Peter M. Groen / oletools

Commit f2cbbbaea5e8a809360ab338bd54ae281e4fd54f

Authored by decalage2
1 parent aafef852

doc update for 0.60.1

Inline Side-by-side
Showing 6 changed files with 146 additions and 19 deletions
oletools/README.html
  View file @f2cbbba
@@ -23,6 +23,51 @@ @@ -23,6 +23,51 @@
23 <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p> 23 <p>Note: python-oletools is not related to OLETools published by BeCubed Software.</p>
24 <h2 id="news">News</h2> 24 <h2 id="news">News</h2>
25 <ul> 25 <ul>
  26 +<li><strong>2022-05-09 v0.60.1</strong>:
  27 +<ul>
  28 +<li>olevba:
  29 +<ul>
  30 +<li>fixed a bug when calling XLMMacroDeobfuscator (PR #737)</li>
  31 +<li>removed keyword &quot;sample&quot; causing false positives</li>
  32 +</ul></li>
  33 +<li>oleid: fixed OleID init issue (issue #695, PR #696)</li>
  34 +<li>oleobj:
  35 +<ul>
  36 +<li>added simple detection of CVE-2021-40444 initial stage</li>
  37 +<li>added detection for customUI onLoad</li>
  38 +<li>improved handling of incorrect filenames in OLE package (PR #451)</li>
  39 +</ul></li>
  40 +<li>rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue #692)</li>
  41 +<li>ftguess:
  42 +<ul>
  43 +<li>added PowerPoint and XPS formats (PR #716)</li>
  44 +<li>fixed issue with XPS and malformed documents (issue #711)</li>
  45 +<li>added XLSB format (issue #758)</li>
  46 +</ul></li>
  47 +<li>improved logging with common module log_helper (PR #449)</li>
  48 +</ul></li>
  49 +<li><strong>2021-06-02 v0.60</strong>:
  50 +<ul>
  51 +<li>ftguess: new tool to identify file formats and containers (issue #680)</li>
  52 +<li>oleid: (issue #679)
  53 +<ul>
  54 +<li>each indicator now has a risk level</li>
  55 +<li>calls ftguess to identify file formats<br />
  56 +</li>
  57 +<li>calls olevba+mraptor to detect and analyse VBA+XLM macros</li>
  58 +</ul></li>
  59 +<li>olevba:
  60 +<ul>
  61 +<li>when XLMMacroDeobfuscator is available, use it to extract and deobfuscate XLM macros</li>
  62 +</ul></li>
  63 +<li>rtfobj:
  64 +<ul>
  65 +<li>use ftguess to identify file type of OLE Package (issue #682)</li>
  66 +<li>fixed bug in re_executable_extensions</li>
  67 +</ul></li>
  68 +<li>crypto: added PowerPoint transparent password '/01Hannes Ruescher/01' (issue #627)</li>
  69 +<li>setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional dependencies</li>
  70 +</ul></li>
26 <li><strong>2021-05-07 v0.56.2</strong>: 71 <li><strong>2021-05-07 v0.56.2</strong>:
27 <ul> 72 <ul>
28 <li>olevba: 73 <li>olevba:
@@ -130,14 +175,15 @@ @@ -130,14 +175,15 @@
130 <li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li> 175 <li><a href="https://github.com/decalage2/oletools/wiki/olemap">olemap</a>: to display a map of all the sectors in an OLE file.</li>
131 </ul> 176 </ul>
132 <h2 id="projects-using-oletools">Projects using oletools:</h2> 177 <h2 id="projects-using-oletools">Projects using oletools:</h2>
133 -<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365 Email</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p> 178 +<p>oletools are used by a number of projects and online malware analysis services, including <a href="https://github.com/IntegralDefense/ACE">ACE</a>, <a href="https://sandbox.anlyz.io/">Anlyz.io</a>, <a href="https://www.cse-cst.gc.ca/en/assemblyline">AssemblyLine</a>, <a href="https://github.com/ctxis/CAPE">CAPE</a>, <a href="https://cincan.io">CinCan</a>, <a href="https://github.com/cuckoosandbox/cuckoo">Cuckoo Sandbox</a>, <a href="https://github.com/cryps1s/DARKSURGEON">DARKSURGEON</a>, <a href="https://sandbox.deepviz.com/">Deepviz</a>, <a href="https://diario.elevenpaths.com/">DIARIO</a>, <a href="https://dridex.malwareconfig.com">dridex.malwareconfig.com</a>, <a href="https://github.com/ninoseki/eml_analyzer">EML Analyzer</a>, <a href="https://certsocietegenerale.github.io/fame/">FAME</a>, <a href="https://github.com/fireeye/flare-vm">FLARE-VM</a>, <a href="https://www.hybrid-analysis.com/">Hybrid-analysis.com</a>, <a href="https://github.com/certego/IntelOwl">IntelOwl</a>, <a href="https://www.document-analyzer.net/">Joe Sandbox</a>, <a href="https://github.com/lmco/laikaboss">Laika BOSS</a>, <a href="https://github.com/sbidy/MacroMilter">MacroMilter</a>, <a href="https://mailcow.email/">mailcow</a>, <a href="https://malshare.io">malshare.io</a>, <a href="https://github.com/Tigzy/malware-repo">malware-repo</a>, <a href="https://www.adlice.com/download/mrf/">Malware Repository Framework (MRF)</a>, <a href="https://bazaar.abuse.ch/">MalwareBazaar</a>, <a href="https://github.com/HeinleinSupport/olefy">olefy</a>, <a href="https://github.com/pandora-analysis/pandora">Pandora</a>, <a href="https://github.com/scVENUS/PeekabooAV">PeekabooAV</a>, <a href="https://github.com/bontchev/pcodedmp">pcodedmp</a>, <a href="https://github.com/CIRCL/PyCIRCLean">PyCIRCLean</a>, <a href="https://remnux.org/">REMnux</a>, <a href="https://github.com/countercept/snake">Snake</a>, <a href="https://app.sndbox.com">SNDBOX</a>, <a href="https://splunkbase.splunk.com/app/5365/">Splunk add-on for MS O365 Email</a>, <a href="https://github.com/ldbo/SpuriousEmu">SpuriousEmu</a>, <a href="https://github.com/target/strelka">Strelka</a>, <a href="https://stoq.punchcyber.com/">stoQ</a>, <a href="https://docs.sublimesecurity.com/docs/enrichment-functions">Sublime Platform/MQL</a>, <a href="https://github.com/TheHive-Project/Cortex-Analyzers">TheHive/Cortex</a>, <a href="https://tsurugi-linux.org/">TSUGURI Linux</a>, <a href="https://github.com/MalwareCantFly/Vba2Graph">Vba2Graph</a>, <a href="http://viper.li/">Viper</a>, <a href="https://github.com/decalage2/ViperMonkey">ViperMonkey</a>, <a href="https://yomi.yoroi.company">YOMI</a>, and probably <a href="https://www.virustotal.com">VirusTotal</a>, <a href="https://www.filescan.io">FileScan.IO</a>. And quite a few <a href="https://github.com/search?q=oletools&amp;type=Repositories">other projects on GitHub</a>. (Please <a href="(http://decalage.info/contact)">contact me</a> if you have or know a project using oletools)</p>
134 <h2 id="download-and-install">Download and Install:</h2> 179 <h2 id="download-and-install">Download and Install:</h2>
135 <p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p> 180 <p>The recommended way to download and install/update the <strong>latest stable release</strong> of oletools is to use <a href="https://pip.pypa.io/en/stable/installing/">pip</a>:</p>
136 <ul> 181 <ul>
137 -<li>On Linux/Mac: <code>sudo -H pip install -U oletools</code></li>  
138 -<li>On Windows: <code>pip install -U oletools</code></li> 182 +<li>On Linux/Mac: <code>sudo -H pip install -U oletools[full]</code></li>
  183 +<li>On Windows: <code>pip install -U oletools[full]</code></li>
139 </ul> 184 </ul>
140 <p>This should automatically create command-line scripts to run each tool from any directory: <code>olevba</code>, <code>mraptor</code>, <code>rtfobj</code>, etc.</p> 185 <p>This should automatically create command-line scripts to run each tool from any directory: <code>olevba</code>, <code>mraptor</code>, <code>rtfobj</code>, etc.</p>
  186 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, just remove <code>[full]</code> from the command line.</p>
141 <p>To get the <strong>latest development version</strong> instead:</p> 187 <p>To get the <strong>latest development version</strong> instead:</p>
142 <ul> 188 <ul>
143 <li>On Linux/Mac: <code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li> 189 <li>On Linux/Mac: <code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></li>
@@ -153,7 +199,7 @@ @@ -153,7 +199,7 @@
153 <p>The code is available in <a href="https://github.com/decalage2/oletools">a GitHub repository</a>. You may use it to submit enhancements using forks and pull requests.</p> 199 <p>The code is available in <a href="https://github.com/decalage2/oletools">a GitHub repository</a>. You may use it to submit enhancements using forks and pull requests.</p>
154 <h2 id="license">License</h2> 200 <h2 id="license">License</h2>
155 <p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p> 201 <p>This license applies to the python-oletools package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
156 -<p>The python-oletools package is copyright (c) 2012-2021 Philippe Lagadec (http://www.decalage.info)</p> 202 +<p>The python-oletools package is copyright (c) 2012-2022 Philippe Lagadec (http://www.decalage.info)</p>
157 <p>All rights reserved.</p> 203 <p>All rights reserved.</p>
158 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p> 204 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
159 <ul> 205 <ul>
oletools/README.rst
  View file @f2cbbba
@@ -29,6 +29,56 @@ Software. @@ -29,6 +29,56 @@ Software.
29 News 29 News
30 ---- 30 ----
31 31
  32 +- **2022-05-09 v0.60.1**:
  33 +
  34 + - olevba:
  35 +
  36 + - fixed a bug when calling XLMMacroDeobfuscator (PR #737)
  37 + - removed keyword "sample" causing false positives
  38 +
  39 + - oleid: fixed OleID init issue (issue #695, PR #696)
  40 + - oleobj:
  41 +
  42 + - added simple detection of CVE-2021-40444 initial stage
  43 + - added detection for customUI onLoad
  44 + - improved handling of incorrect filenames in OLE package (PR
  45 + #451)
  46 +
  47 + - rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue
  48 + #692)
  49 + - ftguess:
  50 +
  51 + - added PowerPoint and XPS formats (PR #716)
  52 + - fixed issue with XPS and malformed documents (issue #711)
  53 + - added XLSB format (issue #758)
  54 +
  55 + - improved logging with common module log_helper (PR #449)
  56 +
  57 +- **2021-06-02 v0.60**:
  58 +
  59 + - ftguess: new tool to identify file formats and containers (issue
  60 + #680)
  61 + - oleid: (issue #679)
  62 +
  63 + - each indicator now has a risk level
  64 + - calls ftguess to identify file formats
  65 + - calls olevba+mraptor to detect and analyse VBA+XLM macros
  66 +
  67 + - olevba:
  68 +
  69 + - when XLMMacroDeobfuscator is available, use it to extract and
  70 + deobfuscate XLM macros
  71 +
  72 + - rtfobj:
  73 +
  74 + - use ftguess to identify file type of OLE Package (issue #682)
  75 + - fixed bug in re_executable_extensions
  76 +
  77 + - crypto: added PowerPoint transparent password '/01Hannes
  78 + Ruescher/01' (issue #627)
  79 + - setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional
  80 + dependencies
  81 +
32 - **2021-05-07 v0.56.2**: 82 - **2021-05-07 v0.56.2**:
33 83
34 - olevba: 84 - olevba:
@@ -202,6 +252,7 @@ BOSS &lt;https://github.com/lmco/laikaboss&gt;`__, @@ -202,6 +252,7 @@ BOSS &lt;https://github.com/lmco/laikaboss&gt;`__,
202 Repository Framework (MRF) <https://www.adlice.com/download/mrf/>`__, 252 Repository Framework (MRF) <https://www.adlice.com/download/mrf/>`__,
203 `MalwareBazaar <https://bazaar.abuse.ch/>`__, 253 `MalwareBazaar <https://bazaar.abuse.ch/>`__,
204 `olefy <https://github.com/HeinleinSupport/olefy>`__, 254 `olefy <https://github.com/HeinleinSupport/olefy>`__,
  255 +`Pandora <https://github.com/pandora-analysis/pandora>`__,
205 `PeekabooAV <https://github.com/scVENUS/PeekabooAV>`__, 256 `PeekabooAV <https://github.com/scVENUS/PeekabooAV>`__,
206 `pcodedmp <https://github.com/bontchev/pcodedmp>`__, 257 `pcodedmp <https://github.com/bontchev/pcodedmp>`__,
207 `PyCIRCLean <https://github.com/CIRCL/PyCIRCLean>`__, 258 `PyCIRCLean <https://github.com/CIRCL/PyCIRCLean>`__,
@@ -211,14 +262,16 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__, @@ -211,14 +262,16 @@ Repository Framework (MRF) &lt;https://www.adlice.com/download/mrf/&gt;`__,
211 Email <https://splunkbase.splunk.com/app/5365/>`__, 262 Email <https://splunkbase.splunk.com/app/5365/>`__,
212 `SpuriousEmu <https://github.com/ldbo/SpuriousEmu>`__, 263 `SpuriousEmu <https://github.com/ldbo/SpuriousEmu>`__,
213 `Strelka <https://github.com/target/strelka>`__, 264 `Strelka <https://github.com/target/strelka>`__,
214 -`stoQ <https://stoq.punchcyber.com/>`__, 265 +`stoQ <https://stoq.punchcyber.com/>`__, `Sublime
  266 +Platform/MQL <https://docs.sublimesecurity.com/docs/enrichment-functions>`__,
215 `TheHive/Cortex <https://github.com/TheHive-Project/Cortex-Analyzers>`__, 267 `TheHive/Cortex <https://github.com/TheHive-Project/Cortex-Analyzers>`__,
216 `TSUGURI Linux <https://tsurugi-linux.org/>`__, 268 `TSUGURI Linux <https://tsurugi-linux.org/>`__,
217 `Vba2Graph <https://github.com/MalwareCantFly/Vba2Graph>`__, 269 `Vba2Graph <https://github.com/MalwareCantFly/Vba2Graph>`__,
218 `Viper <http://viper.li/>`__, 270 `Viper <http://viper.li/>`__,
219 `ViperMonkey <https://github.com/decalage2/ViperMonkey>`__, 271 `ViperMonkey <https://github.com/decalage2/ViperMonkey>`__,
220 `YOMI <https://yomi.yoroi.company>`__, and probably 272 `YOMI <https://yomi.yoroi.company>`__, and probably
221 -`VirusTotal <https://www.virustotal.com>`__. And quite a few `other 273 +`VirusTotal <https://www.virustotal.com>`__,
  274 +`FileScan.IO <https://www.filescan.io>`__. And quite a few `other
222 projects on 275 projects on
223 GitHub <https://github.com/search?q=oletools&type=Repositories>`__. 276 GitHub <https://github.com/search?q=oletools&type=Repositories>`__.
224 (Please `contact me <(http://decalage.info/contact)>`__ if you have or 277 (Please `contact me <(http://decalage.info/contact)>`__ if you have or
@@ -231,12 +284,17 @@ The recommended way to download and install/update the **latest stable @@ -231,12 +284,17 @@ The recommended way to download and install/update the **latest stable
231 release** of oletools is to use 284 release** of oletools is to use
232 `pip <https://pip.pypa.io/en/stable/installing/>`__: 285 `pip <https://pip.pypa.io/en/stable/installing/>`__:
233 286
234 -- On Linux/Mac: ``sudo -H pip install -U oletools``  
235 -- On Windows: ``pip install -U oletools`` 287 +- On Linux/Mac: ``sudo -H pip install -U oletools[full]``
  288 +- On Windows: ``pip install -U oletools[full]``
236 289
237 This should automatically create command-line scripts to run each tool 290 This should automatically create command-line scripts to run each tool
238 from any directory: ``olevba``, ``mraptor``, ``rtfobj``, etc. 291 from any directory: ``olevba``, ``mraptor``, ``rtfobj``, etc.
239 292
  293 +The keyword ``[full]`` means that all optional dependencies will be
  294 +installed, such as XLMMacroDeobfuscator. If you prefer a lighter version
  295 +without optional dependencies, just remove ``[full]`` from the command
  296 +line.
  297 +
240 To get the **latest development version** instead: 298 To get the **latest development version** instead:
241 299
242 - On Linux/Mac: 300 - On Linux/Mac:
@@ -279,7 +337,7 @@ This license applies to the python-oletools package, apart from the @@ -279,7 +337,7 @@ This license applies to the python-oletools package, apart from the
279 thirdparty folder which contains third-party files published with their 337 thirdparty folder which contains third-party files published with their
280 own license. 338 own license.
281 339
282 -The python-oletools package is copyright (c) 2012-2021 Philippe Lagadec 340 +The python-oletools package is copyright (c) 2012-2022 Philippe Lagadec
283 (http://www.decalage.info) 341 (http://www.decalage.info)
284 342
285 All rights reserved. 343 All rights reserved.
oletools/doc/Install.html
  View file @f2cbbba
@@ -18,16 +18,20 @@ @@ -18,16 +18,20 @@
18 <body> 18 <body>
19 <h1 id="how-to-download-and-install-oletools">How to Download and Install oletools</h1> 19 <h1 id="how-to-download-and-install-oletools">How to Download and Install oletools</h1>
20 <h2 id="pre-requisites">Pre-requisites</h2> 20 <h2 id="pre-requisites">Pre-requisites</h2>
21 -<p>The recommended Python version to run oletools is the latest <strong>Python 3.x</strong> (3.7 for now). Python 2.7 is still supported, but as it will become end of life in 2020 (see https://pythonclock.org/), it is highly recommended to switch to Python 3 now.</p> 21 +<p>The recommended Python version to run oletools is the latest <strong>Python 3.x</strong> (3.9 for now). Python 2.7 is still supported for the moment, even if it reached end of life in 2020 (for projects still using Python 2/PyPy 2 such as ViperMonkey). It is highly recommended to switch to Python 3 if possible.</p>
22 <h2 id="recommended-way-to-downloadinstallupdate-oletools-pip">Recommended way to Download+Install/Update oletools: pip</h2> 22 <h2 id="recommended-way-to-downloadinstallupdate-oletools-pip">Recommended way to Download+Install/Update oletools: pip</h2>
23 <p>Pip is included with Python since version 2.7.9 and 3.4. If it is not installed on your system, either upgrade Python or see https://pip.pypa.io/en/stable/installing/</p> 23 <p>Pip is included with Python since version 2.7.9 and 3.4. If it is not installed on your system, either upgrade Python or see https://pip.pypa.io/en/stable/installing/</p>
24 <h3 id="linux-mac-osx-unix">Linux, Mac OSX, Unix</h3> 24 <h3 id="linux-mac-osx-unix">Linux, Mac OSX, Unix</h3>
25 -<p>To download and install/update the latest release version of oletools, run the following command in a shell:</p> 25 +<p>To download and install/update the latest release version of oletools with all its dependencies, run the following command in a shell:</p>
  26 +<pre class="text"><code>sudo -H pip install -U oletools[full]</code></pre>
  27 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, use the following command instead:</p>
26 <pre class="text"><code>sudo -H pip install -U oletools</code></pre> 28 <pre class="text"><code>sudo -H pip install -U oletools</code></pre>
27 <p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p> 29 <p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
28 <p><strong>Important</strong>: Since version 0.50, pip will automatically create convenient command-line scripts in /usr/local/bin to run all the oletools from any directory.</p> 30 <p><strong>Important</strong>: Since version 0.50, pip will automatically create convenient command-line scripts in /usr/local/bin to run all the oletools from any directory.</p>
29 <h3 id="windows">Windows</h3> 31 <h3 id="windows">Windows</h3>
30 -<p>To download and install/update the latest release version of oletools, run the following command in a cmd window:</p> 32 +<p>To download and install/update the latest release version of oletools with all its dependencies, run the following command in a cmd window:</p>
  33 +<pre class="text"><code>pip install -U oletools[full]</code></pre>
  34 +<p>The keyword <code>[full]</code> means that all optional dependencies will be installed, such as XLMMacroDeobfuscator. If you prefer a lighter version without optional dependencies, use the following command instead:</p>
31 <pre class="text"><code>pip install -U oletools</code></pre> 35 <pre class="text"><code>pip install -U oletools</code></pre>
32 <p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p> 36 <p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
33 <p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p> 37 <p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p>
@@ -37,9 +41,11 @@ @@ -37,9 +41,11 @@
37 <p>If you want to benefit from the latest improvements in the development version, you may also use pip:</p> 41 <p>If you want to benefit from the latest improvements in the development version, you may also use pip:</p>
38 <h3 id="linux-mac-osx-unix-1">Linux, Mac OSX, Unix</h3> 42 <h3 id="linux-mac-osx-unix-1">Linux, Mac OSX, Unix</h3>
39 <pre class="text"><code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre> 43 <pre class="text"><code>sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre>
  44 +<p>Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator, so you may need to install them separately.</p>
40 <p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p> 45 <p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
41 <h3 id="windows-1">Windows</h3> 46 <h3 id="windows-1">Windows</h3>
42 <pre class="text"><code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre> 47 <pre class="text"><code>pip install -U https://github.com/decalage2/oletools/archive/master.zip</code></pre>
  48 +<p>Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator, so you may need to install them separately.</p>
43 <p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p> 49 <p>Replace <code>pip</code> by <code>pip3</code> or <code>pip2</code> to install on a specific Python version.</p>
44 <p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p> 50 <p><strong>Note</strong>: with Python 3, you may need to open a cmd window with Administrator privileges in order to run pip and install for all users. If that is not possible, you may also install only for the current user by adding the <code>--user</code> option:</p>
45 <pre class="text"><code>pip3 install -U --user https://github.com/decalage2/oletools/archive/master.zip</code></pre> 51 <pre class="text"><code>pip3 install -U --user https://github.com/decalage2/oletools/archive/master.zip</code></pre>
oletools/doc/Install.md
  View file @f2cbbba
@@ -4,9 +4,10 @@ How to Download and Install oletools @@ -4,9 +4,10 @@ How to Download and Install oletools
4 Pre-requisites 4 Pre-requisites
5 -------------- 5 --------------
6 6
7 -The recommended Python version to run oletools is the latest **Python 3.x** (3.7 for now).  
8 -Python 2.7 is still supported, but as it will become end of life in 2020 (see https://pythonclock.org/), it is highly  
9 -recommended to switch to Python 3 now. 7 +The recommended Python version to run oletools is the latest **Python 3.x** (3.9 for now).
  8 +Python 2.7 is still supported for the moment, even if it reached end of life in 2020
  9 +(for projects still using Python 2/PyPy 2 such as ViperMonkey).
  10 +It is highly recommended to switch to Python 3 if possible.
10 11
11 Recommended way to Download+Install/Update oletools: pip 12 Recommended way to Download+Install/Update oletools: pip
12 -------------------------------------------------------- 13 --------------------------------------------------------
@@ -16,10 +17,16 @@ system, either upgrade Python or see https://pip.pypa.io/en/stable/installing/ @@ -16,10 +17,16 @@ system, either upgrade Python or see https://pip.pypa.io/en/stable/installing/
16 17
17 ### Linux, Mac OSX, Unix 18 ### Linux, Mac OSX, Unix
18 19
19 -To download and install/update the latest release version of oletools, 20 +To download and install/update the latest release version of oletools with all its dependencies,
20 run the following command in a shell: 21 run the following command in a shell:
21 22
22 ```text 23 ```text
  24 +sudo -H pip install -U oletools[full]
  25 +```
  26 +The keyword `[full]` means that all optional dependencies will be installed, such as XLMMacroDeobfuscator.
  27 +If you prefer a lighter version without optional dependencies, use the following command instead:
  28 +
  29 +```text
23 sudo -H pip install -U oletools 30 sudo -H pip install -U oletools
24 ``` 31 ```
25 32
@@ -30,10 +37,16 @@ in /usr/local/bin to run all the oletools from any directory. @@ -30,10 +37,16 @@ in /usr/local/bin to run all the oletools from any directory.
30 37
31 ### Windows 38 ### Windows
32 39
33 -To download and install/update the latest release version of oletools, 40 +To download and install/update the latest release version of oletools with all its dependencies,
34 run the following command in a cmd window: 41 run the following command in a cmd window:
35 42
36 ```text 43 ```text
  44 +pip install -U oletools[full]
  45 +```
  46 +The keyword `[full]` means that all optional dependencies will be installed, such as XLMMacroDeobfuscator.
  47 +If you prefer a lighter version without optional dependencies, use the following command instead:
  48 +
  49 +```text
37 pip install -U oletools 50 pip install -U oletools
38 ``` 51 ```
39 52
@@ -62,6 +75,8 @@ you may also use pip: @@ -62,6 +75,8 @@ you may also use pip:
62 ```text 75 ```text
63 sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip 76 sudo -H pip install -U https://github.com/decalage2/oletools/archive/master.zip
64 ``` 77 ```
  78 +Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator,
  79 +so you may need to install them separately.
65 80
66 Replace `pip` by `pip3` or `pip2` to install on a specific Python version. 81 Replace `pip` by `pip3` or `pip2` to install on a specific Python version.
67 82
@@ -70,6 +85,8 @@ Replace `pip` by `pip3` or `pip2` to install on a specific Python version. @@ -70,6 +85,8 @@ Replace `pip` by `pip3` or `pip2` to install on a specific Python version.
70 ```text 85 ```text
71 pip install -U https://github.com/decalage2/oletools/archive/master.zip 86 pip install -U https://github.com/decalage2/oletools/archive/master.zip
72 ``` 87 ```
  88 +Note that it will install oletools without optional dependencies such as XLMMacroDeobfuscator,
  89 +so you may need to install them separately.
73 90
74 Replace `pip` by `pip3` or `pip2` to install on a specific Python version. 91 Replace `pip` by `pip3` or `pip2` to install on a specific Python version.
75 92
oletools/doc/License.html
  View file @f2cbbba
@@ -18,7 +18,7 @@ @@ -18,7 +18,7 @@
18 <body> 18 <body>
19 <h1 id="license-for-python-oletools">License for python-oletools</h1> 19 <h1 id="license-for-python-oletools">License for python-oletools</h1>
20 <p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p> 20 <p>This license applies to the <a href="http://www.decalage.info/python/oletools">python-oletools</a> package, apart from the thirdparty folder which contains third-party files published with their own license.</p>
21 -<p>The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p> 21 +<p>The python-oletools package is copyright (c) 2012-2022 Philippe Lagadec (<a href="http://www.decalage.info" class="uri">http://www.decalage.info</a>)</p>
22 <p>All rights reserved.</p> 22 <p>All rights reserved.</p>
23 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p> 23 <p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
24 <ul> 24 <ul>
oletools/doc/License.md
  View file @f2cbbba
@@ -4,7 +4,7 @@ License for python-oletools @@ -4,7 +4,7 @@ License for python-oletools
4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the 4 This license applies to the [python-oletools](http://www.decalage.info/python/oletools) package, apart from the
5 thirdparty folder which contains third-party files published with their own license. 5 thirdparty folder which contains third-party files published with their own license.
6 6
7 -The python-oletools package is copyright (c) 2012-2020 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info)) 7 +The python-oletools package is copyright (c) 2012-2022 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
8 8
9 All rights reserved. 9 All rights reserved.
10 10