From f302bdeb762ddf49a809a639948ebfaadc37f418 Mon Sep 17 00:00:00 2001
From: kijeong <kijeong.kim@gmail.com>
Date: Tue, 9 Nov 2021 14:39:16 +0900
Subject: [PATCH] olevba: added PROJECTCOMPATVERSION Record on dir Stream

---
 oletools/olevba.py                         | 21 +++++++++++++++++++--
 tests/olevba/test_basic.py                 | 18 ++++++++++++++++++
 tests/test-data/olevba/sample_with_vba.ppt | Bin 0 -> 94720 bytes
 3 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 tests/test-data/olevba/sample_with_vba.ppt

diff --git a/oletools/olevba.py b/oletools/olevba.py
index 970330f..c590267 100644
--- a/oletools/olevba.py
+++ b/oletools/olevba.py
@@ -234,6 +234,7 @@ from __future__ import print_function
 # 2020-09-28       PL: - added VBA_Parser.get_vba_code_all_modules (partial fix
 #                        for issue #619)
 # 2021-04-14       PL: - added detection of Workbook_BeforeClose (issue #518)
+# 2021-11-09       KJ: - added PROJECTCOMPATVERSION Record on dir Stream
 
 __version__ = '0.60.1.dev3'
 
@@ -1720,9 +1721,25 @@ class VBA_Project(object):
         if self.syskind not in SYSKIND_NAME:
             log.error("invalid PROJECTSYSKIND_SysKind {0:04X}".format(self.syskind))
 
-        # PROJECTLCID Record
+        # PROJECTLCID Record or PROJECTCOMPATVERSION Record
+        project_id = struct.unpack("<H", dir_stream.read(2))[0]
+        if project_id == 0x004A:
+            # PROJECTCOMPATVERSION Record
+            # Specifies the VBA project’s compat version.
+            projectcompatversion_id = project_id
+            self.check_value('PROJETCOMPATVERSION_Id', 0x004A, projectcompatversion_id)
+            projectcompatversion_size = struct.unpack("<L", dir_stream.read(4))[0]
+            self.check_value('PROJECTCOMPATVERSION_Size', 0x0004, projectcompatversion_size)
+            projectcompatversion_compatversion = struct.unpack("<L", dir_stream.read(4))[0]
+            # compat version: A 32-bit number that identifies the Office Model version used by a VBA project.
+            log.debug("compat version: {compat_version}".format(compat_version=projectcompatversion_compatversion))
+
+            # PROJECTLCID Record
+            project_id = struct.unpack("<H", dir_stream.read(2))[0]
+
+        projectlcid_id = project_id
+
         # Specifies the VBA project's LCID.
-        projectlcid_id = struct.unpack("<H", dir_stream.read(2))[0]
         self.check_value('PROJECTLCID_Id', 0x0002, projectlcid_id)
         projectlcid_size = struct.unpack("<L", dir_stream.read(4))[0]
         self.check_value('PROJECTLCID_Size', 0x0004, projectlcid_size)
diff --git a/tests/olevba/test_basic.py b/tests/olevba/test_basic.py
index ef5ed26..d7ab5f1 100644
--- a/tests/olevba/test_basic.py
+++ b/tests/olevba/test_basic.py
@@ -103,6 +103,24 @@ class TestOlevbaBasic(unittest.TestCase):
                                  msg='Wrong return code {} for args {}'\
                                      .format(ret_code, args + [filename, ]))
 
+    def test_dir_stream_record_project_compat_version(self):
+        """Test PROJECTCOMPATVERSION record on dir stream with a ppt file."""
+        input_file = join(DATA_BASE_DIR, 'olevba', 'sample_with_vba.ppt')
+        output, ret_code = call_and_capture('olevba', args=(input_file, "--loglevel", "debug"))
+
+        # check return code
+        self.assertEqual(ret_code, 0)
+
+        # not expected string:
+        self.assertNotIn('invalid value for PROJECTLCID_Id expected 0002 got', output)
+        self.assertNotIn('Error in _extract_vba', output)
+
+        # compat version in debug mode:
+        self.assertIn('compat version: 2', output)
+
+        # vba contents:
+        self.assertIn('Sub Action_Click()\n  MsgBox "The action button clicked!"\nEnd Sub', output)
+
 
 # just in case somebody calls this file as a script
 if __name__ == '__main__':
diff --git a/tests/test-data/olevba/sample_with_vba.ppt b/tests/test-data/olevba/sample_with_vba.ppt
new file mode 100644
index 0000000..5c560c1
Binary files /dev/null and b/tests/test-data/olevba/sample_with_vba.ppt differ
--
libgit2 0.21.4