Peter M. Groen / oletools

Commit 6d2d684468dc7cd53ec2a965df2f809e11ae1f56

Authored by decalage2
1 parent e712f8ca

olemap: added header display, added options --header, --fat and --minifat

Inline Side-by-side
Showing 1 changed file with 36 additions and 3 deletions
oletools/olemap.py
  View file @6d2d684
... ... @@ -46,6 +46,8 @@ http://www.decalage.info/python/oletools
46 46 # 2017-03-20 v0.51 PL: - fixed absolute imports, added optparse
47 47 # - added support for zip files and wildcards
48 48 # - improved MiniFAT display with tablestream
  49 +# 2017-03-21 PL: - added header display
  50 +# - added options --header, --fat and --minifat
49 51  
50 52  
51 53 __version__ = '0.51dev3'
... ... @@ -55,7 +57,7 @@ __version__ = '0.51dev3'
55 57  
56 58 # === IMPORTS ================================================================
57 59  
58   -import sys, os, optparse
  60 +import sys, os, optparse, binascii
59 61  
60 62 # IMPORTANT: it should be possible to run oletools directly as scripts
61 63 # in any directory without installing them with pip or setup.py.
... ... @@ -111,6 +113,21 @@ def sid_display(sid):
111 113 return sid
112 114  
113 115  
  116 +def show_header(ole):
  117 + print("OLE HEADER:")
  118 + t = tablestream.TableStream([20, 20, 79-(4+20+20)], header_row=['Attribute', 'Value', 'Description'])
  119 + t.write_row(['OLE Signature (hex)', binascii.b2a_hex(ole.header_signature).upper(), 'Should be D0CF11E0A1B11AE1'])
  120 + t.write_row(['Header CLSID (hex)', binascii.b2a_hex(ole.header_clsid).upper(), 'Should be 0'])
  121 + t.write_row(['Minor Version', '%04X' % ole.minor_version, 'Should be 003E'])
  122 + t.write_row(['Major Version', '%04X' % ole.dll_version, 'Should be 3 or 4'])
  123 + t.write_row(['Byte Order', '%04X' % ole.byte_order, 'Should be FFFE (little endian)'])
  124 + t.write_row(['Sector Shift', '%04X' % ole.sector_shift, 'Should be 0009 or 000C'])
  125 + t.write_row(['Sector Size (bytes)', '%d' % ole.sector_size, 'Should be 512 or 4096 bytes'])
  126 + t.write_row(['Number of Directory Sectors', ole.num_dir_sectors, 'Should be 0 if major version is 3'])
  127 + t.close()
  128 + print('')
  129 +
  130 +
114 131 def show_fat(ole):
115 132 print('FAT:')
116 133 t = tablestream.TableStream([8, 12, 8, 8], header_row=['Sector #', 'Type', 'Offset', 'Next #'])
... ... @@ -156,6 +173,12 @@ def main():
156 173 help='if the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)')
157 174 # parser.add_option('-l', '--loglevel', dest="loglevel", action="store", default=DEFAULT_LOG_LEVEL,
158 175 # help="logging level debug/info/warning/error/critical (default=%default)")
  176 + parser.add_option("--header", action="store_true", dest="header",
  177 + help='Display the OLE header (default: yes)')
  178 + parser.add_option("--fat", action="store_true", dest="fat",
  179 + help='Display the FAT (default: yes)')
  180 + parser.add_option("--minifat", action="store_true", dest="minifat",
  181 + help='Display the MiniFAT (default: yes)')
159 182  
160 183 # TODO: add logfile option
161 184  
... ... @@ -168,6 +191,12 @@ def main():
168 191 parser.print_help()
169 192 sys.exit()
170 193  
  194 + # if no diplay option is provided, set defaults:
  195 + if not (options.header or options.fat or options.minifat):
  196 + options.header = True
  197 + options.fat = True
  198 + options.minifat = True
  199 +
171 200 # print banner with version
172 201 print(BANNER)
173 202  
... ... @@ -187,8 +216,12 @@ def main():
187 216 # normal filename
188 217 ole = olefile.OleFileIO(filename)
189 218  
190   - show_fat(ole)
191   - show_minifat(ole)
  219 + if options.header:
  220 + show_header(ole)
  221 + if options.fat:
  222 + show_fat(ole)
  223 + if options.minifat:
  224 + show_minifat(ole)
192 225  
193 226 ole.close()
194 227  
... ...