diff --git a/oletools/mraptor.py b/oletools/mraptor.py
index 387b138..41327fe 100755
--- a/oletools/mraptor.py
+++ b/oletools/mraptor.py
@@ -53,6 +53,7 @@ http://www.decalage.info/python/oletools
# 2016-03-08 v0.04 PL: - collapse long lines before analysis
# 2016-08-31 v0.50 PL: - added macro trigger InkPicture_Painted
# 2016-09-05 PL: - added Document_BeforeClose keyword for MS Publisher (.pub)
+# 2016-10-25 PL: - fixed print for Python 3
__version__ = '0.50'
@@ -239,16 +240,16 @@ def main():
# Print help if no arguments are passed
if len(args) == 0:
- print __doc__
+ print(__doc__)
parser.print_help()
- print '\nAn exit code is returned based on the analysis result:'
+ print('\nAn exit code is returned based on the analysis result:')
for result in (Result_NoMacro, Result_NotMSOffice, Result_MacroOK, Result_Error, Result_Suspicious):
- print ' - %d: %s' % (result.exit_code, result.name)
+ print(' - %d: %s' % (result.exit_code, result.name))
sys.exit()
# print banner with version
- print 'MacroRaptor %s - http://decalage.info/python/oletools' % __version__
- print 'This is work in progress, please report issues at %s' % URL_ISSUES
+ print('MacroRaptor %s - http://decalage.info/python/oletools' % __version__)
+ print('This is work in progress, please report issues at %s' % URL_ISSUES)
logging.basicConfig(level=LOG_LEVELS[options.loglevel], format='%(levelname)-8s %(message)s')
# enable logging in the modules:
@@ -325,9 +326,9 @@ def main():
global_result = result
exitcode = result.exit_code
- print ''
- print 'Flags: A=AutoExec, W=Write, X=Execute'
- print 'Exit code: %d - %s' % (exitcode, global_result.name)
+ print('')
+ print('Flags: A=AutoExec, W=Write, X=Execute')
+ print('Exit code: %d - %s' % (exitcode, global_result.name))
sys.exit(exitcode)
if __name__ == '__main__':
diff --git a/oletools/oleid.py b/oletools/oleid.py
index 6e88736..39b7189 100755
--- a/oletools/oleid.py
+++ b/oletools/oleid.py
@@ -18,7 +18,7 @@ http://www.decalage.info/python/oletools
#=== LICENSE =================================================================
-# oleid is copyright (c) 2012-2015, Philippe Lagadec (http://www.decalage.info)
+# oleid is copyright (c) 2012-2016, Philippe Lagadec (http://www.decalage.info)
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification,
@@ -48,8 +48,9 @@ http://www.decalage.info/python/oletools
# 2014-11-29 v0.02 PL: - use olefile instead of OleFileIO_PL
# - improved usage display with -h
# 2014-11-30 v0.03 PL: - improved output with prettytable
+# 2016-10-25 v0.50 PL: - fixed print for Python 3
-__version__ = '0.03'
+__version__ = '0.50'
#------------------------------------------------------------------------------
@@ -275,7 +276,7 @@ def main():
return
for filename in args:
- print '\nFilename:', filename
+ print('\nFilename:', filename)
oleid = OleID(filename)
indicators = oleid.check()
@@ -290,7 +291,7 @@ def main():
#print '%s: %s' % (indicator.name, indicator.value)
t.add_row((indicator.name, indicator.value))
- print t
+ print(t)
if __name__ == '__main__':
main()
diff --git a/oletools/olemeta.py b/oletools/olemeta.py
index 02697b1..429572c 100755
--- a/oletools/olemeta.py
+++ b/oletools/olemeta.py
@@ -45,6 +45,7 @@ http://www.decalage.info/python/oletools
# - improved usage display
# 2015-12-29 v0.03 PL: - only display properties present in the file
# 2016-09-06 v0.50 PL: - added main entry point for setup.py
+# 2016-10-25 PL: - fixed print for Python 3
__version__ = '0.50'
@@ -93,7 +94,7 @@ def main():
value = str(value)
t.write_row([prop, value], colors=[None, 'yellow'])
t.close()
- print ''
+ print('')
print('Properties from the DocumentSummaryInformation stream:')
t = tablestream.TableStream([21, 30], header_row=['Property', 'Value'], outfile=console_utf8)
diff --git a/oletools/olevba.py b/oletools/olevba.py
index b0da3c7..831da11 100755
--- a/oletools/olevba.py
+++ b/oletools/olevba.py
@@ -73,6 +73,8 @@ https://github.com/unixfreak0037/officeparser
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
+from __future__ import print_function
+
#------------------------------------------------------------------------------
# CHANGELOG:
# 2014-08-05 v0.01 PL: - first version based on officeparser code
@@ -184,6 +186,7 @@ https://github.com/unixfreak0037/officeparser
# 2016-09-05 PL: - added autoexec keywords for MS Publisher (.pub)
# 2016-09-06 PL: - fixed issue #20, is_zipfile on Python 2.6
# 2016-09-12 PL: - enabled packrat to improve pyparsing performance
+# 2016-10-25 PL: - fixed raise and print statements for Python 3
__version__ = '0.50'
@@ -246,9 +249,9 @@ except ImportError:
# Python <2.5: standalone ElementTree install
import elementtree.cElementTree as ET
except ImportError:
- raise ImportError, "lxml or ElementTree are not installed, " \
+ raise ImportError("lxml or ElementTree are not installed, " \
+ "see http://codespeak.net/lxml " \
- + "or http://effbot.org/zone/element-index.htm"
+ + "or http://effbot.org/zone/element-index.htm")
import thirdparty.olefile as olefile
from thirdparty.prettytable import prettytable
@@ -1968,18 +1971,18 @@ def print_json(json_dict=None, _json_is_last=False, **json_parts):
json_dict = json_parts
if not _have_printed_json_start:
- print '['
+ print('[')
_have_printed_json_start = True
lines = json.dumps(json2ascii(json_dict), check_circular=False,
indent=4, ensure_ascii=False).splitlines()
for line in lines[:-1]:
- print ' {0}'.format(line)
+ print(' {0}'.format(line))
if _json_is_last:
- print ' {0}'.format(lines[-1]) # print last line without comma
- print ']'
+ print(' {0}'.format(lines[-1])) # print last line without comma
+ print(']')
else:
- print ' {0},'.format(lines[-1]) # print last line with comma
+ print(' {0},'.format(lines[-1])) # print last line with comma
class VBA_Scanner(object):
@@ -2934,7 +2937,7 @@ class VBA_Parser_CLI(VBA_Parser):
"""
# print a waiting message only if the output is not redirected to a file:
if sys.stdout.isatty():
- print 'Analysis...\r',
+ print('Analysis...\r', end='')
sys.stdout.flush()
results = self.analyze_macros(show_decoded_strings, deobfuscate)
if results:
@@ -2950,9 +2953,9 @@ class VBA_Parser_CLI(VBA_Parser):
if not is_printable(description):
description = repr(description)
t.add_row((kw_type, keyword, description))
- print t
+ print(t)
else:
- print 'No suspicious keyword or IOC found.'
+ print('No suspicious keyword or IOC found.')
def print_analysis_json(self, show_decoded_strings=False, deobfuscate=False):
"""
@@ -2966,7 +2969,7 @@ class VBA_Parser_CLI(VBA_Parser):
"""
# print a waiting message only if the output is not redirected to a file:
if sys.stdout.isatty():
- print 'Analysis...\r',
+ print('Analysis...\r', end='')
sys.stdout.flush()
return [dict(type=kw_type, keyword=keyword, description=description)
for kw_type, keyword, description in self.analyze_macros(show_decoded_strings, deobfuscate)]
@@ -2995,11 +2998,11 @@ class VBA_Parser_CLI(VBA_Parser):
display_filename = '%s in %s' % (self.filename, self.container)
else:
display_filename = self.filename
- print '=' * 79
- print 'FILE:', display_filename
+ print('=' * 79)
+ print('FILE: %s' % display_filename)
try:
#TODO: handle olefile errors, when an OLE file is malformed
- print 'Type:', self.type
+ print('Type: %s'% self.type)
if self.detect_vba_macros():
#print 'Contains VBA Macros:'
for (subfilename, stream_path, vba_filename, vba_code) in self.extract_all_macros():
@@ -3008,29 +3011,29 @@ class VBA_Parser_CLI(VBA_Parser):
vba_code_filtered = filter_vba(vba_code)
else:
vba_code_filtered = vba_code
- print '-' * 79
- print 'VBA MACRO %s ' % vba_filename
- print 'in file: %s - OLE stream: %s' % (subfilename, repr(stream_path))
+ print('-' * 79)
+ print('VBA MACRO %s ' % vba_filename)
+ print('in file: %s - OLE stream: %s' % (subfilename, repr(stream_path)))
if display_code:
- print '- ' * 39
+ print('- ' * 39)
# detect empty macros:
if vba_code_filtered.strip() == '':
- print '(empty macro)'
+ print('(empty macro)')
else:
- print vba_code_filtered
+ print(vba_code_filtered)
for (subfilename, stream_path, form_string) in self.extract_form_strings():
- print '-' * 79
- print 'VBA FORM STRING IN %r - OLE stream: %r' % (subfilename, stream_path)
- print '- ' * 39
- print form_string
+ print('-' * 79)
+ print('VBA FORM STRING IN %r - OLE stream: %r' % (subfilename, stream_path))
+ print('- ' * 39)
+ print(form_string)
if not vba_code_only:
# analyse the code from all modules at once:
self.print_analysis(show_decoded_strings, deobfuscate)
if show_deobfuscated_code:
- print 'MACRO SOURCE CODE WITH DEOBFUSCATED VBA STRINGS (EXPERIMENTAL):\n\n'
- print self.reveal()
+ print('MACRO SOURCE CODE WITH DEOBFUSCATED VBA STRINGS (EXPERIMENTAL):\n\n')
+ print(self.reveal())
else:
- print 'No VBA macros found.'
+ print('No VBA macros found.')
except OlevbaBaseException:
raise
except Exception as exc:
@@ -3038,7 +3041,7 @@ class VBA_Parser_CLI(VBA_Parser):
log.info('Error processing file %s (%s)' % (self.filename, exc))
log.debug('Traceback:', exc_info=True)
raise ProcessingError(self.filename, exc)
- print ''
+ print('')
def process_file_json(self, show_decoded_strings=False,
@@ -3124,7 +3127,7 @@ class VBA_Parser_CLI(VBA_Parser):
if self.detect_vba_macros():
# print a waiting message only if the output is not redirected to a file:
if sys.stdout.isatty():
- print 'Analysis...\r',
+ print('Analysis...\r', end='')
sys.stdout.flush()
self.analyze_macros(show_decoded_strings=show_decoded_strings,
deobfuscate=deobfuscate)
@@ -3142,7 +3145,7 @@ class VBA_Parser_CLI(VBA_Parser):
base64obf, dridex, vba_obf)
line = '%-12s %s' % (flags, self.filename)
- print line
+ print(line)
# old table display:
# macros = autoexec = suspicious = iocs = hexstrings = 'no'
@@ -3235,7 +3238,7 @@ def main():
# Print help if no arguments are passed
if len(args) == 0:
- print __doc__
+ print(__doc__)
parser.print_help()
sys.exit(RETURN_WRONG_ARGS)
@@ -3246,7 +3249,7 @@ def main():
url='http://decalage.info/python/oletools',
type='MetaInformation')
else:
- print 'olevba %s - http://decalage.info/python/oletools' % __version__
+ print('olevba %s - http://decalage.info/python/oletools' % __version__)
logging.basicConfig(level=LOG_LEVELS[options.loglevel], format='%(levelname)-8s %(message)s')
# enable logging in the modules:
@@ -3266,8 +3269,8 @@ def main():
# Column headers (do not know how many files there will be yet, so if no output_mode
# was specified, we will print triage for first file --> need these headers)
if options.output_mode in ('triage', 'unspecified'):
- print '%-12s %-65s' % ('Flags', 'Filename')
- print '%-12s %-65s' % ('-' * 11, '-' * 65)
+ print('%-12s %-65s' % ('Flags', 'Filename'))
+ print('%-12s %-65s' % ('-' * 11, '-' * 65))
previous_container = None
count = 0
@@ -3285,14 +3288,14 @@ def main():
if isinstance(data, Exception):
if isinstance(data, PathNotFoundException):
if options.output_mode in ('triage', 'unspecified'):
- print '%-12s %s - File not found' % ('?', filename)
+ print('%-12s %s - File not found' % ('?', filename))
elif options.output_mode != 'json':
log.error('Given path %r does not exist!' % filename)
return_code = RETURN_FILE_NOT_FOUND if return_code == 0 \
else RETURN_SEVERAL_ERRS
else:
if options.output_mode in ('triage', 'unspecified'):
- print '%-12s %s - Failed to read from zip file %s' % ('?', filename, container)
+ print('%-12s %s - Failed to read from zip file %s' % ('?', filename, container))
elif options.output_mode != 'json':
log.error('Exception opening/reading %r from zip file %r: %s'
% (filename, container, data))
@@ -3319,7 +3322,7 @@ def main():
# print container name when it changes:
if container != previous_container:
if container is not None:
- print '\nFiles in %s:' % container
+ print('\nFiles in %s:' % container)
previous_container = container
# summarized output for triage:
vba_parser.process_file_triage(show_decoded_strings=options.show_decoded_strings,
@@ -3337,8 +3340,8 @@ def main():
except (SubstreamOpenError, UnexpectedDataError) as exc:
if options.output_mode in ('triage', 'unspecified'):
- print '%-12s %s - Error opening substream or uenxpected ' \
- 'content' % ('?', filename)
+ print('%-12s %s - Error opening substream or uenxpected ' \
+ 'content' % ('?', filename))
elif options.output_mode == 'json':
print_json(file=filename, type='error',
error=type(exc).__name__, message=str(exc))
@@ -3349,7 +3352,7 @@ def main():
else RETURN_SEVERAL_ERRS
except FileOpenError as exc:
if options.output_mode in ('triage', 'unspecified'):
- print '%-12s %s - File format not supported' % ('?', filename)
+ print('%-12s %s - File format not supported' % ('?', filename))
elif options.output_mode == 'json':
print_json(file=filename, type='error',
error=type(exc).__name__, message=str(exc))
@@ -3359,7 +3362,7 @@ def main():
else RETURN_SEVERAL_ERRS
except ProcessingError as exc:
if options.output_mode in ('triage', 'unspecified'):
- print '%-12s %s - %s' % ('!ERROR', filename, exc.orig_exc)
+ print('%-12s %s - %s' % ('!ERROR', filename, exc.orig_exc))
elif options.output_mode == 'json':
print_json(file=filename, type='error',
error=type(exc).__name__,
@@ -3374,9 +3377,9 @@ def main():
vba_parser.close()
if options.output_mode == 'triage':
- print '\n(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, TXT=Text, M=Macros, ' \
+ print('\n(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, TXT=Text, M=Macros, ' \
'A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, ' \
- 'B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)\n'
+ 'B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)\n')
if count == 1 and options.output_mode == 'unspecified':
# if options -t, -d and -j were not specified and it's a single file, print details:
diff --git a/oletools/pyxswf.py b/oletools/pyxswf.py
index 258febf..50fc0c4 100755
--- a/oletools/pyxswf.py
+++ b/oletools/pyxswf.py
@@ -55,6 +55,7 @@ http://www.decalage.info/python/oletools
# 2014-11-29 v0.03 PL: - use olefile instead of OleFileIO_PL
# - improved usage display with -h
# 2016-09-06 v0.50 PL: - updated to match the rtfobj API
+# 2016-10-25 PL: - fixed print for Python 3
__version__ = '0.50'
@@ -122,7 +123,7 @@ def main():
# check if data contains the SWF magic: FWS or CWS
data = f.getvalue()
if 'FWS' in data or 'CWS' in data:
- print 'OLE stream: %s' % repr(direntry.name)
+ print('OLE stream: %s' % repr(direntry.name))
# call xxxswf to scan or extract Flash files:
xxxswf.disneyland(f, direntry.name, options)
f.close()
@@ -133,7 +134,7 @@ def main():
for filename in args:
for index, orig_len, data in rtfobj.rtf_iter_objects(filename):
if 'FWS' in data or 'CWS' in data:
- print 'RTF embedded object size %d at index %08X' % (len(data), index)
+ print('RTF embedded object size %d at index %08X' % (len(data), index))
f = StringIO.StringIO(data)
name = 'RTF_embedded_object_%08X' % index
# call xxxswf to scan or extract Flash files:
diff --git a/oletools/thirdparty/olefile/__init__.py b/oletools/thirdparty/olefile/__init__.py
index a0c3512..59b442d 100644
--- a/oletools/thirdparty/olefile/__init__.py
+++ b/oletools/thirdparty/olefile/__init__.py
@@ -1,35 +1,28 @@
-#!/usr/local/bin/python
-# -*- coding: latin-1 -*-
-"""
-olefile (formerly OleFileIO_PL)
-
-Module to read/write Microsoft OLE2 files (also called Structured Storage or
-Microsoft Compound Document File Format), such as Microsoft Office 97-2003
-documents, Image Composer and FlashPix files, Outlook messages, ...
-This version is compatible with Python 2.6+ and 3.x
-
-Project website: http://www.decalage.info/olefile
-
-olefile is copyright (c) 2005-2015 Philippe Lagadec (http://www.decalage.info)
-
-olefile is based on the OleFileIO module from the PIL library v1.1.6
-See: http://www.pythonware.com/products/pil/index.htm
-
-The Python Imaging Library (PIL) is
- Copyright (c) 1997-2005 by Secret Labs AB
- Copyright (c) 1995-2005 by Fredrik Lundh
-
-See source code and LICENSE.txt for information on usage and redistribution.
-"""
-
-try:
- # first try to import olefile for Python 2.6+/3.x
- from .olefile import *
- # import metadata not covered by *:
- from .olefile import __version__, __author__, __date__
-
-except:
- # if it fails, fallback to the old version olefile2 for Python 2.x:
- from .olefile2 import *
- # import metadata not covered by *:
- from .olefile2 import __doc__, __version__, __author__, __date__
+#!/usr/local/bin/python
+# -*- coding: latin-1 -*-
+"""
+olefile (formerly OleFileIO_PL)
+
+Module to read/write Microsoft OLE2 files (also called Structured Storage or
+Microsoft Compound Document File Format), such as Microsoft Office 97-2003
+documents, Image Composer and FlashPix files, Outlook messages, ...
+This version is compatible with Python 2.6+ and 3.x
+
+Project website: http://www.decalage.info/olefile
+
+olefile is copyright (c) 2005-2015 Philippe Lagadec (http://www.decalage.info)
+
+olefile is based on the OleFileIO module from the PIL library v1.1.6
+See: http://www.pythonware.com/products/pil/index.htm
+
+The Python Imaging Library (PIL) is
+ Copyright (c) 1997-2005 by Secret Labs AB
+ Copyright (c) 1995-2005 by Fredrik Lundh
+
+See source code and LICENSE.txt for information on usage and redistribution.
+"""
+
+# first try to import olefile for Python 2.6+/3.x
+from .olefile import *
+# import metadata not covered by *:
+from .olefile import __version__, __author__, __date__
diff --git a/oletools/thirdparty/olefile/olefile2.html b/oletools/thirdparty/olefile/olefile2.html
deleted file mode 100644
index 467fa63..0000000
--- a/oletools/thirdparty/olefile/olefile2.html
+++ /dev/null
@@ -1,241 +0,0 @@
-
-
-
Python: module olefile2
-
-
-
- olefile2 (formerly OleFileIO_PL2) version 0.40py2 2014-10-01
-
-Module to read Microsoft OLE2 files (also called Structured Storage or
-Microsoft Compound Document File Format), such as Microsoft Office
-documents, Image Composer and FlashPix files, Outlook messages, ...
-
-IMPORTANT NOTE: olefile2 is an old version of olefile meant to be used
-as fallback for Python 2.5 and older. For Python 2.6, 2.7 and 3.x, please use
-olefile which is more up-to-date. The improvements in olefile might
-not always be backported to olefile2.
-
-Project website: http://www.decalage.info/python/olefileio
-
-olefile2 is copyright (c) 2005-2014 Philippe Lagadec (http://www.decalage.info)
-
-olefile2 is based on the OleFileIO module from the PIL library v1.1.6
-See: http://www.pythonware.com/products/pil/index.htm
-
-The Python Imaging Library (PIL) is
- Copyright (c) 1997-2005 by Secret Labs AB
- Copyright (c) 1995-2005 by Fredrik Lundh
-
-See source code and LICENSE.txt for information on usage and redistribution.
-
-
-
-
-
-Classes |
-
-| | |
-
-- OleFileIO
-
-
-
-
-
-class OleFileIO |
-
-| |
-OLE container object
-
-This class encapsulates the interface to an OLE 2 structured
-storage file. Use the {@link listdir} and {@link openstream} methods to
-access the contents of this file.
-
-Object names are given as a list of strings, one for each subentry
-level. The root entry should be omitted. For example, the following
-code extracts all image streams from a Microsoft Image Composer file:
-
- ole = OleFileIO("fan.mic")
-
- for entry in ole.listdir():
- if entry[1:2] == "Image":
- fin = ole.openstream(entry)
- fout = open(entry[0:1], "wb")
- while True:
- s = fin.read(8192)
- if not s:
- break
- fout.write(s)
-
-You can use the viewer application provided with the Python Imaging
-Library to view the resulting files (which happens to be standard
-TIFF files). |
-| |
-Methods defined here:
-- __init__(self, filename=None, raise_defects=40)
- Constructor for OleFileIO class.
-
-filename: file to open.
-raise_defects: minimal level for defects to be raised as exceptions.
-(use DEFECT_FATAL for a typical application, DEFECT_INCORRECT for a
-security-oriented application, see source code for details)
-
-- close(self)
- close the OLE file, to release the file object
-
-- dumpdirectory(self)
- Dump directory (for debugging only)
-
-- dumpfat(self, fat, firstindex=0)
- Displays a part of FAT in human-readable form for debugging purpose
-
-- dumpsect(self, sector, firstindex=0)
- Displays a sector in a human-readable form, for debugging purpose.
-
-- exists(self, filename)
- Test if given filename exists as a stream or a storage in the OLE
-container.
-
-filename: path of stream in storage tree. (see openstream for syntax)
-return: True if object exist, else False.
-
-- get_metadata(self)
- Parse standard properties streams, return an OleMetadata object
-containing all the available metadata.
-(also stored in the metadata attribute of the OleFileIO object)
-
-new in version 0.25
-
-- get_rootentry_name(self)
- Return root entry name. Should usually be 'Root Entry' or 'R' in most
-implementations.
-
-- get_size(self, filename)
- Return size of a stream in the OLE container, in bytes.
-
-filename: path of stream in storage tree (see openstream for syntax)
-return: size in bytes (long integer)
-raise: IOError if file not found, TypeError if this is not a stream.
-
-- get_type(self, filename)
- Test if given filename exists as a stream or a storage in the OLE
-container, and return its type.
-
-filename: path of stream in storage tree. (see openstream for syntax)
-return: False if object does not exist, its entry type (>0) otherwise:
- - STGTY_STREAM: a stream
- - STGTY_STORAGE: a storage
- - STGTY_ROOT: the root entry
-
-- getctime(self, filename)
- Return creation time of a stream/storage.
-
-filename: path of stream/storage in storage tree. (see openstream for
-syntax)
-return: None if creation time is null, a python datetime object
-otherwise (UTC timezone)
-
-new in version 0.26
-
-- getmtime(self, filename)
- Return modification time of a stream/storage.
-
-filename: path of stream/storage in storage tree. (see openstream for
-syntax)
-return: None if modification time is null, a python datetime object
-otherwise (UTC timezone)
-
-new in version 0.26
-
-- getproperties(self, filename, convert_time=False, no_conversion=None)
- Return properties described in substream.
-
-filename: path of stream in storage tree (see openstream for syntax)
-convert_time: bool, if True timestamps will be converted to Python datetime
-no_conversion: None or list of int, timestamps not to be converted
- (for example total editing time is not a real timestamp)
-return: a dictionary of values indexed by id (integer)
-
-- getsect(self, sect)
- Read given sector from file on disk.
-sect: sector index
-returns a string containing the sector data.
-
-- listdir(self, streams=True, storages=False)
- Return a list of streams stored in this file
-
-streams: bool, include streams if True (True by default) - new in v0.26
-storages: bool, include storages if True (False by default) - new in v0.26
-(note: the root storage is never included)
-
-- loaddirectory(self, sect)
- Load the directory.
-sect: sector index of directory stream.
-
-- loadfat(self, header)
- Load the FAT table.
-
-- loadfat_sect(self, sect)
- Adds the indexes of the given sector to the FAT
-sect: string containing the first FAT sector, or array of long integers
-return: index of last FAT sector.
-
-- loadminifat(self)
- Load the MiniFAT table.
-
-- open(self, filename)
- Open an OLE2 file.
-Reads the header, FAT and directory.
-
-filename: string-like or file-like object
-
-- openstream(self, filename)
- Open a stream as a read-only file object (StringIO).
-
-filename: path of stream in storage tree (except root entry), either:
- - a string using Unix path syntax, for example:
- 'storage_1/storage_1.2/stream'
- - a list of storage filenames, path to the desired stream/storage.
- Example: ['storage_1', 'storage_1.2', 'stream']
-return: file object (read-only)
-raise IOError if filename not found, or if this is not a stream.
-
-- sect2array(self, sect)
- convert a sector to an array of 32 bits unsigned integers,
-swapping bytes on big endian CPUs such as PowerPC (old Macs)
-
- | |
-
-
-
-Functions |
-
-| | |
-- isOleFile(filename)
- Test if file is an OLE container (according to its header).
-filename: file name or path (str, unicode)
-return: True if OLE, False otherwise.
- |
-
-
-
-Data |
-
-| | |
-DEFECT_FATAL = 40
-DEFECT_INCORRECT = 30
-DEFECT_POTENTIAL = 20
-DEFECT_UNSURE = 10
-STGTY_EMPTY = 0
-STGTY_LOCKBYTES = 3
-STGTY_PROPERTY = 4
-STGTY_ROOT = 5
-STGTY_STORAGE = 1
-STGTY_STREAM = 2
-__all__ = ['OleFileIO', 'isOleFile', 'DEFECT_UNSURE', 'STGTY_STREAM', 'DEFECT_FATAL', 'STGTY_EMPTY', 'STGTY_LOCKBYTES', 'STGTY_STORAGE', 'STGTY_PROPERTY', 'DEFECT_INCORRECT', 'DEFECT_POTENTIAL', 'STGTY_ROOT']
-__author__ = 'Philippe Lagadec'
-__date__ = '2014-10-01'
-__version__ = '0.40py2' |
-
-
-
-Author |
-
-| | |
-Philippe Lagadec |
-
\ No newline at end of file
diff --git a/oletools/thirdparty/olefile/olefile2.py b/oletools/thirdparty/olefile/olefile2.py
deleted file mode 100644
index c57a82b..0000000
--- a/oletools/thirdparty/olefile/olefile2.py
+++ /dev/null
@@ -1,2043 +0,0 @@
-#!/usr/local/bin/python
-# -*- coding: latin-1 -*-
-"""
-olefile2 (formerly OleFileIO_PL2) version 0.40py2 2014-10-01
-
-Module to read Microsoft OLE2 files (also called Structured Storage or
-Microsoft Compound Document File Format), such as Microsoft Office
-documents, Image Composer and FlashPix files, Outlook messages, ...
-
-IMPORTANT NOTE: olefile2 is an old version of olefile meant to be used
-as fallback for Python 2.5 and older. For Python 2.6, 2.7 and 3.x, please use
-olefile which is more up-to-date. The improvements in olefile might
-not always be backported to olefile2.
-
-Project website: http://www.decalage.info/python/olefileio
-
-olefile2 is copyright (c) 2005-2014 Philippe Lagadec (http://www.decalage.info)
-
-olefile2 is based on the OleFileIO module from the PIL library v1.1.6
-See: http://www.pythonware.com/products/pil/index.htm
-
-The Python Imaging Library (PIL) is
- Copyright (c) 1997-2005 by Secret Labs AB
- Copyright (c) 1995-2005 by Fredrik Lundh
-
-See source code and LICENSE.txt for information on usage and redistribution.
-"""
-
-__author__ = "Philippe Lagadec"
-__date__ = "2014-10-01"
-__version__ = '0.40py2'
-
-#--- LICENSE ------------------------------------------------------------------
-
-# olefile (formerly OleFileIO_PL) is copyright (c) 2005-2014 Philippe Lagadec
-# (http://www.decalage.info)
-#
-# All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without modification,
-# are permitted provided that the following conditions are met:
-#
-# * Redistributions of source code must retain the above copyright notice, this
-# list of conditions and the following disclaimer.
-# * Redistributions in binary form must reproduce the above copyright notice,
-# this list of conditions and the following disclaimer in the documentation
-# and/or other materials provided with the distribution.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# ----------
-# PIL License:
-#
-# olefile is based on source code from the OleFileIO module of the Python
-# Imaging Library (PIL) published by Fredrik Lundh under the following license:
-
-# The Python Imaging Library (PIL) is
-# Copyright (c) 1997-2005 by Secret Labs AB
-# Copyright (c) 1995-2005 by Fredrik Lundh
-#
-# By obtaining, using, and/or copying this software and/or its associated
-# documentation, you agree that you have read, understood, and will comply with
-# the following terms and conditions:
-#
-# Permission to use, copy, modify, and distribute this software and its
-# associated documentation for any purpose and without fee is hereby granted,
-# provided that the above copyright notice appears in all copies, and that both
-# that copyright notice and this permission notice appear in supporting
-# documentation, and that the name of Secret Labs AB or the author(s) not be used
-# in advertising or publicity pertaining to distribution of the software
-# without specific, written prior permission.
-#
-# SECRET LABS AB AND THE AUTHORS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS
-# SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.
-# IN NO EVENT SHALL SECRET LABS AB OR THE AUTHORS BE LIABLE FOR ANY SPECIAL,
-# INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-# OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-#-----------------------------------------------------------------------------
-# CHANGELOG: (only olefile/OleFileIO_PL changes compared to PIL 1.1.6)
-# 2005-05-11 v0.10 PL: - a few fixes for Python 2.4 compatibility
-# (all changes flagged with [PL])
-# 2006-02-22 v0.11 PL: - a few fixes for some Office 2003 documents which raise
-# exceptions in _OleStream.__init__()
-# 2006-06-09 v0.12 PL: - fixes for files above 6.8MB (DIFAT in loadfat)
-# - added some constants
-# - added header values checks
-# - added some docstrings
-# - getsect: bugfix in case sectors >512 bytes
-# - getsect: added conformity checks
-# - DEBUG_MODE constant to activate debug display
-# 2007-09-04 v0.13 PL: - improved/translated (lots of) comments
-# - updated license
-# - converted tabs to 4 spaces
-# 2007-11-19 v0.14 PL: - added OleFileIO._raise_defect() to adapt sensitivity
-# - improved _unicode() to use Python 2.x unicode support
-# - fixed bug in _OleDirectoryEntry
-# 2007-11-25 v0.15 PL: - added safety checks to detect FAT loops
-# - fixed _OleStream which didn't check stream size
-# - added/improved many docstrings and comments
-# - moved helper functions _unicode and _clsid out of
-# OleFileIO class
-# - improved OleFileIO._find() to add Unix path syntax
-# - OleFileIO._find() is now case-insensitive
-# - added get_type() and get_rootentry_name()
-# - rewritten loaddirectory and _OleDirectoryEntry
-# 2007-11-27 v0.16 PL: - added _OleDirectoryEntry.kids_dict
-# - added detection of duplicate filenames in storages
-# - added detection of duplicate references to streams
-# - added get_size() and exists() to _OleDirectoryEntry
-# - added isOleFile to check header before parsing
-# - added __all__ list to control public keywords in pydoc
-# 2007-12-04 v0.17 PL: - added _load_direntry to fix a bug in loaddirectory
-# - improved _unicode(), added workarounds for Python <2.3
-# - added set_debug_mode and -d option to set debug mode
-# - fixed bugs in OleFileIO.open and _OleDirectoryEntry
-# - added safety check in main for large or binary
-# properties
-# - allow size>0 for storages for some implementations
-# 2007-12-05 v0.18 PL: - fixed several bugs in handling of FAT, MiniFAT and
-# streams
-# - added option '-c' in main to check all streams
-# 2009-12-10 v0.19 PL: - bugfix for 32 bit arrays on 64 bits platforms
-# (thanks to Ben G. and Martijn for reporting the bug)
-# 2009-12-11 v0.20 PL: - bugfix in OleFileIO.open when filename is not plain str
-# 2010-01-22 v0.21 PL: - added support for big-endian CPUs such as PowerPC Macs
-# 2012-02-16 v0.22 PL: - fixed bug in getproperties, patch by chuckleberryfinn
-# (https://bitbucket.org/decalage/olefileio_pl/issue/7)
-# - added close method to OleFileIO (fixed issue #2)
-# 2012-07-25 v0.23 PL: - added support for file-like objects (patch by mete0r_kr)
-# 2013-05-05 v0.24 PL: - getproperties: added conversion from filetime to python
-# datetime
-# - main: displays properties with date format
-# - new class OleMetadata to parse standard properties
-# - added get_metadata method
-# 2013-05-07 v0.24 PL: - a few improvements in OleMetadata
-# 2013-05-24 v0.25 PL: - getproperties: option to not convert some timestamps
-# - OleMetaData: total_edit_time is now a number of seconds,
-# not a timestamp
-# - getproperties: added support for VT_BOOL, VT_INT, V_UINT
-# - getproperties: filter out null chars from strings
-# - getproperties: raise non-fatal defects instead of
-# exceptions when properties cannot be parsed properly
-# 2013-05-27 PL: - getproperties: improved exception handling
-# - _raise_defect: added option to set exception type
-# - all non-fatal issues are now recorded, and displayed
-# when run as a script
-# 2013-07-11 v0.26 PL: - added methods to get modification and creation times
-# of a directory entry or a storage/stream
-# - fixed parsing of direntry timestamps
-# 2013-07-24 PL: - new options in listdir to list storages and/or streams
-# 2014-07-18 v0.31 - preliminary support for 4K sectors
-# 2014-09-26 v0.40 PL: - renamed OleFileIO_PL to olefile
-
-#-----------------------------------------------------------------------------
-# TODO:
-# + check if running on Python 2.6+, if so issue warning to use olefile
-
-#-----------------------------------------------------------------------------
-
-#
-# THIS IS WORK IN PROGRESS
-#
-# The Python Imaging Library
-# $Id: OleFileIO.py 2339 2005-03-25 08:02:17Z fredrik $
-#
-# stuff to deal with OLE2 Structured Storage files. this module is
-# used by PIL to read Image Composer and FlashPix files, but can also
-# be used to read other files of this type.
-#
-# History:
-# 1997-01-20 fl Created
-# 1997-01-22 fl Fixed 64-bit portability quirk
-# 2003-09-09 fl Fixed typo in OleFileIO.loadfat (noted by Daniel Haertle)
-# 2004-02-29 fl Changed long hex constants to signed integers
-#
-# Notes:
-# FIXME: sort out sign problem (eliminate long hex constants)
-# FIXME: change filename to use "a/b/c" instead of ["a", "b", "c"]
-# FIXME: provide a glob mechanism function (using fnmatchcase)
-#
-# Literature:
-#
-# "FlashPix Format Specification, Appendix A", Kodak and Microsoft,
-# September 1996.
-#
-# Quotes:
-#
-# "If this document and functionality of the Software conflict,
-# the actual functionality of the Software represents the correct
-# functionality" -- Microsoft, in the OLE format specification
-#
-# Copyright (c) Secret Labs AB 1997.
-# Copyright (c) Fredrik Lundh 1997.
-#
-# See the README file for information on usage and redistribution.
-#
-
-#------------------------------------------------------------------------------
-
-import string, StringIO, struct, array, os.path, sys, datetime
-
-#[PL] Define explicitly the public API to avoid private objects in pydoc:
-__all__ = ['OleFileIO', 'isOleFile']
-
-#[PL] workaround to fix an issue with array item size on 64 bits systems:
-if array.array('L').itemsize == 4:
- # on 32 bits platforms, long integers in an array are 32 bits:
- UINT32 = 'L'
-elif array.array('I').itemsize == 4:
- # on 64 bits platforms, integers in an array are 32 bits:
- UINT32 = 'I'
-else:
- raise ValueError, 'Need to fix a bug with 32 bit arrays, please contact author...'
-
-
-#[PL] These workarounds were inspired from the Path module
-# (see http://www.jorendorff.com/articles/python/path/)
-#TODO: test with old Python versions
-
-# Pre-2.3 workaround for booleans
-try:
- True, False
-except NameError:
- True, False = 1, 0
-
-# Pre-2.3 workaround for basestring.
-try:
- basestring
-except NameError:
- try:
- # is Unicode supported (Python >2.0 or >1.6 ?)
- basestring = (str, unicode)
- except NameError:
- basestring = str
-
-#[PL] Experimental setting: if True, OLE filenames will be kept in Unicode
-# if False (default PIL behaviour), all filenames are converted to Latin-1.
-KEEP_UNICODE_NAMES = False
-
-#[PL] DEBUG display mode: False by default, use set_debug_mode() or "-d" on
-# command line to change it.
-DEBUG_MODE = False
-def debug_print(msg):
- print msg
-def debug_pass(msg):
- pass
-debug = debug_pass
-
-def set_debug_mode(debug_mode):
- """
- Set debug mode on or off, to control display of debugging messages.
- mode: True or False
- """
- global DEBUG_MODE, debug
- DEBUG_MODE = debug_mode
- if debug_mode:
- debug = debug_print
- else:
- debug = debug_pass
-
-#TODO: convert this to hex
-MAGIC = '\320\317\021\340\241\261\032\341'
-
-#[PL]: added constants for Sector IDs (from AAF specifications)
-MAXREGSECT = 0xFFFFFFFAL; # maximum SECT
-DIFSECT = 0xFFFFFFFCL; # (-4) denotes a DIFAT sector in a FAT
-FATSECT = 0xFFFFFFFDL; # (-3) denotes a FAT sector in a FAT
-ENDOFCHAIN = 0xFFFFFFFEL; # (-2) end of a virtual stream chain
-FREESECT = 0xFFFFFFFFL; # (-1) unallocated sector
-
-#[PL]: added constants for Directory Entry IDs (from AAF specifications)
-MAXREGSID = 0xFFFFFFFAL; # maximum directory entry ID
-NOSTREAM = 0xFFFFFFFFL; # (-1) unallocated directory entry
-
-#[PL] object types in storage (from AAF specifications)
-STGTY_EMPTY = 0 # empty directory entry (according to OpenOffice.org doc)
-STGTY_STORAGE = 1 # element is a storage object
-STGTY_STREAM = 2 # element is a stream object
-STGTY_LOCKBYTES = 3 # element is an ILockBytes object
-STGTY_PROPERTY = 4 # element is an IPropertyStorage object
-STGTY_ROOT = 5 # element is a root storage
-
-
-#
-# --------------------------------------------------------------------
-# property types
-
-VT_EMPTY=0; VT_NULL=1; VT_I2=2; VT_I4=3; VT_R4=4; VT_R8=5; VT_CY=6;
-VT_DATE=7; VT_BSTR=8; VT_DISPATCH=9; VT_ERROR=10; VT_BOOL=11;
-VT_VARIANT=12; VT_UNKNOWN=13; VT_DECIMAL=14; VT_I1=16; VT_UI1=17;
-VT_UI2=18; VT_UI4=19; VT_I8=20; VT_UI8=21; VT_INT=22; VT_UINT=23;
-VT_VOID=24; VT_HRESULT=25; VT_PTR=26; VT_SAFEARRAY=27; VT_CARRAY=28;
-VT_USERDEFINED=29; VT_LPSTR=30; VT_LPWSTR=31; VT_FILETIME=64;
-VT_BLOB=65; VT_STREAM=66; VT_STORAGE=67; VT_STREAMED_OBJECT=68;
-VT_STORED_OBJECT=69; VT_BLOB_OBJECT=70; VT_CF=71; VT_CLSID=72;
-VT_VECTOR=0x1000;
-
-# map property id to name (for debugging purposes)
-
-VT = {}
-for keyword, var in vars().items():
- if keyword[:3] == "VT_":
- VT[var] = keyword
-
-#
-# --------------------------------------------------------------------
-# Some common document types (root.clsid fields)
-
-WORD_CLSID = "00020900-0000-0000-C000-000000000046"
-#TODO: check Excel, PPT, ...
-
-#[PL]: Defect levels to classify parsing errors - see OleFileIO._raise_defect()
-DEFECT_UNSURE = 10 # a case which looks weird, but not sure it's a defect
-DEFECT_POTENTIAL = 20 # a potential defect
-DEFECT_INCORRECT = 30 # an error according to specifications, but parsing
- # can go on
-DEFECT_FATAL = 40 # an error which cannot be ignored, parsing is
- # impossible
-
-#[PL] add useful constants to __all__:
-for key in vars().keys():
- if key.startswith('STGTY_') or key.startswith('DEFECT_'):
- __all__.append(key)
-
-
-#--- FUNCTIONS ----------------------------------------------------------------
-
-def isOleFile (filename):
- """
- Test if file is an OLE container (according to its header).
- filename: file name or path (str, unicode)
- return: True if OLE, False otherwise.
- """
- f = open(filename, 'rb')
- header = f.read(len(MAGIC))
- if header == MAGIC:
- return True
- else:
- return False
-
-
-#TODO: replace i16 and i32 with more readable struct.unpack equivalent
-def i16(c, o = 0):
- """
- Converts a 2-bytes (16 bits) string to an integer.
-
- c: string containing bytes to convert
- o: offset of bytes to convert in string
- """
- return ord(c[o])+(ord(c[o+1])<<8)
-
-
-def i32(c, o = 0):
- """
- Converts a 4-bytes (32 bits) string to an integer.
-
- c: string containing bytes to convert
- o: offset of bytes to convert in string
- """
- return int(ord(c[o])+(ord(c[o+1])<<8)+(ord(c[o+2])<<16)+(ord(c[o+3])<<24))
- # [PL]: added int() because "<<" gives long int since Python 2.4
-
-
-def _clsid(clsid):
- """
- Converts a CLSID to a human-readable string.
- clsid: string of length 16.
- """
- assert len(clsid) == 16
- if clsid == "\0" * len(clsid):
- return ""
- return (("%08X-%04X-%04X-%02X%02X-" + "%02X" * 6) %
- ((i32(clsid, 0), i16(clsid, 4), i16(clsid, 6)) +
- tuple(map(ord, clsid[8:16]))))
-
-
-
-# UNICODE support for Old Python versions:
-# (necessary to handle storages/streams names which use Unicode)
-
-try:
- # is Unicode supported ?
- unicode
-
- def _unicode(s, errors='replace'):
- """
- Map unicode string to Latin 1. (Python with Unicode support)
-
- s: UTF-16LE unicode string to convert to Latin-1
- errors: 'replace', 'ignore' or 'strict'. See Python doc for unicode()
- """
- #TODO: test if it OleFileIO works with Unicode strings, instead of
- # converting to Latin-1.
- try:
- # First the string is converted to plain Unicode:
- # (assuming it is encoded as UTF-16 little-endian)
- u = s.decode('UTF-16LE', errors)
- if KEEP_UNICODE_NAMES:
- return u
- else:
- # Second the unicode string is converted to Latin-1
- return u.encode('latin_1', errors)
- except:
- # there was an error during Unicode to Latin-1 conversion:
- raise IOError, 'incorrect Unicode name'
-
-except NameError:
- def _unicode(s, errors='replace'):
- """
- Map unicode string to Latin 1. (Python without native Unicode support)
-
- s: UTF-16LE unicode string to convert to Latin-1
- errors: 'replace', 'ignore' or 'strict'. (ignored in this version)
- """
- # If the unicode function does not exist, we assume this is an old
- # Python version without Unicode support.
- # Null bytes are simply removed (this only works with usual Latin-1
- # strings which do not contain unicode characters>256):
- return filter(ord, s)
-
-
-def filetime2datetime(filetime):
- """
- convert FILETIME (64 bits int) to Python datetime.datetime
- """
- # TODO: manage exception when microseconds is too large
- # inspired from http://code.activestate.com/recipes/511425-filetime-to-datetime/
- _FILETIME_null_date = datetime.datetime(1601, 1, 1, 0, 0, 0)
- #debug('timedelta days=%d' % (filetime/(10*1000000*3600*24)))
- return _FILETIME_null_date + datetime.timedelta(microseconds=filetime/10)
-
-
-
-#=== CLASSES ==================================================================
-
-class OleMetadata:
- """
- class to parse and store metadata from standard properties of OLE files.
-
- Available attributes:
- codepage, title, subject, author, keywords, comments, template,
- last_saved_by, revision_number, total_edit_time, last_printed, create_time,
- last_saved_time, num_pages, num_words, num_chars, thumbnail,
- creating_application, security, codepage_doc, category, presentation_target,
- bytes, lines, paragraphs, slides, notes, hidden_slides, mm_clips,
- scale_crop, heading_pairs, titles_of_parts, manager, company, links_dirty,
- chars_with_spaces, unused, shared_doc, link_base, hlinks, hlinks_changed,
- version, dig_sig, content_type, content_status, language, doc_version
-
- Note: an attribute is set to None when not present in the properties of the
- OLE file.
-
- References for SummaryInformation stream:
- - http://msdn.microsoft.com/en-us/library/dd942545.aspx
- - http://msdn.microsoft.com/en-us/library/dd925819%28v=office.12%29.aspx
- - http://msdn.microsoft.com/en-us/library/windows/desktop/aa380376%28v=vs.85%29.aspx
- - http://msdn.microsoft.com/en-us/library/aa372045.aspx
- - http://sedna-soft.de/summary-information-stream/
- - http://poi.apache.org/apidocs/org/apache/poi/hpsf/SummaryInformation.html
-
- References for DocumentSummaryInformation stream:
- - http://msdn.microsoft.com/en-us/library/dd945671%28v=office.12%29.aspx
- - http://msdn.microsoft.com/en-us/library/windows/desktop/aa380374%28v=vs.85%29.aspx
- - http://poi.apache.org/apidocs/org/apache/poi/hpsf/DocumentSummaryInformation.html
-
- new in version 0.25
- """
-
- # attribute names for SummaryInformation stream properties:
- # (ordered by property id, starting at 1)
- SUMMARY_ATTRIBS = ['codepage', 'title', 'subject', 'author', 'keywords', 'comments',
- 'template', 'last_saved_by', 'revision_number', 'total_edit_time',
- 'last_printed', 'create_time', 'last_saved_time', 'num_pages',
- 'num_words', 'num_chars', 'thumbnail', 'creating_application',
- 'security']
-
- # attribute names for DocumentSummaryInformation stream properties:
- # (ordered by property id, starting at 1)
- DOCSUM_ATTRIBS = ['codepage_doc', 'category', 'presentation_target', 'bytes', 'lines', 'paragraphs',
- 'slides', 'notes', 'hidden_slides', 'mm_clips',
- 'scale_crop', 'heading_pairs', 'titles_of_parts', 'manager',
- 'company', 'links_dirty', 'chars_with_spaces', 'unused', 'shared_doc',
- 'link_base', 'hlinks', 'hlinks_changed', 'version', 'dig_sig',
- 'content_type', 'content_status', 'language', 'doc_version']
-
- def __init__(self):
- """
- Constructor for OleMetadata
- All attributes are set to None by default
- """
- # properties from SummaryInformation stream
- self.codepage = None
- self.title = None
- self.subject = None
- self.author = None
- self.keywords = None
- self.comments = None
- self.template = None
- self.last_saved_by = None
- self.revision_number = None
- self.total_edit_time = None
- self.last_printed = None
- self.create_time = None
- self.last_saved_time = None
- self.num_pages = None
- self.num_words = None
- self.num_chars = None
- self.thumbnail = None
- self.creating_application = None
- self.security = None
- # properties from DocumentSummaryInformation stream
- self.codepage_doc = None
- self.category = None
- self.presentation_target = None
- self.bytes = None
- self.lines = None
- self.paragraphs = None
- self.slides = None
- self.notes = None
- self.hidden_slides = None
- self.mm_clips = None
- self.scale_crop = None
- self.heading_pairs = None
- self.titles_of_parts = None
- self.manager = None
- self.company = None
- self.links_dirty = None
- self.chars_with_spaces = None
- self.unused = None
- self.shared_doc = None
- self.link_base = None
- self.hlinks = None
- self.hlinks_changed = None
- self.version = None
- self.dig_sig = None
- self.content_type = None
- self.content_status = None
- self.language = None
- self.doc_version = None
-
-
- def parse_properties(self, olefile):
- """
- Parse standard properties of an OLE file, from the streams
- "\x05SummaryInformation" and "\x05DocumentSummaryInformation",
- if present.
- Properties are converted to strings, integers or python datetime objects.
- If a property is not present, its value is set to None.
- """
- # first set all attributes to None:
- for attrib in (self.SUMMARY_ATTRIBS + self.DOCSUM_ATTRIBS):
- setattr(self, attrib, None)
- if olefile.exists("\x05SummaryInformation"):
- # get properties from the stream:
- # (converting timestamps to python datetime, except total_edit_time,
- # which is property #10)
- props = olefile.getproperties("\x05SummaryInformation",
- convert_time=True, no_conversion=[10])
- # store them into this object's attributes:
- for i in range(len(self.SUMMARY_ATTRIBS)):
- # ids for standards properties start at 0x01, until 0x13
- value = props.get(i+1, None)
- setattr(self, self.SUMMARY_ATTRIBS[i], value)
- if olefile.exists("\x05DocumentSummaryInformation"):
- # get properties from the stream:
- props = olefile.getproperties("\x05DocumentSummaryInformation",
- convert_time=True)
- # store them into this object's attributes:
- for i in range(len(self.DOCSUM_ATTRIBS)):
- # ids for standards properties start at 0x01, until 0x13
- value = props.get(i+1, None)
- setattr(self, self.DOCSUM_ATTRIBS[i], value)
-
- def dump(self):
- """
- Dump all metadata, for debugging purposes.
- """
- print 'Properties from SummaryInformation stream:'
- for prop in self.SUMMARY_ATTRIBS:
- value = getattr(self, prop)
- print '- %s: %s' % (prop, repr(value))
- print 'Properties from DocumentSummaryInformation stream:'
- for prop in self.DOCSUM_ATTRIBS:
- value = getattr(self, prop)
- print '- %s: %s' % (prop, repr(value))
-
-
-#--- _OleStream ---------------------------------------------------------------
-
-class _OleStream(StringIO.StringIO):
- """
- OLE2 Stream
-
- Returns a read-only file object which can be used to read
- the contents of a OLE stream (instance of the StringIO class).
- To open a stream, use the openstream method in the OleFile class.
-
- This function can be used with either ordinary streams,
- or ministreams, depending on the offset, sectorsize, and
- fat table arguments.
-
- Attributes:
- - size: actual size of data stream, after it was opened.
- """
-
- # FIXME: should store the list of sects obtained by following
- # the fat chain, and load new sectors on demand instead of
- # loading it all in one go.
-
- def __init__(self, fp, sect, size, offset, sectorsize, fat, filesize):
- """
- Constructor for _OleStream class.
-
- fp : file object, the OLE container or the MiniFAT stream
- sect : sector index of first sector in the stream
- size : total size of the stream
- offset : offset in bytes for the first FAT or MiniFAT sector
- sectorsize: size of one sector
- fat : array/list of sector indexes (FAT or MiniFAT)
- filesize : size of OLE file (for debugging)
- return : a StringIO instance containing the OLE stream
- """
- debug('_OleStream.__init__:')
- debug(' sect=%d (%X), size=%d, offset=%d, sectorsize=%d, len(fat)=%d, fp=%s'
- %(sect,sect,size,offset,sectorsize,len(fat), repr(fp)))
- #[PL] To detect malformed documents with FAT loops, we compute the
- # expected number of sectors in the stream:
- unknown_size = False
- if size==0x7FFFFFFF:
- # this is the case when called from OleFileIO._open(), and stream
- # size is not known in advance (for example when reading the
- # Directory stream). Then we can only guess maximum size:
- size = len(fat)*sectorsize
- # and we keep a record that size was unknown:
- unknown_size = True
- debug(' stream with UNKNOWN SIZE')
- nb_sectors = (size + (sectorsize-1)) / sectorsize
- debug('nb_sectors = %d' % nb_sectors)
- # This number should (at least) be less than the total number of
- # sectors in the given FAT:
- if nb_sectors > len(fat):
- raise IOError, 'malformed OLE document, stream too large'
- # optimization(?): data is first a list of strings, and join() is called
- # at the end to concatenate all in one string.
- # (this may not be really useful with recent Python versions)
- data = []
- # if size is zero, then first sector index should be ENDOFCHAIN:
- if size == 0 and sect != ENDOFCHAIN:
- debug('size == 0 and sect != ENDOFCHAIN:')
- raise IOError, 'incorrect OLE sector index for empty stream'
- #[PL] A fixed-length for loop is used instead of an undefined while
- # loop to avoid DoS attacks:
- for i in xrange(nb_sectors):
- # Sector index may be ENDOFCHAIN, but only if size was unknown
- if sect == ENDOFCHAIN:
- if unknown_size:
- break
- else:
- # else this means that the stream is smaller than declared:
- debug('sect=ENDOFCHAIN before expected size')
- raise IOError, 'incomplete OLE stream'
- # sector index should be within FAT:
- if sect<0 or sect>=len(fat):
- debug('sect=%d (%X) / len(fat)=%d' % (sect, sect, len(fat)))
- debug('i=%d / nb_sectors=%d' %(i, nb_sectors))
-## tmp_data = string.join(data, "")
-## f = open('test_debug.bin', 'wb')
-## f.write(tmp_data)
-## f.close()
-## debug('data read so far: %d bytes' % len(tmp_data))
- raise IOError, 'incorrect OLE FAT, sector index out of range'
- #TODO: merge this code with OleFileIO.getsect() ?
- #TODO: check if this works with 4K sectors:
- try:
- fp.seek(offset + sectorsize * sect)
- except:
- debug('sect=%d, seek=%d, filesize=%d' %
- (sect, offset+sectorsize*sect, filesize))
- raise IOError, 'OLE sector index out of range'
- sector_data = fp.read(sectorsize)
- # [PL] check if there was enough data:
- # Note: if sector is the last of the file, sometimes it is not a
- # complete sector (of 512 or 4K), so we may read less than
- # sectorsize.
- if len(sector_data)!=sectorsize and sect!=(len(fat)-1):
- debug('sect=%d / len(fat)=%d, seek=%d / filesize=%d, len read=%d' %
- (sect, len(fat), offset+sectorsize*sect, filesize, len(sector_data)))
- debug('seek+len(read)=%d' % (offset+sectorsize*sect+len(sector_data)))
- raise IOError, 'incomplete OLE sector'
- data.append(sector_data)
- # jump to next sector in the FAT:
- try:
- sect = fat[sect]
- except IndexError:
- # [PL] if pointer is out of the FAT an exception is raised
- raise IOError, 'incorrect OLE FAT, sector index out of range'
- #[PL] Last sector should be a "end of chain" marker:
- if sect != ENDOFCHAIN:
- raise IOError, 'incorrect last sector index in OLE stream'
- data = string.join(data, "")
- # Data is truncated to the actual stream size:
- if len(data) >= size:
- data = data[:size]
- # actual stream size is stored for future use:
- self.size = size
- elif unknown_size:
- # actual stream size was not known, now we know the size of read
- # data:
- self.size = len(data)
- else:
- # read data is less than expected:
- debug('len(data)=%d, size=%d' % (len(data), size))
- raise IOError, 'OLE stream size is less than declared'
- # when all data is read in memory, StringIO constructor is called
- StringIO.StringIO.__init__(self, data)
- # Then the _OleStream object can be used as a read-only file object.
-
-
-#--- _OleDirectoryEntry -------------------------------------------------------
-
-class _OleDirectoryEntry:
-
- """
- OLE2 Directory Entry
- """
- #[PL] parsing code moved from OleFileIO.loaddirectory
-
- # struct to parse directory entries:
- # <: little-endian byte order, standard sizes
- # (note: this should guarantee that Q returns a 64 bits int)
- # 64s: string containing entry name in unicode (max 31 chars) + null char
- # H: uint16, number of bytes used in name buffer, including null = (len+1)*2
- # B: uint8, dir entry type (between 0 and 5)
- # B: uint8, color: 0=black, 1=red
- # I: uint32, index of left child node in the red-black tree, NOSTREAM if none
- # I: uint32, index of right child node in the red-black tree, NOSTREAM if none
- # I: uint32, index of child root node if it is a storage, else NOSTREAM
- # 16s: CLSID, unique identifier (only used if it is a storage)
- # I: uint32, user flags
- # Q (was 8s): uint64, creation timestamp or zero
- # Q (was 8s): uint64, modification timestamp or zero
- # I: uint32, SID of first sector if stream or ministream, SID of 1st sector
- # of stream containing ministreams if root entry, 0 otherwise
- # I: uint32, total stream size in bytes if stream (low 32 bits), 0 otherwise
- # I: uint32, total stream size in bytes if stream (high 32 bits), 0 otherwise
- STRUCT_DIRENTRY = '<64sHBBIII16sIQQIII'
- # size of a directory entry: 128 bytes
- DIRENTRY_SIZE = 128
- assert struct.calcsize(STRUCT_DIRENTRY) == DIRENTRY_SIZE
-
-
- def __init__(self, entry, sid, olefile):
- """
- Constructor for an _OleDirectoryEntry object.
- Parses a 128-bytes entry from the OLE Directory stream.
-
- entry : string (must be 128 bytes long)
- sid : index of this directory entry in the OLE file directory
- olefile: OleFileIO containing this directory entry
- """
- self.sid = sid
- # ref to olefile is stored for future use
- self.olefile = olefile
- # kids is a list of children entries, if this entry is a storage:
- # (list of _OleDirectoryEntry objects)
- self.kids = []
- # kids_dict is a dictionary of children entries, indexed by their
- # name in lowercase: used to quickly find an entry, and to detect
- # duplicates
- self.kids_dict = {}
- # flag used to detect if the entry is referenced more than once in
- # directory:
- self.used = False
- # decode DirEntry
- (
- name,
- namelength,
- self.entry_type,
- self.color,
- self.sid_left,
- self.sid_right,
- self.sid_child,
- clsid,
- self.dwUserFlags,
- self.createTime,
- self.modifyTime,
- self.isectStart,
- sizeLow,
- sizeHigh
- ) = struct.unpack(_OleDirectoryEntry.STRUCT_DIRENTRY, entry)
- if self.entry_type not in [STGTY_ROOT, STGTY_STORAGE, STGTY_STREAM, STGTY_EMPTY]:
- olefile._raise_defect(DEFECT_INCORRECT, 'unhandled OLE storage type')
- # only first directory entry can (and should) be root:
- if self.entry_type == STGTY_ROOT and sid != 0:
- olefile._raise_defect(DEFECT_INCORRECT, 'duplicate OLE root entry')
- if sid == 0 and self.entry_type != STGTY_ROOT:
- olefile._raise_defect(DEFECT_INCORRECT, 'incorrect OLE root entry')
- #debug (struct.unpack(fmt_entry, entry[:len_entry]))
- # name should be at most 31 unicode characters + null character,
- # so 64 bytes in total (31*2 + 2):
- if namelength>64:
- olefile._raise_defect(DEFECT_INCORRECT, 'incorrect DirEntry name length')
- # if exception not raised, namelength is set to the maximum value:
- namelength = 64
- # only characters without ending null char are kept:
- name = name[:(namelength-2)]
- # name is converted from unicode to Latin-1:
- self.name = _unicode(name)
-
- debug('DirEntry SID=%d: %s' % (self.sid, repr(self.name)))
- debug(' - type: %d' % self.entry_type)
- debug(' - sect: %d' % self.isectStart)
- debug(' - SID left: %d, right: %d, child: %d' % (self.sid_left,
- self.sid_right, self.sid_child))
-
- # sizeHigh is only used for 4K sectors, it should be zero for 512 bytes
- # sectors, BUT apparently some implementations set it as 0xFFFFFFFFL, 1
- # or some other value so it cannot be raised as a defect in general:
- if olefile.sectorsize == 512:
- if sizeHigh != 0 and sizeHigh != 0xFFFFFFFFL:
- debug('sectorsize=%d, sizeLow=%d, sizeHigh=%d (%X)' %
- (olefile.sectorsize, sizeLow, sizeHigh, sizeHigh))
- olefile._raise_defect(DEFECT_UNSURE, 'incorrect OLE stream size')
- self.size = sizeLow
- else:
- self.size = sizeLow + (long(sizeHigh)<<32)
- debug(' - size: %d (sizeLow=%d, sizeHigh=%d)' % (self.size, sizeLow, sizeHigh))
-
- self.clsid = _clsid(clsid)
- # a storage should have a null size, BUT some implementations such as
- # Word 8 for Mac seem to allow non-null values => Potential defect:
- if self.entry_type == STGTY_STORAGE and self.size != 0:
- olefile._raise_defect(DEFECT_POTENTIAL, 'OLE storage with size>0')
- # check if stream is not already referenced elsewhere:
- if self.entry_type in (STGTY_ROOT, STGTY_STREAM) and self.size>0:
- if self.size < olefile.minisectorcutoff \
- and self.entry_type==STGTY_STREAM: # only streams can be in MiniFAT
- # ministream object
- minifat = True
- else:
- minifat = False
- olefile._check_duplicate_stream(self.isectStart, minifat)
-
-
-
- def build_storage_tree(self):
- """
- Read and build the red-black tree attached to this _OleDirectoryEntry
- object, if it is a storage.
- Note that this method builds a tree of all subentries, so it should
- only be called for the root object once.
- """
- debug('build_storage_tree: SID=%d - %s - sid_child=%d'
- % (self.sid, repr(self.name), self.sid_child))
- if self.sid_child != NOSTREAM:
- # if child SID is not NOSTREAM, then this entry is a storage.
- # Let's walk through the tree of children to fill the kids list:
- self.append_kids(self.sid_child)
-
- # Note from OpenOffice documentation: the safest way is to
- # recreate the tree because some implementations may store broken
- # red-black trees...
-
- # in the OLE file, entries are sorted on (length, name).
- # for convenience, we sort them on name instead:
- # (see __cmp__ method in this class)
- self.kids.sort()
-
-
- def append_kids(self, child_sid):
- """
- Walk through red-black tree of children of this directory entry to add
- all of them to the kids list. (recursive method)
-
- child_sid : index of child directory entry to use, or None when called
- first time for the root. (only used during recursion)
- """
- #[PL] this method was added to use simple recursion instead of a complex
- # algorithm.
- # if this is not a storage or a leaf of the tree, nothing to do:
- if child_sid == NOSTREAM:
- return
- # check if child SID is in the proper range:
- if child_sid<0 or child_sid>=len(self.olefile.direntries):
- self.olefile._raise_defect(DEFECT_FATAL, 'OLE DirEntry index out of range')
- # get child direntry:
- child = self.olefile._load_direntry(child_sid) #direntries[child_sid]
- debug('append_kids: child_sid=%d - %s - sid_left=%d, sid_right=%d, sid_child=%d'
- % (child.sid, repr(child.name), child.sid_left, child.sid_right, child.sid_child))
- # the directory entries are organized as a red-black tree.
- # (cf. Wikipedia for details)
- # First walk through left side of the tree:
- self.append_kids(child.sid_left)
- # Check if its name is not already used (case-insensitive):
- name_lower = child.name.lower()
- if self.kids_dict.has_key(name_lower):
- self.olefile._raise_defect(DEFECT_INCORRECT,
- "Duplicate filename in OLE storage")
- # Then the child_sid _OleDirectoryEntry object is appended to the
- # kids list and dictionary:
- self.kids.append(child)
- self.kids_dict[name_lower] = child
- # Check if kid was not already referenced in a storage:
- if child.used:
- self.olefile._raise_defect(DEFECT_INCORRECT,
- 'OLE Entry referenced more than once')
- child.used = True
- # Finally walk through right side of the tree:
- self.append_kids(child.sid_right)
- # Afterwards build kid's own tree if it's also a storage:
- child.build_storage_tree()
-
-
- def __cmp__(self, other):
- "Compare entries by name"
- return cmp(self.name, other.name)
- #TODO: replace by the same function as MS implementation ?
- # (order by name length first, then case-insensitive order)
-
-
- def dump(self, tab = 0):
- "Dump this entry, and all its subentries (for debug purposes only)"
- TYPES = ["(invalid)", "(storage)", "(stream)", "(lockbytes)",
- "(property)", "(root)"]
- print " "*tab + repr(self.name), TYPES[self.entry_type],
- if self.entry_type in (STGTY_STREAM, STGTY_ROOT):
- print self.size, "bytes",
- print
- if self.entry_type in (STGTY_STORAGE, STGTY_ROOT) and self.clsid:
- print " "*tab + "{%s}" % self.clsid
-
- for kid in self.kids:
- kid.dump(tab + 2)
-
-
- def getmtime(self):
- """
- Return modification time of a directory entry.
-
- return: None if modification time is null, a python datetime object
- otherwise (UTC timezone)
-
- new in version 0.26
- """
- if self.modifyTime == 0:
- return None
- return filetime2datetime(self.modifyTime)
-
-
- def getctime(self):
- """
- Return creation time of a directory entry.
-
- return: None if modification time is null, a python datetime object
- otherwise (UTC timezone)
-
- new in version 0.26
- """
- if self.createTime == 0:
- return None
- return filetime2datetime(self.createTime)
-
-
-#--- OleFileIO ----------------------------------------------------------------
-
-class OleFileIO:
- """
- OLE container object
-
- This class encapsulates the interface to an OLE 2 structured
- storage file. Use the {@link listdir} and {@link openstream} methods to
- access the contents of this file.
-
- Object names are given as a list of strings, one for each subentry
- level. The root entry should be omitted. For example, the following
- code extracts all image streams from a Microsoft Image Composer file:
-
- ole = OleFileIO("fan.mic")
-
- for entry in ole.listdir():
- if entry[1:2] == "Image":
- fin = ole.openstream(entry)
- fout = open(entry[0:1], "wb")
- while True:
- s = fin.read(8192)
- if not s:
- break
- fout.write(s)
-
- You can use the viewer application provided with the Python Imaging
- Library to view the resulting files (which happens to be standard
- TIFF files).
- """
-
- def __init__(self, filename = None, raise_defects=DEFECT_FATAL):
- """
- Constructor for OleFileIO class.
-
- filename: file to open.
- raise_defects: minimal level for defects to be raised as exceptions.
- (use DEFECT_FATAL for a typical application, DEFECT_INCORRECT for a
- security-oriented application, see source code for details)
- """
- # minimal level for defects to be raised as exceptions:
- self._raise_defects_level = raise_defects
- # list of defects/issues not raised as exceptions:
- # tuples of (exception type, message)
- self.parsing_issues = []
- if filename:
- self.open(filename)
-
-
- def _raise_defect(self, defect_level, message, exception_type=IOError):
- """
- This method should be called for any defect found during file parsing.
- It may raise an IOError exception according to the minimal level chosen
- for the OleFileIO object.
-
- defect_level: defect level, possible values are:
- DEFECT_UNSURE : a case which looks weird, but not sure it's a defect
- DEFECT_POTENTIAL : a potential defect
- DEFECT_INCORRECT : an error according to specifications, but parsing can go on
- DEFECT_FATAL : an error which cannot be ignored, parsing is impossible
- message: string describing the defect, used with raised exception.
- exception_type: exception class to be raised, IOError by default
- """
- # added by [PL]
- if defect_level >= self._raise_defects_level:
- raise exception_type, message
- else:
- # just record the issue, no exception raised:
- self.parsing_issues.append((exception_type, message))
-
-
- def open(self, filename):
- """
- Open an OLE2 file.
- Reads the header, FAT and directory.
-
- filename: string-like or file-like object
- """
- #[PL] check if filename is a string-like or file-like object:
- # (it is better to check for a read() method)
- if hasattr(filename, 'read'):
- # file-like object
- self.fp = filename
- else:
- # string-like object: filename of file on disk
- #TODO: if larger than 1024 bytes, this could be the actual data => StringIO
- self.fp = open(filename, "rb")
- # old code fails if filename is not a plain string:
- #if type(filename) == type(""):
- # self.fp = open(filename, "rb")
- #else:
- # self.fp = filename
- # obtain the filesize by using seek and tell, which should work on most
- # file-like objects:
- #TODO: do it above, using getsize with filename when possible?
- #TODO: fix code to fail with clear exception when filesize cannot be obtained
- self.fp.seek(0, os.SEEK_END)
- try:
- filesize = self.fp.tell()
- finally:
- self.fp.seek(0)
- self._filesize = filesize
-
- # lists of streams in FAT and MiniFAT, to detect duplicate references
- # (list of indexes of first sectors of each stream)
- self._used_streams_fat = []
- self._used_streams_minifat = []
-
- header = self.fp.read(512)
-
- if len(header) != 512 or header[:8] != MAGIC:
- self._raise_defect(DEFECT_FATAL, "not an OLE2 structured storage file")
-
- # [PL] header structure according to AAF specifications:
- ##Header
- ##struct StructuredStorageHeader { // [offset from start (bytes), length (bytes)]
- ##BYTE _abSig[8]; // [00H,08] {0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1,
- ## // 0x1a, 0xe1} for current version
- ##CLSID _clsid; // [08H,16] reserved must be zero (WriteClassStg/
- ## // GetClassFile uses root directory class id)
- ##USHORT _uMinorVersion; // [18H,02] minor version of the format: 33 is
- ## // written by reference implementation
- ##USHORT _uDllVersion; // [1AH,02] major version of the dll/format: 3 for
- ## // 512-byte sectors, 4 for 4 KB sectors
- ##USHORT _uByteOrder; // [1CH,02] 0xFFFE: indicates Intel byte-ordering
- ##USHORT _uSectorShift; // [1EH,02] size of sectors in power-of-two;
- ## // typically 9 indicating 512-byte sectors
- ##USHORT _uMiniSectorShift; // [20H,02] size of mini-sectors in power-of-two;
- ## // typically 6 indicating 64-byte mini-sectors
- ##USHORT _usReserved; // [22H,02] reserved, must be zero
- ##ULONG _ulReserved1; // [24H,04] reserved, must be zero
- ##FSINDEX _csectDir; // [28H,04] must be zero for 512-byte sectors,
- ## // number of SECTs in directory chain for 4 KB
- ## // sectors
- ##FSINDEX _csectFat; // [2CH,04] number of SECTs in the FAT chain
- ##SECT _sectDirStart; // [30H,04] first SECT in the directory chain
- ##DFSIGNATURE _signature; // [34H,04] signature used for transactions; must
- ## // be zero. The reference implementation
- ## // does not support transactions
- ##ULONG _ulMiniSectorCutoff; // [38H,04] maximum size for a mini stream;
- ## // typically 4096 bytes
- ##SECT _sectMiniFatStart; // [3CH,04] first SECT in the MiniFAT chain
- ##FSINDEX _csectMiniFat; // [40H,04] number of SECTs in the MiniFAT chain
- ##SECT _sectDifStart; // [44H,04] first SECT in the DIFAT chain
- ##FSINDEX _csectDif; // [48H,04] number of SECTs in the DIFAT chain
- ##SECT _sectFat[109]; // [4CH,436] the SECTs of first 109 FAT sectors
- ##};
-
- # [PL] header decoding:
- # '<' indicates little-endian byte ordering for Intel (cf. struct module help)
- fmt_header = '<8s16sHHHHHHLLLLLLLLLL'
- header_size = struct.calcsize(fmt_header)
- debug( "fmt_header size = %d, +FAT = %d" % (header_size, header_size + 109*4) )
- header1 = header[:header_size]
- (
- self.Sig,
- self.clsid,
- self.MinorVersion,
- self.DllVersion,
- self.ByteOrder,
- self.SectorShift,
- self.MiniSectorShift,
- self.Reserved, self.Reserved1,
- self.csectDir,
- self.csectFat,
- self.sectDirStart,
- self.signature,
- self.MiniSectorCutoff,
- self.MiniFatStart,
- self.csectMiniFat,
- self.sectDifStart,
- self.csectDif
- ) = struct.unpack(fmt_header, header1)
- debug( struct.unpack(fmt_header, header1))
-
- if self.Sig != '\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1':
- # OLE signature should always be present
- self._raise_defect(DEFECT_FATAL, "incorrect OLE signature")
- if self.clsid != '\x00'*16:
- # according to AAF specs, CLSID should always be zero
- self._raise_defect(DEFECT_INCORRECT, "incorrect CLSID in OLE header")
- debug( "MinorVersion = %d" % self.MinorVersion )
- debug( "DllVersion = %d" % self.DllVersion )
- if self.DllVersion not in [3, 4]:
- # version 3: usual format, 512 bytes per sector
- # version 4: large format, 4K per sector
- self._raise_defect(DEFECT_INCORRECT, "incorrect DllVersion in OLE header")
- debug( "ByteOrder = %X" % self.ByteOrder )
- if self.ByteOrder != 0xFFFE:
- # For now only common little-endian documents are handled correctly
- self._raise_defect(DEFECT_FATAL, "incorrect ByteOrder in OLE header")
- # TODO: add big-endian support for documents created on Mac ?
- self.SectorSize = 2**self.SectorShift
- debug( "sector_size = %d" % self.SectorSize )
- if self.SectorSize not in [512, 4096]:
- self._raise_defect(DEFECT_INCORRECT, "incorrect sector_size in OLE header")
- if (self.DllVersion==3 and self.SectorSize!=512) \
- or (self.DllVersion==4 and self.SectorSize!=4096):
- self._raise_defect(DEFECT_INCORRECT, "sector_size does not match DllVersion in OLE header")
- self.MiniSectorSize = 2**self.MiniSectorShift
- debug( "mini_sector_size = %d" % self.MiniSectorSize )
- if self.MiniSectorSize not in [64]:
- self._raise_defect(DEFECT_INCORRECT, "incorrect mini_sector_size in OLE header")
- if self.Reserved != 0 or self.Reserved1 != 0:
- self._raise_defect(DEFECT_INCORRECT, "incorrect OLE header (non-null reserved bytes)")
- debug( "csectDir = %d" % self.csectDir )
- if self.SectorSize==512 and self.csectDir!=0:
- self._raise_defect(DEFECT_INCORRECT, "incorrect csectDir in OLE header")
- debug( "num_fat_sectors = %d" % self.csectFat )
- debug( "first_dir_sector = %X" % self.sectDirStart )
- debug( "transaction_signature_number = %d" % self.signature )
- # Signature should be zero, BUT some implementations do not follow this
- # rule => only a potential defect:
- if self.signature != 0:
- self._raise_defect(DEFECT_POTENTIAL, "incorrect OLE header (transaction_signature_number>0)")
- debug( "mini_stream_cutoff_size = %d" % self.MiniSectorCutoff )
- debug( "first_mini_fat_sector = %X" % self.MiniFatStart )
- debug( "num_mini_fat_sectors = %d" % self.csectMiniFat )
- debug( "first_difat_sector = %X" % self.sectDifStart )
- debug( "num_difat_sectors = %d" % self.csectDif )
-
- # calculate the number of sectors in the file
- # (-1 because header doesn't count)
- self.nb_sect = ( (filesize + self.SectorSize-1) / self.SectorSize) - 1
- debug( "Number of sectors in the file: %d" % self.nb_sect )
-
- # file clsid (probably never used, so we don't store it)
- clsid = _clsid(header[8:24])
- self.sectorsize = self.SectorSize #1 << i16(header, 30)
- self.minisectorsize = self.MiniSectorSize #1 << i16(header, 32)
- self.minisectorcutoff = self.MiniSectorCutoff # i32(header, 56)
-
- # check known streams for duplicate references (these are always in FAT,
- # never in MiniFAT):
- self._check_duplicate_stream(self.sectDirStart)
- # check MiniFAT only if it is not empty:
- if self.csectMiniFat:
- self._check_duplicate_stream(self.MiniFatStart)
- # check DIFAT only if it is not empty:
- if self.csectDif:
- self._check_duplicate_stream(self.sectDifStart)
-
- # Load file allocation tables
- self.loadfat(header)
- # Load direcory. This sets both the direntries list (ordered by sid)
- # and the root (ordered by hierarchy) members.
- self.loaddirectory(self.sectDirStart)#i32(header, 48))
- self.ministream = None
- self.minifatsect = self.MiniFatStart #i32(header, 60)
-
-
- def close(self):
- """
- close the OLE file, to release the file object
- """
- self.fp.close()
-
-
- def _check_duplicate_stream(self, first_sect, minifat=False):
- """
- Checks if a stream has not been already referenced elsewhere.
- This method should only be called once for each known stream, and only
- if stream size is not null.
- first_sect: index of first sector of the stream in FAT
- minifat: if True, stream is located in the MiniFAT, else in the FAT
- """
- if minifat:
- debug('_check_duplicate_stream: sect=%d in MiniFAT' % first_sect)
- used_streams = self._used_streams_minifat
- else:
- debug('_check_duplicate_stream: sect=%d in FAT' % first_sect)
- # some values can be safely ignored (not a real stream):
- if first_sect in (DIFSECT,FATSECT,ENDOFCHAIN,FREESECT):
- return
- used_streams = self._used_streams_fat
- #TODO: would it be more efficient using a dict or hash values, instead
- # of a list of long ?
- if first_sect in used_streams:
- self._raise_defect(DEFECT_INCORRECT, 'Stream referenced twice')
- else:
- used_streams.append(first_sect)
-
-
- def dumpfat(self, fat, firstindex=0):
- "Displays a part of FAT in human-readable form for debugging purpose"
- # [PL] added only for debug
- if not DEBUG_MODE:
- return
- # dictionary to convert special FAT values in human-readable strings
- VPL=8 # valeurs par ligne (8+1 * 8+1 = 81)
- fatnames = {
- FREESECT: "..free..",
- ENDOFCHAIN: "[ END. ]",
- FATSECT: "FATSECT ",
- DIFSECT: "DIFSECT "
- }
- nbsect = len(fat)
- nlines = (nbsect+VPL-1)/VPL
- print "index",
- for i in range(VPL):
- print ("%8X" % i),
- print ""
- for l in range(nlines):
- index = l*VPL
- print ("%8X:" % (firstindex+index)),
- for i in range(index, index+VPL):
- if i>=nbsect:
- break
- sect = fat[i]
- if sect in fatnames:
- nom = fatnames[sect]
- else:
- if sect == i+1:
- nom = " --->"
- else:
- nom = "%8X" % sect
- print nom,
- print ""
-
-
- def dumpsect(self, sector, firstindex=0):
- "Displays a sector in a human-readable form, for debugging purpose."
- if not DEBUG_MODE:
- return
- VPL=8 # number of values per line (8+1 * 8+1 = 81)
- tab = array.array(UINT32, sector)
- nbsect = len(tab)
- nlines = (nbsect+VPL-1)/VPL
- print "index",
- for i in range(VPL):
- print ("%8X" % i),
- print ""
- for l in range(nlines):
- index = l*VPL
- print ("%8X:" % (firstindex+index)),
- for i in range(index, index+VPL):
- if i>=nbsect:
- break
- sect = tab[i]
- nom = "%8X" % sect
- print nom,
- print ""
-
- def sect2array(self, sect):
- """
- convert a sector to an array of 32 bits unsigned integers,
- swapping bytes on big endian CPUs such as PowerPC (old Macs)
- """
- a = array.array(UINT32, sect)
- # if CPU is big endian, swap bytes:
- if sys.byteorder == 'big':
- a.byteswap()
- return a
-
-
- def loadfat_sect(self, sect):
- """
- Adds the indexes of the given sector to the FAT
- sect: string containing the first FAT sector, or array of long integers
- return: index of last FAT sector.
- """
- # a FAT sector is an array of ulong integers.
- if isinstance(sect, array.array):
- # if sect is already an array it is directly used
- fat1 = sect
- else:
- # if it's a raw sector, it is parsed in an array
- fat1 = self.sect2array(sect)
- self.dumpsect(sect)
- # The FAT is a sector chain starting at the first index of itself.
- for isect in fat1:
- #print "isect = %X" % isect
- if isect == ENDOFCHAIN or isect == FREESECT:
- # the end of the sector chain has been reached
- break
- # read the FAT sector
- s = self.getsect(isect)
- # parse it as an array of 32 bits integers, and add it to the
- # global FAT array
- nextfat = self.sect2array(s)
- self.fat = self.fat + nextfat
- return isect
-
-
- def loadfat(self, header):
- """
- Load the FAT table.
- """
- # The header contains a sector numbers
- # for the first 109 FAT sectors. Additional sectors are
- # described by DIF blocks
-
- sect = header[76:512]
- debug( "len(sect)=%d, so %d integers" % (len(sect), len(sect)/4) )
- #fat = []
- # [PL] FAT is an array of 32 bits unsigned ints, it's more effective
- # to use an array than a list in Python.
- # It's initialized as empty first:
- self.fat = array.array(UINT32)
- self.loadfat_sect(sect)
- #self.dumpfat(self.fat)
-## for i in range(0, len(sect), 4):
-## ix = i32(sect, i)
-## #[PL] if ix == -2 or ix == -1: # ix == 0xFFFFFFFEL or ix == 0xFFFFFFFFL:
-## if ix == 0xFFFFFFFEL or ix == 0xFFFFFFFFL:
-## break
-## s = self.getsect(ix)
-## #fat = fat + map(lambda i, s=s: i32(s, i), range(0, len(s), 4))
-## fat = fat + array.array(UINT32, s)
- if self.csectDif != 0:
- # [PL] There's a DIFAT because file is larger than 6.8MB
- # some checks just in case:
- if self.csectFat <= 109:
- # there must be at least 109 blocks in header and the rest in
- # DIFAT, so number of sectors must be >109.
- self._raise_defect(DEFECT_INCORRECT, 'incorrect DIFAT, not enough sectors')
- if self.sectDifStart >= self.nb_sect:
- # initial DIFAT block index must be valid
- self._raise_defect(DEFECT_FATAL, 'incorrect DIFAT, first index out of range')
- debug( "DIFAT analysis..." )
- # We compute the necessary number of DIFAT sectors :
- # (each DIFAT sector = 127 pointers + 1 towards next DIFAT sector)
- nb_difat = (self.csectFat-109 + 126)/127
- debug( "nb_difat = %d" % nb_difat )
- if self.csectDif != nb_difat:
- raise IOError, 'incorrect DIFAT'
- isect_difat = self.sectDifStart
- for i in xrange(nb_difat):
- debug( "DIFAT block %d, sector %X" % (i, isect_difat) )
- #TODO: check if corresponding FAT SID = DIFSECT
- sector_difat = self.getsect(isect_difat)
- difat = self.sect2array(sector_difat)
- self.dumpsect(sector_difat)
- self.loadfat_sect(difat[:127])
- # last DIFAT pointer is next DIFAT sector:
- isect_difat = difat[127]
- debug( "next DIFAT sector: %X" % isect_difat )
- # checks:
- if isect_difat not in [ENDOFCHAIN, FREESECT]:
- # last DIFAT pointer value must be ENDOFCHAIN or FREESECT
- raise IOError, 'incorrect end of DIFAT'
-## if len(self.fat) != self.num_fat_sectors:
-## # FAT should contain num_fat_sectors blocks
-## print "FAT length: %d instead of %d" % (len(self.fat), self.num_fat_sectors)
-## raise IOError, 'incorrect DIFAT'
- # since FAT is read from fixed-size sectors, it may contain more values
- # than the actual number of sectors in the file.
- # Keep only the relevant sector indexes:
- if len(self.fat) > self.nb_sect:
- debug('len(fat)=%d, shrunk to nb_sect=%d' % (len(self.fat), self.nb_sect))
- self.fat = self.fat[:self.nb_sect]
- debug('\nFAT:')
- self.dumpfat(self.fat)
-
-
- def loadminifat(self):
- """
- Load the MiniFAT table.
- """
- # MiniFAT is stored in a standard sub-stream, pointed to by a header
- # field.
- # NOTE: there are two sizes to take into account for this stream:
- # 1) Stream size is calculated according to the number of sectors
- # declared in the OLE header. This allocated stream may be more than
- # needed to store the actual sector indexes.
- # (self.num_mini_fat_sectors is the number of sectors of size self.sector_size)
- stream_size = self.csectMiniFat * self.SectorSize
- # 2) Actually used size is calculated by dividing the MiniStream size
- # (given by root entry size) by the size of mini sectors, *4 for
- # 32 bits indexes:
- nb_minisectors = (self.root.size + self.MiniSectorSize-1) / self.MiniSectorSize
- used_size = nb_minisectors * 4
- debug('loadminifat(): minifatsect=%d, nb FAT sectors=%d, used_size=%d, stream_size=%d, nb MiniSectors=%d' %
- (self.minifatsect, self.csectMiniFat, used_size, stream_size, nb_minisectors))
- if used_size > stream_size:
- # This is not really a problem, but may indicate a wrong implementation:
- self._raise_defect(DEFECT_INCORRECT, 'OLE MiniStream is larger than MiniFAT')
- # In any case, first read stream_size:
- s = self._open(self.minifatsect, stream_size, force_FAT=True).read()
- #[PL] Old code replaced by an array:
- #self.minifat = map(lambda i, s=s: i32(s, i), range(0, len(s), 4))
- self.minifat = self.sect2array(s)
- # Then shrink the array to used size, to avoid indexes out of MiniStream:
- debug('MiniFAT shrunk from %d to %d sectors' % (len(self.minifat), nb_minisectors))
- self.minifat = self.minifat[:nb_minisectors]
- debug('loadminifat(): len=%d' % len(self.minifat))
- debug('\nMiniFAT:')
- self.dumpfat(self.minifat)
-
- def getsect(self, sect):
- """
- Read given sector from file on disk.
- sect: sector index
- returns a string containing the sector data.
- """
- # [PL] this original code was wrong when sectors are 4KB instead of
- # 512 bytes:
- #self.fp.seek(512 + self.sectorsize * sect)
- #[PL]: added safety checks:
- #print "getsect(%X)" % sect
- try:
- self.fp.seek(self.sectorsize * (sect+1))
- except:
- debug('getsect(): sect=%X, seek=%d, filesize=%d' %
- (sect, self.sectorsize*(sect+1), self._filesize))
- self._raise_defect(DEFECT_FATAL, 'OLE sector index out of range')
- sector = self.fp.read(self.sectorsize)
- if len(sector) != self.sectorsize:
- debug('getsect(): sect=%X, read=%d, sectorsize=%d' %
- (sect, len(sector), self.sectorsize))
- self._raise_defect(DEFECT_FATAL, 'incomplete OLE sector')
- return sector
-
-
- def loaddirectory(self, sect):
- """
- Load the directory.
- sect: sector index of directory stream.
- """
- # The directory is stored in a standard
- # substream, independent of its size.
-
- # open directory stream as a read-only file:
- # (stream size is not known in advance)
- self.directory_fp = self._open(sect)
-
- #[PL] to detect malformed documents and avoid DoS attacks, the maximum
- # number of directory entries can be calculated:
- max_entries = self.directory_fp.size / 128
- debug('loaddirectory: size=%d, max_entries=%d' %
- (self.directory_fp.size, max_entries))
-
- # Create list of directory entries
- #self.direntries = []
- # We start with a list of "None" object
- self.direntries = [None] * max_entries
-## for sid in xrange(max_entries):
-## entry = fp.read(128)
-## if not entry:
-## break
-## self.direntries.append(_OleDirectoryEntry(entry, sid, self))
- # load root entry:
- root_entry = self._load_direntry(0)
- # Root entry is the first entry:
- self.root = self.direntries[0]
- # read and build all storage trees, starting from the root:
- self.root.build_storage_tree()
-
-
- def _load_direntry (self, sid):
- """
- Load a directory entry from the directory.
- This method should only be called once for each storage/stream when
- loading the directory.
- sid: index of storage/stream in the directory.
- return: a _OleDirectoryEntry object
- raise: IOError if the entry has always been referenced.
- """
- # check if SID is OK:
- if sid<0 or sid>=len(self.direntries):
- self._raise_defect(DEFECT_FATAL, "OLE directory index out of range")
- # check if entry was already referenced:
- if self.direntries[sid] is not None:
- self._raise_defect(DEFECT_INCORRECT,
- "double reference for OLE stream/storage")
- # if exception not raised, return the object
- return self.direntries[sid]
- self.directory_fp.seek(sid * 128)
- entry = self.directory_fp.read(128)
- self.direntries[sid] = _OleDirectoryEntry(entry, sid, self)
- return self.direntries[sid]
-
-
- def dumpdirectory(self):
- """
- Dump directory (for debugging only)
- """
- self.root.dump()
-
-
- def _open(self, start, size = 0x7FFFFFFF, force_FAT=False):
- """
- Open a stream, either in FAT or MiniFAT according to its size.
- (openstream helper)
-
- start: index of first sector
- size: size of stream (or nothing if size is unknown)
- force_FAT: if False (default), stream will be opened in FAT or MiniFAT
- according to size. If True, it will always be opened in FAT.
- """
- debug('OleFileIO.open(): sect=%d, size=%d, force_FAT=%s' %
- (start, size, str(force_FAT)))
- # stream size is compared to the mini_stream_cutoff_size threshold:
- if size < self.minisectorcutoff and not force_FAT:
- # ministream object
- if not self.ministream:
- # load MiniFAT if it wasn't already done:
- self.loadminifat()
- # The first sector index of the miniFAT stream is stored in the
- # root directory entry:
- size_ministream = self.root.size
- debug('Opening MiniStream: sect=%d, size=%d' %
- (self.root.isectStart, size_ministream))
- self.ministream = self._open(self.root.isectStart,
- size_ministream, force_FAT=True)
- return _OleStream(fp=self.ministream, sect=start, size=size,
- offset=0, sectorsize=self.minisectorsize,
- fat=self.minifat, filesize=self.ministream.size)
- else:
- # standard stream
- return _OleStream(fp=self.fp, sect=start, size=size,
- offset=self.sectorsize,
- sectorsize=self.sectorsize, fat=self.fat,
- filesize=self._filesize)
-
-
- def _list(self, files, prefix, node, streams=True, storages=False):
- """
- (listdir helper)
- files: list of files to fill in
- prefix: current location in storage tree (list of names)
- node: current node (_OleDirectoryEntry object)
- streams: bool, include streams if True (True by default) - new in v0.26
- storages: bool, include storages if True (False by default) - new in v0.26
- (note: the root storage is never included)
- """
- prefix = prefix + [node.name]
- for entry in node.kids:
- if entry.kids:
- # this is a storage
- if storages:
- # add it to the list
- files.append(prefix[1:] + [entry.name])
- # check its kids
- self._list(files, prefix, entry, streams, storages)
- else:
- # this is a stream
- if streams:
- # add it to the list
- files.append(prefix[1:] + [entry.name])
-
-
- def listdir(self, streams=True, storages=False):
- """
- Return a list of streams stored in this file
-
- streams: bool, include streams if True (True by default) - new in v0.26
- storages: bool, include storages if True (False by default) - new in v0.26
- (note: the root storage is never included)
- """
- files = []
- self._list(files, [], self.root, streams, storages)
- return files
-
-
- def _find(self, filename):
- """
- Returns directory entry of given filename. (openstream helper)
- Note: this method is case-insensitive.
-
- filename: path of stream in storage tree (except root entry), either:
- - a string using Unix path syntax, for example:
- 'storage_1/storage_1.2/stream'
- - a list of storage filenames, path to the desired stream/storage.
- Example: ['storage_1', 'storage_1.2', 'stream']
- return: sid of requested filename
- raise IOError if file not found
- """
-
- # if filename is a string instead of a list, split it on slashes to
- # convert to a list:
- if isinstance(filename, basestring):
- filename = filename.split('/')
- # walk across storage tree, following given path:
- node = self.root
- for name in filename:
- for kid in node.kids:
- if kid.name.lower() == name.lower():
- break
- else:
- raise IOError, "file not found"
- node = kid
- return node.sid
-
-
- def openstream(self, filename):
- """
- Open a stream as a read-only file object (StringIO).
-
- filename: path of stream in storage tree (except root entry), either:
- - a string using Unix path syntax, for example:
- 'storage_1/storage_1.2/stream'
- - a list of storage filenames, path to the desired stream/storage.
- Example: ['storage_1', 'storage_1.2', 'stream']
- return: file object (read-only)
- raise IOError if filename not found, or if this is not a stream.
- """
- sid = self._find(filename)
- entry = self.direntries[sid]
- if entry.entry_type != STGTY_STREAM:
- raise IOError, "this file is not a stream"
- return self._open(entry.isectStart, entry.size)
-
-
- def get_type(self, filename):
- """
- Test if given filename exists as a stream or a storage in the OLE
- container, and return its type.
-
- filename: path of stream in storage tree. (see openstream for syntax)
- return: False if object does not exist, its entry type (>0) otherwise:
- - STGTY_STREAM: a stream
- - STGTY_STORAGE: a storage
- - STGTY_ROOT: the root entry
- """
- try:
- sid = self._find(filename)
- entry = self.direntries[sid]
- return entry.entry_type
- except:
- return False
-
-
- def getmtime(self, filename):
- """
- Return modification time of a stream/storage.
-
- filename: path of stream/storage in storage tree. (see openstream for
- syntax)
- return: None if modification time is null, a python datetime object
- otherwise (UTC timezone)
-
- new in version 0.26
- """
- sid = self._find(filename)
- entry = self.direntries[sid]
- return entry.getmtime()
-
-
- def getctime(self, filename):
- """
- Return creation time of a stream/storage.
-
- filename: path of stream/storage in storage tree. (see openstream for
- syntax)
- return: None if creation time is null, a python datetime object
- otherwise (UTC timezone)
-
- new in version 0.26
- """
- sid = self._find(filename)
- entry = self.direntries[sid]
- return entry.getctime()
-
-
- def exists(self, filename):
- """
- Test if given filename exists as a stream or a storage in the OLE
- container.
-
- filename: path of stream in storage tree. (see openstream for syntax)
- return: True if object exist, else False.
- """
- try:
- sid = self._find(filename)
- return True
- except:
- return False
-
-
- def get_size(self, filename):
- """
- Return size of a stream in the OLE container, in bytes.
-
- filename: path of stream in storage tree (see openstream for syntax)
- return: size in bytes (long integer)
- raise: IOError if file not found, TypeError if this is not a stream.
- """
- sid = self._find(filename)
- entry = self.direntries[sid]
- if entry.entry_type != STGTY_STREAM:
- #TODO: Should it return zero instead of raising an exception ?
- raise TypeError, 'object is not an OLE stream'
- return entry.size
-
-
- def get_rootentry_name(self):
- """
- Return root entry name. Should usually be 'Root Entry' or 'R' in most
- implementations.
- """
- return self.root.name
-
-
- def getproperties(self, filename, convert_time=False, no_conversion=None):
- """
- Return properties described in substream.
-
- filename: path of stream in storage tree (see openstream for syntax)
- convert_time: bool, if True timestamps will be converted to Python datetime
- no_conversion: None or list of int, timestamps not to be converted
- (for example total editing time is not a real timestamp)
- return: a dictionary of values indexed by id (integer)
- """
- # make sure no_conversion is a list, just to simplify code below:
- if no_conversion == None:
- no_conversion = []
- # stream path as a string to report exceptions:
- streampath = filename
- if not isinstance(streampath, str):
- streampath = '/'.join(streampath)
-
- fp = self.openstream(filename)
-
- data = {}
-
- try:
- # header
- s = fp.read(28)
- clsid = _clsid(s[8:24])
-
- # format id
- s = fp.read(20)
- fmtid = _clsid(s[:16])
- fp.seek(i32(s, 16))
-
- # get section
- s = "****" + fp.read(i32(fp.read(4))-4)
- # number of properties:
- num_props = i32(s, 4)
- except:
- # catch exception while parsing property header, and only raise
- # a DEFECT_INCORRECT then return an empty dict, because this is not
- # a fatal error when parsing the whole file
- exctype, excvalue = sys.exc_info()[:2]
- msg = 'Error while parsing properties header in stream %s: %s' % (
- repr(streampath), excvalue)
- self._raise_defect(DEFECT_INCORRECT, msg, exctype)
- return data
-
- for i in range(num_props):
- try:
- id = 0 # just in case of an exception
- id = i32(s, 8+i*8)
- offset = i32(s, 12+i*8)
- type = i32(s, offset)
-
- debug ('property id=%d: type=%d offset=%X' % (id, type, offset))
-
- # test for common types first (should perhaps use
- # a dictionary instead?)
-
- if type == VT_I2: # 16-bit signed integer
- value = i16(s, offset+4)
- if value >= 32768:
- value = value - 65536
- elif type == VT_UI2: # 2-byte unsigned integer
- value = i16(s, offset+4)
- elif type in (VT_I4, VT_INT, VT_ERROR):
- # VT_I4: 32-bit signed integer
- # VT_ERROR: HRESULT, similar to 32-bit signed integer,
- # see http://msdn.microsoft.com/en-us/library/cc230330.aspx
- value = i32(s, offset+4)
- elif type in (VT_UI4, VT_UINT): # 4-byte unsigned integer
- value = i32(s, offset+4) # FIXME
- elif type in (VT_BSTR, VT_LPSTR):
- # CodePageString, see http://msdn.microsoft.com/en-us/library/dd942354.aspx
- # size is a 32 bits integer, including the null terminator, and
- # possibly trailing or embedded null chars
- #TODO: if codepage is unicode, the string should be converted as such
- count = i32(s, offset+4)
- value = s[offset+8:offset+8+count-1]
- # remove all null chars:
- value = value.replace('\x00', '')
- elif type == VT_BLOB:
- # binary large object (BLOB)
- # see http://msdn.microsoft.com/en-us/library/dd942282.aspx
- count = i32(s, offset+4)
- value = s[offset+8:offset+8+count]
- elif type == VT_LPWSTR:
- # UnicodeString
- # see http://msdn.microsoft.com/en-us/library/dd942313.aspx
- # "the string should NOT contain embedded or additional trailing
- # null characters."
- count = i32(s, offset+4)
- value = _unicode(s[offset+8:offset+8+count*2])
- elif type == VT_FILETIME:
- value = long(i32(s, offset+4)) + (long(i32(s, offset+8))<<32)
- # FILETIME is a 64-bit int: "number of 100ns periods
- # since Jan 1,1601".
- if convert_time and id not in no_conversion:
- debug('Converting property #%d to python datetime, value=%d=%fs'
- %(id, value, float(value)/10000000L))
- # convert FILETIME to Python datetime.datetime
- # inspired from http://code.activestate.com/recipes/511425-filetime-to-datetime/
- _FILETIME_null_date = datetime.datetime(1601, 1, 1, 0, 0, 0)
- debug('timedelta days=%d' % (value/(10*1000000*3600*24)))
- value = _FILETIME_null_date + datetime.timedelta(microseconds=value/10)
- else:
- # legacy code kept for backward compatibility: returns a
- # number of seconds since Jan 1,1601
- value = value / 10000000L # seconds
- elif type == VT_UI1: # 1-byte unsigned integer
- value = ord(s[offset+4])
- elif type == VT_CLSID:
- value = _clsid(s[offset+4:offset+20])
- elif type == VT_CF:
- # PropertyIdentifier or ClipboardData??
- # see http://msdn.microsoft.com/en-us/library/dd941945.aspx
- count = i32(s, offset+4)
- value = s[offset+8:offset+8+count]
- elif type == VT_BOOL:
- # VARIANT_BOOL, 16 bits bool, 0x0000=Fals, 0xFFFF=True
- # see http://msdn.microsoft.com/en-us/library/cc237864.aspx
- value = bool(i16(s, offset+4))
- else:
- value = None # everything else yields "None"
- debug ('property id=%d: type=%d not implemented in parser yet' % (id, type))
-
- # missing: VT_EMPTY, VT_NULL, VT_R4, VT_R8, VT_CY, VT_DATE,
- # VT_DECIMAL, VT_I1, VT_I8, VT_UI8,
- # see http://msdn.microsoft.com/en-us/library/dd942033.aspx
-
- # FIXME: add support for VT_VECTOR
- # VT_VECTOR is a 32 uint giving the number of items, followed by
- # the items in sequence. The VT_VECTOR value is combined with the
- # type of items, e.g. VT_VECTOR|VT_BSTR
- # see http://msdn.microsoft.com/en-us/library/dd942011.aspx
-
- #print "%08x" % id, repr(value),
- #print "(%s)" % VT[i32(s, offset) & 0xFFF]
-
- data[id] = value
- except:
- # catch exception while parsing each property, and only raise
- # a DEFECT_INCORRECT, because parsing can go on
- exctype, excvalue = sys.exc_info()[:2]
- msg = 'Error while parsing property id %d in stream %s: %s' % (
- id, repr(streampath), excvalue)
- self._raise_defect(DEFECT_INCORRECT, msg, exctype)
-
- return data
-
- def get_metadata(self):
- """
- Parse standard properties streams, return an OleMetadata object
- containing all the available metadata.
- (also stored in the metadata attribute of the OleFileIO object)
-
- new in version 0.25
- """
- self.metadata = OleMetadata()
- self.metadata.parse_properties(self)
- return self.metadata
-
-#
-# --------------------------------------------------------------------
-# This script can be used to dump the directory of any OLE2 structured
-# storage file.
-
-if __name__ == "__main__":
-
- import sys
-
- # [PL] display quick usage info if launched from command-line
- if len(sys.argv) <= 1:
- print __doc__
- print """
-Launched from command line, this script parses OLE files and prints info.
-
-Usage: olefile2.py [-d] [-c] [file2 ...]
-
-Options:
--d : debug mode (display a lot of debug information, for developers only)
--c : check all streams (for debugging purposes)
-"""
- sys.exit()
-
- check_streams = False
- for filename in sys.argv[1:]:
-## try:
- # OPTIONS:
- if filename == '-d':
- # option to switch debug mode on:
- set_debug_mode(True)
- continue
- if filename == '-c':
- # option to switch check streams mode on:
- check_streams = True
- continue
-
- ole = OleFileIO(filename)#, raise_defects=DEFECT_INCORRECT)
- print "-" * 68
- print filename
- print "-" * 68
- ole.dumpdirectory()
- for streamname in ole.listdir():
- if streamname[-1][0] == "\005":
- print streamname, ": properties"
- props = ole.getproperties(streamname, convert_time=True)
- props = props.items()
- props.sort()
- for k, v in props:
- #[PL]: avoid to display too large or binary values:
- if isinstance(v, basestring):
- if len(v) > 50:
- v = v[:50]
- # quick and dirty binary check:
- for c in (1,2,3,4,5,6,7,11,12,14,15,16,17,18,19,20,
- 21,22,23,24,25,26,27,28,29,30,31):
- if chr(c) in v:
- v = '(binary data)'
- break
- print " ", k, v
-
- if check_streams:
- # Read all streams to check if there are errors:
- print '\nChecking streams...'
- for streamname in ole.listdir():
- # print name using repr() to convert binary chars to \xNN:
- print '-', repr('/'.join(streamname)),'-',
- st_type = ole.get_type(streamname)
- if st_type == STGTY_STREAM:
- print 'size %d' % ole.get_size(streamname)
- # just try to read stream in memory:
- ole.openstream(streamname)
- else:
- print 'NOT a stream : type=%d' % st_type
- print ''
-
-## for streamname in ole.listdir():
-## # print name using repr() to convert binary chars to \xNN:
-## print '-', repr('/'.join(streamname)),'-',
-## print ole.getmtime(streamname)
-## print ''
-
- print 'Modification/Creation times of all directory entries:'
- for entry in ole.direntries:
- if entry is not None:
- print '- %s: mtime=%s ctime=%s' % (entry.name,
- entry.getmtime(), entry.getctime())
- print ''
-
- # parse and display metadata:
- meta = ole.get_metadata()
- meta.dump()
- print ''
- #[PL] Test a few new methods:
- root = ole.get_rootentry_name()
- print 'Root entry name: "%s"' % root
- if ole.exists('worddocument'):
- print "This is a Word document."
- print "type of stream 'WordDocument':", ole.get_type('worddocument')
- print "size :", ole.get_size('worddocument')
- if ole.exists('macros/vba'):
- print "This document may contain VBA macros."
-
- # print parsing issues:
- print '\nNon-fatal issues raised during parsing:'
- if ole.parsing_issues:
- for exctype, msg in ole.parsing_issues:
- print '- %s: %s' % (exctype.__name__, msg)
- else:
- print 'None'
-## except IOError, v:
-## print "***", "cannot read", file, "-", v
-
-# this code was developed while listening to The Wedding Present "Sea Monsters"
diff --git a/oletools/thirdparty/xxxswf/xxxswf.py b/oletools/thirdparty/xxxswf/xxxswf.py
index 1a47878..1f95659 100644
--- a/oletools/thirdparty/xxxswf/xxxswf.py
+++ b/oletools/thirdparty/xxxswf/xxxswf.py
@@ -1,371 +1,371 @@
-# xxxswf.py was created by alexander dot hanel at gmail dot com
-# version 0.1
-# Date - 12-07-2011
-# To do list
-# - Tag Parser
-# - ActionScript Decompiler
-
-import fnmatch
-import hashlib
-import imp
-import math
-import os
-import re
-import struct
-import sys
-import time
-from StringIO import StringIO
-from optparse import OptionParser
-import zlib
-
-def checkMD5(md5):
-# checks if MD5 has been seen in MD5 Dictionary
-# MD5Dict contains the MD5 and the CVE
-# For { 'MD5':'CVE', 'MD5-1':'CVE-1', 'MD5-2':'CVE-2'}
- MD5Dict = {'c46299a5015c6d31ad5766cb49e4ab4b':'CVE-XXXX-XXXX'}
- if MD5Dict.get(md5):
- print '\t[BAD] MD5 Match on', MD5Dict.get(md5)
- return
-
-def bad(f):
- for idx, x in enumerate(findSWF(f)):
- tmp = verifySWF(f,x)
- if tmp != None:
- yaraScan(tmp)
- checkMD5(hashBuff(tmp))
- return
-
-def yaraScan(d):
-# d = buffer of the read file
-# Scans SWF using Yara
- # test if yara module is installed
- # if not Yara can be downloaded from http://code.google.com/p/yara-project/
- try:
- imp.find_module('yara')
- import yara
- except ImportError:
- print '\t[ERROR] Yara module not installed - aborting scan'
- return
- # test for yara compile errors
- try:
- r = yara.compile(r'rules.yar')
- except:
- pass
- print '\t[ERROR] Yara compile error - aborting scan'
- return
- # get matches
- m = r.match(data=d)
- # print matches
- for X in m:
- print '\t[BAD] Yara Signature Hit:', X
- return
-
-def findSWF(d):
-# d = buffer of the read file
-# Search for SWF Header Sigs in files
- return [tmp.start() for tmp in re.finditer('CWS|FWS', d.read())]
-
-def hashBuff(d):
-# d = buffer of the read file
-# This function hashes the buffer
-# source: http://stackoverflow.com/q/5853830
- if type(d) is str:
- d = StringIO(d)
- md5 = hashlib.md5()
- while True:
- data = d.read(128)
- if not data:
- break
- md5.update(data)
- return md5.hexdigest()
-
-def verifySWF(f,addr):
- # Start of SWF
- f.seek(addr)
- # Read Header
- header = f.read(3)
- # Read Version
- ver = struct.unpack(' 20:
- print ' - [ERROR] Invalid SWF Version'
- return None
-
- if 'CWS' in header:
- try:
- f.read(3)
- tmp = 'FWS' + f.read(5) + zlib.decompress(f.read())
- print ' - CWS Header'
- return tmp
-
- except:
- pass
- print '- [ERROR]: Zlib decompression error. Invalid CWS SWF'
- return None
-
- elif 'FWS' in header:
- try:
- tmp = f.read(size)
- print ' - FWS Header'
- return tmp
-
- except:
- pass
- print ' - [ERROR] Invalid SWF Size'
- return None
-
- else:
- print ' - [Error] Logic Error Blame Programmer'
- return None
-
-def headerInfo(f):
-# f is the already opended file handle
-# Yes, the format is is a rip off SWFDump. Can you blame me? Their tool is awesome.
- # SWFDump FORMAT
- # [HEADER] File version: 8
- # [HEADER] File is zlib compressed. Ratio: 52%
- # [HEADER] File size: 37536
- # [HEADER] Frame rate: 18.000000
- # [HEADER] Frame count: 323
- # [HEADER] Movie width: 217.00
- # [HEADER] Movie height: 85.00
- if type(f) is str:
- f = StringIO(f)
- sig = f.read(3)
- print '\t[HEADER] File header:', sig
- if 'C' in sig:
- print '\t[HEADER] File is zlib compressed.'
- version = struct.unpack('> 3
- print '\t[HEADER] Rect Nbit:', nbit
- # Curretely the nbit is static at 15. This could be modified in the
- # future. If larger than 9 this will break the struct unpack. Will have
- # to revist must be a more effective way to deal with bits. Tried to keep
- # the algo but damn this is ugly...
- f.seek(ta)
- rect = struct.unpack('>Q', f.read(int(math.ceil((nbit*4)/8.0))))[0]
- tmp = struct.unpack('>7)[2:].zfill(1)
- # bin requires Python 2.6 or higher
- # skips string '0b' and the nbit
- rect = bin(rect)[7:]
- xmin = int(rect[0:nbit-1],2)
- print '\t[HEADER] Rect Xmin:', xmin
- xmax = int(rect[nbit:(nbit*2)-1],2)
- print '\t[HEADER] Rect Xmax:', xmax
- ymin = int(rect[nbit*2:(nbit*3)-1],2)
- print '\t[HEADER] Rect Ymin:', ymin
- # one bit needs to be added, my math might be off here
- ymax = int(rect[nbit*3:(nbit*4)-1] + str(tmp) ,2)
- print '\t[HEADER] Rect Ymax:', ymax
- framerate = struct.unpack(' 20:
+ print(' - [ERROR] Invalid SWF Version')
+ return None
+
+ if 'CWS' in header:
+ try:
+ f.read(3)
+ tmp = 'FWS' + f.read(5) + zlib.decompress(f.read())
+ print(' - CWS Header')
+ return tmp
+
+ except:
+ pass
+ print('- [ERROR]: Zlib decompression error. Invalid CWS SWF')
+ return None
+
+ elif 'FWS' in header:
+ try:
+ tmp = f.read(size)
+ print(' - FWS Header')
+ return tmp
+
+ except:
+ pass
+ print(' - [ERROR] Invalid SWF Size')
+ return None
+
+ else:
+ print(' - [Error] Logic Error Blame Programmer')
+ return None
+
+def headerInfo(f):
+# f is the already opended file handle
+# Yes, the format is is a rip off SWFDump. Can you blame me? Their tool is awesome.
+ # SWFDump FORMAT
+ # [HEADER] File version: 8
+ # [HEADER] File is zlib compressed. Ratio: 52%
+ # [HEADER] File size: 37536
+ # [HEADER] Frame rate: 18.000000
+ # [HEADER] Frame count: 323
+ # [HEADER] Movie width: 217.00
+ # [HEADER] Movie height: 85.00
+ if type(f) is str:
+ f = StringIO(f)
+ sig = f.read(3)
+ print('\t[HEADER] File header: %s' % sig)
+ if 'C' in sig:
+ print('\t[HEADER] File is zlib compressed.')
+ version = struct.unpack('> 3
+ print('\t[HEADER] Rect Nbit: %d' % nbit)
+ # Curretely the nbit is static at 15. This could be modified in the
+ # future. If larger than 9 this will break the struct unpack. Will have
+ # to revist must be a more effective way to deal with bits. Tried to keep
+ # the algo but damn this is ugly...
+ f.seek(ta)
+ rect = struct.unpack('>Q', f.read(int(math.ceil((nbit*4)/8.0))))[0]
+ tmp = struct.unpack('>7)[2:].zfill(1)
+ # bin requires Python 2.6 or higher
+ # skips string '0b' and the nbit
+ rect = bin(rect)[7:]
+ xmin = int(rect[0:nbit-1],2)
+ print('\t[HEADER] Rect Xmin: %d' % xmin)
+ xmax = int(rect[nbit:(nbit*2)-1],2)
+ print('\t[HEADER] Rect Xmax: %d' % xmax)
+ ymin = int(rect[nbit*2:(nbit*3)-1],2)
+ print('\t[HEADER] Rect Ymin: %d' % ymin)
+ # one bit needs to be added, my math might be off here
+ ymax = int(rect[nbit*3:(nbit*4)-1] + str(tmp) ,2)
+ print('\t[HEADER] Rect Ymax: %d' % ymax)
+ framerate = struct.unpack('