Peter M. Groen / oletools

Commit 98bf5c3639bea6ba484c391297afd0a5490c7313

Authored by Christian Herdtweck
1 parent 2dd314cd

pylint-ify 2: lower-case-ify PROJECT... REFERENCE... MODULE vars in _extract_vba 

(I just love my vim...)
Inline Side-by-side
Showing 1 changed file with 213 additions and 213 deletions
oletools/olevba.py
  View file @98bf5c3
@@ -76,7 +76,7 @@ https://github.com/unixfreak0037/officeparser @@ -76,7 +76,7 @@ https://github.com/unixfreak0037/officeparser
76 # CHANGELOG: 76 # CHANGELOG:
77 # 2014-08-05 v0.01 PL: - first version based on officeparser code 77 # 2014-08-05 v0.01 PL: - first version based on officeparser code
78 # 2014-08-14 v0.02 PL: - fixed bugs in code, added license from officeparser 78 # 2014-08-14 v0.02 PL: - fixed bugs in code, added license from officeparser
79 -# 2014-08-15 PL: - fixed incorrect value check in PROJECTHELPFILEPATH Record 79 +# 2014-08-15 PL: - fixed incorrect value check in projecthelpfilepath Record
80 # 2014-08-15 v0.03 PL: - refactored extract_macros to support OpenXML formats 80 # 2014-08-15 v0.03 PL: - refactored extract_macros to support OpenXML formats
81 # and to find the VBA project root anywhere in the file 81 # and to find the VBA project root anywhere in the file
82 # 2014-11-29 v0.04 PL: - use olefile instead of OleFileIO_PL 82 # 2014-11-29 v0.04 PL: - use olefile instead of OleFileIO_PL
@@ -1176,122 +1176,122 @@ def _extract_vba(ole, vba_root, project_path, dir_path): @@ -1176,122 +1176,122 @@ def _extract_vba(ole, vba_root, project_path, dir_path):
1176 dir_stream = cStringIO.StringIO(decompress_stream(dir_compressed)) 1176 dir_stream = cStringIO.StringIO(decompress_stream(dir_compressed))
1177 1177
1178 # PROJECTSYSKIND Record 1178 # PROJECTSYSKIND Record
1179 - PROJECTSYSKIND_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1180 - check_value('PROJECTSYSKIND_Id', 0x0001, PROJECTSYSKIND_Id)  
1181 - PROJECTSYSKIND_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1182 - check_value('PROJECTSYSKIND_Size', 0x0004, PROJECTSYSKIND_Size)  
1183 - PROJECTSYSKIND_SysKind = struct.unpack("<L", dir_stream.read(4))[0]  
1184 - if PROJECTSYSKIND_SysKind == 0x00: 1179 + projectsyskind_id = struct.unpack("<H", dir_stream.read(2))[0]
  1180 + check_value('PROJECTSYSKIND_Id', 0x0001, projectsyskind_id)
  1181 + projectsyskind_size = struct.unpack("<L", dir_stream.read(4))[0]
  1182 + check_value('PROJECTSYSKIND_Size', 0x0004, projectsyskind_size)
  1183 + projectsyskind_syskind = struct.unpack("<L", dir_stream.read(4))[0]
  1184 + if projectsyskind_syskind == 0x00:
1185 log.debug("16-bit Windows") 1185 log.debug("16-bit Windows")
1186 - elif PROJECTSYSKIND_SysKind == 0x01: 1186 + elif projectsyskind_syskind == 0x01:
1187 log.debug("32-bit Windows") 1187 log.debug("32-bit Windows")
1188 - elif PROJECTSYSKIND_SysKind == 0x02: 1188 + elif projectsyskind_syskind == 0x02:
1189 log.debug("Macintosh") 1189 log.debug("Macintosh")
1190 - elif PROJECTSYSKIND_SysKind == 0x03: 1190 + elif projectsyskind_syskind == 0x03:
1191 log.debug("64-bit Windows") 1191 log.debug("64-bit Windows")
1192 else: 1192 else:
1193 - log.error("invalid PROJECTSYSKIND_SysKind {0:04X}".format(PROJECTSYSKIND_SysKind)) 1193 + log.error("invalid PROJECTSYSKIND_SysKind {0:04X}".format(projectsyskind_syskind))
1194 1194
1195 # PROJECTLCID Record 1195 # PROJECTLCID Record
1196 - PROJECTLCID_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1197 - check_value('PROJECTLCID_Id', 0x0002, PROJECTLCID_Id)  
1198 - PROJECTLCID_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1199 - check_value('PROJECTLCID_Size', 0x0004, PROJECTLCID_Size)  
1200 - PROJECTLCID_Lcid = struct.unpack("<L", dir_stream.read(4))[0]  
1201 - check_value('PROJECTLCID_Lcid', 0x409, PROJECTLCID_Lcid) 1196 + projectlcid_id = struct.unpack("<H", dir_stream.read(2))[0]
  1197 + check_value('PROJECTLCID_Id', 0x0002, projectlcid_id)
  1198 + projectlcid_size = struct.unpack("<L", dir_stream.read(4))[0]
  1199 + check_value('PROJECTLCID_Size', 0x0004, projectlcid_size)
  1200 + projectlcid_lcid = struct.unpack("<L", dir_stream.read(4))[0]
  1201 + check_value('PROJECTLCID_Lcid', 0x409, projectlcid_lcid)
1202 1202
1203 # PROJECTLCIDINVOKE Record 1203 # PROJECTLCIDINVOKE Record
1204 - PROJECTLCIDINVOKE_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1205 - check_value('PROJECTLCIDINVOKE_Id', 0x0014, PROJECTLCIDINVOKE_Id)  
1206 - PROJECTLCIDINVOKE_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1207 - check_value('PROJECTLCIDINVOKE_Size', 0x0004, PROJECTLCIDINVOKE_Size)  
1208 - PROJECTLCIDINVOKE_LcidInvoke = struct.unpack("<L", dir_stream.read(4))[0]  
1209 - check_value('PROJECTLCIDINVOKE_LcidInvoke', 0x409, PROJECTLCIDINVOKE_LcidInvoke) 1204 + projectlcidinvoke_id = struct.unpack("<H", dir_stream.read(2))[0]
  1205 + check_value('PROJECTLCIDINVOKE_Id', 0x0014, projectlcidinvoke_id)
  1206 + projectlcidinvoke_size = struct.unpack("<L", dir_stream.read(4))[0]
  1207 + check_value('PROJECTLCIDINVOKE_Size', 0x0004, projectlcidinvoke_size)
  1208 + projectlcidinvoke_lcidinvoke = struct.unpack("<L", dir_stream.read(4))[0]
  1209 + check_value('PROJECTLCIDINVOKE_LcidInvoke', 0x409, projectlcidinvoke_lcidinvoke)
1210 1210
1211 # PROJECTCODEPAGE Record 1211 # PROJECTCODEPAGE Record
1212 - PROJECTCODEPAGE_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1213 - check_value('PROJECTCODEPAGE_Id', 0x0003, PROJECTCODEPAGE_Id)  
1214 - PROJECTCODEPAGE_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1215 - check_value('PROJECTCODEPAGE_Size', 0x0002, PROJECTCODEPAGE_Size)  
1216 - PROJECTCODEPAGE_CodePage = struct.unpack("<H", dir_stream.read(2))[0] 1212 + projectcodepage_id = struct.unpack("<H", dir_stream.read(2))[0]
  1213 + check_value('PROJECTCODEPAGE_Id', 0x0003, projectcodepage_id)
  1214 + projectcodepage_size = struct.unpack("<L", dir_stream.read(4))[0]
  1215 + check_value('PROJECTCODEPAGE_Size', 0x0002, projectcodepage_size)
  1216 + projectcodepage_codepage = struct.unpack("<H", dir_stream.read(2))[0]
1217 1217
1218 # PROJECTNAME Record 1218 # PROJECTNAME Record
1219 - PROJECTNAME_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1220 - check_value('PROJECTNAME_Id', 0x0004, PROJECTNAME_Id)  
1221 - PROJECTNAME_SizeOfProjectName = struct.unpack("<L", dir_stream.read(4))[0]  
1222 - if PROJECTNAME_SizeOfProjectName < 1 or PROJECTNAME_SizeOfProjectName > 128:  
1223 - log.error("PROJECTNAME_SizeOfProjectName value not in range: {0}".format(PROJECTNAME_SizeOfProjectName))  
1224 - PROJECTNAME_ProjectName = dir_stream.read(PROJECTNAME_SizeOfProjectName) 1219 + projectname_id = struct.unpack("<H", dir_stream.read(2))[0]
  1220 + check_value('PROJECTNAME_Id', 0x0004, projectname_id)
  1221 + projectname_sizeofprojectname = struct.unpack("<L", dir_stream.read(4))[0]
  1222 + if projectname_sizeofprojectname < 1 or projectname_sizeofprojectname > 128:
  1223 + log.error("PROJECTNAME_SizeOfProjectName value not in range: {0}".format(projectname_sizeofprojectname))
  1224 + projectname_projectname = dir_stream.read(projectname_sizeofprojectname)
1225 1225
1226 # PROJECTDOCSTRING Record 1226 # PROJECTDOCSTRING Record
1227 - PROJECTDOCSTRING_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1228 - check_value('PROJECTDOCSTRING_Id', 0x0005, PROJECTDOCSTRING_Id)  
1229 - PROJECTDOCSTRING_SizeOfDocString = struct.unpack("<L", dir_stream.read(4))[0]  
1230 - if PROJECTNAME_SizeOfProjectName > 2000: 1227 + projectdocstring_id = struct.unpack("<H", dir_stream.read(2))[0]
  1228 + check_value('PROJECTDOCSTRING_Id', 0x0005, projectdocstring_id)
  1229 + projectdocstring_sizeofdocstring = struct.unpack("<L", dir_stream.read(4))[0]
  1230 + if projectname_sizeofprojectname > 2000:
1231 log.error( 1231 log.error(
1232 - "PROJECTDOCSTRING_SizeOfDocString value not in range: {0}".format(PROJECTDOCSTRING_SizeOfDocString))  
1233 - PROJECTDOCSTRING_DocString = dir_stream.read(PROJECTDOCSTRING_SizeOfDocString)  
1234 - PROJECTDOCSTRING_Reserved = struct.unpack("<H", dir_stream.read(2))[0]  
1235 - check_value('PROJECTDOCSTRING_Reserved', 0x0040, PROJECTDOCSTRING_Reserved)  
1236 - PROJECTDOCSTRING_SizeOfDocStringUnicode = struct.unpack("<L", dir_stream.read(4))[0]  
1237 - if PROJECTDOCSTRING_SizeOfDocStringUnicode % 2 != 0: 1232 + "PROJECTDOCSTRING_SizeOfDocString value not in range: {0}".format(projectdocstring_sizeofdocstring))
  1233 + projectdocstring_docstring = dir_stream.read(projectdocstring_sizeofdocstring)
  1234 + projectdocstring_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1235 + check_value('PROJECTDOCSTRING_Reserved', 0x0040, projectdocstring_reserved)
  1236 + projectdocstring_sizeofdocstringunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1237 + if projectdocstring_sizeofdocstringunicode % 2 != 0:
1238 log.error("PROJECTDOCSTRING_SizeOfDocStringUnicode is not even") 1238 log.error("PROJECTDOCSTRING_SizeOfDocStringUnicode is not even")
1239 - PROJECTDOCSTRING_DocStringUnicode = dir_stream.read(PROJECTDOCSTRING_SizeOfDocStringUnicode) 1239 + projectdocstring_docstringunicode = dir_stream.read(projectdocstring_sizeofdocstringunicode)
1240 1240
1241 # PROJECTHELPFILEPATH Record - MS-OVBA 2.3.4.2.1.7 1241 # PROJECTHELPFILEPATH Record - MS-OVBA 2.3.4.2.1.7
1242 - PROJECTHELPFILEPATH_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1243 - check_value('PROJECTHELPFILEPATH_Id', 0x0006, PROJECTHELPFILEPATH_Id)  
1244 - PROJECTHELPFILEPATH_SizeOfHelpFile1 = struct.unpack("<L", dir_stream.read(4))[0]  
1245 - if PROJECTHELPFILEPATH_SizeOfHelpFile1 > 260: 1242 + projecthelpfilepath_id = struct.unpack("<H", dir_stream.read(2))[0]
  1243 + check_value('PROJECTHELPFILEPATH_Id', 0x0006, projecthelpfilepath_id)
  1244 + projecthelpfilepath_sizeofhelpfile1 = struct.unpack("<L", dir_stream.read(4))[0]
  1245 + if projecthelpfilepath_sizeofhelpfile1 > 260:
1246 log.error( 1246 log.error(
1247 - "PROJECTHELPFILEPATH_SizeOfHelpFile1 value not in range: {0}".format(PROJECTHELPFILEPATH_SizeOfHelpFile1))  
1248 - PROJECTHELPFILEPATH_HelpFile1 = dir_stream.read(PROJECTHELPFILEPATH_SizeOfHelpFile1)  
1249 - PROJECTHELPFILEPATH_Reserved = struct.unpack("<H", dir_stream.read(2))[0]  
1250 - check_value('PROJECTHELPFILEPATH_Reserved', 0x003D, PROJECTHELPFILEPATH_Reserved)  
1251 - PROJECTHELPFILEPATH_SizeOfHelpFile2 = struct.unpack("<L", dir_stream.read(4))[0]  
1252 - if PROJECTHELPFILEPATH_SizeOfHelpFile2 != PROJECTHELPFILEPATH_SizeOfHelpFile1: 1247 + "PROJECTHELPFILEPATH_SizeOfHelpFile1 value not in range: {0}".format(projecthelpfilepath_sizeofhelpfile1))
  1248 + projecthelpfilepath_helpfile1 = dir_stream.read(projecthelpfilepath_sizeofhelpfile1)
  1249 + projecthelpfilepath_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1250 + check_value('PROJECTHELPFILEPATH_Reserved', 0x003D, projecthelpfilepath_reserved)
  1251 + projecthelpfilepath_sizeofhelpfile2 = struct.unpack("<L", dir_stream.read(4))[0]
  1252 + if projecthelpfilepath_sizeofhelpfile2 != projecthelpfilepath_sizeofhelpfile1:
1253 log.error("PROJECTHELPFILEPATH_SizeOfHelpFile1 does not equal PROJECTHELPFILEPATH_SizeOfHelpFile2") 1253 log.error("PROJECTHELPFILEPATH_SizeOfHelpFile1 does not equal PROJECTHELPFILEPATH_SizeOfHelpFile2")
1254 - PROJECTHELPFILEPATH_HelpFile2 = dir_stream.read(PROJECTHELPFILEPATH_SizeOfHelpFile2)  
1255 - if PROJECTHELPFILEPATH_HelpFile2 != PROJECTHELPFILEPATH_HelpFile1: 1254 + projecthelpfilepath_helpfile2 = dir_stream.read(projecthelpfilepath_sizeofhelpfile2)
  1255 + if projecthelpfilepath_helpfile2 != projecthelpfilepath_helpfile1:
1256 log.error("PROJECTHELPFILEPATH_HelpFile1 does not equal PROJECTHELPFILEPATH_HelpFile2") 1256 log.error("PROJECTHELPFILEPATH_HelpFile1 does not equal PROJECTHELPFILEPATH_HelpFile2")
1257 1257
1258 # PROJECTHELPCONTEXT Record 1258 # PROJECTHELPCONTEXT Record
1259 - PROJECTHELPCONTEXT_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1260 - check_value('PROJECTHELPCONTEXT_Id', 0x0007, PROJECTHELPCONTEXT_Id)  
1261 - PROJECTHELPCONTEXT_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1262 - check_value('PROJECTHELPCONTEXT_Size', 0x0004, PROJECTHELPCONTEXT_Size)  
1263 - PROJECTHELPCONTEXT_HelpContext = struct.unpack("<L", dir_stream.read(4))[0] 1259 + projecthelpcontext_id = struct.unpack("<H", dir_stream.read(2))[0]
  1260 + check_value('PROJECTHELPCONTEXT_Id', 0x0007, projecthelpcontext_id)
  1261 + projecthelpcontext_size = struct.unpack("<L", dir_stream.read(4))[0]
  1262 + check_value('PROJECTHELPCONTEXT_Size', 0x0004, projecthelpcontext_size)
  1263 + projecthelpcontext_helpcontext = struct.unpack("<L", dir_stream.read(4))[0]
1264 1264
1265 # PROJECTLIBFLAGS Record 1265 # PROJECTLIBFLAGS Record
1266 - PROJECTLIBFLAGS_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1267 - check_value('PROJECTLIBFLAGS_Id', 0x0008, PROJECTLIBFLAGS_Id)  
1268 - PROJECTLIBFLAGS_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1269 - check_value('PROJECTLIBFLAGS_Size', 0x0004, PROJECTLIBFLAGS_Size)  
1270 - PROJECTLIBFLAGS_ProjectLibFlags = struct.unpack("<L", dir_stream.read(4))[0]  
1271 - check_value('PROJECTLIBFLAGS_ProjectLibFlags', 0x0000, PROJECTLIBFLAGS_ProjectLibFlags) 1266 + projectlibflags_id = struct.unpack("<H", dir_stream.read(2))[0]
  1267 + check_value('PROJECTLIBFLAGS_Id', 0x0008, projectlibflags_id)
  1268 + projectlibflags_size = struct.unpack("<L", dir_stream.read(4))[0]
  1269 + check_value('PROJECTLIBFLAGS_Size', 0x0004, projectlibflags_size)
  1270 + projectlibflags_projectlibflags = struct.unpack("<L", dir_stream.read(4))[0]
  1271 + check_value('PROJECTLIBFLAGS_ProjectLibFlags', 0x0000, projectlibflags_projectlibflags)
1272 1272
1273 # PROJECTVERSION Record 1273 # PROJECTVERSION Record
1274 - PROJECTVERSION_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1275 - check_value('PROJECTVERSION_Id', 0x0009, PROJECTVERSION_Id)  
1276 - PROJECTVERSION_Reserved = struct.unpack("<L", dir_stream.read(4))[0]  
1277 - check_value('PROJECTVERSION_Reserved', 0x0004, PROJECTVERSION_Reserved)  
1278 - PROJECTVERSION_VersionMajor = struct.unpack("<L", dir_stream.read(4))[0]  
1279 - PROJECTVERSION_VersionMinor = struct.unpack("<H", dir_stream.read(2))[0] 1274 + projectversion_id = struct.unpack("<H", dir_stream.read(2))[0]
  1275 + check_value('PROJECTVERSION_Id', 0x0009, projectversion_id)
  1276 + projectversion_reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1277 + check_value('PROJECTVERSION_Reserved', 0x0004, projectversion_reserved)
  1278 + projectversion_versionmajor = struct.unpack("<L", dir_stream.read(4))[0]
  1279 + projectversion_versionminor = struct.unpack("<H", dir_stream.read(2))[0]
1280 1280
1281 # PROJECTCONSTANTS Record 1281 # PROJECTCONSTANTS Record
1282 - PROJECTCONSTANTS_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1283 - check_value('PROJECTCONSTANTS_Id', 0x000C, PROJECTCONSTANTS_Id)  
1284 - PROJECTCONSTANTS_SizeOfConstants = struct.unpack("<L", dir_stream.read(4))[0]  
1285 - if PROJECTCONSTANTS_SizeOfConstants > 1015: 1282 + projectconstants_id = struct.unpack("<H", dir_stream.read(2))[0]
  1283 + check_value('PROJECTCONSTANTS_Id', 0x000C, projectconstants_id)
  1284 + projectconstants_sizeofconstants = struct.unpack("<L", dir_stream.read(4))[0]
  1285 + if projectconstants_sizeofconstants > 1015:
1286 log.error( 1286 log.error(
1287 - "PROJECTCONSTANTS_SizeOfConstants value not in range: {0}".format(PROJECTCONSTANTS_SizeOfConstants))  
1288 - PROJECTCONSTANTS_Constants = dir_stream.read(PROJECTCONSTANTS_SizeOfConstants)  
1289 - PROJECTCONSTANTS_Reserved = struct.unpack("<H", dir_stream.read(2))[0]  
1290 - check_value('PROJECTCONSTANTS_Reserved', 0x003C, PROJECTCONSTANTS_Reserved)  
1291 - PROJECTCONSTANTS_SizeOfConstantsUnicode = struct.unpack("<L", dir_stream.read(4))[0]  
1292 - if PROJECTCONSTANTS_SizeOfConstantsUnicode % 2 != 0: 1287 + "PROJECTCONSTANTS_SizeOfConstants value not in range: {0}".format(projectconstants_sizeofconstants))
  1288 + projectconstants_constants = dir_stream.read(projectconstants_sizeofconstants)
  1289 + projectconstants_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1290 + check_value('PROJECTCONSTANTS_Reserved', 0x003C, projectconstants_reserved)
  1291 + projectconstants_sizeofconstantsunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1292 + if projectconstants_sizeofconstantsunicode % 2 != 0:
1293 log.error("PROJECTCONSTANTS_SizeOfConstantsUnicode is not even") 1293 log.error("PROJECTCONSTANTS_SizeOfConstantsUnicode is not even")
1294 - PROJECTCONSTANTS_ConstantsUnicode = dir_stream.read(PROJECTCONSTANTS_SizeOfConstantsUnicode) 1294 + projectconstants_constantsunicode = dir_stream.read(projectconstants_sizeofconstantsunicode)
1295 1295
1296 # array of REFERENCE records 1296 # array of REFERENCE records
1297 check = None 1297 check = None
@@ -1303,194 +1303,194 @@ def _extract_vba(ole, vba_root, project_path, dir_path): @@ -1303,194 +1303,194 @@ def _extract_vba(ole, vba_root, project_path, dir_path):
1303 1303
1304 if check == 0x0016: 1304 if check == 0x0016:
1305 # REFERENCENAME 1305 # REFERENCENAME
1306 - REFERENCE_Id = check  
1307 - REFERENCE_SizeOfName = struct.unpack("<L", dir_stream.read(4))[0]  
1308 - REFERENCE_Name = dir_stream.read(REFERENCE_SizeOfName)  
1309 - REFERENCE_Reserved = struct.unpack("<H", dir_stream.read(2))[0]  
1310 - check_value('REFERENCE_Reserved', 0x003E, REFERENCE_Reserved)  
1311 - REFERENCE_SizeOfNameUnicode = struct.unpack("<L", dir_stream.read(4))[0]  
1312 - REFERENCE_NameUnicode = dir_stream.read(REFERENCE_SizeOfNameUnicode) 1306 + reference_id = check
  1307 + reference_sizeofname = struct.unpack("<L", dir_stream.read(4))[0]
  1308 + reference_name = dir_stream.read(reference_sizeofname)
  1309 + reference_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1310 + check_value('REFERENCE_Reserved', 0x003E, reference_reserved)
  1311 + reference_sizeofnameunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1312 + reference_nameunicode = dir_stream.read(reference_sizeofnameunicode)
1313 continue 1313 continue
1314 1314
1315 if check == 0x0033: 1315 if check == 0x0033:
1316 # REFERENCEORIGINAL (followed by REFERENCECONTROL) 1316 # REFERENCEORIGINAL (followed by REFERENCECONTROL)
1317 - REFERENCEORIGINAL_Id = check  
1318 - REFERENCEORIGINAL_SizeOfLibidOriginal = struct.unpack("<L", dir_stream.read(4))[0]  
1319 - REFERENCEORIGINAL_LibidOriginal = dir_stream.read(REFERENCEORIGINAL_SizeOfLibidOriginal) 1317 + referenceoriginal_id = check
  1318 + referenceoriginal_sizeoflibidoriginal = struct.unpack("<L", dir_stream.read(4))[0]
  1319 + referenceoriginal_libidoriginal = dir_stream.read(referenceoriginal_sizeoflibidoriginal)
1320 continue 1320 continue
1321 1321
1322 if check == 0x002F: 1322 if check == 0x002F:
1323 # REFERENCECONTROL 1323 # REFERENCECONTROL
1324 - REFERENCECONTROL_Id = check  
1325 - REFERENCECONTROL_SizeTwiddled = struct.unpack("<L", dir_stream.read(4))[0] # ignore  
1326 - REFERENCECONTROL_SizeOfLibidTwiddled = struct.unpack("<L", dir_stream.read(4))[0]  
1327 - REFERENCECONTROL_LibidTwiddled = dir_stream.read(REFERENCECONTROL_SizeOfLibidTwiddled)  
1328 - REFERENCECONTROL_Reserved1 = struct.unpack("<L", dir_stream.read(4))[0] # ignore  
1329 - check_value('REFERENCECONTROL_Reserved1', 0x0000, REFERENCECONTROL_Reserved1)  
1330 - REFERENCECONTROL_Reserved2 = struct.unpack("<H", dir_stream.read(2))[0] # ignore  
1331 - check_value('REFERENCECONTROL_Reserved2', 0x0000, REFERENCECONTROL_Reserved2) 1324 + referencecontrol_id = check
  1325 + referencecontrol_sizetwiddled = struct.unpack("<L", dir_stream.read(4))[0] # ignore
  1326 + referencecontrol_sizeoflibidtwiddled = struct.unpack("<L", dir_stream.read(4))[0]
  1327 + referencecontrol_libidtwiddled = dir_stream.read(referencecontrol_sizeoflibidtwiddled)
  1328 + referencecontrol_reserved1 = struct.unpack("<L", dir_stream.read(4))[0] # ignore
  1329 + check_value('REFERENCECONTROL_Reserved1', 0x0000, referencecontrol_reserved1)
  1330 + referencecontrol_reserved2 = struct.unpack("<H", dir_stream.read(2))[0] # ignore
  1331 + check_value('REFERENCECONTROL_Reserved2', 0x0000, referencecontrol_reserved2)
1332 # optional field 1332 # optional field
1333 check2 = struct.unpack("<H", dir_stream.read(2))[0] 1333 check2 = struct.unpack("<H", dir_stream.read(2))[0]
1334 if check2 == 0x0016: 1334 if check2 == 0x0016:
1335 - REFERENCECONTROL_NameRecordExtended_Id = check  
1336 - REFERENCECONTROL_NameRecordExtended_SizeofName = struct.unpack("<L", dir_stream.read(4))[0]  
1337 - REFERENCECONTROL_NameRecordExtended_Name = dir_stream.read(  
1338 - REFERENCECONTROL_NameRecordExtended_SizeofName)  
1339 - REFERENCECONTROL_NameRecordExtended_Reserved = struct.unpack("<H", dir_stream.read(2))[0] 1335 + referencecontrol_namerecordextended_id = check
  1336 + referencecontrol_namerecordextended_sizeofname = struct.unpack("<L", dir_stream.read(4))[0]
  1337 + referencecontrol_namerecordextended_name = dir_stream.read(
  1338 + referencecontrol_namerecordextended_sizeofname)
  1339 + referencecontrol_namerecordextended_reserved = struct.unpack("<H", dir_stream.read(2))[0]
1340 check_value('REFERENCECONTROL_NameRecordExtended_Reserved', 0x003E, 1340 check_value('REFERENCECONTROL_NameRecordExtended_Reserved', 0x003E,
1341 - REFERENCECONTROL_NameRecordExtended_Reserved)  
1342 - REFERENCECONTROL_NameRecordExtended_SizeOfNameUnicode = struct.unpack("<L", dir_stream.read(4))[0]  
1343 - REFERENCECONTROL_NameRecordExtended_NameUnicode = dir_stream.read(  
1344 - REFERENCECONTROL_NameRecordExtended_SizeOfNameUnicode)  
1345 - REFERENCECONTROL_Reserved3 = struct.unpack("<H", dir_stream.read(2))[0] 1341 + referencecontrol_namerecordextended_reserved)
  1342 + referencecontrol_namerecordextended_sizeofnameunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1343 + referencecontrol_namerecordextended_nameunicode = dir_stream.read(
  1344 + referencecontrol_namerecordextended_sizeofnameunicode)
  1345 + referencecontrol_reserved3 = struct.unpack("<H", dir_stream.read(2))[0]
1346 else: 1346 else:
1347 - REFERENCECONTROL_Reserved3 = check2  
1348 -  
1349 - check_value('REFERENCECONTROL_Reserved3', 0x0030, REFERENCECONTROL_Reserved3)  
1350 - REFERENCECONTROL_SizeExtended = struct.unpack("<L", dir_stream.read(4))[0]  
1351 - REFERENCECONTROL_SizeOfLibidExtended = struct.unpack("<L", dir_stream.read(4))[0]  
1352 - REFERENCECONTROL_LibidExtended = dir_stream.read(REFERENCECONTROL_SizeOfLibidExtended)  
1353 - REFERENCECONTROL_Reserved4 = struct.unpack("<L", dir_stream.read(4))[0]  
1354 - REFERENCECONTROL_Reserved5 = struct.unpack("<H", dir_stream.read(2))[0]  
1355 - REFERENCECONTROL_OriginalTypeLib = dir_stream.read(16)  
1356 - REFERENCECONTROL_Cookie = struct.unpack("<L", dir_stream.read(4))[0] 1347 + referencecontrol_reserved3 = check2
  1348 +
  1349 + check_value('REFERENCECONTROL_Reserved3', 0x0030, referencecontrol_reserved3)
  1350 + referencecontrol_sizeextended = struct.unpack("<L", dir_stream.read(4))[0]
  1351 + referencecontrol_sizeoflibidextended = struct.unpack("<L", dir_stream.read(4))[0]
  1352 + referencecontrol_libidextended = dir_stream.read(referencecontrol_sizeoflibidextended)
  1353 + referencecontrol_reserved4 = struct.unpack("<L", dir_stream.read(4))[0]
  1354 + referencecontrol_reserved5 = struct.unpack("<H", dir_stream.read(2))[0]
  1355 + referencecontrol_originaltypelib = dir_stream.read(16)
  1356 + referencecontrol_cookie = struct.unpack("<L", dir_stream.read(4))[0]
1357 continue 1357 continue
1358 1358
1359 if check == 0x000D: 1359 if check == 0x000D:
1360 # REFERENCEREGISTERED 1360 # REFERENCEREGISTERED
1361 - REFERENCEREGISTERED_Id = check  
1362 - REFERENCEREGISTERED_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1363 - REFERENCEREGISTERED_SizeOfLibid = struct.unpack("<L", dir_stream.read(4))[0]  
1364 - REFERENCEREGISTERED_Libid = dir_stream.read(REFERENCEREGISTERED_SizeOfLibid)  
1365 - REFERENCEREGISTERED_Reserved1 = struct.unpack("<L", dir_stream.read(4))[0]  
1366 - check_value('REFERENCEREGISTERED_Reserved1', 0x0000, REFERENCEREGISTERED_Reserved1)  
1367 - REFERENCEREGISTERED_Reserved2 = struct.unpack("<H", dir_stream.read(2))[0]  
1368 - check_value('REFERENCEREGISTERED_Reserved2', 0x0000, REFERENCEREGISTERED_Reserved2) 1361 + referenceregistered_id = check
  1362 + referenceregistered_size = struct.unpack("<L", dir_stream.read(4))[0]
  1363 + referenceregistered_sizeoflibid = struct.unpack("<L", dir_stream.read(4))[0]
  1364 + referenceregistered_libid = dir_stream.read(referenceregistered_sizeoflibid)
  1365 + referenceregistered_reserved1 = struct.unpack("<L", dir_stream.read(4))[0]
  1366 + check_value('REFERENCEREGISTERED_Reserved1', 0x0000, referenceregistered_reserved1)
  1367 + referenceregistered_reserved2 = struct.unpack("<H", dir_stream.read(2))[0]
  1368 + check_value('REFERENCEREGISTERED_Reserved2', 0x0000, referenceregistered_reserved2)
1369 continue 1369 continue
1370 1370
1371 if check == 0x000E: 1371 if check == 0x000E:
1372 # REFERENCEPROJECT 1372 # REFERENCEPROJECT
1373 - REFERENCEPROJECT_Id = check  
1374 - REFERENCEPROJECT_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1375 - REFERENCEPROJECT_SizeOfLibidAbsolute = struct.unpack("<L", dir_stream.read(4))[0]  
1376 - REFERENCEPROJECT_LibidAbsolute = dir_stream.read(REFERENCEPROJECT_SizeOfLibidAbsolute)  
1377 - REFERENCEPROJECT_SizeOfLibidRelative = struct.unpack("<L", dir_stream.read(4))[0]  
1378 - REFERENCEPROJECT_LibidRelative = dir_stream.read(REFERENCEPROJECT_SizeOfLibidRelative)  
1379 - REFERENCEPROJECT_MajorVersion = struct.unpack("<L", dir_stream.read(4))[0]  
1380 - REFERENCEPROJECT_MinorVersion = struct.unpack("<H", dir_stream.read(2))[0] 1373 + referenceproject_id = check
  1374 + referenceproject_size = struct.unpack("<L", dir_stream.read(4))[0]
  1375 + referenceproject_sizeoflibidabsolute = struct.unpack("<L", dir_stream.read(4))[0]
  1376 + referenceproject_libidabsolute = dir_stream.read(referenceproject_sizeoflibidabsolute)
  1377 + referenceproject_sizeoflibidrelative = struct.unpack("<L", dir_stream.read(4))[0]
  1378 + referenceproject_libidrelative = dir_stream.read(referenceproject_sizeoflibidrelative)
  1379 + referenceproject_majorversion = struct.unpack("<L", dir_stream.read(4))[0]
  1380 + referenceproject_minorversion = struct.unpack("<H", dir_stream.read(2))[0]
1381 continue 1381 continue
1382 1382
1383 log.error('invalid or unknown check Id {0:04X}'.format(check)) 1383 log.error('invalid or unknown check Id {0:04X}'.format(check))
1384 sys.exit(0) 1384 sys.exit(0)
1385 1385
1386 - PROJECTMODULES_Id = check #struct.unpack("<H", dir_stream.read(2))[0]  
1387 - check_value('PROJECTMODULES_Id', 0x000F, PROJECTMODULES_Id)  
1388 - PROJECTMODULES_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1389 - check_value('PROJECTMODULES_Size', 0x0002, PROJECTMODULES_Size)  
1390 - PROJECTMODULES_Count = struct.unpack("<H", dir_stream.read(2))[0]  
1391 - PROJECTMODULES_ProjectCookieRecord_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1392 - check_value('PROJECTMODULES_ProjectCookieRecord_Id', 0x0013, PROJECTMODULES_ProjectCookieRecord_Id)  
1393 - PROJECTMODULES_ProjectCookieRecord_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1394 - check_value('PROJECTMODULES_ProjectCookieRecord_Size', 0x0002, PROJECTMODULES_ProjectCookieRecord_Size)  
1395 - PROJECTMODULES_ProjectCookieRecord_Cookie = struct.unpack("<H", dir_stream.read(2))[0]  
1396 -  
1397 - log.debug("parsing {0} modules".format(PROJECTMODULES_Count))  
1398 - for x in xrange(0, PROJECTMODULES_Count):  
1399 - MODULENAME_Id = struct.unpack("<H", dir_stream.read(2))[0]  
1400 - check_value('MODULENAME_Id', 0x0019, MODULENAME_Id)  
1401 - MODULENAME_SizeOfModuleName = struct.unpack("<L", dir_stream.read(4))[0]  
1402 - MODULENAME_ModuleName = dir_stream.read(MODULENAME_SizeOfModuleName) 1386 + projectmodules_id = check #struct.unpack("<H", dir_stream.read(2))[0]
  1387 + check_value('PROJECTMODULES_Id', 0x000F, projectmodules_id)
  1388 + projectmodules_size = struct.unpack("<L", dir_stream.read(4))[0]
  1389 + check_value('PROJECTMODULES_Size', 0x0002, projectmodules_size)
  1390 + projectmodules_count = struct.unpack("<H", dir_stream.read(2))[0]
  1391 + projectmodules_projectcookierecord_id = struct.unpack("<H", dir_stream.read(2))[0]
  1392 + check_value('PROJECTMODULES_ProjectCookieRecord_Id', 0x0013, projectmodules_projectcookierecord_id)
  1393 + projectmodules_projectcookierecord_size = struct.unpack("<L", dir_stream.read(4))[0]
  1394 + check_value('PROJECTMODULES_ProjectCookieRecord_Size', 0x0002, projectmodules_projectcookierecord_size)
  1395 + projectmodules_projectcookierecord_cookie = struct.unpack("<H", dir_stream.read(2))[0]
  1396 +
  1397 + log.debug("parsing {0} modules".format(projectmodules_count))
  1398 + for x in xrange(0, projectmodules_count):
  1399 + modulename_id = struct.unpack("<H", dir_stream.read(2))[0]
  1400 + check_value('MODULENAME_Id', 0x0019, modulename_id)
  1401 + modulename_sizeofmodulename = struct.unpack("<L", dir_stream.read(4))[0]
  1402 + modulename_modulename = dir_stream.read(modulename_sizeofmodulename)
1403 # account for optional sections 1403 # account for optional sections
1404 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1404 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1405 if section_id == 0x0047: 1405 if section_id == 0x0047:
1406 - MODULENAMEUNICODE_Id = section_id  
1407 - MODULENAMEUNICODE_SizeOfModuleNameUnicode = struct.unpack("<L", dir_stream.read(4))[0]  
1408 - MODULENAMEUNICODE_ModuleNameUnicode = dir_stream.read(MODULENAMEUNICODE_SizeOfModuleNameUnicode) 1406 + modulenameunicode_id = section_id
  1407 + modulenameunicode_sizeofmodulenameunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1408 + modulenameunicode_modulenameunicode = dir_stream.read(modulenameunicode_sizeofmodulenameunicode)
1409 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1409 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1410 if section_id == 0x001A: 1410 if section_id == 0x001A:
1411 - MODULESTREAMNAME_id = section_id  
1412 - MODULESTREAMNAME_SizeOfStreamName = struct.unpack("<L", dir_stream.read(4))[0]  
1413 - MODULESTREAMNAME_StreamName = dir_stream.read(MODULESTREAMNAME_SizeOfStreamName)  
1414 - MODULESTREAMNAME_Reserved = struct.unpack("<H", dir_stream.read(2))[0]  
1415 - check_value('MODULESTREAMNAME_Reserved', 0x0032, MODULESTREAMNAME_Reserved)  
1416 - MODULESTREAMNAME_SizeOfStreamNameUnicode = struct.unpack("<L", dir_stream.read(4))[0]  
1417 - MODULESTREAMNAME_StreamNameUnicode = dir_stream.read(MODULESTREAMNAME_SizeOfStreamNameUnicode) 1411 + modulestreamname_id = section_id
  1412 + modulestreamname_sizeofstreamname = struct.unpack("<L", dir_stream.read(4))[0]
  1413 + modulestreamname_streamname = dir_stream.read(modulestreamname_sizeofstreamname)
  1414 + modulestreamname_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1415 + check_value('MODULESTREAMNAME_Reserved', 0x0032, modulestreamname_reserved)
  1416 + modulestreamname_sizeofstreamnameunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1417 + modulestreamname_streamnameunicode = dir_stream.read(modulestreamname_sizeofstreamnameunicode)
1418 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1418 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1419 if section_id == 0x001C: 1419 if section_id == 0x001C:
1420 - MODULEDOCSTRING_Id = section_id  
1421 - check_value('MODULEDOCSTRING_Id', 0x001C, MODULEDOCSTRING_Id)  
1422 - MODULEDOCSTRING_SizeOfDocString = struct.unpack("<L", dir_stream.read(4))[0]  
1423 - MODULEDOCSTRING_DocString = dir_stream.read(MODULEDOCSTRING_SizeOfDocString)  
1424 - MODULEDOCSTRING_Reserved = struct.unpack("<H", dir_stream.read(2))[0]  
1425 - check_value('MODULEDOCSTRING_Reserved', 0x0048, MODULEDOCSTRING_Reserved)  
1426 - MODULEDOCSTRING_SizeOfDocStringUnicode = struct.unpack("<L", dir_stream.read(4))[0]  
1427 - MODULEDOCSTRING_DocStringUnicode = dir_stream.read(MODULEDOCSTRING_SizeOfDocStringUnicode) 1420 + moduledocstring_id = section_id
  1421 + check_value('MODULEDOCSTRING_Id', 0x001C, moduledocstring_id)
  1422 + moduledocstring_sizeofdocstring = struct.unpack("<L", dir_stream.read(4))[0]
  1423 + moduledocstring_docstring = dir_stream.read(moduledocstring_sizeofdocstring)
  1424 + moduledocstring_reserved = struct.unpack("<H", dir_stream.read(2))[0]
  1425 + check_value('MODULEDOCSTRING_Reserved', 0x0048, moduledocstring_reserved)
  1426 + moduledocstring_sizeofdocstringunicode = struct.unpack("<L", dir_stream.read(4))[0]
  1427 + moduledocstring_docstringunicode = dir_stream.read(moduledocstring_sizeofdocstringunicode)
1428 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1428 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1429 if section_id == 0x0031: 1429 if section_id == 0x0031:
1430 - MODULEOFFSET_Id = section_id  
1431 - check_value('MODULEOFFSET_Id', 0x0031, MODULEOFFSET_Id)  
1432 - MODULEOFFSET_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1433 - check_value('MODULEOFFSET_Size', 0x0004, MODULEOFFSET_Size)  
1434 - MODULEOFFSET_TextOffset = struct.unpack("<L", dir_stream.read(4))[0] 1430 + moduleoffset_id = section_id
  1431 + check_value('MODULEOFFSET_Id', 0x0031, moduleoffset_id)
  1432 + moduleoffset_size = struct.unpack("<L", dir_stream.read(4))[0]
  1433 + check_value('MODULEOFFSET_Size', 0x0004, moduleoffset_size)
  1434 + moduleoffset_textoffset = struct.unpack("<L", dir_stream.read(4))[0]
1435 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1435 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1436 if section_id == 0x001E: 1436 if section_id == 0x001E:
1437 - MODULEHELPCONTEXT_Id = section_id  
1438 - check_value('MODULEHELPCONTEXT_Id', 0x001E, MODULEHELPCONTEXT_Id)  
1439 - MODULEHELPCONTEXT_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1440 - check_value('MODULEHELPCONTEXT_Size', 0x0004, MODULEHELPCONTEXT_Size)  
1441 - MODULEHELPCONTEXT_HelpContext = struct.unpack("<L", dir_stream.read(4))[0] 1437 + modulehelpcontext_id = section_id
  1438 + check_value('MODULEHELPCONTEXT_Id', 0x001E, modulehelpcontext_id)
  1439 + modulehelpcontext_size = struct.unpack("<L", dir_stream.read(4))[0]
  1440 + check_value('MODULEHELPCONTEXT_Size', 0x0004, modulehelpcontext_size)
  1441 + modulehelpcontext_helpcontext = struct.unpack("<L", dir_stream.read(4))[0]
1442 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1442 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1443 if section_id == 0x002C: 1443 if section_id == 0x002C:
1444 - MODULECOOKIE_Id = section_id  
1445 - check_value('MODULECOOKIE_Id', 0x002C, MODULECOOKIE_Id)  
1446 - MODULECOOKIE_Size = struct.unpack("<L", dir_stream.read(4))[0]  
1447 - check_value('MODULECOOKIE_Size', 0x0002, MODULECOOKIE_Size)  
1448 - MODULECOOKIE_Cookie = struct.unpack("<H", dir_stream.read(2))[0] 1444 + modulecookie_id = section_id
  1445 + check_value('MODULECOOKIE_Id', 0x002C, modulecookie_id)
  1446 + modulecookie_size = struct.unpack("<L", dir_stream.read(4))[0]
  1447 + check_value('MODULECOOKIE_Size', 0x0002, modulecookie_size)
  1448 + modulecookie_cookie = struct.unpack("<H", dir_stream.read(2))[0]
1449 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1449 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1450 if section_id == 0x0021 or section_id == 0x0022: 1450 if section_id == 0x0021 or section_id == 0x0022:
1451 - MODULETYPE_Id = section_id  
1452 - MODULETYPE_Reserved = struct.unpack("<L", dir_stream.read(4))[0] 1451 + moduletype_id = section_id
  1452 + moduletype_reserved = struct.unpack("<L", dir_stream.read(4))[0]
1453 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1453 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1454 if section_id == 0x0025: 1454 if section_id == 0x0025:
1455 - MODULEREADONLY_Id = section_id  
1456 - check_value('MODULEREADONLY_Id', 0x0025, MODULEREADONLY_Id)  
1457 - MODULEREADONLY_Reserved = struct.unpack("<L", dir_stream.read(4))[0]  
1458 - check_value('MODULEREADONLY_Reserved', 0x0000, MODULEREADONLY_Reserved) 1455 + modulereadonly_id = section_id
  1456 + check_value('MODULEREADONLY_Id', 0x0025, modulereadonly_id)
  1457 + modulereadonly_reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1458 + check_value('MODULEREADONLY_Reserved', 0x0000, modulereadonly_reserved)
1459 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1459 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1460 if section_id == 0x0028: 1460 if section_id == 0x0028:
1461 - MODULEPRIVATE_Id = section_id  
1462 - check_value('MODULEPRIVATE_Id', 0x0028, MODULEPRIVATE_Id)  
1463 - MODULEPRIVATE_Reserved = struct.unpack("<L", dir_stream.read(4))[0]  
1464 - check_value('MODULEPRIVATE_Reserved', 0x0000, MODULEPRIVATE_Reserved) 1461 + moduleprivate_id = section_id
  1462 + check_value('MODULEPRIVATE_Id', 0x0028, moduleprivate_id)
  1463 + moduleprivate_reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1464 + check_value('MODULEPRIVATE_Reserved', 0x0000, moduleprivate_reserved)
1465 section_id = struct.unpack("<H", dir_stream.read(2))[0] 1465 section_id = struct.unpack("<H", dir_stream.read(2))[0]
1466 if section_id == 0x002B: # TERMINATOR 1466 if section_id == 0x002B: # TERMINATOR
1467 - MODULE_Reserved = struct.unpack("<L", dir_stream.read(4))[0]  
1468 - check_value('MODULE_Reserved', 0x0000, MODULE_Reserved) 1467 + module_reserved = struct.unpack("<L", dir_stream.read(4))[0]
  1468 + check_value('MODULE_Reserved', 0x0000, module_reserved)
1469 section_id = None 1469 section_id = None
1470 if section_id != None: 1470 if section_id != None:
1471 log.warning('unknown or invalid module section id {0:04X}'.format(section_id)) 1471 log.warning('unknown or invalid module section id {0:04X}'.format(section_id))
1472 1472
1473 - log.debug('Project CodePage = %d' % PROJECTCODEPAGE_CodePage)  
1474 - vba_codec = 'cp%d' % PROJECTCODEPAGE_CodePage  
1475 - log.debug("ModuleName = {0}".format(MODULENAME_ModuleName))  
1476 - log.debug("StreamName = {0}".format(repr(MODULESTREAMNAME_StreamName)))  
1477 - streamname_unicode = MODULESTREAMNAME_StreamName.decode(vba_codec) 1473 + log.debug('Project CodePage = %d' % projectcodepage_codepage)
  1474 + vba_codec = 'cp%d' % projectcodepage_codepage
  1475 + log.debug("ModuleName = {0}".format(modulename_modulename))
  1476 + log.debug("StreamName = {0}".format(repr(modulestreamname_streamname)))
  1477 + streamname_unicode = modulestreamname_streamname.decode(vba_codec)
1478 log.debug("StreamName.decode('%s') = %s" % (vba_codec, repr(streamname_unicode))) 1478 log.debug("StreamName.decode('%s') = %s" % (vba_codec, repr(streamname_unicode)))
1479 - log.debug("StreamNameUnicode = {0}".format(repr(MODULESTREAMNAME_StreamNameUnicode)))  
1480 - log.debug("TextOffset = {0}".format(MODULEOFFSET_TextOffset)) 1479 + log.debug("StreamNameUnicode = {0}".format(repr(modulestreamname_streamnameunicode)))
  1480 + log.debug("TextOffset = {0}".format(moduleoffset_textoffset))
1481 1481
1482 code_path = vba_root + u'VBA/' + streamname_unicode 1482 code_path = vba_root + u'VBA/' + streamname_unicode
1483 #TODO: test if stream exists 1483 #TODO: test if stream exists
1484 log.debug('opening VBA code stream %s' % repr(code_path)) 1484 log.debug('opening VBA code stream %s' % repr(code_path))
1485 code_data = ole.openstream(code_path).read() 1485 code_data = ole.openstream(code_path).read()
1486 log.debug("length of code_data = {0}".format(len(code_data))) 1486 log.debug("length of code_data = {0}".format(len(code_data)))
1487 - log.debug("offset of code_data = {0}".format(MODULEOFFSET_TextOffset))  
1488 - code_data = code_data[MODULEOFFSET_TextOffset:] 1487 + log.debug("offset of code_data = {0}".format(moduleoffset_textoffset))
  1488 + code_data = code_data[moduleoffset_textoffset:]
1489 if len(code_data) > 0: 1489 if len(code_data) > 0:
1490 code_data = decompress_stream(code_data) 1490 code_data = decompress_stream(code_data)
1491 # case-insensitive search in the code_modules dict to find the file extension: 1491 # case-insensitive search in the code_modules dict to find the file extension:
1492 - filext = code_modules.get(MODULENAME_ModuleName.lower(), 'bin')  
1493 - filename = '{0}.{1}'.format(MODULENAME_ModuleName, filext) 1492 + filext = code_modules.get(modulename_modulename.lower(), 'bin')
  1493 + filename = '{0}.{1}'.format(modulename_modulename, filext)
1494 #TODO: also yield the codepage so that callers can decode it properly 1494 #TODO: also yield the codepage so that callers can decode it properly
1495 yield (code_path, filename, code_data) 1495 yield (code_path, filename, code_data)
1496 # print '-'*79 1496 # print '-'*79
@@ -1500,7 +1500,7 @@ def _extract_vba(ole, vba_root, project_path, dir_path): @@ -1500,7 +1500,7 @@ def _extract_vba(ole, vba_root, project_path, dir_path):
1500 # print '' 1500 # print ''
1501 log.debug('extracted file {0}'.format(filename)) 1501 log.debug('extracted file {0}'.format(filename))
1502 else: 1502 else:
1503 - log.warning("module stream {0} has code data length 0".format(MODULESTREAMNAME_StreamName)) 1503 + log.warning("module stream {0} has code data length 0".format(modulestreamname_streamname))
1504 return 1504 return
1505 1505
1506 1506