Peter M. Groen / oletools

Commit f3c42b855875ad08f75a99bfe318cadaaf5a3f0f

Authored by Philippe Lagadec
1 parent a1fe3a30

Renamed xxxswf2 to pyxswf

Inline Side-by-side
Showing 4 changed files with 34 additions and 26 deletions
README.md
  View file @f3c42b8
... ... @@ -9,7 +9,7 @@ Tools in oletools:
9 9  
10 10 - **olebrowse**: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to
11 11 view and extract individual data streams.
12   -- **xxxswf2**: a script to detect, extract and analyze Flash objects (SWF) that may
  12 +- **pyxswf**: a script to detect, extract and analyze Flash objects (SWF) that may
13 13 be embedded in files such as MS Office documents (e.g. Word, Excel),
14 14 which is especially useful for malware analysis.
15 15 - and a few others (coming soon)
... ... @@ -17,7 +17,7 @@ Tools in oletools:
17 17 News
18 18 ----
19 19  
20   -- 2012-10-09: Initial version of olebrowse and xxxswf2
  20 +- 2012-10-09: Initial version of olebrowse and pyxswf
21 21 - see changelog in source code for more info.
22 22  
23 23 Download:
... ... @@ -34,16 +34,18 @@ view and extract individual data streams.
34 34  
35 35 Usage: olebrowse.py [file]
36 36  
  37 +If you provide a file it will be opened, else a dialog will allow you to browse folders to open a file. Then if it is a valid OLE file, the list of data streams will be displayed. You can select a stream, and then either view its content in a builtin hexadecimal viewer, or save it to a file for further analysis.
  38 +
37 39 olebrowse project website: [http://www.decalage.info/python/olebrowse](http://www.decalage.info/python/olebrowse)
38 40  
39   -xxxswf2:
  41 +pyxswf:
40 42 --------
41 43  
42   -xxxswf2 is a script to detect, extract and analyze Flash objects (SWF files) that may
  44 +pyxswf is a script to detect, extract and analyze Flash objects (SWF files) that may
43 45 be embedded in files such as MS Office documents (e.g. Word, Excel),
44 46 which is especially useful for malware analysis.
45 47  
46   -xxxswf2 is an improved version of xxxswf.py published by Alexander Hanel on
  48 +pyxswf is an improved version of xxxswf.py published by Alexander Hanel on
47 49 [http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html](http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html)
48 50  
49 51 Compared to xxxswf, it can extract streams from MS Office documents by parsing
... ... @@ -53,7 +55,7 @@ Stream fragmentation is a known obfuscation technique, as explained on
53 55  
54 56 For this, simply add the -o option to work on OLE streams rather than raw files.
55 57  
56   - Usage: xxxswf2.py [options] <file.bad>
  58 + Usage: pyxswf.py [options] <file.bad>
57 59  
58 60 Options:
59 61 -o, --ole Parse an OLE file (e.g. Word, Excel) to look for SWF
... ... @@ -75,18 +77,18 @@ For this, simply add the -o option to work on OLE streams rather than raw files.
75 77  
76 78 Example - detecting and extracting a SWF file from a Word document on Windows:
77 79  
78   - C:\oletools>xxxswf2.py -o word_flash.doc
  80 + C:\oletools>pyxswf.py -o word_flash.doc
79 81 OLE stream: 'Contents'
80 82 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
81 83 [ADDR] SWF 1 at 0x8 - FWS Header
82 84  
83   - C:\oletools>xxxswf2.py -xo word_flash.doc
  85 + C:\oletools>pyxswf.py -xo word_flash.doc
84 86 OLE stream: 'Contents'
85 87 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
86 88 [ADDR] SWF 1 at 0x8 - FWS Header
87 89 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf
88 90  
89   -xxxswf2 project website: [http://www.decalage.info/python/xxxswf2](http://www.decalage.info/python/xxxswf2)
  91 +pyxswf project website: [http://www.decalage.info/python/pyxswf](http://www.decalage.info/python/pyxswf)
90 92  
91 93  
92 94 How to contribute:
... ...
oletools/README.txt
  View file @f3c42b8
... ... @@ -16,7 +16,7 @@ Tools in oletools:
16 16  
17 17 - **olebrowse**: A simple GUI to browse OLE files (e.g. MS Word, Excel,
18 18 Powerpoint documents), to view and extract individual data streams.
19   -- **xxxswf2**: a script to detect, extract and analyze Flash objects
  19 +- **pyxswf**: a script to detect, extract and analyze Flash objects
20 20 (SWF) that may be embedded in files such as MS Office documents (e.g.
21 21 Word, Excel), which is especially useful for malware analysis.
22 22 - and a few others (coming soon)
... ... @@ -24,7 +24,7 @@ Tools in oletools:
24 24 News
25 25 ----
26 26  
27   -- 2012-10-09: Initial version of olebrowse and xxxswf2
  27 +- 2012-10-09: Initial version of olebrowse and pyxswf
28 28 - see changelog in source code for more info.
29 29  
30 30 Download:
... ... @@ -43,17 +43,23 @@ documents), to view and extract individual data streams.
43 43  
44 44 Usage: olebrowse.py [file]
45 45  
  46 +If you provide a file it will be opened, else a dialog will allow you to
  47 +browse folders to open a file. Then if it is a valid OLE file, the list
  48 +of data streams will be displayed. You can select a stream, and then
  49 +either view its content in a builtin hexadecimal viewer, or save it to a
  50 +file for further analysis.
  51 +
46 52 olebrowse project website:
47 53 `http://www.decalage.info/python/olebrowse <http://www.decalage.info/python/olebrowse>`_
48 54  
49   -xxxswf2:
50   ---------
  55 +pyxswf:
  56 +-------
51 57  
52   -xxxswf2 is a script to detect, extract and analyze Flash objects (SWF
  58 +pyxswf is a script to detect, extract and analyze Flash objects (SWF
53 59 files) that may be embedded in files such as MS Office documents (e.g.
54 60 Word, Excel), which is especially useful for malware analysis.
55 61  
56   -xxxswf2 is an improved version of xxxswf.py published by Alexander Hanel
  62 +pyxswf is an improved version of xxxswf.py published by Alexander Hanel
57 63 on
58 64 `http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html <http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html>`_
59 65  
... ... @@ -68,7 +74,7 @@ raw files.
68 74  
69 75 ::
70 76  
71   - Usage: xxxswf2.py [options] <file.bad>
  77 + Usage: pyxswf.py [options] <file.bad>
72 78  
73 79 Options:
74 80 -o, --ole Parse an OLE file (e.g. Word, Excel) to look for SWF
... ... @@ -93,19 +99,19 @@ Windows:
93 99  
94 100 ::
95 101  
96   - C:\oletools>xxxswf2.py -o word_flash.doc
  102 + C:\oletools>pyxswf.py -o word_flash.doc
97 103 OLE stream: 'Contents'
98 104 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
99 105 [ADDR] SWF 1 at 0x8 - FWS Header
100 106  
101   - C:\oletools>xxxswf2.py -xo word_flash.doc
  107 + C:\oletools>pyxswf.py -xo word_flash.doc
102 108 OLE stream: 'Contents'
103 109 [SUMMARY] 1 SWF(s) in MD5:993664cc86f60d52d671b6610813cfd1:Contents
104 110 [ADDR] SWF 1 at 0x8 - FWS Header
105 111 [FILE] Carved SWF MD5: 2498e9c0701dc0e461ab4358f9102bc5.swf
106 112  
107   -xxxswf2 project website:
108   -`http://www.decalage.info/python/xxxswf2 <http://www.decalage.info/python/xxxswf2>`_
  113 +pyxswf project website:
  114 +`http://www.decalage.info/python/pyxswf <http://www.decalage.info/python/pyxswf>`_
109 115  
110 116 How to contribute:
111 117 ------------------
... ...
oletools/olebrowse.py
  View file @f3c42b8
... ... @@ -43,7 +43,7 @@ __version__ = &#39;0.01&#39;
43 43 # TODO:
44 44 # - menu option to open another file
45 45 # - menu option to display properties
46   -# - menu option to run xxxswf2, oleid, oleyara, olecarve, etc
  46 +# - menu option to run other oletools, external tools such as OfficeCat?
47 47 # - for a stream, display info: size, path, etc
48 48 # - stream info: magic, entropy, ... ?
49 49  
... ...
oletools/xxxswf2.py renamed to oletools/pyxswf.py
  View file @f3c42b8
1 1 #!/usr/bin/env python
2 2 """
3   -xxxswf2.py - Philippe Lagadec 2012-09-17
  3 +pyxswf.py - Philippe Lagadec 2012-09-17
4 4  
5   -xxxswf2 is a script to detect, extract and analyze Flash objects (SWF) that may
  5 +pyxswf is a script to detect, extract and analyze Flash objects (SWF) that may
6 6 be embedded in files such as MS Office documents (e.g. Word, Excel),
7 7 which is especially useful for malware analysis.
8   -xxxswf2 is an improved version of xxxswf.py published by Alexander Hanel on
  8 +pyxswf is an improved version of xxxswf.py published by Alexander Hanel on
9 9 http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html
10 10 Compared to xxxswf, it can extract streams from MS Office documents by parsing
11 11 their OLE structure properly, which is necessary when streams are fragmented.
12 12 Stream fragmentation is a known obfuscation technique, as explained on
13 13 http://www.breakingpointsystems.com/resources/blog/evasion-with-ole2-fragmentation/
14 14  
15   -xxxswf2 project website: http://www.decalage.info/python/xxxswf2
  15 +pyxswf project website: http://www.decalage.info/python/pyxswf
16 16  
17   -xxxswf2 is copyright (c) 2012, Philippe Lagadec (http://www.decalage.info)
  17 +pyxswf is copyright (c) 2012, Philippe Lagadec (http://www.decalage.info)
18 18 All rights reserved.
19 19  
20 20 Redistribution and use in source and binary forms, with or without modification,
... ...