Peter M. Groen / oletools

Commit 8159c1b951891bada19f45dd3bf74f7251d0f442

Authored by decalage2
1 parent 40694d71

plugin_biff: almost fixed #428

Inline Side-by-side
Showing 1 changed file with 434 additions and 355 deletions
oletools/thirdparty/oledump/plugin_biff.py
  View file @8159c1b
... ... @@ -32,85 +32,50 @@ import struct
32 32 import re
33 33 import optparse
34 34 import binascii
  35 +import sys
35 36  
  37 +# from olevba:
36 38  
37   -# CIC: Call If Callable
38   -def CIC(expression):
39   - if callable(expression):
40   - return expression()
41   - else:
42   - return expression
43   -
  39 +if sys.version_info[0] <= 2:
  40 + # Python 2.x
  41 + PYTHON2 = True
  42 +else:
  43 + # Python 3.x+
  44 + PYTHON2 = False
44 45  
45   -# IFF: IF Function
46   -def IFF(expression, valueTrue, valueFalse):
47   - if expression:
48   - return CIC(valueTrue)
  46 +def unicode2str(unicode_string):
  47 + """
  48 + convert a unicode string to a native str:
  49 + - on Python 3, it returns the same string
  50 + - on Python 2, the string is encoded with UTF-8 to a bytes str
  51 + :param unicode_string: unicode string to be converted
  52 + :return: the string converted to str
  53 + :rtype: str
  54 + """
  55 + if PYTHON2:
  56 + return unicode_string.encode('utf8', errors='replace')
49 57 else:
50   - return CIC(valueFalse)
51   -
52   -
53   -def CombineHexASCII(hexDump, asciiDump, length):
54   - if hexDump == '':
55   - return ''
56   - return hexDump + ' ' + (' ' * (3 * (length - len(asciiDump)))) + asciiDump
57   -
58   -def HexASCII(data, length=16):
59   - result = []
60   - if len(data) > 0:
61   - hexDump = ''
62   - asciiDump = ''
63   - for i, b in enumerate(data):
64   - if i % length == 0:
65   - if hexDump != '':
66   - result.append(CombineHexASCII(hexDump, asciiDump, length))
67   - hexDump = '%08X:' % i
68   - asciiDump = ''
69   - hexDump += ' %02X' % ord(b)
70   - asciiDump += IFF(ord(b) >= 32, b, '.')
71   - result.append(CombineHexASCII(hexDump, asciiDump, length))
72   - return result
  58 + return unicode_string
73 59  
74   -def StringsASCII(data):
75   - return re.findall('[^\x00-\x08\x0A-\x1F\x7F-\xFF]{4,}', data)
76   -
77   -def StringsUNICODE(data):
78   - return [foundunicodestring.replace('\x00', '') for foundunicodestring, dummy in re.findall('(([^\x00-\x08\x0A-\x1F\x7F-\xFF]\x00){4,})', data)]
79 60  
80   -def Strings(data, encodings='sL'):
81   - dStrings = {}
82   - for encoding in encodings:
83   - if encoding == 's':
84   - dStrings[encoding] = StringsASCII(data)
85   - elif encoding == 'L':
86   - dStrings[encoding] = StringsUNICODE(data)
87   - return dStrings
88   -
89   -def ContainsWord(word, expression):
90   - return struct.pack('<H', word) in expression
91   -
92   -#https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/6e5eed10-5b77-43d6-8dd0-37345f8654ad
93   -def ParseLoc(expression):
94   - formatcodes = 'HH'
95   - formatsize = struct.calcsize(formatcodes)
96   - row, column = struct.unpack(formatcodes, expression[0:formatsize])
97   - rowRelative = column & 0x8000
98   - colRelative = column & 0x4000
99   - column = column & 0x3FFF
100   - if rowRelative:
101   - rowindicator = '~'
  61 +def bytes2str(bytes_string, encoding='utf8'):
  62 + """
  63 + convert a bytes string to a native str:
  64 + - on Python 2, it returns the same string (bytes=str)
  65 + - on Python 3, the string is decoded using the provided encoding
  66 + (UTF-8 by default) to a unicode str
  67 + :param bytes_string: bytes string to be converted
  68 + :param encoding: codec to be used for decoding
  69 + :return: the string converted to str
  70 + :rtype: str
  71 + """
  72 + if PYTHON2:
  73 + return bytes_string
102 74 else:
103   - rowindicator = ''
104   - row += 1
105   - if colRelative:
106   - colindicator = '~'
107   - else:
108   - colindicator = ''
109   - column += 1
110   - return 'R%s%dC%s%d' % (rowindicator, row, colindicator, column)
  75 + return bytes_string.decode(encoding, errors='replace')
111 76  
112   -def ParseExpression(expression):
113   - dTokens = {
  77 +
  78 +dTokens = {
114 79 0x01: 'ptgExp',
115 80 0x02: 'ptgTbl',
116 81 0x03: 'ptgAdd',
... ... @@ -209,7 +174,7 @@ def ParseExpression(expression):
209 174 }
210 175  
211 176 #https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b
212   - dFunctions = {
  177 +dFunctions = {
213 178 0x0000: 'COUNT',
214 179 0x0001: 'IF',
215 180 0x0002: 'ISNA',
... ... @@ -585,62 +550,436 @@ def ParseExpression(expression):
585 550 0x017B: 'RTD',
586 551  
587 552 0x8076: 'ALERT',
588   - }
  553 +}
  554 +
  555 +dOpcodes = {
  556 + 0x06: 'FORMULA : Cell Formula',
  557 + 0x0A: 'EOF : End of File',
  558 + 0x0C: 'CALCCOUNT : Iteration Count',
  559 + 0x0D: 'CALCMODE : Calculation Mode',
  560 + 0x0E: 'PRECISION : Precision',
  561 + 0x0F: 'REFMODE : Reference Mode',
  562 + 0x10: 'DELTA : Iteration Increment',
  563 + 0x11: 'ITERATION : Iteration Mode',
  564 + 0x12: 'PROTECT : Protection Flag',
  565 + 0x13: 'PASSWORD : Protection Password',
  566 + 0x14: 'HEADER : Print Header on Each Page',
  567 + 0x15: 'FOOTER : Print Footer on Each Page',
  568 + 0x16: 'EXTERNCOUNT : Number of External References',
  569 + 0x17: 'EXTERNSHEET : External Reference',
  570 + 0x18: 'LABEL : Cell Value, String Constant',
  571 + 0x19: 'WINDOWPROTECT : Windows Are Protected',
  572 + 0x1A: 'VERTICALPAGEBREAKS : Explicit Column Page Breaks',
  573 + 0x1B: 'HORIZONTALPAGEBREAKS : Explicit Row Page Breaks',
  574 + 0x1C: 'NOTE : Comment Associated with a Cell',
  575 + 0x1D: 'SELECTION : Current Selection',
  576 + 0x22: '1904 : 1904 Date System',
  577 + 0x26: 'LEFTMARGIN : Left Margin Measurement',
  578 + 0x27: 'RIGHTMARGIN : Right Margin Measurement',
  579 + 0x28: 'TOPMARGIN : Top Margin Measurement',
  580 + 0x29: 'BOTTOMMARGIN : Bottom Margin Measurement',
  581 + 0x2A: 'PRINTHEADERS : Print Row/Column Labels',
  582 + 0x2B: 'PRINTGRIDLINES : Print Gridlines Flag',
  583 + 0x2F: 'FILEPASS : File Is Password-Protected',
  584 + 0x3C: 'CONTINUE : Continues Long Records',
  585 + 0x3D: 'WINDOW1 : Window Information',
  586 + 0x40: 'BACKUP : Save Backup Version of the File',
  587 + 0x41: 'PANE : Number of Panes and Their Position',
  588 + 0x42: 'CODENAME : VBE Object Name',
  589 + 0x42: 'CODEPAGE : Default Code Page',
  590 + 0x4D: 'PLS : Environment-Specific Print Record',
  591 + 0x50: 'DCON : Data Consolidation Information',
  592 + 0x51: 'DCONREF : Data Consolidation References',
  593 + 0x52: 'DCONNAME : Data Consolidation Named References',
  594 + 0x55: 'DEFCOLWIDTH : Default Width for Columns',
  595 + 0x59: 'XCT : CRN Record Count',
  596 + 0x5A: 'CRN : Nonresident Operands',
  597 + 0x5B: 'FILESHARING : File-Sharing Information',
  598 + 0x5C: 'WRITEACCESS : Write Access User Name',
  599 + 0x5D: 'OBJ : Describes a Graphic Object',
  600 + 0x5E: 'UNCALCED : Recalculation Status',
  601 + 0x5F: 'SAVERECALC : Recalculate Before Save',
  602 + 0x60: 'TEMPLATE : Workbook Is a Template',
  603 + 0x63: 'OBJPROTECT : Objects Are Protected',
  604 + 0x7D: 'COLINFO : Column Formatting Information',
  605 + 0x7E: 'RK : Cell Value, RK Number',
  606 + 0x7F: 'IMDATA : Image Data',
  607 + 0x80: 'GUTS : Size of Row and Column Gutters',
  608 + 0x81: 'WSBOOL : Additional Workspace Information',
  609 + 0x82: 'GRIDSET : State Change of Gridlines Option',
  610 + 0x83: 'HCENTER : Center Between Horizontal Margins',
  611 + 0x84: 'VCENTER : Center Between Vertical Margins',
  612 + 0x85: 'BOUNDSHEET : Sheet Information',
  613 + 0x86: 'WRITEPROT : Workbook Is Write-Protected',
  614 + 0x87: 'ADDIN : Workbook Is an Add-in Macro',
  615 + 0x88: 'EDG : Edition Globals',
  616 + 0x89: 'PUB : Publisher',
  617 + 0x8C: 'COUNTRY : Default Country and WIN.INI Country',
  618 + 0x8D: 'HIDEOBJ : Object Display Options',
  619 + 0x90: 'SORT : Sorting Options',
  620 + 0x91: 'SUB : Subscriber',
  621 + 0x92: 'PALETTE : Color Palette Definition',
  622 + 0x94: 'LHRECORD : .WK? File Conversion Information',
  623 + 0x95: 'LHNGRAPH : Named Graph Information',
  624 + 0x96: 'SOUND : Sound Note',
  625 + 0x98: 'LPR : Sheet Was Printed Using LINE.PRINT(',
  626 + 0x99: 'STANDARDWIDTH : Standard Column Width',
  627 + 0x9A: 'FNGROUPNAME : Function Group Name',
  628 + 0x9B: 'FILTERMODE : Sheet Contains Filtered List',
  629 + 0x9C: 'FNGROUPCOUNT : Built-in Function Group Count',
  630 + 0x9D: 'AUTOFILTERINFO : Drop-Down Arrow Count',
  631 + 0x9E: 'AUTOFILTER : AutoFilter Data',
  632 + 0xA0: 'SCL : Window Zoom Magnification',
  633 + 0xA1: 'SETUP : Page Setup',
  634 + 0xA9: 'COORDLIST : Polygon Object Vertex Coordinates',
  635 + 0xAB: 'GCW : Global Column-Width Flags',
  636 + 0xAE: 'SCENMAN : Scenario Output Data',
  637 + 0xAF: 'SCENARIO : Scenario Data',
  638 + 0xB0: 'SXVIEW : View Definition',
  639 + 0xB1: 'SXVD : View Fields',
  640 + 0xB2: 'SXVI : View Item',
  641 + 0xB4: 'SXIVD : Row/Column Field IDs',
  642 + 0xB5: 'SXLI : Line Item Array',
  643 + 0xB6: 'SXPI : Page Item',
  644 + 0xB8: 'DOCROUTE : Routing Slip Information',
  645 + 0xB9: 'RECIPNAME : Recipient Name',
  646 + 0xBC: 'SHRFMLA : Shared Formula',
  647 + 0xBD: 'MULRK : Multiple RK Cells',
  648 + 0xBE: 'MULBLANK : Multiple Blank Cells',
  649 + 0xC1: 'MMS : ADDMENU / DELMENU Record Group Count',
  650 + 0xC2: 'ADDMENU : Menu Addition',
  651 + 0xC3: 'DELMENU : Menu Deletion',
  652 + 0xC5: 'SXDI : Data Item',
  653 + 0xC6: 'SXDB : PivotTable Cache Data',
  654 + 0xCD: 'SXSTRING : String',
  655 + 0xD0: 'SXTBL : Multiple Consolidation Source Info',
  656 + 0xD1: 'SXTBRGIITM : Page Item Name Count',
  657 + 0xD2: 'SXTBPG : Page Item Indexes',
  658 + 0xD3: 'OBPROJ : Visual Basic Project',
  659 + 0xD5: 'SXIDSTM : Stream ID',
  660 + 0xD6: 'RSTRING : Cell with Character Formatting',
  661 + 0xD7: 'DBCELL : Stream Offsets',
  662 + 0xDA: 'BOOKBOOL : Workbook Option Flag',
  663 + 0xDC: 'PARAMQRY : Query Parameters',
  664 + 0xDC: 'SXEXT : External Source Information',
  665 + 0xDD: 'SCENPROTECT : Scenario Protection',
  666 + 0xDE: 'OLESIZE : Size of OLE Object',
  667 + 0xDF: 'UDDESC : Description String for Chart Autoformat',
  668 + 0xE0: 'XF : Extended Format',
  669 + 0xE1: 'INTERFACEHDR : Beginning of User Interface Records',
  670 + 0xE2: 'INTERFACEEND : End of User Interface Records',
  671 + 0xE3: 'SXVS : View Source',
  672 + 0xE5: 'MERGECELLS : Merged Cells',
  673 + 0xEA: 'TABIDCONF : Sheet Tab ID of Conflict History',
  674 + 0xEB: 'MSODRAWINGGROUP : Microsoft Office Drawing Group',
  675 + 0xEC: 'MSODRAWING : Microsoft Office Drawing',
  676 + 0xED: 'MSODRAWINGSELECTION : Microsoft Office Drawing Selection',
  677 + 0xF0: 'SXRULE : PivotTable Rule Data',
  678 + 0xF1: 'SXEX : PivotTable View Extended Information',
  679 + 0xF2: 'SXFILT : PivotTable Rule Filter',
  680 + 0xF4: 'SXDXF : Pivot Table Formatting',
  681 + 0xF5: 'SXITM : Pivot Table Item Indexes',
  682 + 0xF6: 'SXNAME : PivotTable Name',
  683 + 0xF7: 'SXSELECT : PivotTable Selection Information',
  684 + 0xF8: 'SXPAIR : PivotTable Name Pair',
  685 + 0xF9: 'SXFMLA : Pivot Table Parsed Expression',
  686 + 0xFB: 'SXFORMAT : PivotTable Format Record',
  687 + 0xFC: 'SST : Shared String Table',
  688 + 0xFD: 'LABELSST : Cell Value, String Constant/ SST',
  689 + 0xFF: 'EXTSST : Extended Shared String Table',
  690 + 0x100: 'SXVDEX : Extended PivotTable View Fields',
  691 + 0x103: 'SXFORMULA : PivotTable Formula Record',
  692 + 0x122: 'SXDBEX : PivotTable Cache Data',
  693 + 0x13D: 'TABID : Sheet Tab Index Array',
  694 + 0x160: 'USESELFS : Natural Language Formulas Flag',
  695 + 0x161: 'DSF : Double Stream File',
  696 + 0x162: 'XL5MODIFY : Flag for DSF',
  697 + 0x1A5: 'FILESHARING2 : File-Sharing Information for Shared Lists',
  698 + 0x1A9: 'USERBVIEW : Workbook Custom View Settings',
  699 + 0x1AA: 'USERSVIEWBEGIN : Custom View Settings',
  700 + 0x1AB: 'USERSVIEWEND : End of Custom View Records',
  701 + 0x1AD: 'QSI : External Data Range',
  702 + 0x1AE: 'SUPBOOK : Supporting Workbook',
  703 + 0x1AF: 'PROT4REV : Shared Workbook Protection Flag',
  704 + 0x1B0: 'CONDFMT : Conditional Formatting Range Information',
  705 + 0x1B1: 'CF : Conditional Formatting Conditions',
  706 + 0x1B2: 'DVAL : Data Validation Information',
  707 + 0x1B5: 'DCONBIN : Data Consolidation Information',
  708 + 0x1B6: 'TXO : Text Object',
  709 + 0x1B7: 'REFRESHALL : Refresh Flag',
  710 + 0x1B8: 'HLINK : Hyperlink',
  711 + 0x1BB: 'SXFDBTYPE : SQL Datatype Identifier',
  712 + 0x1BC: 'PROT4REVPASS : Shared Workbook Protection Password',
  713 + 0x1BE: 'DV : Data Validation Criteria',
  714 + 0x1C0: 'EXCEL9FILE : Excel 9 File',
  715 + 0x1C1: 'RECALCID : Recalc Information',
  716 + 0x200: 'DIMENSIONS : Cell Table Size',
  717 + 0x201: 'BLANK : Cell Value, Blank Cell',
  718 + 0x203: 'NUMBER : Cell Value, Floating-Point Number',
  719 + 0x204: 'LABEL : Cell Value, String Constant',
  720 + 0x205: 'BOOLERR : Cell Value, Boolean or Error',
  721 + 0x207: 'STRING : String Value of a Formula',
  722 + 0x208: 'ROW : Describes a Row',
  723 + 0x20B: 'INDEX : Index Record',
  724 + 0x218: 'NAME : Defined Name',
  725 + 0x221: 'ARRAY : Array-Entered Formula',
  726 + 0x223: 'EXTERNNAME : Externally Referenced Name',
  727 + 0x225: 'DEFAULTROWHEIGHT : Default Row Height',
  728 + 0x231: 'FONT : Font Description',
  729 + 0x236: 'TABLE : Data Table',
  730 + 0x23E: 'WINDOW2 : Sheet Window Information',
  731 + 0x293: 'STYLE : Style Information',
  732 + 0x406: 'FORMULA : Cell Formula',
  733 + 0x41E: 'FORMAT : Number Format',
  734 + 0x800: 'HLINKTOOLTIP : Hyperlink Tooltip',
  735 + 0x801: 'WEBPUB : Web Publish Item',
  736 + 0x802: 'QSISXTAG : PivotTable and Query Table Extensions',
  737 + 0x803: 'DBQUERYEXT : Database Query Extensions',
  738 + 0x804: 'EXTSTRING : FRT String',
  739 + 0x805: 'TXTQUERY : Text Query Information',
  740 + 0x806: 'QSIR : Query Table Formatting',
  741 + 0x807: 'QSIF : Query Table Field Formatting',
  742 + 0x809: 'BOF : Beginning of File',
  743 + 0x80A: 'OLEDBCONN : OLE Database Connection',
  744 + 0x80B: 'WOPT : Web Options',
  745 + 0x80C: 'SXVIEWEX : Pivot Table OLAP Extensions',
  746 + 0x80D: 'SXTH : PivotTable OLAP Hierarchy',
  747 + 0x80E: 'SXPIEX : OLAP Page Item Extensions',
  748 + 0x80F: 'SXVDTEX : View Dimension OLAP Extensions',
  749 + 0x810: 'SXVIEWEX9 : Pivot Table Extensions',
  750 + 0x812: 'CONTINUEFRT : Continued FRT',
  751 + 0x813: 'REALTIMEDATA : Real-Time Data (RTD)',
  752 + 0x862: 'SHEETEXT : Extra Sheet Info',
  753 + 0x863: 'BOOKEXT : Extra Book Info',
  754 + 0x864: 'SXADDL : Pivot Table Additional Info',
  755 + 0x865: 'CRASHRECERR : Crash Recovery Error',
  756 + 0x866: 'HFPicture : Header / Footer Picture',
  757 + 0x867: 'FEATHEADR : Shared Feature Header',
  758 + 0x868: 'FEAT : Shared Feature Record',
  759 + 0x86A: 'DATALABEXT : Chart Data Label Extension',
  760 + 0x86B: 'DATALABEXTCONTENTS : Chart Data Label Extension Contents',
  761 + 0x86C: 'CELLWATCH : Cell Watch',
  762 + 0x86d: 'FEATINFO : Shared Feature Info Record',
  763 + 0x871: 'FEATHEADR11 : Shared Feature Header 11',
  764 + 0x872: 'FEAT11 : Shared Feature 11 Record',
  765 + 0x873: 'FEATINFO11 : Shared Feature Info 11 Record',
  766 + 0x874: 'DROPDOWNOBJIDS : Drop Down Object',
  767 + 0x875: 'CONTINUEFRT11 : Continue FRT 11',
  768 + 0x876: 'DCONN : Data Connection',
  769 + 0x877: 'LIST12 : Extra Table Data Introduced in Excel 2007',
  770 + 0x878: 'FEAT12 : Shared Feature 12 Record',
  771 + 0x879: 'CONDFMT12 : Conditional Formatting Range Information 12',
  772 + 0x87A: 'CF12 : Conditional Formatting Condition 12',
  773 + 0x87B: 'CFEX : Conditional Formatting Extension',
  774 + 0x87C: 'XFCRC : XF Extensions Checksum',
  775 + 0x87D: 'XFEXT : XF Extension',
  776 + 0x87E: 'EZFILTER12 : AutoFilter Data Introduced in Excel 2007',
  777 + 0x87F: 'CONTINUEFRT12 : Continue FRT 12',
  778 + 0x881: 'SXADDL12 : Additional Workbook Connections Information',
  779 + 0x884: 'MDTINFO : Information about a Metadata Type',
  780 + 0x885: 'MDXSTR : MDX Metadata String',
  781 + 0x886: 'MDXTUPLE : Tuple MDX Metadata',
  782 + 0x887: 'MDXSET : Set MDX Metadata',
  783 + 0x888: 'MDXPROP : Member Property MDX Metadata',
  784 + 0x889: 'MDXKPI : Key Performance Indicator MDX Metadata',
  785 + 0x88A: 'MDTB : Block of Metadata Records',
  786 + 0x88B: 'PLV : Page Layout View Settings in Excel 2007',
  787 + 0x88C: 'COMPAT12 : Compatibility Checker 12',
  788 + 0x88D: 'DXF : Differential XF',
  789 + 0x88E: 'TABLESTYLES : Table Styles',
  790 + 0x88F: 'TABLESTYLE : Table Style',
  791 + 0x890: 'TABLESTYLEELEMENT : Table Style Element',
  792 + 0x892: 'STYLEEXT : Named Cell Style Extension',
  793 + 0x893: 'NAMEPUBLISH : Publish To Excel Server Data for Name',
  794 + 0x894: 'NAMECMT : Name Comment',
  795 + 0x895: 'SORTDATA12 : Sort Data 12',
  796 + 0x896: 'THEME : Theme',
  797 + 0x897: 'GUIDTYPELIB : VB Project Typelib GUID',
  798 + 0x898: 'FNGRP12 : Function Group',
  799 + 0x899: 'NAMEFNGRP12 : Extra Function Group',
  800 + 0x89A: 'MTRSETTINGS : Multi-Threaded Calculation Settings',
  801 + 0x89B: 'COMPRESSPICTURES : Automatic Picture Compression Mode',
  802 + 0x89C: 'HEADERFOOTER : Header Footer',
  803 + 0x8A3: 'FORCEFULLCALCULATION : Force Full Calculation Settings',
  804 + 0x8c1: 'LISTOBJ : List Object',
  805 + 0x8c2: 'LISTFIELD : List Field',
  806 + 0x8c3: 'LISTDV : List Data Validation',
  807 + 0x8c4: 'LISTCONDFMT : List Conditional Formatting',
  808 + 0x8c5: 'LISTCF : List Cell Formatting',
  809 + 0x8c6: 'FMQRY : Filemaker queries',
  810 + 0x8c7: 'FMSQRY : File maker queries',
  811 + 0x8c8: 'PLV : Page Layout View in Mac Excel 11',
  812 + 0x8c9: 'LNEXT : Extension information for borders in Mac Office 11',
  813 + 0x8ca: 'MKREXT : Extension information for markers in Mac Office 11'
  814 +}
  815 +
  816 +
  817 +# CIC: Call If Callable
  818 +def CIC(expression):
  819 + if callable(expression):
  820 + return expression()
  821 + else:
  822 + return expression
  823 +
  824 +
  825 +# IFF: IF Function
  826 +def IFF(expression, valueTrue, valueFalse):
  827 + if expression:
  828 + return CIC(valueTrue)
  829 + else:
  830 + return CIC(valueFalse)
  831 +
  832 +
  833 +def CombineHexASCII(hexDump, asciiDump, length):
  834 + if hexDump == '':
  835 + return ''
  836 + return hexDump + ' ' + (' ' * (3 * (length - len(asciiDump)))) + asciiDump
  837 +
  838 +def HexASCII(data, length=16):
  839 + result = []
  840 + if len(data) > 0:
  841 + hexDump = ''
  842 + asciiDump = ''
  843 + for i, b in enumerate(data):
  844 + if i % length == 0:
  845 + if hexDump != '':
  846 + result.append(CombineHexASCII(hexDump, asciiDump, length))
  847 + hexDump = '%08X:' % i
  848 + asciiDump = ''
  849 + hexDump += ' %02X' % ord(b)
  850 + asciiDump += IFF(ord(b) >= 32, b, '.')
  851 + result.append(CombineHexASCII(hexDump, asciiDump, length))
  852 + return result
  853 +
  854 +def StringsASCII(data):
  855 + """
  856 + Extract a list of plain ASCII strings of 4+ chars found in data.
  857 + :param data: bytearray or bytes
  858 + :return: list of str (converted to unicode on Python 3)
  859 + """
  860 + # list of bytes strings:
  861 + bytes_strings = re.findall(b'[^\x00-\x08\x0A-\x1F\x7F-\xFF]{4,}', bytes(data))
  862 + return [bytes2str(bs) for bs in bytes_strings]
  863 +
  864 +def StringsUNICODE(data):
  865 + """
  866 + Extract a list of Unicode strings (made of 4+ plain ASCII characters only) found in data.
  867 + :param data: bytearray or bytes
  868 + :return: list of str (converted to unicode on Python 3)
  869 + """
  870 + # list of bytes strings:
  871 + # TODO: check if the null byte should be before or after the ascii byte
  872 + bytes_strings = [foundunicodestring.replace(b'\x00', b'') for foundunicodestring, dummy in re.findall(b'(([^\x00-\x08\x0A-\x1F\x7F-\xFF]\x00){4,})', bytes(data))]
  873 + return [bytes2str(bs) for bs in bytes_strings]
589 874  
  875 +def Strings(data, encodings='sL'):
  876 + """
  877 +
  878 + :param data bytearray: bytearray, data to be scanned for strings
  879 + :param encodings:
  880 + :return: dict with key = 's' or 'L', values = list of str
  881 + """
  882 + dStrings = {}
  883 + for encoding in encodings:
  884 + if encoding == 's':
  885 + dStrings[encoding] = StringsASCII(data)
  886 + elif encoding == 'L':
  887 + dStrings[encoding] = StringsUNICODE(data)
  888 + return dStrings
  889 +
  890 +def ContainsWord(word, expression):
  891 + return struct.pack('<H', word) in expression
  892 +
  893 +# https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/6e5eed10-5b77-43d6-8dd0-37345f8654ad
  894 +def ParseLoc(expression):
  895 + """
  896 +
  897 + :param expression bytearray: bytearray, data to be parsed
  898 + :return:
  899 + :rtype: str
  900 + """
  901 + formatcodes = 'HH'
  902 + formatsize = struct.calcsize(formatcodes)
  903 + row, column = struct.unpack(formatcodes, expression[0:formatsize])
  904 + rowRelative = column & 0x8000
  905 + colRelative = column & 0x4000
  906 + column = column & 0x3FFF
  907 + if rowRelative:
  908 + rowindicator = '~'
  909 + else:
  910 + rowindicator = ''
  911 + row += 1
  912 + if colRelative:
  913 + colindicator = '~'
  914 + else:
  915 + colindicator = ''
  916 + column += 1
  917 + return 'R%s%dC%s%d' % (rowindicator, row, colindicator, column)
  918 +
  919 +def ParseExpression(expression):
  920 + '''
  921 + Parse an expression into a human readable string.
  922 +
  923 + :param expression bytearray: bytearray, expression data to be parsed
  924 + :return: str, parsed expression as a string (bytes on Python 2, unicode on python 3)
  925 + :rtype: str
  926 + '''
590 927 result = ''
591 928 while len(expression) > 0:
592   - ptgid = expression[0]
593   - expression = expression[1:]
  929 + ptgid = expression[0] # int
  930 + expression = expression[1:] # bytearray
594 931 if ptgid in dTokens:
595 932 result += dTokens[ptgid] + ' '
596   - if ptgid == 0x17:
597   - length = expression[0]
  933 + if ptgid == 0x17: # ptgStr
  934 + length = expression[0] # int
598 935 expression = expression[1:]
599   - if expression[0] == '\x00': # probably BIFF8 -> UNICODE (compressed)
  936 + if expression[0] == 0: # probably BIFF8 -> UNICODE (compressed)
600 937 expression = expression[1:]
601   - result += '"%s" ' % expression[:length]
  938 + result += '"%s" ' % bytes2str(expression[:length])
602 939 expression = expression[length:]
603   - elif ptgid == 0x19:
604   - grbit = expression[0]
  940 + elif ptgid == 0x19: # ptgAttr
  941 + grbit = expression[0] # int
605 942 expression = expression[1:]
606 943 if grbit & 0x04:
607 944 result += 'CHOOSE '
608 945 break
609 946 else:
610 947 expression = expression[2:]
611   - elif ptgid == 0x16 or ptgid == 0x0e:
  948 + elif ptgid == 0x16 or ptgid == 0x0e: # 0x0E: 'ptgNE', 0x16: 'ptgMissArg'
612 949 pass
613   - elif ptgid == 0x1e:
  950 + elif ptgid == 0x1e: # ptgInt
614 951 result += '%d ' % (expression[0] + expression[1] * 0x100)
615 952 expression = expression[2:]
616   - elif ptgid == 0x41:
  953 + elif ptgid == 0x41: # ptgFuncV
617 954 functionid = expression[0] + expression[1] * 0x100
618 955 result += '%s (0x%04x) ' % (dFunctions.get(functionid, '*UNKNOWN FUNCTION*'), functionid)
619 956 expression = expression[2:]
620   - elif ptgid == 0x22 or ptgid == 0x42:
  957 + elif ptgid == 0x22 or ptgid == 0x42: # 0x22: 'ptgFuncVar', 0x42: 'ptgFuncVarV'
621 958 functionid = expression[1] + expression[2] * 0x100
622 959 result += 'args %d func %s (0x%04x) ' % (expression[0], dFunctions.get(functionid, '*UNKNOWN FUNCTION*'), functionid)
623 960 expression = expression[3:]
624   - elif ptgid == 0x23:
  961 + elif ptgid == 0x23: # ptgName
625 962 result += '%04x ' % (expression[0] + expression[1] * 0x100)
  963 + # TODO: looks like we're skipping quite a few bytes
626 964 expression = expression[14:]
627   - elif ptgid == 0x1f:
  965 + elif ptgid == 0x1f: # ptgNum
628 966 result += 'FLOAT '
  967 + # TODO: looks like we're skipping quite a few bytes
629 968 expression = expression[8:]
630   - elif ptgid == 0x26:
631   - expression = expression[4:]
  969 + elif ptgid == 0x26: # ptgMemArea
  970 + expression = expression[4:] # skipping 4 bytes
632 971 expression = expression[expression[0] + expression[1] * 0x100:]
633 972 result += 'REFERENCE-EXPRESSION '
634   - elif ptgid == 0x01:
  973 + elif ptgid == 0x01: # ptgExp
635 974 formatcodes = 'HH'
636 975 formatsize = struct.calcsize(formatcodes)
637 976 row, column = struct.unpack(formatcodes, expression[0:formatsize])
638 977 expression = expression[formatsize:]
639 978 result += 'R%dC%d ' % (row + 1, column + 1)
640   - elif ptgid == 0x24 or ptgid == 0x44:
  979 + elif ptgid == 0x24 or ptgid == 0x44: # 0x24: 'ptgRef', 0x44: 'ptgRefV'
641 980 result += '%s ' % ParseLoc(expression)
642 981 expression = expression[4:]
643   - elif ptgid == 0x3A or ptgid == 0x5A:
  982 + elif ptgid == 0x3A or ptgid == 0x5A: # 0x3A: 'ptgRef3d', 0x5A: 'ptgRef3dV'
644 983 result += '%s ' % ParseLoc(expression[2:])
645 984 expression = expression[6:]
646 985 else:
... ... @@ -651,6 +990,7 @@ def ParseExpression(expression):
651 990 if expression == '':
652 991 return result
653 992 else:
  993 + # 0x006E: 'EXEC', 0x0095: 'REGISTER'
654 994 functions = [dFunctions[functionid] for functionid in [0x6E, 0x95] if ContainsWord(functionid, expression)]
655 995 if functions != []:
656 996 message = ' Could contain following functions: ' + ','.join(functions) + ' -'
... ... @@ -672,267 +1012,6 @@ class cBIFF(object): # cPluginParent):
672 1012 def Analyze(self):
673 1013 result = []
674 1014 macros4Found = False
675   - dOpcodes = {
676   - 0x06: 'FORMULA : Cell Formula',
677   - 0x0A: 'EOF : End of File',
678   - 0x0C: 'CALCCOUNT : Iteration Count',
679   - 0x0D: 'CALCMODE : Calculation Mode',
680   - 0x0E: 'PRECISION : Precision',
681   - 0x0F: 'REFMODE : Reference Mode',
682   - 0x10: 'DELTA : Iteration Increment',
683   - 0x11: 'ITERATION : Iteration Mode',
684   - 0x12: 'PROTECT : Protection Flag',
685   - 0x13: 'PASSWORD : Protection Password',
686   - 0x14: 'HEADER : Print Header on Each Page',
687   - 0x15: 'FOOTER : Print Footer on Each Page',
688   - 0x16: 'EXTERNCOUNT : Number of External References',
689   - 0x17: 'EXTERNSHEET : External Reference',
690   - 0x18: 'LABEL : Cell Value, String Constant',
691   - 0x19: 'WINDOWPROTECT : Windows Are Protected',
692   - 0x1A: 'VERTICALPAGEBREAKS : Explicit Column Page Breaks',
693   - 0x1B: 'HORIZONTALPAGEBREAKS : Explicit Row Page Breaks',
694   - 0x1C: 'NOTE : Comment Associated with a Cell',
695   - 0x1D: 'SELECTION : Current Selection',
696   - 0x22: '1904 : 1904 Date System',
697   - 0x26: 'LEFTMARGIN : Left Margin Measurement',
698   - 0x27: 'RIGHTMARGIN : Right Margin Measurement',
699   - 0x28: 'TOPMARGIN : Top Margin Measurement',
700   - 0x29: 'BOTTOMMARGIN : Bottom Margin Measurement',
701   - 0x2A: 'PRINTHEADERS : Print Row/Column Labels',
702   - 0x2B: 'PRINTGRIDLINES : Print Gridlines Flag',
703   - 0x2F: 'FILEPASS : File Is Password-Protected',
704   - 0x3C: 'CONTINUE : Continues Long Records',
705   - 0x3D: 'WINDOW1 : Window Information',
706   - 0x40: 'BACKUP : Save Backup Version of the File',
707   - 0x41: 'PANE : Number of Panes and Their Position',
708   - 0x42: 'CODENAME : VBE Object Name',
709   - 0x42: 'CODEPAGE : Default Code Page',
710   - 0x4D: 'PLS : Environment-Specific Print Record',
711   - 0x50: 'DCON : Data Consolidation Information',
712   - 0x51: 'DCONREF : Data Consolidation References',
713   - 0x52: 'DCONNAME : Data Consolidation Named References',
714   - 0x55: 'DEFCOLWIDTH : Default Width for Columns',
715   - 0x59: 'XCT : CRN Record Count',
716   - 0x5A: 'CRN : Nonresident Operands',
717   - 0x5B: 'FILESHARING : File-Sharing Information',
718   - 0x5C: 'WRITEACCESS : Write Access User Name',
719   - 0x5D: 'OBJ : Describes a Graphic Object',
720   - 0x5E: 'UNCALCED : Recalculation Status',
721   - 0x5F: 'SAVERECALC : Recalculate Before Save',
722   - 0x60: 'TEMPLATE : Workbook Is a Template',
723   - 0x63: 'OBJPROTECT : Objects Are Protected',
724   - 0x7D: 'COLINFO : Column Formatting Information',
725   - 0x7E: 'RK : Cell Value, RK Number',
726   - 0x7F: 'IMDATA : Image Data',
727   - 0x80: 'GUTS : Size of Row and Column Gutters',
728   - 0x81: 'WSBOOL : Additional Workspace Information',
729   - 0x82: 'GRIDSET : State Change of Gridlines Option',
730   - 0x83: 'HCENTER : Center Between Horizontal Margins',
731   - 0x84: 'VCENTER : Center Between Vertical Margins',
732   - 0x85: 'BOUNDSHEET : Sheet Information',
733   - 0x86: 'WRITEPROT : Workbook Is Write-Protected',
734   - 0x87: 'ADDIN : Workbook Is an Add-in Macro',
735   - 0x88: 'EDG : Edition Globals',
736   - 0x89: 'PUB : Publisher',
737   - 0x8C: 'COUNTRY : Default Country and WIN.INI Country',
738   - 0x8D: 'HIDEOBJ : Object Display Options',
739   - 0x90: 'SORT : Sorting Options',
740   - 0x91: 'SUB : Subscriber',
741   - 0x92: 'PALETTE : Color Palette Definition',
742   - 0x94: 'LHRECORD : .WK? File Conversion Information',
743   - 0x95: 'LHNGRAPH : Named Graph Information',
744   - 0x96: 'SOUND : Sound Note',
745   - 0x98: 'LPR : Sheet Was Printed Using LINE.PRINT(',
746   - 0x99: 'STANDARDWIDTH : Standard Column Width',
747   - 0x9A: 'FNGROUPNAME : Function Group Name',
748   - 0x9B: 'FILTERMODE : Sheet Contains Filtered List',
749   - 0x9C: 'FNGROUPCOUNT : Built-in Function Group Count',
750   - 0x9D: 'AUTOFILTERINFO : Drop-Down Arrow Count',
751   - 0x9E: 'AUTOFILTER : AutoFilter Data',
752   - 0xA0: 'SCL : Window Zoom Magnification',
753   - 0xA1: 'SETUP : Page Setup',
754   - 0xA9: 'COORDLIST : Polygon Object Vertex Coordinates',
755   - 0xAB: 'GCW : Global Column-Width Flags',
756   - 0xAE: 'SCENMAN : Scenario Output Data',
757   - 0xAF: 'SCENARIO : Scenario Data',
758   - 0xB0: 'SXVIEW : View Definition',
759   - 0xB1: 'SXVD : View Fields',
760   - 0xB2: 'SXVI : View Item',
761   - 0xB4: 'SXIVD : Row/Column Field IDs',
762   - 0xB5: 'SXLI : Line Item Array',
763   - 0xB6: 'SXPI : Page Item',
764   - 0xB8: 'DOCROUTE : Routing Slip Information',
765   - 0xB9: 'RECIPNAME : Recipient Name',
766   - 0xBC: 'SHRFMLA : Shared Formula',
767   - 0xBD: 'MULRK : Multiple RK Cells',
768   - 0xBE: 'MULBLANK : Multiple Blank Cells',
769   - 0xC1: 'MMS : ADDMENU / DELMENU Record Group Count',
770   - 0xC2: 'ADDMENU : Menu Addition',
771   - 0xC3: 'DELMENU : Menu Deletion',
772   - 0xC5: 'SXDI : Data Item',
773   - 0xC6: 'SXDB : PivotTable Cache Data',
774   - 0xCD: 'SXSTRING : String',
775   - 0xD0: 'SXTBL : Multiple Consolidation Source Info',
776   - 0xD1: 'SXTBRGIITM : Page Item Name Count',
777   - 0xD2: 'SXTBPG : Page Item Indexes',
778   - 0xD3: 'OBPROJ : Visual Basic Project',
779   - 0xD5: 'SXIDSTM : Stream ID',
780   - 0xD6: 'RSTRING : Cell with Character Formatting',
781   - 0xD7: 'DBCELL : Stream Offsets',
782   - 0xDA: 'BOOKBOOL : Workbook Option Flag',
783   - 0xDC: 'PARAMQRY : Query Parameters',
784   - 0xDC: 'SXEXT : External Source Information',
785   - 0xDD: 'SCENPROTECT : Scenario Protection',
786   - 0xDE: 'OLESIZE : Size of OLE Object',
787   - 0xDF: 'UDDESC : Description String for Chart Autoformat',
788   - 0xE0: 'XF : Extended Format',
789   - 0xE1: 'INTERFACEHDR : Beginning of User Interface Records',
790   - 0xE2: 'INTERFACEEND : End of User Interface Records',
791   - 0xE3: 'SXVS : View Source',
792   - 0xE5: 'MERGECELLS : Merged Cells',
793   - 0xEA: 'TABIDCONF : Sheet Tab ID of Conflict History',
794   - 0xEB: 'MSODRAWINGGROUP : Microsoft Office Drawing Group',
795   - 0xEC: 'MSODRAWING : Microsoft Office Drawing',
796   - 0xED: 'MSODRAWINGSELECTION : Microsoft Office Drawing Selection',
797   - 0xF0: 'SXRULE : PivotTable Rule Data',
798   - 0xF1: 'SXEX : PivotTable View Extended Information',
799   - 0xF2: 'SXFILT : PivotTable Rule Filter',
800   - 0xF4: 'SXDXF : Pivot Table Formatting',
801   - 0xF5: 'SXITM : Pivot Table Item Indexes',
802   - 0xF6: 'SXNAME : PivotTable Name',
803   - 0xF7: 'SXSELECT : PivotTable Selection Information',
804   - 0xF8: 'SXPAIR : PivotTable Name Pair',
805   - 0xF9: 'SXFMLA : Pivot Table Parsed Expression',
806   - 0xFB: 'SXFORMAT : PivotTable Format Record',
807   - 0xFC: 'SST : Shared String Table',
808   - 0xFD: 'LABELSST : Cell Value, String Constant/ SST',
809   - 0xFF: 'EXTSST : Extended Shared String Table',
810   - 0x100: 'SXVDEX : Extended PivotTable View Fields',
811   - 0x103: 'SXFORMULA : PivotTable Formula Record',
812   - 0x122: 'SXDBEX : PivotTable Cache Data',
813   - 0x13D: 'TABID : Sheet Tab Index Array',
814   - 0x160: 'USESELFS : Natural Language Formulas Flag',
815   - 0x161: 'DSF : Double Stream File',
816   - 0x162: 'XL5MODIFY : Flag for DSF',
817   - 0x1A5: 'FILESHARING2 : File-Sharing Information for Shared Lists',
818   - 0x1A9: 'USERBVIEW : Workbook Custom View Settings',
819   - 0x1AA: 'USERSVIEWBEGIN : Custom View Settings',
820   - 0x1AB: 'USERSVIEWEND : End of Custom View Records',
821   - 0x1AD: 'QSI : External Data Range',
822   - 0x1AE: 'SUPBOOK : Supporting Workbook',
823   - 0x1AF: 'PROT4REV : Shared Workbook Protection Flag',
824   - 0x1B0: 'CONDFMT : Conditional Formatting Range Information',
825   - 0x1B1: 'CF : Conditional Formatting Conditions',
826   - 0x1B2: 'DVAL : Data Validation Information',
827   - 0x1B5: 'DCONBIN : Data Consolidation Information',
828   - 0x1B6: 'TXO : Text Object',
829   - 0x1B7: 'REFRESHALL : Refresh Flag',
830   - 0x1B8: 'HLINK : Hyperlink',
831   - 0x1BB: 'SXFDBTYPE : SQL Datatype Identifier',
832   - 0x1BC: 'PROT4REVPASS : Shared Workbook Protection Password',
833   - 0x1BE: 'DV : Data Validation Criteria',
834   - 0x1C0: 'EXCEL9FILE : Excel 9 File',
835   - 0x1C1: 'RECALCID : Recalc Information',
836   - 0x200: 'DIMENSIONS : Cell Table Size',
837   - 0x201: 'BLANK : Cell Value, Blank Cell',
838   - 0x203: 'NUMBER : Cell Value, Floating-Point Number',
839   - 0x204: 'LABEL : Cell Value, String Constant',
840   - 0x205: 'BOOLERR : Cell Value, Boolean or Error',
841   - 0x207: 'STRING : String Value of a Formula',
842   - 0x208: 'ROW : Describes a Row',
843   - 0x20B: 'INDEX : Index Record',
844   - 0x218: 'NAME : Defined Name',
845   - 0x221: 'ARRAY : Array-Entered Formula',
846   - 0x223: 'EXTERNNAME : Externally Referenced Name',
847   - 0x225: 'DEFAULTROWHEIGHT : Default Row Height',
848   - 0x231: 'FONT : Font Description',
849   - 0x236: 'TABLE : Data Table',
850   - 0x23E: 'WINDOW2 : Sheet Window Information',
851   - 0x293: 'STYLE : Style Information',
852   - 0x406: 'FORMULA : Cell Formula',
853   - 0x41E: 'FORMAT : Number Format',
854   - 0x800: 'HLINKTOOLTIP : Hyperlink Tooltip',
855   - 0x801: 'WEBPUB : Web Publish Item',
856   - 0x802: 'QSISXTAG : PivotTable and Query Table Extensions',
857   - 0x803: 'DBQUERYEXT : Database Query Extensions',
858   - 0x804: 'EXTSTRING : FRT String',
859   - 0x805: 'TXTQUERY : Text Query Information',
860   - 0x806: 'QSIR : Query Table Formatting',
861   - 0x807: 'QSIF : Query Table Field Formatting',
862   - 0x809: 'BOF : Beginning of File',
863   - 0x80A: 'OLEDBCONN : OLE Database Connection',
864   - 0x80B: 'WOPT : Web Options',
865   - 0x80C: 'SXVIEWEX : Pivot Table OLAP Extensions',
866   - 0x80D: 'SXTH : PivotTable OLAP Hierarchy',
867   - 0x80E: 'SXPIEX : OLAP Page Item Extensions',
868   - 0x80F: 'SXVDTEX : View Dimension OLAP Extensions',
869   - 0x810: 'SXVIEWEX9 : Pivot Table Extensions',
870   - 0x812: 'CONTINUEFRT : Continued FRT',
871   - 0x813: 'REALTIMEDATA : Real-Time Data (RTD)',
872   - 0x862: 'SHEETEXT : Extra Sheet Info',
873   - 0x863: 'BOOKEXT : Extra Book Info',
874   - 0x864: 'SXADDL : Pivot Table Additional Info',
875   - 0x865: 'CRASHRECERR : Crash Recovery Error',
876   - 0x866: 'HFPicture : Header / Footer Picture',
877   - 0x867: 'FEATHEADR : Shared Feature Header',
878   - 0x868: 'FEAT : Shared Feature Record',
879   - 0x86A: 'DATALABEXT : Chart Data Label Extension',
880   - 0x86B: 'DATALABEXTCONTENTS : Chart Data Label Extension Contents',
881   - 0x86C: 'CELLWATCH : Cell Watch',
882   - 0x86d: 'FEATINFO : Shared Feature Info Record',
883   - 0x871: 'FEATHEADR11 : Shared Feature Header 11',
884   - 0x872: 'FEAT11 : Shared Feature 11 Record',
885   - 0x873: 'FEATINFO11 : Shared Feature Info 11 Record',
886   - 0x874: 'DROPDOWNOBJIDS : Drop Down Object',
887   - 0x875: 'CONTINUEFRT11 : Continue FRT 11',
888   - 0x876: 'DCONN : Data Connection',
889   - 0x877: 'LIST12 : Extra Table Data Introduced in Excel 2007',
890   - 0x878: 'FEAT12 : Shared Feature 12 Record',
891   - 0x879: 'CONDFMT12 : Conditional Formatting Range Information 12',
892   - 0x87A: 'CF12 : Conditional Formatting Condition 12',
893   - 0x87B: 'CFEX : Conditional Formatting Extension',
894   - 0x87C: 'XFCRC : XF Extensions Checksum',
895   - 0x87D: 'XFEXT : XF Extension',
896   - 0x87E: 'EZFILTER12 : AutoFilter Data Introduced in Excel 2007',
897   - 0x87F: 'CONTINUEFRT12 : Continue FRT 12',
898   - 0x881: 'SXADDL12 : Additional Workbook Connections Information',
899   - 0x884: 'MDTINFO : Information about a Metadata Type',
900   - 0x885: 'MDXSTR : MDX Metadata String',
901   - 0x886: 'MDXTUPLE : Tuple MDX Metadata',
902   - 0x887: 'MDXSET : Set MDX Metadata',
903   - 0x888: 'MDXPROP : Member Property MDX Metadata',
904   - 0x889: 'MDXKPI : Key Performance Indicator MDX Metadata',
905   - 0x88A: 'MDTB : Block of Metadata Records',
906   - 0x88B: 'PLV : Page Layout View Settings in Excel 2007',
907   - 0x88C: 'COMPAT12 : Compatibility Checker 12',
908   - 0x88D: 'DXF : Differential XF',
909   - 0x88E: 'TABLESTYLES : Table Styles',
910   - 0x88F: 'TABLESTYLE : Table Style',
911   - 0x890: 'TABLESTYLEELEMENT : Table Style Element',
912   - 0x892: 'STYLEEXT : Named Cell Style Extension',
913   - 0x893: 'NAMEPUBLISH : Publish To Excel Server Data for Name',
914   - 0x894: 'NAMECMT : Name Comment',
915   - 0x895: 'SORTDATA12 : Sort Data 12',
916   - 0x896: 'THEME : Theme',
917   - 0x897: 'GUIDTYPELIB : VB Project Typelib GUID',
918   - 0x898: 'FNGRP12 : Function Group',
919   - 0x899: 'NAMEFNGRP12 : Extra Function Group',
920   - 0x89A: 'MTRSETTINGS : Multi-Threaded Calculation Settings',
921   - 0x89B: 'COMPRESSPICTURES : Automatic Picture Compression Mode',
922   - 0x89C: 'HEADERFOOTER : Header Footer',
923   - 0x8A3: 'FORCEFULLCALCULATION : Force Full Calculation Settings',
924   - 0x8c1: 'LISTOBJ : List Object',
925   - 0x8c2: 'LISTFIELD : List Field',
926   - 0x8c3: 'LISTDV : List Data Validation',
927   - 0x8c4: 'LISTCONDFMT : List Conditional Formatting',
928   - 0x8c5: 'LISTCF : List Cell Formatting',
929   - 0x8c6: 'FMQRY : Filemaker queries',
930   - 0x8c7: 'FMSQRY : File maker queries',
931   - 0x8c8: 'PLV : Page Layout View in Mac Excel 11',
932   - 0x8c9: 'LNEXT : Extension information for borders in Mac Office 11',
933   - 0x8ca: 'MKREXT : Extension information for markers in Mac Office 11'
934   - }
935   -
936 1015 if self.streamname in [['Workbook'], ['Book']]:
937 1016 self.ran = True
938 1017 # use a bytearray to have Python 2+3 compatibility with the same code (no need for ord())
... ... @@ -988,7 +1067,7 @@ class cBIFF(object): # cPluginParent):
988 1067 line += ' - build-in-name %d %s' % (code, dBuildInNames.get(code, '?'))
989 1068 else:
990 1069 pass
991   - line += ' - %s' % (data[14:14+data[3]])
  1070 + line += ' - %s' % bytes2str(data[14:14+data[3]])
992 1071 # print(line)
993 1072  
994 1073 # BOUNDSHEET record
... ... @@ -1002,7 +1081,7 @@ class cBIFF(object): # cPluginParent):
1002 1081  
1003 1082 # STRING record
1004 1083 if opcode == 0x207 and len(data) >= 4:
1005   - values = Strings(data[3:]).values()
  1084 + values = list(Strings(data[3:]).values())
1006 1085 strings = ''
1007 1086 if values[0] != []:
1008 1087 strings += ' '.join(values[0])
... ...