How to use the oletools.record_base function in oletools

To help you get started, we’ve selected a few oletools examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github decalage2 / oletools / oletools / ppt_record_parser.py View on Github external
repr(record.unicode_user_name),
                             '  ' * indent))
    elif isinstance(record, PptRecordExOleObjAtom):
        logging.info('{2}--> obj id {0}, persist id ref {1}'
                     .format(record.ex_obj_id, record.persist_id_ref,
                             '  ' * indent))
    elif isinstance(record, PptRecordExOleVbaActiveXAtom):
        ole = record.get_data_as_olefile()
        for entry in ole.listdir():
            logging.info('{0}ole entry {1}'.format('  ' * indent, entry))


if __name__ == '__main__':
    def do_per_record(record):
        print_records(record, logging.info, 2, False)
    sys.exit(record_base.test(sys.argv[1:], PptFile,
                              do_per_record=do_per_record,
                              verbose=False))
github decalage2 / oletools / oletools / xls_parser.py View on Github external
for record in xlsb_stream.iter_records():
            yield record
    except Exception:
        raise
    finally:
        if xlsb_stream is not None:
            xlsb_stream.close()


###############################################################################
# TESTING
###############################################################################


if __name__ == '__main__':
    sys.exit(record_base.test(sys.argv[1:], XlsFile, WorkbookStream))
github decalage2 / oletools / oletools / xls_parser.py View on Github external
###############################################################################
# File, Storage, Stream
###############################################################################

class XlsFile(record_base.OleRecordFile):
    """ An xls file has most streams made up of records """

    @classmethod
    def stream_class_for_name(cls, stream_name):
        """ helper for iter_streams """
        if stream_name == 'Workbook':
            return WorkbookStream
        return XlsStream


class XlsStream(record_base.OleRecordStream):
    """ most streams in xls file consist of records """

    def read_record_head(self):
        """ read first few bytes of record to determine size and type

        returns (type, size, other) where other is None
        """
        rec_type, rec_size = unpack('
github decalage2 / oletools / oletools / xls_parser.py View on Github external
""" read a unicode string with characters encoded by 2 bytes """
    end_idx = start_idx + n_chars * 2
    if n_chars < 256:  # faster version, long format string for unpack
        unichars = (unichr(val) for val in
                    unpack('<' + 'H'*n_chars, data[start_idx:end_idx]))
    else:              # slower version but less memory-extensive
        unichars = (unichr(unpack('
github decalage2 / oletools / oletools / ppt_record_parser.py View on Github external
elif record_name == 'CString':
                is_container = False
            else:
                logging.warning('Unexpected name for record type "{0}". typo?'
                                .format(record_name))
                is_container = False

            if is_container:
                return PptContainerRecord, True
            else:
                return PptRecord, False
        except KeyError:
            return PptRecord, False


class PptRecord(record_base.OleRecordBase):
    """ A Record within a ppt file; has instance and version fields """

    # fixed values for instance and version (usually ver is 0 or 0xf, inst 0/1)
    INSTANCE = None
    VERSION = None

    def finish_constructing(self, more_data):
        """ check and save instance and version """
        instance, version = more_data
        if self.INSTANCE is not None and self.INSTANCE != instance:
            raise ValueError('invalid instance {0} for {1}'
                             .format(instance, self))
        elif self.INSTANCE is not None and instance not in (0, 1):
            try:
                min_val, max_val = INSTANCE_EXCEPTIONS[self.type]
                is_ok = (min_val <= instance <= max_val)
github decalage2 / oletools / oletools / ppt_record_parser.py View on Github external
def finish_constructing(self, more_data):
        """ parse records from self.data """
        # set self.version and self.instance
        super(PptContainerRecord, self).finish_constructing(more_data)
        self.records = None
        if not self.data:
            return

        # logging.debug('parsing contents of container record {0}'
        #               .format(self))

        # create a stream from self.data and parse it like any other
        data_stream = io.BytesIO(self.data)
        record_stream = PptStream(data_stream, self.size,
                                  'PptContainerRecordSubstream',
                                  record_base.STGTY_SUBSTREAM)
        self.records = list(record_stream.iter_records())
        # logging.debug('done parsing contents of container record {0}'
github decalage2 / oletools / oletools / ppt_record_parser.py View on Github external
def get_data_as_olefile(self, debug_output=False):
        """ return an OleFileIO that streams from iter_uncompressed

        probably only works if data is an OLE object, otherwise expect
        exception
        """
        if debug_output:
            record_base.enable_olefile_logging()
        return record_base.OleFileIO(IterStream(self.iter_uncompressed,
                                                self.get_uncompressed_size()),
                                     debug=debug_output)
github decalage2 / oletools / oletools / ppt_record_parser.py View on Github external
return False


class PptFile(record_base.OleRecordFile):
    """ Record-based view on a PowerPoint ppt file

    This is a subclass of OleFileIO, so can be constructed from file name or
    file data or data stream.
    """

    @classmethod
    def stream_class_for_name(cls, stream_name):
        return PptStream


class PptStream(record_base.OleRecordStream):
    """ a stream of records in a ppt file """

    def read_record_head(self):
        """ read first few bytes of record to determine size and type

        returns (type, size, other) where other is (instance, version)
        """
        ver_inst, rec_type, rec_size = unpack('
github decalage2 / oletools / oletools / xls_parser.py View on Github external
def parse_xlsb_part(file_stream, _, filename):
    """ Excel xlsb files also have bin files with record structure. iter! """
    xlsb_stream = None
    try:
        xlsb_stream = XlsbStream(file_stream, file_stream.size, filename,
                                 record_base.STGTY_STREAM)
        for record in xlsb_stream.iter_records():
            yield record
    except Exception:
        raise
    finally:
        if xlsb_stream is not None:
            xlsb_stream.close()
github decalage2 / oletools / oletools / xls_parser.py View on Github external
self.support_link_type = self.LINK_TYPE_ADDIN
            # next records must be ExternName with all add-in functions
        elif self.virt_path == u'\u0020':   # space ; ctab can be anything
            self.support_link_type = self.LINK_TYPE_UNUSED
        elif self.virt_path == u'\u0000':
            self.support_link_type = self.LINK_TYPE_SAMESHEET
        elif self.ctab == 0x0 and self.virt_path:
            self.support_link_type = self.LINK_TYPE_OLE_DDE
        elif self.ctab > 0 and self.virt_path:
            self.support_link_type = self.LINK_TYPE_EXTERNAL

    def _type_str(self):
        return 'SupBook Record ({0})'.format(self.support_link_type)


class XlsbRecord(record_base.OleRecordBase):
    """ like an xls record, but from binary part of xlsb file

    has no MAX_SIZE and types have different meanings
    """

    MAX_SIZE = None

    def _type_str(self):
        """ simplification for subclasses to create their own __str__ """
        try:
            return FREQUENT_RECORDS_XLSB[self.type]
        except KeyError:
            return 'XlsbRecord type {0}'.format(self.type)


class XlsbBeginSupBook(XlsbRecord):