olevba: added PROJECTCOMPATVERSION Record on dir Stream

kijeong
1 parent d5b971e4
Showing 3 changed files with 37 additions and 2 deletions
oletools/olevba.py
tests/olevba/test_basic.py
tests/test-data/olevba/sample_with_vba.ppt
@@ -234,6 +234,7 @@ from __future__ import print_function
 # 2020-09-28       PL: - added VBA_Parser.get_vba_code_all_modules (partial fix
 #                        for issue #619)
 # 2021-04-14       PL: - added detection of Workbook_BeforeClose (issue #518)
+# 2021-11-09       KJ: - added PROJECTCOMPATVERSION Record on dir Stream
 __version__ = '0.60.1.dev3'
@@ -1720,9 +1721,25 @@ class VBA_Project(object):
         if self.syskind not in SYSKIND_NAME:
             log.error("invalid PROJECTSYSKIND_SysKind {0:04X}".format(self.syskind))
-        # PROJECTLCID Record
+        # PROJECTLCID Record or PROJECTCOMPATVERSION Record
+        project_id = struct.unpack("<H", dir_stream.read(2))[0]
+        if project_id == 0x004A:
+            # PROJECTCOMPATVERSION Record
+            # Specifies the VBA project’s compat version.
+            projectcompatversion_id = project_id
+            self.check_value('PROJETCOMPATVERSION_Id', 0x004A, projectcompatversion_id)
+            projectcompatversion_size = struct.unpack("<L", dir_stream.read(4))[0]
+            self.check_value('PROJECTCOMPATVERSION_Size', 0x0004, projectcompatversion_size)
+            projectcompatversion_compatversion = struct.unpack("<L", dir_stream.read(4))[0]
+            # compat version: A 32-bit number that identifies the Office Model version used by a VBA project.
+            log.debug("compat version: {compat_version}".format(compat_version=projectcompatversion_compatversion))
+
+            # PROJECTLCID Record
+            project_id = struct.unpack("<H", dir_stream.read(2))[0]
+
+        projectlcid_id = project_id
+
         # Specifies the VBA project's LCID.
-        projectlcid_id = struct.unpack("<H", dir_stream.read(2))[0]
         self.check_value('PROJECTLCID_Id', 0x0002, projectlcid_id)
         projectlcid_size = struct.unpack("<L", dir_stream.read(4))[0]
         self.check_value('PROJECTLCID_Size', 0x0004, projectlcid_size)
@@ -103,6 +103,24 @@ class TestOlevbaBasic(unittest.TestCase):
                                  msg='Wrong return code {} for args {}'\
                                      .format(ret_code, args + [filename, ]))
+    def test_dir_stream_record_project_compat_version(self):
+        """Test PROJECTCOMPATVERSION record on dir stream with a ppt file."""
+        input_file = join(DATA_BASE_DIR, 'olevba', 'sample_with_vba.ppt')
+        output, ret_code = call_and_capture('olevba', args=(input_file, "--loglevel", "debug"))
+
+        # check return code
+        self.assertEqual(ret_code, 0)
+
+        # not expected string:
+        self.assertNotIn('invalid value for PROJECTLCID_Id expected 0002 got', output)
+        self.assertNotIn('Error in _extract_vba', output)
+
+        # compat version in debug mode:
+        self.assertIn('compat version: 2', output)
+
+        # vba contents:
+        self.assertIn('Sub Action_Click()\n  MsgBox "The action button clicked!"\nEnd Sub', output)
+
 # just in case somebody calls this file as a script
 if __name__ == '__main__':