Commit efa4ad19de34c315df4bf35531b9d535e95db08a

Authored by decalage2
1 parent a0475490

olevba: removed support for Python 2.6

oletools/olevba.py
@@ -28,7 +28,7 @@ https://github.com/unixfreak0037/officeparser @@ -28,7 +28,7 @@ https://github.com/unixfreak0037/officeparser
28 28
29 # === LICENSE ================================================================== 29 # === LICENSE ==================================================================
30 30
31 -# olevba is copyright (c) 2014-2018 Philippe Lagadec (http://www.decalage.info) 31 +# olevba is copyright (c) 2014-2019 Philippe Lagadec (http://www.decalage.info)
32 # All rights reserved. 32 # All rights reserved.
33 # 33 #
34 # Redistribution and use in source and binary forms, with or without modification, 34 # Redistribution and use in source and binary forms, with or without modification,
@@ -212,8 +212,9 @@ from __future__ import print_function @@ -212,8 +212,9 @@ from __future__ import print_function
212 # 2018-10-25 CH: - detect encryption and raise error if detected 212 # 2018-10-25 CH: - detect encryption and raise error if detected
213 # 2018-12-03 PL: - uses tablestream (+colors) instead of prettytable 213 # 2018-12-03 PL: - uses tablestream (+colors) instead of prettytable
214 # 2018-12-06 PL: - colorize the suspicious keywords found in VBA code 214 # 2018-12-06 PL: - colorize the suspicious keywords found in VBA code
  215 +# 2019-01-01 PL: - removed support for Python 2.6
215 216
216 -__version__ = '0.54dev6' 217 +__version__ = '0.54dev7'
217 218
218 #------------------------------------------------------------------------------ 219 #------------------------------------------------------------------------------
219 # TODO: 220 # TODO:
@@ -327,19 +328,11 @@ if sys.version_info[0] <= 2: @@ -327,19 +328,11 @@ if sys.version_info[0] <= 2:
327 # to use ord on bytes/bytearray items the same way in Python 2+3 328 # to use ord on bytes/bytearray items the same way in Python 2+3
328 # on Python 2, just use the normal ord() because items are bytes 329 # on Python 2, just use the normal ord() because items are bytes
329 byte_ord = ord 330 byte_ord = ord
330 - if sys.version_info[1] <= 6:  
331 - # Python 2.6  
332 - # use is_zipfile backported from Python 2.7:  
333 - from thirdparty.zipfile27 import is_zipfile  
334 - else:  
335 - # Python 2.7  
336 - from zipfile import is_zipfile  
337 else: 331 else:
338 # Python 3.x+ 332 # Python 3.x+
339 # to use ord on bytes/bytearray items the same way in Python 2+3 333 # to use ord on bytes/bytearray items the same way in Python 2+3
340 # on Python 3, items are int, so just return the item 334 # on Python 3, items are int, so just return the item
341 byte_ord = lambda x: x 335 byte_ord = lambda x: x
342 - from zipfile import is_zipfile  
343 # xrange is now called range: 336 # xrange is now called range:
344 xrange = range 337 xrange = range
345 # unichr does not exist anymore, only chr: 338 # unichr does not exist anymore, only chr:
@@ -2533,7 +2526,7 @@ class VBA_Parser(object): @@ -2533,7 +2526,7 @@ class VBA_Parser(object):
2533 2526
2534 # if this worked, try whether it is a ppt file (special ole file) 2527 # if this worked, try whether it is a ppt file (special ole file)
2535 self.open_ppt() 2528 self.open_ppt()
2536 - if self.type is None and is_zipfile(_file): 2529 + if self.type is None and zipfile.is_zipfile(_file):
2537 # Zip file, which may be an OpenXML document 2530 # Zip file, which may be an OpenXML document
2538 self.open_openxml(_file) 2531 self.open_openxml(_file)
2539 if self.type is None: 2532 if self.type is None:
oletools/thirdparty/zipfile27/LICENSE.txt deleted
1 -Python 2.7 license  
2 -  
3 -This is the official license for the Python 2.7 release:  
4 -  
5 -A. HISTORY OF THE SOFTWARE  
6 -==========================  
7 -  
8 -Python was created in the early 1990s by Guido van Rossum at Stichting  
9 -Mathematisch Centrum (CWI, see http://www.cwi.nl) in the Netherlands  
10 -as a successor of a language called ABC. Guido remains Python's  
11 -principal author, although it includes many contributions from others.  
12 -  
13 -In 1995, Guido continued his work on Python at the Corporation for  
14 -National Research Initiatives (CNRI, see http://www.cnri.reston.va.us)  
15 -in Reston, Virginia where he released several versions of the  
16 -software.  
17 -  
18 -In May 2000, Guido and the Python core development team moved to  
19 -BeOpen.com to form the BeOpen PythonLabs team. In October of the same  
20 -year, the PythonLabs team moved to Digital Creations (now Zope  
21 -Corporation, see http://www.zope.com). In 2001, the Python Software  
22 -Foundation (PSF, see http://www.python.org/psf/) was formed, a  
23 -non-profit organization created specifically to own Python-related  
24 -Intellectual Property. Zope Corporation is a sponsoring member of  
25 -the PSF.  
26 -  
27 -All Python releases are Open Source (see http://www.opensource.org for  
28 -the Open Source Definition). Historically, most, but not all, Python  
29 -releases have also been GPL-compatible; the table below summarizes  
30 -the various releases.  
31 -  
32 - Release Derived Year Owner GPL-  
33 - from compatible? (1)  
34 -  
35 - 0.9.0 thru 1.2 1991-1995 CWI yes  
36 - 1.3 thru 1.5.2 1.2 1995-1999 CNRI yes  
37 - 1.6 1.5.2 2000 CNRI no  
38 - 2.0 1.6 2000 BeOpen.com no  
39 - 1.6.1 1.6 2001 CNRI yes (2)  
40 - 2.1 2.0+1.6.1 2001 PSF no  
41 - 2.0.1 2.0+1.6.1 2001 PSF yes  
42 - 2.1.1 2.1+2.0.1 2001 PSF yes  
43 - 2.2 2.1.1 2001 PSF yes  
44 - 2.1.2 2.1.1 2002 PSF yes  
45 - 2.1.3 2.1.2 2002 PSF yes  
46 - 2.2.1 2.2 2002 PSF yes  
47 - 2.2.2 2.2.1 2002 PSF yes  
48 - 2.2.3 2.2.2 2003 PSF yes  
49 - 2.3 2.2.2 2002-2003 PSF yes  
50 - 2.3.1 2.3 2002-2003 PSF yes  
51 - 2.3.2 2.3.1 2002-2003 PSF yes  
52 - 2.3.3 2.3.2 2002-2003 PSF yes  
53 - 2.3.4 2.3.3 2004 PSF yes  
54 - 2.3.5 2.3.4 2005 PSF yes  
55 - 2.4 2.3 2004 PSF yes  
56 - 2.4.1 2.4 2005 PSF yes  
57 - 2.4.2 2.4.1 2005 PSF yes  
58 - 2.4.3 2.4.2 2006 PSF yes  
59 - 2.5 2.4 2006 PSF yes  
60 - 2.7 2.6 2010 PSF yes  
61 -  
62 -Footnotes:  
63 -  
64 -(1) GPL-compatible doesn't mean that we're distributing Python under  
65 - the GPL. All Python licenses, unlike the GPL, let you distribute  
66 - a modified version without making your changes open source. The  
67 - GPL-compatible licenses make it possible to combine Python with  
68 - other software that is released under the GPL; the others don't.  
69 -  
70 -(2) According to Richard Stallman, 1.6.1 is not GPL-compatible,  
71 - because its license has a choice of law clause. According to  
72 - CNRI, however, Stallman's lawyer has told CNRI's lawyer that 1.6.1  
73 - is "not incompatible" with the GPL.  
74 -  
75 -Thanks to the many outside volunteers who have worked under Guido's  
76 -direction to make these releases possible.  
77 -  
78 -  
79 -B. TERMS AND CONDITIONS FOR ACCESSING OR OTHERWISE USING PYTHON  
80 -===============================================================  
81 -  
82 -PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2  
83 ---------------------------------------------  
84 -  
85 -1. This LICENSE AGREEMENT is between the Python Software Foundation  
86 -("PSF"), and the Individual or Organization ("Licensee") accessing and  
87 -otherwise using this software ("Python") in source or binary form and  
88 -its associated documentation.  
89 -  
90 -2. Subject to the terms and conditions of this License Agreement, PSF  
91 -hereby grants Licensee a nonexclusive, royalty-free, world-wide  
92 -license to reproduce, analyze, test, perform and/or display publicly,  
93 -prepare derivative works, distribute, and otherwise use Python  
94 -alone or in any derivative version, provided, however, that PSF's  
95 -License Agreement and PSF's notice of copyright, i.e., "Copyright (c)  
96 -2001, 2002, 2003, 2004, 2005, 2006 Python Software Foundation; All Rights  
97 -Reserved" are retained in Python alone or in any derivative version  
98 -prepared by Licensee.  
99 -  
100 -3. In the event Licensee prepares a derivative work that is based on  
101 -or incorporates Python or any part thereof, and wants to make  
102 -the derivative work available to others as provided herein, then  
103 -Licensee hereby agrees to include in any such work a brief summary of  
104 -the changes made to Python.  
105 -  
106 -4. PSF is making Python available to Licensee on an "AS IS"  
107 -basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR  
108 -IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND  
109 -DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS  
110 -FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT  
111 -INFRINGE ANY THIRD PARTY RIGHTS.  
112 -  
113 -5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON  
114 -FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS  
115 -A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,  
116 -OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.  
117 -  
118 -6. This License Agreement will automatically terminate upon a material  
119 -breach of its terms and conditions.  
120 -  
121 -7. Nothing in this License Agreement shall be deemed to create any  
122 -relationship of agency, partnership, or joint venture between PSF and  
123 -Licensee. This License Agreement does not grant permission to use PSF  
124 -trademarks or trade name in a trademark sense to endorse or promote  
125 -products or services of Licensee, or any third party.  
126 -  
127 -8. By copying, installing or otherwise using Python, Licensee  
128 -agrees to be bound by the terms and conditions of this License  
129 -Agreement.  
130 -  
131 -  
132 -BEOPEN.COM LICENSE AGREEMENT FOR PYTHON 2.0  
133 --------------------------------------------  
134 -  
135 -BEOPEN PYTHON OPEN SOURCE LICENSE AGREEMENT VERSION 1  
136 -  
137 -1. This LICENSE AGREEMENT is between BeOpen.com ("BeOpen"), having an  
138 -office at 160 Saratoga Avenue, Santa Clara, CA 95051, and the  
139 -Individual or Organization ("Licensee") accessing and otherwise using  
140 -this software in source or binary form and its associated  
141 -documentation ("the Software").  
142 -  
143 -2. Subject to the terms and conditions of this BeOpen Python License  
144 -Agreement, BeOpen hereby grants Licensee a non-exclusive,  
145 -royalty-free, world-wide license to reproduce, analyze, test, perform  
146 -and/or display publicly, prepare derivative works, distribute, and  
147 -otherwise use the Software alone or in any derivative version,  
148 -provided, however, that the BeOpen Python License is retained in the  
149 -Software, alone or in any derivative version prepared by Licensee.  
150 -  
151 -3. BeOpen is making the Software available to Licensee on an "AS IS"  
152 -basis. BEOPEN MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR  
153 -IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, BEOPEN MAKES NO AND  
154 -DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS  
155 -FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF THE SOFTWARE WILL NOT  
156 -INFRINGE ANY THIRD PARTY RIGHTS.  
157 -  
158 -4. BEOPEN SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF THE  
159 -SOFTWARE FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS  
160 -AS A RESULT OF USING, MODIFYING OR DISTRIBUTING THE SOFTWARE, OR ANY  
161 -DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.  
162 -  
163 -5. This License Agreement will automatically terminate upon a material  
164 -breach of its terms and conditions.  
165 -  
166 -6. This License Agreement shall be governed by and interpreted in all  
167 -respects by the law of the State of California, excluding conflict of  
168 -law provisions. Nothing in this License Agreement shall be deemed to  
169 -create any relationship of agency, partnership, or joint venture  
170 -between BeOpen and Licensee. This License Agreement does not grant  
171 -permission to use BeOpen trademarks or trade names in a trademark  
172 -sense to endorse or promote products or services of Licensee, or any  
173 -third party. As an exception, the "BeOpen Python" logos available at  
174 -http://www.pythonlabs.com/logos.html may be used according to the  
175 -permissions granted on that web page.  
176 -  
177 -7. By copying, installing or otherwise using the software, Licensee  
178 -agrees to be bound by the terms and conditions of this License  
179 -Agreement.  
180 -  
181 -  
182 -CNRI LICENSE AGREEMENT FOR PYTHON 1.6.1  
183 ----------------------------------------  
184 -  
185 -1. This LICENSE AGREEMENT is between the Corporation for National  
186 -Research Initiatives, having an office at 1895 Preston White Drive,  
187 -Reston, VA 20191 ("CNRI"), and the Individual or Organization  
188 -("Licensee") accessing and otherwise using Python 1.6.1 software in  
189 -source or binary form and its associated documentation.  
190 -  
191 -2. Subject to the terms and conditions of this License Agreement, CNRI  
192 -hereby grants Licensee a nonexclusive, royalty-free, world-wide  
193 -license to reproduce, analyze, test, perform and/or display publicly,  
194 -prepare derivative works, distribute, and otherwise use Python 1.6.1  
195 -alone or in any derivative version, provided, however, that CNRI's  
196 -License Agreement and CNRI's notice of copyright, i.e., "Copyright (c)  
197 -1995-2001 Corporation for National Research Initiatives; All Rights  
198 -Reserved" are retained in Python 1.6.1 alone or in any derivative  
199 -version prepared by Licensee. Alternately, in lieu of CNRI's License  
200 -Agreement, Licensee may substitute the following text (omitting the  
201 -quotes): "Python 1.6.1 is made available subject to the terms and  
202 -conditions in CNRI's License Agreement. This Agreement together with  
203 -Python 1.6.1 may be located on the Internet using the following  
204 -unique, persistent identifier (known as a handle): 1895.22/1013. This  
205 -Agreement may also be obtained from a proxy server on the Internet  
206 -using the following URL: http://hdl.handle.net/1895.22/1013".  
207 -  
208 -3. In the event Licensee prepares a derivative work that is based on  
209 -or incorporates Python 1.6.1 or any part thereof, and wants to make  
210 -the derivative work available to others as provided herein, then  
211 -Licensee hereby agrees to include in any such work a brief summary of  
212 -the changes made to Python 1.6.1.  
213 -  
214 -4. CNRI is making Python 1.6.1 available to Licensee on an "AS IS"  
215 -basis. CNRI MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR  
216 -IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, CNRI MAKES NO AND  
217 -DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS  
218 -FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 1.6.1 WILL NOT  
219 -INFRINGE ANY THIRD PARTY RIGHTS.  
220 -  
221 -5. CNRI SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON  
222 -1.6.1 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS  
223 -A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON 1.6.1,  
224 -OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.  
225 -  
226 -6. This License Agreement will automatically terminate upon a material  
227 -breach of its terms and conditions.  
228 -  
229 -7. This License Agreement shall be governed by the federal  
230 -intellectual property law of the United States, including without  
231 -limitation the federal copyright law, and, to the extent such  
232 -U.S. federal law does not apply, by the law of the Commonwealth of  
233 -Virginia, excluding Virginia's conflict of law provisions.  
234 -Notwithstanding the foregoing, with regard to derivative works based  
235 -on Python 1.6.1 that incorporate non-separable material that was  
236 -previously distributed under the GNU General Public License (GPL), the  
237 -law of the Commonwealth of Virginia shall govern this License  
238 -Agreement only as to issues arising under or with respect to  
239 -Paragraphs 4, 5, and 7 of this License Agreement. Nothing in this  
240 -License Agreement shall be deemed to create any relationship of  
241 -agency, partnership, or joint venture between CNRI and Licensee. This  
242 -License Agreement does not grant permission to use CNRI trademarks or  
243 -trade name in a trademark sense to endorse or promote products or  
244 -services of Licensee, or any third party.  
245 -  
246 -8. By clicking on the "ACCEPT" button where indicated, or by copying,  
247 -installing or otherwise using Python 1.6.1, Licensee agrees to be  
248 -bound by the terms and conditions of this License Agreement.  
249 -  
250 - ACCEPT  
251 -  
252 -  
253 -CWI LICENSE AGREEMENT FOR PYTHON 0.9.0 THROUGH 1.2  
254 ---------------------------------------------------  
255 -  
256 -Copyright (c) 1991 - 1995, Stichting Mathematisch Centrum Amsterdam,  
257 -The Netherlands. All rights reserved.  
258 -  
259 -Permission to use, copy, modify, and distribute this software and its  
260 -documentation for any purpose and without fee is hereby granted,  
261 -provided that the above copyright notice appear in all copies and that  
262 -both that copyright notice and this permission notice appear in  
263 -supporting documentation, and that the name of Stichting Mathematisch  
264 -Centrum or CWI not be used in advertising or publicity pertaining to  
265 -distribution of the software without specific, written prior  
266 -permission.  
267 -  
268 -STICHTING MATHEMATISCH CENTRUM DISCLAIMS ALL WARRANTIES WITH REGARD TO  
269 -THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND  
270 -FITNESS, IN NO EVENT SHALL STICHTING MATHEMATISCH CENTRUM BE LIABLE  
271 -FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES  
272 -WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN  
273 -ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT  
274 -OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.  
275 -  
oletools/thirdparty/zipfile27/__init__.py deleted
1 -# Excerpt from the zipfile module from Python 2.7, to enable is_zipfile  
2 -# to check any file object (e.g. in memory), for Python 2.6.  
3 -# is_zipfile in Python 2.6 can only check files on disk.  
4 -  
5 -# This code from Python 2.7 was not modified.  
6 -  
7 -# 2016-09-06 v0.01 PL: - first version  
8 -  
9 -  
10 -from zipfile import _EndRecData  
11 -  
12 -def _check_zipfile(fp):  
13 - try:  
14 - if _EndRecData(fp):  
15 - return True # file has correct magic number  
16 - except IOError:  
17 - pass  
18 - return False  
19 -  
20 -def is_zipfile(filename):  
21 - """Quickly see if a file is a ZIP file by checking the magic number.  
22 -  
23 - The filename argument may be a file or file-like object too.  
24 - """  
25 - result = False  
26 - try:  
27 - if hasattr(filename, "read"):  
28 - result = _check_zipfile(fp=filename)  
29 - else:  
30 - with open(filename, "rb") as fp:  
31 - result = _check_zipfile(fp)  
32 - except IOError:  
33 - pass  
34 - return result  
35 -  
setup.py
@@ -47,7 +47,7 @@ import os, fnmatch @@ -47,7 +47,7 @@ import os, fnmatch
47 #--- METADATA ----------------------------------------------------------------- 47 #--- METADATA -----------------------------------------------------------------
48 48
49 name = "oletools" 49 name = "oletools"
50 -version = '0.54dev6' 50 +version = '0.54dev7'
51 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR" 51 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
52 long_desc = open('oletools/README.rst').read() 52 long_desc = open('oletools/README.rst').read()
53 author = "Philippe Lagadec" 53 author = "Philippe Lagadec"
@@ -89,7 +89,6 @@ packages=[ @@ -89,7 +89,6 @@ packages=[
89 'oletools.thirdparty.xglob', 89 'oletools.thirdparty.xglob',
90 'oletools.thirdparty.DridexUrlDecoder', 90 'oletools.thirdparty.DridexUrlDecoder',
91 'oletools.thirdparty.tablestream', 91 'oletools.thirdparty.tablestream',
92 - 'oletools.thirdparty.zipfile27',  
93 ] 92 ]
94 ##setupdir = '.' 93 ##setupdir = '.'
95 ##package_dir={'': setupdir} 94 ##package_dir={'': setupdir}
@@ -177,9 +176,6 @@ package_data={ @@ -177,9 +176,6 @@ package_data={
177 'oletools.thirdparty.DridexUrlDecoder': [ 176 'oletools.thirdparty.DridexUrlDecoder': [
178 'LICENSE.txt', 177 'LICENSE.txt',
179 ], 178 ],
180 - 'oletools.thirdparty.zipfile27': [  
181 - 'LICENSE.txt',  
182 - ],  
183 # 'oletools.thirdparty.tablestream': [ 179 # 'oletools.thirdparty.tablestream': [
184 # 'LICENSE', 'README', 180 # 'LICENSE', 'README',
185 # ], 181 # ],