Best Python code snippet using Testify_python
pyole.py
Source:pyole.py
...42 43 ole_logger = logging.getLogger('ole.logger')44 def __init__(self):45 pass46 def _raise_exception(self, error):47 #self.ole_logger.error(error)48 self.ole_logger.warning(error)49 raise Exception(error)50 def _filetime_to_datetime(self, microseconds):51 seconds, microseconds = divmod(microseconds/10, 1000000)52 days, seconds = divmod(seconds, 86400)53 date_time = datetime.datetime(1601, 1, 1, 0, 0, 0) + datetime.timedelta(days, seconds, microseconds)54 return str(date_time)55class OLEHeader(OLEBase):56 Signature = ''57 CLSID = ''58 MinorVersion = 059 MajorVersion = 060 ByteOrder = 061 SectorShift = 062 MiniSectorShift = 063 Reserved = ''64 NumberOfDirectorySectors = 065 NumberOfFATSectors = 066 FirstDirecotrySector = 067 TransactionSignatureNumber = 068 MiniStreamCutoffSize = 069 FirstMiniFATSector = 070 NumberOfMiniFATSectors = 071 FirstDIFATSector = 072 NumberOfDIFATSectors = 073 DIFAT = list()74 def __init__(self, data):75 76 self.Signature = ''77 self.CLSID = ''78 self.MinorVersion = 079 self.MajorVersion = 080 self.ByteOrder = 081 self.SectorShift = 082 self.MiniSectorShift = 083 self.Reserved = ''84 self.NumberOfDirectorySectors = 085 self.NumberOfFATSectors = 086 self.FirstDirecotrySector = 087 self.TransactionSignatureNumber = 088 self.MiniStreamCutoffSize = 089 self.FirstMiniFATSector = 090 self.NumberOfMiniFATSectors = 091 self.FirstDIFATSector = 092 self.NumberOfDIFATSectors = 093 self.DIFAT = list()94 95 self.Signature = data[0x00:0x08]96 self.ole_logger.debug('OLEHeader.Signature: ' + self.Signature.encode('hex').upper())97 if self.Signature != '\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1':98 self._raise_exception('OLEHeader.Signature verify failed.')99 100 self.CLSID = data[0x08:0x18]101 self.ole_logger.debug('OLEHeader.CLSID: ' + self.CLSID.encode('hex').upper())102 if self.CLSID != '\x00' * 16:103 self.ole_logger.warning('OLEHeader.CLSID is not null.')104 self.MinorVersion = struct.unpack('<H', data[0x18:0x1A])[0]105 self.ole_logger.debug('OLEHeader.MinorVersion: ' + str(hex(self.MinorVersion)))106 self.MajorVersion = struct.unpack('<H', data[0x1A:0x1C])[0]107 self.ole_logger.debug('OLEHeader.MajorVersion: ' + str(hex(self.MajorVersion)))108 if self.MajorVersion != 0x03 and self.MajorVersion != 0x04:109 self._raise_exception('OLEHeader.MajorVersion has an abnormal value.')110 self.ByteOrder = struct.unpack('<H', data[0x1C:0x1E])[0]111 if self.ByteOrder == 0xFFFE:112 self.ole_logger.debug('OLEHeader.ByteOrder: ' + str(hex(self.ByteOrder)) + ' (little-endian)')113 else:114 self.ole_logger.debug('OLEHeader.ByteOrder: ' + str(hex(self.ByteOrder)))115 self._raise_exception('OLEHeader.ByteOrder has an abnormal value.')116 self.SectorShift = struct.unpack('<H', data[0x1E:0x20])[0]117 if self.SectorShift == 0x09:118 self.ole_logger.debug('OLEHeader.SectorShift: ' + str(hex(self.SectorShift)) + ' (512 bytes)')119 elif self.SectorShift == 0x0C:120 self.ole_logger.debug('OLEHeader.SectorShift: ' + str(hex(self.SectorShift)) + ' (4096 bytes)')121 else:122 self.ole_logger.debug('OLEHeader.SectorShift: ' + str(hex(self.SectorShift)))123 self._raise_exception('OLEHeader.SectorShift has an abnormal value.')124 self.MiniSectorShift = struct.unpack('<H', data[0x20:0x22])[0]125 if self.MiniSectorShift == 0x06:126 self.ole_logger.debug('OLEHeader.MiniSectorShift: ' + str(hex(self.MiniSectorShift)) + ' (64 bytes)')127 else:128 self.ole_logger.debug('OLEHeader.MiniSectorShift: ' + str(hex(self.MiniSectorShift)))129 self._raise_exception('OLEHeader.MiniSectorShift has an abnormal value.')130 self.Reserved = data[0x22:0x28]131 self.ole_logger.debug('OLEHeader.Reserved: ' + self.Reserved.encode('hex').upper())132 if self.Reserved != '\x00' * 6:133 self.ole_logger.warning('OLEHeader.Reserved is not all zeros.')134 self.NumberOfDirectorySectors = struct.unpack('<I', data[0x28:0x2C])[0]135 self.ole_logger.debug('OLEHeader.NumberOfDirectorySectors: ' + str(hex(self.NumberOfDirectorySectors)))136 if self.NumberOfDirectorySectors != 0x0 and self.MajorVersion != 0x04:137 self._raise_exception('OLEHeader.NumberOfDirectorySectors has an abnormal value.')138 139 self.NumberOfFATSectors = struct.unpack('<I', data[0x2C:0x30])[0]140 self.ole_logger.debug('OLEHeader.NumberOfFATSectors: ' + str(hex(self.NumberOfFATSectors)))141 self.FirstDirecotrySector = struct.unpack('<I', data[0x30:0x34])[0]142 self.ole_logger.debug('OLEHeader.FirstDirecotrySector: ' + str(hex(self.FirstDirecotrySector)))143 if self.FirstDirecotrySector == 0:144 self._raise_exception('OLEHeader.FirstDirecotrySector is zero.')145 self.TransactionSignatureNumber = struct.unpack('<I', data[0x34:0x38])[0]146 self.ole_logger.debug('OLEHeader.TransactionSignatureNumber: ' + str(hex(self.TransactionSignatureNumber)))147 self.MiniStreamCutoffSize = struct.unpack('<I', data[0x38:0x3C])[0]148 self.ole_logger.debug('OLEHeader.MiniStreamCutoffSize: ' + str(hex(self.MiniStreamCutoffSize)))149 if self.MiniStreamCutoffSize != 0x1000:150 self._raise_exception('OLEHeader.MiniStreamCutoffSize has an abnormal value.')151 self.FirstMiniFATSector = struct.unpack('<I', data[0x3C:0x40])[0]152 self.ole_logger.debug('OLEHeader.FirstMiniFATSector: ' + str(hex(self.FirstMiniFATSector)))153 self.NumberOfMiniFATSectors = struct.unpack('<I', data[0x40:0x44])[0]154 self.ole_logger.debug('OLEHeader.NumberOfMiniFATSectors: ' + str(hex(self.NumberOfMiniFATSectors)))155 if self.NumberOfMiniFATSectors > 0 and self.FirstMiniFATSector == 0xFFFFFFFE:156 self._raise_exception('OLEHeader.NumberOfMiniFATSectors or OLEHeader.FirstMiniFATSector has an abnormal value.')157 self.FirstDIFATSector = struct.unpack('<I', data[0x44:0x48])[0]158 self.ole_logger.debug('OLEHeader.FirstDIFATSector: ' + str(hex(self.FirstDIFATSector)))159 self.NumberOfDIFATSectors = struct.unpack('<I', data[0x48:0x4C])[0]160 self.ole_logger.debug('OLEHeader.NumberOfDIFATSectors: ' + str(hex(self.NumberOfDIFATSectors)))161 if self.NumberOfDIFATSectors > 0 and self.FirstDIFATSector == 0xFFFFFFFE:162 self._raise_exception('OLEHeader.NumberOfDIFATSectors or OLEHeader.FirstDIFATSector has an abnormal value.')163 164 for i in range(0, 109):165 difat = struct.unpack('<I', data[0x4C+i*4:0x4C+i*4+4])[0]166 if difat == 0xFFFFFFFF:167 break168 self.ole_logger.debug('OLEHeader.DIFAT[' + str(i) + '] :' + str(hex(difat)))169 self.DIFAT.append(difat)170 i += 1171 for j in range(i, 109):172 difat = struct.unpack('<I', data[0x4C+j*4:0x4C+j*4+4])[0]173 if difat != 0xFFFFFFFF:174 self._raise_exception('OLEHeader.DIFAT[' + str(j) + '] has an abnormal value.')175class Directory(OLEBase):176 Name = ''177 NameLength = 0178 ObjectType = 0179 ColorFlag = 0180 LeftSiblingID = 0181 RightSiblingID = 0182 ChildID = 0183 CLSID = ''184 StateBits = 0185 CreationTime = ''186 ModifiedTime = ''187 StartingSector = 0188 StreamSize = 0189 def __init__(self, data):190 191 self.Name = ''192 self.NameLength = 0193 self.ObjectType = 0194 self.ColorFlag = 0195 self.LeftSiblingID = 0196 self.RightSiblingID = 0197 self.ChildID = 0198 self.CLSID = ''199 self.StateBits = 0200 self.CreationTime = ''201 self.ModifiedTime = ''202 self.StartingSector = 0203 self.StreamSize = 0204 self.Name = data[0:0x40].decode('utf-16').strip('\x00')205 self.ole_logger.debug('Dir.Name: ' + self.Name)206 self.NameLength = struct.unpack('<H', data[0x40:0x42])[0]207 self.ole_logger.debug('Dir.NameLength: ' + str(self.NameLength))208 209 if self.NameLength != len(self.Name)*2+2:210 self._raise_exception('DirectoryEntry.NameLength has a wrong value.')211 212 self.ObjectType = ord(data[0x42])213 if self.ObjectType == 0x00: 214 self.ole_logger.debug('Dir.ObjectType: ' + str(self.ObjectType) + ' (unallocated)')215 elif self.ObjectType == 0x01:216 self.ole_logger.debug('Dir.ObjectType: ' + str(self.ObjectType) + ' (storage object)')217 elif self.ObjectType == 0x02:218 self.ole_logger.debug('Dir.ObjectType: ' + str(self.ObjectType) + ' (stream object)')219 elif self.ObjectType == 0x05:220 self.ole_logger.debug('Dir.ObjectType: ' + str(self.ObjectType) + ' (root storage object)')221 else:222 self._raise_exception('DirectoryEntry.ObjectType has an abnormal value.')223 self.ColorFlag = ord(data[0x43])224 if self.ColorFlag == 0x00: 225 self.ole_logger.debug('Dir.ColorFlag: ' + str(self.ColorFlag) + ' (red)')226 elif self.ColorFlag == 0x01:227 self.ole_logger.debug('Dir.ColorFlag: ' + str(self.ColorFlag) + ' (black)')228 else:229 self._raise_exception('DirectoryEntry.ColorFlag has an abnormal value.')230 self.LeftSiblingID = struct.unpack('<I', data[0x44:0x48])[0]231 if self.LeftSiblingID >= 0 and self.LeftSiblingID <= 0xFFFFFFF9:232 self.ole_logger.debug('Dir.LeftSiblingID: ' + str(hex(self.LeftSiblingID)) + ' (REGSID)')233 elif self.LeftSiblingID == 0xFFFFFFFF:234 self.ole_logger.debug('Dir.LeftSiblingID: ' + str(hex(self.LeftSiblingID)) + ' (NOSTREAM)')235 else:236 self._raise_exception('DirectoryEntry.LeftSiblingID has an abnormal value.')237 self.RightSiblingID = struct.unpack('<I', data[0x48:0x4C])[0]238 if self.RightSiblingID >= 0 and self.RightSiblingID <= 0xFFFFFFF9:239 self.ole_logger.debug('Dir.RightSiblingID: ' + str(hex(self.RightSiblingID)) + ' (REGSID)')240 elif self.RightSiblingID == 0xFFFFFFFF:241 self.ole_logger.debug('Dir.LeftSiblingID: ' + str(hex(self.RightSiblingID)) + ' (NOSTREAM)')242 else:243 self._raise_exception('DirectoryEntry.RightSiblingID has an abnormal value.')244 self.ChildID = struct.unpack('<I', data[0x4C:0x50])[0]245 if self.ChildID >= 0 and self.ChildID <= 0xFFFFFFF9:246 self.ole_logger.debug('Dir.ChildID: ' + str(hex(self.ChildID)) + ' (REGSID)')247 elif self.ChildID == 0xFFFFFFFF:248 self.ole_logger.debug('Dir.ChildID: ' + str(hex(self.ChildID)) + ' (NOSTREAM)')249 else:250 self._raise_exception('DirectoryEntry.ChildID has an abnormal value.')251 self.CLSID = data[0x50:0x60]252 self.ole_logger.debug('Dir.CLSID: ' + self.CLSID.encode('hex'))253 self.StateBits = struct.unpack('<I', data[0x60:0x64])[0]254 self.ole_logger.debug('Dir.StateBits: ' + str(hex(self.StateBits)))255 self.CreationTime = struct.unpack('<Q', data[0x64:0x6C])[0]256 self.ole_logger.debug('Dir.CreationTime: ' + self._filetime_to_datetime(self.CreationTime))257 self.ModifiedTime = struct.unpack('<Q', data[0x6C:0x74])[0]258 self.ole_logger.debug('Dir.ModifiedTime: ' + self._filetime_to_datetime(self.ModifiedTime))259 self.StartingSector = struct.unpack('<I', data[0x74:0x78])[0]260 self.ole_logger.debug('Dir.StartingSector: ' + str(hex(self.StartingSector)))261 self.StreamSize = struct.unpack('<Q', data[0x78:0x80])[0]262 self.ole_logger.debug('Dir.StreamSize: ' + str(hex(self.StreamSize)))263class PropertyIdentifierAndOffset(OLEBase):264 PropertyIdentifier = 0265 Offset = 0266 def __init__(self, data):267 self.PropertyIdentifier = 0268 self.Offset = 0269 self.PropertyIdentifier = struct.unpack('<I', data[0:4])[0]270 self.ole_logger.debug('PropertyIdentifierAndOffset.PropertyIdentifier: ' + str(hex(self.PropertyIdentifier)))271 self.Offset = struct.unpack('<I', data[4:8])[0]272 self.ole_logger.debug('PropertyIdentifierAndOffset.Offset: ' + str(hex(self.Offset)))273class DocSummaryInfoPropertySet(OLEBase):274 Size = 0275 NumProperties = 0276 PropertyIdentifierAndOffset = list()277 Property = list()278 def __init__(self, data):279 280 self.Size = 0281 self.NumProperties = 0282 self.PropertyIdentifierAndOffset = list()283 self.Property = list()284 self.Size = struct.unpack('<I', data[0x00:0x04])[0]285 self.ole_logger.debug('DocSummaryInfoPropertySet.Size: ' + str(hex(self.Size)))286 self.NumProperties = struct.unpack('<I', data[0x04:0x08])[0]287 self.ole_logger.debug('DocSummaryInfoPropertySet.NumProperties: ' + str(hex(self.NumProperties)))288 for i in range(0, self.NumProperties):289 piao = PropertyIdentifierAndOffset(data[0x08+i*8:0x08+i*8+8])290 self.PropertyIdentifierAndOffset.append(piao)291 for i in range(0, self.NumProperties):292 if (i+1) < self.NumProperties:293 if self.PropertyIdentifierAndOffset[i].Offset < self.PropertyIdentifierAndOffset[i+1].Offset:294 property = data[self.PropertyIdentifierAndOffset[i].Offset:self.PropertyIdentifierAndOffset[i+1].Offset]295 else:296 self.ole_logger.warning('DocSummaryInfoPropertySet.PropertyIdentifierAndOffset.Offset is not in increasing order.')297 property = data[self.PropertyIdentifierAndOffset[i].Offset:self.Size]298 else:299 property = data[self.PropertyIdentifierAndOffset[i].Offset:self.Size]300 self.Property.append(property)301 302 for i in range(0, self.NumProperties):303 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDDSI['GKPIDDSI_CODEPAGE']:304 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]305 self.ole_logger.debug('Property.GKPIDDSI_CODEPAGE.type: ' + str(hex(type)))306 if type != PropertyType['VT_I2']:307 self._raise_exception('Property.GKPIDDSI_CODEPAGE has an abnormal value.')308 codepage = struct.unpack('<H', self.Property[i][0x04:0x06])[0]309 self.ole_logger.debug('Property.GKPIDDSI_CODEPAGE: ' + str(hex(codepage)))310 continue311 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDDSI['GKPIDDSI_COMPANY']:312 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]313 self.ole_logger.debug('Property.GKPIDDSI_COMPANY.type: ' + str(hex(type)))314 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]315 self.ole_logger.debug('Property.GKPIDDSI_COMPANY.cch: ' + str(hex(cch)))316 if cch > 0x0000FFFF:317 self._raise_exception('Property.GKPIDDSI_COMPANY.cch has an abnormal value.')318 if type == PropertyType['VT_LPSTR']:319 company = self.Property[i][0x08:0x08+cch]320 elif type == PropertyType['VT_LPWSTR']:321 company = self.Property[i][0x08:0x08+cch*2].decode('utf-16')322 else:323 self._raise_exception('Property.GKPIDDSI_COMPANY has an abnormal value.')324 self.ole_logger.debug('Property.GKPIDDSI_COMPANY: ' + company)325 continue326 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDDSI['GKPIDDSI_LINECOUNT']:327 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]328 self.ole_logger.debug('Property.GKPIDDSI_LINECOUNT.type: ' + str(hex(type)))329 if type != PropertyType['VT_I4']:330 self._raise_exception('Property.GKPIDDSI_LINECOUNT has an abnormal value.')331 linecount = struct.unpack('<I', self.Property[i][0x04:0x08])[0]332 self.ole_logger.debug('Property.GKPIDDSI_LINECOUNT: ' + str(hex(linecount)))333 continue334 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDDSI['GKPIDDSI_PARACOUNT']:335 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]336 self.ole_logger.debug('Property.GKPIDDSI_PARACOUNT.type: ' + str(hex(type)))337 if type != PropertyType['VT_I4']:338 self._raise_exception('Property.GKPIDDSI_PARACOUNT has an abnormal value.')339 pagecount = struct.unpack('<I', self.Property[i][0x04:0x08])[0]340 self.ole_logger.debug('Property.GKPIDDSI_PARACOUNT: ' + str(hex(pagecount)))341 continue342 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDDSI['GKPIDDSI_CCHWITHSPACES']:343 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]344 self.ole_logger.debug('Property.GKPIDDSI_CCHWITHSPACES.type: ' + str(hex(type)))345 if type != PropertyType['VT_I4']:346 self._raise_exception('Property.GKPIDDSI_CCHWITHSPACES has an abnormal value.')347 pagecount = struct.unpack('<I', self.Property[i][0x04:0x08])[0]348 self.ole_logger.debug('Property.GKPIDDSI_CCHWITHSPACES: ' + str(hex(pagecount)))349 continue350 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDDSI['GKPIDDSI_VERSION']:351 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]352 self.ole_logger.debug('Property.GKPIDDSI_VERSION.type: ' + str(hex(type)))353 if type != PropertyType['VT_I4']:354 self._raise_exception('Property.GKPIDDSI_VERSION has an abnormal value.')355 minorversion = struct.unpack('<H', self.Property[i][0x04:0x06])[0]356 majorverson= struct.unpack('<H', self.Property[i][0x06:0x08])[0]357 if majorverson == 0:358 self._raise_exception('Property.GKPIDDSI_VERSION.MajorVersion has an abnormal value.')359 self.ole_logger.debug('Property.GKPIDDSI_VERSION.MajorVersion: ' + str(hex(majorverson)))360 self.ole_logger.debug('Property.GKPIDDSI_VERSION.MinorVersion: ' + str(hex(minorversion)))361 continue362 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDDSI['GKPIDDSI_DOCPARTS']:363 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]364 self.ole_logger.debug('Property.GKPIDDSI_DOCPARTS.type: ' + str(hex(type)))365 celements = struct.unpack('<I', self.Property[i][0x04:0x08])[0]366 self.ole_logger.debug('Property.GKPIDDSI_DOCPARTS.vtValue.cElements: ' + str(hex(celements)))367 if type == (PropertyType['VT_VECTOR'] | PropertyType['VT_LPSTR']): 368 offset = 0369 for j in range(0, celements):370 cch = struct.unpack('<I', self.Property[i][0x08+offset:0x0C+offset])[0]371 self.ole_logger.debug('Property.GKPIDDSI_DOCPARTS.vtValue.rgString[' + str(j) + '].cch: ' + str(hex(cch)))372 if cch > 0x0000FFFF:373 self._raise_exception('Property.GKPIDDSI_DOCPARTS.vtValue.rgString[' + str(j) + '].cch has an abnormal value.')374 value = self.Property[i][0x0C+offset:0x0C+offset+cch]375 self.ole_logger.debug('Property.GKPIDDSI_DOCPARTS.vtValue.rgString[' + str(j) + ']: ' + value.encode('hex'))376 offset = offset + 4 + cch377 elif type == (PropertyType['VT_VECTOR'] | PropertyType['VT_LPWSTR']):378 offset = 0379 for j in range(0, celements):380 cch = struct.unpack('<I', self.Property[i][0x08+offset:0x0C+offset])[0]381 self.ole_logger.debug('Property.GKPIDDSI_DOCPARTS.vtValue.rgString[' + str(j) + '].cch: ' + str(hex(cch)))382 if cch > 0x0000FFFF:383 self._raise_exception('Property.GKPIDDSI_DOCPARTS.vtValue.rgString[' + str(j) + '].cch has an abnormal value.')384 value = self.Property[i][0x0C+offset:0x0C+offset+cch*2].decode('utf-16')385 self.ole_logger.debug('Property.GKPIDDSI_DOCPARTS.vtValue.rgString[' + str(j) + ']: ' + value.encode('hex'))386 offset = offset + 4 + cch*2387 else:388 self._raise_exception('Property.GKPIDDSI_DOCPARTS.type has an abnormal value.')389 continue390 391 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDDSI['GKPIDDSI_HEADINGPAIR']:392 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]393 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.type: ' + str(hex(type)))394 if type != (PropertyType['VT_VECTOR'] | PropertyType['VT_VARIANT']):395 self._raise_exception('Property.GKPIDDSI_HEADINGPAIR.type has an abnormal value.')396 celements = struct.unpack('<I', self.Property[i][0x04:0x08])[0]397 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.cElements: ' + str(hex(celements)))398 offset = 0399 for j in range(0, celements/2):400 strtype = struct.unpack('<H', self.Property[i][0x08+offset:0x0A+offset])[0]401 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headingString.type: ' + str(hex(strtype)))402 cch = struct.unpack('<I', self.Property[i][0x0C+offset:0x10+offset])[0]403 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headingString.cch: ' + str(hex(cch)))404 if cch > 0x0000FFFF:405 self._raise_exception('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headingString.cch has an abnormal value.')406 if strtype == PropertyType['VT_LPSTR']:407 value = self.Property[i][0x10+offset:0x10+offset+cch]408 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headingString: ' + value)409 partstype = struct.unpack('<H', self.Property[i][0x10+offset+cch:0x10+offset+cch+0x02])[0]410 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headerParts.type: ' + str(hex(partstype)))411 if partstype != PropertyType['VT_I4']:412 self._raise_exception('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headerParts.type has an abnormal value.')413 parts = struct.unpack('<I', self.Property[i][0x10+offset+cch+0x04:0x10+offset+cch+0x08])[0]414 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headerParts: ' + str(hex(parts)))415 offset = offset + 0x10 + cch416 elif strtype == PropertyType['VT_LPWSTR']:417 value = self.Property[i][0x10+offset:0x10+offset+cch*2].decode('utf-16')418 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headingString: ' + value)419 partstype = struct.unpack('<H', self.Property[i][0x10+offset+cch*2:0x10+offset+cch*2+0x02])[0]420 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headerParts.type: ' + str(hex(partstype)))421 if partstype != PropertyType['VT_I4']:422 self._raise_exception('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headerParts.type has an abnormal value.')423 parts = struct.unpack('<I', self.Property[i][0x10+offset+cch*2+0x04:0x10+offset+cch*2+0x08])[0]424 self.ole_logger.debug('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headerParts: ' + str(hex(parts)))425 offset = offset + 0x10 + cch*2426 else:427 self._raise_exception('Property.GKPIDDSI_HEADINGPAIR.vtValue.rgHeadingPairs[' + str(j) + '].headingString.type has an abnormal value.')428 continue429class DocSummaryInfo(OLEBase):430 byteOrder = 0431 version = 0432 sysId = 0433 OSMajorVersion = 0434 OSMinorVersion = 0435 OSType = 0436 applicationClsid = ''437 cSections = 0438 formatId1 = ''439 sectionOffset1 = 0440 formatId2 = ''441 sectionOffset2 = 0442 DocumentSummaryInfoPropertySet = None443 def __init__(self, data):444 self.byteOrder = 0445 self.version = 0446 self.sysId = 0447 self.OSMajorVersion = 0448 self.OSMinorVersion = 0449 self.OSType = 0450 self.applicationClsid = ''451 self.cSections = 0452 self.formatId1 = ''453 self.sectionOffset1 = 0454 self.formatId2 = ''455 self.sectionOffset2 = 0456 self.DocumentSummaryInfoPropertySet = None457 self.ole_logger.debug('######## DocumentSummaryInfo ########')458 self.byteOrder = struct.unpack('<H', data[0x00:0x02])[0]459 self.ole_logger.debug('DocumentSummaryInfo.byteOrder: ' + str(hex(self.byteOrder)))460 if self.byteOrder != 0xFFFE:461 self._raise_exception('DocumentSummaryInfo.byteOrder has an abnormal value.')462 self.version = struct.unpack('<H', data[0x02:0x04])[0]463 self.ole_logger.debug('DocumentSummaryInfo.version: ' + str(hex(self.version)))464 if self.version != 0 and self.version != 1:465 self._raise_exception('DocumentSummaryInfo.version has an abnormal value.')466 self.sysId = struct.unpack('<I', data[0x04:0x08])[0]467 self.OSMajorVersion = ord(data[0x04])468 self.ole_logger.debug('DocumentSummaryInfo.sysId.OSMajorVersion: ' + str(hex(self.OSMajorVersion)))469 self.OSMinorVersion = ord(data[0x05])470 self.ole_logger.debug('DocumentSummaryInfo.sysId.OSMinorVersion: ' + str(hex(self.OSMinorVersion)))471 self.OSType = struct.unpack('<H', data[0x06:0x08])[0]472 self.ole_logger.debug('DocumentSummaryInfo.sysId.OSType: ' + str(hex(self.OSType)))473 self.applicationClsid = data[0x08:0x18]474 self.ole_logger.debug('DocumentSummaryInfo.applicationClsid: ' + self.applicationClsid.encode('hex'))475 if self.applicationClsid != '\x00' * 0x10:476 self._raise_exception('DocumentSummaryInfo.applicationClsid has an abnormal value.')477 self.cSections = struct.unpack('<I', data[0x18:0x1C])[0]478 self.ole_logger.debug('DocumentSummaryInfo.cSections: ' + str(hex(self.cSections)))479 if self.cSections != 1 and self.cSections != 2:480 self._raise_exception('DocumentSummaryInfo.cSections has an abnormal value.')481 self.formatId1 = data[0x1C:0x2C]482 self.ole_logger.debug('DocumentSummaryInfo.rgIdOffset.IdOffsetElement-1.formatId: ' + self.formatId1.encode('hex'))483 if self.formatId1 != '\x02\xD5\xCD\xD5\x9C\x2E\x1B\x10\x93\x97\x08\x00\x2B\x2C\xF9\xAE':484 self._raise_exception('DocumentSummaryInfo.rgIdOffset.IdOffsetElement-1.formatId has an abnormal value.')485 self.sectionOffset1 = struct.unpack('<I', data[0x2C:0x30])[0]486 self.ole_logger.debug('DocumentSummaryInfo.rgIdOffset.IdOffsetElement-1.sectionOffset: ' + str(hex(self.sectionOffset1)))487 if self.cSections == 2:488 self.formatId2 = data[0x30:0x40]489 self.ole_logger.debug('DocumentSummaryInfo.rgIdOffset.IdOffsetElement-2.formatId: ' + self.formatId2.encode('hex'))490 if self.formatId2 != '\x05\xD5\xCD\xD5\x9C\x2E\x1B\x10\x93\x97\x08\x00\x2B\x2C\xF9\xAE':491 self._raise_exception('DocumentSummaryInfo.rgIdOffset.IdOffsetElement-2.formatId has an abnormal value.')492 self.sectionOffset2 = struct.unpack('<I', data[0x40:0x44])[0]493 self.ole_logger.debug('DocumentSummaryInfo.rgIdOffset.IdOffsetElement-2.sectionOffset: ' + str(hex(self.sectionOffset2)))494 self.DocumentSummaryInfoPropertySet = DocSummaryInfoPropertySet(data[self.sectionOffset1:])495class SummaryInfoPropertySet(OLEBase):496 Size = 0497 NumProperties = 0498 PropertyIdentifierAndOffset = list()499 Property = list()500 def __init__(self, data):501 502 self.Size = 0503 self.NumProperties = 0504 self.PropertyIdentifierAndOffset = list()505 self.Property = list()506 self.Size = struct.unpack('<I', data[0x00:0x04])[0]507 self.ole_logger.debug('SummaryInfoPropertySet.Size: ' + str(hex(self.Size)))508 self.NumProperties = struct.unpack('<I', data[0x04:0x08])[0]509 self.ole_logger.debug('SummaryInfoPropertySet.NumProperties: ' + str(hex(self.NumProperties)))510 for i in range(0, self.NumProperties):511 piao = PropertyIdentifierAndOffset(data[0x08+i*8:0x08+i*8+8])512 self.PropertyIdentifierAndOffset.append(piao)513 for i in range(0, self.NumProperties):514 if (i+1) < self.NumProperties:515 if self.PropertyIdentifierAndOffset[i].Offset < self.PropertyIdentifierAndOffset[i+1].Offset:516 property = data[self.PropertyIdentifierAndOffset[i].Offset:self.PropertyIdentifierAndOffset[i+1].Offset]517 else:518 self.ole_logger.warning('SummaryInfoPropertySet.PropertyIdentifierAndOffset.Offset is not in increasing order.')519 property = data[self.PropertyIdentifierAndOffset[i].Offset:self.Size]520 else:521 property = data[self.PropertyIdentifierAndOffset[i].Offset:self.Size]522 self.Property.append(property)523 524 for i in range(0, self.NumProperties):525 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_CODEPAGE']:526 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]527 self.ole_logger.debug('Property.PIDSI_CODEPAGE.type: ' + str(hex(type)))528 if type != PropertyType['VT_I2']:529 self._raise_exception('Property.PIDSI_CODEPAGE has an abnormal value.')530 codepage = struct.unpack('<H', self.Property[i][0x04:0x06])[0]531 self.ole_logger.debug('Property.PIDSI_CODEPAGE: ' + str(hex(codepage)))532 continue533 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_TITLE']:534 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]535 self.ole_logger.debug('Property.PIDSI_TITLE.type: ' + str(hex(type)))536 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]537 self.ole_logger.debug('Property.PIDSI_TITLE.cch: ' + str(hex(cch)))538 if cch > 0x0000FFFF:539 self._raise_exception('Property.PIDSI_TITLE.cch has an abnormal value.')540 if type == PropertyType['VT_LPSTR']:541 data = self.Property[i][0x08:0x08+cch]542 elif type == PropertyType['VT_LPWSTR']:543 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')544 else:545 self._raise_exception('Property.PIDSI_TITLE has an abnormal value.')546 self.ole_logger.debug('Property.PIDSI_TITLE: ' + data)547 continue548 549 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_SUBJECT']:550 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]551 self.ole_logger.debug('Property.PIDSI_SUBJECT.type: ' + str(hex(type)))552 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]553 self.ole_logger.debug('Property.PIDSI_SUBJECT.cch: ' + str(hex(cch)))554 if cch > 0x0000FFFF:555 self._raise_exception('Property.PIDSI_SUBJECT.cch has an abnormal value.')556 if type == PropertyType['VT_LPSTR']:557 data = self.Property[i][0x08:0x08+cch]558 elif type == PropertyType['VT_LPWSTR']:559 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')560 else:561 self._raise_exception('Property.PIDSI_SUBJECT has an abnormal value.')562 self.ole_logger.debug('Property.PIDSI_SUBJECT: ' + data)563 continue564 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_AUTHOR']:565 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]566 self.ole_logger.debug('Property.PIDSI_AUTHOR.type: ' + str(hex(type)))567 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]568 self.ole_logger.debug('Property.PIDSI_AUTHOR.cch: ' + str(hex(cch)))569 if cch > 0x0000FFFF:570 self._raise_exception('Property.PIDSI_AUTHOR.cch has an abnormal value.')571 if type == PropertyType['VT_LPSTR']:572 data = self.Property[i][0x08:0x08+cch]573 elif type == PropertyType['VT_LPWSTR']:574 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')575 else:576 self._raise_exception('Property.PIDSI_AUTHOR has an abnormal value.')577 self.ole_logger.debug('Property.PIDSI_AUTHOR: ' + data)578 continue579 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_KEYWORDS']:580 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]581 self.ole_logger.debug('Property.PIDSI_KEYWORDS.type: ' + str(hex(type)))582 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]583 self.ole_logger.debug('Property.PIDSI_KEYWORDS.cch: ' + str(hex(cch)))584 if cch > 0x0000FFFF:585 self._raise_exception('Property.PIDSI_KEYWORDS.cch has an abnormal value.')586 if type == PropertyType['VT_LPSTR']:587 data = self.Property[i][0x08:0x08+cch]588 elif type == PropertyType['VT_LPWSTR']:589 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')590 else:591 self._raise_exception('Property.PIDSI_KEYWORDS has an abnormal value.')592 self.ole_logger.debug('Property.PIDSI_KEYWORDS: ' + data)593 continue594 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_COMMENTS']:595 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]596 self.ole_logger.debug('Property.PIDSI_COMMENTS.type: ' + str(hex(type)))597 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]598 self.ole_logger.debug('Property.PIDSI_COMMENTS.cch: ' + str(hex(cch)))599 if cch > 0x0000FFFF:600 self._raise_exception('Property.PIDSI_COMMENTS.cch has an abnormal value.')601 if type == PropertyType['VT_LPSTR']:602 data = self.Property[i][0x08:0x08+cch]603 elif type == PropertyType['VT_LPWSTR']:604 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')605 else:606 self._raise_exception('Property.PIDSI_COMMENTS has an abnormal value.')607 self.ole_logger.debug('Property.PIDSI_COMMENTS: ' + data)608 continue609 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_TEMPLATE']:610 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]611 self.ole_logger.debug('Property.PIDSI_TEMPLATE.type: ' + str(hex(type)))612 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]613 self.ole_logger.debug('Property.PIDSI_TEMPLATE.cch: ' + str(hex(cch)))614 if cch > 0x0000FFFF:615 self._raise_exception('Property.PIDSI_TEMPLATE.cch has an abnormal value.')616 if type == PropertyType['VT_LPSTR']:617 data = self.Property[i][0x08:0x08+cch]618 elif type == PropertyType['VT_LPWSTR']:619 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')620 else:621 self._raise_exception('Property.PIDSI_TEMPLATE has an abnormal value.')622 self.ole_logger.debug('Property.PIDSI_TEMPLATE: ' + data)623 continue624 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_LASTAUTHOR']:625 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]626 self.ole_logger.debug('Property.PIDSI_LASTAUTHOR.type: ' + str(hex(type)))627 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]628 self.ole_logger.debug('Property.PIDSI_LASTAUTHOR.cch: ' + str(hex(cch)))629 if cch > 0x0000FFFF:630 self._raise_exception('Property.PIDSI_LASTAUTHOR.cch has an abnormal value.')631 if type == PropertyType['VT_LPSTR']:632 data = self.Property[i][0x08:0x08+cch]633 elif type == PropertyType['VT_LPWSTR']:634 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')635 else:636 self._raise_exception('Property.PIDSI_LASTAUTHOR has an abnormal value.')637 self.ole_logger.debug('Property.PIDSI_LASTAUTHOR: ' + data)638 continue639 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_REVNUMBER']:640 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]641 self.ole_logger.debug('Property.PIDSI_REVNUMBER.type: ' + str(hex(type)))642 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]643 self.ole_logger.debug('Property.PIDSI_REVNUMBER.cch: ' + str(hex(cch)))644 if cch > 0x0000FFFF:645 self._raise_exception('Property.PIDSI_REVNUMBER.cch has an abnormal value.')646 if type == PropertyType['VT_LPSTR']:647 data = self.Property[i][0x08:0x08+cch]648 elif type == PropertyType['VT_LPWSTR']:649 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')650 else:651 self._raise_exception('Property.PIDSI_REVNUMBER has an abnormal value.')652 self.ole_logger.debug('Property.PIDSI_REVNUMBER: ' + data)653 continue654 655 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_APPNAME']:656 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]657 self.ole_logger.debug('Property.PIDSI_APPNAME.type: ' + str(hex(type)))658 cch = struct.unpack('<I', self.Property[i][0x04:0x08])[0]659 self.ole_logger.debug('Property.PIDSI_APPNAME.cch: ' + str(hex(cch)))660 if cch > 0x0000FFFF:661 self._raise_exception('Property.PIDSI_APPNAME.cch has an abnormal value.')662 if type == PropertyType['VT_LPSTR']:663 data = self.Property[i][0x08:0x08+cch]664 elif type == PropertyType['VT_LPWSTR']:665 data = self.Property[i][0x08:0x08+cch*2].decode('utf-16')666 else:667 self._raise_exception('Property.PIDSI_APPNAME has an abnormal value.')668 self.ole_logger.debug('Property.PIDSI_APPNAME: ' + data)669 continue670 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_EDITTIME']:671 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]672 self.ole_logger.debug('Property.PIDSI_APPNAME.type: ' + str(hex(type)))673 if type != PropertyType['VT_FILETIME']:674 self._raise_exception('Property.PIDSI_EDITTIME has an abnormal value.')675 time = struct.unpack('<Q', self.Property[i][0x04:0x0C])[0]676 self.ole_logger.debug('Property.PIDSI_EDITTIME: ' + str(hex(time)))677 continue678 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_LASTPRINTED']:679 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]680 self.ole_logger.debug('Property.PIDSI_LASTPRINTED.type: ' + str(hex(type)))681 if type != PropertyType['VT_FILETIME']:682 self._raise_exception('Property.PIDSI_LASTPRINTED has an abnormal value.')683 time = struct.unpack('<Q', self.Property[i][0x04:0x0C])[0]684 self.ole_logger.debug('Property.PIDSI_LASTPRINTED: ' + self._filetime_to_datetime(time))685 continue686 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_CREATE_DTM']:687 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]688 self.ole_logger.debug('Property.PIDSI_CREATE_DTM.type: ' + str(hex(type)))689 if type != PropertyType['VT_FILETIME']:690 self._raise_exception('Property.PIDSI_CREATE_DTM has an abnormal value.')691 time = struct.unpack('<Q', self.Property[i][0x04:0x0C])[0]692 self.ole_logger.debug('Property.PIDSI_CREATE_DTM: ' + self._filetime_to_datetime(time))693 continue694 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_LASTSAVE_DTM']:695 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]696 self.ole_logger.debug('Property.PIDSI_LASTSAVE_DTM.type: ' + str(hex(type)))697 if type != PropertyType['VT_FILETIME']:698 self._raise_exception('Property.PIDSI_LASTSAVE_DTM has an abnormal value.')699 time = struct.unpack('<Q', self.Property[i][0x04:0x0C])[0]700 self.ole_logger.debug('Property.PIDSI_LASTSAVE_DTM: ' + self._filetime_to_datetime(time))701 continue702 703 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_PAGECOUNT']:704 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]705 self.ole_logger.debug('Property.PIDSI_PAGECOUNT.type: ' + str(hex(type)))706 if type != PropertyType['VT_I4']:707 self._raise_exception('Property.PIDSI_PAGECOUNT has an abnormal value.')708 count = struct.unpack('<I', self.Property[i][0x04:0x08])[0]709 self.ole_logger.debug('Property.PIDSI_PAGECOUNT: ' + str(hex(count)))710 continue711 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_WORDCOUNT']:712 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]713 self.ole_logger.debug('Property.PIDSI_WORDCOUNT.type: ' + str(hex(type)))714 if type != PropertyType['VT_I4']:715 self._raise_exception('Property.PIDSI_WORDCOUNT has an abnormal value.')716 count = struct.unpack('<I', self.Property[i][0x04:0x08])[0]717 self.ole_logger.debug('Property.PIDSI_WORDCOUNT: ' + str(hex(count)))718 continue719 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_CHARCOUNT']:720 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]721 self.ole_logger.debug('Property.PIDSI_CHARCOUNT.type: ' + str(hex(type)))722 if type != PropertyType['VT_I4']:723 self._raise_exception('Property.PIDSI_CHARCOUNT has an abnormal value.')724 count = struct.unpack('<I', self.Property[i][0x04:0x08])[0]725 self.ole_logger.debug('Property.PIDSI_CHARCOUNT: ' + str(hex(count)))726 continue727 if self.PropertyIdentifierAndOffset[i].PropertyIdentifier == PIDSI['PIDSI_DOC_SECURITY']:728 type = struct.unpack('<H', self.Property[i][0x00:0x02])[0]729 self.ole_logger.debug('Property.PIDSI_DOC_SECURITY.type: ' + str(hex(type)))730 if type != PropertyType['VT_I4']:731 self._raise_exception('Property.PIDSI_DOC_SECURITY has an abnormal value.')732 security = struct.unpack('<I', self.Property[i][0x04:0x08])[0]733 self.ole_logger.debug('Property.PIDSI_DOC_SECURITY: ' + str(hex(security)))734 continue735class SummaryInfo(OLEBase):736 byteOrder = 0737 version = 0738 sysId = 0739 OSMajorVersion = 0740 OSMinorVersion = 0741 OSType = 0742 applicationClsid = ''743 cSections = 0744 formatId1 = ''745 sectionOffset1 = 0746 formatId2 = ''747 sectionOffset2 = 0748 SummaryInfoPropertySet = None749 def __init__(self, data):750 self.byteOrder = 0751 self.version = 0752 self.sysId = 0753 self.OSMajorVersion = 0754 self.OSMinorVersion = 0755 self.OSType = 0756 self.applicationClsid = ''757 self.cSections = 0758 self.formatId1 = ''759 self.sectionOffset1 = 0760 self.formatId2 = ''761 self.sectionOffset2 = 0762 self.SummaryInfoPropertySet = None763 self.ole_logger.debug('######## SummaryInfo ########')764 self.byteOrder = struct.unpack('<H', data[0x00:0x02])[0]765 self.ole_logger.debug('SummaryInfo.byteOrder: ' + str(hex(self.byteOrder)))766 if self.byteOrder != 0xFFFE:767 self._raise_exception('DocumentSummaryInfo.byteOrder has an abnormal value.')768 self.version = struct.unpack('<H', data[0x02:0x04])[0]769 self.ole_logger.debug('SummaryInfo.version: ' + str(hex(self.version)))770 if self.version != 0 and self.version != 1:771 self._raise_exception('SummaryInfo.version has an abnormal value.')772 self.sysId = struct.unpack('<I', data[0x04:0x08])[0]773 self.ole_logger.debug('SummaryInfo.sysId: ' + str(hex(self.sysId)))774 self.clsid = data[0x08:0x18]775 self.ole_logger.debug('SummaryInfo.clsid: ' + self.clsid.encode('hex'))776 if self.clsid != '\x00' * 0x10:777 self._raise_exception('SummaryInfo.clsid has an abnormal value.')778 self.cSections = struct.unpack('<I', data[0x18:0x1C])[0]779 self.ole_logger.debug('SummaryInfo.cSections: ' + str(hex(self.cSections)))780 if self.cSections != 1 and self.cSections != 2:781 self._raise_exception('SummaryInfo.cSections has an abnormal value.')782 self.formatId1 = data[0x1C:0x2C]783 self.ole_logger.debug('SummaryInfo.rgIdOffset.IdOffsetElement-1.formatId: ' + self.formatId1.encode('hex'))784 if self.formatId1 != '\xE0\x85\x9F\xF2\xF9\x4F\x68\x10\xAB\x91\x08\x00\x2B\x27\xB3\xD9':785 self._raise_exception('SummaryInfo.rgIdOffset.IdOffsetElement-1.formatId has an abnormal value.')786 self.sectionOffset1 = struct.unpack('<I', data[0x2C:0x30])[0]787 self.ole_logger.debug('DocumentSummaryInfo.rgIdOffset.IdOffsetElement-1.sectionOffset: ' + str(hex(self.sectionOffset1)))788 if self.cSections == 2:789 self.formatId2 = data[0x30:0x40]790 self.ole_logger.debug('SummaryInfo.rgIdOffset.IdOffsetElement-2.formatId: ' + self.formatId2.encode('hex'))791 if self.formatId2 != '\x05\xD5\xCD\xD5\x9C\x2E\x1B\x10\x93\x97\x08\x00\x2B\x2C\xF9\xAE':792 self._raise_exception('SummaryInfo.rgIdOffset.IdOffsetElement-2.formatId has an abnormal value.')793 self.sectionOffset2 = struct.unpack('<I', data[0x40:0x44])[0]794 self.ole_logger.debug('SummaryInfo.rgIdOffset.IdOffsetElement-2.sectionOffset: ' + str(hex(self.sectionOffset2)))795 self.SummaryInfoPropertySet = SummaryInfoPropertySet(data[self.sectionOffset1:])796class OLEFile(OLEBase):797 file_data = None798 sector_size = 0799 mini_sector_size = 0800 OLEHeader = None801 DIFAT = list()802 FAT = list()803 MiniFAT = list()804 Directory = list()805 SummaryInfo = None806 DocumentSummaryInfo = None807 def __init__(self, filename):808 809 self.file_data = None810 self.sector_size = 0811 self.mini_sector_size = 0812 813 self.OLEHeader = None814 self.DIFAT = list()815 self.FAT = list()816 self.MiniFAT = list()817 self.Directory = list()818 self.SummaryInfo = None819 self.DocumentSummaryInfo = None820 821 822 if os.path.isfile(filename):823 self.file_data = open(filename, 'rb').read()824 self.ole_logger.debug('Load file: ' + filename)825 self.OLEHeader = OLEHeader(self.file_data)826 if self.OLEHeader.SectorShift == 0x09:827 self.sector_size = 512828 elif self.OLEHeader.SectorShift == 0x0C:829 self.sector_size = 4096830 else:831 self._raise_exception('Invalid Sector Size.')832 if self.OLEHeader.MiniSectorShift == 0x06:833 self.mini_sector_size = 64834 else:835 self._raise_exception('Invalid MiniSector Size.')836 self._init_fat_chain()837 838 if self.OLEHeader.NumberOfMiniFATSectors > 0:839 self._init_minifat_chain()840 self._init_dir_entry()841 for i in range(0, len(self.Directory)):842 if self.Directory[i].Name == '\x05SummaryInformation':843 self.SummaryInfo = SummaryInfo(self.find_object_by_index(i))844 if self.Directory[i].Name == '\x05DocumentSummaryInformation':845 self.DocumentSummaryInfo = DocSummaryInfo(self.find_object_by_index(i))846 else:847 self._raise_exception('Invalid file: ' + filename)848 def _init_fat_chain(self):849 self.DIFAT = list(self.OLEHeader.DIFAT)850 if self.OLEHeader.NumberOfDIFATSectors > 0:851 difat_sector_index = self.OLEHeader.FirstDIFATSector852 for i in range(0, self.OLEHeader.NumberOfDIFATSectors):853 difat_sector_offset = (difat_sector_index+1) * self.sector_size854 self.ole_logger.debug('DIFAT sector #' + str(i) + ' at offset: ' + str(hex(difat_sector_offset)))855 for j in range(0, self.sector_size/4-1):856 difat = struct.unpack('<I', self.file_data[difat_sector_offset+j*4:difat_sector_offset+j*4+4])[0]857 if difat == 0xFFFFFFFF:858 if i+1 == self.OLEHeader.NumberOfDIFATSectors:859 break860 else:861 _raise_exception('Encounter an invalid DIFAT value when parsing DIFAT chain.')862 self.ole_logger.debug('DIFT[' + str(len(self.DIFAT)) + ']: ' + str(hex(difat)))863 self.DIFAT.append(difat) 864 difat_sector_index = struct.unpack('<I', self.file_data[difat_sector_offset+j*4:difat_sector_offset+j*4+4])[0]865 866 if len(self.DIFAT) != self.OLEHeader.NumberOfFATSectors:867 self.ole_logger.warn('OLEHeader.NumberOfFATSectors does not mahtch the number of the DIFAT entries.')868 869 for i in range(0, self.OLEHeader.NumberOfFATSectors):870 fat_sector_index = self.DIFAT[i]871 fat_sector_offset = (fat_sector_index+1) * self.sector_size872 self.ole_logger.debug('FAT sector #' + str(i) + ' at offset: ' + str(hex(fat_sector_offset)))873 for j in range(0, self.sector_size/4):874 fat = struct.unpack('<I', self.file_data[fat_sector_offset+j*4:fat_sector_offset+j*4+4])[0]875 self.FAT.append(fat)...
pyvba.py
Source:pyvba.py
...117 self.ole_logger.debug('PROJECTwm.NameMap[' + str(i) + '].MBCS: ' + namemap_mbcs)118 namemap_utf16 = namemaps[i][index+1:]+'\x00'119 self.ole_logger.debug('PROJECTwm.NameMap[' + str(i) + '].UTF16: ' + namemap_utf16)120 else:121 self._raise_exception('PROJECTwm.NameMap[' + str(i) + '] has an abnormal values.')122 else:123 self._raise_exception('PROJECTwm stream contains abnormal values.')124class VBAProject(VBABase):125 Reserved1 = 0126 Version = 0127 Reserved2 = 0128 Reserved3 = 0129 PerformanceCache = ''130 131 def __init__(self, data):132 self.Reserved1 = 0133 self.Version = 0134 self.Reserved2 = 0135 self.Reserved3 = 0136 self.PerformanceCache = ''137 self.ole_logger.debug('######## _VBA_PROJECTStream ########')138 self.Reserved1 = struct.unpack('<H', data[0x00:0x02])[0]139 self.ole_logger.debug('_VBA_PROJECT.Reserved1: ' + str(hex(self.Reserved1)))140 if self.Reserved1 != 0x61CC:141 self._raise_exception('_VBA_PROJECT.Reserved1 has an abnormal values.')142 self.Version = struct.unpack('<H', data[0x02:0x04])[0]143 self.ole_logger.debug('_VBA_PROJECT.Version: ' + str(hex(self.Version)))144 self.Reserved2 = ord(data[0x04])145 self.ole_logger.debug('_VBA_PROJECT.Reserved2: ' + str(hex(self.Reserved2)))146 if self.Reserved2 != 0x00:147 self._raise_exception('_VBA_PROJECT.Reserved2 has an abnormal values.')148 self.Reserved3 = struct.unpack('<H', data[0x05:0x07])[0]149 self.ole_logger.debug('_VBA_PROJECT.Reserved3: ' + str(hex(self.Reserved3)))150 self.PerformanceCache = data[0x07:]151class ProjectSysKindRecord(VBABase):152 Id = 0153 Size = 0154 SysKind = 0155 def __init__(self, data):156 self.Id = 0157 self.Size = 0158 self.SysKind = 0159 self.Id = struct.unpack('<H', data[0x00:0x02])[0]160 self.ole_logger.debug('ProjectSysKindRecord.Id: ' + str(hex(self.Id)))161 if self.Id != 0x01:162 self._raise_exception('ProjectSysKindRecord.Id has an abnormal value.')163 self.Size = struct.unpack('<I', data[0x02:0x06])[0]164 self.ole_logger.debug('ProjectSysKindRecord.Size: ' + str(hex(self.Size)))165 if self.Size != 0x04:166 self._raise_exception('ProjectSysKindRecord.Size has an abnormal value.')167 self.SysKind = struct.unpack('<I', data[0x06:0x0A])[0]168 if self.SysKind == 0x00:169 self.ole_logger.debug('ProjectSysKindRecord.SysKind: ' + str(hex(self.SysKind)) + ' (16-bit Windows Platforms)')170 elif self.SysKind == 0x01:171 self.ole_logger.debug('ProjectSysKindRecord.SysKind: ' + str(hex(self.SysKind)) + ' (32-bit Windows Platforms)')172 elif self.SysKind == 0x02:173 self.ole_logger.debug('ProjectSysKindRecord.SysKind: ' + str(hex(self.SysKind)) + ' (Macintosh Platforms)')174 elif self.SysKind == 0x03:175 self.ole_logger.debug('ProjectSysKindRecord.SysKind: ' + str(hex(self.SysKind)) + ' (64-bit Windows Platforms)')176 else:177 self._raise_exception('ProjectSysKindRecord.SysKind has an abnormal value.')178class ProjectLcidRecord(VBABase):179 180 Id = 0181 Size = 0182 Lcid = 0183 def __init__(self, data):184 self.Id = 0185 self.Size = 0186 self.Lcid = 0187 self.Id = struct.unpack('<H', data[0x00:0x02])[0]188 self.ole_logger.debug('ProjectLcidRecord.Id: ' + str(hex(self.Id)))189 if self.Id != 0x02:190 self._raise_exception('ProjectLcidRecord.Id has an abnormal value.')191 self.Size = struct.unpack('<I', data[0x02:0x06])[0]192 self.ole_logger.debug('ProjectLcidRecord.Size: ' + str(hex(self.Size)))193 if self.Size != 0x04:194 self._raise_exception('ProjectLcidRecord.Size has an abnormal value.')195 self.Lcid = struct.unpack('<I', data[0x06:0x0A])[0]196 self.ole_logger.debug('ProjectLcidRecord.Lcid: ' + str(hex(self.Lcid)))197 if self.Lcid != 0x409:198 self._raise_exception('ProjectLcidRecord.Lcid has an abnormal value.')199class ProjectLcidInvokeRecord(VBABase):200 201 Id = 0202 Size = 0203 LcidInvoke = 0204 def __init__(self, data):205 self.Id = 0206 self.Size = 0207 self.LcidInvoke = 0208 self.Id = struct.unpack('<H', data[0x00:0x02])[0]209 self.ole_logger.debug('ProjectLcidInvokeRecord.Id: ' + str(hex(self.Id)))210 if self.Id != 0x14:211 self._raise_exception('ProjectLcidInvokeRecord.Id has an abnormal value.')212 self.Size = struct.unpack('<I', data[0x02:0x06])[0]213 self.ole_logger.debug('ProjectLcidInvokeRecord.Size: ' + str(hex(self.Size)))214 if self.Size != 0x04:215 self._raise_exception('ProjectLcidInvokeRecord.Size has an abnormal value.')216 self.LcidInvoke = struct.unpack('<I', data[0x06:0x0A])[0]217 self.ole_logger.debug('ProjectLcidInvokeRecord.LcidInvoke: ' + str(hex(self.LcidInvoke)))218 if self.LcidInvoke != 0x409:219 self._raise_exception('ProjectLcidInvokeRecord.LcidInvoke has an abnormal value.')220class ProjectCodePageRecord(VBABase):221 222 Id = 0223 Size = 0224 CodePage = 0225 def __init__(self, data):226 self.Id = 0227 self.Size = 0228 self.CodePage = 0229 self.Id = struct.unpack('<H', data[0x00:0x02])[0]230 self.ole_logger.debug('ProjectCodePageRecord.Id: ' + str(hex(self.Id)))231 if self.Id != 0x03:232 self._raise_exception('ProjectCodePageRecord.Id has an abnormal value.')233 self.Size = struct.unpack('<I', data[0x02:0x06])[0]234 self.ole_logger.debug('ProjectCodePageRecord.Size: ' + str(hex(self.Size)))235 if self.Size != 0x02:236 self._raise_exception('ProjectCodePageRecord.Size has an abnormal value.')237 self.CodePage = struct.unpack('<H', data[0x06:0x08])[0]238 self.ole_logger.debug('ProjectCodePageRecord.CodePage: ' + str(hex(self.CodePage)))239class ProjectNameRecord(VBABase):240 241 Id = 0242 Size = 0243 ProjectName = 0244 def __init__(self, data):245 self.Id = 0246 self.Size = 0247 self.ProjectName = 0248 self.Id = struct.unpack('<H', data[0x00:0x02])[0]249 self.ole_logger.debug('ProjectNameRecord.Id: ' + str(hex(self.Id)))250 if self.Id != 0x04:251 self._raise_exception('ProjectNameRecord.Id has an abnormal value.')252 self.Size = struct.unpack('<I', data[0x02:0x06])[0]253 self.ole_logger.debug('ProjectNameRecord.Size: ' + str(hex(self.Size)))254 if self.Size < 0x01 or self.Size > 0x80:255 self._raise_exception('ProjectNameRecord.Size has an abnormal value.')256 self.ProjectName = data[0x06:0x06+self.Size]257 self.ole_logger.debug('ProjectNameRecord.ProjectName: ' + self.ProjectName)258class ProjectDocStringRecord(VBABase):259 260 Id = 0261 SizeOfDocString = 0262 DocString = ''263 Reserved = 0264 SizeOfDocStringUnicode = 0265 DocStringUnicode = ''266 def __init__(self, data):267 self.Id = 0268 self.SizeOfDocString = 0269 self.DocString = ''270 self.Reserved = 0271 self.SizeOfDocStringUnicode = 0272 self.DocStringUnicode = ''273 self.Id = struct.unpack('<H', data[0x00:0x02])[0]274 self.ole_logger.debug('ProjectDocStringRecord.Id: ' + str(hex(self.Id)))275 if self.Id != 0x05:276 self._raise_exception('ProjectDocStringRecord.Id has an abnormal value.')277 self.SizeOfDocString = struct.unpack('<I', data[0x02:0x06])[0]278 self.ole_logger.debug('ProjectDocStringRecord.SizeOfDocString: ' + str(hex(self.SizeOfDocString)))279 if self.SizeOfDocString > 2000:280 self._raise_exception('ProjectDocStringRecord.SizeOfDocString has an abnormal value.')281 self.DocString = data[0x06:0x06+self.SizeOfDocString]282 self.ole_logger.debug('ProjectDocStringRecord.DocString: ' + self.DocString)283 current = 0x06 + self.SizeOfDocString284 self.Reserved = struct.unpack('<H', data[current:current+0x02])[0]285 self.ole_logger.debug('ProjectDocStringRecord.Reserved: ' + str(hex(self.Reserved)))286 if self.Reserved != 0x40:287 self._raise_exception('ProjectDocStringRecord.Reserved has an abnormal value.')288 current = current + 0x02289 self.SizeOfDocStringUnicode = struct.unpack('<I', data[current:current+0x04])[0]290 self.ole_logger.debug('ProjectDocStringRecord.SizeOfDocStringUnicode: ' + str(hex(self.SizeOfDocStringUnicode)))291 if self.SizeOfDocStringUnicode > 2000*2:292 self._raise_exception('ProjectDocStringRecord.SizeOfDocStringUnicode has an abnormal value.')293 current = current + 0x04294 self.DocStringUnicode = data[current:current+self.SizeOfDocStringUnicode]295 self.ole_logger.debug('ProjectDocStringRecord.DocStringUnicode: ' + self.DocStringUnicode)296class ProjectHelpFilePathRecord(VBABase):297 298 Id = 0299 SizeOfHelpFile1 = 0300 HelpFile1 = ''301 Reserved = 0302 SizeOfHelpFile2 = 0303 HelpFile2 = ''304 def __init__(self, data):305 self.Id = 0306 self.SizeOfHelpFile1 = 0307 self.HelpFile1 = ''308 self.Reserved = 0309 self.SizeOfHelpFile2 = 0310 self.HelpFile2 = ''311 self.Id = struct.unpack('<H', data[0x00:0x02])[0]312 self.ole_logger.debug('ProjectHelpFilePathRecord.Id: ' + str(hex(self.Id)))313 if self.Id != 0x06:314 self._raise_exception('ProjectHelpFilePathRecord.Id has an abnormal value.')315 self.SizeOfHelpFile1 = struct.unpack('<I', data[0x02:0x06])[0]316 self.ole_logger.debug('ProjectHelpFilePathRecord.SizeOfHelpFile1: ' + str(hex(self.SizeOfHelpFile1)))317 if self.SizeOfHelpFile1 > 260:318 self._raise_exception('ProjectHelpFilePathRecord.SizeOfHelpFile1 has an abnormal value.')319 self.HelpFile1 = data[0x06:0x06+self.SizeOfHelpFile1]320 self.ole_logger.debug('ProjectHelpFilePathRecord.HelpFile1: ' + self.HelpFile1)321 current = 0x06 + self.SizeOfHelpFile1322 self.Reserved = struct.unpack('<H', data[current:current+0x02])[0]323 self.ole_logger.debug('ProjectHelpFilePathRecord.Reserved: ' + str(hex(self.Reserved)))324 if self.Reserved != 0x3D:325 self._raise_exception('ProjectHelpFilePathRecord.Reserved has an abnormal value.')326 current = current + 0x02327 self.SizeOfHelpFile2 = struct.unpack('<I', data[current:current+0x04])[0]328 self.ole_logger.debug('ProjectHelpFilePathRecord.SizeOfHelpFile2: ' + str(hex(self.SizeOfHelpFile2)))329 if self.SizeOfHelpFile2 > 260:330 self._raise_exception('ProjectHelpFilePathRecord.SizeOfHelpFile2 has an abnormal value.')331 current = current + 0x04332 self.HelpFile2 = data[current:current+self.SizeOfHelpFile2]333 self.ole_logger.debug('ProjectHelpFilePathRecord.HelpFile2: ' + self.HelpFile2)334class ProjectHelpContextRecord(VBABase):335 336 Id = 0337 Size = 0338 HelpContext = 0339 def __init__(self, data):340 self.Id = 0341 self.Size = 0342 self.HelpContext = 0343 self.Id = struct.unpack('<H', data[0x00:0x02])[0]344 self.ole_logger.debug('ProjectHelpContextRecord.Id: ' + str(hex(self.Id)))345 if self.Id != 0x07:346 self._raise_exception('ProjectHelpContextRecord.Id has an abnormal value.')347 self.Size = struct.unpack('<I', data[0x02:0x06])[0]348 self.ole_logger.debug('ProjectHelpContextRecord.Size: ' + str(hex(self.Size)))349 if self.Size != 0x04:350 self._raise_exception('ProjectHelpContextRecord.Size has an abnormal value.')351 self.HelpContext = struct.unpack('<I', data[0x06:0x0A])[0]352 self.ole_logger.debug('ProjectHelpContextRecord.HelpContext: ' + str(hex(self.HelpContext)))353class ProjectLibFlagsRecord(VBABase):354 355 Id = 0356 Size = 0357 LibFlags = 0358 def __init__(self, data):359 self.Id = 0360 self.Size = 0361 self.LibFlags = 0362 self.Id = struct.unpack('<H', data[0x00:0x02])[0]363 self.ole_logger.debug('ProjectLibFlagsRecord.Id: ' + str(hex(self.Id)))364 if self.Id != 0x8:365 self._raise_exception('ProjectLibFlagsRecord.Id has an abnormal value.')366 self.Size = struct.unpack('<I', data[0x02:0x06])[0]367 self.ole_logger.debug('ProjectLibFlagsRecord.Size: ' + str(hex(self.Size)))368 if self.Size != 0x04:369 self._raise_exception('ProjectLibFlagsRecord.Size has an abnormal value.')370 self.LibFlags = struct.unpack('<I', data[0x06:0x0A])[0]371 self.ole_logger.debug('ProjectLibFlagsRecord.LibFlags: ' + str(hex(self.LibFlags)))372 if self.LibFlags != 0x00:373 self._raise_exception('ProjectLibFlagsRecord.LibFlags has an abnormal value.')374class ProjectVersionRecord(VBABase):375 376 Id = 0377 Size = 0378 MajorVersion = 0379 MinorVersion = 0380 def __init__(self, data):381 self.Id = 0382 self.Reserved = 0383 self.MajorVersion = 0384 self.MinorVersion = 0385 self.Id = struct.unpack('<H', data[0x00:0x02])[0]386 self.ole_logger.debug('ProjectVersionRecord.Id: ' + str(hex(self.Id)))387 if self.Id != 0x9:388 self._raise_exception('ProjectVersionRecord.Id has an abnormal value.')389 self.Reserved = struct.unpack('<I', data[0x02:0x06])[0]390 self.ole_logger.debug('ProjectVersionRecord.Reserved: ' + str(hex(self.Reserved)))391 if self.Reserved != 0x04:392 self._raise_exception('ProjectVersionRecord.Reserved has an abnormal value.')393 self.MajorVersion = struct.unpack('<I', data[0x06:0x0A])[0]394 self.ole_logger.debug('ProjectVersionRecord.MajorVersion: ' + str(hex(self.MajorVersion)))395 self.MinorVersion = struct.unpack('<H', data[0x0A:0x0C])[0]396 self.ole_logger.debug('ProjectVersionRecord.MinorVersion: ' + str(hex(self.MinorVersion)))397class ProjectConstantsRecord(VBABase):398 399 Id = 0400 SizeOfConstants = 0401 Constants = ''402 Reserved = 0403 SizeOfConstantsUnicode = 0404 ConstantsUnicode = ''405 def __init__(self, data):406 self.Id = 0407 self.SizeOfConstants = 0408 self.Constants = ''409 self.Reserved = 0410 self.SizeOfConstantsUnicode = 0411 self.ConstantsUnicode = ''412 self.Id = struct.unpack('<H', data[0x00:0x02])[0]413 self.ole_logger.debug('ProjectConstantsRecord.Id: ' + str(hex(self.Id)))414 if self.Id != 0x0C:415 self._raise_exception('ProjectConstantsRecord.Id has an abnormal value.')416 self.SizeOfConstants = struct.unpack('<I', data[0x02:0x06])[0]417 self.ole_logger.debug('ProjectConstantsRecord.SizeOfConstants: ' + str(hex(self.SizeOfConstants)))418 if self.SizeOfConstants > 1015:419 self._raise_exception('ProjectConstantsRecord.SizeOfConstants has an abnormal value.')420 self.Constants = data[0x06:0x06+self.SizeOfConstants]421 self.ole_logger.debug('ProjectConstantsRecord.Constants: ' + self.Constants)422 current = 0x06 + self.SizeOfConstants423 self.Reserved = struct.unpack('<H', data[current:current+0x02])[0]424 self.ole_logger.debug('ProjectConstantsRecord.Reserved: ' + str(hex(self.Reserved)))425 if self.Reserved != 0x3C:426 self._raise_exception('ProjectConstantsRecord.Reserved has an abnormal value.')427 current = current + 0x02428 self.SizeOfConstantsUnicode = struct.unpack('<I', data[current:current+0x04])[0]429 self.ole_logger.debug('ProjectConstantsRecord.SizeOfConstantsUnicode: ' + str(hex(self.SizeOfConstantsUnicode)))430 if self.SizeOfConstantsUnicode > 1015*2:431 self._raise_exception('ProjectConstantsRecord.SizeOfConstantsUnicode has an abnormal value.')432 current = current + 0x04433 self.ConstantsUnicode = data[current:current+self.SizeOfConstantsUnicode]434 self.ole_logger.debug('ProjectConstantsRecord.ConstantsUnicode: ' + self.ConstantsUnicode)435class ProjectInformationRecord(VBABase):436 SysKindRecord = None437 LcidRecord = None438 LcidInvokeRecord = None439 CodePageRecord = None440 NameRecord = None441 DocStringRecord = None442 HelpFilePathRecord = None443 HelpContextRecord = None444 LibFlagsRecord = None445 VersionRecord = None446 ConstantsRecord = None447 Size = 0448 def __init__(self, data):449 self.SysKindRecord = None450 self.LcidRecord = None451 self.LcidInvokeRecord = None452 self.NameRecord = None453 self.DocStringRecord = None454 self.HelpFilePathRecord = None455 self.HelpContextRecord = None456 self.LibFlagsRecord = None457 self.VersionRecord = None458 self.ConstantsRecord = None459 self.Size = 0460 self.SysKindRecord = ProjectSysKindRecord(data[0x00:0x0A])461 462 self.LcidRecord = ProjectLcidRecord(data[0x0A:0x14])463 464 self.LcidInvokeRecord = ProjectLcidInvokeRecord(data[0x14:0x1E])465 466 self.CodePageRecord = ProjectCodePageRecord(data[0x1E:0x26])467 468 self.NameRecord = ProjectNameRecord(data[0x26:])469 current = 0x26 + 0x06 + self.NameRecord.Size470 self.DocStringRecord = ProjectDocStringRecord(data[current:])471 current = current + 0x0C + self.DocStringRecord.SizeOfDocString + self.DocStringRecord.SizeOfDocStringUnicode472 self.HelpFilePathRecord = ProjectHelpFilePathRecord(data[current:])473 current = current + 0x0C + self.HelpFilePathRecord.SizeOfHelpFile1 + self.HelpFilePathRecord.SizeOfHelpFile2474 self.HelpContextRecord = ProjectHelpContextRecord(data[current:])475 current = current + 0x0A476 self.LibFlagsRecord = ProjectLibFlagsRecord(data[current:])477 current = current + 0x0A478 self.VersionRecord = ProjectVersionRecord(data[current:])479 current = current + 0x0C480 self.ConstantsRecord = ProjectConstantsRecord(data[current:])481 self.Size = current + 0x0C + self.ConstantsRecord.SizeOfConstants + self.ConstantsRecord.SizeOfConstantsUnicode482class ReferenceNameRecord(VBABase):483 Id = 0484 SizeOfName = 0485 Name = ''486 Reserved = 0487 SizeOfNameUnicode = 0488 NameUnicode = ''489 def __init__(self, data):490 self.Id = 0491 self.SizeOfName = 0492 self.Name = ''493 self.Reserved = 0494 self.SizeOfNameUnicode = 0495 self.NameUnicode = ''496 self.Id = struct.unpack('<H', data[0x00:0x02])[0]497 self.ole_logger.debug('ReferenceNameRecord.Id: ' + str(hex(self.Id)))498 if self.Id != 0x16:499 self._raise_exception('ReferenceNameRecord.Id has an abnormal value.')500 self.SizeOfName = struct.unpack('<I', data[0x02:0x06])[0]501 self.ole_logger.debug('ReferenceNameRecord.SizeOfName: ' + str(hex(self.SizeOfName)))502 self.Name = data[0x06:0x06+self.SizeOfName]503 self.ole_logger.debug('ReferenceNameRecord.Name: ' + self.Name)504 current = 0x06 + self.SizeOfName505 self.Reserved = struct.unpack('<H', data[current:current+0x02])[0]506 self.ole_logger.debug('ReferenceNameRecord.Reserved: ' + str(hex(self.Reserved)))507 if self.Reserved != 0x3E:508 self.ole_logger.warn('ReferenceNameRecord.Reserved has an abnormal value.')509 current = current + 0x02510 self.SizeOfNameUnicode = struct.unpack('<I', data[current:current+0x04])[0]511 self.ole_logger.debug('ReferenceNameRecord.SizeOfNameUnicode: ' + str(hex(self.SizeOfNameUnicode)))512 current = current + 0x04513 self.NameUnicode = data[current:current+self.SizeOfNameUnicode]514 self.ole_logger.debug('ReferenceNameRecord.NameUnicode: ' + self.NameUnicode)515class ReferenceOriginalRecord(VBABase):516 Id = 0517 SizeOfLibidOriginal = 0518 LibidOriginal = ''519 def __init__(self, data):520 self.Id = 0521 self.SizeOfLibidOriginal = 0522 self.LibidOriginal = ''523 self.id = struct.unpack('<H', data[0x00:0x02])[0]524 if self.id != 0x33:525 self._raise_exception('ReferenceOriginalRecord.Id has an abnormal value.')526 self.SizeOfLibidOriginal = struct.unpack('<I', data[0x02:0x06])[0]527 self.ole_logger.debug('ReferenceOriginalRecord.SizeOfLibidOriginal: ' + str(hex(self.SizeOfLibidOriginal)))528 self.LibidOriginal = data[0x06:0x06+self.SizeOfLibidOriginal]529 self.ole_logger.debug('ReferenceOriginalRecord.LibidOriginal: ' + self.LibidOriginal)530class ReferenceControlRecord(VBABase):531 OriginalRecord = None532 Id = 0533 SizeTwiddled = 0534 SizeOfLibidTwiddled = 0535 LibidTwiddled = ''536 Reserved1 = 0537 Reserved2 = 0538 NameRecordExtended = None539 Reserved3 = 0540 SizeExtended = 0541 SizeOfLibidExtended = 0542 LibidExtended = ''543 Reserved4 = 0544 Reserved5 = 0545 OriginalTypeLib = ''546 Cookie = 0547 Size = 0548 def __init__(self, data):549 self.OriginalRecord = None550 self.Id = 0551 self.SizeTwiddled = 0552 self.SizeOfLibidTwiddled = 0553 self.LibidTwiddled = ''554 self.Reserved1 = 0555 self.Reserved2 = 0556 self.NameRecordExtended = None557 self.Reserved3 = 0558 self.SizeExtended = 0559 self.SizeOfLibidExtended = 0560 self.LibidExtended = ''561 self.Reserved4 = 0562 self.Reserved5 = 0563 self.OriginalTypeLib = ''564 self.Cookie = 0565 self.Size = 0566 current = 0567 id = struct.unpack('<H', data[current:current+0x02])[0]568 if id == 0x33:569 self.OriginalRecord = ReferenceOriginalRecord(data)570 current = current + 0x06 + self.OriginalRecord.SizeOfLibidOriginal571 self.Id = struct.unpack('<H', data[current:current+0x02])[0]572 self.ole_logger.debug('ReferenceControlRecord.Id: ' + str(hex(self.Id)))573 if self.Id != 0x2F:574 self._raise_exception('ReferenceControlRecord.Id has an abnormal value.')575 current = current + 0x02576 self.SizeTwiddled = struct.unpack('<I', data[current:current+0x04])[0]577 self.ole_logger.debug('ReferenceControlRecord.SizeTwiddled: ' + str(hex(self.SizeTwiddled)))578 current = current + 0x04579 self.SizeOfLibidTwiddled = struct.unpack('<I', data[current:current+0x04])[0]580 self.ole_logger.debug('ReferenceControlRecord.SizeOfLibidTwiddled: ' + str(hex(self.SizeOfLibidTwiddled)))581 current = current + 0x04 582 self.LibidTwiddled = data[current:current+self.SizeOfLibidTwiddled]583 self.ole_logger.debug('ReferenceControlRecord.LibidTwiddled: ' + self.LibidTwiddled)584 current = current + self.SizeOfLibidTwiddled585 self.Reserved1 = struct.unpack('<I', data[current:current+0x04])[0]586 self.ole_logger.debug('ReferenceControlRecord.Reserved1: ' + str(hex(self.Reserved1)))587 if self.Reserved1 != 0x00:588 self._raise_exception('ReferenceControlRecord.Reserved1 has an abnormal value.')589 current = current + 0x04590 self.Reserved2 = struct.unpack('<H', data[current:current+0x02])[0]591 self.ole_logger.debug('ReferenceControlRecord.Reserved2: ' + str(hex(self.Reserved2)))592 if self.Reserved2 != 0x00:593 self._raise_exception('ReferenceControlRecord.Reserved2 has an abnormal value.')594 current = current + 0x02595 id = struct.unpack('<H', data[current:current+0x02])[0]596 if id == 0x16:597 self.NameRecordExtended = ReferenceNameRecord(data[current:])598 current = current + 0x0C + self.NameRecordExtended.SizeOfName + self.NameRecordExtended.SizeOfNameUnicode599 self.Reserved3 = struct.unpack('<H', data[current:current+0x02])[0]600 self.ole_logger.debug('ReferenceControlRecord.Reserved3: ' + str(hex(self.Reserved3)))601 if self.Reserved3 != 0x30:602 self._raise_exception('ReferenceControlRecord.Reserved3 has an abnormal value.')603 current = current + 0x02604 self.SizeExtended = struct.unpack('<I', data[current:current+0x04])[0]605 self.ole_logger.debug('ReferenceControlRecord.SizeExtended: ' + str(hex(self.SizeExtended)))606 current = current + 0x04607 self.SizeOfLibidExtended = struct.unpack('<I', data[current:current+0x04])[0]608 self.ole_logger.debug('ReferenceControlRecord.SizeOfLibidExtended: ' + str(hex(self.SizeOfLibidExtended)))609 current = current + 0x04610 self.LibidExtended = data[current:current+self.SizeOfLibidExtended]611 self.ole_logger.debug('ReferenceControlRecord.LibidExtended: ' + self.LibidExtended)612 current = current + self.SizeOfLibidExtended613 self.Reserved4 = struct.unpack('<I', data[current:current+0x04])[0]614 self.ole_logger.debug('ReferenceControlRecord.Reserved4: ' + str(hex(self.Reserved4)))615 if self.Reserved4 != 0x00:616 self._raise_exception('ReferenceControlRecord.Reserved4 has an abnormal value.')617 current = current + 0x04618 self.Reserved5 = struct.unpack('<H', data[current:current+0x02])[0]619 self.ole_logger.debug('ReferenceControlRecord.Reserved5: ' + str(hex(self.Reserved5)))620 if self.Reserved5 != 0x00:621 self._raise_exception('ReferenceControlRecord.Reserved5 has an abnormal value.')622 current = current + 0x02623 self.OriginalTypeLib = data[current:current+0x10]624 self.ole_logger.debug('ReferenceControlRecord.OriginalTypeLib: ' + self.OriginalTypeLib.encode('hex'))625 current = current + 0x10626 self.Cookie = struct.unpack('<I', data[current:current+0x04])[0]627 self.ole_logger.debug('ReferenceControlRecord.Cookie: ' + str(hex(self.Cookie)))628 self.Size = current + 0x04629class ReferenceRegisteredRecord(VBABase):630 Id = 0631 Size = 0632 SizeOfLibid = 0633 Libid = ''634 Reserved1 = 0635 Reserved2 = 0636 def __init__(self, data):637 self.Id = 0638 self.Size = 0639 self.SizeOfLibid = 0640 self.Libid = ''641 self.Reserved1 = 0642 self.Reserved2 = 0643 current = 0644 self.Id = struct.unpack('<H', data[current:current+0x02])[0]645 self.ole_logger.debug('ReferenceRegisteredRecord.Id: ' + str(hex(self.Id)))646 if self.Id != 0x0D:647 self._raise_exception('ReferenceRegisteredRecord.Id has an abnormal value.')648 current = current + 0x02649 self.Size = struct.unpack('<I', data[current:current+0x04])[0]650 self.ole_logger.debug('ReferenceRegisteredRecord.Size: ' + str(hex(self.Size)))651 current = current + 0x04652 self.SizeOfLibid = struct.unpack('<I', data[current:current+0x04])[0]653 self.ole_logger.debug('ReferenceRegisteredRecord.SizeOfLibid: ' + str(hex(self.SizeOfLibid)))654 current = current + 0x04 655 self.Libid = data[current:current+self.SizeOfLibid]656 self.ole_logger.debug('ReferenceRegisteredRecord.Libid: ' + self.Libid)657 current = current + self.SizeOfLibid658 self.Reserved1 = struct.unpack('<I', data[current:current+0x04])[0]659 self.ole_logger.debug('ReferenceRegisteredRecord.Reserved1: ' + str(hex(self.Reserved1)))660 if self.Reserved1 != 0x00:661 self._raise_exception('ReferenceRegisteredRecord.Reserved1 has an abnormal value.')662 current = current + 0x04663 self.Reserved2 = struct.unpack('<H', data[current:current+0x02])[0]664 self.ole_logger.debug('ReferenceRegisteredRecord.Reserved2: ' + str(hex(self.Reserved2)))665 if self.Reserved2 != 0x00:666 self._raise_exception('ReferenceRegisteredRecord.Reserved2 has an abnormal value.')667class ReferenceProjectRecord(VBABase):668 Id = 0669 Size = 0670 SizeOfLibidAbsolute = 0671 LibidAbsolute = ''672 SizeOfLibidRelative = 0673 LibidRelative = ''674 MajorVersion = 0675 MinorVersion = 0676 def __init__(self, data):677 self.Id = 0678 self.Size = 0679 self.SizeOfLibidAbsolute = 0680 self.LibidAbsolute = ''681 self.SizeOfLibidRelative = 0682 self.LibidRelative = ''683 self.MajorVersion = 0684 self.MinorVersion = 0685 current = 0686 self.Id = struct.unpack('<H', data[current:current+0x02])[0]687 self.ole_logger.debug('ReferenceProjectRecord.Id: ' + str(hex(self.Id)))688 if self.Id != 0x0E:689 self._raise_exception('ReferenceProjectRecord.Id has an abnormal value.')690 current = current + 0x02691 self.Size = struct.unpack('<I', data[current:current+0x04])[0]692 self.ole_logger.debug('ReferenceProjectRecord.Size: ' + str(hex(self.Size)))693 current = current + 0x04694 self.SizeOfLibidAbsolute = struct.unpack('<I', data[current:current+0x04])[0]695 self.ole_logger.debug('ReferenceProjectRecord.SizeOfLibidAbsolute: ' + str(hex(self.SizeOfLibidAbsolute)))696 current = current + 0x04 697 self.LibidAbsolute = data[current:current+self.SizeOfLibidAbsolute]698 self.ole_logger.debug('ReferenceProjectRecord.LibidAbsolute: ' + self.LibidAbsolute)699 current = current + self.SizeOfLibidAbsolute700 self.SizeOfLibidRelative = struct.unpack('<I', data[current:current+0x04])[0]701 self.ole_logger.debug('ReferenceProjectRecord.SizeOfLibidRelative: ' + str(hex(self.SizeOfLibidRelative)))702 current = current + 0x04 703 self.LibidRelative = data[current:current+self.SizeOfLibidRelative]704 self.ole_logger.debug('ReferenceProjectRecord.LibidRelative: ' + self.LibidRelative)705 current = current + self.SizeOfLibidRelative706 self.MajorVersion = struct.unpack('<I', data[current:current+0x04])[0]707 self.ole_logger.debug('ReferenceProjectRecord.MajorVersion: ' + str(hex(self.MajorVersion)))708 current = current + 0x04709 self.MinorVersion = struct.unpack('<H', data[current:current+0x02])[0]710 self.ole_logger.debug('ReferenceProjectRecord.MinorVersion: ' + str(hex(self.MinorVersion)))711class ProjectReferencesRecord(VBABase):712 ReferenceArray = list()713 Size = 0714 def __init__(self, data):715 self.ReferenceArray = list()716 self.Size = 0717 current = 0718 NameRecord = None719 ControlRecord = None720 RegisteredRecord = None721 ProjectRecord = None722 while True:723 id = struct.unpack('<H', data[current:current+2])[0]724 if id == 0x0F:725 self.Size = current726 break727 elif id == 0x16:728 NameRecord = ReferenceNameRecord(data[current:])729 current = current + 0x0C + NameRecord.SizeOfName + NameRecord.SizeOfNameUnicode730 id = struct.unpack('<H', data[current:current+2])[0]731 if id == 0x2F or id == 0x33:732 ControlRecord = ReferenceControlRecord(data[current:])733 current = current + ControlRecord.Size734 self.ReferenceArray.append([NameRecord, ControlRecord])735 elif id == 0x0D:736 RegisteredRecord = ReferenceRegisteredRecord(data[current:])737 current = current + 0x06 + RegisteredRecord.Size738 self.ReferenceArray.append([NameRecord, RegisteredRecord])739 elif id == 0x0E:740 ProjectRecord = ReferenceProjectRecord(data[current:])741 current = current + 0x06 + ProjectRecord.Size742 self.ReferenceArray.append([NameRecord, ProjectRecord])743 744 else:745 self.ole_logger.warn('ReferencesRecord.Id has an abnormal value.')746 elif id == 0x2F or id == 0x33:747 ControlRecord = ReferenceControlRecord(data[current:])748 current = current + ControlRecord.Size749 self.ReferenceArray.append([None, ControlRecord])750 elif id == 0x0D:751 RegisteredRecord = ReferenceRegisteredRecord(data[current:])752 current = current + 0x06 + RegisteredRecord.Size753 self.ReferenceArray.append([None, RegisteredRecord])754 elif id == 0x0E:755 ProjectRecord = ReferenceProjectRecord(data[current:])756 current = current + 0x06 + ProjectRecord.Size757 self.ReferenceArray.append([None, ProjectRecord])758 759 else:760 self._raise_exception('ReferencesRecord.Id has an abnormal value.')761class ProjectCookieRecord(VBABase):762 763 Id = 0764 Size = 0765 Cookie = 0766 def __init__(self, data):767 self.Id = 0768 self.Size = 0769 self.CodePage = 0770 self.Id = struct.unpack('<H', data[0x00:0x02])[0]771 self.ole_logger.debug('ProjectCookieRecord.Id: ' + str(hex(self.Id)))772 if self.Id != 0x13:773 self._raise_exception('ProjectCookieRecord.Id has an abnormal value.')774 self.Size = struct.unpack('<I', data[0x02:0x06])[0]775 self.ole_logger.debug('ProjectCookieRecord.Size: ' + str(hex(self.Size)))776 if self.Size != 0x02:777 self._raise_exception('ProjectCookieRecord.Size has an abnormal value.')778 self.Cookie = struct.unpack('<H', data[0x06:0x08])[0]779 self.ole_logger.debug('ProjectCookieRecord.Cookie: ' + str(hex(self.Cookie)))780class ModuleNameRecord(VBABase):781 Id = 0782 SizeOfModuleName = 0783 ModuleName = ''784 def __init__(self, data):785 self.Id = 0786 self.SizeOfModuleName = 0787 self.ModuleName = ''788 self.Id = struct.unpack('<H', data[0x00:0x02])[0]789 self.ole_logger.debug('ModuleNameRecord.Id: ' + str(hex(self.Id)))790 if self.Id != 0x19:791 self._raise_exception('ModuleNameRecord.Id has an abnormal value.')792 self.SizeOfModuleName = struct.unpack('<I', data[0x02:0x06])[0]793 self.ole_logger.debug('ModuleNameRecord.Size: ' + str(hex(self.SizeOfModuleName)))794 self.ModuleName = data[0x06:0x06+self.SizeOfModuleName]795 self.ole_logger.debug('ModuleNameRecord.ModuleName: ' + self.ModuleName)796class ModuleNameUnicodeRecord(VBABase):797 Id = 0798 SizeOfModuleNameUnicode = 0799 ModuleNameUnicode = ''800 def __init__(self, data):801 self.Id = 0802 self.SizeOfModuleName = 0803 self.ModuleNameUnicode = ''804 self.Id = struct.unpack('<H', data[0x00:0x02])[0]805 self.ole_logger.debug('ModuleNameUnicodeRecord.Id: ' + str(hex(self.Id)))806 if self.Id != 0x47:807 self._raise_exception('ModuleNameUnicodeRecord.Id has an abnormal value.')808 self.SizeOfModuleNameUnicode = struct.unpack('<I', data[0x02:0x06])[0]809 self.ole_logger.debug('ModuleNameUnicodeRecord.SizeOfModuleNameUnicode: ' + str(hex(self.SizeOfModuleNameUnicode)))810 self.ModuleNameUnicode = data[0x06:0x06+self.SizeOfModuleNameUnicode]811 self.ole_logger.debug('ModuleNameUnicodeRecord.ModuleName: ' + self.ModuleNameUnicode)812class ModuleStreamNameRecord(VBABase):813 814 Id = 0815 SizeOfStreamName = 0816 StreamName = ''817 Reserved = 0818 SizeOfStreamNameUnicode = 0819 StreamNameUnicode = ''820 def __init__(self, data):821 self.Id = 0822 self.SizeOfStreamName = 0823 self.StreamName = ''824 self.Reserved = 0825 self.SizeOfStreamNameUnicode = 0826 self.StreamNameUnicode = ''827 self.Id = struct.unpack('<H', data[0x00:0x02])[0]828 self.ole_logger.debug('ModuleStreamNameRecord.Id: ' + str(hex(self.Id)))829 if self.Id != 0x1A:830 self._raise_exception('ModuleStreamNameRecord.Id has an abnormal value.')831 self.SizeOfStreamName = struct.unpack('<I', data[0x02:0x06])[0]832 self.ole_logger.debug('ModuleStreamNameRecord.SizeOfStreamName: ' + str(hex(self.SizeOfStreamName)))833 self.StreamName = data[0x06:0x06+self.SizeOfStreamName]834 self.ole_logger.debug('ModuleStreamNameRecord.StreamName: ' + self.StreamName)835 current = 0x06 + self.SizeOfStreamName836 self.Reserved = struct.unpack('<H', data[current:current+0x02])[0]837 self.ole_logger.debug('ModuleStreamNameRecord.Reserved: ' + str(hex(self.Reserved)))838 if self.Reserved != 0x32:839 self._raise_exception('ModuleStreamNameRecord.Reserved has an abnormal value.')840 current = current + 0x02841 self.SizeOfStreamNameUnicode = struct.unpack('<I', data[current:current+0x04])[0]842 self.ole_logger.debug('ModuleStreamNameRecord.SizeOfStreamNameUnicode: ' + str(hex(self.SizeOfStreamNameUnicode)))843 current = current + 0x04844 self.StreamNameUnicode = data[current:current+self.SizeOfStreamNameUnicode]845 self.ole_logger.debug('ModuleStreamNameRecord.StreamNameUnicode: ' + self.StreamNameUnicode)846class ModuleDocStringRecord(VBABase):847 848 Id = 0849 SizeOfDocString = 0850 DocString = ''851 Reserved = 0852 SizeOfDocStringUnicode = 0853 DocStringUnicode = ''854 def __init__(self, data):855 self.Id = 0856 self.SizeOfDocString = 0857 self.DocString = ''858 self.Reserved = 0859 self.SizeOfDocStringUnicode = 0860 self.DocStringUnicode = ''861 self.Id = struct.unpack('<H', data[0x00:0x02])[0]862 self.ole_logger.debug('ModuleDocStringRecord.Id: ' + str(hex(self.Id)))863 if self.Id != 0x1C:864 self._raise_exception('ModuleDocStringRecord.Id has an abnormal value.')865 self.SizeOfDocString = struct.unpack('<I', data[0x02:0x06])[0]866 self.ole_logger.debug('ModuleDocStringRecord.SizeOfDocString: ' + str(hex(self.SizeOfDocString)))867 self.DocString = data[0x06:0x06+self.SizeOfDocString]868 self.ole_logger.debug('ModuleDocStringRecord.DocString: ' + self.DocString)869 current = 0x06 + self.SizeOfDocString870 self.Reserved = struct.unpack('<H', data[current:current+0x02])[0]871 self.ole_logger.debug('ModuleDocStringRecord.Reserved: ' + str(hex(self.Reserved)))872 if self.Reserved != 0x48:873 self._raise_exception('ModuleDocStringRecord.Reserved has an abnormal value.')874 current = current + 0x02875 self.SizeOfDocStringUnicode = struct.unpack('<I', data[current:current+0x04])[0]876 self.ole_logger.debug('ModuleDocStringRecord.SizeOfDocStringUnicode: ' + str(hex(self.SizeOfDocStringUnicode)))877 current = current + 0x04878 self.DocStringUnicode = data[current:current+self.SizeOfDocStringUnicode]879 self.ole_logger.debug('ModuleDocStringRecord.DocStringUnicode: ' + self.DocStringUnicode) 880class ModuleOffsetRecord(VBABase):881 882 Id = 0883 Size = 0884 TextOffset = 0885 def __init__(self, data):886 self.Id = 0887 self.Size = 0888 self.TextOffset = 0889 self.Id = struct.unpack('<H', data[0x00:0x02])[0]890 self.ole_logger.debug('ModuleOffsetRecord.Id: ' + str(hex(self.Id)))891 if self.Id != 0x31:892 self._raise_exception('ModuleOffsetRecord.Id has an abnormal value.')893 self.Size = struct.unpack('<I', data[0x02:0x06])[0]894 self.ole_logger.debug('ModuleOffsetRecord.Size: ' + str(hex(self.Size)))895 if self.Size != 0x04:896 self._raise_exception('ModuleOffsetRecord.Size has an abnormal value.')897 self.TextOffset = struct.unpack('<I', data[0x06:0x0A])[0]898 self.ole_logger.debug('ModuleOffsetRecord.TextOffset: ' + str(hex(self.TextOffset))) 899class ModuleHelpContextRecord(VBABase):900 901 Id = 0902 Size = 0903 HelpContext = 0904 def __init__(self, data):905 self.Id = 0906 self.Size = 0907 self.HelpContext = 0908 self.Id = struct.unpack('<H', data[0x00:0x02])[0]909 self.ole_logger.debug('ModuleHelpContextRecord.Id: ' + str(hex(self.Id)))910 if self.Id != 0x1E:911 self._raise_exception('ModuleHelpContextRecord.Id has an abnormal value.')912 self.Size = struct.unpack('<I', data[0x02:0x06])[0]913 self.ole_logger.debug('ModuleHelpContextRecord.Size: ' + str(hex(self.Size)))914 if self.Size != 0x04:915 self._raise_exception('ModuleHelpContextRecord.Size has an abnormal value.')916 self.HelpContext = struct.unpack('<I', data[0x06:0x0A])[0]917 self.ole_logger.debug('ModuleHelpContextRecord.HelpContext: ' + str(hex(self.HelpContext))) 918class ModuleCookieRecord(VBABase):919 920 Id = 0921 Size = 0922 Cookie = 0923 def __init__(self, data):924 self.Id = 0925 self.Size = 0926 self.Cookie = 0927 self.Id = struct.unpack('<H', data[0x00:0x02])[0]928 self.ole_logger.debug('ModuleCookieRecord.Id: ' + str(hex(self.Id)))929 if self.Id != 0x2C:930 self._raise_exception('ModuleCookieRecord.Id has an abnormal value.')931 self.Size = struct.unpack('<I', data[0x02:0x06])[0]932 self.ole_logger.debug('ModuleCookieRecord.Size: ' + str(hex(self.Size)))933 if self.Size != 0x02:934 self._raise_exception('ModuleCookieRecord.Size has an abnormal value.')935 self.Cookie = struct.unpack('<H', data[0x06:0x08])[0]936 self.ole_logger.debug('ModuleCookieRecord.Cookie: ' + str(hex(self.Cookie))) 937class ModuleTypeRecord(VBABase):938 939 Id = 0940 Reserved = 0941 def __init__(self, data):942 self.Id = 0943 self.Size = 0944 self.Id = struct.unpack('<H', data[0x00:0x02])[0]945 self.ole_logger.debug('ModuleTypeRecord.Id: ' + str(hex(self.Id)))946 if self.Id != 0x21 and self.Id != 0x22:947 self._raise_exception('ModuleTypeRecord.Id has an abnormal value.')948 self.Reserved = struct.unpack('<I', data[0x02:0x06])[0]949 self.ole_logger.debug('ModuleTypeRecord.Reserved: ' + str(hex(self.Reserved)))950 if self.Reserved != 0x00:951 self._raise_exception('ModuleTypeRecord.Reserved has an abnormal value.')952class ModuleReadOnlyRecord(VBABase):953 954 Id = 0955 Reserved = 0956 def __init__(self, data):957 self.Id = 0958 self.Size = 0959 self.Id = struct.unpack('<H', data[0x00:0x02])[0]960 self.ole_logger.debug('ModuleReadOnlyRecord.Id: ' + str(hex(self.Id)))961 if self.Id != 0x25:962 self._raise_exception('ModuleReadOnlyRecord.Id has an abnormal value.')963 self.Reserved = struct.unpack('<I', data[0x02:0x06])[0]964 self.ole_logger.debug('ModuleReadOnlyRecord.Reserved: ' + str(hex(self.Reserved)))965 if self.Reserved != 0x00:966 self._raise_exception('ModuleReadOnlyRecord.Reserved has an abnormal value.')967class ModulePrivateRecord(VBABase):968 969 Id = 0970 Reserved = 0971 def __init__(self, data):972 self.Id = 0973 self.Size = 0974 self.Id = struct.unpack('<H', data[0x00:0x02])[0]975 self.ole_logger.debug('ModulePrivateRecord.Id: ' + str(hex(self.Id)))976 if self.Id != 0x28:977 self._raise_exception('ModulePrivateRecord.Id has an abnormal value.')978 self.Reserved = struct.unpack('<I', data[0x02:0x06])[0]979 self.ole_logger.debug('ModulePrivateRecord.Reserved: ' + str(hex(self.Reserved)))980 if self.Reserved != 0x00:981 self._raise_exception('ModulePrivateRecord.Reserved has an abnormal value.')982class ModuleRecord(VBABase):983 NameRecord = None984 NameUnicodeRecord = None985 StreamNameRecord = None986 DocStringRecord = None987 OffsetRecord = None988 HelpContextRecord = None989 CookieRecord = None990 TypeRecord = None991 ReadOnlyRecord = None992 PrivateRecord = None993 Terminator = 0994 Reserved = 0995 Size = 0996 997 def __init__(self, data):998 self.NameRecord = None999 self.NameUnicodeRecord = None1000 self.StreamNameRecord = None1001 self.DocStringRecord = None1002 self.OffsetRecord = None1003 self.HelpContextRecord = None1004 self.CookieRecord = None1005 self.TypeRecord = None1006 self.ReadOnlyRecord = None1007 self.PrivateRecord = None1008 self.Terminator = 01009 self.Reserved = 01010 self.Size = 01011 current = 01012 self.NameRecord = ModuleNameRecord(data)1013 current = current + 0x06 + self.NameRecord.SizeOfModuleName1014 self.NameUnicodeRecord = ModuleNameUnicodeRecord(data[current:])1015 current = current + 0x06 + self.NameUnicodeRecord.SizeOfModuleNameUnicode1016 self.StreamNameRecord = ModuleStreamNameRecord(data[current:])1017 current = current + 0x0C + self.StreamNameRecord.SizeOfStreamName + self.StreamNameRecord.SizeOfStreamNameUnicode1018 self.DocStringRecord = ModuleDocStringRecord(data[current:])1019 current = current + 0x0C + self.DocStringRecord.SizeOfDocString + self.DocStringRecord.SizeOfDocStringUnicode1020 self.OffsetRecord = ModuleOffsetRecord(data[current:current+0x0A])1021 current = current + 0x0A1022 self.HelpContextRecord = ModuleHelpContextRecord(data[current:current+0x0A])1023 current = current + 0x0A1024 self.CookieRecord = ModuleCookieRecord(data[current:current+0x08])1025 current = current + 0x081026 self.TypeRecord = ModuleTypeRecord(data[current:current+0x06])1027 while True:1028 current = current + 0x061029 id = struct.unpack('<H', data[current:current+0x02])[0]1030 if id == 0x25:1031 self.ReadOnlyRecord = ModuleReadOnlyRecord(data[current:current+0x06])1032 elif id == 0x28:1033 self.PrivateRecord = ModulePrivateRecord(data[current:current+0x06])1034 elif id == 0x2B:1035 self.Terminator = struct.unpack('<H', data[current:current+0x02])[0]1036 break1037 else:1038 self._raise_exception('ModuleRecord contains an abnormal record id.')1039 current = current + 0x021040 self.Reserved = struct.unpack('<I', data[current:current+0x04])[0]1041 if self.Size != 0x00:1042 self._raise_exception('ModuleRecord.Reserved has an abnormal value.')1043 1044 self.Size = current + 0x041045class ProjectModulesRecord(VBABase):1046 Id = 01047 Size = 01048 Count = 01049 CookieRecord = None1050 ModuleArray = list()1051 def __init__(self, data):1052 self.Id = 01053 self.Size = 01054 self.Count = 01055 self.CookieRecord = None1056 self.ModuleArray = list()1057 self.Id = struct.unpack('<H', data[0x00:0x02])[0]1058 self.ole_logger.debug('ModulesRecord.Id: ' + str(hex(self.Id)))1059 if self.Id != 0x0F:1060 self._raise_exception('ModulesRecord.Id has an abnormal value.')1061 self.Size = struct.unpack('<I', data[0x02:0x06])[0]1062 self.ole_logger.debug('ModulesRecord.Size: ' + str(hex(self.Size)))1063 if self.Size != 0x02:1064 self._raise_exception('ModulesRecord.Size has an abnormal value.')1065 1066 self.Count = struct.unpack('<H', data[0x06:0x08])[0]1067 self.ole_logger.debug('ModulesRecord.Count: ' + str(hex(self.Count)))1068 self.CookieRecord = ProjectCookieRecord(data[0x08:0x10])1069 current = 0x101070 for i in range(0, self.Count):1071 Module = ModuleRecord(data[current:])1072 self.ModuleArray.append(Module)1073 current = current + Module.Size1074 1075 1076class DirStream(VBABase):1077 InformationRecord = None1078 ReferencesRecord = None1079 ModulesRecord = None1080 def __init__(self, data):1081 self.InformationRecord = None1082 self.ReferencesRecord = None1083 self.ModulesRecord = None1084 1085 self.ole_logger.debug('######## dirStream ########')1086 1087 data = self._decompress(data)1088 self.InformationRecord = ProjectInformationRecord(data)1089 current = self.InformationRecord.Size1090 self.ReferencesRecord = ProjectReferencesRecord(data[current:])1091 current = current + self.ReferencesRecord.Size1092 self.ModulesRecord = ProjectModulesRecord(data[current:])1093class VBAFile(VBABase):1094 OLE = None1095 PROJECT = None1096 PROJECTwm = None1097 VBA_PROJECT = None1098 dir = None1099 def __init__(self, filename):1100 self.OLE = None1101 self.PROJECT = None1102 self.PROJECTwm = None1103 self.VBA_PROJECT = None1104 self.dir = None1105 self.OLE = OLEFile(filename)1106 project_data = self.OLE.find_object_by_name('PROJECT')1107 if project_data is not None:1108 self.PROJECT = ProjectStream(project_data)1109 else:1110 self.ole_logger.warn('VBA project does not contain the PROJECT stream.')1111 1112 projectwm_data = self.OLE.find_object_by_name('PROJECTwm')1113 if projectwm_data is not None:1114 self.PROJECTwm = Projectwm(projectwm_data)1115 1116 vba_project_data = self.OLE.find_object_by_name('_VBA_PROJECT')1117 if vba_project_data is not None:1118 self.VBA_PROJECT = VBAProject(vba_project_data)1119 else:1120 self.ole_logger.warn('VBA project does not contain the _VBA_PROJECT stream.')1121 dir_data = self.OLE.find_object_by_name('dir')1122 if dir_data is not None:1123 self.dir = DirStream(dir_data)1124 else:1125 self._raise_exception('VBA project does not contain the dir stream.')1126if __name__ == '__main__':1127 init_logging(True)1128 #init_logging(False)1129 try:1130 vba = VBAFile('oletest1.doc')1131 except Exception as e:...
test_traceback.py
Source:test_traceback.py
1# Licensed to the .NET Foundation under one or more agreements.2# The .NET Foundation licenses this file to you under the Apache 2.0 License.3# See the LICENSE file in the project root for more information.4# !!! DO NOT MOVE OR CHANGE THE FOLLOWING LINES5def _raise_exception():6 raise Exception()7_retb = (18, 0, 'test_traceback.py', '_raise_exception')8from iptest.assert_util import *9from iptest.file_util import *10if not is_cli: import os11def _raise_exception_with_finally():12 try:13 raise Exception()14 finally:15 pass16_rewftb= (27, 0, 'test_traceback.py', '_raise_exception_with_finally')17def assert_traceback(expected):18 import sys19 tb = sys.exc_info()[2]20 21 if expected is None:22 AreEqual(None, expected)23 else:24 tb_list = []25 while tb is not None :26 f = tb.tb_frame27 co = f.f_code28 filename = co.co_filename.lower()29 name = co.co_name30 tb_list.append((tb.tb_lineno, tb.tb_lasti, filename, name))31 tb = tb.tb_next32 33 #print tb_list34 35 AreEqual(len(tb_list), len(expected))36 37 for x in range(len(expected)):38 AreEqual(tb_list[x][0], expected[x][0])39 AreEqual(tb_list[x][2:], expected[x][2:])40 41def test_no_traceback():42 #assert_traceback(None)43 try:44 _raise_exception()45 except:46 pass47 assert_traceback(None)48FILE="test_traceback.py"49LINE100 = 7050def test_catch_others_exception():51 try:52 _raise_exception()53 except:54 assert_traceback([(LINE100 + 2, 0, FILE, 'test_catch_others_exception'), _retb])55LINE110 = 7856def test_catch_its_own_exception():57 try:58 raise Exception()59 except:60 assert_traceback([(LINE110 + 2, 0, FILE, 'test_catch_its_own_exception')])61LINE120 = 8662def test_catch_others_exception_with_finally():63 try:64 _raise_exception_with_finally()65 except:66 assert_traceback([(LINE120 + 2, 0, FILE, 'test_catch_others_exception_with_finally'), _rewftb])67LINE130 = 9468def test_nested_caught_outside():69 try:70 x = 271 try:72 _raise_exception()73 except NameError:74 Assert(False, "unhittable")75 y = 276 except:77 assert_traceback([(LINE130 + 4, 0, FILE, 'test_nested_caught_outside'), _retb])78LINE140 = 10879def test_nested_caught_inside():80 try:81 x = 282 try:83 _raise_exception()84 except:85 assert_traceback([(LINE140 + 4, 0, FILE, 'test_nested_caught_inside'), _retb])86 y = 287 except:88 assert_traceback(None)89LINE150 = 12090def test_throw_in_except():91 try:92 _raise_exception()93 except:94 assert_traceback([(LINE150+2, 0, FILE, 'test_throw_in_except'), _retb])95 try:96 assert_traceback([(LINE150+2, 0, FILE, 'test_throw_in_except'), _retb])97 _raise_exception()98 except:99 assert_traceback([(LINE150+7, 0, FILE, 'test_throw_in_except'), _retb])100 assert_traceback([(LINE150+7, 0, FILE, 'test_throw_in_except'), _retb])101LINE160 = 134102class C1:103 def M(self):104 try:105 _raise_exception()106 except:107 assert_traceback([(LINE160 + 3, 0, FILE, 'M'), _retb])108def test_throw_in_method():109 c = C1()110 c.M()111LINE170 = 147112def test_throw_when_defining_class():113 class C2(object):114 try:115 _raise_exception()116 except:117 assert_traceback([(LINE170 + 3, 0, FILE, 'C2'), _retb])118def throw_when_defining_class_directly():119 class C3(C1):120 _raise_exception()121LINE180 = 160122def test_throw_when_defining_class_directly():123 try:124 throw_when_defining_class_directly()125 except:126 assert_traceback([(LINE180 + 2, 0, FILE, 'test_throw_when_defining_class_directly'),127 (LINE180 - 5, 0, FILE, 'throw_when_defining_class_directly'),128 (LINE180 - 4, 0, FILE, 'C3'), _retb])129LINE200 = 169130def test_compiled_code():131 try:132 codeobj = compile('\nraise Exception()', '<mycode>', 'exec')133 exec(codeobj, {})134 except:135 assert_traceback([(LINE200+3, 0, FILE, 'test_compiled_code'), (2, 0, '<mycode>', '<module>')])136def generator_throw_before_yield():137 _raise_exception()138 yield 1139 140LINE210 = 181141def test_throw_before_yield():142 try:143 for x in generator_throw_before_yield():144 pass145 except:146 assert_traceback([(LINE210+3, 0, FILE, 'test_throw_before_yield'), (LINE210-4, 2, 'test_traceback.py', 'generator_throw_before_yield'), _retb])147def generator_throw_after_yield():148 yield 1149 _raise_exception()150LINE220 = 194151def test_throw_while_yield():152 try:153 for x in generator_throw_while_yield():154 pass155 except:156 assert_traceback([(LINE220+3, 0, FILE, 'test_throw_while_yield')])157def generator_yield_inside_try():158 try:159 yield 1160 yield 2161 _raise_exception()162 except NameError:163 pass164LINE230 = 211165def test_yield_inside_try():166 try:167 for x in generator_yield_inside_try():168 pass169 except:170 assert_traceback([(LINE230+3, 0, FILE, 'test_yield_inside_try'), (LINE230-5, 2, 'test_traceback.py', 'generator_yield_inside_try'), _retb])171LINE240 = 221172def test_throw_and_throw():173 try:174 _raise_exception()175 except:176 assert_traceback([(LINE240 + 2, 0, FILE, 'test_throw_and_throw'), _retb])177 try:178 _raise_exception()179 except:180 assert_traceback([(LINE240 + 6, 0, FILE, 'test_throw_and_throw'), _retb])181LINE250 = 233182def test_throw_in_another_file():183 if is_cli: _f_file = path_combine(get_full_dir_name(testpath.public_testdir), 'foo.py')184 else: _f_file = os.getcwd() + '\\foo.py'185 write_to_file(_f_file, '''186def another_raise():187 raise Exception()188''');189 try:190 import foo191 foo.another_raise()192 except:193 assert_traceback([(LINE250 + 8, 0, FILE, 'test_throw_in_another_file'), (3, 0, _f_file.lower(), 'another_raise')])194 finally:195 os.remove(_f_file)196class MyException(Exception): pass197Line260 = 250198def catch_MyException():199 try:200 _raise_exception()201 except MyException:202 assert_traceback([]) # UNREACABLE. THIS TRICK SIMPLIFIES THE CHECK203def test_catch_MyException():204 try:205 catch_MyException()206 except:207 assert_traceback([(Line260+8, 0, FILE, 'test_catch_MyException'), (Line260+2, 0, FILE, 'catch_MyException'), _retb])208Line263 = 263209def test_cp11923_first():210 try:211 _t_test = path_combine(testpath.public_testdir, "cp11923.py")212 write_to_file(_t_test, """def f():213 x = 'something bad'214 raise Exception(x)""")...
Learn to execute automation testing from scratch with LambdaTest Learning Hub. Right from setting up the prerequisites to run your first automation test, to following best practices and diving deeper into advanced test scenarios. LambdaTest Learning Hubs compile a list of step-by-step guides to help you be proficient with different test automation frameworks i.e. Selenium, Cypress, TestNG etc.
You could also refer to video tutorials over LambdaTest YouTube channel to get step by step demonstration from industry experts.
Get 100 minutes of automation test minutes FREE!!