Peter M. Groen / oletools

Commit ab9a0433ce3443f4078fb5f54744f87992d5f238

Authored by decalage2
1 parent 5641d8d0

fix(olevba): prevent display of ANSI escape codes on the CLI (PR #873), bump to v0.60.3

Inline Side-by-side
Showing 22 changed files with 727 additions and 3583 deletions
LICENSE.md
  View file @ab9a043
1 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files 1 This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files
2 published with their own license. 2 published with their own license.
3 3
4 -The python-oletools package is copyright (c) 2012-2024 Philippe Lagadec (http://www.decalage.info) 4 +The python-oletools package is copyright (c) 2012-2025 Philippe Lagadec (http://www.decalage.info)
5 5
6 All rights reserved. 6 All rights reserved.
7 7
README.md
  View file @ab9a043
@@ -33,6 +33,8 @@ Note: python-oletools is not related to OLETools published by BeCubed Software. @@ -33,6 +33,8 @@ Note: python-oletools is not related to OLETools published by BeCubed Software.
33 News 33 News
34 ---- 34 ----
35 35
  36 +- **2025-05-21 v0.60.3**:
  37 + - olevba: fixed a security issue in the CLI display when ANSI escape codes are present (PR #873)
36 - **2024-07-02 v0.60.2**: 38 - **2024-07-02 v0.60.2**:
37 - olevba: 39 - olevba:
38 - fixed a bug in open_slk (issue #797, PR #769) 40 - fixed a bug in open_slk (issue #797, PR #769)
oletools/README.html
  View file @ab9a043
@@ -4,231 +4,61 @@ @@ -4,231 +4,61 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="python-oletools">python-oletools</h1> 19 <h1 id="python-oletools">python-oletools</h1>
160 -<p><a href="https://pypi.org/project/oletools/"><img  
161 -src="https://img.shields.io/pypi/v/oletools.svg" alt="PyPI" /></a> <a  
162 -href="https://travis-ci.org/decalage2/oletools"><img  
163 -src="https://travis-ci.org/decalage2/oletools.svg?branch=master"  
164 -alt="Build Status" /></a> <a  
165 -href="https://saythanks.io/to/decalage2"><img  
166 -src="https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg"  
167 -alt="Say Thanks!" /></a></p>  
168 -<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a  
169 -package of python tools to analyze <a  
170 -href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft  
171 -OLE2 files</a> (also called Structured Storage, Compound File Binary  
172 -Format or Compound Document File Format), such as Microsoft Office  
173 -97-2003 documents, MSI files or Outlook messages, mainly for malware  
174 -analysis, forensics and debugging. It is based on the <a  
175 -href="http://www.decalage.info/olefile">olefile</a> parser.</p>  
176 -<p>It also provides tools to analyze RTF files and files based on the <a  
177 -href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a>  
178 -(aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>  
179 -<p>For example, oletools can detect, extract and analyse VBA macros, OLE  
180 -objects, Excel 4 macros (XLM) and DDE links.</p>  
181 -<p>See <a  
182 -href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a>  
183 -for more info.</p>  
184 -<p><strong>Quick links:</strong> <a  
185 -href="http://www.decalage.info/python/oletools">Home page</a> - <a  
186 -href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a>  
187 -- <a href="https://github.com/decalage2/oletools/wiki">Documentation</a>  
188 -- <a href="https://github.com/decalage2/oletools/issues">Report  
189 -Issues/Suggestions/Questions</a> - <a  
190 -href="http://decalage.info/contact">Contact the Author</a> - <a  
191 -href="https://github.com/decalage2/oletools">Repository</a> - <a  
192 -href="https://twitter.com/decalage2">Updates on Twitter</a> <a  
193 -href="https://github.com/decalage2/oletools/blob/master/cheatsheet/oletools_cheatsheet.pdf">Cheatsheet</a></p>  
194 -<p>Note: python-oletools is not related to OLETools published by BeCubed  
195 -Software.</p> 20 +<p><a href="https://pypi.org/project/oletools/"><img src="https://img.shields.io/pypi/v/oletools.svg" alt="PyPI" /></a> <a href="https://travis-ci.org/decalage2/oletools"><img src="https://travis-ci.org/decalage2/oletools.svg?branch=master" alt="Build Status" /></a> <a href="https://saythanks.io/to/decalage2"><img src="https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg" alt="Say Thanks!" /></a></p>
  21 +<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser.</p>
  22 +<p>It also provides tools to analyze RTF files and files based on the <a href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a> (aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>
  23 +<p>For example, oletools can detect, extract and analyse VBA macros, OLE objects, Excel 4 macros (XLM) and DDE links.</p>
  24 +<p>See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p>
  25 +<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a> <a href="https://github.com/decalage2/oletools/blob/master/cheatsheet/oletools_cheatsheet.pdf">Cheatsheet</a></p>
  26 +<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
196 <h2 id="news">News</h2> 27 <h2 id="news">News</h2>
197 <ul> 28 <ul>
  29 +<li><strong>2025-05-21 v0.60.3</strong>:
  30 +<ul>
  31 +<li>olevba: fixed a security issue in the CLI display when ANSI escape codes are present (PR #873)</li>
  32 +</ul></li>
198 <li><strong>2024-07-02 v0.60.2</strong>: 33 <li><strong>2024-07-02 v0.60.2</strong>:
199 <ul> 34 <ul>
200 <li>olevba: 35 <li>olevba:
201 <ul> 36 <ul>
202 <li>fixed a bug in open_slk (issue #797, PR #769)</li> 37 <li>fixed a bug in open_slk (issue #797, PR #769)</li>
203 -<li>fixed a bug due to new PROJECTCOMPATVERSION record in dir stream (PR  
204 -#723, issues #700, #701, #725, #791, #808, #811, #833)</li> 38 +<li>fixed a bug due to new PROJECTCOMPATVERSION record in dir stream (PR #723, issues #700, #701, #725, #791, #808, #811, #833)</li>
205 </ul></li> 39 </ul></li>
206 -<li>oleobj: fixed SyntaxError with Python 3.12 (PR #855), SyntaxWarning  
207 -(PR #774)</li> 40 +<li>oleobj: fixed SyntaxError with Python 3.12 (PR #855), SyntaxWarning (PR #774)</li>
208 <li>rtfobj: fixed SyntaxError with Python 3.12 (PR #854)</li> 41 <li>rtfobj: fixed SyntaxError with Python 3.12 (PR #854)</li>
209 <li>clsid: added CLSIDs for MSI, Zed</li> 42 <li>clsid: added CLSIDs for MSI, Zed</li>
210 <li>ftguess: added MSI, PNG and OneNote formats</li> 43 <li>ftguess: added MSI, PNG and OneNote formats</li>
211 <li>pyxswf: fixed python 3.12 compatibility (PR #841, issue #813)</li> 44 <li>pyxswf: fixed python 3.12 compatibility (PR #841, issue #813)</li>
212 -<li>setup/requirements: allow pyparsing 3 to solve install issues (PR  
213 -#812, issue #762)</li> 45 +<li>setup/requirements: allow pyparsing 3 to solve install issues (PR #812, issue #762)</li>
214 </ul></li> 46 </ul></li>
215 <li><strong>2022-05-09 v0.60.1</strong>: 47 <li><strong>2022-05-09 v0.60.1</strong>:
216 <ul> 48 <ul>
217 <li>olevba: 49 <li>olevba:
218 <ul> 50 <ul>
219 <li>fixed a bug when calling XLMMacroDeobfuscator (PR #737)</li> 51 <li>fixed a bug when calling XLMMacroDeobfuscator (PR #737)</li>
220 -<li>removed keyword "sample" causing false positives</li> 52 +<li>removed keyword &quot;sample&quot; causing false positives</li>
221 </ul></li> 53 </ul></li>
222 <li>oleid: fixed OleID init issue (issue #695, PR #696)</li> 54 <li>oleid: fixed OleID init issue (issue #695, PR #696)</li>
223 <li>oleobj: 55 <li>oleobj:
224 <ul> 56 <ul>
225 <li>added simple detection of CVE-2021-40444 initial stage</li> 57 <li>added simple detection of CVE-2021-40444 initial stage</li>
226 <li>added detection for customUI onLoad</li> 58 <li>added detection for customUI onLoad</li>
227 -<li>improved handling of incorrect filenames in OLE package (PR  
228 -#451)</li> 59 +<li>improved handling of incorrect filenames in OLE package (PR #451)</li>
229 </ul></li> 60 </ul></li>
230 -<li>rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue  
231 -#692)</li> 61 +<li>rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue #692)</li>
232 <li>ftguess: 62 <li>ftguess:
233 <ul> 63 <ul>
234 <li>added PowerPoint and XPS formats (PR #716)</li> 64 <li>added PowerPoint and XPS formats (PR #716)</li>
@@ -239,8 +69,7 @@ Software.&lt;/p&gt; @@ -239,8 +69,7 @@ Software.&lt;/p&gt;
239 </ul></li> 69 </ul></li>
240 <li><strong>2021-06-02 v0.60</strong>: 70 <li><strong>2021-06-02 v0.60</strong>:
241 <ul> 71 <ul>
242 -<li>ftguess: new tool to identify file formats and containers (issue  
243 -#680)</li> 72 +<li>ftguess: new tool to identify file formats and containers (issue #680)</li>
244 <li>oleid: (issue #679) 73 <li>oleid: (issue #679)
245 <ul> 74 <ul>
246 <li>each indicator now has a risk level</li> 75 <li>each indicator now has a risk level</li>
@@ -250,232 +79,75 @@ Software.&lt;/p&gt; @@ -250,232 +79,75 @@ Software.&lt;/p&gt;
250 </ul></li> 79 </ul></li>
251 <li>olevba: 80 <li>olevba:
252 <ul> 81 <ul>
253 -<li>when XLMMacroDeobfuscator is available, use it to extract and  
254 -deobfuscate XLM macros</li> 82 +<li>when XLMMacroDeobfuscator is available, use it to extract and deobfuscate XLM macros</li>
255 </ul></li> 83 </ul></li>
256 <li>rtfobj: 84 <li>rtfobj:
257 <ul> 85 <ul>
258 <li>use ftguess to identify file type of OLE Package (issue #682)</li> 86 <li>use ftguess to identify file type of OLE Package (issue #682)</li>
259 <li>fixed bug in re_executable_extensions</li> 87 <li>fixed bug in re_executable_extensions</li>
260 </ul></li> 88 </ul></li>
261 -<li>crypto: added PowerPoint transparent password '/01Hannes  
262 -Ruescher/01' (issue #627)</li>  
263 -<li>setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional  
264 -dependencies</li> 89 +<li>crypto: added PowerPoint transparent password '/01Hannes Ruescher/01' (issue #627)</li>
  90 +<li>setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional dependencies</li>
265 </ul></li> 91 </ul></li>
266 </ul> 92 </ul>
267 -<p>See the <a  
268 -href="https://github.com/decalage2/oletools/wiki/Changelog">full  
269 -changelog</a> for more information.</p> 93 +<p>See the <a href="https://github.com/decalage2/oletools/wiki/Changelog">full changelog</a> for more information.</p>
270 <h2 id="tools">Tools:</h2> 94 <h2 id="tools">Tools:</h2>
271 -<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious  
272 -documents</h3>  
273 -<ul>  
274 -<li><a  
275 -href="https://github.com/decalage2/oletools/wiki/oleid">oleid</a>: to  
276 -analyze OLE files to detect specific characteristics usually found in  
277 -malicious files.</li>  
278 -<li><a  
279 -href="https://github.com/decalage2/oletools/wiki/olevba">olevba</a>: to  
280 -extract and analyze VBA Macro source code from MS Office documents (OLE  
281 -and OpenXML).</li>  
282 -<li><a  
283 -href="https://github.com/decalage2/oletools/wiki/mraptor">MacroRaptor</a>:  
284 -to detect malicious VBA Macros</li>  
285 -<li><a  
286 -href="https://github.com/decalage2/oletools/wiki/msodde">msodde</a>: to  
287 -detect and extract DDE/DDEAUTO links from MS Office documents, RTF and  
288 -CSV</li>  
289 -<li><a  
290 -href="https://github.com/decalage2/oletools/wiki/pyxswf">pyxswf</a>: to  
291 -detect, extract and analyze Flash objects (SWF) that may be embedded in  
292 -files such as MS Office documents (e.g. Word, Excel) and RTF, which is  
293 -especially useful for malware analysis.</li>  
294 -<li><a  
295 -href="https://github.com/decalage2/oletools/wiki/oleobj">oleobj</a>: to  
296 -extract embedded objects from OLE files.</li>  
297 -<li><a  
298 -href="https://github.com/decalage2/oletools/wiki/rtfobj">rtfobj</a>: to  
299 -extract embedded objects from RTF files.</li> 95 +<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious documents</h3>
  96 +<ul>
  97 +<li><a href="https://github.com/decalage2/oletools/wiki/oleid">oleid</a>: to analyze OLE files to detect specific characteristics usually found in malicious files.</li>
  98 +<li><a href="https://github.com/decalage2/oletools/wiki/olevba">olevba</a>: to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>
  99 +<li><a href="https://github.com/decalage2/oletools/wiki/mraptor">MacroRaptor</a>: to detect malicious VBA Macros</li>
  100 +<li><a href="https://github.com/decalage2/oletools/wiki/msodde">msodde</a>: to detect and extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>
  101 +<li><a href="https://github.com/decalage2/oletools/wiki/pyxswf">pyxswf</a>: to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>
  102 +<li><a href="https://github.com/decalage2/oletools/wiki/oleobj">oleobj</a>: to extract embedded objects from OLE files.</li>
  103 +<li><a href="https://github.com/decalage2/oletools/wiki/rtfobj">rtfobj</a>: to extract embedded objects from RTF files.</li>
300 </ul> 104 </ul>
301 -<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze  
302 -the structure of OLE files</h3> 105 +<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze the structure of OLE files</h3>
303 <ul> 106 <ul>
304 -<li><a  
305 -href="https://github.com/decalage2/oletools/wiki/olebrowse">olebrowse</a>:  
306 -A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint  
307 -documents), to view and extract individual data streams.</li>  
308 -<li><a  
309 -href="https://github.com/decalage2/oletools/wiki/olemeta">olemeta</a>:  
310 -to extract all standard properties (metadata) from OLE files.</li>  
311 -<li><a  
312 -href="https://github.com/decalage2/oletools/wiki/oletimes">oletimes</a>:  
313 -to extract creation and modification timestamps of all streams and  
314 -storages.</li>  
315 -<li><a  
316 -href="https://github.com/decalage2/oletools/wiki/oledir">oledir</a>: to  
317 -display all the directory entries of an OLE file, including free and  
318 -orphaned entries.</li>  
319 -<li><a  
320 -href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to  
321 -display a map of all the sectors in an OLE file.</li> 107 +<li><a href="https://github.com/decalage2/oletools/wiki/olebrowse">olebrowse</a>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>
  108 +<li><a href="https://github.com/decalage2/oletools/wiki/olemeta">olemeta</a>: to extract all standard properties (metadata) from OLE files.</li>
  109 +<li><a href="https://github.com/decalage2/oletools/wiki/oletimes">oletimes</a>: to extract creation and modification timestamps of all streams and storages.</li>
  110 +<li><a href="https://github.com/decalage2/oletools/wiki/oledir">oledir</a>: to display all the directory entries of an OLE file, including free and orphaned entries.</li>
  111 +<li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li>
322 </ul> 112 </ul>
323 <h2 id="projects-using-oletools">Projects using oletools:</h2> 113 <h2 id="projects-using-oletools">Projects using oletools:</h2>
324 -<p>oletools are used by a number of projects and online malware analysis  
325 -services, including <a  
326 -href="https://github.com/IntegralDefense/ACE">ACE</a>, <a  
327 -href="https://www.blackhat.com/eu-23/briefings/schedule/index.html#unmasking-apts-an-automated-approach-for-real-world-threat-attribution-35162">ADAPT</a>,  
328 -<a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a  
329 -href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a  
330 -href="https://github.com/binref/refinery">Binary Refinery</a>, <a  
331 -href="https://github.com/ctxis/CAPE">CAPE</a>, <a  
332 -href="https://cincan.io">CinCan</a>, <a  
333 -href="https://cortex.marketplace.pan.dev/marketplace/details/Oletools/">Cortex  
334 -XSOAR (Palo Alto)</a>, <a  
335 -href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a  
336 -href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a  
337 -href="https://sandbox.deepviz.com/">Deepviz</a>, <a  
338 -href="https://diario.elevenpaths.com/">DIARIO</a>, <a  
339 -href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a  
340 -href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a  
341 -href="https://pub.expmon.com/">EXPMON</a>, <a  
342 -href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a  
343 -href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a  
344 -href="https://www.glimps.fr/en/glimps-malware-2/">GLIMPS Malware</a>, <a  
345 -href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a  
346 -href="https://labs.inquest.net/">InQuest Labs</a>, <a  
347 -href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a  
348 -href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a  
349 -href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a  
350 -href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a  
351 -href="https://mailcow.email/">mailcow</a>, <a  
352 -href="https://malshare.io">malshare.io</a>, <a  
353 -href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a  
354 -href="https://www.adlice.com/download/mrf/">Malware Repository Framework  
355 -(MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a  
356 -href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a  
357 -href="https://github.com/pandora-analysis/pandora">Pandora</a>, <a  
358 -href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a  
359 -href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a  
360 -href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a  
361 -href="https://www.quarkslab.com/products-qflow/">QFlow</a>, <a  
362 -href="https://github.com/CYB3RMX/Qu1cksc0pe">Qu1cksc0pe</a>, <a  
363 -href="https://github.com/tylabs/quicksand">Tylabs QuickSand</a>, <a  
364 -href="https://remnux.org/">REMnux</a>, <a  
365 -href="https://github.com/countercept/snake">Snake</a>, <a  
366 -href="https://app.sndbox.com">SNDBOX</a>, <a  
367 -href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365  
368 -Email</a>, <a  
369 -href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a  
370 -href="https://github.com/target/strelka">Strelka</a>, <a  
371 -href="https://stoq.punchcyber.com/">stoQ</a>, <a  
372 -href="https://docs.sublimesecurity.com/docs/enrichment-functions">Sublime  
373 -Platform/MQL</a>, <a  
374 -href="https://github.com/jstrosch/subparse">Subparse</a>, <a  
375 -href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>,  
376 -<a href="https://s.threatbook.com/">ThreatBoook</a>, <a  
377 -href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a  
378 -href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a  
379 -href="http://viper.li/">Viper</a>, <a  
380 -href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a  
381 -href="https://yomi.yoroi.company">YOMI</a>, and probably <a  
382 -href="https://www.virustotal.com">VirusTotal</a>, <a  
383 -href="https://www.filescan.io">FileScan.IO</a>. And quite a few <a  
384 -href="https://github.com/search?q=oletools&amp;type=Repositories">other  
385 -projects on GitHub</a>. (Please <a  
386 -href="(http://decalage.info/contact)">contact me</a> if you have or know  
387 -a project using oletools)</p> 114 +<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://www.blackhat.com/eu-23/briefings/schedule/index.html#unmasking-apts-an-automated-approach-for-real-world-threat-attribution-35162">ADAPT</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/binref/refinery">Binary Refinery</a>, <a href="https://github.com/kevoreilly/CAPEv2">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://cortex.marketplace.pan.dev/marketplace/details/Oletools/">Cortex XSOAR (Palo Alto)</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://pub.expmon.com/">EXPMON</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.glimps.fr/en/glimps-malware-2/">GLIMPS Malware</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://labs.inquest.net/">InQuest Labs</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/pandora-analysis/pandora">Pandora</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://www.quarkslab.com/products-qflow/">QFlow</a>, <a href="https://github.com/CYB3RMX/Qu1cksc0pe">Qu1cksc0pe</a>, <a href="https://github.com/tylabs/quicksand">Tylabs QuickSand</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365 Email</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://docs.sublimesecurity.com/docs/enrichment-functions">Sublime Platform/MQL</a>, <a href="https://github.com/jstrosch/subparse">Subparse</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://s.threatbook.com/">ThreatBoook</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>, <a href="https://www.filescan.io">FileScan.IO</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
388 <h2 id="download-and-install">Download and Install:</h2> 115 <h2 id="download-and-install">Download and Install:</h2>
389 -<p>The recommended way to download and install/update the <strong>latest  
390 -stable release</strong> of oletools is to use <a  
391 -href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p> 116 +<p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
392 <ul> 117 <ul>
393 -<li>On Linux/Mac:  
394 -<code>sudo -H pip install -U oletools[full]</code></li> 118 +<li>On Linux/Mac: <code>sudo -H pip install -U oletools[full]</code></li>
395 <li>On Windows: <code>pip install -U oletools[full]</code></li> 119 <li>On Windows: <code>pip install -U oletools[full]</code></li>
396 </ul> 120 </ul>
397 -<p>This should automatically create command-line scripts to run each  
398 -tool from any directory: <code>olevba</code>, <code>mraptor</code>,  
399 -<code>rtfobj</code>, etc.</p>  
400 -<p>The keyword <code>[full]</code> means that all optional dependencies  
401 -will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter  
402 -version without optional dependencies, just remove <code>[full]</code>  
403 -from the command line.</p> 121 +<p>This should automatically create command-line scripts to run each tool from any directory: <code>olevba</code>, <code>mraptor</code>, <code>rtfobj</code>, etc.</p>
  122 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, just remove <code>[full]</code> from the command line.</p>
404 <p>To get the <strong>latest development version</strong> instead:</p> 123 <p>To get the <strong>latest development version</strong> instead:</p>
405 <ul> 124 <ul>
406 -<li>On Linux/Mac:  
407 -<code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>  
408 -<li>On Windows:  
409 -<code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li> 125 +<li>On Linux/Mac: <code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
  126 +<li>On Windows: <code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
410 </ul> 127 </ul>
411 -<p>See the <a  
412 -href="https://github.com/decalage2/oletools/wiki/Install">documentation</a>  
413 -for other installation options.</p> 128 +<p>See the <a href="https://github.com/decalage2/oletools/wiki/Install">documentation</a> for other installation options.</p>
414 <h2 id="documentation">Documentation:</h2> 129 <h2 id="documentation">Documentation:</h2>
415 -<p>The latest version of the documentation can be found <a  
416 -href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise  
417 -a copy is provided in the doc subfolder of the package.</p>  
418 -<h2 id="how-to-suggest-improvements-report-issues-or-contribute">How to  
419 -Suggest Improvements, Report Issues or Contribute:</h2>  
420 -<p>This is a personal open-source project, developed on my spare time.  
421 -Any contribution, suggestion, feedback or bug report is welcome.</p>  
422 -<p>To suggest improvements, report a bug or any issue, please use the <a  
423 -href="https://github.com/decalage2/oletools/issues">issue reporting  
424 -page</a>, providing all the information and files to reproduce the  
425 -problem.</p>  
426 -<p>You may also <a href="http://decalage.info/contact">contact the  
427 -author</a> directly to provide feedback.</p>  
428 -<p>The code is available in <a  
429 -href="https://github.com/decalage2/oletools">a GitHub repository</a>.  
430 -You may use it to submit enhancements using forks and pull requests.</p> 130 +<p>The latest version of the documentation can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
  131 +<h2 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute:</h2>
  132 +<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
  133 +<p>To suggest improvements, report a bug or any issue, please use the <a href="https://github.com/decalage2/oletools/issues">issue reporting page</a>, providing all the information and files to reproduce the problem.</p>
  134 +<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to provide feedback.</p>
  135 +<p>The code is available in <a href="https://github.com/decalage2/oletools">a GitHub repository</a>. You may use it to submit enhancements using forks and pull requests.</p>
431 <h2 id="license">License</h2> 136 <h2 id="license">License</h2>
432 -<p>This license applies to the python-oletools package, apart from the  
433 -thirdparty folder which contains third-party files published with their  
434 -own license.</p>  
435 -<p>The python-oletools package is copyright (c) 2012-2024 Philippe  
436 -Lagadec (http://www.decalage.info)</p> 137 +<p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
  138 +<p>The python-oletools package is copyright (c) 2012-2024 Philippe Lagadec (http://www.decalage.info)</p>
437 <p>All rights reserved.</p> 139 <p>All rights reserved.</p>
438 -<p>Redistribution and use in source and binary forms, with or without  
439 -modification, are permitted provided that the following conditions are  
440 -met:</p> 140 +<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
441 <ul> 141 <ul>
442 -<li>Redistributions of source code must retain the above copyright  
443 -notice, this list of conditions and the following disclaimer.</li>  
444 -<li>Redistributions in binary form must reproduce the above copyright  
445 -notice, this list of conditions and the following disclaimer in the  
446 -documentation and/or other materials provided with the  
447 -distribution.</li> 142 +<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
  143 +<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
448 </ul> 144 </ul>
449 -<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS  
450 -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT  
451 -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A  
452 -PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT  
453 -HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,  
454 -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED  
455 -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR  
456 -PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF  
457 -LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING  
458 -NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS  
459 -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p> 145 +<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS &quot;AS IS&quot; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
460 <hr /> 146 <hr />
461 -<p>olevba contains modified source code from the officeparser project,  
462 -published under the following MIT License (MIT):</p> 147 +<p>olevba contains modified source code from the officeparser project, published under the following MIT License (MIT):</p>
463 <p>officeparser is copyright (c) 2014 John William Davison</p> 148 <p>officeparser is copyright (c) 2014 John William Davison</p>
464 -<p>Permission is hereby granted, free of charge, to any person obtaining  
465 -a copy of this software and associated documentation files (the  
466 -"Software"), to deal in the Software without restriction, including  
467 -without limitation the rights to use, copy, modify, merge, publish,  
468 -distribute, sublicense, and/or sell copies of the Software, and to  
469 -permit persons to whom the Software is furnished to do so, subject to  
470 -the following conditions:</p>  
471 -<p>The above copyright notice and this permission notice shall be  
472 -included in all copies or substantial portions of the Software.</p>  
473 -<p>THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,  
474 -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF  
475 -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  
476 -IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY  
477 -CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,  
478 -TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE  
479 -SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p> 149 +<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the &quot;Software&quot;), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>
  150 +<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>
  151 +<p>THE SOFTWARE IS PROVIDED &quot;AS IS&quot;, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
480 </body> 152 </body>
481 </html> 153 </html>
oletools/README.rst
  View file @ab9a043
@@ -38,6 +38,11 @@ Software. @@ -38,6 +38,11 @@ Software.
38 News 38 News
39 ---- 39 ----
40 40
  41 +- **2025-05-21 v0.60.3**:
  42 +
  43 + - olevba: fixed a security issue in the CLI display when ANSI escape
  44 + codes are present (PR #873)
  45 +
41 - **2024-07-02 v0.60.2**: 46 - **2024-07-02 v0.60.2**:
42 47
43 - olevba: 48 - olevba:
@@ -162,7 +167,7 @@ services, including `ACE &lt;https://github.com/IntegralDefense/ACE&gt;`__, @@ -162,7 +167,7 @@ services, including `ACE &lt;https://github.com/IntegralDefense/ACE&gt;`__,
162 `Anlyz.io <https://sandbox.anlyz.io/>`__, 167 `Anlyz.io <https://sandbox.anlyz.io/>`__,
163 `AssemblyLine <https://www.cse-cst.gc.ca/en/assemblyline>`__, `Binary 168 `AssemblyLine <https://www.cse-cst.gc.ca/en/assemblyline>`__, `Binary
164 Refinery <https://github.com/binref/refinery>`__, 169 Refinery <https://github.com/binref/refinery>`__,
165 -`CAPE <https://github.com/ctxis/CAPE>`__, 170 +`CAPE <https://github.com/kevoreilly/CAPEv2>`__,
166 `CinCan <https://cincan.io>`__, `Cortex XSOAR (Palo 171 `CinCan <https://cincan.io>`__, `Cortex XSOAR (Palo
167 Alto) <https://cortex.marketplace.pan.dev/marketplace/details/Oletools/>`__, 172 Alto) <https://cortex.marketplace.pan.dev/marketplace/details/Oletools/>`__,
168 `Cuckoo Sandbox <https://github.com/cuckoosandbox/cuckoo>`__, 173 `Cuckoo Sandbox <https://github.com/cuckoosandbox/cuckoo>`__,
oletools/doc/Contribute.html
  View file @ab9a043
@@ -4,182 +4,30 @@ @@ -4,182 +4,30 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 -<h1 id="how-to-suggest-improvements-report-issues-or-contribute">How to  
160 -Suggest Improvements, Report Issues or Contribute</h1>  
161 -<p>This is a personal open-source project, developed on my spare time.  
162 -Any contribution, suggestion, feedback or bug report is welcome.</p>  
163 -<p>To <strong>suggest improvements, report a bug or any issue</strong>,  
164 -please use the <a  
165 -href="https://github.com/decalage2/oletools/issues">issue reporting  
166 -page</a>, and provide all the information and files to reproduce the  
167 -problem.</p>  
168 -<p>You may also <a href="http://decalage.info/contact">contact the  
169 -author</a> directly to <strong>send feedback</strong>.</p>  
170 -<p>The code is available in <a  
171 -href="https://github.com/decalage2/oletools">a repository on GitHub</a>.  
172 -You may use it to <strong>submit enhancements</strong> using forks and  
173 -pull requests.</p> 19 +<h1 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute</h1>
  20 +<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
  21 +<p>To <strong>suggest improvements, report a bug or any issue</strong>, please use the <a href="https://github.com/decalage2/oletools/issues">issue reporting page</a>, and provide all the information and files to reproduce the problem.</p>
  22 +<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to <strong>send feedback</strong>.</p>
  23 +<p>The code is available in <a href="https://github.com/decalage2/oletools">a repository on GitHub</a>. You may use it to <strong>submit enhancements</strong> using forks and pull requests.</p>
174 <hr /> 24 <hr />
175 -<h2 id="python-oletools-documentation">python-oletools  
176 -documentation</h2> 25 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
177 <ul> 26 <ul>
178 <li><a href="Home.html">Home</a></li> 27 <li><a href="Home.html">Home</a></li>
179 <li><a href="License.html">License</a></li> 28 <li><a href="License.html">License</a></li>
180 <li><a href="Install.html">Install</a></li> 29 <li><a href="Install.html">Install</a></li>
181 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
182 -Report Issues</li> 30 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
183 <li>Tools: 31 <li>Tools:
184 <ul> 32 <ul>
185 <li><a href="mraptor.html">mraptor</a></li> 33 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/Home.html
  View file @ab9a043
@@ -4,240 +4,53 @@ @@ -4,240 +4,53 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 -<h1 id="python-oletools-documentation">python-oletools  
160 -documentation</h1>  
161 -<p>This is the home page of the documentation for python-oletools. The  
162 -latest version can be found <a  
163 -href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise  
164 -a copy is provided in the doc subfolder of the package.</p>  
165 -<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a  
166 -package of python tools to analyze <a  
167 -href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft  
168 -OLE2 files</a> (also called Structured Storage, Compound File Binary  
169 -Format or Compound Document File Format), such as Microsoft Office  
170 -97-2003 documents, MSI files or Outlook messages, mainly for malware  
171 -analysis, forensics and debugging. It is based on the <a  
172 -href="http://www.decalage.info/olefile">olefile</a> parser.</p>  
173 -<p>It also provides tools to analyze RTF files and files based on the <a  
174 -href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a>  
175 -(aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>  
176 -<p>For example, oletools can detect, extract and analyse VBA macros, OLE  
177 -objects, Excel 4 macros (XLM) and DDE links.</p>  
178 -<p>See <a  
179 -href="http://www.decalage.info/python/oletools">http://www.decalage.info/python/oletools</a>  
180 -for more info.</p>  
181 -<p><strong>Quick links:</strong> <a  
182 -href="http://www.decalage.info/python/oletools">Home page</a> - <a  
183 -href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a>  
184 -- <a href="https://github.com/decalage2/oletools/wiki">Documentation</a>  
185 -- <a href="https://github.com/decalage2/oletools/issues">Report  
186 -Issues/Suggestions/Questions</a> - <a  
187 -href="http://decalage.info/contact">Contact the Author</a> - <a  
188 -href="https://github.com/decalage2/oletools">Repository</a> - <a  
189 -href="https://twitter.com/decalage2">Updates on Twitter</a></p>  
190 -<p>Note: python-oletools is not related to OLETools published by BeCubed  
191 -Software.</p> 19 +<h1 id="python-oletools-documentation">python-oletools documentation</h1>
  20 +<p>This is the home page of the documentation for python-oletools. The latest version can be found <a href="https://github.com/decalage2/oletools/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
  21 +<p><a href="http://www.decalage.info/python/oletools">oletools</a> is a package of python tools to analyze <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the <a href="http://www.decalage.info/olefile">olefile</a> parser.</p>
  22 +<p>It also provides tools to analyze RTF files and files based on the <a href="https://en.wikipedia.org/wiki/Office_Open_XML">OpenXML format</a> (aka OOXML) such as MS Office 2007+ documents, XPS or MSIX files.</p>
  23 +<p>For example, oletools can detect, extract and analyse VBA macros, OLE objects, Excel 4 macros (XLM) and DDE links.</p>
  24 +<p>See <a href="http://www.decalage.info/python/oletools" class="uri">http://www.decalage.info/python/oletools</a> for more info.</p>
  25 +<p><strong>Quick links:</strong> <a href="http://www.decalage.info/python/oletools">Home page</a> - <a href="https://github.com/decalage2/oletools/wiki/Install">Download/Install</a> - <a href="https://github.com/decalage2/oletools/wiki">Documentation</a> - <a href="https://github.com/decalage2/oletools/issues">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the Author</a> - <a href="https://github.com/decalage2/oletools">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
  26 +<p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
192 <h2 id="tools-in-python-oletools">Tools in python-oletools:</h2> 27 <h2 id="tools-in-python-oletools">Tools in python-oletools:</h2>
193 -<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious  
194 -documents</h3> 28 +<h3 id="tools-to-analyze-malicious-documents">Tools to analyze malicious documents</h3>
195 <ul> 29 <ul>
196 -<li><strong><a href="oleid.html">oleid</a></strong>: to analyze OLE  
197 -files to detect specific characteristics usually found in malicious  
198 -files.</li>  
199 -<li><strong><a href="olevba.html">olevba</a></strong>: to extract and  
200 -analyze VBA Macro source code from MS Office documents (OLE and  
201 -OpenXML).</li>  
202 -<li><strong><a href="mraptor.html">mraptor</a></strong>: to detect  
203 -malicious VBA Macros</li>  
204 -<li><strong><a href="msodde.html">msodde</a></strong>: to detect and  
205 -extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>  
206 -<li><strong><a href="pyxswf.html">pyxswf</a></strong>: to detect,  
207 -extract and analyze Flash objects (SWF) that may be embedded in files  
208 -such as MS Office documents (e.g. Word, Excel) and RTF, which is  
209 -especially useful for malware analysis.</li>  
210 -<li><strong><a href="oleobj.html">oleobj</a></strong>: to extract  
211 -embedded objects from OLE files.</li>  
212 -<li><strong><a href="rtfobj.html">rtfobj</a></strong>: to extract  
213 -embedded objects from RTF files.</li> 30 +<li><strong><a href="oleid.html">oleid</a></strong>: to analyze OLE files to detect specific characteristics usually found in malicious files.</li>
  31 +<li><strong><a href="olevba.html">olevba</a></strong>: to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).</li>
  32 +<li><strong><a href="mraptor.html">mraptor</a></strong>: to detect malicious VBA Macros</li>
  33 +<li><strong><a href="msodde.html">msodde</a></strong>: to detect and extract DDE/DDEAUTO links from MS Office documents, RTF and CSV</li>
  34 +<li><strong><a href="pyxswf.html">pyxswf</a></strong>: to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.</li>
  35 +<li><strong><a href="oleobj.html">oleobj</a></strong>: to extract embedded objects from OLE files.</li>
  36 +<li><strong><a href="rtfobj.html">rtfobj</a></strong>: to extract embedded objects from RTF files.</li>
214 </ul> 37 </ul>
215 -<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze  
216 -the structure of OLE files</h3> 38 +<h3 id="tools-to-analyze-the-structure-of-ole-files">Tools to analyze the structure of OLE files</h3>
217 <ul> 39 <ul>
218 -<li><strong><a href="olebrowse.html">olebrowse</a></strong>: A simple  
219 -GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to  
220 -view and extract individual data streams.</li>  
221 -<li><strong><a href="olemeta.html">olemeta</a></strong>: to extract all  
222 -standard properties (metadata) from OLE files.</li>  
223 -<li><strong><a href="oletimes.html">oletimes</a></strong>: to extract  
224 -creation and modification timestamps of all streams and storages.</li>  
225 -<li><strong><a href="oledir.html">oledir</a></strong>: to display all  
226 -the directory entries of an OLE file, including free and orphaned  
227 -entries.</li>  
228 -<li><strong><a href="olemap.html">olemap</a></strong>: to display a map  
229 -of all the sectors in an OLE file.</li> 40 +<li><strong><a href="olebrowse.html">olebrowse</a></strong>: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</li>
  41 +<li><strong><a href="olemeta.html">olemeta</a></strong>: to extract all standard properties (metadata) from OLE files.</li>
  42 +<li><strong><a href="oletimes.html">oletimes</a></strong>: to extract creation and modification timestamps of all streams and storages.</li>
  43 +<li><strong><a href="oledir.html">oledir</a></strong>: to display all the directory entries of an OLE file, including free and orphaned entries.</li>
  44 +<li><strong><a href="olemap.html">olemap</a></strong>: to display a map of all the sectors in an OLE file.</li>
230 <li>and a few others (coming soon)</li> 45 <li>and a few others (coming soon)</li>
231 </ul> 46 </ul>
232 <hr /> 47 <hr />
233 -<h2 id="python-oletools-documentation-1">python-oletools  
234 -documentation</h2> 48 +<h2 id="python-oletools-documentation-1">python-oletools documentation</h2>
235 <ul> 49 <ul>
236 <li><a href="Home.html">Home</a></li> 50 <li><a href="Home.html">Home</a></li>
237 <li><a href="License.html">License</a></li> 51 <li><a href="License.html">License</a></li>
238 <li><a href="Install.html">Install</a></li> 52 <li><a href="Install.html">Install</a></li>
239 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
240 -Report Issues</li> 53 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
241 <li>Tools: 54 <li>Tools:
242 <ul> 55 <ul>
243 <li><a href="mraptor.html">mraptor</a></li> 56 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/Install.html
  View file @ab9a043
@@ -4,267 +4,75 @@ @@ -4,267 +4,75 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 -<h1 id="how-to-download-and-install-oletools">How to Download and  
160 -Install oletools</h1> 19 +<h1 id="how-to-download-and-install-oletools">How to Download and Install oletools</h1>
161 <h2 id="pre-requisites">Pre-requisites</h2> 20 <h2 id="pre-requisites">Pre-requisites</h2>
162 -<p>The recommended Python version to run oletools is the latest  
163 -<strong>Python 3.x</strong> (3.12 for now). Python 2.7 is still  
164 -supported for the moment, even if it reached end of life in 2020 (for  
165 -projects still using Python 2/PyPy 2 such as ViperMonkey). It is highly  
166 -recommended to switch to Python 3 if possible.</p>  
167 -<h2  
168 -id="recommended-way-to-downloadinstallupdate-oletools-pip-or-pipx">Recommended  
169 -way to Download+Install/Update oletools: pip or pipx</h2>  
170 -<p>Pip is included with Python since version 2.7.9 and 3.4. If it is not  
171 -installed on your system, either upgrade Python or see  
172 -https://pip.pypa.io/en/stable/installing/</p> 21 +<p>The recommended Python version to run oletools is the latest <strong>Python 3.x</strong> (3.12 for now). Python 2.7 is still supported for the moment, even if it reached end of life in 2020 (for projects still using Python 2/PyPy 2 such as ViperMonkey). It is highly recommended to switch to Python 3 if possible.</p>
  22 +<h2 id="recommended-way-to-downloadinstallupdate-oletools-pip-or-pipx">Recommended way to Download+Install/Update oletools: pip or pipx</h2>
  23 +<p>Pip is included with Python since version 2.7.9 and 3.4. If it is not installed on your system, either upgrade Python or see https://pip.pypa.io/en/stable/installing/</p>
173 <h3 id="linux-mac-osx-unix">Linux, Mac OSX, Unix</h3> 24 <h3 id="linux-mac-osx-unix">Linux, Mac OSX, Unix</h3>
174 -<p>To download and install/update the latest release version of oletools  
175 -with all its dependencies, run the following command in a shell:</p> 25 +<p>To download and install/update the latest release version of oletools with all its dependencies, run the following command in a shell:</p>
176 <pre class="text"><code>sudo -H pip install -U oletools[full]</code></pre> 26 <pre class="text"><code>sudo -H pip install -U oletools[full]</code></pre>
177 -<p>The keyword <code>[full]</code> means that all optional dependencies  
178 -will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter  
179 -version without optional dependencies, use the following command  
180 -instead:</p> 27 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, use the following command instead:</p>
181 <pre class="text"><code>sudo -H pip install -U oletools</code></pre> 28 <pre class="text"><code>sudo -H pip install -U oletools</code></pre>
182 -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to  
183 -install on a specific Python version.</p>  
184 -<p>On some Linux distributions, it might not be allowed to install  
185 -system-wide python packages with pip. In that case, pipx may be a better  
186 -alternative to install oletools in a user virtual environment, and to  
187 -install the command-line scripts oleid, olevba, etc:</p> 29 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
  30 +<p>On some Linux distributions, it might not be allowed to install system-wide python packages with pip. In that case, pipx may be a better alternative to install oletools in a user virtual environment, and to install the command-line scripts oleid, olevba, etc:</p>
188 <pre class="text"><code>pipx install oletools</code></pre> 31 <pre class="text"><code>pipx install oletools</code></pre>
189 -<p><strong>Important</strong>: Since version 0.50, pip will  
190 -automatically create convenient command-line scripts in /usr/local/bin  
191 -to run all the oletools from any directory.</p> 32 +<p><strong>Important</strong>: Since version 0.50, pip will automatically create convenient command-line scripts in /usr/local/bin to run all the oletools from any directory.</p>
192 <h3 id="windows">Windows</h3> 33 <h3 id="windows">Windows</h3>
193 -<p>To download and install/update the latest release version of oletools  
194 -with all its dependencies, run the following command in a cmd  
195 -window:</p> 34 +<p>To download and install/update the latest release version of oletools with all its dependencies, run the following command in a cmd window:</p>
196 <pre class="text"><code>pip install -U oletools[full]</code></pre> 35 <pre class="text"><code>pip install -U oletools[full]</code></pre>
197 -<p>The keyword <code>[full]</code> means that all optional dependencies  
198 -will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter  
199 -version without optional dependencies, use the following command  
200 -instead:</p> 36 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, use the following command instead:</p>
201 <pre class="text"><code>pip install -U oletools</code></pre> 37 <pre class="text"><code>pip install -U oletools</code></pre>
202 -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to  
203 -install on a specific Python version.</p>  
204 -<p><strong>Note</strong>: with Python 3, you may need to open a cmd  
205 -window with Administrator privileges in order to run pip and install for  
206 -all users. If that is not possible, you may also install only for the  
207 -current user by adding the <code>--user</code> option:</p> 38 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
  39 +<p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p>
208 <pre class="text"><code>pip3 install -U --user oletools</code></pre> 40 <pre class="text"><code>pip3 install -U --user oletools</code></pre>
209 -<p><strong>Important</strong>: Since version 0.50, pip will  
210 -automatically create convenient command-line scripts to run all the  
211 -oletools from any directory: olevba, mraptor, oleid, rtfobj, etc.</p>  
212 -<h2 id="how-to-install-the-latest-development-version">How to install  
213 -the latest development version</h2>  
214 -<p>If you want to benefit from the latest improvements in the  
215 -development version, you may also use pip:</p> 41 +<p><strong>Important</strong>: Since version 0.50, pip will automatically create convenient command-line scripts to run all the oletools from any directory: olevba, mraptor, oleid, rtfobj, etc.</p>
  42 +<h2 id="how-to-install-the-latest-development-version">How to install the latest development version</h2>
  43 +<p>If you want to benefit from the latest improvements in the development version, you may also use pip:</p>
216 <h3 id="linux-mac-osx-unix-1">Linux, Mac OSX, Unix</h3> 44 <h3 id="linux-mac-osx-unix-1">Linux, Mac OSX, Unix</h3>
217 <pre class="text"><code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre> 45 <pre class="text"><code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre>
218 -<p>Note that it will install oletools without optional dependencies such  
219 -as XLMMacroDeobfuscator, so you may need to install them separately.</p>  
220 -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to  
221 -install on a specific Python version.</p> 46 +<p>Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator, so you may need to install them separately.</p>
  47 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
222 <h3 id="windows-1">Windows</h3> 48 <h3 id="windows-1">Windows</h3>
223 <pre class="text"><code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre> 49 <pre class="text"><code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre>
224 -<p>Note that it will install oletools without optional dependencies such  
225 -as XLMMacroDeobfuscator, so you may need to install them separately.</p>  
226 -<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to  
227 -install on a specific Python version.</p>  
228 -<p><strong>Note</strong>: with Python 3, you may need to open a cmd  
229 -window with Administrator privileges in order to run pip and install for  
230 -all users. If that is not possible, you may also install only for the  
231 -current user by adding the <code>--user</code> option:</p> 50 +<p>Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator, so you may need to install them separately.</p>
  51 +<p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
  52 +<p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p>
232 <pre class="text"><code>pip3 install -U --user https://github.com/decalage2/oletools/archive/master.zip</code></pre> 53 <pre class="text"><code>pip3 install -U --user https://github.com/decalage2/oletools/archive/master.zip</code></pre>
233 -<h2 id="how-to-install-offline---computer-without-internet-access">How  
234 -to install offline - Computer without Internet access</h2>  
235 -<p>First, download the oletools archive on a computer with Internet  
236 -access: * Latest stable version: from https://pypi.org/project/oletools/  
237 -or https://github.com/decalage2/oletools/releases * Development version:  
238 -https://github.com/decalage2/oletools/archive/master.zip</p> 54 +<h2 id="how-to-install-offline---computer-without-internet-access">How to install offline - Computer without Internet access</h2>
  55 +<p>First, download the oletools archive on a computer with Internet access: * Latest stable version: from https://pypi.org/project/oletools/ or https://github.com/decalage2/oletools/releases * Development version: https://github.com/decalage2/oletools/archive/master.zip</p>
239 <p>Copy the archive file to the target computer.</p> 56 <p>Copy the archive file to the target computer.</p>
240 -<p>On Linux, Mac OSX, Unix, run the following command using the filename  
241 -of the archive that you downloaded:</p> 57 +<p>On Linux, Mac OSX, Unix, run the following command using the filename of the archive that you downloaded:</p>
242 <pre class="text"><code>sudo -H pip install -U oletools.zip</code></pre> 58 <pre class="text"><code>sudo -H pip install -U oletools.zip</code></pre>
243 <p>On Windows:</p> 59 <p>On Windows:</p>
244 <pre class="text"><code>pip install -U oletools.zip</code></pre> 60 <pre class="text"><code>pip install -U oletools.zip</code></pre>
245 -<h2 id="old-school-install-using-setup.py">Old school install using  
246 -setup.py</h2>  
247 -<p>If you cannot use pip, it is still possible to run the setup.py  
248 -script directly. However, this method will not create the command-line  
249 -scripts automatically.</p>  
250 -<p>First, download the oletools archive: * Latest stable version: from  
251 -https://github.com/decalage2/oletools/releases * Development version:  
252 -https://github.com/decalage2/oletools/archive/master.zip</p>  
253 -<p>Then extract the archive, open a shell and go to the oletools  
254 -directory.</p> 61 +<h2 id="old-school-install-using-setup.py">Old school install using setup.py</h2>
  62 +<p>If you cannot use pip, it is still possible to run the setup.py script directly. However, this method will not create the command-line scripts automatically.</p>
  63 +<p>First, download the oletools archive: * Latest stable version: from https://github.com/decalage2/oletools/releases * Development version: https://github.com/decalage2/oletools/archive/master.zip</p>
  64 +<p>Then extract the archive, open a shell and go to the oletools directory.</p>
255 <h3 id="linux-mac-osx-unix-2">Linux, Mac OSX, Unix</h3> 65 <h3 id="linux-mac-osx-unix-2">Linux, Mac OSX, Unix</h3>
256 <pre class="text"><code>sudo -H python setup.py install</code></pre> 66 <pre class="text"><code>sudo -H python setup.py install</code></pre>
257 <h3 id="windows-2">Windows:</h3> 67 <h3 id="windows-2">Windows:</h3>
258 <pre class="text"><code>python setup.py install</code></pre> 68 <pre class="text"><code>python setup.py install</code></pre>
259 <hr /> 69 <hr />
260 -<h2 id="python-oletools-documentation">python-oletools  
261 -documentation</h2> 70 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
262 <ul> 71 <ul>
263 <li><a href="Home.html">Home</a></li> 72 <li><a href="Home.html">Home</a></li>
264 <li><a href="License.html">License</a></li> 73 <li><a href="License.html">License</a></li>
265 <li><a href="Install.html">Install</a></li> 74 <li><a href="Install.html">Install</a></li>
266 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
267 -Report Issues</li> 75 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
268 <li>Tools: 76 <li>Tools:
269 <ul> 77 <ul>
270 <li><a href="mraptor.html">mraptor</a></li> 78 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/License.html
  View file @ab9a043
@@ -4,189 +4,28 @@ @@ -4,189 +4,28 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="license-for-python-oletools">License for python-oletools</h1> 19 <h1 id="license-for-python-oletools">License for python-oletools</h1>
160 -<p>This license applies to the <a  
161 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
162 -package, apart from the thirdparty folder which contains third-party  
163 -files published with their own license.</p>  
164 -<p>The python-oletools package is copyright (c) 2012-2024 Philippe  
165 -Lagadec (<a  
166 -href="http://www.decalage.info">http://www.decalage.info</a>)</p> 20 +<p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
  21 +<p>The python-oletools package is copyright (c) 2012-2025 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p>
167 <p>All rights reserved.</p> 22 <p>All rights reserved.</p>
168 -<p>Redistribution and use in source and binary forms, with or without  
169 -modification, are permitted provided that the following conditions are  
170 -met:</p> 23 +<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
171 <ul> 24 <ul>
172 -<li>Redistributions of source code must retain the above copyright  
173 -notice, this list of conditions and the following disclaimer.</li>  
174 -<li>Redistributions in binary form must reproduce the above copyright  
175 -notice, this list of conditions and the following disclaimer in the  
176 -documentation and/or other materials provided with the  
177 -distribution.</li> 25 +<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
  26 +<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
178 </ul> 27 </ul>
179 -<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS  
180 -“AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT  
181 -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A  
182 -PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT  
183 -HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,  
184 -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED  
185 -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR  
186 -PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF  
187 -LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING  
188 -NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS  
189 -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p> 28 +<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
190 <table> 29 <table>
191 <tbody> 30 <tbody>
192 <tr class="odd"> 31 <tr class="odd">
@@ -194,35 +33,18 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.&lt;/p&gt; @@ -194,35 +33,18 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.&lt;/p&gt;
194 </tr> 33 </tr>
195 </tbody> 34 </tbody>
196 </table> 35 </table>
197 -<p>olevba contains modified source code from the <a  
198 -href="https://github.com/unixfreak0037/officeparser">officeparser</a>  
199 -project, published under the following MIT License (MIT):</p> 36 +<p>olevba contains modified source code from the <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> project, published under the following MIT License (MIT):</p>
200 <p>officeparser is copyright (c) 2014 John William Davison</p> 37 <p>officeparser is copyright (c) 2014 John William Davison</p>
201 -<p>Permission is hereby granted, free of charge, to any person obtaining  
202 -a copy of this software and associated documentation files (the  
203 -“Software”), to deal in the Software without restriction, including  
204 -without limitation the rights to use, copy, modify, merge, publish,  
205 -distribute, sublicense, and/or sell copies of the Software, and to  
206 -permit persons to whom the Software is furnished to do so, subject to  
207 -the following conditions:</p>  
208 -<p>The above copyright notice and this permission notice shall be  
209 -included in all copies or substantial portions of the Software.</p>  
210 -<p>THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND,  
211 -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF  
212 -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  
213 -IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY  
214 -CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,  
215 -TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE  
216 -SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p> 38 +<p>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:</p>
  39 +<p>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.</p>
  40 +<p>THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.</p>
217 <hr /> 41 <hr />
218 -<h2 id="python-oletools-documentation">python-oletools  
219 -documentation</h2> 42 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
220 <ul> 43 <ul>
221 <li><a href="Home.html">Home</a></li> 44 <li><a href="Home.html">Home</a></li>
222 <li><a href="License.html">License</a></li> 45 <li><a href="License.html">License</a></li>
223 <li><a href="Install.html">Install</a></li> 46 <li><a href="Install.html">Install</a></li>
224 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
225 -Report Issues</li> 47 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
226 <li>Tools: 48 <li>Tools:
227 <ul> 49 <ul>
228 <li><a href="mraptor.html">mraptor</a></li> 50 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/License.md
  View file @ab9a043
@@ -4,7 +4,7 @@ License for python-oletools @@ -4,7 +4,7 @@ License for python-oletools
4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the 4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the
5 thirdparty folder which contains third-party files published with their own license. 5 thirdparty folder which contains third-party files published with their own license.
6 6
7 -The python-oletools package is copyright (c) 2012-2024 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info)) 7 +The python-oletools package is copyright (c) 2012-2025 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
8 8
9 All rights reserved. 9 All rights reserved.
10 10
oletools/doc/mraptor.html
  View file @ab9a043
@@ -4,177 +4,25 @@ @@ -4,177 +4,25 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="mraptor-macroraptor">mraptor (MacroRaptor)</h1> 19 <h1 id="mraptor-macroraptor">mraptor (MacroRaptor)</h1>
160 -<p>mraptor is a tool designed to detect most malicious VBA Macros using  
161 -generic heuristics. Unlike antivirus engines, it does not rely on  
162 -signatures.</p>  
163 -<p>In a nutshell, mraptor detects keywords corresponding to the three  
164 -following types of behaviour that are present in clear text in almost  
165 -any macro malware: - A: Auto-execution trigger - W: Write to the file  
166 -system or memory - X: Execute a file or any payload outside the VBA  
167 -context</p>  
168 -<p>mraptor considers that a macro is suspicious when A and (W or X) is  
169 -true.</p>  
170 -<p>For more information about mraptor’s detection algorithm, see the  
171 -article <a href="http://www.decalage.info/mraptor">How to detect most  
172 -malicious macros without an antivirus</a>.</p>  
173 -<p>mraptor can be used either as a command-line tool, or as a python  
174 -module from your own applications.</p>  
175 -<p>It is part of the <a  
176 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
177 -package.</p> 20 +<p>mraptor is a tool designed to detect most malicious VBA Macros using generic heuristics. Unlike antivirus engines, it does not rely on signatures.</p>
  21 +<p>In a nutshell, mraptor detects keywords corresponding to the three following types of behaviour that are present in clear text in almost any macro malware: - A: Auto-execution trigger - W: Write to the file system or memory - X: Execute a file or any payload outside the VBA context</p>
  22 +<p>mraptor considers that a macro is suspicious when A and (W or X) is true.</p>
  23 +<p>For more information about mraptor’s detection algorithm, see the article <a href="http://www.decalage.info/mraptor">How to detect most malicious macros without an antivirus</a>.</p>
  24 +<p>mraptor can be used either as a command-line tool, or as a python module from your own applications.</p>
  25 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
178 <h2 id="usage">Usage</h2> 26 <h2 id="usage">Usage</h2>
179 <pre class="text"><code>Usage: mraptor [options] &lt;filename&gt; [filename2 ...] 27 <pre class="text"><code>Usage: mraptor [options] &lt;filename&gt; [filename2 ...]
180 28
@@ -202,34 +50,24 @@ An exit code is returned based on the analysis result: @@ -202,34 +50,24 @@ An exit code is returned based on the analysis result:
202 <h3 id="examples">Examples</h3> 50 <h3 id="examples">Examples</h3>
203 <p>Scan a single file:</p> 51 <p>Scan a single file:</p>
204 <pre class="text"><code>mraptor file.doc</code></pre> 52 <pre class="text"><code>mraptor file.doc</code></pre>
205 -<p>Scan a single file, stored in a Zip archive with password  
206 -“infected”:</p> 53 +<p>Scan a single file, stored in a Zip archive with password “infected”:</p>
207 <pre class="text"><code>mraptor malicious_file.xls.zip -z infected</code></pre> 54 <pre class="text"><code>mraptor malicious_file.xls.zip -z infected</code></pre>
208 <p>Scan a collection of files stored in a folder:</p> 55 <p>Scan a collection of files stored in a folder:</p>
209 <pre class="text"><code>mraptor &quot;MalwareZoo/VBA/*&quot;</code></pre> 56 <pre class="text"><code>mraptor &quot;MalwareZoo/VBA/*&quot;</code></pre>
210 -<p><strong>Important</strong>: on Linux/MacOSX, always add double quotes  
211 -around a file name when you use wildcards such as <code>*</code> and  
212 -<code>?</code>. Otherwise, the shell may replace the argument with the  
213 -actual list of files matching the wildcards before starting the  
214 -script.</p> 57 +<p><strong>Important</strong>: on Linux/MacOSX, always add double quotes around a file name when you use wildcards such as <code>*</code> and <code>?</code>. Otherwise, the shell may replace the argument with the actual list of files matching the wildcards before starting the script.</p>
215 <p><img src="mraptor1.png" /></p> 58 <p><img src="mraptor1.png" /></p>
216 <h2 id="python-3-support---mraptor3">Python 3 support - mraptor3</h2> 59 <h2 id="python-3-support---mraptor3">Python 3 support - mraptor3</h2>
217 -<p>Since v0.54, mraptor is fully compatible with both Python 2 and 3.  
218 -There is no need to use mraptor3 anymore, however it is still present  
219 -for backward compatibility.</p> 60 +<p>Since v0.54, mraptor is fully compatible with both Python 2 and 3. There is no need to use mraptor3 anymore, however it is still present for backward compatibility.</p>
220 <hr /> 61 <hr />
221 -<h2 id="how-to-use-mraptor-in-python-applications">How to use mraptor in  
222 -Python applications</h2> 62 +<h2 id="how-to-use-mraptor-in-python-applications">How to use mraptor in Python applications</h2>
223 <p>TODO</p> 63 <p>TODO</p>
224 <hr /> 64 <hr />
225 -<h2 id="python-oletools-documentation">python-oletools  
226 -documentation</h2> 65 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
227 <ul> 66 <ul>
228 <li><a href="Home.html">Home</a></li> 67 <li><a href="Home.html">Home</a></li>
229 <li><a href="License.html">License</a></li> 68 <li><a href="License.html">License</a></li>
230 <li><a href="Install.html">Install</a></li> 69 <li><a href="Install.html">Install</a></li>
231 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
232 -Report Issues</li> 70 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
233 <li>Tools: 71 <li>Tools:
234 <ul> 72 <ul>
235 <li><a href="mraptor.html">mraptor</a></li> 73 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/olebrowse.html
  View file @ab9a043
@@ -4,182 +4,30 @@ @@ -4,182 +4,30 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="olebrowse">olebrowse</h1> 19 <h1 id="olebrowse">olebrowse</h1>
160 -<p>olebrowse is a simple GUI to browse OLE files (e.g. MS Word, Excel,  
161 -Powerpoint documents), to view and extract individual data streams.</p>  
162 -<p>It is part of the <a  
163 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
164 -package.</p> 20 +<p>olebrowse is a simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.</p>
  21 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
165 <h2 id="dependencies">Dependencies</h2> 22 <h2 id="dependencies">Dependencies</h2>
166 -<p>olebrowse requires <a  
167 -href="https://en.wikipedia.org/wiki/Tkinter">Tkinter</a>. On Windows and  
168 -MacOSX, it should be installed with Python, and olebrowse should work  
169 -out of the box.</p>  
170 -<p>However, on Linux it might be necessary to install the tkinter  
171 -package for Python separately. For example, on Ubuntu this is done with  
172 -the following command:</p> 23 +<p>olebrowse requires <a href="https://en.wikipedia.org/wiki/Tkinter">Tkinter</a>. On Windows and MacOSX, it should be installed with Python, and olebrowse should work out of the box.</p>
  24 +<p>However, on Linux it might be necessary to install the tkinter package for Python separately. For example, on Ubuntu this is done with the following command:</p>
173 <pre><code>sudo apt-get install python-tk</code></pre> 25 <pre><code>sudo apt-get install python-tk</code></pre>
174 <p>And for Python 3:</p> 26 <p>And for Python 3:</p>
175 <pre><code>sudo apt-get install python3-tk</code></pre> 27 <pre><code>sudo apt-get install python3-tk</code></pre>
176 <h2 id="usage">Usage</h2> 28 <h2 id="usage">Usage</h2>
177 <pre><code>olebrowse [file]</code></pre> 29 <pre><code>olebrowse [file]</code></pre>
178 -<p>If you provide a file it will be opened, else a dialog will allow you  
179 -to browse folders to open a file. Then if it is a valid OLE file, the  
180 -list of data streams will be displayed. You can select a stream, and  
181 -then either view its content in a builtin hexadecimal viewer, or save it  
182 -to a file for further analysis.</p> 30 +<p>If you provide a file it will be opened, else a dialog will allow you to browse folders to open a file. Then if it is a valid OLE file, the list of data streams will be displayed. You can select a stream, and then either view its content in a builtin hexadecimal viewer, or save it to a file for further analysis.</p>
183 <h2 id="screenshots">Screenshots</h2> 31 <h2 id="screenshots">Screenshots</h2>
184 <p>Main menu, showing all streams in the OLE file:</p> 32 <p>Main menu, showing all streams in the OLE file:</p>
185 <p><img src="olebrowse1_menu.png" /></p> 33 <p><img src="olebrowse1_menu.png" /></p>
@@ -188,14 +36,12 @@ to a file for further analysis.&lt;/p&gt; @@ -188,14 +36,12 @@ to a file for further analysis.&lt;/p&gt;
188 <p>Hex view for a stream:</p> 36 <p>Hex view for a stream:</p>
189 <p><img src="olebrowse3_hexview.png" /></p> 37 <p><img src="olebrowse3_hexview.png" /></p>
190 <hr /> 38 <hr />
191 -<h2 id="python-oletools-documentation">python-oletools  
192 -documentation</h2> 39 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
193 <ul> 40 <ul>
194 <li><a href="Home.html">Home</a></li> 41 <li><a href="Home.html">Home</a></li>
195 <li><a href="License.html">License</a></li> 42 <li><a href="License.html">License</a></li>
196 <li><a href="Install.html">Install</a></li> 43 <li><a href="Install.html">Install</a></li>
197 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
198 -Report Issues</li> 44 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
199 <li>Tools: 45 <li>Tools:
200 <ul> 46 <ul>
201 <li><a href="mraptor.html">mraptor</a></li> 47 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/oledir.html
  View file @ab9a043
@@ -4,166 +4,22 @@ @@ -4,166 +4,22 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="oledir">oledir</h1> 19 <h1 id="oledir">oledir</h1>
160 -<p>oledir is a script to display all the directory entries of an OLE  
161 -file, including free and orphaned entries.</p>  
162 -<p>It can be used either as a command-line tool, or as a python module  
163 -from your own applications.</p>  
164 -<p>It is part of the <a  
165 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
166 -package.</p> 20 +<p>oledir is a script to display all the directory entries of an OLE file, including free and orphaned entries.</p>
  21 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  22 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
167 <h2 id="usage">Usage</h2> 23 <h2 id="usage">Usage</h2>
168 <pre class="text"><code>Usage: oledir [options] &lt;filename&gt; [filename2 ...] 24 <pre class="text"><code>Usage: oledir [options] &lt;filename&gt; [filename2 ...]
169 25
@@ -182,18 +38,15 @@ Options: @@ -182,18 +38,15 @@ Options:
182 <pre class="text"><code>oledir file.doc</code></pre> 38 <pre class="text"><code>oledir file.doc</code></pre>
183 <p><img src="oledir.png" /></p> 39 <p><img src="oledir.png" /></p>
184 <hr /> 40 <hr />
185 -<h2 id="how-to-use-oledir-in-python-applications">How to use oledir in  
186 -Python applications</h2> 41 +<h2 id="how-to-use-oledir-in-python-applications">How to use oledir in Python applications</h2>
187 <p>TODO</p> 42 <p>TODO</p>
188 <hr /> 43 <hr />
189 -<h2 id="python-oletools-documentation">python-oletools  
190 -documentation</h2> 44 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
191 <ul> 45 <ul>
192 <li><a href="Home.html">Home</a></li> 46 <li><a href="Home.html">Home</a></li>
193 <li><a href="License.html">License</a></li> 47 <li><a href="License.html">License</a></li>
194 <li><a href="Install.html">Install</a></li> 48 <li><a href="Install.html">Install</a></li>
195 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
196 -Report Issues</li> 49 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
197 <li>Tools: 50 <li>Tools:
198 <ul> 51 <ul>
199 <li><a href="mraptor.html">mraptor</a></li> 52 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/oleid.html
  View file @ab9a043
@@ -4,233 +4,89 @@ @@ -4,233 +4,89 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - pre > code.sourceCode { white-space: pre; position: relative; }  
156 - pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }  
157 - pre > code.sourceCode > span:empty { height: 1.2em; }  
158 - .sourceCode { overflow: visible; }  
159 - code.sourceCode > span { color: inherit; text-decoration: inherit; }  
160 - div.sourceCode { margin: 1em 0; }  
161 - pre.sourceCode { margin: 0; }  
162 - @media screen {  
163 - div.sourceCode { overflow: auto; }  
164 - }  
165 - @media print {  
166 - pre > code.sourceCode { white-space: pre-wrap; }  
167 - pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }  
168 - }  
169 - pre.numberSource code  
170 - { counter-reset: source-line 0; }  
171 - pre.numberSource code > span  
172 - { position: relative; left: -4em; counter-increment: source-line; }  
173 - pre.numberSource code > span > a:first-child::before  
174 - { content: counter(source-line);  
175 - position: relative; left: -1em; text-align: right; vertical-align: baseline;  
176 - border: none; display: inline-block;  
177 - -webkit-touch-callout: none; -webkit-user-select: none;  
178 - -khtml-user-select: none; -moz-user-select: none;  
179 - -ms-user-select: none; user-select: none;  
180 - padding: 0 4px; width: 4em;  
181 - color: #aaaaaa;  
182 - }  
183 - pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }  
184 - div.sourceCode  
185 - { }  
186 - @media screen {  
187 - pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }  
188 - }  
189 - code span.al { color: #ff0000; font-weight: bold; } /* Alert */  
190 - code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */  
191 - code span.at { color: #7d9029; } /* Attribute */  
192 - code span.bn { color: #40a070; } /* BaseN */  
193 - code span.bu { color: #008000; } /* BuiltIn */  
194 - code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */  
195 - code span.ch { color: #4070a0; } /* Char */  
196 - code span.cn { color: #880000; } /* Constant */  
197 - code span.co { color: #60a0b0; font-style: italic; } /* Comment */  
198 - code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */  
199 - code span.do { color: #ba2121; font-style: italic; } /* Documentation */  
200 - code span.dt { color: #902000; } /* DataType */  
201 - code span.dv { color: #40a070; } /* DecVal */  
202 - code span.er { color: #ff0000; font-weight: bold; } /* Error */  
203 - code span.ex { } /* Extension */  
204 - code span.fl { color: #40a070; } /* Float */  
205 - code span.fu { color: #06287e; } /* Function */  
206 - code span.im { color: #008000; font-weight: bold; } /* Import */  
207 - code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */  
208 - code span.kw { color: #007020; font-weight: bold; } /* Keyword */  
209 - code span.op { color: #666666; } /* Operator */  
210 - code span.ot { color: #007020; } /* Other */  
211 - code span.pp { color: #bc7a00; } /* Preprocessor */  
212 - code span.sc { color: #4070a0; } /* SpecialChar */  
213 - code span.ss { color: #bb6688; } /* SpecialString */  
214 - code span.st { color: #4070a0; } /* String */  
215 - code span.va { color: #19177c; } /* Variable */  
216 - code span.vs { color: #4070a0; } /* VerbatimString */  
217 - code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */  
218 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
219 </style> 13 </style>
  14 + <style type="text/css">
  15 +a.sourceLine { display: inline-block; line-height: 1.25; }
  16 +a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
  17 +a.sourceLine:empty { height: 1.2em; position: absolute; }
  18 +.sourceCode { overflow: visible; }
  19 +code.sourceCode { white-space: pre; position: relative; }
  20 +div.sourceCode { margin: 1em 0; }
  21 +pre.sourceCode { margin: 0; }
  22 +@media screen {
  23 +div.sourceCode { overflow: auto; }
  24 +}
  25 +@media print {
  26 +code.sourceCode { white-space: pre-wrap; }
  27 +a.sourceLine { text-indent: -1em; padding-left: 1em; }
  28 +}
  29 +pre.numberSource a.sourceLine
  30 + { position: relative; }
  31 +pre.numberSource a.sourceLine:empty
  32 + { position: absolute; }
  33 +pre.numberSource a.sourceLine::before
  34 + { content: attr(data-line-number);
  35 + position: absolute; left: -5em; text-align: right; vertical-align: baseline;
  36 + border: none; pointer-events: all;
  37 + -webkit-touch-callout: none; -webkit-user-select: none;
  38 + -khtml-user-select: none; -moz-user-select: none;
  39 + -ms-user-select: none; user-select: none;
  40 + padding: 0 4px; width: 4em;
  41 + color: #aaaaaa;
  42 + }
  43 +pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  44 +div.sourceCode
  45 + { }
  46 +@media screen {
  47 +a.sourceLine::before { text-decoration: underline; }
  48 +}
  49 +code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  50 +code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  51 +code span.at { color: #7d9029; } /* Attribute */
  52 +code span.bn { color: #40a070; } /* BaseN */
  53 +code span.bu { } /* BuiltIn */
  54 +code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  55 +code span.ch { color: #4070a0; } /* Char */
  56 +code span.cn { color: #880000; } /* Constant */
  57 +code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  58 +code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  59 +code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  60 +code span.dt { color: #902000; } /* DataType */
  61 +code span.dv { color: #40a070; } /* DecVal */
  62 +code span.er { color: #ff0000; font-weight: bold; } /* Error */
  63 +code span.ex { } /* Extension */
  64 +code span.fl { color: #40a070; } /* Float */
  65 +code span.fu { color: #06287e; } /* Function */
  66 +code span.im { } /* Import */
  67 +code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  68 +code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  69 +code span.op { color: #666666; } /* Operator */
  70 +code span.ot { color: #007020; } /* Other */
  71 +code span.pp { color: #bc7a00; } /* Preprocessor */
  72 +code span.sc { color: #4070a0; } /* SpecialChar */
  73 +code span.ss { color: #bb6688; } /* SpecialString */
  74 +code span.st { color: #4070a0; } /* String */
  75 +code span.va { color: #19177c; } /* Variable */
  76 +code span.vs { color: #4070a0; } /* VerbatimString */
  77 +code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  78 + </style>
  79 + <!--[if lt IE 9]>
  80 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  81 + <![endif]-->
220 </head> 82 </head>
221 <body> 83 <body>
222 <h1 id="oleid">oleid</h1> 84 <h1 id="oleid">oleid</h1>
223 -<p>oleid is a script to analyze OLE files such as MS Office documents  
224 -(e.g. Word, Excel), to detect specific characteristics usually found in  
225 -malicious files (e.g. malware). For example it can detect VBA macros and  
226 -embedded Flash objects.</p>  
227 -<p>It is part of the <a  
228 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
229 -package.</p> 85 +<p>oleid is a script to analyze OLE files such as MS Office documents (e.g. Word, Excel), to detect specific characteristics usually found in malicious files (e.g. malware). For example it can detect VBA macros and embedded Flash objects.</p>
  86 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
230 <h2 id="main-features">Main Features</h2> 87 <h2 id="main-features">Main Features</h2>
231 <ul> 88 <ul>
232 -<li>Detect OLE file type from its internal structure (e.g. MS Word,  
233 -Excel, PowerPoint, …)</li> 89 +<li>Detect OLE file type from its internal structure (e.g. MS Word, Excel, PowerPoint, …)</li>
234 <li>Detect VBA Macros</li> 90 <li>Detect VBA Macros</li>
235 <li>Detect embedded Flash objects</li> 91 <li>Detect embedded Flash objects</li>
236 <li>Detect embedded OLE objects</li> 92 <li>Detect embedded OLE objects</li>
@@ -245,8 +101,7 @@ Excel, PowerPoint, …)&lt;/li&gt; @@ -245,8 +101,7 @@ Excel, PowerPoint, …)&lt;/li&gt;
245 <li>Generic VBA macros detection</li> 101 <li>Generic VBA macros detection</li>
246 <li>Detect auto-executable VBA macros</li> 102 <li>Detect auto-executable VBA macros</li>
247 <li>Extended OLE file types detection</li> 103 <li>Extended OLE file types detection</li>
248 -<li>Detect unusual OLE structures (fragmentation, unused sectors,  
249 -etc)</li> 104 +<li>Detect unusual OLE structures (fragmentation, unused sectors, etc)</li>
250 <li>Options to scan multiple files</li> 105 <li>Options to scan multiple files</li>
251 <li>Options to scan files from encrypted zip archives</li> 106 <li>Options to scan files from encrypted zip archives</li>
252 <li>CSV output</li> 107 <li>CSV output</li>
@@ -254,8 +109,7 @@ etc)&lt;/li&gt; @@ -254,8 +109,7 @@ etc)&lt;/li&gt;
254 <h2 id="usage">Usage</h2> 109 <h2 id="usage">Usage</h2>
255 <pre class="text"><code>oleid &lt;file&gt;</code></pre> 110 <pre class="text"><code>oleid &lt;file&gt;</code></pre>
256 <h3 id="example">Example</h3> 111 <h3 id="example">Example</h3>
257 -<p>Analyzing a Word document containing a Flash object and VBA  
258 -macros:</p> 112 +<p>Analyzing a Word document containing a Flash object and VBA macros:</p>
259 <pre class="text"><code>C:\oletools&gt;oleid word_flash_vba.doc 113 <pre class="text"><code>C:\oletools&gt;oleid word_flash_vba.doc
260 114
261 Filename: word_flash_vba.doc 115 Filename: word_flash_vba.doc
@@ -274,45 +128,35 @@ Filename: word_flash_vba.doc @@ -274,45 +128,35 @@ Filename: word_flash_vba.doc
274 | ObjectPool | True | 128 | ObjectPool | True |
275 | Flash objects | 1 | 129 | Flash objects | 1 |
276 +-------------------------------+-----------------------+</code></pre> 130 +-------------------------------+-----------------------+</code></pre>
277 -<h2 id="how-to-use-oleid-in-your-python-applications">How to use oleid  
278 -in your Python applications</h2>  
279 -<p>First, import oletools.oleid, and create an <strong>OleID</strong>  
280 -object to scan a file:</p>  
281 -<div class="sourceCode" id="cb3"><pre  
282 -class="sourceCode python"><code class="sourceCode python"><span id="cb3-1"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="im">import</span> oletools.oleid</span>  
283 -<span id="cb3-2"><a href="#cb3-2" aria-hidden="true" tabindex="-1"></a></span>  
284 -<span id="cb3-3"><a href="#cb3-3" aria-hidden="true" tabindex="-1"></a>oid <span class="op">=</span> oletools.oleid.OleID(filename)</span></code></pre></div>  
285 -<p>Note: filename can be a filename, a file-like object, or a bytes  
286 -string containing the file to be analyzed.</p>  
287 -<p>Second, call the <strong>check()</strong> method. It returns a list  
288 -of <strong>Indicator</strong> objects.</p> 131 +<h2 id="how-to-use-oleid-in-your-python-applications">How to use oleid in your Python applications</h2>
  132 +<p>First, import oletools.oleid, and create an <strong>OleID</strong> object to scan a file:</p>
  133 +<div class="sourceCode" id="cb3"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb3-1" data-line-number="1"><span class="im">import</span> oletools.oleid</a>
  134 +<a class="sourceLine" id="cb3-2" data-line-number="2"></a>
  135 +<a class="sourceLine" id="cb3-3" data-line-number="3">oid <span class="op">=</span> oletools.oleid.OleID(filename)</a></code></pre></div>
  136 +<p>Note: filename can be a filename, a file-like object, or a bytes string containing the file to be analyzed.</p>
  137 +<p>Second, call the <strong>check()</strong> method. It returns a list of <strong>Indicator</strong> objects.</p>
289 <p>Each Indicator object has the following attributes:</p> 138 <p>Each Indicator object has the following attributes:</p>
290 <ul> 139 <ul>
291 <li><strong>id</strong>: str, identifier for the indicator</li> 140 <li><strong>id</strong>: str, identifier for the indicator</li>
292 <li><strong>name</strong>: str, name to display the indicator</li> 141 <li><strong>name</strong>: str, name to display the indicator</li>
293 -<li><strong>description</strong>: str, long description of the  
294 -indicator</li>  
295 -<li><strong>type</strong>: class of the indicator (e.g. bool, str,  
296 -int)</li> 142 +<li><strong>description</strong>: str, long description of the indicator</li>
  143 +<li><strong>type</strong>: class of the indicator (e.g. bool, str, int)</li>
297 <li><strong>value</strong>: value of the indicator</li> 144 <li><strong>value</strong>: value of the indicator</li>
298 </ul> 145 </ul>
299 <p>For example, the following code displays all the indicators:</p> 146 <p>For example, the following code displays all the indicators:</p>
300 -<div class="sourceCode" id="cb4"><pre  
301 -class="sourceCode python"><code class="sourceCode python"><span id="cb4-1"><a href="#cb4-1" aria-hidden="true" tabindex="-1"></a>indicators <span class="op">=</span> oid.check()</span>  
302 -<span id="cb4-2"><a href="#cb4-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> i <span class="kw">in</span> indicators:</span>  
303 -<span id="cb4-3"><a href="#cb4-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Indicator id=</span><span class="sc">%s</span><span class="st"> name=&quot;</span><span class="sc">%s</span><span class="st">&quot; type=</span><span class="sc">%s</span><span class="st"> value=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (i.<span class="bu">id</span>, i.name, i.<span class="bu">type</span>, <span class="bu">repr</span>(i.value))</span>  
304 -<span id="cb4-4"><a href="#cb4-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;description:&#39;</span>, i.description</span>  
305 -<span id="cb4-5"><a href="#cb4-5" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;&#39;</span></span></code></pre></div> 147 +<div class="sourceCode" id="cb4"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb4-1" data-line-number="1">indicators <span class="op">=</span> oid.check()</a>
  148 +<a class="sourceLine" id="cb4-2" data-line-number="2"><span class="cf">for</span> i <span class="kw">in</span> indicators:</a>
  149 +<a class="sourceLine" id="cb4-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;Indicator id=</span><span class="sc">%s</span><span class="st"> name=&quot;</span><span class="sc">%s</span><span class="st">&quot; type=</span><span class="sc">%s</span><span class="st"> value=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (i.<span class="bu">id</span>, i.name, i.<span class="bu">type</span>, <span class="bu">repr</span>(i.value))</a>
  150 +<a class="sourceLine" id="cb4-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;description:&#39;</span>, i.description</a>
  151 +<a class="sourceLine" id="cb4-5" data-line-number="5"> <span class="bu">print</span> <span class="st">&#39;&#39;</span></a></code></pre></div>
306 <p>See the source code of oleid.py for more details.</p> 152 <p>See the source code of oleid.py for more details.</p>
307 <hr /> 153 <hr />
308 -<h2 id="python-oletools-documentation">python-oletools  
309 -documentation</h2> 154 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
310 <ul> 155 <ul>
311 <li><a href="Home.html">Home</a></li> 156 <li><a href="Home.html">Home</a></li>
312 <li><a href="License.html">License</a></li> 157 <li><a href="License.html">License</a></li>
313 <li><a href="Install.html">Install</a></li> 158 <li><a href="Install.html">Install</a></li>
314 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
315 -Report Issues</li> 159 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
316 <li>Tools: 160 <li>Tools:
317 <ul> 161 <ul>
318 <li><a href="mraptor.html">mraptor</a></li> 162 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/olemap.html
  View file @ab9a043
@@ -4,166 +4,22 @@ @@ -4,166 +4,22 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="olemap">olemap</h1> 19 <h1 id="olemap">olemap</h1>
160 -<p>olemap is a script to display a map of all the sectors in an OLE  
161 -file.</p>  
162 -<p>It can be used either as a command-line tool, or as a python module  
163 -from your own applications.</p>  
164 -<p>It is part of the <a  
165 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
166 -package.</p> 20 +<p>olemap is a script to display a map of all the sectors in an OLE file.</p>
  21 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  22 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
167 <h2 id="usage">Usage</h2> 23 <h2 id="usage">Usage</h2>
168 <pre class="text"><code>Usage: olemap &lt;filename&gt;</code></pre> 24 <pre class="text"><code>Usage: olemap &lt;filename&gt;</code></pre>
169 <h3 id="examples">Examples</h3> 25 <h3 id="examples">Examples</h3>
@@ -172,18 +28,15 @@ package.&lt;/p&gt; @@ -172,18 +28,15 @@ package.&lt;/p&gt;
172 <p><img src="olemap1.png" /></p> 28 <p><img src="olemap1.png" /></p>
173 <p><img src="olemap2.png" /></p> 29 <p><img src="olemap2.png" /></p>
174 <hr /> 30 <hr />
175 -<h2 id="how-to-use-olemap-in-python-applications">How to use olemap in  
176 -Python applications</h2> 31 +<h2 id="how-to-use-olemap-in-python-applications">How to use olemap in Python applications</h2>
177 <p>TODO</p> 32 <p>TODO</p>
178 <hr /> 33 <hr />
179 -<h2 id="python-oletools-documentation">python-oletools  
180 -documentation</h2> 34 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
181 <ul> 35 <ul>
182 <li><a href="Home.html">Home</a></li> 36 <li><a href="Home.html">Home</a></li>
183 <li><a href="License.html">License</a></li> 37 <li><a href="License.html">License</a></li>
184 <li><a href="Install.html">Install</a></li> 38 <li><a href="Install.html">Install</a></li>
185 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
186 -Report Issues</li> 39 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
187 <li>Tools: 40 <li>Tools:
188 <ul> 41 <ul>
189 <li><a href="mraptor.html">mraptor</a></li> 42 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/olemeta.html
  View file @ab9a043
@@ -4,181 +4,34 @@ @@ -4,181 +4,34 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="olemeta">olemeta</h1> 19 <h1 id="olemeta">olemeta</h1>
160 -<p>olemeta is a script to parse OLE files such as MS Office documents  
161 -(e.g. Word, Excel), to extract all standard properties present in the  
162 -OLE file.</p>  
163 -<p>It is part of the <a  
164 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
165 -package.</p> 20 +<p>olemeta is a script to parse OLE files such as MS Office documents (e.g. Word, Excel), to extract all standard properties present in the OLE file.</p>
  21 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
166 <h2 id="usage">Usage</h2> 22 <h2 id="usage">Usage</h2>
167 <pre class="text"><code>olemeta &lt;file&gt;</code></pre> 23 <pre class="text"><code>olemeta &lt;file&gt;</code></pre>
168 <h3 id="example">Example</h3> 24 <h3 id="example">Example</h3>
169 <p><img src="olemeta1.png" /></p> 25 <p><img src="olemeta1.png" /></p>
170 -<h2 id="how-to-use-olemeta-in-python-applications">How to use olemeta in  
171 -Python applications</h2> 26 +<h2 id="how-to-use-olemeta-in-python-applications">How to use olemeta in Python applications</h2>
172 <p>TODO</p> 27 <p>TODO</p>
173 <hr /> 28 <hr />
174 -<h2 id="python-oletools-documentation">python-oletools  
175 -documentation</h2> 29 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
176 <ul> 30 <ul>
177 <li><a href="Home.html">Home</a></li> 31 <li><a href="Home.html">Home</a></li>
178 <li><a href="License.html">License</a></li> 32 <li><a href="License.html">License</a></li>
179 <li><a href="Install.html">Install</a></li> 33 <li><a href="Install.html">Install</a></li>
180 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
181 -Report Issues</li> 34 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
182 <li>Tools: 35 <li>Tools:
183 <ul> 36 <ul>
184 <li><a href="mraptor.html">mraptor</a></li> 37 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/oleobj.html
  View file @ab9a043
@@ -4,181 +4,35 @@ @@ -4,181 +4,35 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="oleobj">oleobj</h1> 19 <h1 id="oleobj">oleobj</h1>
160 <p>oleobj is a script to extract embedded objects from OLE files.</p> 20 <p>oleobj is a script to extract embedded objects from OLE files.</p>
161 -<p>It can be used either as a command-line tool, or as a python module  
162 -from your own applications.</p>  
163 -<p>It is part of the <a  
164 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
165 -package.</p> 21 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  22 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
166 <h2 id="usage">Usage</h2> 23 <h2 id="usage">Usage</h2>
167 <pre class="text"><code>TODO</code></pre> 24 <pre class="text"><code>TODO</code></pre>
168 <hr /> 25 <hr />
169 -<h2 id="how-to-use-oleobj-in-python-applications">How to use oleobj in  
170 -Python applications</h2> 26 +<h2 id="how-to-use-oleobj-in-python-applications">How to use oleobj in Python applications</h2>
171 <p>See rtfobj.py source code.</p> 27 <p>See rtfobj.py source code.</p>
172 <p>TODO</p> 28 <p>TODO</p>
173 <hr /> 29 <hr />
174 -<h2 id="python-oletools-documentation">python-oletools  
175 -documentation</h2> 30 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
176 <ul> 31 <ul>
177 <li><a href="Home.html">Home</a></li> 32 <li><a href="Home.html">Home</a></li>
178 <li><a href="License.html">License</a></li> 33 <li><a href="License.html">License</a></li>
179 <li><a href="Install.html">Install</a></li> 34 <li><a href="Install.html">Install</a></li>
180 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
181 -Report Issues</li> 35 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
182 <li>Tools: 36 <li>Tools:
183 <ul> 37 <ul>
184 <li><a href="mraptor.html">mraptor</a></li> 38 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/oletimes.html
  View file @ab9a043
@@ -4,170 +4,25 @@ @@ -4,170 +4,25 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="oletimes">oletimes</h1> 19 <h1 id="oletimes">oletimes</h1>
160 -<p>oletimes is a script to parse OLE files such as MS Office documents  
161 -(e.g. Word, Excel), to extract creation and modification times of all  
162 -streams and storages in the OLE file.</p>  
163 -<p>It is part of the <a  
164 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
165 -package.</p> 20 +<p>oletimes is a script to parse OLE files such as MS Office documents (e.g. Word, Excel), to extract creation and modification times of all streams and storages in the OLE file.</p>
  21 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
166 <h2 id="usage">Usage</h2> 22 <h2 id="usage">Usage</h2>
167 <pre class="text"><code>oletimes &lt;file&gt;</code></pre> 23 <pre class="text"><code>oletimes &lt;file&gt;</code></pre>
168 <h3 id="example">Example</h3> 24 <h3 id="example">Example</h3>
169 -<p>Checking the malware sample <a  
170 -href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p> 25 +<p>Checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
171 <pre class="text"><code>&gt;oletimes DIAN_caso-5415.doc 26 <pre class="text"><code>&gt;oletimes DIAN_caso-5415.doc
172 27
173 +----------------------------+---------------------+---------------------+ 28 +----------------------------+---------------------+---------------------+
@@ -193,18 +48,15 @@ href=&quot;https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/&quot;&gt;D @@ -193,18 +48,15 @@ href=&quot;https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/&quot;&gt;D
193 | &#39;Macros/VBA/dir&#39; | None | None | 48 | &#39;Macros/VBA/dir&#39; | None | None |
194 | &#39;WordDocument&#39; | None | None | 49 | &#39;WordDocument&#39; | None | None |
195 +----------------------------+---------------------+---------------------+</code></pre> 50 +----------------------------+---------------------+---------------------+</code></pre>
196 -<h2 id="how-to-use-oletimes-in-python-applications">How to use oletimes  
197 -in Python applications</h2> 51 +<h2 id="how-to-use-oletimes-in-python-applications">How to use oletimes in Python applications</h2>
198 <p>TODO</p> 52 <p>TODO</p>
199 <hr /> 53 <hr />
200 -<h2 id="python-oletools-documentation">python-oletools  
201 -documentation</h2> 54 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
202 <ul> 55 <ul>
203 <li><a href="Home.html">Home</a></li> 56 <li><a href="Home.html">Home</a></li>
204 <li><a href="License.html">License</a></li> 57 <li><a href="License.html">License</a></li>
205 <li><a href="Install.html">Install</a></li> 58 <li><a href="Install.html">Install</a></li>
206 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
207 -Report Issues</li> 59 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
208 <li>Tools: 60 <li>Tools:
209 <ul> 61 <ul>
210 <li><a href="mraptor.html">mraptor</a></li> 62 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/olevba.html
  View file @ab9a043
@@ -4,242 +4,88 @@ @@ -4,242 +4,88 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - pre > code.sourceCode { white-space: pre; position: relative; }  
156 - pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }  
157 - pre > code.sourceCode > span:empty { height: 1.2em; }  
158 - .sourceCode { overflow: visible; }  
159 - code.sourceCode > span { color: inherit; text-decoration: inherit; }  
160 - div.sourceCode { margin: 1em 0; }  
161 - pre.sourceCode { margin: 0; }  
162 - @media screen {  
163 - div.sourceCode { overflow: auto; }  
164 - }  
165 - @media print {  
166 - pre > code.sourceCode { white-space: pre-wrap; }  
167 - pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }  
168 - }  
169 - pre.numberSource code  
170 - { counter-reset: source-line 0; }  
171 - pre.numberSource code > span  
172 - { position: relative; left: -4em; counter-increment: source-line; }  
173 - pre.numberSource code > span > a:first-child::before  
174 - { content: counter(source-line);  
175 - position: relative; left: -1em; text-align: right; vertical-align: baseline;  
176 - border: none; display: inline-block;  
177 - -webkit-touch-callout: none; -webkit-user-select: none;  
178 - -khtml-user-select: none; -moz-user-select: none;  
179 - -ms-user-select: none; user-select: none;  
180 - padding: 0 4px; width: 4em;  
181 - color: #aaaaaa;  
182 - }  
183 - pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }  
184 - div.sourceCode  
185 - { }  
186 - @media screen {  
187 - pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }  
188 - }  
189 - code span.al { color: #ff0000; font-weight: bold; } /* Alert */  
190 - code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */  
191 - code span.at { color: #7d9029; } /* Attribute */  
192 - code span.bn { color: #40a070; } /* BaseN */  
193 - code span.bu { color: #008000; } /* BuiltIn */  
194 - code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */  
195 - code span.ch { color: #4070a0; } /* Char */  
196 - code span.cn { color: #880000; } /* Constant */  
197 - code span.co { color: #60a0b0; font-style: italic; } /* Comment */  
198 - code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */  
199 - code span.do { color: #ba2121; font-style: italic; } /* Documentation */  
200 - code span.dt { color: #902000; } /* DataType */  
201 - code span.dv { color: #40a070; } /* DecVal */  
202 - code span.er { color: #ff0000; font-weight: bold; } /* Error */  
203 - code span.ex { } /* Extension */  
204 - code span.fl { color: #40a070; } /* Float */  
205 - code span.fu { color: #06287e; } /* Function */  
206 - code span.im { color: #008000; font-weight: bold; } /* Import */  
207 - code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */  
208 - code span.kw { color: #007020; font-weight: bold; } /* Keyword */  
209 - code span.op { color: #666666; } /* Operator */  
210 - code span.ot { color: #007020; } /* Other */  
211 - code span.pp { color: #bc7a00; } /* Preprocessor */  
212 - code span.sc { color: #4070a0; } /* SpecialChar */  
213 - code span.ss { color: #bb6688; } /* SpecialString */  
214 - code span.st { color: #4070a0; } /* String */  
215 - code span.va { color: #19177c; } /* Variable */  
216 - code span.vs { color: #4070a0; } /* VerbatimString */  
217 - code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */  
218 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
219 </style> 13 </style>
  14 + <style type="text/css">
  15 +a.sourceLine { display: inline-block; line-height: 1.25; }
  16 +a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
  17 +a.sourceLine:empty { height: 1.2em; position: absolute; }
  18 +.sourceCode { overflow: visible; }
  19 +code.sourceCode { white-space: pre; position: relative; }
  20 +div.sourceCode { margin: 1em 0; }
  21 +pre.sourceCode { margin: 0; }
  22 +@media screen {
  23 +div.sourceCode { overflow: auto; }
  24 +}
  25 +@media print {
  26 +code.sourceCode { white-space: pre-wrap; }
  27 +a.sourceLine { text-indent: -1em; padding-left: 1em; }
  28 +}
  29 +pre.numberSource a.sourceLine
  30 + { position: relative; }
  31 +pre.numberSource a.sourceLine:empty
  32 + { position: absolute; }
  33 +pre.numberSource a.sourceLine::before
  34 + { content: attr(data-line-number);
  35 + position: absolute; left: -5em; text-align: right; vertical-align: baseline;
  36 + border: none; pointer-events: all;
  37 + -webkit-touch-callout: none; -webkit-user-select: none;
  38 + -khtml-user-select: none; -moz-user-select: none;
  39 + -ms-user-select: none; user-select: none;
  40 + padding: 0 4px; width: 4em;
  41 + color: #aaaaaa;
  42 + }
  43 +pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  44 +div.sourceCode
  45 + { }
  46 +@media screen {
  47 +a.sourceLine::before { text-decoration: underline; }
  48 +}
  49 +code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  50 +code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  51 +code span.at { color: #7d9029; } /* Attribute */
  52 +code span.bn { color: #40a070; } /* BaseN */
  53 +code span.bu { } /* BuiltIn */
  54 +code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  55 +code span.ch { color: #4070a0; } /* Char */
  56 +code span.cn { color: #880000; } /* Constant */
  57 +code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  58 +code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  59 +code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  60 +code span.dt { color: #902000; } /* DataType */
  61 +code span.dv { color: #40a070; } /* DecVal */
  62 +code span.er { color: #ff0000; font-weight: bold; } /* Error */
  63 +code span.ex { } /* Extension */
  64 +code span.fl { color: #40a070; } /* Float */
  65 +code span.fu { color: #06287e; } /* Function */
  66 +code span.im { } /* Import */
  67 +code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  68 +code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  69 +code span.op { color: #666666; } /* Operator */
  70 +code span.ot { color: #007020; } /* Other */
  71 +code span.pp { color: #bc7a00; } /* Preprocessor */
  72 +code span.sc { color: #4070a0; } /* SpecialChar */
  73 +code span.ss { color: #bb6688; } /* SpecialString */
  74 +code span.st { color: #4070a0; } /* String */
  75 +code span.va { color: #19177c; } /* Variable */
  76 +code span.vs { color: #4070a0; } /* VerbatimString */
  77 +code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  78 + </style>
  79 + <!--[if lt IE 9]>
  80 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  81 + <![endif]-->
220 </head> 82 </head>
221 <body> 83 <body>
222 <h1 id="olevba">olevba</h1> 84 <h1 id="olevba">olevba</h1>
223 -<p>olevba is a script to parse OLE and OpenXML files such as MS Office  
224 -documents (e.g. Word, Excel), to <strong>detect VBA Macros</strong>,  
225 -extract their <strong>source code</strong> in clear text, and detect  
226 -security-related patterns such as <strong>auto-executable  
227 -macros</strong>, <strong>suspicious VBA keywords</strong> used by  
228 -malware, anti-sandboxing and anti-virtualization techniques, and  
229 -potential <strong>IOCs</strong> (IP addresses, URLs, executable  
230 -filenames, etc). It also detects and decodes several common  
231 -<strong>obfuscation methods including Hex encoding, StrReverse, Base64,  
232 -Dridex, VBA expressions</strong>, and extracts IOCs from decoded  
233 -strings. XLM/Excel 4 Macros are also supported in Excel and SLK  
234 -files.</p>  
235 -<p>It can be used either as a command-line tool, or as a python module  
236 -from your own applications.</p>  
237 -<p>It is part of the <a  
238 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
239 -package.</p>  
240 -<p>olevba is based on source code from <a  
241 -href="https://github.com/unixfreak0037/officeparser">officeparser</a> by  
242 -John William Davison, with significant modifications.</p> 85 +<p>olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to <strong>detect VBA Macros</strong>, extract their <strong>source code</strong> in clear text, and detect security-related patterns such as <strong>auto-executable macros</strong>, <strong>suspicious VBA keywords</strong> used by malware, anti-sandboxing and anti-virtualization techniques, and potential <strong>IOCs</strong> (IP addresses, URLs, executable filenames, etc). It also detects and decodes several common <strong>obfuscation methods including Hex encoding, StrReverse, Base64, Dridex, VBA expressions</strong>, and extracts IOCs from decoded strings. XLM/Excel 4 Macros are also supported in Excel and SLK files.</p>
  86 +<p>It can be used either as a command-line tool, or as a python module from your own applications.</p>
  87 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  88 +<p>olevba is based on source code from <a href="https://github.com/unixfreak0037/officeparser">officeparser</a> by John William Davison, with significant modifications.</p>
243 <h2 id="supported-formats">Supported formats</h2> 89 <h2 id="supported-formats">Supported formats</h2>
244 <ul> 90 <ul>
245 <li>Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)</li> 91 <li>Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)</li>
@@ -255,50 +101,31 @@ John William Davison, with significant modifications.&lt;/p&gt; @@ -255,50 +101,31 @@ John William Davison, with significant modifications.&lt;/p&gt;
255 </ul> 101 </ul>
256 <p>S## Main Features</p> 102 <p>S## Main Features</p>
257 <ul> 103 <ul>
258 -<li>Detect VBA macros in MS Office 97-2003 and 2007+ files, XML,  
259 -MHT</li> 104 +<li>Detect VBA macros in MS Office 97-2003 and 2007+ files, XML, MHT</li>
260 <li>Extract VBA macro source code</li> 105 <li>Extract VBA macro source code</li>
261 <li>Detect auto-executable macros</li> 106 <li>Detect auto-executable macros</li>
262 <li>Detect suspicious VBA keywords often used by malware</li> 107 <li>Detect suspicious VBA keywords often used by malware</li>
263 <li>Detect anti-sandboxing and anti-virtualization techniques</li> 108 <li>Detect anti-sandboxing and anti-virtualization techniques</li>
264 -<li>Detect and decodes strings obfuscated with  
265 -Hex/Base64/StrReverse/Dridex</li>  
266 -<li>Deobfuscates VBA expressions with any combination of Chr, Asc, Val,  
267 -StrReverse, Environ, +, &amp;, using a VBA parser built with <a  
268 -href="http://pyparsing.wikispaces.com">pyparsing</a>, including custom  
269 -Hex and Base64 encodings</li>  
270 -<li>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail  
271 -addresses and executable file names</li>  
272 -<li>Scan multiple files and sample collections (wildcards,  
273 -recursive)</li> 109 +<li>Detect and decodes strings obfuscated with Hex/Base64/StrReverse/Dridex</li>
  110 +<li>Deobfuscates VBA expressions with any combination of Chr, Asc, Val, StrReverse, Environ, +, &amp;, using a VBA parser built with <a href="http://pyparsing.wikispaces.com">pyparsing</a>, including custom Hex and Base64 encodings</li>
  111 +<li>Extract IOCs/patterns of interest such as IP addresses, URLs, e-mail addresses and executable file names</li>
  112 +<li>Scan multiple files and sample collections (wildcards, recursive)</li>
274 <li>Triage mode for a summary view of multiple files</li> 113 <li>Triage mode for a summary view of multiple files</li>
275 <li>Scan malware samples in password-protected Zip archives</li> 114 <li>Scan malware samples in password-protected Zip archives</li>
276 <li>Python API to use olevba from your applications</li> 115 <li>Python API to use olevba from your applications</li>
277 </ul> 116 </ul>
278 -<p>MS Office files encrypted with a password are also supported, because  
279 -VBA macro code is never encrypted, only the content of the document.</p> 117 +<p>MS Office files encrypted with a password are also supported, because VBA macro code is never encrypted, only the content of the document.</p>
280 <h2 id="about-vba-macros">About VBA Macros</h2> 118 <h2 id="about-vba-macros">About VBA Macros</h2>
281 -<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a>  
282 -for more information and technical details about VBA Macros and how they  
283 -are stored in MS Office documents.</p> 119 +<p>See <a href="http://www.decalage.info/en/vba_tools">this article</a> for more information and technical details about VBA Macros and how they are stored in MS Office documents.</p>
284 <h2 id="how-it-works">How it works</h2> 120 <h2 id="how-it-works">How it works</h2>
285 <ol type="1"> 121 <ol type="1">
286 -<li>olevba checks the file type: If it is an OLE file (i.e MS Office  
287 -97-2003), it is parsed right away.</li>  
288 -<li>If it is a zip file (i.e. MS Office 2007+), XML or MHTML, olevba  
289 -looks for all OLE files stored in it (e.g. vbaProject.bin,  
290 -editdata.mso), and opens them.</li>  
291 -<li>olevba identifies all the VBA projects stored in the OLE  
292 -structure.</li>  
293 -<li>Each VBA project is parsed to find the corresponding OLE streams  
294 -containing macro code.</li>  
295 -<li>In each of these OLE streams, the VBA macro source code is extracted  
296 -and decompressed (RLE compression).</li>  
297 -<li>olevba looks for specific strings obfuscated with various algorithms  
298 -(Hex, Base64, StrReverse, Dridex, VBA expressions).</li>  
299 -<li>olevba scans the macro source code and the deobfuscated strings to  
300 -find suspicious keywords, auto-executable macros and potential IOCs  
301 -(URLs, IP addresses, e-mail addresses, executable filenames, etc).</li> 122 +<li>olevba checks the file type: If it is an OLE file (i.e MS Office 97-2003), it is parsed right away.</li>
  123 +<li>If it is a zip file (i.e. MS Office 2007+), XML or MHTML, olevba looks for all OLE files stored in it (e.g. vbaProject.bin, editdata.mso), and opens them.</li>
  124 +<li>olevba identifies all the VBA projects stored in the OLE structure.</li>
  125 +<li>Each VBA project is parsed to find the corresponding OLE streams containing macro code.</li>
  126 +<li>In each of these OLE streams, the VBA macro source code is extracted and decompressed (RLE compression).</li>
  127 +<li>olevba looks for specific strings obfuscated with various algorithms (Hex, Base64, StrReverse, Dridex, VBA expressions).</li>
  128 +<li>olevba scans the macro source code and the deobfuscated strings to find suspicious keywords, auto-executable macros and potential IOCs (URLs, IP addresses, e-mail addresses, executable filenames, etc).</li>
302 </ol> 129 </ol>
303 <h2 id="usage">Usage</h2> 130 <h2 id="usage">Usage</h2>
304 <pre class="text"><code>Usage: olevba [options] &lt;filename&gt; [filename2 ...] 131 <pre class="text"><code>Usage: olevba [options] &lt;filename&gt; [filename2 ...]
@@ -337,37 +164,28 @@ Options: @@ -337,37 +164,28 @@ Options:
337 -d, --detailed detailed mode, display full results (default for 164 -d, --detailed detailed mode, display full results (default for
338 single file) 165 single file)
339 -j, --json json mode, detailed in json format (never default)</code></pre> 166 -j, --json json mode, detailed in json format (never default)</code></pre>
340 -<p><strong>New in v0.54:</strong> the -p option can now be used to  
341 -decrypt encrypted documents using the provided password(s).</p> 167 +<p><strong>New in v0.54:</strong> the -p option can now be used to decrypt encrypted documents using the provided password(s).</p>
342 <h3 id="examples">Examples</h3> 168 <h3 id="examples">Examples</h3>
343 <p>Scan a single file:</p> 169 <p>Scan a single file:</p>
344 <pre class="text"><code>olevba file.doc</code></pre> 170 <pre class="text"><code>olevba file.doc</code></pre>
345 -<p>Scan a single file, stored in a Zip archive with password  
346 -“infected”:</p> 171 +<p>Scan a single file, stored in a Zip archive with password “infected”:</p>
347 <pre class="text"><code>olevba malicious_file.xls.zip -z infected</code></pre> 172 <pre class="text"><code>olevba malicious_file.xls.zip -z infected</code></pre>
348 <p>Scan a single file, showing all obfuscated strings decoded:</p> 173 <p>Scan a single file, showing all obfuscated strings decoded:</p>
349 <pre class="text"><code>olevba file.doc --decode</code></pre> 174 <pre class="text"><code>olevba file.doc --decode</code></pre>
350 -<p>Scan a single file, showing the macro source code with VBA strings  
351 -deobfuscated:</p> 175 +<p>Scan a single file, showing the macro source code with VBA strings deobfuscated:</p>
352 <pre class="text"><code>olevba file.doc --reveal</code></pre> 176 <pre class="text"><code>olevba file.doc --reveal</code></pre>
353 <p>Scan VBA source code extracted into a text file:</p> 177 <p>Scan VBA source code extracted into a text file:</p>
354 <pre class="text"><code>olevba source_code.vba</code></pre> 178 <pre class="text"><code>olevba source_code.vba</code></pre>
355 <p>Scan a collection of files stored in a folder:</p> 179 <p>Scan a collection of files stored in a folder:</p>
356 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*&quot;</code></pre> 180 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*&quot;</code></pre>
357 -<p>NOTE: On Linux, MacOSX and other Unix variants, it is required to add  
358 -double quotes around wildcards. Otherwise, they will be expanded by the  
359 -shell instead of olevba.</p> 181 +<p>NOTE: On Linux, MacOSX and other Unix variants, it is required to add double quotes around wildcards. Otherwise, they will be expanded by the shell instead of olevba.</p>
360 <p>Scan all .doc and .xls files, recursively in all subfolders:</p> 182 <p>Scan all .doc and .xls files, recursively in all subfolders:</p>
361 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*.doc&quot; &quot;MalwareZoo/VBA/*.xls&quot; -r</code></pre> 183 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*.doc&quot; &quot;MalwareZoo/VBA/*.xls&quot; -r</code></pre>
362 -<p>Scan all .doc files within all .zip files with password,  
363 -recursively:</p> 184 +<p>Scan all .doc files within all .zip files with password, recursively:</p>
364 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*.zip&quot; -r -z infected -f &quot;*.doc&quot;</code></pre> 185 <pre class="text"><code>olevba &quot;MalwareZoo/VBA/*.zip&quot; -r -z infected -f &quot;*.doc&quot;</code></pre>
365 -<h3 id="detailed-analysis-mode-default-for-single-file">Detailed  
366 -analysis mode (default for single file)</h3>  
367 -<p>When a single file is scanned, or when using the option -d, all  
368 -details of the analysis are displayed.</p>  
369 -<p>For example, checking the malware sample <a  
370 -href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p> 186 +<h3 id="detailed-analysis-mode-default-for-single-file">Detailed analysis mode (default for single file)</h3>
  187 +<p>When a single file is scanned, or when using the option -d, all details of the analysis are displayed.</p>
  188 +<p>For example, checking the malware sample <a href="https://malwr.com/analysis/M2I4YWRhM2IwY2QwNDljN2E3ZWFjYTg3ODk4NmZhYmE/">DIAN_caso-5415.doc</a>:</p>
371 <pre class="text"><code>&gt;olevba c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip -z infected 189 <pre class="text"><code>&gt;olevba c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip -z infected
372 =============================================================================== 190 ===============================================================================
373 FILE: DIAN_caso-5415.doc.malware in c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip 191 FILE: DIAN_caso-5415.doc.malware in c:\MalwareZoo\VBA\DIAN_caso-5415.doc.zip
@@ -419,32 +237,23 @@ ANALYSIS: @@ -419,32 +237,23 @@ ANALYSIS:
419 | IOC | test.exe | Executable file name | 237 | IOC | test.exe | Executable file name |
420 | IOC | sfjozjero.exe | Executable file name | 238 | IOC | sfjozjero.exe | Executable file name |
421 +------------+----------------------+-----------------------------------------+</code></pre> 239 +------------+----------------------+-----------------------------------------+</code></pre>
422 -<h3 id="triage-mode-default-for-multiple-files">Triage mode (default for  
423 -multiple files)</h3>  
424 -<p>When several files are scanned, or when using the option -t, a  
425 -summary of the analysis for each file is displayed. This is more  
426 -convenient for quick triage of a collection of suspicious files.</p> 240 +<h3 id="triage-mode-default-for-multiple-files">Triage mode (default for multiple files)</h3>
  241 +<p>When several files are scanned, or when using the option -t, a summary of the analysis for each file is displayed. This is more convenient for quick triage of a collection of suspicious files.</p>
427 <p>The following flags show the results of the analysis:</p> 242 <p>The following flags show the results of the analysis:</p>
428 <ul> 243 <ul>
429 -<li><strong>OLE</strong>: the file type is OLE, for example MS Office  
430 -97-2003</li>  
431 -<li><strong>OpX</strong>: the file type is OpenXML, for example MS  
432 -Office 2007+</li> 244 +<li><strong>OLE</strong>: the file type is OLE, for example MS Office 97-2003</li>
  245 +<li><strong>OpX</strong>: the file type is OpenXML, for example MS Office 2007+</li>
433 <li><strong>XML</strong>: the file type is Word 2003 XML</li> 246 <li><strong>XML</strong>: the file type is Word 2003 XML</li>
434 -<li><strong>MHT</strong>: the file type is Word MHTML, aka Single File  
435 -Web Page (.mht)</li> 247 +<li><strong>MHT</strong>: the file type is Word MHTML, aka Single File Web Page (.mht)</li>
436 <li><strong>?</strong>: the file type is not supported</li> 248 <li><strong>?</strong>: the file type is not supported</li>
437 <li><strong>M</strong>: contains VBA Macros</li> 249 <li><strong>M</strong>: contains VBA Macros</li>
438 <li><strong>A</strong>: auto-executable macros</li> 250 <li><strong>A</strong>: auto-executable macros</li>
439 <li><strong>S</strong>: suspicious VBA keywords</li> 251 <li><strong>S</strong>: suspicious VBA keywords</li>
440 <li><strong>I</strong>: potential IOCs</li> 252 <li><strong>I</strong>: potential IOCs</li>
441 <li><strong>H</strong>: hex-encoded strings (potential obfuscation)</li> 253 <li><strong>H</strong>: hex-encoded strings (potential obfuscation)</li>
442 -<li><strong>B</strong>: Base64-encoded strings (potential  
443 -obfuscation)</li>  
444 -<li><strong>D</strong>: Dridex-encoded strings (potential  
445 -obfuscation)</li>  
446 -<li><strong>V</strong>: VBA string expressions (potential  
447 -obfuscation)</li> 254 +<li><strong>B</strong>: Base64-encoded strings (potential obfuscation)</li>
  255 +<li><strong>D</strong>: Dridex-encoded strings (potential obfuscation)</li>
  256 +<li><strong>V</strong>: VBA string expressions (potential obfuscation)</li>
448 </ul> 257 </ul>
449 <p>Here is an example:</p> 258 <p>Here is an example:</p>
450 <pre class="text"><code>c:\&gt;olevba \MalwareZoo\VBA\samples\* 259 <pre class="text"><code>c:\&gt;olevba \MalwareZoo\VBA\samples\*
@@ -467,253 +276,146 @@ OpX:MASI--- \MalwareZoo\VBA\samples\RottenKitten.xlsb.malware @@ -467,253 +276,146 @@ OpX:MASI--- \MalwareZoo\VBA\samples\RottenKitten.xlsb.malware
467 OLE:MASI-B- \MalwareZoo\VBA\samples\ROVNIX.doc.malware 276 OLE:MASI-B- \MalwareZoo\VBA\samples\ROVNIX.doc.malware
468 OLE:MA----- \MalwareZoo\VBA\samples\Word within Word macro auto.doc</code></pre> 277 OLE:MA----- \MalwareZoo\VBA\samples\Word within Word macro auto.doc</code></pre>
469 <h2 id="python-3-support---olevba3">Python 3 support - olevba3</h2> 278 <h2 id="python-3-support---olevba3">Python 3 support - olevba3</h2>
470 -<p>Since v0.54, olevba is fully compatible with both Python 2 and 3.  
471 -There is no need to use olevba3 anymore, however it is still present for  
472 -backward compatibility.</p> 279 +<p>Since v0.54, olevba is fully compatible with both Python 2 and 3. There is no need to use olevba3 anymore, however it is still present for backward compatibility.</p>
473 <hr /> 280 <hr />
474 -<h2 id="how-to-use-olevba-in-python-applications">How to use olevba in  
475 -Python applications</h2>  
476 -<p>olevba may be used to open a MS Office file, detect if it contains  
477 -VBA macros, extract and analyze the VBA source code from your own python  
478 -applications.</p>  
479 -<p>IMPORTANT: olevba is currently under active development, therefore  
480 -this API is likely to change.</p> 281 +<h2 id="how-to-use-olevba-in-python-applications">How to use olevba in Python applications</h2>
  282 +<p>olevba may be used to open a MS Office file, detect if it contains VBA macros, extract and analyze the VBA source code from your own python applications.</p>
  283 +<p>IMPORTANT: olevba is currently under active development, therefore this API is likely to change.</p>
481 <h3 id="import-olevba">Import olevba</h3> 284 <h3 id="import-olevba">Import olevba</h3>
482 -<p>First, import the <strong>oletools.olevba</strong> package, using at  
483 -least the VBA_Parser and VBA_Scanner classes:</p>  
484 -<div class="sourceCode" id="cb12"><pre  
485 -class="sourceCode python"><code class="sourceCode python"><span id="cb12-1"><a href="#cb12-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> VBA_Parser, TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML, TYPE_MHTML</span></code></pre></div>  
486 -<h3 id="parse-a-ms-office-file---vba_parser">Parse a MS Office file -  
487 -VBA_Parser</h3>  
488 -<p>To parse a file on disk, create an instance of the  
489 -<strong>VBA_Parser</strong> class, providing the name of the file to  
490 -open as parameter. For example:</p>  
491 -<div class="sourceCode" id="cb13"><pre  
492 -class="sourceCode python"><code class="sourceCode python"><span id="cb13-1"><a href="#cb13-1" aria-hidden="true" tabindex="-1"></a>vbaparser <span class="op">=</span> VBA_Parser(<span class="st">&#39;my_file_with_macros.doc&#39;</span>)</span></code></pre></div>  
493 -<p>The file may also be provided as a bytes string containing its data.  
494 -In that case, the actual filename must be provided for reference, and  
495 -the file content with the data parameter. For example:</p>  
496 -<div class="sourceCode" id="cb14"><pre  
497 -class="sourceCode python"><code class="sourceCode python"><span id="cb14-1"><a href="#cb14-1" aria-hidden="true" tabindex="-1"></a>myfile <span class="op">=</span> <span class="st">&#39;my_file_with_macros.doc&#39;</span></span>  
498 -<span id="cb14-2"><a href="#cb14-2" aria-hidden="true" tabindex="-1"></a>filedata <span class="op">=</span> <span class="bu">open</span>(myfile, <span class="st">&#39;rb&#39;</span>).read()</span>  
499 -<span id="cb14-3"><a href="#cb14-3" aria-hidden="true" tabindex="-1"></a>vbaparser <span class="op">=</span> VBA_Parser(myfile, data<span class="op">=</span>filedata)</span></code></pre></div>  
500 -<p>VBA_Parser will raise an exception if the file is not a supported  
501 -format, such as OLE (MS Office 97-2003), OpenXML (MS Office 2007+),  
502 -MHTML or Word 2003 XML.</p>  
503 -<p>After parsing the file, the attribute  
504 -<strong>VBA_Parser.type</strong> is a string indicating the file type.  
505 -It can be either TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML or  
506 -TYPE_MHTML. (constants defined in the olevba module)</p> 285 +<p>First, import the <strong>oletools.olevba</strong> package, using at least the VBA_Parser and VBA_Scanner classes:</p>
  286 +<div class="sourceCode" id="cb12"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb12-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> VBA_Parser, TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML, TYPE_MHTML</a></code></pre></div>
  287 +<h3 id="parse-a-ms-office-file---vba_parser">Parse a MS Office file - VBA_Parser</h3>
  288 +<p>To parse a file on disk, create an instance of the <strong>VBA_Parser</strong> class, providing the name of the file to open as parameter. For example:</p>
  289 +<div class="sourceCode" id="cb13"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb13-1" data-line-number="1">vbaparser <span class="op">=</span> VBA_Parser(<span class="st">&#39;my_file_with_macros.doc&#39;</span>)</a></code></pre></div>
  290 +<p>The file may also be provided as a bytes string containing its data. In that case, the actual filename must be provided for reference, and the file content with the data parameter. For example:</p>
  291 +<div class="sourceCode" id="cb14"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb14-1" data-line-number="1">myfile <span class="op">=</span> <span class="st">&#39;my_file_with_macros.doc&#39;</span></a>
  292 +<a class="sourceLine" id="cb14-2" data-line-number="2">filedata <span class="op">=</span> <span class="bu">open</span>(myfile, <span class="st">&#39;rb&#39;</span>).read()</a>
  293 +<a class="sourceLine" id="cb14-3" data-line-number="3">vbaparser <span class="op">=</span> VBA_Parser(myfile, data<span class="op">=</span>filedata)</a></code></pre></div>
  294 +<p>VBA_Parser will raise an exception if the file is not a supported format, such as OLE (MS Office 97-2003), OpenXML (MS Office 2007+), MHTML or Word 2003 XML.</p>
  295 +<p>After parsing the file, the attribute <strong>VBA_Parser.type</strong> is a string indicating the file type. It can be either TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML or TYPE_MHTML. (constants defined in the olevba module)</p>
507 <h3 id="detect-vba-macros">Detect VBA macros</h3> 296 <h3 id="detect-vba-macros">Detect VBA macros</h3>
508 -<p>The method <strong>detect_vba_macros</strong> of a VBA_Parser object  
509 -returns True if VBA macros have been found in the file, False  
510 -otherwise.</p>  
511 -<div class="sourceCode" id="cb15"><pre  
512 -class="sourceCode python"><code class="sourceCode python"><span id="cb15-1"><a href="#cb15-1" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> vbaparser.detect_vba_macros():</span>  
513 -<span id="cb15-2"><a href="#cb15-2" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;VBA Macros found&#39;</span></span>  
514 -<span id="cb15-3"><a href="#cb15-3" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>  
515 -<span id="cb15-4"><a href="#cb15-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;No VBA Macros found&#39;</span></span></code></pre></div>  
516 -<p>Note: The detection algorithm looks for streams and storage with  
517 -specific names in the OLE structure, which works fine for all the  
518 -supported formats listed above. However, for some formats such as  
519 -PowerPoint 97-2003, this method will always return False because VBA  
520 -Macros are stored in a different way which is not yet supported by  
521 -olevba.</p>  
522 -<p>Moreover, if the file contains an embedded document (e.g. an Excel  
523 -workbook inserted into a Word document), this method may return True if  
524 -the embedded document contains VBA Macros, even if the main document  
525 -does not.</p>  
526 -<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source  
527 -Code</h3>  
528 -<p>The method <strong>extract_macros</strong> extracts and decompresses  
529 -source code for each VBA macro found in the file (possibly including  
530 -embedded files). It is a generator yielding a tuple (filename,  
531 -stream_path, vba_filename, vba_code) for each VBA macro found.</p> 297 +<p>The method <strong>detect_vba_macros</strong> of a VBA_Parser object returns True if VBA macros have been found in the file, False otherwise.</p>
  298 +<div class="sourceCode" id="cb15"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb15-1" data-line-number="1"><span class="cf">if</span> vbaparser.detect_vba_macros():</a>
  299 +<a class="sourceLine" id="cb15-2" data-line-number="2"> <span class="bu">print</span> <span class="st">&#39;VBA Macros found&#39;</span></a>
  300 +<a class="sourceLine" id="cb15-3" data-line-number="3"><span class="cf">else</span>:</a>
  301 +<a class="sourceLine" id="cb15-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;No VBA Macros found&#39;</span></a></code></pre></div>
  302 +<p>Note: The detection algorithm looks for streams and storage with specific names in the OLE structure, which works fine for all the supported formats listed above. However, for some formats such as PowerPoint 97-2003, this method will always return False because VBA Macros are stored in a different way which is not yet supported by olevba.</p>
  303 +<p>Moreover, if the file contains an embedded document (e.g. an Excel workbook inserted into a Word document), this method may return True if the embedded document contains VBA Macros, even if the main document does not.</p>
  304 +<h3 id="extract-vba-macro-source-code">Extract VBA Macro Source Code</h3>
  305 +<p>The method <strong>extract_macros</strong> extracts and decompresses source code for each VBA macro found in the file (possibly including embedded files). It is a generator yielding a tuple (filename, stream_path, vba_filename, vba_code) for each VBA macro found.</p>
532 <ul> 306 <ul>
533 -<li>filename: If the file is OLE (MS Office 97-2003), filename is the  
534 -path of the file. If the file is OpenXML (MS Office 2007+), filename is  
535 -the path of the OLE subfile containing VBA macros within the zip  
536 -archive, e.g. word/vbaProject.bin.</li>  
537 -<li>stream_path: path of the OLE stream containing the VBA macro source  
538 -code</li> 307 +<li>filename: If the file is OLE (MS Office 97-2003), filename is the path of the file. If the file is OpenXML (MS Office 2007+), filename is the path of the OLE subfile containing VBA macros within the zip archive, e.g. word/vbaProject.bin.</li>
  308 +<li>stream_path: path of the OLE stream containing the VBA macro source code</li>
539 <li>vba_filename: corresponding VBA filename</li> 309 <li>vba_filename: corresponding VBA filename</li>
540 <li>vba_code: string containing the VBA source code in clear text</li> 310 <li>vba_code: string containing the VBA source code in clear text</li>
541 </ul> 311 </ul>
542 <p>Example:</p> 312 <p>Example:</p>
543 -<div class="sourceCode" id="cb16"><pre  
544 -class="sourceCode python"><code class="sourceCode python"><span id="cb16-1"><a href="#cb16-1" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> (filename, stream_path, vba_filename, vba_code) <span class="kw">in</span> vbaparser.extract_macros():</span>  
545 -<span id="cb16-2"><a href="#cb16-2" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;-&#39;</span><span class="op">*</span><span class="dv">79</span></span>  
546 -<span id="cb16-3"><a href="#cb16-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Filename :&#39;</span>, filename</span>  
547 -<span id="cb16-4"><a href="#cb16-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;OLE stream :&#39;</span>, stream_path</span>  
548 -<span id="cb16-5"><a href="#cb16-5" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;VBA filename:&#39;</span>, vba_filename</span>  
549 -<span id="cb16-6"><a href="#cb16-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;- &#39;</span><span class="op">*</span><span class="dv">39</span></span>  
550 -<span id="cb16-7"><a href="#cb16-7" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> vba_code</span></code></pre></div>  
551 -<p>Alternatively, the VBA_Parser method  
552 -<strong>extract_all_macros</strong> returns the same results as a list  
553 -of tuples.</p> 313 +<div class="sourceCode" id="cb16"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb16-1" data-line-number="1"><span class="cf">for</span> (filename, stream_path, vba_filename, vba_code) <span class="kw">in</span> vbaparser.extract_macros():</a>
  314 +<a class="sourceLine" id="cb16-2" data-line-number="2"> <span class="bu">print</span> <span class="st">&#39;-&#39;</span><span class="op">*</span><span class="dv">79</span></a>
  315 +<a class="sourceLine" id="cb16-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;Filename :&#39;</span>, filename</a>
  316 +<a class="sourceLine" id="cb16-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;OLE stream :&#39;</span>, stream_path</a>
  317 +<a class="sourceLine" id="cb16-5" data-line-number="5"> <span class="bu">print</span> <span class="st">&#39;VBA filename:&#39;</span>, vba_filename</a>
  318 +<a class="sourceLine" id="cb16-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;- &#39;</span><span class="op">*</span><span class="dv">39</span></a>
  319 +<a class="sourceLine" id="cb16-7" data-line-number="7"> <span class="bu">print</span> vba_code</a></code></pre></div>
  320 +<p>Alternatively, the VBA_Parser method <strong>extract_all_macros</strong> returns the same results as a list of tuples.</p>
554 <h3 id="analyze-vba-source-code">Analyze VBA Source Code</h3> 321 <h3 id="analyze-vba-source-code">Analyze VBA Source Code</h3>
555 -<p>Since version 0.40, the VBA_Parser class provides simpler methods  
556 -than VBA_Scanner to analyze all macros contained in a file:</p>  
557 -<p>The method <strong>analyze_macros</strong> from the class  
558 -<strong>VBA_Parser</strong> can be used to scan the source code of all  
559 -VBA modules to find obfuscated strings, suspicious keywords, IOCs,  
560 -auto-executable macros, etc.</p>  
561 -<p>analyze_macros() takes an optional argument show_decoded_strings: if  
562 -set to True, the results will contain all the encoded strings found in  
563 -the code (Hex, Base64, Dridex) with their decoded value. By default, it  
564 -will only include the strings which contain printable characters.</p>  
565 -<p><strong>VBA_Parser.analyze_macros()</strong> returns a list of tuples  
566 -(type, keyword, description), one for each item in the results.</p> 322 +<p>Since version 0.40, the VBA_Parser class provides simpler methods than VBA_Scanner to analyze all macros contained in a file:</p>
  323 +<p>The method <strong>analyze_macros</strong> from the class <strong>VBA_Parser</strong> can be used to scan the source code of all VBA modules to find obfuscated strings, suspicious keywords, IOCs, auto-executable macros, etc.</p>
  324 +<p>analyze_macros() takes an optional argument show_decoded_strings: if set to True, the results will contain all the encoded strings found in the code (Hex, Base64, Dridex) with their decoded value. By default, it will only include the strings which contain printable characters.</p>
  325 +<p><strong>VBA_Parser.analyze_macros()</strong> returns a list of tuples (type, keyword, description), one for each item in the results.</p>
567 <ul> 326 <ul>
568 -<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’,  
569 -‘Base64 String’, ‘Dridex String’ or ‘VBA obfuscated Strings’.</li>  
570 -<li>keyword is the string found for auto-executable macros, suspicious  
571 -keywords or IOCs. For obfuscated strings, it is the decoded value of the  
572 -string.</li>  
573 -<li>description provides a description of the keyword. For obfuscated  
574 -strings, it is the encoded value of the string.</li> 327 +<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’, ‘Base64 String’, ‘Dridex String’ or ‘VBA obfuscated Strings’.</li>
  328 +<li>keyword is the string found for auto-executable macros, suspicious keywords or IOCs. For obfuscated strings, it is the decoded value of the string.</li>
  329 +<li>description provides a description of the keyword. For obfuscated strings, it is the encoded value of the string.</li>
575 </ul> 330 </ul>
576 <p>Example:</p> 331 <p>Example:</p>
577 -<div class="sourceCode" id="cb17"><pre  
578 -class="sourceCode python"><code class="sourceCode python"><span id="cb17-1"><a href="#cb17-1" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> vbaparser.analyze_macros()</span>  
579 -<span id="cb17-2"><a href="#cb17-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>  
580 -<span id="cb17-3"><a href="#cb17-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>  
581 -<p>After calling analyze_macros, the following VBA_Parser attributes  
582 -also provide the number of items found for each category:</p>  
583 -<div class="sourceCode" id="cb18"><pre  
584 -class="sourceCode python"><code class="sourceCode python"><span id="cb18-1"><a href="#cb18-1" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;AutoExec keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_autoexec</span>  
585 -<span id="cb18-2"><a href="#cb18-2" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Suspicious keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_suspicious</span>  
586 -<span id="cb18-3"><a href="#cb18-3" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;IOCs: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_iocs</span>  
587 -<span id="cb18-4"><a href="#cb18-4" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Hex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_hexstrings</span>  
588 -<span id="cb18-5"><a href="#cb18-5" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Base64 obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_base64strings</span>  
589 -<span id="cb18-6"><a href="#cb18-6" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;Dridex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_dridexstrings</span>  
590 -<span id="cb18-7"><a href="#cb18-7" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> <span class="st">&#39;VBA obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_vbastrings</span></code></pre></div>  
591 -<h3 id="deobfuscate-vba-macro-source-code">Deobfuscate VBA Macro Source  
592 -Code</h3>  
593 -<p>The method <strong>reveal</strong> attempts to deobfuscate the macro  
594 -source code by replacing all the obfuscated strings by their decoded  
595 -content. Returns a single string.</p> 332 +<div class="sourceCode" id="cb17"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb17-1" data-line-number="1">results <span class="op">=</span> vbaparser.analyze_macros()</a>
  333 +<a class="sourceLine" id="cb17-2" data-line-number="2"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
  334 +<a class="sourceLine" id="cb17-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
  335 +<p>After calling analyze_macros, the following VBA_Parser attributes also provide the number of items found for each category:</p>
  336 +<div class="sourceCode" id="cb18"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb18-1" data-line-number="1"><span class="bu">print</span> <span class="st">&#39;AutoExec keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_autoexec</a>
  337 +<a class="sourceLine" id="cb18-2" data-line-number="2"><span class="bu">print</span> <span class="st">&#39;Suspicious keywords: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_suspicious</a>
  338 +<a class="sourceLine" id="cb18-3" data-line-number="3"><span class="bu">print</span> <span class="st">&#39;IOCs: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_iocs</a>
  339 +<a class="sourceLine" id="cb18-4" data-line-number="4"><span class="bu">print</span> <span class="st">&#39;Hex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_hexstrings</a>
  340 +<a class="sourceLine" id="cb18-5" data-line-number="5"><span class="bu">print</span> <span class="st">&#39;Base64 obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_base64strings</a>
  341 +<a class="sourceLine" id="cb18-6" data-line-number="6"><span class="bu">print</span> <span class="st">&#39;Dridex obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_dridexstrings</a>
  342 +<a class="sourceLine" id="cb18-7" data-line-number="7"><span class="bu">print</span> <span class="st">&#39;VBA obfuscated strings: </span><span class="sc">%d</span><span class="st">&#39;</span> <span class="op">%</span> vbaparser.nb_vbastrings</a></code></pre></div>
  343 +<h3 id="deobfuscate-vba-macro-source-code">Deobfuscate VBA Macro Source Code</h3>
  344 +<p>The method <strong>reveal</strong> attempts to deobfuscate the macro source code by replacing all the obfuscated strings by their decoded content. Returns a single string.</p>
596 <p>Example:</p> 345 <p>Example:</p>
597 -<div class="sourceCode" id="cb19"><pre  
598 -class="sourceCode python"><code class="sourceCode python"><span id="cb19-1"><a href="#cb19-1" aria-hidden="true" tabindex="-1"></a><span class="bu">print</span> vbaparser.reveal()</span></code></pre></div> 346 +<div class="sourceCode" id="cb19"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb19-1" data-line-number="1"><span class="bu">print</span> vbaparser.reveal()</a></code></pre></div>
599 <h3 id="close-the-vba_parser">Close the VBA_Parser</h3> 347 <h3 id="close-the-vba_parser">Close the VBA_Parser</h3>
600 -<p>After usage, it is better to call the <strong>close</strong> method  
601 -of the VBA_Parser object, to make sure the file is closed, especially if  
602 -your application is parsing many files.</p>  
603 -<div class="sourceCode" id="cb20"><pre  
604 -class="sourceCode python"><code class="sourceCode python"><span id="cb20-1"><a href="#cb20-1" aria-hidden="true" tabindex="-1"></a>vbaparser.close()</span></code></pre></div> 348 +<p>After usage, it is better to call the <strong>close</strong> method of the VBA_Parser object, to make sure the file is closed, especially if your application is parsing many files.</p>
  349 +<div class="sourceCode" id="cb20"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb20-1" data-line-number="1">vbaparser.close()</a></code></pre></div>
605 <hr /> 350 <hr />
606 <h2 id="deprecated-api">Deprecated API</h2> 351 <h2 id="deprecated-api">Deprecated API</h2>
607 -<p>The following methods and functions are still functional, but their  
608 -usage is not recommended since they have been replaced by better  
609 -solutions.</p> 352 +<p>The following methods and functions are still functional, but their usage is not recommended since they have been replaced by better solutions.</p>
610 <h3 id="vba_scanner-deprecated">VBA_Scanner (deprecated)</h3> 353 <h3 id="vba_scanner-deprecated">VBA_Scanner (deprecated)</h3>
611 -<p>The class <strong>VBA_Scanner</strong> can be used to scan the source  
612 -code of a VBA module to find obfuscated strings, suspicious keywords,  
613 -IOCs, auto-executable macros, etc.</p>  
614 -<p>First, create a VBA_Scanner object with a string containing the VBA  
615 -source code (for example returned by the extract_macros method). Then  
616 -call the methods <strong>scan</strong> or <strong>scan_summary</strong>  
617 -to get the results of the analysis.</p>  
618 -<p>scan() takes an optional argument include_decoded_strings: if set to  
619 -True, the results will contain all the encoded strings found in the code  
620 -(Hex, Base64, Dridex) with their decoded value.</p>  
621 -<p><strong>scan</strong> returns a list of tuples (type, keyword,  
622 -description), one for each item in the results.</p> 354 +<p>The class <strong>VBA_Scanner</strong> can be used to scan the source code of a VBA module to find obfuscated strings, suspicious keywords, IOCs, auto-executable macros, etc.</p>
  355 +<p>First, create a VBA_Scanner object with a string containing the VBA source code (for example returned by the extract_macros method). Then call the methods <strong>scan</strong> or <strong>scan_summary</strong> to get the results of the analysis.</p>
  356 +<p>scan() takes an optional argument include_decoded_strings: if set to True, the results will contain all the encoded strings found in the code (Hex, Base64, Dridex) with their decoded value.</p>
  357 +<p><strong>scan</strong> returns a list of tuples (type, keyword, description), one for each item in the results.</p>
623 <ul> 358 <ul>
624 -<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’,  
625 -‘Base64 String’ or ‘Dridex String’.</li>  
626 -<li>keyword is the string found for auto-executable macros, suspicious  
627 -keywords or IOCs. For obfuscated strings, it is the decoded value of the  
628 -string.</li>  
629 -<li>description provides a description of the keyword. For obfuscated  
630 -strings, it is the encoded value of the string.</li> 359 +<li>type may be either ‘AutoExec’, ‘Suspicious’, ‘IOC’, ‘Hex String’, ‘Base64 String’ or ‘Dridex String’.</li>
  360 +<li>keyword is the string found for auto-executable macros, suspicious keywords or IOCs. For obfuscated strings, it is the decoded value of the string.</li>
  361 +<li>description provides a description of the keyword. For obfuscated strings, it is the encoded value of the string.</li>
631 </ul> 362 </ul>
632 <p>Example:</p> 363 <p>Example:</p>
633 -<div class="sourceCode" id="cb21"><pre  
634 -class="sourceCode python"><code class="sourceCode python"><span id="cb21-1"><a href="#cb21-1" aria-hidden="true" tabindex="-1"></a>vba_scanner <span class="op">=</span> VBA_Scanner(vba_code)</span>  
635 -<span id="cb21-2"><a href="#cb21-2" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> vba_scanner.scan(include_decoded_strings<span class="op">=</span><span class="va">True</span>)</span>  
636 -<span id="cb21-3"><a href="#cb21-3" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>  
637 -<span id="cb21-4"><a href="#cb21-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>  
638 -<p>The function <strong>scan_vba</strong> is a shortcut for  
639 -VBA_Scanner(vba_code).scan():</p>  
640 -<div class="sourceCode" id="cb22"><pre  
641 -class="sourceCode python"><code class="sourceCode python"><span id="cb22-1"><a href="#cb22-1" aria-hidden="true" tabindex="-1"></a>results <span class="op">=</span> scan_vba(vba_code, include_decoded_strings<span class="op">=</span><span class="va">True</span>)</span>  
642 -<span id="cb22-2"><a href="#cb22-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</span>  
643 -<span id="cb22-3"><a href="#cb22-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</span></code></pre></div>  
644 -<p><strong>scan_summary</strong> returns a tuple with the number of  
645 -items found for each category: (autoexec, suspicious, IOCs, hex, base64,  
646 -dridex).</p>  
647 -<h3 id="detect-auto-executable-macros-deprecated">Detect auto-executable  
648 -macros (deprecated)</h3>  
649 -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba  
650 -or VBA_Scanner to get all results at once.</p>  
651 -<p>The function <strong>detect_autoexec</strong> checks if VBA macro  
652 -code contains specific macro names that will be triggered when the  
653 -document/workbook is opened, closed, changed, etc.</p>  
654 -<p>It returns a list of tuples containing two strings, the detected  
655 -keyword, and the description of the trigger. (See the malware example  
656 -above)</p> 364 +<div class="sourceCode" id="cb21"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb21-1" data-line-number="1">vba_scanner <span class="op">=</span> VBA_Scanner(vba_code)</a>
  365 +<a class="sourceLine" id="cb21-2" data-line-number="2">results <span class="op">=</span> vba_scanner.scan(include_decoded_strings<span class="op">=</span><span class="va">True</span>)</a>
  366 +<a class="sourceLine" id="cb21-3" data-line-number="3"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
  367 +<a class="sourceLine" id="cb21-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
  368 +<p>The function <strong>scan_vba</strong> is a shortcut for VBA_Scanner(vba_code).scan():</p>
  369 +<div class="sourceCode" id="cb22"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb22-1" data-line-number="1">results <span class="op">=</span> scan_vba(vba_code, include_decoded_strings<span class="op">=</span><span class="va">True</span>)</a>
  370 +<a class="sourceLine" id="cb22-2" data-line-number="2"><span class="cf">for</span> kw_type, keyword, description <span class="kw">in</span> results:</a>
  371 +<a class="sourceLine" id="cb22-3" data-line-number="3"> <span class="bu">print</span> <span class="st">&#39;type=</span><span class="sc">%s</span><span class="st"> - keyword=</span><span class="sc">%s</span><span class="st"> - description=</span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (kw_type, keyword, description)</a></code></pre></div>
  372 +<p><strong>scan_summary</strong> returns a tuple with the number of items found for each category: (autoexec, suspicious, IOCs, hex, base64, dridex).</p>
  373 +<h3 id="detect-auto-executable-macros-deprecated">Detect auto-executable macros (deprecated)</h3>
  374 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  375 +<p>The function <strong>detect_autoexec</strong> checks if VBA macro code contains specific macro names that will be triggered when the document/workbook is opened, closed, changed, etc.</p>
  376 +<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the trigger. (See the malware example above)</p>
657 <p>Sample usage:</p> 377 <p>Sample usage:</p>
658 -<div class="sourceCode" id="cb23"><pre  
659 -class="sourceCode python"><code class="sourceCode python"><span id="cb23-1"><a href="#cb23-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_autoexec</span>  
660 -<span id="cb23-2"><a href="#cb23-2" aria-hidden="true" tabindex="-1"></a>autoexec_keywords <span class="op">=</span> detect_autoexec(vba_code)</span>  
661 -<span id="cb23-3"><a href="#cb23-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> autoexec_keywords:</span>  
662 -<span id="cb23-4"><a href="#cb23-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords found:&#39;</span></span>  
663 -<span id="cb23-5"><a href="#cb23-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> keyword, description <span class="kw">in</span> autoexec_keywords:</span>  
664 -<span id="cb23-6"><a href="#cb23-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</span>  
665 -<span id="cb23-7"><a href="#cb23-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>  
666 -<span id="cb23-8"><a href="#cb23-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords: None found&#39;</span></span></code></pre></div>  
667 -<h3 id="detect-suspicious-vba-keywords-deprecated">Detect suspicious VBA  
668 -keywords (deprecated)</h3>  
669 -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba  
670 -or VBA_Scanner to get all results at once.</p>  
671 -<p>The function <strong>detect_suspicious</strong> checks if VBA macro  
672 -code contains specific keywords often used by malware to act on the  
673 -system (create files, run commands or applications, write to the  
674 -registry, etc).</p>  
675 -<p>It returns a list of tuples containing two strings, the detected  
676 -keyword, and the description of the corresponding malicious behaviour.  
677 -(See the malware example above)</p> 378 +<div class="sourceCode" id="cb23"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb23-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_autoexec</a>
  379 +<a class="sourceLine" id="cb23-2" data-line-number="2">autoexec_keywords <span class="op">=</span> detect_autoexec(vba_code)</a>
  380 +<a class="sourceLine" id="cb23-3" data-line-number="3"><span class="cf">if</span> autoexec_keywords:</a>
  381 +<a class="sourceLine" id="cb23-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords found:&#39;</span></a>
  382 +<a class="sourceLine" id="cb23-5" data-line-number="5"> <span class="cf">for</span> keyword, description <span class="kw">in</span> autoexec_keywords:</a>
  383 +<a class="sourceLine" id="cb23-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</a>
  384 +<a class="sourceLine" id="cb23-7" data-line-number="7"><span class="cf">else</span>:</a>
  385 +<a class="sourceLine" id="cb23-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Auto-executable macro keywords: None found&#39;</span></a></code></pre></div>
  386 +<h3 id="detect-suspicious-vba-keywords-deprecated">Detect suspicious VBA keywords (deprecated)</h3>
  387 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  388 +<p>The function <strong>detect_suspicious</strong> checks if VBA macro code contains specific keywords often used by malware to act on the system (create files, run commands or applications, write to the registry, etc).</p>
  389 +<p>It returns a list of tuples containing two strings, the detected keyword, and the description of the corresponding malicious behaviour. (See the malware example above)</p>
678 <p>Sample usage:</p> 390 <p>Sample usage:</p>
679 -<div class="sourceCode" id="cb24"><pre  
680 -class="sourceCode python"><code class="sourceCode python"><span id="cb24-1"><a href="#cb24-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_suspicious</span>  
681 -<span id="cb24-2"><a href="#cb24-2" aria-hidden="true" tabindex="-1"></a>suspicious_keywords <span class="op">=</span> detect_suspicious(vba_code)</span>  
682 -<span id="cb24-3"><a href="#cb24-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> suspicious_keywords:</span>  
683 -<span id="cb24-4"><a href="#cb24-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords found:&#39;</span></span>  
684 -<span id="cb24-5"><a href="#cb24-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> keyword, description <span class="kw">in</span> suspicious_keywords:</span>  
685 -<span id="cb24-6"><a href="#cb24-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</span>  
686 -<span id="cb24-7"><a href="#cb24-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>  
687 -<span id="cb24-8"><a href="#cb24-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords: None found&#39;</span></span></code></pre></div>  
688 -<h3 id="extract-potential-iocs-deprecated">Extract potential IOCs  
689 -(deprecated)</h3>  
690 -<p><strong>Deprecated</strong>: It is preferable to use either scan_vba  
691 -or VBA_Scanner to get all results at once.</p>  
692 -<p>The function <strong>detect_patterns</strong> checks if VBA macro  
693 -code contains specific patterns of interest, that may be useful for  
694 -malware analysis and detection (potential Indicators of Compromise): IP  
695 -addresses, e-mail addresses, URLs, executable file names.</p>  
696 -<p>It returns a list of tuples containing two strings, the pattern type,  
697 -and the extracted value. (See the malware example above)</p> 391 +<div class="sourceCode" id="cb24"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb24-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_suspicious</a>
  392 +<a class="sourceLine" id="cb24-2" data-line-number="2">suspicious_keywords <span class="op">=</span> detect_suspicious(vba_code)</a>
  393 +<a class="sourceLine" id="cb24-3" data-line-number="3"><span class="cf">if</span> suspicious_keywords:</a>
  394 +<a class="sourceLine" id="cb24-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords found:&#39;</span></a>
  395 +<a class="sourceLine" id="cb24-5" data-line-number="5"> <span class="cf">for</span> keyword, description <span class="kw">in</span> suspicious_keywords:</a>
  396 +<a class="sourceLine" id="cb24-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (keyword, description)</a>
  397 +<a class="sourceLine" id="cb24-7" data-line-number="7"><span class="cf">else</span>:</a>
  398 +<a class="sourceLine" id="cb24-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Suspicious VBA keywords: None found&#39;</span></a></code></pre></div>
  399 +<h3 id="extract-potential-iocs-deprecated">Extract potential IOCs (deprecated)</h3>
  400 +<p><strong>Deprecated</strong>: It is preferable to use either scan_vba or VBA_Scanner to get all results at once.</p>
  401 +<p>The function <strong>detect_patterns</strong> checks if VBA macro code contains specific patterns of interest, that may be useful for malware analysis and detection (potential Indicators of Compromise): IP addresses, e-mail addresses, URLs, executable file names.</p>
  402 +<p>It returns a list of tuples containing two strings, the pattern type, and the extracted value. (See the malware example above)</p>
698 <p>Sample usage:</p> 403 <p>Sample usage:</p>
699 -<div class="sourceCode" id="cb25"><pre  
700 -class="sourceCode python"><code class="sourceCode python"><span id="cb25-1"><a href="#cb25-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_patterns</span>  
701 -<span id="cb25-2"><a href="#cb25-2" aria-hidden="true" tabindex="-1"></a>patterns <span class="op">=</span> detect_patterns(vba_code)</span>  
702 -<span id="cb25-3"><a href="#cb25-3" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> patterns:</span>  
703 -<span id="cb25-4"><a href="#cb25-4" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Patterns found:&#39;</span></span>  
704 -<span id="cb25-5"><a href="#cb25-5" aria-hidden="true" tabindex="-1"></a> <span class="cf">for</span> pattern_type, value <span class="kw">in</span> patterns:</span>  
705 -<span id="cb25-6"><a href="#cb25-6" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (pattern_type, value)</span>  
706 -<span id="cb25-7"><a href="#cb25-7" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>  
707 -<span id="cb25-8"><a href="#cb25-8" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span> <span class="st">&#39;Patterns: None found&#39;</span></span></code></pre></div> 404 +<div class="sourceCode" id="cb25"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb25-1" data-line-number="1"><span class="im">from</span> oletools.olevba <span class="im">import</span> detect_patterns</a>
  405 +<a class="sourceLine" id="cb25-2" data-line-number="2">patterns <span class="op">=</span> detect_patterns(vba_code)</a>
  406 +<a class="sourceLine" id="cb25-3" data-line-number="3"><span class="cf">if</span> patterns:</a>
  407 +<a class="sourceLine" id="cb25-4" data-line-number="4"> <span class="bu">print</span> <span class="st">&#39;Patterns found:&#39;</span></a>
  408 +<a class="sourceLine" id="cb25-5" data-line-number="5"> <span class="cf">for</span> pattern_type, value <span class="kw">in</span> patterns:</a>
  409 +<a class="sourceLine" id="cb25-6" data-line-number="6"> <span class="bu">print</span> <span class="st">&#39;</span><span class="sc">%s</span><span class="st">: </span><span class="sc">%s</span><span class="st">&#39;</span> <span class="op">%</span> (pattern_type, value)</a>
  410 +<a class="sourceLine" id="cb25-7" data-line-number="7"><span class="cf">else</span>:</a>
  411 +<a class="sourceLine" id="cb25-8" data-line-number="8"> <span class="bu">print</span> <span class="st">&#39;Patterns: None found&#39;</span></a></code></pre></div>
708 <hr /> 412 <hr />
709 -<h2 id="python-oletools-documentation">python-oletools  
710 -documentation</h2> 413 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
711 <ul> 414 <ul>
712 <li><a href="Home.html">Home</a></li> 415 <li><a href="Home.html">Home</a></li>
713 <li><a href="License.html">License</a></li> 416 <li><a href="License.html">License</a></li>
714 <li><a href="Install.html">Install</a></li> 417 <li><a href="Install.html">Install</a></li>
715 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
716 -Report Issues</li> 418 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
717 <li>Tools: 419 <li>Tools:
718 <ul> 420 <ul>
719 <li><a href="mraptor.html">mraptor</a></li> 421 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/pyxswf.html
  View file @ab9a043
@@ -4,177 +4,25 @@ @@ -4,177 +4,25 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
156 </style> 13 </style>
  14 + <!--[if lt IE 9]>
  15 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  16 + <![endif]-->
157 </head> 17 </head>
158 <body> 18 <body>
159 <h1 id="pyxswf">pyxswf</h1> 19 <h1 id="pyxswf">pyxswf</h1>
160 -<p>pyxswf is a script to detect, extract and analyze Flash objects (SWF  
161 -files) that may be embedded in files such as MS Office documents  
162 -(e.g. Word, Excel), which is especially useful for malware analysis.</p>  
163 -<p>It is part of the <a  
164 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
165 -package.</p>  
166 -<p>pyxswf is an extension to <a  
167 -href="http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html">xxxswf.py</a>  
168 -published by Alexander Hanel.</p>  
169 -<p>Compared to xxxswf, it can extract streams from MS Office documents  
170 -by parsing their OLE structure properly, which is necessary when streams  
171 -are fragmented. Stream fragmentation is a known obfuscation technique,  
172 -as explained on <a  
173 -href="http://web.archive.org/web/20121118021207/http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/">http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/</a></p>  
174 -<p>It can also extract Flash objects from RTF documents, by parsing  
175 -embedded objects encoded in hexadecimal format (-f option).</p>  
176 -<p>For this, simply add the -o option to work on OLE streams rather than  
177 -raw files, or the -f option to work on RTF files.</p> 20 +<p>pyxswf is a script to detect, extract and analyze Flash objects (SWF files) that may be embedded in files such as MS Office documents (e.g. Word, Excel), which is especially useful for malware analysis.</p>
  21 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
  22 +<p>pyxswf is an extension to <a href="http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html">xxxswf.py</a> published by Alexander Hanel.</p>
  23 +<p>Compared to xxxswf, it can extract streams from MS Office documents by parsing their OLE structure properly, which is necessary when streams are fragmented. Stream fragmentation is a known obfuscation technique, as explained on <a href="http://web.archive.org/web/20121118021207/http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/">http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/</a></p>
  24 +<p>It can also extract Flash objects from RTF documents, by parsing embedded objects encoded in hexadecimal format (-f option).</p>
  25 +<p>For this, simply add the -o option to work on OLE streams rather than raw files, or the -f option to work on RTF files.</p>
178 <h2 id="usage">Usage</h2> 26 <h2 id="usage">Usage</h2>
179 <pre class="text"><code>Usage: pyxswf [options] &lt;file.bad&gt; 27 <pre class="text"><code>Usage: pyxswf [options] &lt;file.bad&gt;
180 28
@@ -197,10 +45,7 @@ Options: @@ -197,10 +45,7 @@ Options:
197 Will recursively scan a directory for files that 45 Will recursively scan a directory for files that
198 contain SWFs. Must provide path in quotes 46 contain SWFs. Must provide path in quotes
199 -c, --compress Compresses the SWF using Zlib</code></pre> 47 -c, --compress Compresses the SWF using Zlib</code></pre>
200 -<h3  
201 -id="example-1---detecting-and-extracting-a-swf-file-from-a-word-document-on-windows">Example  
202 -1 - detecting and extracting a SWF file from a Word document on  
203 -Windows:</h3> 48 +<h3 id="example-1---detecting-and-extracting-a-swf-file-from-a-word-document-on-windows">Example 1 - detecting and extracting a SWF file from a Word document on Windows:</h3>
204 <pre class="text"><code>C:\oletools&gt;pyxswf -o word_flash.doc 49 <pre class="text"><code>C:\oletools&gt;pyxswf -o word_flash.doc
205 OLE stream: &#39;Contents&#39; 50 OLE stream: &#39;Contents&#39;
206 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents 51 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
@@ -211,28 +56,22 @@ OLE stream: &amp;#39;Contents&amp;#39; @@ -211,28 +56,22 @@ OLE stream: &amp;#39;Contents&amp;#39;
211 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents 56 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
212 [ADDR] SWF 1 at 0x8 - FWS Header 57 [ADDR] SWF 1 at 0x8 - FWS Header
213 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre> 58 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>
214 -<h3  
215 -id="example-2---detecting-and-extracting-a-swf-file-from-a-rtf-document-on-windows">Example  
216 -2 - detecting and extracting a SWF file from a RTF document on  
217 -Windows:</h3> 59 +<h3 id="example-2---detecting-and-extracting-a-swf-file-from-a-rtf-document-on-windows">Example 2 - detecting and extracting a SWF file from a RTF document on Windows:</h3>
218 <pre class="text"><code>C:\oletools&gt;pyxswf -xf &quot;rtf_flash.rtf&quot; 60 <pre class="text"><code>C:\oletools&gt;pyxswf -xf &quot;rtf_flash.rtf&quot;
219 RTF embedded object size 1498557 at index 000036DD 61 RTF embedded object size 1498557 at index 000036DD
220 [SUMMARY] 1 SWF(s) in MD5:46a110548007e04f4043785ac4184558:RTF_embedded_object_0 62 [SUMMARY] 1 SWF(s) in MD5:46a110548007e04f4043785ac4184558:RTF_embedded_object_0
221 00036DD 63 00036DD
222 [ADDR] SWF 1 at 0xc40 - FWS Header 64 [ADDR] SWF 1 at 0xc40 - FWS Header
223 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre> 65 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf</code></pre>
224 -<h2 id="how-to-use-pyxswf-in-python-applications">How to use pyxswf in  
225 -Python applications</h2> 66 +<h2 id="how-to-use-pyxswf-in-python-applications">How to use pyxswf in Python applications</h2>
226 <p>TODO</p> 67 <p>TODO</p>
227 <hr /> 68 <hr />
228 -<h2 id="python-oletools-documentation">python-oletools  
229 -documentation</h2> 69 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
230 <ul> 70 <ul>
231 <li><a href="Home.html">Home</a></li> 71 <li><a href="Home.html">Home</a></li>
232 <li><a href="License.html">License</a></li> 72 <li><a href="License.html">License</a></li>
233 <li><a href="Install.html">Install</a></li> 73 <li><a href="Install.html">Install</a></li>
234 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
235 -Report Issues</li> 74 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
236 <li>Tools: 75 <li>Tools:
237 <ul> 76 <ul>
238 <li><a href="mraptor.html">mraptor</a></li> 77 <li><a href="mraptor.html">mraptor</a></li>
oletools/doc/rtfobj.html
  View file @ab9a043
@@ -4,234 +4,88 @@ @@ -4,234 +4,88 @@
4 <meta charset="utf-8" /> 4 <meta charset="utf-8" />
5 <meta name="generator" content="pandoc" /> 5 <meta name="generator" content="pandoc" />
6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
7 - <title>-</title>  
8 - <style>  
9 - html {  
10 - line-height: 1.5;  
11 - font-family: Georgia, serif;  
12 - font-size: 20px;  
13 - color: #1a1a1a;  
14 - background-color: #fdfdfd;  
15 - }  
16 - body {  
17 - margin: 0 auto;  
18 - max-width: 36em;  
19 - padding-left: 50px;  
20 - padding-right: 50px;  
21 - padding-top: 50px;  
22 - padding-bottom: 50px;  
23 - hyphens: auto;  
24 - overflow-wrap: break-word;  
25 - text-rendering: optimizeLegibility;  
26 - font-kerning: normal;  
27 - }  
28 - @media (max-width: 600px) {  
29 - body {  
30 - font-size: 0.9em;  
31 - padding: 1em;  
32 - }  
33 - h1 {  
34 - font-size: 1.8em;  
35 - }  
36 - }  
37 - @media print {  
38 - body {  
39 - background-color: transparent;  
40 - color: black;  
41 - font-size: 12pt;  
42 - }  
43 - p, h2, h3 {  
44 - orphans: 3;  
45 - widows: 3;  
46 - }  
47 - h2, h3, h4 {  
48 - page-break-after: avoid;  
49 - }  
50 - }  
51 - p {  
52 - margin: 1em 0;  
53 - }  
54 - a {  
55 - color: #1a1a1a;  
56 - }  
57 - a:visited {  
58 - color: #1a1a1a;  
59 - }  
60 - img {  
61 - max-width: 100%;  
62 - }  
63 - h1, h2, h3, h4, h5, h6 {  
64 - margin-top: 1.4em;  
65 - }  
66 - h5, h6 {  
67 - font-size: 1em;  
68 - font-style: italic;  
69 - }  
70 - h6 {  
71 - font-weight: normal;  
72 - }  
73 - ol, ul {  
74 - padding-left: 1.7em;  
75 - margin-top: 1em;  
76 - }  
77 - li > ol, li > ul {  
78 - margin-top: 0;  
79 - }  
80 - blockquote {  
81 - margin: 1em 0 1em 1.7em;  
82 - padding-left: 1em;  
83 - border-left: 2px solid #e6e6e6;  
84 - color: #606060;  
85 - }  
86 - code {  
87 - font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;  
88 - font-size: 85%;  
89 - margin: 0;  
90 - }  
91 - pre {  
92 - margin: 1em 0;  
93 - overflow: auto;  
94 - }  
95 - pre code {  
96 - padding: 0;  
97 - overflow: visible;  
98 - overflow-wrap: normal;  
99 - }  
100 - .sourceCode {  
101 - background-color: transparent;  
102 - overflow: visible;  
103 - }  
104 - hr {  
105 - background-color: #1a1a1a;  
106 - border: none;  
107 - height: 1px;  
108 - margin: 1em 0;  
109 - }  
110 - table {  
111 - margin: 1em 0;  
112 - border-collapse: collapse;  
113 - width: 100%;  
114 - overflow-x: auto;  
115 - display: block;  
116 - font-variant-numeric: lining-nums tabular-nums;  
117 - }  
118 - table caption {  
119 - margin-bottom: 0.75em;  
120 - }  
121 - tbody {  
122 - margin-top: 0.5em;  
123 - border-top: 1px solid #1a1a1a;  
124 - border-bottom: 1px solid #1a1a1a;  
125 - }  
126 - th {  
127 - border-top: 1px solid #1a1a1a;  
128 - padding: 0.25em 0.5em 0.25em 0.5em;  
129 - }  
130 - td {  
131 - padding: 0.125em 0.5em 0.25em 0.5em;  
132 - }  
133 - header {  
134 - margin-bottom: 4em;  
135 - text-align: center;  
136 - }  
137 - #TOC li {  
138 - list-style: none;  
139 - }  
140 - #TOC ul {  
141 - padding-left: 1.3em;  
142 - }  
143 - #TOC > ul {  
144 - padding-left: 0;  
145 - }  
146 - #TOC a:not(:hover) {  
147 - text-decoration: none;  
148 - }  
149 - code{white-space: pre-wrap;}  
150 - span.smallcaps{font-variant: small-caps;}  
151 - span.underline{text-decoration: underline;}  
152 - div.column{display: inline-block; vertical-align: top; width: 50%;}  
153 - div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}  
154 - ul.task-list{list-style: none;}  
155 - pre > code.sourceCode { white-space: pre; position: relative; }  
156 - pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }  
157 - pre > code.sourceCode > span:empty { height: 1.2em; }  
158 - .sourceCode { overflow: visible; }  
159 - code.sourceCode > span { color: inherit; text-decoration: inherit; }  
160 - div.sourceCode { margin: 1em 0; }  
161 - pre.sourceCode { margin: 0; }  
162 - @media screen {  
163 - div.sourceCode { overflow: auto; }  
164 - }  
165 - @media print {  
166 - pre > code.sourceCode { white-space: pre-wrap; }  
167 - pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }  
168 - }  
169 - pre.numberSource code  
170 - { counter-reset: source-line 0; }  
171 - pre.numberSource code > span  
172 - { position: relative; left: -4em; counter-increment: source-line; }  
173 - pre.numberSource code > span > a:first-child::before  
174 - { content: counter(source-line);  
175 - position: relative; left: -1em; text-align: right; vertical-align: baseline;  
176 - border: none; display: inline-block;  
177 - -webkit-touch-callout: none; -webkit-user-select: none;  
178 - -khtml-user-select: none; -moz-user-select: none;  
179 - -ms-user-select: none; user-select: none;  
180 - padding: 0 4px; width: 4em;  
181 - color: #aaaaaa;  
182 - }  
183 - pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }  
184 - div.sourceCode  
185 - { }  
186 - @media screen {  
187 - pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }  
188 - }  
189 - code span.al { color: #ff0000; font-weight: bold; } /* Alert */  
190 - code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */  
191 - code span.at { color: #7d9029; } /* Attribute */  
192 - code span.bn { color: #40a070; } /* BaseN */  
193 - code span.bu { color: #008000; } /* BuiltIn */  
194 - code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */  
195 - code span.ch { color: #4070a0; } /* Char */  
196 - code span.cn { color: #880000; } /* Constant */  
197 - code span.co { color: #60a0b0; font-style: italic; } /* Comment */  
198 - code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */  
199 - code span.do { color: #ba2121; font-style: italic; } /* Documentation */  
200 - code span.dt { color: #902000; } /* DataType */  
201 - code span.dv { color: #40a070; } /* DecVal */  
202 - code span.er { color: #ff0000; font-weight: bold; } /* Error */  
203 - code span.ex { } /* Extension */  
204 - code span.fl { color: #40a070; } /* Float */  
205 - code span.fu { color: #06287e; } /* Function */  
206 - code span.im { color: #008000; font-weight: bold; } /* Import */  
207 - code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */  
208 - code span.kw { color: #007020; font-weight: bold; } /* Keyword */  
209 - code span.op { color: #666666; } /* Operator */  
210 - code span.ot { color: #007020; } /* Other */  
211 - code span.pp { color: #bc7a00; } /* Preprocessor */  
212 - code span.sc { color: #4070a0; } /* SpecialChar */  
213 - code span.ss { color: #bb6688; } /* SpecialString */  
214 - code span.st { color: #4070a0; } /* String */  
215 - code span.va { color: #19177c; } /* Variable */  
216 - code span.vs { color: #4070a0; } /* VerbatimString */  
217 - code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */  
218 - .display.math{display: block; text-align: center; margin: 0.5rem auto;} 7 + <title>Untitled</title>
  8 + <style type="text/css">
  9 + code{white-space: pre-wrap;}
  10 + span.smallcaps{font-variant: small-caps;}
  11 + span.underline{text-decoration: underline;}
  12 + div.column{display: inline-block; vertical-align: top; width: 50%;}
219 </style> 13 </style>
  14 + <style type="text/css">
  15 +a.sourceLine { display: inline-block; line-height: 1.25; }
  16 +a.sourceLine { pointer-events: none; color: inherit; text-decoration: inherit; }
  17 +a.sourceLine:empty { height: 1.2em; position: absolute; }
  18 +.sourceCode { overflow: visible; }
  19 +code.sourceCode { white-space: pre; position: relative; }
  20 +div.sourceCode { margin: 1em 0; }
  21 +pre.sourceCode { margin: 0; }
  22 +@media screen {
  23 +div.sourceCode { overflow: auto; }
  24 +}
  25 +@media print {
  26 +code.sourceCode { white-space: pre-wrap; }
  27 +a.sourceLine { text-indent: -1em; padding-left: 1em; }
  28 +}
  29 +pre.numberSource a.sourceLine
  30 + { position: relative; }
  31 +pre.numberSource a.sourceLine:empty
  32 + { position: absolute; }
  33 +pre.numberSource a.sourceLine::before
  34 + { content: attr(data-line-number);
  35 + position: absolute; left: -5em; text-align: right; vertical-align: baseline;
  36 + border: none; pointer-events: all;
  37 + -webkit-touch-callout: none; -webkit-user-select: none;
  38 + -khtml-user-select: none; -moz-user-select: none;
  39 + -ms-user-select: none; user-select: none;
  40 + padding: 0 4px; width: 4em;
  41 + color: #aaaaaa;
  42 + }
  43 +pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
  44 +div.sourceCode
  45 + { }
  46 +@media screen {
  47 +a.sourceLine::before { text-decoration: underline; }
  48 +}
  49 +code span.al { color: #ff0000; font-weight: bold; } /* Alert */
  50 +code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
  51 +code span.at { color: #7d9029; } /* Attribute */
  52 +code span.bn { color: #40a070; } /* BaseN */
  53 +code span.bu { } /* BuiltIn */
  54 +code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
  55 +code span.ch { color: #4070a0; } /* Char */
  56 +code span.cn { color: #880000; } /* Constant */
  57 +code span.co { color: #60a0b0; font-style: italic; } /* Comment */
  58 +code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
  59 +code span.do { color: #ba2121; font-style: italic; } /* Documentation */
  60 +code span.dt { color: #902000; } /* DataType */
  61 +code span.dv { color: #40a070; } /* DecVal */
  62 +code span.er { color: #ff0000; font-weight: bold; } /* Error */
  63 +code span.ex { } /* Extension */
  64 +code span.fl { color: #40a070; } /* Float */
  65 +code span.fu { color: #06287e; } /* Function */
  66 +code span.im { } /* Import */
  67 +code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
  68 +code span.kw { color: #007020; font-weight: bold; } /* Keyword */
  69 +code span.op { color: #666666; } /* Operator */
  70 +code span.ot { color: #007020; } /* Other */
  71 +code span.pp { color: #bc7a00; } /* Preprocessor */
  72 +code span.sc { color: #4070a0; } /* SpecialChar */
  73 +code span.ss { color: #bb6688; } /* SpecialString */
  74 +code span.st { color: #4070a0; } /* String */
  75 +code span.va { color: #19177c; } /* Variable */
  76 +code span.vs { color: #4070a0; } /* VerbatimString */
  77 +code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
  78 + </style>
  79 + <!--[if lt IE 9]>
  80 + <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
  81 + <![endif]-->
220 </head> 82 </head>
221 <body> 83 <body>
222 <h1 id="rtfobj">rtfobj</h1> 84 <h1 id="rtfobj">rtfobj</h1>
223 -<p>rtfobj is a Python module to detect and extract embedded objects  
224 -stored in RTF files, such as OLE objects. It can also detect OLE Package  
225 -objects, and extract the embedded files.</p>  
226 -<p>Since v0.50, rtfobj contains a custom RTF parser that has been  
227 -designed to match MS Word’s behaviour, in order to handle obfuscated RTF  
228 -files. See my article <a  
229 -href="http://decalage.info/rtf_tricks">“Anti-Analysis Tricks in  
230 -Weaponized RTF”</a> for some concrete examples.</p> 85 +<p>rtfobj is a Python module to detect and extract embedded objects stored in RTF files, such as OLE objects. It can also detect OLE Package objects, and extract the embedded files.</p>
  86 +<p>Since v0.50, rtfobj contains a custom RTF parser that has been designed to match MS Word’s behaviour, in order to handle obfuscated RTF files. See my article <a href="http://decalage.info/rtf_tricks">“Anti-Analysis Tricks in Weaponized RTF”</a> for some concrete examples.</p>
231 <p>rtfobj can be used as a Python library or a command-line tool.</p> 87 <p>rtfobj can be used as a Python library or a command-line tool.</p>
232 -<p>It is part of the <a  
233 -href="http://www.decalage.info/python/oletools">python-oletools</a>  
234 -package.</p> 88 +<p>It is part of the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package.</p>
235 <h2 id="usage">Usage</h2> 89 <h2 id="usage">Usage</h2>
236 <pre class="text"><code>rtfobj [options] &lt;filename&gt; [filename2 ...] 90 <pre class="text"><code>rtfobj [options] &lt;filename&gt; [filename2 ...]
237 91
@@ -253,41 +107,28 @@ Options: @@ -253,41 +107,28 @@ Options:
253 to a file, for example &quot;-s 2&quot;. Use &quot;-s all&quot; to save 107 to a file, for example &quot;-s 2&quot;. Use &quot;-s all&quot; to save
254 all objects at once. 108 all objects at once.
255 -d OUTPUT_DIR use specified directory to save output files.</code></pre> 109 -d OUTPUT_DIR use specified directory to save output files.</code></pre>
256 -<p>rtfobj displays a list of the OLE and Package objects that have been  
257 -detected, with their attributes such as class and filename.</p>  
258 -<p>When an OLE Package object contains an executable file or script, it  
259 -is highlighted as such. For example:</p> 110 +<p>rtfobj displays a list of the OLE and Package objects that have been detected, with their attributes such as class and filename.</p>
  111 +<p>When an OLE Package object contains an executable file or script, it is highlighted as such. For example:</p>
260 <p><img src="rtfobj1.png" /></p> 112 <p><img src="rtfobj1.png" /></p>
261 -<p>To extract an object or file, use the option -s followed by the  
262 -object number as shown in the table.</p> 113 +<p>To extract an object or file, use the option -s followed by the object number as shown in the table.</p>
263 <p>Example:</p> 114 <p>Example:</p>
264 <pre class="text"><code>rtfobj -s 0</code></pre> 115 <pre class="text"><code>rtfobj -s 0</code></pre>
265 -<p>It extracts and decodes the corresponding object, and saves it as a  
266 -file named “object_xxxx.bin”, xxxx being the location of the object in  
267 -the RTF file.</p>  
268 -<h2 id="how-to-use-rtfobj-in-python-applications">How to use rtfobj in  
269 -Python applications</h2>  
270 -<p>As of v0.50, the API has changed significantly and it is not final  
271 -yet. For now, see the class RtfObjectParser in the code.</p>  
272 -<h3 id="deprecated-api-still-functional">Deprecated API (still  
273 -functional):</h3>  
274 -<p>rtf_iter_objects(filename) is an iterator which yields a tuple  
275 -(index, orig_len, object) providing the index of each hexadecimal stream  
276 -in the RTF file, and the corresponding decoded object.</p> 116 +<p>It extracts and decodes the corresponding object, and saves it as a file named “object_xxxx.bin”, xxxx being the location of the object in the RTF file.</p>
  117 +<h2 id="how-to-use-rtfobj-in-python-applications">How to use rtfobj in Python applications</h2>
  118 +<p>As of v0.50, the API has changed significantly and it is not final yet. For now, see the class RtfObjectParser in the code.</p>
  119 +<h3 id="deprecated-api-still-functional">Deprecated API (still functional):</h3>
  120 +<p>rtf_iter_objects(filename) is an iterator which yields a tuple (index, orig_len, object) providing the index of each hexadecimal stream in the RTF file, and the corresponding decoded object.</p>
277 <p>Example:</p> 121 <p>Example:</p>
278 -<div class="sourceCode" id="cb3"><pre  
279 -class="sourceCode python"><code class="sourceCode python"><span id="cb3-1"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="im">from</span> oletools <span class="im">import</span> rtfobj</span>  
280 -<span id="cb3-2"><a href="#cb3-2" aria-hidden="true" tabindex="-1"></a><span class="cf">for</span> index, orig_len, data <span class="kw">in</span> rtfobj.rtf_iter_objects(<span class="st">&quot;myfile.rtf&quot;</span>):</span>  
281 -<span id="cb3-3"><a href="#cb3-3" aria-hidden="true" tabindex="-1"></a> <span class="bu">print</span>(<span class="st">&#39;found object size </span><span class="sc">%d</span><span class="st"> at index </span><span class="sc">%08X</span><span class="st">&#39;</span> <span class="op">%</span> (<span class="bu">len</span>(data), index))</span></code></pre></div> 122 +<div class="sourceCode" id="cb3"><pre class="sourceCode python"><code class="sourceCode python"><a class="sourceLine" id="cb3-1" data-line-number="1"><span class="im">from</span> oletools <span class="im">import</span> rtfobj</a>
  123 +<a class="sourceLine" id="cb3-2" data-line-number="2"><span class="cf">for</span> index, orig_len, data <span class="kw">in</span> rtfobj.rtf_iter_objects(<span class="st">&quot;myfile.rtf&quot;</span>):</a>
  124 +<a class="sourceLine" id="cb3-3" data-line-number="3"> <span class="bu">print</span>(<span class="st">&#39;found object size </span><span class="sc">%d</span><span class="st"> at index </span><span class="sc">%08X</span><span class="st">&#39;</span> <span class="op">%</span> (<span class="bu">len</span>(data), index))</a></code></pre></div>
282 <hr /> 125 <hr />
283 -<h2 id="python-oletools-documentation">python-oletools  
284 -documentation</h2> 126 +<h2 id="python-oletools-documentation">python-oletools documentation</h2>
285 <ul> 127 <ul>
286 <li><a href="Home.html">Home</a></li> 128 <li><a href="Home.html">Home</a></li>
287 <li><a href="License.html">License</a></li> 129 <li><a href="License.html">License</a></li>
288 <li><a href="Install.html">Install</a></li> 130 <li><a href="Install.html">Install</a></li>
289 -<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or  
290 -Report Issues</li> 131 +<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
291 <li>Tools: 132 <li>Tools:
292 <ul> 133 <ul>
293 <li><a href="mraptor.html">mraptor</a></li> 134 <li><a href="mraptor.html">mraptor</a></li>
oletools/olevba.py
  View file @ab9a043
@@ -32,7 +32,7 @@ https://github.com/unixfreak0037/officeparser @@ -32,7 +32,7 @@ https://github.com/unixfreak0037/officeparser
32 32
33 # === LICENSE ================================================================== 33 # === LICENSE ==================================================================
34 34
35 -# olevba is copyright (c) 2014-2024 Philippe Lagadec (http://www.decalage.info) 35 +# olevba is copyright (c) 2014-2025 Philippe Lagadec (http://www.decalage.info)
36 # All rights reserved. 36 # All rights reserved.
37 # 37 #
38 # Redistribution and use in source and binary forms, with or without modification, 38 # Redistribution and use in source and binary forms, with or without modification,
@@ -236,7 +236,7 @@ from __future__ import print_function @@ -236,7 +236,7 @@ from __future__ import print_function
236 # 2021-04-14 PL: - added detection of Workbook_BeforeClose (issue #518) 236 # 2021-04-14 PL: - added detection of Workbook_BeforeClose (issue #518)
237 # 2021-11-09 KJ: - added PROJECTCOMPATVERSION Record on dir Stream 237 # 2021-11-09 KJ: - added PROJECTCOMPATVERSION Record on dir Stream
238 238
239 -__version__ = '0.60.2' 239 +__version__ = '0.60.3'
240 240
241 #------------------------------------------------------------------------------ 241 #------------------------------------------------------------------------------
242 # TODO: 242 # TODO:
@@ -4112,7 +4112,6 @@ class VBA_Parser_CLI(VBA_Parser): @@ -4112,7 +4112,6 @@ class VBA_Parser_CLI(VBA_Parser):
4112 for kw_type, keyword, description in results: 4112 for kw_type, keyword, description in results:
4113 color_type = COLOR_TYPE.get(kw_type, None) 4113 color_type = COLOR_TYPE.get(kw_type, None)
4114 if color_type: 4114 if color_type:
4115 -  
4116 # Prevent malicious actors from performing anti-analysis by replacing 4115 # Prevent malicious actors from performing anti-analysis by replacing
4117 # character 27 (ESC) with \e. 4116 # character 27 (ESC) with \e.
4118 # See more: https://www.youtube.com/watch?v=3T2Al3jdY38 4117 # See more: https://www.youtube.com/watch?v=3T2Al3jdY38
setup.py
  View file @ab9a043
@@ -55,7 +55,7 @@ import os, fnmatch @@ -55,7 +55,7 @@ import os, fnmatch
55 #--- METADATA ----------------------------------------------------------------- 55 #--- METADATA -----------------------------------------------------------------
56 56
57 name = "oletools" 57 name = "oletools"
58 -version = '0.60.2' 58 +version = '0.60.3'
59 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR" 59 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
60 long_desc = open('oletools/README.rst').read() 60 long_desc = open('oletools/README.rst').read()
61 author = "Philippe Lagadec" 61 author = "Philippe Lagadec"