Peter M. Groen / oletools

Commit e44b04a2ab97c7eb8ad840828f193908bed907cb

Authored by Christian Herdtweck
1 parent c896d126

ftguess: Add a few PowerPoint formats

Inline Side-by-side
Showing 1 changed file with 69 additions and 0 deletions
oletools/ftguess.py
  View file @e44b04a
... ... @@ -166,6 +166,12 @@ class FTYPE(object):
166 166 EXCEL2007_XLTM = 'Excel2007_XLTM'
167 167 EXCEL2007_XLSB = 'Excel2007_XLSB'
168 168 EXCEL2007_XLAM = 'Excel2007_XLAM'
  169 + POWERPOINT97 = 'Powerpoint97'
  170 + POWERPOINT2007 = 'Powerpoint2007'
  171 + POWERPOINT2007_PPTX = 'Powerpoint2007_PPTX'
  172 + POWERPOINT2007_PPSX = 'Powerpoint2007_PPSX'
  173 + POWERPOINT2007_PPTM = 'Powerpoint2007_PPTM'
  174 + POWERPOINT2007_PPSM = 'Powerpoint2007_PPSM'
169 175 # TODO: XLSB, DOCM, PPTM, PPSX, PPSM, ...
170 176 XPS = 'XPS'
171 177 RTF = 'RTF'
... ... @@ -582,6 +588,54 @@ class FType_Excel2007_Addin_Macro(FType_Excel2007):
582 588 longname = 'MS Excel 2007+ Macro-Enabled Add-in (.xlam)'
583 589 extensions = ['xlam']
584 590  
  591 +# --- POWERPOINT Formats ---
  592 +
  593 +class FType_Powerpoint(FType_Base):
  594 + '''Base class for all MS Powerpoint file types'''
  595 + application = APP.MSPOWERPOINT
  596 + name = 'MS Powerpoint (generic)'
  597 + longname = 'MS Powerpoint Presentation/Slideshow/Template/Addin/... (generic)'
  598 +
  599 +class FType_Powerpoint97(FType_Powerpoint, FType_Generic_OLE):
  600 + # see also: ppt_record_parser.is_ppt
  601 + filetype = FTYPE.POWERPOINT97
  602 + name = 'MS Powerpoint 97 Presentation'
  603 + longname = 'MS Powerpoint 97-2003 Presentation/Slideshow/Template'
  604 + CLSIDS = ('64818D10-4F9B-11CF-86EA-00AA00B929E8',)
  605 + extensions = ['ppt', 'pps', 'pot']
  606 +
  607 +class FType_Powerpoint2007(FType_Powerpoint, FType_Generic_OpenXML):
  608 + '''Base class for all MS Powerpoint 2007 file types'''
  609 + filetype = FTYPE.POWERPOINT2007
  610 + name = 'MS Powerpoint 2007+ (generic)'
  611 + longname = 'MS Powerpoint 2007+ Presentation/Slideshow/Template (generic)'
  612 + content_types = ('application/vnd.openxmlformats-officedocument.presentationml.presentation',)
  613 +
  614 +class FType_Powerpoint2007_Presentation(FType_Powerpoint2007):
  615 + filetype = FTYPE.POWERPOINT2007_PPTX
  616 + name = 'MSPointpoint 2007+ Presentation'
  617 + longname = 'MSPointpoint 2007+ Presentation (.pptx)'
  618 + extensions = ['pptx']
  619 +
  620 +class FType_Powerpoint2007_Slideshow(FType_Powerpoint2007):
  621 + filetype = FTYPE.POWERPOINT2007_PPSX
  622 + name = 'MSPointpoint 2007+ Slideshow'
  623 + longname = 'MSPointpoint 2007+ Slideshow (.ppsx)'
  624 + extensions = ['ppsx']
  625 +
  626 +class FType_Powerpoint2007_Macro(FType_Powerpoint2007):
  627 + filetype = FTYPE.POWERPOINT2007_PPTM
  628 + name = 'MSPointpoint 2007+ Macro-Enabled Presentation'
  629 + longname = 'MSPointpoint 2007+ Macro-Enabled Presentation (.pptm)'
  630 + extensions = ['pptm']
  631 +
  632 +class FType_Powerpoint2007_Slideshow_Macro(FType_Powerpoint2007):
  633 + filetype = FTYPE.POWERPOINT2007_PPSM
  634 + name = 'MSPointpoint 2007+ Macro-Enabled Slideshow'
  635 + longname = 'MSPointpoint 2007+ Macro-Enabled Slideshow (.ppsm)'
  636 + extensions = ['ppsm']
  637 +
  638 +
585 639 class FType_XPS(FType_Generic_OpenXML):
586 640 application = APP.WINDOWS
587 641 filetype = FTYPE.XPS
... ... @@ -595,12 +649,15 @@ class FType_XPS(FType_Generic_OpenXML):
595 649  
596 650 clsid_ftypes = {
597 651 # mapping from CLSID of root storage to FType classes:
  652 + # TODO: do not repeat magic numbers, import from oletools.common.clsid
598 653 # WORD
599 654 '00020906-0000-0000-C000-000000000046': FType_Word97,
600 655 '00020900-0000-0000-C000-000000000046': FType_Word6,
601 656 # EXCEL
602 657 '00020820-0000-0000-C000-000000000046': FType_Excel97,
603 658 '00020810-0000-0000-C000-000000000046': FType_Excel5,
  659 + # POWERPOINT
  660 + '64818D10-4F9B-11CF-86EA-00AA00B929E8': FType_Powerpoint97,
604 661 }
605 662  
606 663 openxml_ftypes = {
... ... @@ -617,6 +674,11 @@ openxml_ftypes = {
617 674 'application/vnd.openxmlformats-officedocument.spreadsheetml.template.main+xml': FType_Excel2007_Template,
618 675 'application/vnd.ms-excel.template.macroEnabled.main+xml': FType_Excel2007_Template_Macro,
619 676 'application/vnd.ms-excel.addin.macroEnabled.main+xml': FType_Excel2007_Addin_Macro,
  677 + # POWERPOINT
  678 + 'application/vnd.openxmlformats-officedocument.presentationml.presentation.main+xml': FType_Powerpoint2007_Presentation,
  679 + 'application/vnd.openxmlformats-officedocument.presentationml.slideshow.main+xml': FType_Powerpoint2007_Slideshow,
  680 + 'application/vnd.ms-powerpoint.presentation.macroEnabled.main+xml': FType_Powerpoint2007_Macro,
  681 + 'application/vnd.ms-powerpoint.slideshow.macroEnabled.main+xml': FType_Powerpoint2007_Slideshow_Macro,
620 682 # XPS
621 683 'application/vnd.ms-package.xps-fixeddocumentsequence+xml': FType_XPS,
622 684 }
... ... @@ -750,6 +812,13 @@ class FileTypeGuesser(object):
750 812 """
751 813 return issubclass(self.ftype, FType_Excel)
752 814  
  815 + def is_powerpoint(self):
  816 + """
  817 + Shortcut to check if a file is Powerpoint file of any kind
  818 + :return: bool
  819 + """
  820 + return issubclass(self.ftype, FType_Powerpoint)
  821 +
753 822  
754 823 # === FUNCTIONS ==============================================================
755 824  
... ...