Commit 5d3718da11d7892f010a6edd40cb3b838e085f46

Authored by Philippe Lagadec
1 parent 4c98aa7a

updated olefile to v0.42

oletools/thirdparty/olefile/LICENSE.txt
1 LICENSE for the olefile package: 1 LICENSE for the olefile package:
2 2
3 -olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec 3 +olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec
4 (http://www.decalage.info) 4 (http://www.decalage.info)
5 5
6 All rights reserved. 6 All rights reserved.
oletools/thirdparty/olefile/README.html
@@ -8,25 +8,21 @@ @@ -8,25 +8,21 @@
8 </head> 8 </head>
9 <body> 9 <body>
10 <h1 id="olefile-formerly-olefileio_pl">olefile (formerly OleFileIO_PL)</h1> 10 <h1 id="olefile-formerly-olefileio_pl">olefile (formerly OleFileIO_PL)</h1>
11 -<p><a href="http://www.decalage.info/python/olefileio">olefile</a> is a Python package to parse, read and write [Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)] (http://en.wikipedia.org/wiki/Compound_File_Binary_Format), such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p> 11 +<p><a href="http://www.decalage.info/olefile">olefile</a> is a Python package to parse, read and write <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, vbaProject.bin in MS Office 2007+ files, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
12 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/olefile">Home page</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/olefileio_pl">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p> 12 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/olefile">Home page</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/olefileio_pl">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
13 -<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>  
14 -<p>As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>  
15 -<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>  
16 -<p>olefile can be used as an independent module or with PIL/Pillow.</p>  
17 -<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my [python-oletools] (http://www.decalage.info/python/oletools), which are built upon olefile and provide a higher-level interface.</p>  
18 <h2 id="news">News</h2> 13 <h2 id="news">News</h2>
19 <p>Follow all updates and news on Twitter: <a href="https://twitter.com/decalage2"><code class="url">https://twitter.com/decalage2</code></a></p> 14 <p>Follow all updates and news on Twitter: <a href="https://twitter.com/decalage2"><code class="url">https://twitter.com/decalage2</code></a></p>
20 <ul> 15 <ul>
21 -<li><strong>2014-11-25 v0.41</strong>: OleFileIO.open and isOleFile now support OLE files stored in byte strings, fixed installer for python 3, added support for Jython (Niko Ehrenfeuchter)</li> 16 +<li><strong>2015-01-25 v0.42</strong>: improved handling of special characters in stream/storage names on Python 2.x (using UTF-8 instead of Latin-1), fixed bug in listdir with empty storages.</li>
  17 +<li>2014-11-25 v0.41: OleFileIO.open and isOleFile now support OLE files stored in byte strings, fixed installer for python 3, added support for Jython (Niko Ehrenfeuchter)</li>
22 <li>2014-10-01 v0.40: renamed OleFileIO_PL to olefile, added initial write support for streams &gt;4K, updated doc and license, improved the setup script.</li> 18 <li>2014-10-01 v0.40: renamed OleFileIO_PL to olefile, added initial write support for streams &gt;4K, updated doc and license, improved the setup script.</li>
23 <li>2014-07-27 v0.31: fixed support for large files with 4K sectors, thanks to Niko Ehrenfeuchter, Martijn Berger and Dave Jones. Added test scripts from Pillow (by hugovk). Fixed setup for Python 3 (Martin Panter)</li> 19 <li>2014-07-27 v0.31: fixed support for large files with 4K sectors, thanks to Niko Ehrenfeuchter, Martijn Berger and Dave Jones. Added test scripts from Pillow (by hugovk). Fixed setup for Python 3 (Martin Panter)</li>
24 <li>2014-02-04 v0.30: now compatible with Python 3.x, thanks to Martin Panter who did most of the hard work.</li> 20 <li>2014-02-04 v0.30: now compatible with Python 3.x, thanks to Martin Panter who did most of the hard work.</li>
25 <li>2013-07-24 v0.26: added methods to parse stream/storage timestamps, improved listdir to include storages, fixed parsing of direntry timestamps</li> 21 <li>2013-07-24 v0.26: added methods to parse stream/storage timestamps, improved listdir to include storages, fixed parsing of direntry timestamps</li>
26 -<li>2013-05-27 v0.25: improved metadata extraction, properties parsing and exception handling, fixed [issue #12] (https://bitbucket.org/decalage/olefileio_pl/issue/12/error-when-converting-timestamps-in-ole)</li> 22 +<li>2013-05-27 v0.25: improved metadata extraction, properties parsing and exception handling, fixed <a href="https://bitbucket.org/decalage/olefileio_pl/issue/12/error-when-converting-timestamps-in-ole">issue #12</a></li>
27 <li>2013-05-07 v0.24: new features to extract metadata (get_metadata method and OleMetadata class), improved getproperties to convert timestamps to Python datetime</li> 23 <li>2013-05-07 v0.24: new features to extract metadata (get_metadata method and OleMetadata class), improved getproperties to convert timestamps to Python datetime</li>
28 <li>2012-10-09: published <a href="http://www.decalage.info/python/oletools">python-oletools</a>, a package of analysis tools based on OleFileIO_PL</li> 24 <li>2012-10-09: published <a href="http://www.decalage.info/python/oletools">python-oletools</a>, a package of analysis tools based on OleFileIO_PL</li>
29 -<li>2012-09-11 v0.23: added support for file-like objects, fixed [issue #8] (https://bitbucket.org/decalage/olefileio_pl/issue/8/bug-with-file-object)</li> 25 +<li>2012-09-11 v0.23: added support for file-like objects, fixed <a href="https://bitbucket.org/decalage/olefileio_pl/issue/8/bug-with-file-object">issue #8</a></li>
30 <li>2012-02-17 v0.22: fixed issues #7 (bug in getproperties) and #2 (added close method)</li> 26 <li>2012-02-17 v0.22: fixed issues #7 (bug in getproperties) and #2 (added close method)</li>
31 <li>2011-10-20: code hosted on bitbucket to ease contributions and bug tracking</li> 27 <li>2011-10-20: code hosted on bitbucket to ease contributions and bug tracking</li>
32 <li>2010-01-24 v0.21: fixed support for big-endian CPUs, such as PowerPC Macs.</li> 28 <li>2010-01-24 v0.21: fixed support for big-endian CPUs, such as PowerPC Macs.</li>
@@ -35,7 +31,9 @@ @@ -35,7 +31,9 @@
35 <li>see changelog in source code for more info.</li> 31 <li>see changelog in source code for more info.</li>
36 </ul> 32 </ul>
37 <h2 id="downloadinstall">Download/Install</h2> 33 <h2 id="downloadinstall">Download/Install</h2>
38 -<p>If you have pip or setuptools installed, you may simply run &quot;<strong>pip install olefile</strong>&quot; or &quot;<strong>easy_install olefile</strong>&quot;. Otherwise, see https://bitbucket.org/decalage/olefileio_pl/wiki/Install</p> 34 +<p>If you have pip or setuptools installed (pip is included in Python 2.7.9+), you may simply run <strong>pip install olefile</strong> or <strong>easy_install olefile</strong> for the first installation.</p>
  35 +<p>To update olefile, run <strong>pip install -U olefile</strong>.</p>
  36 +<p>Otherwise, see https://bitbucket.org/decalage/olefileio_pl/wiki/Install</p>
39 <h2 id="features">Features</h2> 37 <h2 id="features">Features</h2>
40 <ul> 38 <ul>
41 <li>Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc</li> 39 <li>Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc</li>
@@ -44,6 +42,12 @@ @@ -44,6 +42,12 @@
44 <li>Parse and read property streams, containing metadata of the file</li> 42 <li>Parse and read property streams, containing metadata of the file</li>
45 <li>Portable, pure Python module, no dependency</li> 43 <li>Portable, pure Python module, no dependency</li>
46 </ul> 44 </ul>
  45 +<p>olefile can be used as an independent package or with PIL/Pillow.</p>
  46 +<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my <a href="http://www.decalage.info/python/oletools">python-oletools</a>, which are built upon olefile and provide a higher-level interface.</p>
  47 +<h2 id="history">History</h2>
  48 +<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>
  49 +<p>As far as I know, olefile is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>
  50 +<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>
47 <h2 id="main-improvements-over-the-original-version-of-olefileio-in-pil">Main improvements over the original version of OleFileIO in PIL:</h2> 51 <h2 id="main-improvements-over-the-original-version-of-olefileio-in-pil">Main improvements over the original version of OleFileIO in PIL:</h2>
48 <ul> 52 <ul>
49 <li>Compatible with Python 3.x and 2.6+</li> 53 <li>Compatible with Python 3.x and 2.6+</li>
@@ -60,12 +64,12 @@ @@ -60,12 +64,12 @@
60 <li>Write features</li> 64 <li>Write features</li>
61 </ul> 65 </ul>
62 <h2 id="documentation">Documentation</h2> 66 <h2 id="documentation">Documentation</h2>
63 -<p>Please see the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online documentation</a> for more information, especially the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview">OLE overview</a> and the [API page] (https://bitbucket.org/decalage/olefileio_pl/wiki/API) which describe how to use olefile in Python applications. A copy of the same documentation is also provided in the doc subfolder of the olefile package.</p> 67 +<p>Please see the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online documentation</a> for more information, especially the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview">OLE overview</a> and the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/API">API page</a> which describe how to use olefile in Python applications. A copy of the same documentation is also provided in the doc subfolder of the olefile package.</p>
64 <h2 id="real-life-examples">Real-life examples</h2> 68 <h2 id="real-life-examples">Real-life examples</h2>
65 -<p>A real-life example: [using OleFileIO_PL for malware analysis and forensics] (http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/).</p> 69 +<p>A real-life example: <a href="http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/">using OleFileIO_PL for malware analysis and forensics</a>.</p>
66 <p>See also <a href="https://computer-forensics.sans.org/community/papers/gcfa/grow-forensic-tools-taxonomy-python-libraries-helpful-forensic-analysis_6879">this paper</a> about python tools for forensics, which features olefile.</p> 70 <p>See also <a href="https://computer-forensics.sans.org/community/papers/gcfa/grow-forensic-tools-taxonomy-python-libraries-helpful-forensic-analysis_6879">this paper</a> about python tools for forensics, which features olefile.</p>
67 <h2 id="license">License</h2> 71 <h2 id="license">License</h2>
68 -<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p> 72 +<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
69 <p>All rights reserved.</p> 73 <p>All rights reserved.</p>
70 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p> 74 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
71 <ul> 75 <ul>
oletools/thirdparty/olefile/README.rst
1 olefile (formerly OleFileIO\_PL) 1 olefile (formerly OleFileIO\_PL)
2 ================================ 2 ================================
3 3
4 -`olefile <http://www.decalage.info/python/olefileio>`_ is a Python  
5 -package to parse, read and write [Microsoft OLE2 files (also called  
6 -Structured Storage, Compound File Binary Format or Compound Document  
7 -File Format)]  
8 -(http://en.wikipedia.org/wiki/Compound\_File\_Binary\_Format), such as  
9 -Microsoft Office 97-2003 documents, Image Composer and FlashPix files,  
10 -Outlook messages, StickyNotes, several Microscopy file formats, McAfee  
11 -antivirus quarantine files, etc. 4 +`olefile <http://www.decalage.info/olefile>`_ is a Python package to
  5 +parse, read and write `Microsoft OLE2
  6 +files <http://en.wikipedia.org/wiki/Compound_File_Binary_Format>`_ (also
  7 +called Structured Storage, Compound File Binary Format or Compound
  8 +Document File Format), such as Microsoft Office 97-2003 documents,
  9 +vbaProject.bin in MS Office 2007+ files, Image Composer and FlashPix
  10 +files, Outlook messages, StickyNotes, several Microscopy file formats,
  11 +McAfee antivirus quarantine files, etc.
12 12
13 **Quick links:** `Home page <http://www.decalage.info/olefile>`_ - 13 **Quick links:** `Home page <http://www.decalage.info/olefile>`_ -
14 `Download/Install <https://bitbucket.org/decalage/olefileio_pl/wiki/Install>`_ 14 `Download/Install <https://bitbucket.org/decalage/olefileio_pl/wiki/Install>`_
@@ -19,40 +19,17 @@ Issues/Suggestions/Questions &lt;https://bitbucket.org/decalage/olefileio_pl/issues @@ -19,40 +19,17 @@ Issues/Suggestions/Questions &lt;https://bitbucket.org/decalage/olefileio_pl/issues
19 `Repository <https://bitbucket.org/decalage/olefileio_pl>`_ - `Updates 19 `Repository <https://bitbucket.org/decalage/olefileio_pl>`_ - `Updates
20 on Twitter <https://twitter.com/decalage2>`_ 20 on Twitter <https://twitter.com/decalage2>`_
21 21
22 -olefile is based on the OleFileIO module from  
23 -`PIL <http://www.pythonware.com/products/pil/index.htm>`_, the excellent  
24 -Python Imaging Library, created and maintained by Fredrik Lundh. The  
25 -olefile API is still compatible with PIL, but since 2005 I have improved  
26 -the internal implementation significantly, with new features, bugfixes  
27 -and a more robust design. From 2005 to 2014 the project was called  
28 -OleFileIO\_PL, and in 2014 I changed its name to olefile to celebrate  
29 -its 9 years and its new write features.  
30 -  
31 -As far as I know, this module is the most complete and robust Python  
32 -implementation to read MS OLE2 files, portable on several operating  
33 -systems. (please tell me if you know other similar Python modules)  
34 -  
35 -Since 2014 olefile/OleFileIO\_PL has been integrated into  
36 -`Pillow <http://python-imaging.github.io/>`_, the friendly fork of PIL.  
37 -olefile will continue to be improved as a separate project, and new  
38 -versions will be merged into Pillow regularly.  
39 -  
40 -olefile can be used as an independent module or with PIL/Pillow.  
41 -  
42 -olefile is mostly meant for developers. If you are looking for tools to  
43 -analyze OLE files or to extract data (especially for security purposes  
44 -such as malware analysis and forensics), then please also check my  
45 -[python-oletools] (http://www.decalage.info/python/oletools), which are  
46 -built upon olefile and provide a higher-level interface.  
47 -  
48 News 22 News
49 ---- 23 ----
50 24
51 Follow all updates and news on Twitter: https://twitter.com/decalage2 25 Follow all updates and news on Twitter: https://twitter.com/decalage2
52 26
53 -- **2014-11-25 v0.41**: OleFileIO.open and isOleFile now support OLE  
54 - files stored in byte strings, fixed installer for python 3, added  
55 - support for Jython (Niko Ehrenfeuchter) 27 +- **2015-01-25 v0.42**: improved handling of special characters in
  28 + stream/storage names on Python 2.x (using UTF-8 instead of Latin-1),
  29 + fixed bug in listdir with empty storages.
  30 +- 2014-11-25 v0.41: OleFileIO.open and isOleFile now support OLE files
  31 + stored in byte strings, fixed installer for python 3, added support
  32 + for Jython (Niko Ehrenfeuchter)
56 - 2014-10-01 v0.40: renamed OleFileIO\_PL to olefile, added initial 33 - 2014-10-01 v0.40: renamed OleFileIO\_PL to olefile, added initial
57 write support for streams >4K, updated doc and license, improved the 34 write support for streams >4K, updated doc and license, improved the
58 setup script. 35 setup script.
@@ -66,17 +43,16 @@ Follow all updates and news on Twitter: https://twitter.com/decalage2 @@ -66,17 +43,16 @@ Follow all updates and news on Twitter: https://twitter.com/decalage2
66 improved listdir to include storages, fixed parsing of direntry 43 improved listdir to include storages, fixed parsing of direntry
67 timestamps 44 timestamps
68 - 2013-05-27 v0.25: improved metadata extraction, properties parsing 45 - 2013-05-27 v0.25: improved metadata extraction, properties parsing
69 - and exception handling, fixed [issue #12]  
70 - (https://bitbucket.org/decalage/olefileio\_pl/issue/12/error-when-converting-timestamps-in-ole) 46 + and exception handling, fixed `issue
  47 + #12 <https://bitbucket.org/decalage/olefileio_pl/issue/12/error-when-converting-timestamps-in-ole>`_
71 - 2013-05-07 v0.24: new features to extract metadata (get\_metadata 48 - 2013-05-07 v0.24: new features to extract metadata (get\_metadata
72 method and OleMetadata class), improved getproperties to convert 49 method and OleMetadata class), improved getproperties to convert
73 timestamps to Python datetime 50 timestamps to Python datetime
74 - 2012-10-09: published 51 - 2012-10-09: published
75 `python-oletools <http://www.decalage.info/python/oletools>`_, a 52 `python-oletools <http://www.decalage.info/python/oletools>`_, a
76 package of analysis tools based on OleFileIO\_PL 53 package of analysis tools based on OleFileIO\_PL
77 -- 2012-09-11 v0.23: added support for file-like objects, fixed [issue  
78 - #8]  
79 - (https://bitbucket.org/decalage/olefileio\_pl/issue/8/bug-with-file-object) 54 +- 2012-09-11 v0.23: added support for file-like objects, fixed `issue
  55 + #8 <https://bitbucket.org/decalage/olefileio_pl/issue/8/bug-with-file-object>`_
80 - 2012-02-17 v0.22: fixed issues #7 (bug in getproperties) and #2 56 - 2012-02-17 v0.22: fixed issues #7 (bug in getproperties) and #2
81 (added close method) 57 (added close method)
82 - 2011-10-20: code hosted on bitbucket to ease contributions and bug 58 - 2011-10-20: code hosted on bitbucket to ease contributions and bug
@@ -92,9 +68,13 @@ Follow all updates and news on Twitter: https://twitter.com/decalage2 @@ -92,9 +68,13 @@ Follow all updates and news on Twitter: https://twitter.com/decalage2
92 Download/Install 68 Download/Install
93 ---------------- 69 ----------------
94 70
95 -If you have pip or setuptools installed, you may simply run "**pip  
96 -install olefile**\ " or "**easy\_install olefile**\ ". Otherwise, see  
97 -https://bitbucket.org/decalage/olefileio\_pl/wiki/Install 71 +If you have pip or setuptools installed (pip is included in Python
  72 +2.7.9+), you may simply run **pip install olefile** or **easy\_install
  73 +olefile** for the first installation.
  74 +
  75 +To update olefile, run **pip install -U olefile**.
  76 +
  77 +Otherwise, see https://bitbucket.org/decalage/olefileio\_pl/wiki/Install
98 78
99 Features 79 Features
100 -------- 80 --------
@@ -109,6 +89,35 @@ Features @@ -109,6 +89,35 @@ Features
109 - Parse and read property streams, containing metadata of the file 89 - Parse and read property streams, containing metadata of the file
110 - Portable, pure Python module, no dependency 90 - Portable, pure Python module, no dependency
111 91
  92 +olefile can be used as an independent package or with PIL/Pillow.
  93 +
  94 +olefile is mostly meant for developers. If you are looking for tools to
  95 +analyze OLE files or to extract data (especially for security purposes
  96 +such as malware analysis and forensics), then please also check my
  97 +`python-oletools <http://www.decalage.info/python/oletools>`_, which are
  98 +built upon olefile and provide a higher-level interface.
  99 +
  100 +History
  101 +-------
  102 +
  103 +olefile is based on the OleFileIO module from
  104 +`PIL <http://www.pythonware.com/products/pil/index.htm>`_, the excellent
  105 +Python Imaging Library, created and maintained by Fredrik Lundh. The
  106 +olefile API is still compatible with PIL, but since 2005 I have improved
  107 +the internal implementation significantly, with new features, bugfixes
  108 +and a more robust design. From 2005 to 2014 the project was called
  109 +OleFileIO\_PL, and in 2014 I changed its name to olefile to celebrate
  110 +its 9 years and its new write features.
  111 +
  112 +As far as I know, olefile is the most complete and robust Python
  113 +implementation to read MS OLE2 files, portable on several operating
  114 +systems. (please tell me if you know other similar Python modules)
  115 +
  116 +Since 2014 olefile/OleFileIO\_PL has been integrated into
  117 +`Pillow <http://python-imaging.github.io/>`_, the friendly fork of PIL.
  118 +olefile will continue to be improved as a separate project, and new
  119 +versions will be merged into Pillow regularly.
  120 +
112 Main improvements over the original version of OleFileIO in PIL: 121 Main improvements over the original version of OleFileIO in PIL:
113 ---------------------------------------------------------------- 122 ----------------------------------------------------------------
114 123
@@ -134,18 +143,17 @@ Please see the `online @@ -134,18 +143,17 @@ Please see the `online
134 documentation <https://bitbucket.org/decalage/olefileio_pl/wiki>`_ for 143 documentation <https://bitbucket.org/decalage/olefileio_pl/wiki>`_ for
135 more information, especially the `OLE 144 more information, especially the `OLE
136 overview <https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview>`_ 145 overview <https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview>`_
137 -and the [API page]  
138 -(https://bitbucket.org/decalage/olefileio\_pl/wiki/API) which describe  
139 -how to use olefile in Python applications. A copy of the same 146 +and the `API
  147 +page <https://bitbucket.org/decalage/olefileio_pl/wiki/API>`_ which
  148 +describe how to use olefile in Python applications. A copy of the same
140 documentation is also provided in the doc subfolder of the olefile 149 documentation is also provided in the doc subfolder of the olefile
141 package. 150 package.
142 151
143 Real-life examples 152 Real-life examples
144 ------------------ 153 ------------------
145 154
146 -A real-life example: [using OleFileIO\_PL for malware analysis and  
147 -forensics]  
148 -(http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/). 155 +A real-life example: `using OleFileIO\_PL for malware analysis and
  156 +forensics <http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/>`_.
149 157
150 See also `this 158 See also `this
151 paper <https://computer-forensics.sans.org/community/papers/gcfa/grow-forensic-tools-taxonomy-python-libraries-helpful-forensic-analysis_6879>`_ 159 paper <https://computer-forensics.sans.org/community/papers/gcfa/grow-forensic-tools-taxonomy-python-libraries-helpful-forensic-analysis_6879>`_
@@ -154,7 +162,7 @@ about python tools for forensics, which features olefile. @@ -154,7 +162,7 @@ about python tools for forensics, which features olefile.
154 License 162 License
155 ------- 163 -------
156 164
157 -olefile (formerly OleFileIO\_PL) is copyright (c) 2005-2014 Philippe 165 +olefile (formerly OleFileIO\_PL) is copyright (c) 2005-2015 Philippe
158 Lagadec (`http://www.decalage.info <http://www.decalage.info>`_) 166 Lagadec (`http://www.decalage.info <http://www.decalage.info>`_)
159 167
160 All rights reserved. 168 All rights reserved.
oletools/thirdparty/olefile/__init__.py
@@ -10,7 +10,7 @@ This version is compatible with Python 2.6+ and 3.x @@ -10,7 +10,7 @@ This version is compatible with Python 2.6+ and 3.x
10 10
11 Project website: http://www.decalage.info/olefile 11 Project website: http://www.decalage.info/olefile
12 12
13 -olefile is copyright (c) 2005-2014 Philippe Lagadec (http://www.decalage.info) 13 +olefile is copyright (c) 2005-2015 Philippe Lagadec (http://www.decalage.info)
14 14
15 olefile is based on the OleFileIO module from the PIL library v1.1.6 15 olefile is based on the OleFileIO module from the PIL library v1.1.6
16 See: http://www.pythonware.com/products/pil/index.htm 16 See: http://www.pythonware.com/products/pil/index.htm
oletools/thirdparty/olefile/doc/API.html
@@ -56,16 +56,22 @@ else: @@ -56,16 +56,22 @@ else:
56 <pre><code>ole = olefile.OleFileIO(&#39;test.doc&#39;, write_mode=True)</code></pre> 56 <pre><code>ole = olefile.OleFileIO(&#39;test.doc&#39;, write_mode=True)</code></pre>
57 <p>(new in v0.40)</p> 57 <p>(new in v0.40)</p>
58 <p>The code for write features is new and it has not been thoroughly tested yet. See <a href="https://bitbucket.org/decalage/olefileio_pl/issue/6/improve-olefileio_pl-to-write-ole-files">issue #6</a> for the roadmap and the implementation status. If you encounter any issue, please send me your <a href="http://www.decalage.info/en/contact">feedback</a> or <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">report issues</a>.</p> 58 <p>The code for write features is new and it has not been thoroughly tested yet. See <a href="https://bitbucket.org/decalage/olefileio_pl/issue/6/improve-olefileio_pl-to-write-ole-files">issue #6</a> for the roadmap and the implementation status. If you encounter any issue, please send me your <a href="http://www.decalage.info/en/contact">feedback</a> or <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">report issues</a>.</p>
59 -<h2 id="syntax-for-stream-and-storage-path">Syntax for stream and storage path</h2> 59 +<h2 id="syntax-for-stream-and-storage-paths">Syntax for stream and storage paths</h2>
60 <p>Two different syntaxes are allowed for methods that need or return the path of streams and storages:</p> 60 <p>Two different syntaxes are allowed for methods that need or return the path of streams and storages:</p>
61 <ol style="list-style-type: decimal"> 61 <ol style="list-style-type: decimal">
62 <li><p>Either a <strong>list of strings</strong> including all the storages from the root up to the stream/storage name. For example a stream called &quot;WordDocument&quot; at the root will have ['WordDocument'] as full path. A stream called &quot;ThisDocument&quot; located in the storage &quot;Macros/VBA&quot; will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL. While hard to read and not very convenient, this syntax works in all cases.</p></li> 62 <li><p>Either a <strong>list of strings</strong> including all the storages from the root up to the stream/storage name. For example a stream called &quot;WordDocument&quot; at the root will have ['WordDocument'] as full path. A stream called &quot;ThisDocument&quot; located in the storage &quot;Macros/VBA&quot; will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL. While hard to read and not very convenient, this syntax works in all cases.</p></li>
63 -<li><p>Or a <strong>single string with slashes</strong> to separate storage and stream names (similar to the Unix path syntax). The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a stream or storage name contains a slash. (new in v0.15)</p></li> 63 +<li><p>Or a <strong>single string with slashes</strong> to separate storage and stream names (similar to the Unix path syntax). The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a stream or storage name contains a slash (which is normally not allowed, according to the Microsoft specifications [MS-CFB]). (new in v0.15)</p></li>
64 </ol> 64 </ol>
65 <p>Both are case-insensitive.</p> 65 <p>Both are case-insensitive.</p>
66 <p>Switching between the two is easy:</p> 66 <p>Switching between the two is easy:</p>
67 <pre><code>slash_path = &#39;/&#39;.join(list_path) 67 <pre><code>slash_path = &#39;/&#39;.join(list_path)
68 list_path = slash_path.split(&#39;/&#39;)</code></pre> 68 list_path = slash_path.split(&#39;/&#39;)</code></pre>
  69 +<p><strong>Encoding</strong>:</p>
  70 +<ul>
  71 +<li>Stream and Storage names are stored in Unicode format in OLE files, which means they may contain special characters (e.g. Greek, Cyrillic, Japanese, etc) that applications must support to avoid exceptions.</li>
  72 +<li><strong>On Python 2.x</strong>, all stream and storage paths are handled by olefile in bytes strings, using the <strong>UTF-8 encoding</strong> by default. If you need to use Unicode instead, add the option <strong>path_encoding=None</strong> when creating the OleFileIO object. This is new in v0.42. Olefile was using the Latin-1 encoding until v0.41, therefore special characters were not supported.<br /></li>
  73 +<li><strong>On Python 3.x</strong>, all stream and storage paths are handled by olefile in unicode strings, without encoding.</li>
  74 +</ul>
69 <h2 id="get-the-list-of-streams">Get the list of streams</h2> 75 <h2 id="get-the-list-of-streams">Get the list of streams</h2>
70 <p>listdir() returns a list of all the streams contained in the OLE file, including those stored in storages. Each stream is listed itself as a list, as described above.</p> 76 <p>listdir() returns a list of all the streams contained in the OLE file, including those stored in storages. Each stream is listed itself as a list, as described above.</p>
71 <pre><code>print(ole.listdir())</code></pre> 77 <pre><code>print(ole.listdir())</code></pre>
oletools/thirdparty/olefile/doc/API.md
@@ -112,13 +112,18 @@ Before using the write features, the OLE file must be opened in read/write mode: @@ -112,13 +112,18 @@ Before using the write features, the OLE file must be opened in read/write mode:
112 The code for write features is new and it has not been thoroughly tested yet. See [issue #6](https://bitbucket.org/decalage/olefileio_pl/issue/6/improve-olefileio_pl-to-write-ole-files) for the roadmap and the implementation status. If you encounter any issue, please send me your [feedback](http://www.decalage.info/en/contact) or [report issues](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open). 112 The code for write features is new and it has not been thoroughly tested yet. See [issue #6](https://bitbucket.org/decalage/olefileio_pl/issue/6/improve-olefileio_pl-to-write-ole-files) for the roadmap and the implementation status. If you encounter any issue, please send me your [feedback](http://www.decalage.info/en/contact) or [report issues](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open).
113 113
114 114
115 -## Syntax for stream and storage path 115 +## Syntax for stream and storage paths
116 116
117 Two different syntaxes are allowed for methods that need or return the path of streams and storages: 117 Two different syntaxes are allowed for methods that need or return the path of streams and storages:
118 118
119 -1) Either a **list of strings** including all the storages from the root up to the stream/storage name. For example a stream called "WordDocument" at the root will have ['WordDocument'] as full path. A stream called "ThisDocument" located in the storage "Macros/VBA" will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL. While hard to read and not very convenient, this syntax works in all cases. 119 +1) Either a **list of strings** including all the storages from the root up to the stream/storage name. For example a
  120 +stream called "WordDocument" at the root will have ['WordDocument'] as full path. A stream called "ThisDocument"
  121 +located in the storage "Macros/VBA" will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL.
  122 +While hard to read and not very convenient, this syntax works in all cases.
120 123
121 -2) Or a **single string with slashes** to separate storage and stream names (similar to the Unix path syntax). The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a stream or storage name contains a slash. (new in v0.15) 124 +2) Or a **single string with slashes** to separate storage and stream names (similar to the Unix path syntax).
  125 +The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a
  126 +stream or storage name contains a slash (which is normally not allowed, according to the Microsoft specifications [MS-CFB]). (new in v0.15)
122 127
123 Both are case-insensitive. 128 Both are case-insensitive.
124 129
@@ -128,10 +133,20 @@ Switching between the two is easy: @@ -128,10 +133,20 @@ Switching between the two is easy:
128 slash_path = '/'.join(list_path) 133 slash_path = '/'.join(list_path)
129 list_path = slash_path.split('/') 134 list_path = slash_path.split('/')
130 135
  136 +**Encoding**:
  137 +
  138 +- Stream and Storage names are stored in Unicode format in OLE files, which means they may contain special characters
  139 + (e.g. Greek, Cyrillic, Japanese, etc) that applications must support to avoid exceptions.
  140 +- **On Python 2.x**, all stream and storage paths are handled by olefile in bytes strings, using the **UTF-8 encoding**
  141 + by default. If you need to use Unicode instead, add the option **path_encoding=None** when creating the OleFileIO
  142 + object. This is new in v0.42. Olefile was using the Latin-1 encoding until v0.41, therefore special characters were
  143 + not supported.
  144 +- **On Python 3.x**, all stream and storage paths are handled by olefile in unicode strings, without encoding.
131 145
132 ## Get the list of streams 146 ## Get the list of streams
133 147
134 -listdir() returns a list of all the streams contained in the OLE file, including those stored in storages. Each stream is listed itself as a list, as described above. 148 +listdir() returns a list of all the streams contained in the OLE file, including those stored in storages.
  149 +Each stream is listed itself as a list, as described above.
135 150
136 :::python 151 :::python
137 print(ole.listdir()) 152 print(ole.listdir())
oletools/thirdparty/olefile/doc/Home.html
@@ -7,16 +7,18 @@ @@ -7,16 +7,18 @@
7 <title></title> 7 <title></title>
8 </head> 8 </head>
9 <body> 9 <body>
10 -<h1 id="olefile-v0.41-documentation">olefile v0.41 documentation</h1> 10 +<h1 id="olefile-v0.42-documentation">olefile v0.42 documentation</h1>
11 <p>This is the home page of the documentation for olefile. The latest version can be found <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p> 11 <p>This is the home page of the documentation for olefile. The latest version can be found <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
12 -<p><a href="http://www.decalage.info/olefile">olefile</a> is a Python package to parse, read and write <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)</a>, such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p> 12 +<p><a href="http://www.decalage.info/olefile">olefile</a> is a Python package to parse, read and write <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
13 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/olefile">Home page</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/olefileio_pl">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p> 13 <p><strong>Quick links:</strong> <a href="http://www.decalage.info/olefile">Home page</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&amp;status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/olefileio_pl">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
14 -<h2 id="history">History</h2>  
15 -<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>  
16 -<p>As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>  
17 -<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>  
18 -<p>olefile can be used as an independent module or with PIL/Pillow.</p>  
19 -<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my <a href="http://www.decalage.info/python/oletools">python-oletools</a>, which are built upon olefile and provide a higher-level interface.</p> 14 +<h2 id="documentation-pages">Documentation pages</h2>
  15 +<ul>
  16 +<li><a href="License.html">License</a></li>
  17 +<li><a href="Install.html">Install</a></li>
  18 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
  19 +<li><a href="OLE_Overview.html">OLE_Overview</a></li>
  20 +<li><a href="API.html">API</a> and Usage</li>
  21 +</ul>
20 <h2 id="features">Features</h2> 22 <h2 id="features">Features</h2>
21 <ul> 23 <ul>
22 <li>Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc</li> 24 <li>Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc</li>
@@ -25,6 +27,12 @@ @@ -25,6 +27,12 @@
25 <li>Parse and read property streams, containing metadata of the file</li> 27 <li>Parse and read property streams, containing metadata of the file</li>
26 <li>Portable, pure Python module, no dependency</li> 28 <li>Portable, pure Python module, no dependency</li>
27 </ul> 29 </ul>
  30 +<p>olefile can be used as an independent module or with PIL/Pillow.</p>
  31 +<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my <a href="http://www.decalage.info/python/oletools">python-oletools</a>, which are built upon olefile and provide a higher-level interface.</p>
  32 +<h2 id="history">History</h2>
  33 +<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>
  34 +<p>As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>
  35 +<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>
28 <h2 id="main-improvements-over-the-original-version-of-olefileio-in-pil">Main improvements over the original version of OleFileIO in PIL:</h2> 36 <h2 id="main-improvements-over-the-original-version-of-olefileio-in-pil">Main improvements over the original version of OleFileIO in PIL:</h2>
29 <ul> 37 <ul>
30 <li>Compatible with Python 3.x and 2.6+</li> 38 <li>Compatible with Python 3.x and 2.6+</li>
oletools/thirdparty/olefile/doc/Home.md
1 -olefile v0.41 documentation 1 +olefile v0.42 documentation
2 =========================== 2 ===========================
3 3
4 -This is the home page of the documentation for olefile. The latest version can be found [online](https://bitbucket.org/decalage/olefileio_pl/wiki), otherwise a copy is provided in the doc subfolder of the package. 4 +This is the home page of the documentation for olefile. The latest version can be found
  5 +[online](https://bitbucket.org/decalage/olefileio_pl/wiki), otherwise a copy is provided in the doc subfolder of the package.
5 6
6 -[olefile](http://www.decalage.info/olefile) is a Python package to parse, read and write [Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)](http://en.wikipedia.org/wiki/Compound_File_Binary_Format), such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc. 7 +[olefile](http://www.decalage.info/olefile) is a Python package to parse, read and write
  8 +[Microsoft OLE2 files](http://en.wikipedia.org/wiki/Compound_File_Binary_Format)
  9 +(also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft
  10 +Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file
  11 +formats, McAfee antivirus quarantine files, etc.
7 12
8 13
9 -**Quick links:** [Home page](http://www.decalage.info/olefile) - [Download/Install](https://bitbucket.org/decalage/olefileio_pl/wiki/Install) - [Documentation](https://bitbucket.org/decalage/olefileio_pl/wiki) - [Report Issues/Suggestions/Questions](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open) - [Contact the author](http://decalage.info/contact) - [Repository](https://bitbucket.org/decalage/olefileio_pl) - [Updates on Twitter](https://twitter.com/decalage2) 14 +**Quick links:**
  15 +[Home page](http://www.decalage.info/olefile) -
  16 +[Download/Install](https://bitbucket.org/decalage/olefileio_pl/wiki/Install) -
  17 +[Documentation](https://bitbucket.org/decalage/olefileio_pl/wiki) -
  18 +[Report Issues/Suggestions/Questions](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open) -
  19 +[Contact the author](http://decalage.info/contact) -
  20 +[Repository](https://bitbucket.org/decalage/olefileio_pl) -
  21 +[Updates on Twitter](https://twitter.com/decalage2)
10 22
11 -History  
12 --------  
13 -  
14 -olefile is based on the OleFileIO module from [PIL](http://www.pythonware.com/products/pil/index.htm), the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.  
15 -  
16 -As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)  
17 -  
18 -Since 2014 olefile/OleFileIO_PL has been integrated into [Pillow](http://python-imaging.github.io/), the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly. 23 +Documentation pages
  24 +-------------------
19 25
20 -olefile can be used as an independent module or with PIL/Pillow. 26 +- [[License]]
  27 +- [[Install]]
  28 +- [[Contribute]], Suggest Improvements or Report Issues
  29 +- [[OLE_Overview]]
  30 +- [[API]] and Usage
21 31
22 -olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my [python-oletools](http://www.decalage.info/python/oletools), which are built upon olefile and provide a higher-level interface.  
23 32
24 Features 33 Features
25 -------- 34 --------
26 35
27 -- Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc 36 +- Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls,
  37 + PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss
  38 + AxioVision ZVI files, Olympus FluoView OIB files, etc
28 - List all the streams and storages contained in an OLE file 39 - List all the streams and storages contained in an OLE file
29 - Open streams as files 40 - Open streams as files
30 - Parse and read property streams, containing metadata of the file 41 - Parse and read property streams, containing metadata of the file
31 - Portable, pure Python module, no dependency 42 - Portable, pure Python module, no dependency
32 43
  44 +olefile can be used as an independent module or with PIL/Pillow.
  45 +
  46 +olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data
  47 +(especially for security purposes such as malware analysis and forensics), then please also check my
  48 +[python-oletools](http://www.decalage.info/python/oletools), which are built upon olefile and provide a higher-level
  49 +interface.
  50 +
  51 +
  52 +History
  53 +-------
  54 +
  55 +olefile is based on the OleFileIO module from [PIL](http://www.pythonware.com/products/pil/index.htm), the excellent
  56 +Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but
  57 +since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust
  58 +design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate
  59 +its 9 years and its new write features.
  60 +
  61 +As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on
  62 +several operating systems. (please tell me if you know other similar Python modules)
  63 +
  64 +Since 2014 olefile/OleFileIO_PL has been integrated into [Pillow](http://python-imaging.github.io/), the friendly fork
  65 +of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.
33 66
34 Main improvements over the original version of OleFileIO in PIL: 67 Main improvements over the original version of OleFileIO in PIL:
35 ---------------------------------------------------------------- 68 ----------------------------------------------------------------
oletools/thirdparty/olefile/doc/Install.html
@@ -12,8 +12,9 @@ @@ -12,8 +12,9 @@
12 <p>olefile requires Python 2.6, 2.7 or 3.x.</p> 12 <p>olefile requires Python 2.6, 2.7 or 3.x.</p>
13 <p>For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain all the enhancements implemented in olefile.</p> 13 <p>For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain all the enhancements implemented in olefile.</p>
14 <h2 id="download-and-install">Download and Install</h2> 14 <h2 id="download-and-install">Download and Install</h2>
15 -<p>To use olefile with other Python applications or your own scripts, the simplest solution is to run &quot;<strong>pip install olefile</strong>&quot; or &quot;<strong>easy_install olefile</strong>&quot; to download and install the package in one go.</p>  
16 -<p>Otherwise you may download/extract the <a href="https://bitbucket.org/decalage/olefileio_pl/downloads">zip archive</a> in a temporary directory and run &quot;<strong>python setup.py install</strong>&quot;.</p> 15 +<p>To use olefile with other Python applications or your own scripts, the simplest solution is to run <strong>pip install olefile</strong> or <strong>easy_install olefile</strong>, to download and install the package in one go. Pip is part of the standard Python distribution since v2.7.9.</p>
  16 +<p>To update olefile if a previous version is already installed, run <strong>pip install -U olefile</strong>.</p>
  17 +<p>Otherwise you may download/extract the <a href="https://bitbucket.org/decalage/olefileio_pl/downloads">zip archive</a> in a temporary directory and run <strong>python setup.py install</strong>.</p>
17 <p>On Windows you may simply double-click on <strong>install.bat</strong>.</p> 18 <p>On Windows you may simply double-click on <strong>install.bat</strong>.</p>
18 <hr /> 19 <hr />
19 <h2 id="olefile-documentation">olefile documentation</h2> 20 <h2 id="olefile-documentation">olefile documentation</h2>
oletools/thirdparty/olefile/doc/Install.md
@@ -6,15 +6,21 @@ Pre-requisites @@ -6,15 +6,21 @@ Pre-requisites
6 6
7 olefile requires Python 2.6, 2.7 or 3.x. 7 olefile requires Python 2.6, 2.7 or 3.x.
8 8
9 -For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain all the enhancements implemented in olefile. 9 +For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain
  10 +all the enhancements implemented in olefile.
10 11
11 12
12 Download and Install 13 Download and Install
13 -------------------- 14 --------------------
14 15
15 -To use olefile with other Python applications or your own scripts, the simplest solution is to run "**pip install olefile**" or "**easy_install olefile**" to download and install the package in one go. 16 +To use olefile with other Python applications or your own scripts, the simplest solution is to run **pip install olefile**
  17 +or **easy_install olefile**, to download and install the package in one go. Pip is part of the standard Python
  18 +distribution since v2.7.9.
16 19
17 -Otherwise you may download/extract the [zip archive](https://bitbucket.org/decalage/olefileio_pl/downloads) in a temporary directory and run "**python setup.py install**". 20 +To update olefile if a previous version is already installed, run **pip install -U olefile**.
  21 +
  22 +Otherwise you may download/extract the [zip archive](https://bitbucket.org/decalage/olefileio_pl/downloads) in a
  23 +temporary directory and run **python setup.py install**.
18 24
19 On Windows you may simply double-click on **install.bat**. 25 On Windows you may simply double-click on **install.bat**.
20 26
oletools/thirdparty/olefile/doc/License.html
@@ -8,7 +8,7 @@ @@ -8,7 +8,7 @@
8 </head> 8 </head>
9 <body> 9 <body>
10 <h1 id="license-for-olefile">License for olefile</h1> 10 <h1 id="license-for-olefile">License for olefile</h1>
11 -<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p> 11 +<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
12 <p>All rights reserved.</p> 12 <p>All rights reserved.</p>
13 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p> 13 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
14 <ul> 14 <ul>
oletools/thirdparty/olefile/doc/License.md
1 License for olefile 1 License for olefile
2 =================== 2 ===================
3 3
4 -olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info)) 4 +olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
5 5
6 All rights reserved. 6 All rights reserved.
7 7
oletools/thirdparty/olefile/olefile.html
No preview for this file type
oletools/thirdparty/olefile/olefile.py
1 #!/usr/bin/env python 1 #!/usr/bin/env python
2 2
3 -# olefile (formerly OleFileIO_PL) version 0.42 2015-01-24 3 +# olefile (formerly OleFileIO_PL) version 0.42 2015-01-25
4 # 4 #
5 # Module to read/write Microsoft OLE2 files (also called Structured Storage or 5 # Module to read/write Microsoft OLE2 files (also called Structured Storage or
6 # Microsoft Compound Document File Format), such as Microsoft Office 97-2003 6 # Microsoft Compound Document File Format), such as Microsoft Office 97-2003
@@ -29,8 +29,8 @@ from __future__ import print_function # This version of olefile requires Pytho @@ -29,8 +29,8 @@ from __future__ import print_function # This version of olefile requires Pytho
29 29
30 30
31 __author__ = "Philippe Lagadec" 31 __author__ = "Philippe Lagadec"
32 -__date__ = "2015-01-24"  
33 -__version__ = '0.42' 32 +__date__ = "2015-01-25"
  33 +__version__ = '0.42.1'
34 34
35 #--- LICENSE ------------------------------------------------------------------ 35 #--- LICENSE ------------------------------------------------------------------
36 36