Logo white

Peter M. Groen / oletools

Sign in
  • Sign in
  • Project
  • Files
  • Commits
  • Network
  • Graphs
  • Milestones
  • Issues 0
  • Merge Requests 0
  • Labels
  • Wiki
  • Commits 1,521
  • Compare
  • Branches 1
  • Tags 0
  • oletools
12 Dec, 2018
2 commits
  • updated MANIFEST.in
    19911393
    decalage2 authored
    2018-12-12 15:31:48 +0100  
    Browse Code »
  • Merge pull request #371 from christian-intra2net/source-dist-include-tests ...
    20aea720
    setup: create MANIFEST so source-tarball includes tests
    Philippe Lagadec authored
    2018-12-12 15:07:07 +0100  
    Browse Code »

09 Dec, 2018
1 commit
  • sync olevba and olevba3 (work in progress)
    b44486fc
    decalage2 authored
    2018-12-09 17:24:30 +0100  
    Browse Code »

08 Dec, 2018
3 commits
  • xglob: fixed issue #373, zip password must be bytes
    9c301d5b
    decalage2 authored
    2018-12-08 17:25:52 +0100  
    Browse Code »
  • olevba3: import io instead of _io
    5699d8bf
    decalage2 authored
    2018-12-08 16:49:23 +0100  
    Browse Code »
  • olevba: replaced StringIO by BytesIO for better Python 3 compatibility
    13eb7056
    decalage2 authored
    2018-12-08 16:44:03 +0100  
    Browse Code »

06 Dec, 2018
2 commits
  • setup: create MANIFEST so source-tarball includes tests ...
    0d7495db
    When creating source tarball	via "python setup.py sdist" or
    "python setup.py bdist_rpm", then include test code and data so can
    still run unittests. This does not affect the rpms.
    
    Tried first to achieve this effect (test[-data] included in source but not
    in rpm) using options in setup.py but failed.
    Christian Herdtweck authored
    2018-12-06 15:50:58 +0100  
    Browse Code »
  • olevba: suspicious keywords and IOCs found during analysis are now colorized in … ...
    e444851c
    …the VBA code output on the console
    decalage2 authored
    2018-12-06 09:06:25 +0100  
    Browse Code »

05 Dec, 2018
1 commit
  • olevba: removed some old comments
    1bc2b801
    decalage2 authored
    2018-12-05 18:01:37 +0100  
    Browse Code »

03 Dec, 2018
1 commit
  • olevba: replaced prettytable by tablestream (+colors)
    cb596a8a
    decalage2 authored
    2018-12-03 21:58:44 +0100  
    Browse Code »

30 Oct, 2018
29 commits
  • oleobj: bumped version to 0.54dev4
    33e52c57
    decalage2 authored
    2018-10-30 19:55:58 +0100  
    Browse Code »
  • Merge pull request #317 from samiraguiar/oleobj-detect-external ...
    79159242
    oleobj: detect external links
    Philippe Lagadec authored
    2018-10-30 19:53:02 +0100  
    Browse Code »
  • bumped version to 0.54dev4
    d3b8857d
    decalage2 authored
    2018-10-30 19:47:39 +0100  
    Browse Code »
  • Merge pull request #362 from christian-intra2net/encrypt-detect-and-raise ...
    e8b6dd46
    Encrypt detect and raise
    Philippe Lagadec authored
    2018-10-30 19:45:17 +0100  
    Browse Code »
  • olevba[3]: update doc string and changelog
    72684467
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • msodde: update doc string and changelog
    dbd555de
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • msodde: mention error if processing fails ...
    053d9359
    This only applies to non-xml parts of xlsx files
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • ppt_record_parser: detect ppt even when encrypted
    3a3fa1f0
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: return None if check_* failed due to closed file
    541e2d11
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • tests: create unittest for msodde with encrypted input
    8cbc4d2c
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • tests: create unittest for olevba with encrypted input
    c2018fd8
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • msodde: Raise error of file is encrypted ...
    ca1940b7
    Sofar, msodde do not complain if file is encrypted, but cannot inspect it
    either. That gives the user a false sense of security which is dangerous.
    Raise error to make the situation clear
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: detect encryption for ppt files
    332a4a5b
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: specify return values for OleID methods
    4dc0355f
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: do not run checks for non-ole files/objects
    b7da0ac5
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • tests: create unittest for oleid ...
    2966aa5d
    Checks output on all data in tests/test-data dir
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • tests: add encrypted office files to sample set ...
    d7a7c7b2
    Samples were created by me using Office 2010 on a Windows 7 machine,
    password is "encrypted", contents is trivial (no links, macros, ...)
    
    Encryption should be the CryptoAPI RC4 Encryption (see [MS-OFFCRYPTO])
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • record_base: throw encryption error when iterating encrypted files ...
    dd498c52
    Sofar, most tools (like msodde) do not complain if file is encrypted, but
    cannot inspect it either. That gives the user a false sense of security
    which is dangerous. Raise error to make the situation clear. But only
    raise when iterating records (stream names are still reliable and useful.
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • common: make filename optional for FileIsEncryptedError ...
    002fca03
    Sometimes there just is no filename
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • xls_parser: Fixed is_xls ...
    da4a1076
    Error was probably not noticeable since None was returned which usually
    also evaluates to False
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • xls_parser: Fixed selection of Workbook Stream
    58145c2c
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: found possible code duplication in record_base, ooxml ...
    9c7571e9
    Shame on me, I did not realize when creating ooxml and record_base that
    oleid already does some of the work of basic file classification.
    
    Added comments that this should one day be remedied.
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • olevba[3]: Raise error if ole file is encrypted ...
    dbe41313
    Right now, olevba[3] does not complain at all but cannot do its job.
    That could give the user a false sense of security.
    
    Return new return code so condition can easily be tested
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • errors: create new common module for commonly used errors
    1c427ebb
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: switch to argparse
    fc50a984
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: return newly created indicators
    5ba896d5
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: Accept olefile as arg to OleID constructor ...
    89680415
    This should avoid repeated opening and parsing of the same file if oleid
    is used by other tools
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • oleid: make much more pylint compatible ...
    4a38c4f7
    - add docstrings
    - break lines at 80
    - remove irregular whitespace
    - correct bare except
    - replace extra self.encrypted and self.macros
      with helper function get_indicator
    - correct a few variable names and one function name
    - make absolute import for scripts little less hacky
    Christian Herdtweck authored
    2018-10-30 12:18:59 +0100  
    Browse Code »
  • clsid: added Microsoft Equation
    d1f2a554
    decalage2 authored
    2018-10-30 10:37:20 +0100  
    Browse Code »

27 Oct, 2018
1 commit
  • setup: fixed issue #359 (bug when importing log_helper)
    34d4e60a
    decalage2 authored
    2018-10-27 19:54:22 +0200  
    Browse Code »