16 @@ Follow all updates and news on Twitter: https://twitter.com/decalage2
66 43 improved listdir to include storages, fixed parsing of direntry
67 44 timestamps
68 45 - 2013-05-27 v0.25: improved metadata extraction, properties parsing
69   - and exception handling, fixed [issue #12]
70   - (https://bitbucket.org/decalage/olefileio\_pl/issue/12/error-when-converting-timestamps-in-ole)
  46 + and exception handling, fixed `issue
  47 + #12 <https://bitbucket.org/decalage/olefileio_pl/issue/12/error-when-converting-timestamps-in-ole>`_
71 48 - 2013-05-07 v0.24: new features to extract metadata (get\_metadata
72 49 method and OleMetadata class), improved getproperties to convert
73 50 timestamps to Python datetime
74 51 - 2012-10-09: published
75 52 `python-oletools <http://www.decalage.info/python/oletools>`_, a
76 53 package of analysis tools based on OleFileIO\_PL
77   -- 2012-09-11 v0.23: added support for file-like objects, fixed [issue
78   - #8]
79   - (https://bitbucket.org/decalage/olefileio\_pl/issue/8/bug-with-file-object)
  54 +- 2012-09-11 v0.23: added support for file-like objects, fixed `issue
  55 + #8 <https://bitbucket.org/decalage/olefileio_pl/issue/8/bug-with-file-object>`_
80 56 - 2012-02-17 v0.22: fixed issues #7 (bug in getproperties) and #2
81 57 (added close method)
82 58 - 2011-10-20: code hosted on bitbucket to ease contributions and bug
... ... @@ -92,9 +68,13 @@ Follow all updates and news on Twitter: https://twitter.com/decalage2
92 68 Download/Install
93 69 ----------------
94 70  
95   -If you have pip or setuptools installed, you may simply run "**pip
96   -install olefile**\ " or "**easy\_install olefile**\ ". Otherwise, see
97   -https://bitbucket.org/decalage/olefileio\_pl/wiki/Install
  71 +If you have pip or setuptools installed (pip is included in Python
  72 +2.7.9+), you may simply run **pip install olefile** or **easy\_install
  73 +olefile** for the first installation.
  74 +
  75 +To update olefile, run **pip install -U olefile**.
  76 +
  77 +Otherwise, see https://bitbucket.org/decalage/olefileio\_pl/wiki/Install
98 78  
99 79 Features
100 80 --------
... ... @@ -109,6 +89,35 @@ Features
109 89 - Parse and read property streams, containing metadata of the file
110 90 - Portable, pure Python module, no dependency
111 91  
  92 +olefile can be used as an independent package or with PIL/Pillow.
  93 +
  94 +olefile is mostly meant for developers. If you are looking for tools to
  95 +analyze OLE files or to extract data (especially for security purposes
  96 +such as malware analysis and forensics), then please also check my
  97 +`python-oletools <http://www.decalage.info/python/oletools>`_, which are
  98 +built upon olefile and provide a higher-level interface.
  99 +
  100 +History
  101 +-------
  102 +
  103 +olefile is based on the OleFileIO module from
  104 +`PIL <http://www.pythonware.com/products/pil/index.htm>`_, the excellent
  105 +Python Imaging Library, created and maintained by Fredrik Lundh. The
  106 +olefile API is still compatible with PIL, but since 2005 I have improved
  107 +the internal implementation significantly, with new features, bugfixes
  108 +and a more robust design. From 2005 to 2014 the project was called
  109 +OleFileIO\_PL, and in 2014 I changed its name to olefile to celebrate
  110 +its 9 years and its new write features.
  111 +
  112 +As far as I know, olefile is the most complete and robust Python
  113 +implementation to read MS OLE2 files, portable on several operating
  114 +systems. (please tell me if you know other similar Python modules)
  115 +
  116 +Since 2014 olefile/OleFileIO\_PL has been integrated into
  117 +`Pillow <http://python-imaging.github.io/>`_, the friendly fork of PIL.
  118 +olefile will continue to be improved as a separate project, and new
  119 +versions will be merged into Pillow regularly.
  120 +
112 121 Main improvements over the original version of OleFileIO in PIL:
113 122 ----------------------------------------------------------------
114 123  
... ... @@ -134,18 +143,17 @@ Please see the `online
134 143 documentation <https://bitbucket.org/decalage/olefileio_pl/wiki>`_ for
135 144 more information, especially the `OLE
136 145 overview <https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview>`_
137   -and the [API page]
138   -(https://bitbucket.org/decalage/olefileio\_pl/wiki/API) which describe
139   -how to use olefile in Python applications. A copy of the same
  146 +and the `API
  147 +page <https://bitbucket.org/decalage/olefileio_pl/wiki/API>`_ which
  148 +describe how to use olefile in Python applications. A copy of the same
140 149 documentation is also provided in the doc subfolder of the olefile
141 150 package.
142 151  
143 152 Real-life examples
144 153 ------------------
145 154  
146   -A real-life example: [using OleFileIO\_PL for malware analysis and
147   -forensics]
148   -(http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/).
  155 +A real-life example: `using OleFileIO\_PL for malware analysis and
  156 +forensics <http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/>`_.
149 157  
150 158 See also `this
151 159 paper <https://computer-forensics.sans.org/community/papers/gcfa/grow-forensic-tools-taxonomy-python-libraries-helpful-forensic-analysis_6879>`_
... ... @@ -154,7 +162,7 @@ about python tools for forensics, which features olefile.
154 162 License
155 163 -------
156 164  
157   -olefile (formerly OleFileIO\_PL) is copyright (c) 2005-2014 Philippe
  165 +olefile (formerly OleFileIO\_PL) is copyright (c) 2005-2015 Philippe
158 166 Lagadec (`http://www.decalage.info <http://www.decalage.info>`_)
159 167  
160 168 All rights reserved.
... ...
oletools/thirdparty/olefile/__init__.py
... ... @@ -10,7 +10,7 @@ This version is compatible with Python 2.6+ and 3.x
10 10  
11 11 Project website: http://www.decalage.info/olefile
12 12  
13   -olefile is copyright (c) 2005-2014 Philippe Lagadec (http://www.decalage.info)
  13 +olefile is copyright (c) 2005-2015 Philippe Lagadec (http://www.decalage.info)
14 14  
15 15 olefile is based on the OleFileIO module from the PIL library v1.1.6
16 16 See: http://www.pythonware.com/products/pil/index.htm
... ...
oletools/thirdparty/olefile/doc/API.html
... ... @@ -56,16 +56,22 @@ else:
56 56 <pre><code>ole = olefile.OleFileIO(&#39;test.doc&#39;, write_mode=True)</code></pre>
57 57 <p>(new in v0.40)</p>
58 58 <p>The code for write features is new and it has not been thoroughly tested yet. See <a href="https://bitbucket.org/decalage/olefileio_pl/issue/6/improve-olefileio_pl-to-write-ole-files">issue #6</a> for the roadmap and the implementation status. If you encounter any issue, please send me your <a href="http://www.decalage.info/en/contact">feedback</a> or <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">report issues</a>.</p>
59   -<h2 id="syntax-for-stream-and-storage-path">Syntax for stream and storage path</h2>
  59 +<h2 id="syntax-for-stream-and-storage-paths">Syntax for stream and storage paths</h2>
60 60 <p>Two different syntaxes are allowed for methods that need or return the path of streams and storages:</p>
61 61 <ol style="list-style-type: decimal">
62 62 <li><p>Either a <strong>list of strings</strong> including all the storages from the root up to the stream/storage name. For example a stream called &quot;WordDocument&quot; at the root will have ['WordDocument'] as full path. A stream called &quot;ThisDocument&quot; located in the storage &quot;Macros/VBA&quot; will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL. While hard to read and not very convenient, this syntax works in all cases.</p></li>
63   -<li><p>Or a <strong>single string with slashes</strong> to separate storage and stream names (similar to the Unix path syntax). The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a stream or storage name contains a slash. (new in v0.15)</p></li>
  63 +<li><p>Or a <strong>single string with slashes</strong> to separate storage and stream names (similar to the Unix path syntax). The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a stream or storage name contains a slash (which is normally not allowed, according to the Microsoft specifications [MS-CFB]). (new in v0.15)</p></li>
64 64 </ol>
65 65 <p>Both are case-insensitive.</p>
66 66 <p>Switching between the two is easy:</p>
67 67 <pre><code>slash_path = &#39;/&#39;.join(list_path)
68 68 list_path = slash_path.split(&#39;/&#39;)</code></pre>
  69 +<p><strong>Encoding</strong>:</p>
  70 +<ul>
  71 +<li>Stream and Storage names are stored in Unicode format in OLE files, which means they may contain special characters (e.g. Greek, Cyrillic, Japanese, etc) that applications must support to avoid exceptions.</li>
  72 +<li><strong>On Python 2.x</strong>, all stream and storage paths are handled by olefile in bytes strings, using the <strong>UTF-8 encoding</strong> by default. If you need to use Unicode instead, add the option <strong>path_encoding=None</strong> when creating the OleFileIO object. This is new in v0.42. Olefile was using the Latin-1 encoding until v0.41, therefore special characters were not supported.<br /></li>
  73 +<li><strong>On Python 3.x</strong>, all stream and storage paths are handled by olefile in unicode strings, without encoding.</li>
  74 +</ul>
69 75 <h2 id="get-the-list-of-streams">Get the list of streams</h2>
70 76 <p>listdir() returns a list of all the streams contained in the OLE file, including those stored in storages. Each stream is listed itself as a list, as described above.</p>
71 77 <pre><code>print(ole.listdir())</code></pre>
... ...
oletools/thirdparty/olefile/doc/API.md
... ... @@ -112,13 +112,18 @@ Before using the write features, the OLE file must be opened in read/write mode:
112 112 The code for write features is new and it has not been thoroughly tested yet. See [issue #6](https://bitbucket.org/decalage/olefileio_pl/issue/6/improve-olefileio_pl-to-write-ole-files) for the roadmap and the implementation status. If you encounter any issue, please send me your [feedback](http://www.decalage.info/en/contact) or [report issues](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open).
113 113  
114 114  
115   -## Syntax for stream and storage path
  115 +## Syntax for stream and storage paths
116 116  
117 117 Two different syntaxes are allowed for methods that need or return the path of streams and storages:
118 118  
119   -1) Either a **list of strings** including all the storages from the root up to the stream/storage name. For example a stream called "WordDocument" at the root will have ['WordDocument'] as full path. A stream called "ThisDocument" located in the storage "Macros/VBA" will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL. While hard to read and not very convenient, this syntax works in all cases.
  119 +1) Either a **list of strings** including all the storages from the root up to the stream/storage name. For example a
  120 +stream called "WordDocument" at the root will have ['WordDocument'] as full path. A stream called "ThisDocument"
  121 +located in the storage "Macros/VBA" will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL.
  122 +While hard to read and not very convenient, this syntax works in all cases.
120 123  
121   -2) Or a **single string with slashes** to separate storage and stream names (similar to the Unix path syntax). The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a stream or storage name contains a slash. (new in v0.15)
  124 +2) Or a **single string with slashes** to separate storage and stream names (similar to the Unix path syntax).
  125 +The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a
  126 +stream or storage name contains a slash (which is normally not allowed, according to the Microsoft specifications [MS-CFB]). (new in v0.15)
122 127  
123 128 Both are case-insensitive.
124 129  
... ... @@ -128,10 +133,20 @@ Switching between the two is easy:
128 133 slash_path = '/'.join(list_path)
129 134 list_path = slash_path.split('/')
130 135  
  136 +**Encoding**:
  137 +
  138 +- Stream and Storage names are stored in Unicode format in OLE files, which means they may contain special characters
  139 + (e.g. Greek, Cyrillic, Japanese, etc) that applications must support to avoid exceptions.
  140 +- **On Python 2.x**, all stream and storage paths are handled by olefile in bytes strings, using the **UTF-8 encoding**
  141 + by default. If you need to use Unicode instead, add the option **path_encoding=None** when creating the OleFileIO
  142 + object. This is new in v0.42. Olefile was using the Latin-1 encoding until v0.41, therefore special characters were
  143 + not supported.
  144 +- **On Python 3.x**, all stream and storage paths are handled by olefile in unicode strings, without encoding.
131 145  
132 146 ## Get the list of streams
133 147  
134   -listdir() returns a list of all the streams contained in the OLE file, including those stored in storages. Each stream is listed itself as a list, as described above.
  148 +listdir() returns a list of all the streams contained in the OLE file, including those stored in storages.
  149 +Each stream is listed itself as a list, as described above.
135 150  
136 151 :::python
137 152 print(ole.listdir())
... ...
oletools/thirdparty/olefile/doc/Home.html
... ... @@ -7,16 +7,18 @@
7 7 <title></title>
8 8 </head>
9 9 <body>
10   -<h1 id="olefile-v0.41-documentation">olefile v0.41 documentation</h1>
  10 +<h1 id="olefile-v0.42-documentation">olefile v0.42 documentation</h1>
11 11 <p>This is the home page of the documentation for olefile. The latest version can be found <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
12   -<p><a href="http://www.decalage.info/olefile">olefile</a> is a Python package to parse, read and write <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)</a>, such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
  12 +<p><a href="http://www.decalage.info/olefile">olefile</a> is a Python package to parse, read and write <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
13 13 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/olefile">Home page</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/olefileio_pl">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
14   -<h2 id="history">History</h2>
15   -<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>
16   -<p>As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>
17   -<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>
18   -<p>olefile can be used as an independent module or with PIL/Pillow.</p>
19   -<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my <a href="http://www.decalage.info/python/oletools">python-oletools</a>, which are built upon olefile and provide a higher-level interface.</p>
  14 +<h2 id="documentation-pages">Documentation pages</h2>
  15 +<ul>
  16 +<li><a href="License.html">License</a></li>
  17 +<li><a href="Install.html">Install</a></li>
  18 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  19 +<li><a href="OLE_Overview.html">OLE_Overview</a></li>
  20 +<li><a href="API.html">API</a> and Usage</li>
  21 +</ul>
20 22 <h2 id="features">Features</h2>
21 23 <ul>
22 24 <li>Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc</li>
... ... @@ -25,6 +27,12 @@
25 27 <li>Parse and read property streams, containing metadata of the file</li>
26 28 <li>Portable, pure Python module, no dependency</li>
27 29 </ul>
  30 +<p>olefile can be used as an independent module or with PIL/Pillow.</p>
  31 +<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my <a href="http://www.decalage.info/python/oletools">python-oletools</a>, which are built upon olefile and provide a higher-level interface.</p>
  32 +<h2 id="history">History</h2>
  33 +<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>
  34 +<p>As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>
  35 +<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>
28 36 <h2 id="main-improvements-over-the-original-version-of-olefileio-in-pil">Main improvements over the original version of OleFileIO in PIL:</h2>
29 37 <ul>
30 38 <li>Compatible with Python 3.x and 2.6+</li>
... ...
oletools/thirdparty/olefile/doc/Home.md
1   -olefile v0.41 documentation
  1 +olefile v0.42 documentation
2 2 ===========================
3 3  
4   -This is the home page of the documentation for olefile. The latest version can be found [online](https://bitbucket.org/decalage/olefileio_pl/wiki), otherwise a copy is provided in the doc subfolder of the package.
  4 +This is the home page of the documentation for olefile. The latest version can be found
  5 +[online](https://bitbucket.org/decalage/olefileio_pl/wiki), otherwise a copy is provided in the doc subfolder of the package.
5 6  
6   -[olefile](http://www.decalage.info/olefile) is a Python package to parse, read and write [Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)](http://en.wikipedia.org/wiki/Compound_File_Binary_Format), such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.
  7 +[olefile](http://www.decalage.info/olefile) is a Python package to parse, read and write
  8 +[Microsoft OLE2 files](http://en.wikipedia.org/wiki/Compound_File_Binary_Format)
  9 +(also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft
  10 +Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file
  11 +formats, McAfee antivirus quarantine files, etc.
7 12  
8 13  
9   -**Quick links:** [Home page](http://www.decalage.info/olefile) - [Download/Install](https://bitbucket.org/decalage/olefileio_pl/wiki/Install) - [Documentation](https://bitbucket.org/decalage/olefileio_pl/wiki) - [Report Issues/Suggestions/Questions](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open) - [Contact the author](http://decalage.info/contact) - [Repository](https://bitbucket.org/decalage/olefileio_pl) - [Updates on Twitter](https://twitter.com/decalage2)
  14 +**Quick links:**
  15 +[Home page](http://www.decalage.info/olefile) -
  16 +[Download/Install](https://bitbucket.org/decalage/olefileio_pl/wiki/Install) -
  17 +[Documentation](https://bitbucket.org/decalage/olefileio_pl/wiki) -
  18 +[Report Issues/Suggestions/Questions](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open) -
  19 +[Contact the author](http://decalage.info/contact) -
  20 +[Repository](https://bitbucket.org/decalage/olefileio_pl) -
  21 +[Updates on Twitter](https://twitter.com/decalage2)
10 22  
11   -History
12   --------
13   -
14   -olefile is based on the OleFileIO module from [PIL](http://www.pythonware.com/products/pil/index.htm), the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.
15   -
16   -As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)
17   -
18   -Since 2014 olefile/OleFileIO_PL has been integrated into [Pillow](http://python-imaging.github.io/), the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.
  23 +Documentation pages
  24 +-------------------
19 25  
20   -olefile can be used as an independent module or with PIL/Pillow.
  26 +- [[License]]
  27 +- [[Install]]
  28 +- [[Contribute]], Suggest Improvements or Report Issues
  29 +- [[OLE_Overview]]
  30 +- [[API]] and Usage
21 31  
22   -olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my [python-oletools](http://www.decalage.info/python/oletools), which are built upon olefile and provide a higher-level interface.
23 32  
24 33 Features
25 34 --------
26 35  
27   -- Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc
  36 +- Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls,
  37 + PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss
  38 + AxioVision ZVI files, Olympus FluoView OIB files, etc
28 39 - List all the streams and storages contained in an OLE file
29 40 - Open streams as files
30 41 - Parse and read property streams, containing metadata of the file
31 42 - Portable, pure Python module, no dependency
32 43  
  44 +olefile can be used as an independent module or with PIL/Pillow.
  45 +
  46 +olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data
  47 +(especially for security purposes such as malware analysis and forensics), then please also check my
  48 +[python-oletools](http://www.decalage.info/python/oletools), which are built upon olefile and provide a higher-level
  49 +interface.
  50 +
  51 +
  52 +History
  53 +-------
  54 +
  55 +olefile is based on the OleFileIO module from [PIL](http://www.pythonware.com/products/pil/index.htm), the excellent
  56 +Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but
  57 +since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust
  58 +design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate
  59 +its 9 years and its new write features.
  60 +
  61 +As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on
  62 +several operating systems. (please tell me if you know other similar Python modules)
  63 +
  64 +Since 2014 olefile/OleFileIO_PL has been integrated into [Pillow](http://python-imaging.github.io/), the friendly fork
  65 +of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.
33 66  
34 67 Main improvements over the original version of OleFileIO in PIL:
35 68 ----------------------------------------------------------------
... ...
oletools/thirdparty/olefile/doc/Install.html
... ... @@ -12,8 +12,9 @@
12 12 <p>olefile requires Python 2.6, 2.7 or 3.x.</p>
13 13 <p>For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain all the enhancements implemented in olefile.</p>
14 14 <h2 id="download-and-install">Download and Install</h2>
15   -<p>To use olefile with other Python applications or your own scripts, the simplest solution is to run &quot;<strong>pip install olefile</strong>&quot; or &quot;<strong>easy_install olefile</strong>&quot; to download and install the package in one go.</p>
16   -<p>Otherwise you may download/extract the <a href="https://bitbucket.org/decalage/olefileio_pl/downloads">zip archive</a> in a temporary directory and run &quot;<strong>python setup.py install</strong>&quot;.</p>
  15 +<p>To use olefile with other Python applications or your own scripts, the simplest solution is to run <strong>pip install olefile</strong> or <strong>easy_install olefile</strong>, to download and install the package in one go. Pip is part of the standard Python distribution since v2.7.9.</p>
  16 +<p>To update olefile if a previous version is already installed, run <strong>pip install -U olefile</strong>.</p>
  17 +<p>Otherwise you may download/extract the <a href="https://bitbucket.org/decalage/olefileio_pl/downloads">zip archive</a> in a temporary directory and run <strong>python setup.py install</strong>.</p>
17 18 <p>On Windows you may simply double-click on <strong>install.bat</strong>.</p>
18 19 <hr />
19 20 <h2 id="olefile-documentation">olefile documentation</h2>
... ...
oletools/thirdparty/olefile/doc/Install.md
... ... @@ -6,15 +6,21 @@ Pre-requisites
6 6  
7 7 olefile requires Python 2.6, 2.7 or 3.x.
8 8  
9   -For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain all the enhancements implemented in olefile.
  9 +For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain
  10 +all the enhancements implemented in olefile.
10 11  
11 12  
12 13 Download and Install
13 14 --------------------
14 15  
15   -To use olefile with other Python applications or your own scripts, the simplest solution is to run "**pip install olefile**" or "**easy_install olefile**" to download and install the package in one go.
  16 +To use olefile with other Python applications or your own scripts, the simplest solution is to run **pip install olefile**
  17 +or **easy_install olefile**, to download and install the package in one go. Pip is part of the standard Python
  18 +distribution since v2.7.9.
16 19  
17   -Otherwise you may download/extract the [zip archive](https://bitbucket.org/decalage/olefileio_pl/downloads) in a temporary directory and run "**python setup.py install**".
  20 +To update olefile if a previous version is already installed, run **pip install -U olefile**.
  21 +
  22 +Otherwise you may download/extract the [zip archive](https://bitbucket.org/decalage/olefileio_pl/downloads) in a
  23 +temporary directory and run **python setup.py install**.
18 24  
19 25 On Windows you may simply double-click on **install.bat**.
20 26  
... ...
oletools/thirdparty/olefile/doc/License.html
... ... @@ -8,7 +8,7 @@
8 8 </head>
9 9 <body>
10 10 <h1 id="license-for-olefile">License for olefile</h1>
11   -<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
  11 +<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
12 12 <p>All rights reserved.</p>
13 13 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
14 14 <ul>
... ...
oletools/thirdparty/olefile/doc/License.md
1 1 License for olefile
2 2 ===================
3 3  
4   -olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
  4 +olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
5 5  
6 6 All rights reserved.
7 7  
... ...
oletools/thirdparty/olefile/olefile.html
No preview for this file type
oletools/thirdparty/olefile/olefile.py
1 1 #!/usr/bin/env python
2 2  
3   -# olefile (formerly OleFileIO_PL) version 0.42 2015-01-24
  3 +# olefile (formerly OleFileIO_PL) version 0.42 2015-01-25
4 4 #
5 5 # Module to read/write Microsoft OLE2 files (also called Structured Storage or
6 6 # Microsoft Compound Document File Format), such as Microsoft Office 97-2003
... ... @@ -29,8 +29,8 @@ from __future__ import print_function # This version of olefile requires Pytho
29 29  
30 30  
31 31 __author__ = "Philippe Lagadec"
32   -__date__ = "2015-01-24"
33   -__version__ = '0.42'
  32 +__date__ = "2015-01-25"
  33 +__version__ = '0.42.1'
34 34  
35 35 #--- LICENSE ------------------------------------------------------------------
36 36  
... ...