Peter M. Groen / oletools

Commit 8159c1b951891bada19f45dd3bf74f7251d0f442

Authored by decalage2
1 parent 40694d71

plugin_biff: almost fixed #428

Inline Side-by-side
Showing 1 changed file with 434 additions and 355 deletions
oletools/thirdparty/oledump/plugin_biff.py
  View file @8159c1b
@@ -32,85 +32,50 @@ import struct @@ -32,85 +32,50 @@ import struct
32 import re 32 import re
33 import optparse 33 import optparse
34 import binascii 34 import binascii
  35 +import sys
35 36
  37 +# from olevba:
36 38
37 -# CIC: Call If Callable  
38 -def CIC(expression):  
39 - if callable(expression):  
40 - return expression()  
41 - else:  
42 - return expression  
43 - 39 +if sys.version_info[0] <= 2:
  40 + # Python 2.x
  41 + PYTHON2 = True
  42 +else:
  43 + # Python 3.x+
  44 + PYTHON2 = False
44 45
45 -# IFF: IF Function  
46 -def IFF(expression, valueTrue, valueFalse):  
47 - if expression:  
48 - return CIC(valueTrue) 46 +def unicode2str(unicode_string):
  47 + """
  48 + convert a unicode string to a native str:
  49 + - on Python 3, it returns the same string
  50 + - on Python 2, the string is encoded with UTF-8 to a bytes str
  51 + :param unicode_string: unicode string to be converted
  52 + :return: the string converted to str
  53 + :rtype: str
  54 + """
  55 + if PYTHON2:
  56 + return unicode_string.encode('utf8', errors='replace')
49 else: 57 else:
50 - return CIC(valueFalse)  
51 -  
52 -  
53 -def CombineHexASCII(hexDump, asciiDump, length):  
54 - if hexDump == '':  
55 - return ''  
56 - return hexDump + ' ' + (' ' * (3 * (length - len(asciiDump)))) + asciiDump  
57 -  
58 -def HexASCII(data, length=16):  
59 - result = []  
60 - if len(data) > 0:  
61 - hexDump = ''  
62 - asciiDump = ''  
63 - for i, b in enumerate(data):  
64 - if i % length == 0:  
65 - if hexDump != '':  
66 - result.append(CombineHexASCII(hexDump, asciiDump, length))  
67 - hexDump = '%08X:' % i  
68 - asciiDump = ''  
69 - hexDump += ' %02X' % ord(b)  
70 - asciiDump += IFF(ord(b) >= 32, b, '.')  
71 - result.append(CombineHexASCII(hexDump, asciiDump, length))  
72 - return result 58 + return unicode_string
73 59
74 -def StringsASCII(data):  
75 - return re.findall('[^\x00-\x08\x0A-\x1F\x7F-\xFF]{4,}', data)  
76 -  
77 -def StringsUNICODE(data):  
78 - return [foundunicodestring.replace('\x00', '') for foundunicodestring, dummy in re.findall('(([^\x00-\x08\x0A-\x1F\x7F-\xFF]\x00){4,})', data)]  
79 60
80 -def Strings(data, encodings='sL'):  
81 - dStrings = {}  
82 - for encoding in encodings:  
83 - if encoding == 's':  
84 - dStrings[encoding] = StringsASCII(data)  
85 - elif encoding == 'L':  
86 - dStrings[encoding] = StringsUNICODE(data)  
87 - return dStrings  
88 -  
89 -def ContainsWord(word, expression):  
90 - return struct.pack('<H', word) in expression  
91 -  
92 -#https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/6e5eed10-5b77-43d6-8dd0-37345f8654ad  
93 -def ParseLoc(expression):  
94 - formatcodes = 'HH'  
95 - formatsize = struct.calcsize(formatcodes)  
96 - row, column = struct.unpack(formatcodes, expression[0:formatsize])  
97 - rowRelative = column & 0x8000  
98 - colRelative = column & 0x4000  
99 - column = column & 0x3FFF  
100 - if rowRelative:  
101 - rowindicator = '~' 61 +def bytes2str(bytes_string, encoding='utf8'):
  62 + """
  63 + convert a bytes string to a native str:
  64 + - on Python 2, it returns the same string (bytes=str)
  65 + - on Python 3, the string is decoded using the provided encoding
  66 + (UTF-8 by default) to a unicode str
  67 + :param bytes_string: bytes string to be converted
  68 + :param encoding: codec to be used for decoding
  69 + :return: the string converted to str
  70 + :rtype: str
  71 + """
  72 + if PYTHON2:
  73 + return bytes_string
102 else: 74 else:
103 - rowindicator = ''  
104 - row += 1  
105 - if colRelative:  
106 - colindicator = '~'  
107 - else:  
108 - colindicator = ''  
109 - column += 1  
110 - return 'R%s%dC%s%d' % (rowindicator, row, colindicator, column) 75 + return bytes_string.decode(encoding, errors='replace')
111 76
112 -def ParseExpression(expression):  
113 - dTokens = { 77 +
  78 +dTokens = {
114 0x01: 'ptgExp', 79 0x01: 'ptgExp',
115 0x02: 'ptgTbl', 80 0x02: 'ptgTbl',
116 0x03: 'ptgAdd', 81 0x03: 'ptgAdd',
@@ -209,7 +174,7 @@ def ParseExpression(expression): @@ -209,7 +174,7 @@ def ParseExpression(expression):
209 } 174 }
210 175
211 #https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b 176 #https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b
212 - dFunctions = { 177 +dFunctions = {
213 0x0000: 'COUNT', 178 0x0000: 'COUNT',
214 0x0001: 'IF', 179 0x0001: 'IF',
215 0x0002: 'ISNA', 180 0x0002: 'ISNA',
@@ -585,62 +550,436 @@ def ParseExpression(expression): @@ -585,62 +550,436 @@ def ParseExpression(expression):
585 0x017B: 'RTD', 550 0x017B: 'RTD',
586 551
587 0x8076: 'ALERT', 552 0x8076: 'ALERT',
588 - } 553 +}
  554 +
  555 +dOpcodes = {
  556 + 0x06: 'FORMULA : Cell Formula',
  557 + 0x0A: 'EOF : End of File',
  558 + 0x0C: 'CALCCOUNT : Iteration Count',
  559 + 0x0D: 'CALCMODE : Calculation Mode',
  560 + 0x0E: 'PRECISION : Precision',
  561 + 0x0F: 'REFMODE : Reference Mode',
  562 + 0x10: 'DELTA : Iteration Increment',
  563 + 0x11: 'ITERATION : Iteration Mode',
  564 + 0x12: 'PROTECT : Protection Flag',
  565 + 0x13: 'PASSWORD : Protection Password',
  566 + 0x14: 'HEADER : Print Header on Each Page',
  567 + 0x15: 'FOOTER : Print Footer on Each Page',
  568 + 0x16: 'EXTERNCOUNT : Number of External References',
  569 + 0x17: 'EXTERNSHEET : External Reference',
  570 + 0x18: 'LABEL : Cell Value, String Constant',
  571 + 0x19: 'WINDOWPROTECT : Windows Are Protected',
  572 + 0x1A: 'VERTICALPAGEBREAKS : Explicit Column Page Breaks',
  573 + 0x1B: 'HORIZONTALPAGEBREAKS : Explicit Row Page Breaks',
  574 + 0x1C: 'NOTE : Comment Associated with a Cell',
  575 + 0x1D: 'SELECTION : Current Selection',
  576 + 0x22: '1904 : 1904 Date System',
  577 + 0x26: 'LEFTMARGIN : Left Margin Measurement',
  578 + 0x27: 'RIGHTMARGIN : Right Margin Measurement',
  579 + 0x28: 'TOPMARGIN : Top Margin Measurement',
  580 + 0x29: 'BOTTOMMARGIN : Bottom Margin Measurement',
  581 + 0x2A: 'PRINTHEADERS : Print Row/Column Labels',
  582 + 0x2B: 'PRINTGRIDLINES : Print Gridlines Flag',
  583 + 0x2F: 'FILEPASS : File Is Password-Protected',
  584 + 0x3C: 'CONTINUE : Continues Long Records',
  585 + 0x3D: 'WINDOW1 : Window Information',
  586 + 0x40: 'BACKUP : Save Backup Version of the File',
  587 + 0x41: 'PANE : Number of Panes and Their Position',
  588 + 0x42: 'CODENAME : VBE Object Name',
  589 + 0x42: 'CODEPAGE : Default Code Page',
  590 + 0x4D: 'PLS : Environment-Specific Print Record',
  591 + 0x50: 'DCON : Data Consolidation Information',
  592 + 0x51: 'DCONREF : Data Consolidation References',
  593 + 0x52: 'DCONNAME : Data Consolidation Named References',
  594 + 0x55: 'DEFCOLWIDTH : Default Width for Columns',
  595 + 0x59: 'XCT : CRN Record Count',
  596 + 0x5A: 'CRN : Nonresident Operands',
  597 + 0x5B: 'FILESHARING : File-Sharing Information',
  598 + 0x5C: 'WRITEACCESS : Write Access User Name',
  599 + 0x5D: 'OBJ : Describes a Graphic Object',
  600 + 0x5E: 'UNCALCED : Recalculation Status',
  601 + 0x5F: 'SAVERECALC : Recalculate Before Save',
  602 + 0x60: 'TEMPLATE : Workbook Is a Template',
  603 + 0x63: 'OBJPROTECT : Objects Are Protected',
  604 + 0x7D: 'COLINFO : Column Formatting Information',
  605 + 0x7E: 'RK : Cell Value, RK Number',
  606 + 0x7F: 'IMDATA : Image Data',
  607 + 0x80: 'GUTS : Size of Row and Column Gutters',
  608 + 0x81: 'WSBOOL : Additional Workspace Information',
  609 + 0x82: 'GRIDSET : State Change of Gridlines Option',
  610 + 0x83: 'HCENTER : Center Between Horizontal Margins',
  611 + 0x84: 'VCENTER : Center Between Vertical Margins',
  612 + 0x85: 'BOUNDSHEET : Sheet Information',
  613 + 0x86: 'WRITEPROT : Workbook Is Write-Protected',
  614 + 0x87: 'ADDIN : Workbook Is an Add-in Macro',
  615 + 0x88: 'EDG : Edition Globals',
  616 + 0x89: 'PUB : Publisher',
  617 + 0x8C: 'COUNTRY : Default Country and WIN.INI Country',
  618 + 0x8D: 'HIDEOBJ : Object Display Options',
  619 + 0x90: 'SORT : Sorting Options',
  620 + 0x91: 'SUB : Subscriber',
  621 + 0x92: 'PALETTE : Color Palette Definition',
  622 + 0x94: 'LHRECORD : .WK? File Conversion Information',
  623 + 0x95: 'LHNGRAPH : Named Graph Information',
  624 + 0x96: 'SOUND : Sound Note',
  625 + 0x98: 'LPR : Sheet Was Printed Using LINE.PRINT(',
  626 + 0x99: 'STANDARDWIDTH : Standard Column Width',
  627 + 0x9A: 'FNGROUPNAME : Function Group Name',
  628 + 0x9B: 'FILTERMODE : Sheet Contains Filtered List',
  629 + 0x9C: 'FNGROUPCOUNT : Built-in Function Group Count',
  630 + 0x9D: 'AUTOFILTERINFO : Drop-Down Arrow Count',
  631 + 0x9E: 'AUTOFILTER : AutoFilter Data',
  632 + 0xA0: 'SCL : Window Zoom Magnification',
  633 + 0xA1: 'SETUP : Page Setup',
  634 + 0xA9: 'COORDLIST : Polygon Object Vertex Coordinates',
  635 + 0xAB: 'GCW : Global Column-Width Flags',
  636 + 0xAE: 'SCENMAN : Scenario Output Data',
  637 + 0xAF: 'SCENARIO : Scenario Data',
  638 + 0xB0: 'SXVIEW : View Definition',
  639 + 0xB1: 'SXVD : View Fields',
  640 + 0xB2: 'SXVI : View Item',
  641 + 0xB4: 'SXIVD : Row/Column Field IDs',
  642 + 0xB5: 'SXLI : Line Item Array',
  643 + 0xB6: 'SXPI : Page Item',
  644 + 0xB8: 'DOCROUTE : Routing Slip Information',
  645 + 0xB9: 'RECIPNAME : Recipient Name',
  646 + 0xBC: 'SHRFMLA : Shared Formula',
  647 + 0xBD: 'MULRK : Multiple RK Cells',
  648 + 0xBE: 'MULBLANK : Multiple Blank Cells',
  649 + 0xC1: 'MMS : ADDMENU / DELMENU Record Group Count',
  650 + 0xC2: 'ADDMENU : Menu Addition',
  651 + 0xC3: 'DELMENU : Menu Deletion',
  652 + 0xC5: 'SXDI : Data Item',
  653 + 0xC6: 'SXDB : PivotTable Cache Data',
  654 + 0xCD: 'SXSTRING : String',
  655 + 0xD0: 'SXTBL : Multiple Consolidation Source Info',
  656 + 0xD1: 'SXTBRGIITM : Page Item Name Count',
  657 + 0xD2: 'SXTBPG : Page Item Indexes',
  658 + 0xD3: 'OBPROJ : Visual Basic Project',
  659 + 0xD5: 'SXIDSTM : Stream ID',
  660 + 0xD6: 'RSTRING : Cell with Character Formatting',
  661 + 0xD7: 'DBCELL : Stream Offsets',
  662 + 0xDA: 'BOOKBOOL : Workbook Option Flag',
  663 + 0xDC: 'PARAMQRY : Query Parameters',
  664 + 0xDC: 'SXEXT : External Source Information',
  665 + 0xDD: 'SCENPROTECT : Scenario Protection',
  666 + 0xDE: 'OLESIZE : Size of OLE Object',
  667 + 0xDF: 'UDDESC : Description String for Chart Autoformat',
  668 + 0xE0: 'XF : Extended Format',
  669 + 0xE1: 'INTERFACEHDR : Beginning of User Interface Records',
  670 + 0xE2: 'INTERFACEEND : End of User Interface Records',
  671 + 0xE3: 'SXVS : View Source',
  672 + 0xE5: 'MERGECELLS : Merged Cells',
  673 + 0xEA: 'TABIDCONF : Sheet Tab ID of Conflict History',
  674 + 0xEB: 'MSODRAWINGGROUP : Microsoft Office Drawing Group',
  675 + 0xEC: 'MSODRAWING : Microsoft Office Drawing',
  676 + 0xED: 'MSODRAWINGSELECTION : Microsoft Office Drawing Selection',
  677 + 0xF0: 'SXRULE : PivotTable Rule Data',
  678 + 0xF1: 'SXEX : PivotTable View Extended Information',
  679 + 0xF2: 'SXFILT : PivotTable Rule Filter',
  680 + 0xF4: 'SXDXF : Pivot Table Formatting',
  681 + 0xF5: 'SXITM : Pivot Table Item Indexes',
  682 + 0xF6: 'SXNAME : PivotTable Name',
  683 + 0xF7: 'SXSELECT : PivotTable Selection Information',
  684 + 0xF8: 'SXPAIR : PivotTable Name Pair',
  685 + 0xF9: 'SXFMLA : Pivot Table Parsed Expression',
  686 + 0xFB: 'SXFORMAT : PivotTable Format Record',
  687 + 0xFC: 'SST : Shared String Table',
  688 + 0xFD: 'LABELSST : Cell Value, String Constant/ SST',
  689 + 0xFF: 'EXTSST : Extended Shared String Table',
  690 + 0x100: 'SXVDEX : Extended PivotTable View Fields',
  691 + 0x103: 'SXFORMULA : PivotTable Formula Record',
  692 + 0x122: 'SXDBEX : PivotTable Cache Data',
  693 + 0x13D: 'TABID : Sheet Tab Index Array',
  694 + 0x160: 'USESELFS : Natural Language Formulas Flag',
  695 + 0x161: 'DSF : Double Stream File',
  696 + 0x162: 'XL5MODIFY : Flag for DSF',
  697 + 0x1A5: 'FILESHARING2 : File-Sharing Information for Shared Lists',
  698 + 0x1A9: 'USERBVIEW : Workbook Custom View Settings',
  699 + 0x1AA: 'USERSVIEWBEGIN : Custom View Settings',
  700 + 0x1AB: 'USERSVIEWEND : End of Custom View Records',
  701 + 0x1AD: 'QSI : External Data Range',
  702 + 0x1AE: 'SUPBOOK : Supporting Workbook',
  703 + 0x1AF: 'PROT4REV : Shared Workbook Protection Flag',
  704 + 0x1B0: 'CONDFMT : Conditional Formatting Range Information',
  705 + 0x1B1: 'CF : Conditional Formatting Conditions',
  706 + 0x1B2: 'DVAL : Data Validation Information',
  707 + 0x1B5: 'DCONBIN : Data Consolidation Information',
  708 + 0x1B6: 'TXO : Text Object',
  709 + 0x1B7: 'REFRESHALL : Refresh Flag',
  710 + 0x1B8: 'HLINK : Hyperlink',
  711 + 0x1BB: 'SXFDBTYPE : SQL Datatype Identifier',
  712 + 0x1BC: 'PROT4REVPASS : Shared Workbook Protection Password',
  713 + 0x1BE: 'DV : Data Validation Criteria',
  714 + 0x1C0: 'EXCEL9FILE : Excel 9 File',
  715 + 0x1C1: 'RECALCID : Recalc Information',
  716 + 0x200: 'DIMENSIONS : Cell Table Size',
  717 + 0x201: 'BLANK : Cell Value, Blank Cell',
  718 + 0x203: 'NUMBER : Cell Value, Floating-Point Number',
  719 + 0x204: 'LABEL : Cell Value, String Constant',
  720 + 0x205: 'BOOLERR : Cell Value, Boolean or Error',
  721 + 0x207: 'STRING : String Value of a Formula',
  722 + 0x208: 'ROW : Describes a Row',
  723 + 0x20B: 'INDEX : Index Record',
  724 + 0x218: 'NAME : Defined Name',
  725 + 0x221: 'ARRAY : Array-Entered Formula',
  726 + 0x223: 'EXTERNNAME : Externally Referenced Name',
  727 + 0x225: 'DEFAULTROWHEIGHT : Default Row Height',
  728 + 0x231: 'FONT : Font Description',
  729 + 0x236: 'TABLE : Data Table',
  730 + 0x23E: 'WINDOW2 : Sheet Window Information',
  731 + 0x293: 'STYLE : Style Information',
  732 + 0x406: 'FORMULA : Cell Formula',
  733 + 0x41E: 'FORMAT : Number Format',
  734 + 0x800: 'HLINKTOOLTIP : Hyperlink Tooltip',
  735 + 0x801: 'WEBPUB : Web Publish Item',
  736 + 0x802: 'QSISXTAG : PivotTable and Query Table Extensions',
  737 + 0x803: 'DBQUERYEXT : Database Query Extensions',
  738 + 0x804: 'EXTSTRING : FRT String',
  739 + 0x805: 'TXTQUERY : Text Query Information',
  740 + 0x806: 'QSIR : Query Table Formatting',
  741 + 0x807: 'QSIF : Query Table Field Formatting',
  742 + 0x809: 'BOF : Beginning of File',
  743 + 0x80A: 'OLEDBCONN : OLE Database Connection',
  744 + 0x80B: 'WOPT : Web Options',
  745 + 0x80C: 'SXVIEWEX : Pivot Table OLAP Extensions',
  746 + 0x80D: 'SXTH : PivotTable OLAP Hierarchy',
  747 + 0x80E: 'SXPIEX : OLAP Page Item Extensions',
  748 + 0x80F: 'SXVDTEX : View Dimension OLAP Extensions',
  749 + 0x810: 'SXVIEWEX9 : Pivot Table Extensions',
  750 + 0x812: 'CONTINUEFRT : Continued FRT',
  751 + 0x813: 'REALTIMEDATA : Real-Time Data (RTD)',
  752 + 0x862: 'SHEETEXT : Extra Sheet Info',
  753 + 0x863: 'BOOKEXT : Extra Book Info',
  754 + 0x864: 'SXADDL : Pivot Table Additional Info',
  755 + 0x865: 'CRASHRECERR : Crash Recovery Error',
  756 + 0x866: 'HFPicture : Header / Footer Picture',
  757 + 0x867: 'FEATHEADR : Shared Feature Header',
  758 + 0x868: 'FEAT : Shared Feature Record',
  759 + 0x86A: 'DATALABEXT : Chart Data Label Extension',
  760 + 0x86B: 'DATALABEXTCONTENTS : Chart Data Label Extension Contents',
  761 + 0x86C: 'CELLWATCH : Cell Watch',
  762 + 0x86d: 'FEATINFO : Shared Feature Info Record',
  763 + 0x871: 'FEATHEADR11 : Shared Feature Header 11',
  764 + 0x872: 'FEAT11 : Shared Feature 11 Record',
  765 + 0x873: 'FEATINFO11 : Shared Feature Info 11 Record',
  766 + 0x874: 'DROPDOWNOBJIDS : Drop Down Object',
  767 + 0x875: 'CONTINUEFRT11 : Continue FRT 11',
  768 + 0x876: 'DCONN : Data Connection',
  769 + 0x877: 'LIST12 : Extra Table Data Introduced in Excel 2007',
  770 + 0x878: 'FEAT12 : Shared Feature 12 Record',
  771 + 0x879: 'CONDFMT12 : Conditional Formatting Range Information 12',
  772 + 0x87A: 'CF12 : Conditional Formatting Condition 12',
  773 + 0x87B: 'CFEX : Conditional Formatting Extension',
  774 + 0x87C: 'XFCRC : XF Extensions Checksum',
  775 + 0x87D: 'XFEXT : XF Extension',
  776 + 0x87E: 'EZFILTER12 : AutoFilter Data Introduced in Excel 2007',
  777 + 0x87F: 'CONTINUEFRT12 : Continue FRT 12',
  778 + 0x881: 'SXADDL12 : Additional Workbook Connections Information',
  779 + 0x884: 'MDTINFO : Information about a Metadata Type',
  780 + 0x885: 'MDXSTR : MDX Metadata String',
  781 + 0x886: 'MDXTUPLE : Tuple MDX Metadata',
  782 + 0x887: 'MDXSET : Set MDX Metadata',
  783 + 0x888: 'MDXPROP : Member Property MDX Metadata',
  784 + 0x889: 'MDXKPI : Key Performance Indicator MDX Metadata',
  785 + 0x88A: 'MDTB : Block of Metadata Records',
  786 + 0x88B: 'PLV : Page Layout View Settings in Excel 2007',
  787 + 0x88C: 'COMPAT12 : Compatibility Checker 12',
  788 + 0x88D: 'DXF : Differential XF',
  789 + 0x88E: 'TABLESTYLES : Table Styles',
  790 + 0x88F: 'TABLESTYLE : Table Style',
  791 + 0x890: 'TABLESTYLEELEMENT : Table Style Element',
  792 + 0x892: 'STYLEEXT : Named Cell Style Extension',
  793 + 0x893: 'NAMEPUBLISH : Publish To Excel Server Data for Name',
  794 + 0x894: 'NAMECMT : Name Comment',
  795 + 0x895: 'SORTDATA12 : Sort Data 12',
  796 + 0x896: 'THEME : Theme',
  797 + 0x897: 'GUIDTYPELIB : VB Project Typelib GUID',
  798 + 0x898: 'FNGRP12 : Function Group',
  799 + 0x899: 'NAMEFNGRP12 : Extra Function Group',
  800 + 0x89A: 'MTRSETTINGS : Multi-Threaded Calculation Settings',
  801 + 0x89B: 'COMPRESSPICTURES : Automatic Picture Compression Mode',
  802 + 0x89C: 'HEADERFOOTER : Header Footer',
  803 + 0x8A3: 'FORCEFULLCALCULATION : Force Full Calculation Settings',
  804 + 0x8c1: 'LISTOBJ : List Object',
  805 + 0x8c2: 'LISTFIELD : List Field',
  806 + 0x8c3: 'LISTDV : List Data Validation',
  807 + 0x8c4: 'LISTCONDFMT : List Conditional Formatting',
  808 + 0x8c5: 'LISTCF : List Cell Formatting',
  809 + 0x8c6: 'FMQRY : Filemaker queries',
  810 + 0x8c7: 'FMSQRY : File maker queries',
  811 + 0x8c8: 'PLV : Page Layout View in Mac Excel 11',
  812 + 0x8c9: 'LNEXT : Extension information for borders in Mac Office 11',
  813 + 0x8ca: 'MKREXT : Extension information for markers in Mac Office 11'
  814 +}
  815 +
  816 +
  817 +# CIC: Call If Callable
  818 +def CIC(expression):
  819 + if callable(expression):
  820 + return expression()
  821 + else:
  822 + return expression
  823 +
  824 +
  825 +# IFF: IF Function
  826 +def IFF(expression, valueTrue, valueFalse):
  827 + if expression:
  828 + return CIC(valueTrue)
  829 + else:
  830 + return CIC(valueFalse)
  831 +
  832 +
  833 +def CombineHexASCII(hexDump, asciiDump, length):
  834 + if hexDump == '':
  835 + return ''
  836 + return hexDump + ' ' + (' ' * (3 * (length - len(asciiDump)))) + asciiDump
  837 +
  838 +def HexASCII(data, length=16):
  839 + result = []
  840 + if len(data) > 0:
  841 + hexDump = ''
  842 + asciiDump = ''
  843 + for i, b in enumerate(data):
  844 + if i % length == 0:
  845 + if hexDump != '':
  846 + result.append(CombineHexASCII(hexDump, asciiDump, length))
  847 + hexDump = '%08X:' % i
  848 + asciiDump = ''
  849 + hexDump += ' %02X' % ord(b)
  850 + asciiDump += IFF(ord(b) >= 32, b, '.')
  851 + result.append(CombineHexASCII(hexDump, asciiDump, length))
  852 + return result
  853 +
  854 +def StringsASCII(data):
  855 + """
  856 + Extract a list of plain ASCII strings of 4+ chars found in data.
  857 + :param data: bytearray or bytes
  858 + :return: list of str (converted to unicode on Python 3)
  859 + """
  860 + # list of bytes strings:
  861 + bytes_strings = re.findall(b'[^\x00-\x08\x0A-\x1F\x7F-\xFF]{4,}', bytes(data))
  862 + return [bytes2str(bs) for bs in bytes_strings]
  863 +
  864 +def StringsUNICODE(data):
  865 + """
  866 + Extract a list of Unicode strings (made of 4+ plain ASCII characters only) found in data.
  867 + :param data: bytearray or bytes
  868 + :return: list of str (converted to unicode on Python 3)
  869 + """
  870 + # list of bytes strings:
  871 + # TODO: check if the null byte should be before or after the ascii byte
  872 + bytes_strings = [foundunicodestring.replace(b'\x00', b'') for foundunicodestring, dummy in re.findall(b'(([^\x00-\x08\x0A-\x1F\x7F-\xFF]\x00){4,})', bytes(data))]
  873 + return [bytes2str(bs) for bs in bytes_strings]
589 874
  875 +def Strings(data, encodings='sL'):
  876 + """
  877 +
  878 + :param data bytearray: bytearray, data to be scanned for strings
  879 + :param encodings:
  880 + :return: dict with key = 's' or 'L', values = list of str
  881 + """
  882 + dStrings = {}
  883 + for encoding in encodings:
  884 + if encoding == 's':
  885 + dStrings[encoding] = StringsASCII(data)
  886 + elif encoding == 'L':
  887 + dStrings[encoding] = StringsUNICODE(data)
  888 + return dStrings
  889 +
  890 +def ContainsWord(word, expression):
  891 + return struct.pack('<H', word) in expression
  892 +
  893 +# https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/6e5eed10-5b77-43d6-8dd0-37345f8654ad
  894 +def ParseLoc(expression):
  895 + """
  896 +
  897 + :param expression bytearray: bytearray, data to be parsed
  898 + :return:
  899 + :rtype: str
  900 + """
  901 + formatcodes = 'HH'
  902 + formatsize = struct.calcsize(formatcodes)
  903 + row, column = struct.unpack(formatcodes, expression[0:formatsize])
  904 + rowRelative = column & 0x8000
  905 + colRelative = column & 0x4000
  906 + column = column & 0x3FFF
  907 + if rowRelative:
  908 + rowindicator = '~'
  909 + else:
  910 + rowindicator = ''
  911 + row += 1
  912 + if colRelative:
  913 + colindicator = '~'
  914 + else:
  915 + colindicator = ''
  916 + column += 1
  917 + return 'R%s%dC%s%d' % (rowindicator, row, colindicator, column)
  918 +
  919 +def ParseExpression(expression):
  920 + '''
  921 + Parse an expression into a human readable string.
  922 +
  923 + :param expression bytearray: bytearray, expression data to be parsed
  924 + :return: str, parsed expression as a string (bytes on Python 2, unicode on python 3)
  925 + :rtype: str
  926 + '''
590 result = '' 927 result = ''
591 while len(expression) > 0: 928 while len(expression) > 0:
592 - ptgid = expression[0]  
593 - expression = expression[1:] 929 + ptgid = expression[0] # int
  930 + expression = expression[1:] # bytearray
594 if ptgid in dTokens: 931 if ptgid in dTokens:
595 result += dTokens[ptgid] + ' ' 932 result += dTokens[ptgid] + ' '
596 - if ptgid == 0x17:  
597 - length = expression[0] 933 + if ptgid == 0x17: # ptgStr
  934 + length = expression[0] # int
598 expression = expression[1:] 935 expression = expression[1:]
599 - if expression[0] == '\x00': # probably BIFF8 -> UNICODE (compressed) 936 + if expression[0] == 0: # probably BIFF8 -> UNICODE (compressed)
600 expression = expression[1:] 937 expression = expression[1:]
601 - result += '"%s" ' % expression[:length] 938 + result += '"%s" ' % bytes2str(expression[:length])
602 expression = expression[length:] 939 expression = expression[length:]
603 - elif ptgid == 0x19:  
604 - grbit = expression[0] 940 + elif ptgid == 0x19: # ptgAttr
  941 + grbit = expression[0] # int
605 expression = expression[1:] 942 expression = expression[1:]
606 if grbit & 0x04: 943 if grbit & 0x04:
607 result += 'CHOOSE ' 944 result += 'CHOOSE '
608 break 945 break
609 else: 946 else:
610 expression = expression[2:] 947 expression = expression[2:]
611 - elif ptgid == 0x16 or ptgid == 0x0e: 948 + elif ptgid == 0x16 or ptgid == 0x0e: # 0x0E: 'ptgNE', 0x16: 'ptgMissArg'
612 pass 949 pass
613 - elif ptgid == 0x1e: 950 + elif ptgid == 0x1e: # ptgInt
614 result += '%d ' % (expression[0] + expression[1] * 0x100) 951 result += '%d ' % (expression[0] + expression[1] * 0x100)
615 expression = expression[2:] 952 expression = expression[2:]
616 - elif ptgid == 0x41: 953 + elif ptgid == 0x41: # ptgFuncV
617 functionid = expression[0] + expression[1] * 0x100 954 functionid = expression[0] + expression[1] * 0x100
618 result += '%s (0x%04x) ' % (dFunctions.get(functionid, '*UNKNOWN FUNCTION*'), functionid) 955 result += '%s (0x%04x) ' % (dFunctions.get(functionid, '*UNKNOWN FUNCTION*'), functionid)
619 expression = expression[2:] 956 expression = expression[2:]
620 - elif ptgid == 0x22 or ptgid == 0x42: 957 + elif ptgid == 0x22 or ptgid == 0x42: # 0x22: 'ptgFuncVar', 0x42: 'ptgFuncVarV'
621 functionid = expression[1] + expression[2] * 0x100 958 functionid = expression[1] + expression[2] * 0x100
622 result += 'args %d func %s (0x%04x) ' % (expression[0], dFunctions.get(functionid, '*UNKNOWN FUNCTION*'), functionid) 959 result += 'args %d func %s (0x%04x) ' % (expression[0], dFunctions.get(functionid, '*UNKNOWN FUNCTION*'), functionid)
623 expression = expression[3:] 960 expression = expression[3:]
624 - elif ptgid == 0x23: 961 + elif ptgid == 0x23: # ptgName
625 result += '%04x ' % (expression[0] + expression[1] * 0x100) 962 result += '%04x ' % (expression[0] + expression[1] * 0x100)
  963 + # TODO: looks like we're skipping quite a few bytes
626 expression = expression[14:] 964 expression = expression[14:]
627 - elif ptgid == 0x1f: 965 + elif ptgid == 0x1f: # ptgNum
628 result += 'FLOAT ' 966 result += 'FLOAT '
  967 + # TODO: looks like we're skipping quite a few bytes
629 expression = expression[8:] 968 expression = expression[8:]
630 - elif ptgid == 0x26:  
631 - expression = expression[4:] 969 + elif ptgid == 0x26: # ptgMemArea
  970 + expression = expression[4:] # skipping 4 bytes
632 expression = expression[expression[0] + expression[1] * 0x100:] 971 expression = expression[expression[0] + expression[1] * 0x100:]
633 result += 'REFERENCE-EXPRESSION ' 972 result += 'REFERENCE-EXPRESSION '
634 - elif ptgid == 0x01: 973 + elif ptgid == 0x01: # ptgExp
635 formatcodes = 'HH' 974 formatcodes = 'HH'
636 formatsize = struct.calcsize(formatcodes) 975 formatsize = struct.calcsize(formatcodes)
637 row, column = struct.unpack(formatcodes, expression[0:formatsize]) 976 row, column = struct.unpack(formatcodes, expression[0:formatsize])
638 expression = expression[formatsize:] 977 expression = expression[formatsize:]
639 result += 'R%dC%d ' % (row + 1, column + 1) 978 result += 'R%dC%d ' % (row + 1, column + 1)
640 - elif ptgid == 0x24 or ptgid == 0x44: 979 + elif ptgid == 0x24 or ptgid == 0x44: # 0x24: 'ptgRef', 0x44: 'ptgRefV'
641 result += '%s ' % ParseLoc(expression) 980 result += '%s ' % ParseLoc(expression)
642 expression = expression[4:] 981 expression = expression[4:]
643 - elif ptgid == 0x3A or ptgid == 0x5A: 982 + elif ptgid == 0x3A or ptgid == 0x5A: # 0x3A: 'ptgRef3d', 0x5A: 'ptgRef3dV'
644 result += '%s ' % ParseLoc(expression[2:]) 983 result += '%s ' % ParseLoc(expression[2:])
645 expression = expression[6:] 984 expression = expression[6:]
646 else: 985 else:
@@ -651,6 +990,7 @@ def ParseExpression(expression): @@ -651,6 +990,7 @@ def ParseExpression(expression):
651 if expression == '': 990 if expression == '':
652 return result 991 return result
653 else: 992 else:
  993 + # 0x006E: 'EXEC', 0x0095: 'REGISTER'
654 functions = [dFunctions[functionid] for functionid in [0x6E, 0x95] if ContainsWord(functionid, expression)] 994 functions = [dFunctions[functionid] for functionid in [0x6E, 0x95] if ContainsWord(functionid, expression)]
655 if functions != []: 995 if functions != []:
656 message = ' Could contain following functions: ' + ','.join(functions) + ' -' 996 message = ' Could contain following functions: ' + ','.join(functions) + ' -'
@@ -672,267 +1012,6 @@ class cBIFF(object): # cPluginParent): @@ -672,267 +1012,6 @@ class cBIFF(object): # cPluginParent):
672 def Analyze(self): 1012 def Analyze(self):
673 result = [] 1013 result = []
674 macros4Found = False 1014 macros4Found = False
675 - dOpcodes = {  
676 - 0x06: 'FORMULA : Cell Formula',  
677 - 0x0A: 'EOF : End of File',  
678 - 0x0C: 'CALCCOUNT : Iteration Count',  
679 - 0x0D: 'CALCMODE : Calculation Mode',  
680 - 0x0E: 'PRECISION : Precision',  
681 - 0x0F: 'REFMODE : Reference Mode',  
682 - 0x10: 'DELTA : Iteration Increment',  
683 - 0x11: 'ITERATION : Iteration Mode',  
684 - 0x12: 'PROTECT : Protection Flag',  
685 - 0x13: 'PASSWORD : Protection Password',  
686 - 0x14: 'HEADER : Print Header on Each Page',  
687 - 0x15: 'FOOTER : Print Footer on Each Page',  
688 - 0x16: 'EXTERNCOUNT : Number of External References',  
689 - 0x17: 'EXTERNSHEET : External Reference',  
690 - 0x18: 'LABEL : Cell Value, String Constant',  
691 - 0x19: 'WINDOWPROTECT : Windows Are Protected',  
692 - 0x1A: 'VERTICALPAGEBREAKS : Explicit Column Page Breaks',  
693 - 0x1B: 'HORIZONTALPAGEBREAKS : Explicit Row Page Breaks',  
694 - 0x1C: 'NOTE : Comment Associated with a Cell',  
695 - 0x1D: 'SELECTION : Current Selection',  
696 - 0x22: '1904 : 1904 Date System',  
697 - 0x26: 'LEFTMARGIN : Left Margin Measurement',  
698 - 0x27: 'RIGHTMARGIN : Right Margin Measurement',  
699 - 0x28: 'TOPMARGIN : Top Margin Measurement',  
700 - 0x29: 'BOTTOMMARGIN : Bottom Margin Measurement',  
701 - 0x2A: 'PRINTHEADERS : Print Row/Column Labels',  
702 - 0x2B: 'PRINTGRIDLINES : Print Gridlines Flag',  
703 - 0x2F: 'FILEPASS : File Is Password-Protected',  
704 - 0x3C: 'CONTINUE : Continues Long Records',  
705 - 0x3D: 'WINDOW1 : Window Information',  
706 - 0x40: 'BACKUP : Save Backup Version of the File',  
707 - 0x41: 'PANE : Number of Panes and Their Position',  
708 - 0x42: 'CODENAME : VBE Object Name',  
709 - 0x42: 'CODEPAGE : Default Code Page',  
710 - 0x4D: 'PLS : Environment-Specific Print Record',  
711 - 0x50: 'DCON : Data Consolidation Information',  
712 - 0x51: 'DCONREF : Data Consolidation References',  
713 - 0x52: 'DCONNAME : Data Consolidation Named References',  
714 - 0x55: 'DEFCOLWIDTH : Default Width for Columns',  
715 - 0x59: 'XCT : CRN Record Count',  
716 - 0x5A: 'CRN : Nonresident Operands',  
717 - 0x5B: 'FILESHARING : File-Sharing Information',  
718 - 0x5C: 'WRITEACCESS : Write Access User Name',  
719 - 0x5D: 'OBJ : Describes a Graphic Object',  
720 - 0x5E: 'UNCALCED : Recalculation Status',  
721 - 0x5F: 'SAVERECALC : Recalculate Before Save',  
722 - 0x60: 'TEMPLATE : Workbook Is a Template',  
723 - 0x63: 'OBJPROTECT : Objects Are Protected',  
724 - 0x7D: 'COLINFO : Column Formatting Information',  
725 - 0x7E: 'RK : Cell Value, RK Number',  
726 - 0x7F: 'IMDATA : Image Data',  
727 - 0x80: 'GUTS : Size of Row and Column Gutters',  
728 - 0x81: 'WSBOOL : Additional Workspace Information',  
729 - 0x82: 'GRIDSET : State Change of Gridlines Option',  
730 - 0x83: 'HCENTER : Center Between Horizontal Margins',  
731 - 0x84: 'VCENTER : Center Between Vertical Margins',  
732 - 0x85: 'BOUNDSHEET : Sheet Information',  
733 - 0x86: 'WRITEPROT : Workbook Is Write-Protected',  
734 - 0x87: 'ADDIN : Workbook Is an Add-in Macro',  
735 - 0x88: 'EDG : Edition Globals',  
736 - 0x89: 'PUB : Publisher',  
737 - 0x8C: 'COUNTRY : Default Country and WIN.INI Country',  
738 - 0x8D: 'HIDEOBJ : Object Display Options',  
739 - 0x90: 'SORT : Sorting Options',  
740 - 0x91: 'SUB : Subscriber',  
741 - 0x92: 'PALETTE : Color Palette Definition',  
742 - 0x94: 'LHRECORD : .WK? File Conversion Information',  
743 - 0x95: 'LHNGRAPH : Named Graph Information',  
744 - 0x96: 'SOUND : Sound Note',  
745 - 0x98: 'LPR : Sheet Was Printed Using LINE.PRINT(',  
746 - 0x99: 'STANDARDWIDTH : Standard Column Width',  
747 - 0x9A: 'FNGROUPNAME : Function Group Name',  
748 - 0x9B: 'FILTERMODE : Sheet Contains Filtered List',  
749 - 0x9C: 'FNGROUPCOUNT : Built-in Function Group Count',  
750 - 0x9D: 'AUTOFILTERINFO : Drop-Down Arrow Count',  
751 - 0x9E: 'AUTOFILTER : AutoFilter Data',  
752 - 0xA0: 'SCL : Window Zoom Magnification',  
753 - 0xA1: 'SETUP : Page Setup',  
754 - 0xA9: 'COORDLIST : Polygon Object Vertex Coordinates',  
755 - 0xAB: 'GCW : Global Column-Width Flags',  
756 - 0xAE: 'SCENMAN : Scenario Output Data',  
757 - 0xAF: 'SCENARIO : Scenario Data',  
758 - 0xB0: 'SXVIEW : View Definition',  
759 - 0xB1: 'SXVD : View Fields',  
760 - 0xB2: 'SXVI : View Item',  
761 - 0xB4: 'SXIVD : Row/Column Field IDs',  
762 - 0xB5: 'SXLI : Line Item Array',  
763 - 0xB6: 'SXPI : Page Item',  
764 - 0xB8: 'DOCROUTE : Routing Slip Information',  
765 - 0xB9: 'RECIPNAME : Recipient Name',  
766 - 0xBC: 'SHRFMLA : Shared Formula',  
767 - 0xBD: 'MULRK : Multiple RK Cells',  
768 - 0xBE: 'MULBLANK : Multiple Blank Cells',  
769 - 0xC1: 'MMS : ADDMENU / DELMENU Record Group Count',  
770 - 0xC2: 'ADDMENU : Menu Addition',  
771 - 0xC3: 'DELMENU : Menu Deletion',  
772 - 0xC5: 'SXDI : Data Item',  
773 - 0xC6: 'SXDB : PivotTable Cache Data',  
774 - 0xCD: 'SXSTRING : String',  
775 - 0xD0: 'SXTBL : Multiple Consolidation Source Info',  
776 - 0xD1: 'SXTBRGIITM : Page Item Name Count',  
777 - 0xD2: 'SXTBPG : Page Item Indexes',  
778 - 0xD3: 'OBPROJ : Visual Basic Project',  
779 - 0xD5: 'SXIDSTM : Stream ID',  
780 - 0xD6: 'RSTRING : Cell with Character Formatting',  
781 - 0xD7: 'DBCELL : Stream Offsets',  
782 - 0xDA: 'BOOKBOOL : Workbook Option Flag',  
783 - 0xDC: 'PARAMQRY : Query Parameters',  
784 - 0xDC: 'SXEXT : External Source Information',  
785 - 0xDD: 'SCENPROTECT : Scenario Protection',  
786 - 0xDE: 'OLESIZE : Size of OLE Object',  
787 - 0xDF: 'UDDESC : Description String for Chart Autoformat',  
788 - 0xE0: 'XF : Extended Format',  
789 - 0xE1: 'INTERFACEHDR : Beginning of User Interface Records',  
790 - 0xE2: 'INTERFACEEND : End of User Interface Records',  
791 - 0xE3: 'SXVS : View Source',  
792 - 0xE5: 'MERGECELLS : Merged Cells',  
793 - 0xEA: 'TABIDCONF : Sheet Tab ID of Conflict History',  
794 - 0xEB: 'MSODRAWINGGROUP : Microsoft Office Drawing Group',  
795 - 0xEC: 'MSODRAWING : Microsoft Office Drawing',  
796 - 0xED: 'MSODRAWINGSELECTION : Microsoft Office Drawing Selection',  
797 - 0xF0: 'SXRULE : PivotTable Rule Data',  
798 - 0xF1: 'SXEX : PivotTable View Extended Information',  
799 - 0xF2: 'SXFILT : PivotTable Rule Filter',  
800 - 0xF4: 'SXDXF : Pivot Table Formatting',  
801 - 0xF5: 'SXITM : Pivot Table Item Indexes',  
802 - 0xF6: 'SXNAME : PivotTable Name',  
803 - 0xF7: 'SXSELECT : PivotTable Selection Information',  
804 - 0xF8: 'SXPAIR : PivotTable Name Pair',  
805 - 0xF9: 'SXFMLA : Pivot Table Parsed Expression',  
806 - 0xFB: 'SXFORMAT : PivotTable Format Record',  
807 - 0xFC: 'SST : Shared String Table',  
808 - 0xFD: 'LABELSST : Cell Value, String Constant/ SST',  
809 - 0xFF: 'EXTSST : Extended Shared String Table',  
810 - 0x100: 'SXVDEX : Extended PivotTable View Fields',  
811 - 0x103: 'SXFORMULA : PivotTable Formula Record',  
812 - 0x122: 'SXDBEX : PivotTable Cache Data',  
813 - 0x13D: 'TABID : Sheet Tab Index Array',  
814 - 0x160: 'USESELFS : Natural Language Formulas Flag',  
815 - 0x161: 'DSF : Double Stream File',  
816 - 0x162: 'XL5MODIFY : Flag for DSF',  
817 - 0x1A5: 'FILESHARING2 : File-Sharing Information for Shared Lists',  
818 - 0x1A9: 'USERBVIEW : Workbook Custom View Settings',  
819 - 0x1AA: 'USERSVIEWBEGIN : Custom View Settings',  
820 - 0x1AB: 'USERSVIEWEND : End of Custom View Records',  
821 - 0x1AD: 'QSI : External Data Range',  
822 - 0x1AE: 'SUPBOOK : Supporting Workbook',  
823 - 0x1AF: 'PROT4REV : Shared Workbook Protection Flag',  
824 - 0x1B0: 'CONDFMT : Conditional Formatting Range Information',  
825 - 0x1B1: 'CF : Conditional Formatting Conditions',  
826 - 0x1B2: 'DVAL : Data Validation Information',  
827 - 0x1B5: 'DCONBIN : Data Consolidation Information',  
828 - 0x1B6: 'TXO : Text Object',  
829 - 0x1B7: 'REFRESHALL : Refresh Flag',  
830 - 0x1B8: 'HLINK : Hyperlink',  
831 - 0x1BB: 'SXFDBTYPE : SQL Datatype Identifier',  
832 - 0x1BC: 'PROT4REVPASS : Shared Workbook Protection Password',  
833 - 0x1BE: 'DV : Data Validation Criteria',  
834 - 0x1C0: 'EXCEL9FILE : Excel 9 File',  
835 - 0x1C1: 'RECALCID : Recalc Information',  
836 - 0x200: 'DIMENSIONS : Cell Table Size',  
837 - 0x201: 'BLANK : Cell Value, Blank Cell',  
838 - 0x203: 'NUMBER : Cell Value, Floating-Point Number',  
839 - 0x204: 'LABEL : Cell Value, String Constant',  
840 - 0x205: 'BOOLERR : Cell Value, Boolean or Error',  
841 - 0x207: 'STRING : String Value of a Formula',  
842 - 0x208: 'ROW : Describes a Row',  
843 - 0x20B: 'INDEX : Index Record',  
844 - 0x218: 'NAME : Defined Name',  
845 - 0x221: 'ARRAY : Array-Entered Formula',  
846 - 0x223: 'EXTERNNAME : Externally Referenced Name',  
847 - 0x225: 'DEFAULTROWHEIGHT : Default Row Height',  
848 - 0x231: 'FONT : Font Description',  
849 - 0x236: 'TABLE : Data Table',  
850 - 0x23E: 'WINDOW2 : Sheet Window Information',  
851 - 0x293: 'STYLE : Style Information',  
852 - 0x406: 'FORMULA : Cell Formula',  
853 - 0x41E: 'FORMAT : Number Format',  
854 - 0x800: 'HLINKTOOLTIP : Hyperlink Tooltip',  
855 - 0x801: 'WEBPUB : Web Publish Item',  
856 - 0x802: 'QSISXTAG : PivotTable and Query Table Extensions',  
857 - 0x803: 'DBQUERYEXT : Database Query Extensions',  
858 - 0x804: 'EXTSTRING : FRT String',  
859 - 0x805: 'TXTQUERY : Text Query Information',  
860 - 0x806: 'QSIR : Query Table Formatting',  
861 - 0x807: 'QSIF : Query Table Field Formatting',  
862 - 0x809: 'BOF : Beginning of File',  
863 - 0x80A: 'OLEDBCONN : OLE Database Connection',  
864 - 0x80B: 'WOPT : Web Options',  
865 - 0x80C: 'SXVIEWEX : Pivot Table OLAP Extensions',  
866 - 0x80D: 'SXTH : PivotTable OLAP Hierarchy',  
867 - 0x80E: 'SXPIEX : OLAP Page Item Extensions',  
868 - 0x80F: 'SXVDTEX : View Dimension OLAP Extensions',  
869 - 0x810: 'SXVIEWEX9 : Pivot Table Extensions',  
870 - 0x812: 'CONTINUEFRT : Continued FRT',  
871 - 0x813: 'REALTIMEDATA : Real-Time Data (RTD)',  
872 - 0x862: 'SHEETEXT : Extra Sheet Info',  
873 - 0x863: 'BOOKEXT : Extra Book Info',  
874 - 0x864: 'SXADDL : Pivot Table Additional Info',  
875 - 0x865: 'CRASHRECERR : Crash Recovery Error',  
876 - 0x866: 'HFPicture : Header / Footer Picture',  
877 - 0x867: 'FEATHEADR : Shared Feature Header',  
878 - 0x868: 'FEAT : Shared Feature Record',  
879 - 0x86A: 'DATALABEXT : Chart Data Label Extension',  
880 - 0x86B: 'DATALABEXTCONTENTS : Chart Data Label Extension Contents',  
881 - 0x86C: 'CELLWATCH : Cell Watch',  
882 - 0x86d: 'FEATINFO : Shared Feature Info Record',  
883 - 0x871: 'FEATHEADR11 : Shared Feature Header 11',  
884 - 0x872: 'FEAT11 : Shared Feature 11 Record',  
885 - 0x873: 'FEATINFO11 : Shared Feature Info 11 Record',  
886 - 0x874: 'DROPDOWNOBJIDS : Drop Down Object',  
887 - 0x875: 'CONTINUEFRT11 : Continue FRT 11',  
888 - 0x876: 'DCONN : Data Connection',  
889 - 0x877: 'LIST12 : Extra Table Data Introduced in Excel 2007',  
890 - 0x878: 'FEAT12 : Shared Feature 12 Record',  
891 - 0x879: 'CONDFMT12 : Conditional Formatting Range Information 12',  
892 - 0x87A: 'CF12 : Conditional Formatting Condition 12',  
893 - 0x87B: 'CFEX : Conditional Formatting Extension',  
894 - 0x87C: 'XFCRC : XF Extensions Checksum',  
895 - 0x87D: 'XFEXT : XF Extension',  
896 - 0x87E: 'EZFILTER12 : AutoFilter Data Introduced in Excel 2007',  
897 - 0x87F: 'CONTINUEFRT12 : Continue FRT 12',  
898 - 0x881: 'SXADDL12 : Additional Workbook Connections Information',  
899 - 0x884: 'MDTINFO : Information about a Metadata Type',  
900 - 0x885: 'MDXSTR : MDX Metadata String',  
901 - 0x886: 'MDXTUPLE : Tuple MDX Metadata',  
902 - 0x887: 'MDXSET : Set MDX Metadata',  
903 - 0x888: 'MDXPROP : Member Property MDX Metadata',  
904 - 0x889: 'MDXKPI : Key Performance Indicator MDX Metadata',  
905 - 0x88A: 'MDTB : Block of Metadata Records',  
906 - 0x88B: 'PLV : Page Layout View Settings in Excel 2007',  
907 - 0x88C: 'COMPAT12 : Compatibility Checker 12',  
908 - 0x88D: 'DXF : Differential XF',  
909 - 0x88E: 'TABLESTYLES : Table Styles',  
910 - 0x88F: 'TABLESTYLE : Table Style',  
911 - 0x890: 'TABLESTYLEELEMENT : Table Style Element',  
912 - 0x892: 'STYLEEXT : Named Cell Style Extension',  
913 - 0x893: 'NAMEPUBLISH : Publish To Excel Server Data for Name',  
914 - 0x894: 'NAMECMT : Name Comment',  
915 - 0x895: 'SORTDATA12 : Sort Data 12',  
916 - 0x896: 'THEME : Theme',  
917 - 0x897: 'GUIDTYPELIB : VB Project Typelib GUID',  
918 - 0x898: 'FNGRP12 : Function Group',  
919 - 0x899: 'NAMEFNGRP12 : Extra Function Group',  
920 - 0x89A: 'MTRSETTINGS : Multi-Threaded Calculation Settings',  
921 - 0x89B: 'COMPRESSPICTURES : Automatic Picture Compression Mode',  
922 - 0x89C: 'HEADERFOOTER : Header Footer',  
923 - 0x8A3: 'FORCEFULLCALCULATION : Force Full Calculation Settings',  
924 - 0x8c1: 'LISTOBJ : List Object',  
925 - 0x8c2: 'LISTFIELD : List Field',  
926 - 0x8c3: 'LISTDV : List Data Validation',  
927 - 0x8c4: 'LISTCONDFMT : List Conditional Formatting',  
928 - 0x8c5: 'LISTCF : List Cell Formatting',  
929 - 0x8c6: 'FMQRY : Filemaker queries',  
930 - 0x8c7: 'FMSQRY : File maker queries',  
931 - 0x8c8: 'PLV : Page Layout View in Mac Excel 11',  
932 - 0x8c9: 'LNEXT : Extension information for borders in Mac Office 11',  
933 - 0x8ca: 'MKREXT : Extension information for markers in Mac Office 11'  
934 - }  
935 -  
936 if self.streamname in [['Workbook'], ['Book']]: 1015 if self.streamname in [['Workbook'], ['Book']]:
937 self.ran = True 1016 self.ran = True
938 # use a bytearray to have Python 2+3 compatibility with the same code (no need for ord()) 1017 # use a bytearray to have Python 2+3 compatibility with the same code (no need for ord())
@@ -988,7 +1067,7 @@ class cBIFF(object): # cPluginParent): @@ -988,7 +1067,7 @@ class cBIFF(object): # cPluginParent):
988 line += ' - build-in-name %d %s' % (code, dBuildInNames.get(code, '?')) 1067 line += ' - build-in-name %d %s' % (code, dBuildInNames.get(code, '?'))
989 else: 1068 else:
990 pass 1069 pass
991 - line += ' - %s' % (data[14:14+data[3]]) 1070 + line += ' - %s' % bytes2str(data[14:14+data[3]])
992 # print(line) 1071 # print(line)
993 1072
994 # BOUNDSHEET record 1073 # BOUNDSHEET record
@@ -1002,7 +1081,7 @@ class cBIFF(object): # cPluginParent): @@ -1002,7 +1081,7 @@ class cBIFF(object): # cPluginParent):
1002 1081
1003 # STRING record 1082 # STRING record
1004 if opcode == 0x207 and len(data) >= 4: 1083 if opcode == 0x207 and len(data) >= 4:
1005 - values = Strings(data[3:]).values() 1084 + values = list(Strings(data[3:]).values())
1006 strings = '' 1085 strings = ''
1007 if values[0] != []: 1086 if values[0] != []:
1008 strings += ' '.join(values[0]) 1087 strings += ' '.join(values[0])