Peter M. Groen / oletools

Commit 98bf5c3639bea6ba484c391297afd0a5490c7313

Authored by Christian Herdtweck
1 parent 2dd314cd

pylint-ify 2: lower-case-ify PROJECT... REFERENCE... MODULE vars in _extract_vba 

(I just love my vim...)
Inline Side-by-side
Showing 1 changed file with 213 additions and 213 deletions
oletools/olevba.py
  View file @98bf5c3
... ... @@ -76,7 +76,7 @@ https://github.com/unixfreak0037/officeparser
76 76 # CHANGELOG:
77 77 # 2014-08-05 v0.01 PL: - first version based on officeparser code
78 78 # 2014-08-14 v0.02 PL: - fixed bugs in code, added license from officeparser
79   -# 2014-08-15 PL: - fixed incorrect value check in PROJECTHELPFILEPATH Record
  79 +# 2014-08-15 PL: - fixed incorrect value check in projecthelpfilepath Record
80 80 # 2014-08-15 v0.03 PL: - refactored extract_macros to support OpenXML formats
81 81 # and to find the VBA project root anywhere in the file
82 82 # 2014-11-29 v0.04 PL: - use olefile instead of OleFileIO_PL
... ... @@ -1176,122 +1176,122 @@ def _extract_vba(ole, vba_root, project_path, dir_path):
1176 1176 dir_stream = cStringIO.StringIO(decompress_stream(dir_compressed))
1177 1177  
1178 1178 # PROJECTSYSKIND Record
1179   - PROJECTSYSKIND_Id = struct.unpack("<H", dir_stream.read(2))[0]
1180   - check_value('PROJECTSYSKIND_Id', 0x0001, PROJECTSYSKIND_Id)
1181   - PROJECTSYSKIND_Size = struct.unpack("<L", dir_stream.read(4))[0]
1182   - check_value('PROJECTSYSKIND_Size', 0x0004, PROJECTSYSKIND_Size)
1183   - PROJECTSYSKIND_SysKind = struct.unpack("<L", dir_stream.read(4))[0]
1184   - if PROJECTSYSKIND_SysKind == 0x00:
  1179 + projectsyskind_id = struct.unpack("<H", dir_stream.read(2))[0]
  1180 + check_value('PROJECTSYSKIND_Id', 0x0001, projectsyskind_id)
  1181 + projectsyskind_size = struct.unpack("<L", dir_stream.read(4))[0]
  1182 + check_value('PROJECTSYSKIND_Size', 0x0004, projectsyskind_size)
  1183 + projectsyskind_syskind = struct.unpack("<L", dir_stream.read(4))[0]
  1184 + if projectsyskind_syskind == 0x00:
1185 1185 log.debug("16-bit Windows")
1186   - elif PROJECTSYSKIND_SysKind == 0x01:
  1186 + elif projectsyskind_syskind == 0x01:
1187 1187 log.debug("32-bit Windows")
1188   - elif PROJECTSYSKIND_SysKind == 0x02:
  1188 + elif projectsyskind_syskind == 0x02:
1189 1189 log.debug("Macintosh")
1190   - elif PROJECTSYSKIND_SysKind == 0x03:
  1190 + elif projectsyskind_syskind == 0x03:
1191 1191 log.debug("64-bit Windows")
1192 1192 else:
1193   - log.error("invalid PROJECTSYSKIND_SysKind {0:04X}".format(PROJECTSYSKIND_SysKind))
  1193 + log.error("invalid PROJECTSYSKIND_SysKind {0:04X}".format(projectsyskind_syskind))
1194 1194  
1195 1195 # PROJECTLCID Record
1196   - PROJECTLCID_Id = struct.unpack("<H", dir_stream.read(2))[0]
1197   - check_value('PROJECTLCID_Id', 0x0002, PROJECTLCID_Id)
1198   - PROJECTLCID_Size = struct.unpack("<L", dir_stream.read(4))[0]
1199   - check_value('PROJECTLCID_Size', 0x0004, PROJECTLCID_Size)
1200   - PROJECTLCID_Lcid = struct.unpack("<L", dir_stream.read(4))[0]
1201   - check_value('PROJECTLCID_Lcid', 0x409, PROJECTLCID_Lcid)
  1196 + projectlcid_id = struct.unpack("<H", dir_stream.read(2))[0]
  1197 + check_value('PROJECTLCID_Id', 0x0002, projectlcid_id)
  1198 + projectlcid_size = struct.unpack("<L", dir_stream.read(4))[0]
  1199 + check_value('PROJECTLCID_Size', 0x0004, projectlcid_size)
  1200 + projectlcid_lcid = struct.unpack("<L", dir_stream.read(4))[0]
  1201 + check_value('PROJECTLCID_Lcid', 0x409, projectlcid_lcid)
1202 1202  
1203 1203 # PROJECTLCIDINVOKE Record
1204   - PROJECTLCIDINVOKE_Id = struct.unpack("<H", dir_stream.read(2))[0]
1205   - check_value('PROJECTLCIDINVOKE_Id', 0x0014, PROJECTLCIDINVOKE_Id)
1206   - PROJECTLCIDINVOKE_Size = struct.unpack("<L", dir_stream.read(4))[0]
1207   - check_value('PROJECTLCIDINVOKE_Size', 0x0004, PROJECTLCIDINVOKE_Size)
1208   - PROJECTLCIDINVOKE_LcidInvoke = struct.unpack("<L", dir_stream.read(4))[0]
1209   - check_value('PROJECTLCIDINVOKE_LcidInvoke', 0x409, PROJECTLCIDINVOKE_LcidInvoke)
  1204 + projectlcidinvoke_id = struct.unpack("<H", dir_stream.read(2))[0]
  1205 + check_value('PROJECTLCIDINVOKE_Id', 0x0014, projectlcidinvoke_id)
  1206 + projectlcidinvoke_size = struct.unpack("<L", dir_stream.read(4))[0]
  1207 + check_value('PROJECTLCIDINVOKE_Size', 0x0004, projectlcidinvoke_size)
  1208 + projectlcidinvoke_lcidinvoke = struct.unpack("<L", dir_stream.read(4))[0]
  1209 + check_value('PROJECTLCIDINVOKE_LcidInvoke', 0x409, projectlcidinvoke_lcidinvoke)
1210 1210  
1211 1211 # PROJECTCODEPAGE Record
1212   - PROJECTCODEPAGE_Id = struct.unpack("<H", dir_stream.read(2))[0]
1213   - check_value('PROJECTCODEPAGE_Id', 0x0003, PROJECTCODEPAGE_Id)
1214   - PROJECTCODEPAGE_Size = struct.unpack("<L", dir_stream.read(4))[0]
1215   - check_value('PROJECTCODEPAGE_Size', 0x0002, PROJECTCODEPAGE_Size)
1216   - PROJECTCODEPAGE_CodePage = struct.unpack("<H", dir_stream.read(2))[0]
  1212 + projectcodepage_id = struct.unpack("<H", dir_stream.read(2))[0]
  1213 + check_value('PROJECTCODEPAGE_Id', 0x0003, projectcodepage_id)
  1214 + projectcodepage_size = struct.unpack("<L", dir_stream.read(4))[0]
  1215 + check_value('PROJECTCODEPAGE_Size', 0x0002, projectcodepage_size)
  1216 + projectcodepage_codepage = struct.unpack("<H", dir_stream.read(2))[0]
1217 1217  
1218 1218 # PROJECTNAME Record
1219   - PROJECTNAME_Id = struct.unpack("<H", dir_stream.read(2))[0]
1220   - check_value('PROJECTNAME_Id', 0x0004, PROJECTNAME_Id)
1221   - PROJECTNAME_SizeOfProjectName = struct.unpack("<L", dir_stream.read(4))[0]
1222   - if PROJECTNAME_SizeOfProjectName < 1 or PROJECTNAME_SizeOfProjectName > 128:
1223   - log.error("PROJECTNAME_SizeOfProjectName value not in range: {0}".format(PROJECTNAME_SizeOfProjectName))
1224   - PROJECTNAME_ProjectName = dir_stream.read(PROJECTNAME_SizeOfProjectName)
  1219 + projectname_id = struct.unpack("<H", dir_stream.read(2))[0]
  1220 + check_value('PROJECTNAME_Id', 0x0004, projectname_id)
  1221 + projectname_sizeofprojectname = struct.unpack("<L", dir_stream.read(4))[0]
  1222 + if projectname_sizeofprojectname < 1 or projectname_sizeofprojectname > 128:
  1223 + log.error("PROJECTNAME_SizeOfProjectName value not in range: {0}".format(projectname_sizeofprojectname))
  1224 + projectname_projectname = dir_stream.read(projectname_sizeofprojectname)
1225 1225  
1226 1226 # PROJECTDOCSTRING Record
1227   - PROJECTDOCSTRING_Id = struct.unpack("<H", dir_stream.read(2))[0]
1228   - check_value('PROJECTDOCSTRING_Id', 0x0005, PROJECTDOCSTRING_Id)
1229   - PROJECTDOCSTRING_SizeOfDocString = struct.unpack("<L", dir_stream.read(4))[0]
1230   - if PROJECTNAME_SizeOfProjectName > 2000:
  1227 + projectdocstring_id = struct.unpack("<H", dir_stream.read(2))[0]
  1228 + check_value('PROJECTDOCSTRING_Id', 0x0005, projectdocstring_id)
  1229 + projectdocstring_sizeofdocstring = struct.unpack("<L", dir_stream.read(4))[0]
  1230 + if projectname_sizeofprojectname > 2000:
1231 1231 log.error(
1232   - "PROJECTDOCSTRING_SizeOfDocString value not in range: {0}".format(PROJECTDOCSTRING_SizeOfDocString))
1233   - PROJECTDOCSTRING_DocString = dir_stream.read(PROJECTDOCSTRING_SizeOfDocString)
1234   - PROJECTDOCSTRING_Reserved = struct.unpack("<H", dir_stream.read(2))[0]
1235   - check_value('PROJECTDOCSTRING_Reserved', 0x0040, PROJECTDOCSTRING_Reserved)
1236   - PROJECTDOCSTRING_SizeOfDocStringUnicode = struct.unpack("<L", dir_stream.read(4))[0]
1237   - if PROJECTDOCSTRING_SizeOfDocStringUnicode % 2 != 0:
  1232 + "PROJECTDOCSTRING_SizeOfDocString value not in range: {0}".format(projectdocstring_sizeofdocstring))
  1233 + projectdocstring_docstring = dir_stream.read(projectdocstring_sizeofdocstring)
  1234 + projectdocstring_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1235 + check_value('PROJECTDOCSTRING_Reserved', 0x0040, projectdocstring_reserved)
  1236 + projectdocstring_sizeofdocstringunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1237 + if projectdocstring_sizeofdocstringunicode % 2 != 0:
1238 1238 log.error("PROJECTDOCSTRING_SizeOfDocStringUnicode is not even")
1239   - PROJECTDOCSTRING_DocStringUnicode = dir_stream.read(PROJECTDOCSTRING_SizeOfDocStringUnicode)
  1239 + projectdocstring_docstringunicode = dir_stream.read(projectdocstring_sizeofdocstringunicode)
1240 1240  
1241 1241 # PROJECTHELPFILEPATH Record - MS-OVBA 2.3.4.2.1.7
1242   - PROJECTHELPFILEPATH_Id = struct.unpack("<H", dir_stream.read(2))[0]
1243   - check_value('PROJECTHELPFILEPATH_Id', 0x0006, PROJECTHELPFILEPATH_Id)
1244   - PROJECTHELPFILEPATH_SizeOfHelpFile1 = struct.unpack("<L", dir_stream.read(4))[0]
1245   - if PROJECTHELPFILEPATH_SizeOfHelpFile1 > 260:
  1242 + projecthelpfilepath_id = struct.unpack("<H", dir_stream.read(2))[0]
  1243 + check_value('PROJECTHELPFILEPATH_Id', 0x0006, projecthelpfilepath_id)
  1244 + projecthelpfilepath_sizeofhelpfile1 = struct.unpack("<L", dir_stream.read(4))[0]
  1245 + if projecthelpfilepath_sizeofhelpfile1 > 260:
1246 1246 log.error(
1247   - "PROJECTHELPFILEPATH_SizeOfHelpFile1 value not in range: {0}".format(PROJECTHELPFILEPATH_SizeOfHelpFile1))
1248   - PROJECTHELPFILEPATH_HelpFile1 = dir_stream.read(PROJECTHELPFILEPATH_SizeOfHelpFile1)
1249   - PROJECTHELPFILEPATH_Reserved = struct.unpack("<H", dir_stream.read(2))[0]
1250   - check_value('PROJECTHELPFILEPATH_Reserved', 0x003D, PROJECTHELPFILEPATH_Reserved)
1251   - PROJECTHELPFILEPATH_SizeOfHelpFile2 = struct.unpack("<L", dir_stream.read(4))[0]
1252   - if PROJECTHELPFILEPATH_SizeOfHelpFile2 != PROJECTHELPFILEPATH_SizeOfHelpFile1:
  1247 + "PROJECTHELPFILEPATH_SizeOfHelpFile1 value not in range: {0}".format(projecthelpfilepath_sizeofhelpfile1))
  1248 + projecthelpfilepath_helpfile1 = dir_stream.read(projecthelpfilepath_sizeofhelpfile1)
  1249 + projecthelpfilepath_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1250 + check_value('PROJECTHELPFILEPATH_Reserved', 0x003D, projecthelpfilepath_reserved)
  1251 + projecthelpfilepath_sizeofhelpfile2 = struct.unpack("<L", dir_stream.read(4))[0]
  1252 + if projecthelpfilepath_sizeofhelpfile2 != projecthelpfilepath_sizeofhelpfile1:
1253 1253 log.error("PROJECTHELPFILEPATH_SizeOfHelpFile1 does not equal PROJECTHELPFILEPATH_SizeOfHelpFile2")
1254   - PROJECTHELPFILEPATH_HelpFile2 = dir_stream.read(PROJECTHELPFILEPATH_SizeOfHelpFile2)
1255   - if PROJECTHELPFILEPATH_HelpFile2 != PROJECTHELPFILEPATH_HelpFile1:
  1254 + projecthelpfilepath_helpfile2 = dir_stream.read(projecthelpfilepath_sizeofhelpfile2)
  1255 + if projecthelpfilepath_helpfile2 != projecthelpfilepath_helpfile1:
1256 1256 log.error("PROJECTHELPFILEPATH_HelpFile1 does not equal PROJECTHELPFILEPATH_HelpFile2")
1257 1257  
1258 1258 # PROJECTHELPCONTEXT Record
1259   - PROJECTHELPCONTEXT_Id = struct.unpack("<H", dir_stream.read(2))[0]
1260   - check_value('PROJECTHELPCONTEXT_Id', 0x0007, PROJECTHELPCONTEXT_Id)
1261   - PROJECTHELPCONTEXT_Size = struct.unpack("<L", dir_stream.read(4))[0]
1262   - check_value('PROJECTHELPCONTEXT_Size', 0x0004, PROJECTHELPCONTEXT_Size)
1263   - PROJECTHELPCONTEXT_HelpContext = struct.unpack("<L", dir_stream.read(4))[0]
  1259 + projecthelpcontext_id = struct.unpack("<H", dir_stream.read(2))[0]
  1260 + check_value('PROJECTHELPCONTEXT_Id', 0x0007, projecthelpcontext_id)
  1261 + projecthelpcontext_size = struct.unpack("<L", dir_stream.read(4))[0]
  1262 + check_value('PROJECTHELPCONTEXT_Size', 0x0004, projecthelpcontext_size)
  1263 + projecthelpcontext_helpcontext = struct.unpack("<L", dir_stream.read(4))[0]
1264 1264  
1265 1265 # PROJECTLIBFLAGS Record
1266   - PROJECTLIBFLAGS_Id = struct.unpack("<H", dir_stream.read(2))[0]
1267   - check_value('PROJECTLIBFLAGS_Id', 0x0008, PROJECTLIBFLAGS_Id)
1268   - PROJECTLIBFLAGS_Size = struct.unpack("<L", dir_stream.read(4))[0]
1269   - check_value('PROJECTLIBFLAGS_Size', 0x0004, PROJECTLIBFLAGS_Size)
1270   - PROJECTLIBFLAGS_ProjectLibFlags = struct.unpack("<L", dir_stream.read(4))[0]
1271   - check_value('PROJECTLIBFLAGS_ProjectLibFlags', 0x0000, PROJECTLIBFLAGS_ProjectLibFlags)
  1266 + projectlibflags_id = struct.unpack("<H", dir_stream.read(2))[0]
  1267 + check_value('PROJECTLIBFLAGS_Id', 0x0008, projectlibflags_id)
  1268 + projectlibflags_size = struct.unpack("<L", dir_stream.read(4))[0]
  1269 + check_value('PROJECTLIBFLAGS_Size', 0x0004, projectlibflags_size)
  1270 + projectlibflags_projectlibflags = struct.unpack("<L", dir_stream.read(4))[0]
  1271 + check_value('PROJECTLIBFLAGS_ProjectLibFlags', 0x0000, projectlibflags_projectlibflags)
1272 1272  
1273 1273 # PROJECTVERSION Record
1274   - PROJECTVERSION_Id = struct.unpack("<H", dir_stream.read(2))[0]
1275   - check_value('PROJECTVERSION_Id', 0x0009, PROJECTVERSION_Id)
1276   - PROJECTVERSION_Reserved = struct.unpack("<L", dir_stream.read(4))[0]
1277   - check_value('PROJECTVERSION_Reserved', 0x0004, PROJECTVERSION_Reserved)
1278   - PROJECTVERSION_VersionMajor = struct.unpack("<L", dir_stream.read(4))[0]
1279   - PROJECTVERSION_VersionMinor = struct.unpack("<H", dir_stream.read(2))[0]
  1274 + projectversion_id = struct.unpack("<H", dir_stream.read(2))[0]
  1275 + check_value('PROJECTVERSION_Id', 0x0009, projectversion_id)
  1276 + projectversion_reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1277 + check_value('PROJECTVERSION_Reserved', 0x0004, projectversion_reserved)
  1278 + projectversion_versionmajor = struct.unpack("<L", dir_stream.read(4))[0]
  1279 + projectversion_versionminor = struct.unpack("<H", dir_stream.read(2))[0]
1280 1280  
1281 1281 # PROJECTCONSTANTS Record
1282   - PROJECTCONSTANTS_Id = struct.unpack("<H", dir_stream.read(2))[0]
1283   - check_value('PROJECTCONSTANTS_Id', 0x000C, PROJECTCONSTANTS_Id)
1284   - PROJECTCONSTANTS_SizeOfConstants = struct.unpack("<L", dir_stream.read(4))[0]
1285   - if PROJECTCONSTANTS_SizeOfConstants > 1015:
  1282 + projectconstants_id = struct.unpack("<H", dir_stream.read(2))[0]
  1283 + check_value('PROJECTCONSTANTS_Id', 0x000C, projectconstants_id)
  1284 + projectconstants_sizeofconstants = struct.unpack("<L", dir_stream.read(4))[0]
  1285 + if projectconstants_sizeofconstants > 1015:
1286 1286 log.error(
1287   - "PROJECTCONSTANTS_SizeOfConstants value not in range: {0}".format(PROJECTCONSTANTS_SizeOfConstants))
1288   - PROJECTCONSTANTS_Constants = dir_stream.read(PROJECTCONSTANTS_SizeOfConstants)
1289   - PROJECTCONSTANTS_Reserved = struct.unpack("<H", dir_stream.read(2))[0]
1290   - check_value('PROJECTCONSTANTS_Reserved', 0x003C, PROJECTCONSTANTS_Reserved)
1291   - PROJECTCONSTANTS_SizeOfConstantsUnicode = struct.unpack("<L", dir_stream.read(4))[0]
1292   - if PROJECTCONSTANTS_SizeOfConstantsUnicode % 2 != 0:
  1287 + "PROJECTCONSTANTS_SizeOfConstants value not in range: {0}".format(projectconstants_sizeofconstants))
  1288 + projectconstants_constants = dir_stream.read(projectconstants_sizeofconstants)
  1289 + projectconstants_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1290 + check_value('PROJECTCONSTANTS_Reserved', 0x003C, projectconstants_reserved)
  1291 + projectconstants_sizeofconstantsunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1292 + if projectconstants_sizeofconstantsunicode % 2 != 0:
1293 1293 log.error("PROJECTCONSTANTS_SizeOfConstantsUnicode is not even")
1294   - PROJECTCONSTANTS_ConstantsUnicode = dir_stream.read(PROJECTCONSTANTS_SizeOfConstantsUnicode)
  1294 + projectconstants_constantsunicode = dir_stream.read(projectconstants_sizeofconstantsunicode)
1295 1295  
1296 1296 # array of REFERENCE records
1297 1297 check = None
... ... @@ -1303,194 +1303,194 @@ def _extract_vba(ole, vba_root, project_path, dir_path):
1303 1303  
1304 1304 if check == 0x0016:
1305 1305 # REFERENCENAME
1306   - REFERENCE_Id = check
1307   - REFERENCE_SizeOfName = struct.unpack("<L", dir_stream.read(4))[0]
1308   - REFERENCE_Name = dir_stream.read(REFERENCE_SizeOfName)
1309   - REFERENCE_Reserved = struct.unpack("<H", dir_stream.read(2))[0]
1310   - check_value('REFERENCE_Reserved', 0x003E, REFERENCE_Reserved)
1311   - REFERENCE_SizeOfNameUnicode = struct.unpack("<L", dir_stream.read(4))[0]
1312   - REFERENCE_NameUnicode = dir_stream.read(REFERENCE_SizeOfNameUnicode)
  1306 + reference_id = check
  1307 + reference_sizeofname = struct.unpack("<L", dir_stream.read(4))[0]
  1308 + reference_name = dir_stream.read(reference_sizeofname)
  1309 + reference_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1310 + check_value('REFERENCE_Reserved', 0x003E, reference_reserved)
  1311 + reference_sizeofnameunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1312 + reference_nameunicode = dir_stream.read(reference_sizeofnameunicode)
1313 1313 continue
1314 1314  
1315 1315 if check == 0x0033:
1316 1316 # REFERENCEORIGINAL (followed by REFERENCECONTROL)
1317   - REFERENCEORIGINAL_Id = check
1318   - REFERENCEORIGINAL_SizeOfLibidOriginal = struct.unpack("<L", dir_stream.read(4))[0]
1319   - REFERENCEORIGINAL_LibidOriginal = dir_stream.read(REFERENCEORIGINAL_SizeOfLibidOriginal)
  1317 + referenceoriginal_id = check
  1318 + referenceoriginal_sizeoflibidoriginal = struct.unpack("<L", dir_stream.read(4))[0]
  1319 + referenceoriginal_libidoriginal = dir_stream.read(referenceoriginal_sizeoflibidoriginal)
1320 1320 continue
1321 1321  
1322 1322 if check == 0x002F:
1323 1323 # REFERENCECONTROL
1324   - REFERENCECONTROL_Id = check
1325   - REFERENCECONTROL_SizeTwiddled = struct.unpack("<L", dir_stream.read(4))[0] # ignore
1326   - REFERENCECONTROL_SizeOfLibidTwiddled = struct.unpack("<L", dir_stream.read(4))[0]
1327   - REFERENCECONTROL_LibidTwiddled = dir_stream.read(REFERENCECONTROL_SizeOfLibidTwiddled)
1328   - REFERENCECONTROL_Reserved1 = struct.unpack("<L", dir_stream.read(4))[0] # ignore
1329   - check_value('REFERENCECONTROL_Reserved1', 0x0000, REFERENCECONTROL_Reserved1)
1330   - REFERENCECONTROL_Reserved2 = struct.unpack("<H", dir_stream.read(2))[0] # ignore
1331   - check_value('REFERENCECONTROL_Reserved2', 0x0000, REFERENCECONTROL_Reserved2)
  1324 + referencecontrol_id = check
  1325 + referencecontrol_sizetwiddled = struct.unpack("<L", dir_stream.read(4))[0] # ignore
  1326 + referencecontrol_sizeoflibidtwiddled = struct.unpack("<L", dir_stream.read(4))[0]
  1327 + referencecontrol_libidtwiddled = dir_stream.read(referencecontrol_sizeoflibidtwiddled)
  1328 + referencecontrol_reserved1 = struct.unpack("<L", dir_stream.read(4))[0] # ignore
  1329 + check_value('REFERENCECONTROL_Reserved1', 0x0000, referencecontrol_reserved1)
  1330 + referencecontrol_reserved2 = struct.unpack("<H", dir_stream.read(2))[0] # ignore
  1331 + check_value('REFERENCECONTROL_Reserved2', 0x0000, referencecontrol_reserved2)
1332 1332 # optional field
1333 1333 check2 = struct.unpack("<H", dir_stream.read(2))[0]
1334 1334 if check2 == 0x0016:
1335   - REFERENCECONTROL_NameRecordExtended_Id = check
1336   - REFERENCECONTROL_NameRecordExtended_SizeofName = struct.unpack("<L", dir_stream.read(4))[0]
1337   - REFERENCECONTROL_NameRecordExtended_Name = dir_stream.read(
1338   - REFERENCECONTROL_NameRecordExtended_SizeofName)
1339   - REFERENCECONTROL_NameRecordExtended_Reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1335 + referencecontrol_namerecordextended_id = check
  1336 + referencecontrol_namerecordextended_sizeofname = struct.unpack("<L", dir_stream.read(4))[0]
  1337 + referencecontrol_namerecordextended_name = dir_stream.read(
  1338 + referencecontrol_namerecordextended_sizeofname)
  1339 + referencecontrol_namerecordextended_reserved = struct.unpack("<H", dir_stream.read(2))[0]
1340 1340 check_value('REFERENCECONTROL_NameRecordExtended_Reserved', 0x003E,
1341   - REFERENCECONTROL_NameRecordExtended_Reserved)
1342   - REFERENCECONTROL_NameRecordExtended_SizeOfNameUnicode = struct.unpack("<L", dir_stream.read(4))[0]
1343   - REFERENCECONTROL_NameRecordExtended_NameUnicode = dir_stream.read(
1344   - REFERENCECONTROL_NameRecordExtended_SizeOfNameUnicode)
1345   - REFERENCECONTROL_Reserved3 = struct.unpack("<H", dir_stream.read(2))[0]
  1341 + referencecontrol_namerecordextended_reserved)
  1342 + referencecontrol_namerecordextended_sizeofnameunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1343 + referencecontrol_namerecordextended_nameunicode = dir_stream.read(
  1344 + referencecontrol_namerecordextended_sizeofnameunicode)
  1345 + referencecontrol_reserved3 = struct.unpack("<H", dir_stream.read(2))[0]
1346 1346 else:
1347   - REFERENCECONTROL_Reserved3 = check2
1348   -
1349   - check_value('REFERENCECONTROL_Reserved3', 0x0030, REFERENCECONTROL_Reserved3)
1350   - REFERENCECONTROL_SizeExtended = struct.unpack("<L", dir_stream.read(4))[0]
1351   - REFERENCECONTROL_SizeOfLibidExtended = struct.unpack("<L", dir_stream.read(4))[0]
1352   - REFERENCECONTROL_LibidExtended = dir_stream.read(REFERENCECONTROL_SizeOfLibidExtended)
1353   - REFERENCECONTROL_Reserved4 = struct.unpack("<L", dir_stream.read(4))[0]
1354   - REFERENCECONTROL_Reserved5 = struct.unpack("<H", dir_stream.read(2))[0]
1355   - REFERENCECONTROL_OriginalTypeLib = dir_stream.read(16)
1356   - REFERENCECONTROL_Cookie = struct.unpack("<L", dir_stream.read(4))[0]
  1347 + referencecontrol_reserved3 = check2
  1348 +
  1349 + check_value('REFERENCECONTROL_Reserved3', 0x0030, referencecontrol_reserved3)
  1350 + referencecontrol_sizeextended = struct.unpack("<L", dir_stream.read(4))[0]
  1351 + referencecontrol_sizeoflibidextended = struct.unpack("<L", dir_stream.read(4))[0]
  1352 + referencecontrol_libidextended = dir_stream.read(referencecontrol_sizeoflibidextended)
  1353 + referencecontrol_reserved4 = struct.unpack("<L", dir_stream.read(4))[0]
  1354 + referencecontrol_reserved5 = struct.unpack("<H", dir_stream.read(2))[0]
  1355 + referencecontrol_originaltypelib = dir_stream.read(16)
  1356 + referencecontrol_cookie = struct.unpack("<L", dir_stream.read(4))[0]
1357 1357 continue
1358 1358  
1359 1359 if check == 0x000D:
1360 1360 # REFERENCEREGISTERED
1361   - REFERENCEREGISTERED_Id = check
1362   - REFERENCEREGISTERED_Size = struct.unpack("<L", dir_stream.read(4))[0]
1363   - REFERENCEREGISTERED_SizeOfLibid = struct.unpack("<L", dir_stream.read(4))[0]
1364   - REFERENCEREGISTERED_Libid = dir_stream.read(REFERENCEREGISTERED_SizeOfLibid)
1365   - REFERENCEREGISTERED_Reserved1 = struct.unpack("<L", dir_stream.read(4))[0]
1366   - check_value('REFERENCEREGISTERED_Reserved1', 0x0000, REFERENCEREGISTERED_Reserved1)
1367   - REFERENCEREGISTERED_Reserved2 = struct.unpack("<H", dir_stream.read(2))[0]
1368   - check_value('REFERENCEREGISTERED_Reserved2', 0x0000, REFERENCEREGISTERED_Reserved2)
  1361 + referenceregistered_id = check
  1362 + referenceregistered_size = struct.unpack("<L", dir_stream.read(4))[0]
  1363 + referenceregistered_sizeoflibid = struct.unpack("<L", dir_stream.read(4))[0]
  1364 + referenceregistered_libid = dir_stream.read(referenceregistered_sizeoflibid)
  1365 + referenceregistered_reserved1 = struct.unpack("<L", dir_stream.read(4))[0]
  1366 + check_value('REFERENCEREGISTERED_Reserved1', 0x0000, referenceregistered_reserved1)
  1367 + referenceregistered_reserved2 = struct.unpack("<H", dir_stream.read(2))[0]
  1368 + check_value('REFERENCEREGISTERED_Reserved2', 0x0000, referenceregistered_reserved2)
1369 1369 continue
1370 1370  
1371 1371 if check == 0x000E:
1372 1372 # REFERENCEPROJECT
1373   - REFERENCEPROJECT_Id = check
1374   - REFERENCEPROJECT_Size = struct.unpack("<L", dir_stream.read(4))[0]
1375   - REFERENCEPROJECT_SizeOfLibidAbsolute = struct.unpack("<L", dir_stream.read(4))[0]
1376   - REFERENCEPROJECT_LibidAbsolute = dir_stream.read(REFERENCEPROJECT_SizeOfLibidAbsolute)
1377   - REFERENCEPROJECT_SizeOfLibidRelative = struct.unpack("<L", dir_stream.read(4))[0]
1378   - REFERENCEPROJECT_LibidRelative = dir_stream.read(REFERENCEPROJECT_SizeOfLibidRelative)
1379   - REFERENCEPROJECT_MajorVersion = struct.unpack("<L", dir_stream.read(4))[0]
1380   - REFERENCEPROJECT_MinorVersion = struct.unpack("<H", dir_stream.read(2))[0]
  1373 + referenceproject_id = check
  1374 + referenceproject_size = struct.unpack("<L", dir_stream.read(4))[0]
  1375 + referenceproject_sizeoflibidabsolute = struct.unpack("<L", dir_stream.read(4))[0]
  1376 + referenceproject_libidabsolute = dir_stream.read(referenceproject_sizeoflibidabsolute)
  1377 + referenceproject_sizeoflibidrelative = struct.unpack("<L", dir_stream.read(4))[0]
  1378 + referenceproject_libidrelative = dir_stream.read(referenceproject_sizeoflibidrelative)
  1379 + referenceproject_majorversion = struct.unpack("<L", dir_stream.read(4))[0]
  1380 + referenceproject_minorversion = struct.unpack("<H", dir_stream.read(2))[0]
1381 1381 continue
1382 1382  
1383 1383 log.error('invalid or unknown check Id {0:04X}'.format(check))
1384 1384 sys.exit(0)
1385 1385  
1386   - PROJECTMODULES_Id = check #struct.unpack("<H", dir_stream.read(2))[0]
1387   - check_value('PROJECTMODULES_Id', 0x000F, PROJECTMODULES_Id)
1388   - PROJECTMODULES_Size = struct.unpack("<L", dir_stream.read(4))[0]
1389   - check_value('PROJECTMODULES_Size', 0x0002, PROJECTMODULES_Size)
1390   - PROJECTMODULES_Count = struct.unpack("<H", dir_stream.read(2))[0]
1391   - PROJECTMODULES_ProjectCookieRecord_Id = struct.unpack("<H", dir_stream.read(2))[0]
1392   - check_value('PROJECTMODULES_ProjectCookieRecord_Id', 0x0013, PROJECTMODULES_ProjectCookieRecord_Id)
1393   - PROJECTMODULES_ProjectCookieRecord_Size = struct.unpack("<L", dir_stream.read(4))[0]
1394   - check_value('PROJECTMODULES_ProjectCookieRecord_Size', 0x0002, PROJECTMODULES_ProjectCookieRecord_Size)
1395   - PROJECTMODULES_ProjectCookieRecord_Cookie = struct.unpack("<H", dir_stream.read(2))[0]
1396   -
1397   - log.debug("parsing {0} modules".format(PROJECTMODULES_Count))
1398   - for x in xrange(0, PROJECTMODULES_Count):
1399   - MODULENAME_Id = struct.unpack("<H", dir_stream.read(2))[0]
1400   - check_value('MODULENAME_Id', 0x0019, MODULENAME_Id)
1401   - MODULENAME_SizeOfModuleName = struct.unpack("<L", dir_stream.read(4))[0]
1402   - MODULENAME_ModuleName = dir_stream.read(MODULENAME_SizeOfModuleName)
  1386 + projectmodules_id = check #struct.unpack("<H", dir_stream.read(2))[0]
  1387 + check_value('PROJECTMODULES_Id', 0x000F, projectmodules_id)
  1388 + projectmodules_size = struct.unpack("<L", dir_stream.read(4))[0]
  1389 + check_value('PROJECTMODULES_Size', 0x0002, projectmodules_size)
  1390 + projectmodules_count = struct.unpack("<H", dir_stream.read(2))[0]
  1391 + projectmodules_projectcookierecord_id = struct.unpack("<H", dir_stream.read(2))[0]
  1392 + check_value('PROJECTMODULES_ProjectCookieRecord_Id', 0x0013, projectmodules_projectcookierecord_id)
  1393 + projectmodules_projectcookierecord_size = struct.unpack("<L", dir_stream.read(4))[0]
  1394 + check_value('PROJECTMODULES_ProjectCookieRecord_Size', 0x0002, projectmodules_projectcookierecord_size)
  1395 + projectmodules_projectcookierecord_cookie = struct.unpack("<H", dir_stream.read(2))[0]
  1396 +
  1397 + log.debug("parsing {0} modules".format(projectmodules_count))
  1398 + for x in xrange(0, projectmodules_count):
  1399 + modulename_id = struct.unpack("<H", dir_stream.read(2))[0]
  1400 + check_value('MODULENAME_Id', 0x0019, modulename_id)
  1401 + modulename_sizeofmodulename = struct.unpack("<L", dir_stream.read(4))[0]
  1402 + modulename_modulename = dir_stream.read(modulename_sizeofmodulename)
1403 1403 # account for optional sections
1404 1404 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1405 1405 if section_id == 0x0047:
1406   - MODULENAMEUNICODE_Id = section_id
1407   - MODULENAMEUNICODE_SizeOfModuleNameUnicode = struct.unpack("<L", dir_stream.read(4))[0]
1408   - MODULENAMEUNICODE_ModuleNameUnicode = dir_stream.read(MODULENAMEUNICODE_SizeOfModuleNameUnicode)
  1406 + modulenameunicode_id = section_id
  1407 + modulenameunicode_sizeofmodulenameunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1408 + modulenameunicode_modulenameunicode = dir_stream.read(modulenameunicode_sizeofmodulenameunicode)
1409 1409 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1410 1410 if section_id == 0x001A:
1411   - MODULESTREAMNAME_id = section_id
1412   - MODULESTREAMNAME_SizeOfStreamName = struct.unpack("<L", dir_stream.read(4))[0]
1413   - MODULESTREAMNAME_StreamName = dir_stream.read(MODULESTREAMNAME_SizeOfStreamName)
1414   - MODULESTREAMNAME_Reserved = struct.unpack("<H", dir_stream.read(2))[0]
1415   - check_value('MODULESTREAMNAME_Reserved', 0x0032, MODULESTREAMNAME_Reserved)
1416   - MODULESTREAMNAME_SizeOfStreamNameUnicode = struct.unpack("<L", dir_stream.read(4))[0]
1417   - MODULESTREAMNAME_StreamNameUnicode = dir_stream.read(MODULESTREAMNAME_SizeOfStreamNameUnicode)
  1411 + modulestreamname_id = section_id
  1412 + modulestreamname_sizeofstreamname = struct.unpack("<L", dir_stream.read(4))[0]
  1413 + modulestreamname_streamname = dir_stream.read(modulestreamname_sizeofstreamname)
  1414 + modulestreamname_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1415 + check_value('MODULESTREAMNAME_Reserved', 0x0032, modulestreamname_reserved)
  1416 + modulestreamname_sizeofstreamnameunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1417 + modulestreamname_streamnameunicode = dir_stream.read(modulestreamname_sizeofstreamnameunicode)
1418 1418 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1419 1419 if section_id == 0x001C:
1420   - MODULEDOCSTRING_Id = section_id
1421   - check_value('MODULEDOCSTRING_Id', 0x001C, MODULEDOCSTRING_Id)
1422   - MODULEDOCSTRING_SizeOfDocString = struct.unpack("<L", dir_stream.read(4))[0]
1423   - MODULEDOCSTRING_DocString = dir_stream.read(MODULEDOCSTRING_SizeOfDocString)
1424   - MODULEDOCSTRING_Reserved = struct.unpack("<H", dir_stream.read(2))[0]
1425   - check_value('MODULEDOCSTRING_Reserved', 0x0048, MODULEDOCSTRING_Reserved)
1426   - MODULEDOCSTRING_SizeOfDocStringUnicode = struct.unpack("<L", dir_stream.read(4))[0]
1427   - MODULEDOCSTRING_DocStringUnicode = dir_stream.read(MODULEDOCSTRING_SizeOfDocStringUnicode)
  1420 + moduledocstring_id = section_id
  1421 + check_value('MODULEDOCSTRING_Id', 0x001C, moduledocstring_id)
  1422 + moduledocstring_sizeofdocstring = struct.unpack("<L", dir_stream.read(4))[0]
  1423 + moduledocstring_docstring = dir_stream.read(moduledocstring_sizeofdocstring)
  1424 + moduledocstring_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1425 + check_value('MODULEDOCSTRING_Reserved', 0x0048, moduledocstring_reserved)
  1426 + moduledocstring_sizeofdocstringunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1427 + moduledocstring_docstringunicode = dir_stream.read(moduledocstring_sizeofdocstringunicode)
1428 1428 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1429 1429 if section_id == 0x0031:
1430   - MODULEOFFSET_Id = section_id
1431   - check_value('MODULEOFFSET_Id', 0x0031, MODULEOFFSET_Id)
1432   - MODULEOFFSET_Size = struct.unpack("<L", dir_stream.read(4))[0]
1433   - check_value('MODULEOFFSET_Size', 0x0004, MODULEOFFSET_Size)
1434   - MODULEOFFSET_TextOffset = struct.unpack("<L", dir_stream.read(4))[0]
  1430 + moduleoffset_id = section_id
  1431 + check_value('MODULEOFFSET_Id', 0x0031, moduleoffset_id)
  1432 + moduleoffset_size = struct.unpack("<L", dir_stream.read(4))[0]
  1433 + check_value('MODULEOFFSET_Size', 0x0004, moduleoffset_size)
  1434 + moduleoffset_textoffset = struct.unpack("<L", dir_stream.read(4))[0]
1435 1435 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1436 1436 if section_id == 0x001E:
1437   - MODULEHELPCONTEXT_Id = section_id
1438   - check_value('MODULEHELPCONTEXT_Id', 0x001E, MODULEHELPCONTEXT_Id)
1439   - MODULEHELPCONTEXT_Size = struct.unpack("<L", dir_stream.read(4))[0]
1440   - check_value('MODULEHELPCONTEXT_Size', 0x0004, MODULEHELPCONTEXT_Size)
1441   - MODULEHELPCONTEXT_HelpContext = struct.unpack("<L", dir_stream.read(4))[0]
  1437 + modulehelpcontext_id = section_id
  1438 + check_value('MODULEHELPCONTEXT_Id', 0x001E, modulehelpcontext_id)
  1439 + modulehelpcontext_size = struct.unpack("<L", dir_stream.read(4))[0]
  1440 + check_value('MODULEHELPCONTEXT_Size', 0x0004, modulehelpcontext_size)
  1441 + modulehelpcontext_helpcontext = struct.unpack("<L", dir_stream.read(4))[0]
1442 1442 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1443 1443 if section_id == 0x002C:
1444   - MODULECOOKIE_Id = section_id
1445   - check_value('MODULECOOKIE_Id', 0x002C, MODULECOOKIE_Id)
1446   - MODULECOOKIE_Size = struct.unpack("<L", dir_stream.read(4))[0]
1447   - check_value('MODULECOOKIE_Size', 0x0002, MODULECOOKIE_Size)
1448   - MODULECOOKIE_Cookie = struct.unpack("<H", dir_stream.read(2))[0]
  1444 + modulecookie_id = section_id
  1445 + check_value('MODULECOOKIE_Id', 0x002C, modulecookie_id)
  1446 + modulecookie_size = struct.unpack("<L", dir_stream.read(4))[0]
  1447 + check_value('MODULECOOKIE_Size', 0x0002, modulecookie_size)
  1448 + modulecookie_cookie = struct.unpack("<H", dir_stream.read(2))[0]
1449 1449 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1450 1450 if section_id == 0x0021 or section_id == 0x0022:
1451   - MODULETYPE_Id = section_id
1452   - MODULETYPE_Reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1451 + moduletype_id = section_id
  1452 + moduletype_reserved = struct.unpack("<L", dir_stream.read(4))[0]
1453 1453 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1454 1454 if section_id == 0x0025:
1455   - MODULEREADONLY_Id = section_id
1456   - check_value('MODULEREADONLY_Id', 0x0025, MODULEREADONLY_Id)
1457   - MODULEREADONLY_Reserved = struct.unpack("<L", dir_stream.read(4))[0]
1458   - check_value('MODULEREADONLY_Reserved', 0x0000, MODULEREADONLY_Reserved)
  1455 + modulereadonly_id = section_id
  1456 + check_value('MODULEREADONLY_Id', 0x0025, modulereadonly_id)
  1457 + modulereadonly_reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1458 + check_value('MODULEREADONLY_Reserved', 0x0000, modulereadonly_reserved)
1459 1459 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1460 1460 if section_id == 0x0028:
1461   - MODULEPRIVATE_Id = section_id
1462   - check_value('MODULEPRIVATE_Id', 0x0028, MODULEPRIVATE_Id)
1463   - MODULEPRIVATE_Reserved = struct.unpack("<L", dir_stream.read(4))[0]
1464   - check_value('MODULEPRIVATE_Reserved', 0x0000, MODULEPRIVATE_Reserved)
  1461 + moduleprivate_id = section_id
  1462 + check_value('MODULEPRIVATE_Id', 0x0028, moduleprivate_id)
  1463 + moduleprivate_reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1464 + check_value('MODULEPRIVATE_Reserved', 0x0000, moduleprivate_reserved)
1465 1465 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1466 1466 if section_id == 0x002B: # TERMINATOR
1467   - MODULE_Reserved = struct.unpack("<L", dir_stream.read(4))[0]
1468   - check_value('MODULE_Reserved', 0x0000, MODULE_Reserved)
  1467 + module_reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1468 + check_value('MODULE_Reserved', 0x0000, module_reserved)
1469 1469 section_id = None
1470 1470 if section_id != None:
1471 1471 log.warning('unknown or invalid module section id {0:04X}'.format(section_id))
1472 1472  
1473   - log.debug('Project CodePage = %d' % PROJECTCODEPAGE_CodePage)
1474   - vba_codec = 'cp%d' % PROJECTCODEPAGE_CodePage
1475   - log.debug("ModuleName = {0}".format(MODULENAME_ModuleName))
1476   - log.debug("StreamName = {0}".format(repr(MODULESTREAMNAME_StreamName)))
1477   - streamname_unicode = MODULESTREAMNAME_StreamName.decode(vba_codec)
  1473 + log.debug('Project CodePage = %d' % projectcodepage_codepage)
  1474 + vba_codec = 'cp%d' % projectcodepage_codepage
  1475 + log.debug("ModuleName = {0}".format(modulename_modulename))
  1476 + log.debug("StreamName = {0}".format(repr(modulestreamname_streamname)))
  1477 + streamname_unicode = modulestreamname_streamname.decode(vba_codec)
1478 1478 log.debug("StreamName.decode('%s') = %s" % (vba_codec, repr(streamname_unicode)))
1479   - log.debug("StreamNameUnicode = {0}".format(repr(MODULESTREAMNAME_StreamNameUnicode)))
1480   - log.debug("TextOffset = {0}".format(MODULEOFFSET_TextOffset))
  1479 + log.debug("StreamNameUnicode = {0}".format(repr(modulestreamname_streamnameunicode)))
  1480 + log.debug("TextOffset = {0}".format(moduleoffset_textoffset))
1481 1481  
1482 1482 code_path = vba_root + u'VBA/' + streamname_unicode
1483 1483 #TODO: test if stream exists
1484 1484 log.debug('opening VBA code stream %s' % repr(code_path))
1485 1485 code_data = ole.openstream(code_path).read()
1486 1486 log.debug("length of code_data = {0}".format(len(code_data)))
1487   - log.debug("offset of code_data = {0}".format(MODULEOFFSET_TextOffset))
1488   - code_data = code_data[MODULEOFFSET_TextOffset:]
  1487 + log.debug("offset of code_data = {0}".format(moduleoffset_textoffset))
  1488 + code_data = code_data[moduleoffset_textoffset:]
1489 1489 if len(code_data) > 0:
1490 1490 code_data = decompress_stream(code_data)
1491 1491 # case-insensitive search in the code_modules dict to find the file extension:
1492   - filext = code_modules.get(MODULENAME_ModuleName.lower(), 'bin')
1493   - filename = '{0}.{1}'.format(MODULENAME_ModuleName, filext)
  1492 + filext = code_modules.get(modulename_modulename.lower(), 'bin')
  1493 + filename = '{0}.{1}'.format(modulename_modulename, filext)
1494 1494 #TODO: also yield the codepage so that callers can decode it properly
1495 1495 yield (code_path, filename, code_data)
1496 1496 # print '-'*79
... ... @@ -1500,7 +1500,7 @@ def _extract_vba(ole, vba_root, project_path, dir_path):
1500 1500 # print ''
1501 1501 log.debug('extracted file {0}'.format(filename))
1502 1502 else:
1503   - log.warning("module stream {0} has code data length 0".format(MODULESTREAMNAME_StreamName))
  1503 + log.warning("module stream {0} has code data length 0".format(modulestreamname_streamname))
1504 1504 return
1505 1505  
1506 1506  
... ...