
    Zi|                     0   S r SSKJr  SrSSKrSSKrSSKrSSKrSSKrSSK	r	SSK
r
 SSKJr  \R&                  R)                  \R&                  R+                  \R&                  R-                  \5      5      5      r\R&                  R)                  \R&                  R3                  \S5      5      r\\R&                  ;  a  \R&                  R7                  S\5        SSKJr  SSKJr   " S	 S
\	R@                  5      r!\	RD                  S-   4S jr#\#" S5      r$S r% " S S\&5      r' " S S\&5      r( " S S\&5      r)Sr*\*S-   r+\*S-   r,Sr-Sr.Sr/Sr0Sr1Sr2\2S-   r3\2S-   r4S r5\5S!-   r6\5S"-   r7\5S#-   r8\5S$-   r9S%r:\5S&-   r; " S' S(\&5      r< " S) S*\<5      r= " S+ S,\<5      r> " S- S.\<5      r? " S/ S0\?5      r@ " S1 S2\<5      rA " S3 S4\<5      rB " S5 S6\<5      rC " S7 S8\@\C5      rD " S9 S:\@\C5      rE " S; S<\B\C5      rF " S= S>\F5      rG " S? S@\F5      rH " SA SB\F5      rI " SC SD\F5      rJ " SE SF\<5      rK " SG SH\K\?5      rL " SI SJ\K\?5      rM " SK SL\K\B5      rN " SM SN\N5      rO " SO SP\N5      rP " SQ SR\N5      rQ " SS ST\N5      rR " SU SV\N5      rS " SW SX\N5      rT " SY SZ\<5      rU " S[ S\\U\?5      rV " S] S^\U\B5      rW " S_ S`\W5      rX " Sa Sb\W5      rY " Sc Sd\W5      rZ " Se Sf\W5      r[ " Sg Sh\B5      r\ " Si Sj\?5      r] " Sk Sl\<5      r^ " Sm Sn\<5      r_\D\E\L\M\V\]So.r`\G\H\I\J\O\P\Q\R\S\T\X\Y\Z\[\\Sp.ra " Sq Sr\<5      rb " Ss St\&5      rcSySu jrdSv reSw rf\gSx:X  a  \f" 5         gg! \ a5     SSKJs  Jr   GN?! \ a     SSKJr    GNP! \ a	    \" S5      ef = ff = ff = f)za  
ftguess.py

ftguess is a Python module to determine the type of a file based on its contents.
It can be used as a Python library or a command-line tool.

Usage: ftguess <file>

ftguess is part of the python-oletools package:
http://www.decalage.info/python/oletools
    )print_functionz0.60.2Nzplxml or ElementTree are not installed, see http://codespeak.net/lxml or http://effbot.org/zone/element-index.htmz..)clsid)xglobc                       \ rS rSrSrS rSrg)NullHandlerd   a  
Log Handler without output, to avoid printing messages if logging is not
configured by the main application.
Python 2.7 has logging.NullHandler, but this is necessary for 2.6:
see https://docs.python.org/2.6/library/logging.html#configuring-logging-for-a-library
c                     g N )selfrecords     j/var/www/eduai.edurigo.com/question_generate/ques_gen_env/lib/python3.13/site-packages/oletools/ftguess.pyemitNullHandler.emitk   s        r   N)__name__
__module____qualname____firstlineno____doc__r   __static_attributes__r   r   r   r   r   d   s    r   r      c                 (   U [         R                  R                  R                  ;   a)  [         R                  " U 5      nUR                  U5        U$ [         R                  " U 5      nUR                  [        5       5        UR                  U5        U$ )aR  
Create a suitable logger object for this module.
The goal is not to change settings of the root logger, to avoid getting
other modules' logs on the screen.
If a logger exists with same name, reuse it. (Else it would have duplicate
handlers and messages would be doubled.)
The level is set to CRITICAL+1 by default, to avoid any logging.
)loggingLoggermanager
loggerDict	getLoggersetLevel
addHandlerr   )namelevelloggers      r   
get_loggerr$   n   sr     w~~%%000 ""4(t$F km$
OOEMr   ftguessc                  J    [         R                  [        R                  5        g)z
Enable logging for this module (disabled by default).
This will set the module-specific logger level to NOTSET, which
means the main application controls the actual logging level.
N)logr   r   NOTSETr   r   r   enable_loggingr)      s     LL r   c                       \ rS rSrSrSrSrSrSrSr	Sr
S	rS
rSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSr Sr!S r"S!r#S"r$S#r%S$r&S%r'S&r(S'r)S(r*S)r+S*r,g+),FTYPE   
Constants for file types
ZipWordWord6Word97Word2007Word2007_DOCXWord2007_DOTXWord2007_DOCMWord2007_DOTMExcelExcel5Excel97	Excel2007Excel2007_XLSXExcel2007_XLSMExcel2007_XLTXExcel2007_XLTMExcel2007_XLSBExcel2007_XLAMPowerpoint97Powerpoint2007Powerpoint2007_PPTXPowerpoint2007_PPSXPowerpoint2007_PPTMPowerpoint2007_PPSMXPSRTFHTMLPDFMHTMLTEXTEXE_PEOLEXMLOpenXMLzUnknown File TypeMSIOneNotePNGr   N)-r   r   r   r   r   ZIPWORDWORD6WORD97WORD2007WORD2007_DOCXWORD2007_DOTXWORD2007_DOCMWORD2007_DOTMEXCELEXCEL5EXCEL97	EXCEL2007EXCEL2007_XLSXEXCEL2007_XLSMEXCEL2007_XLTXEXCEL2007_XLTMEXCEL2007_XLSBEXCEL2007_XLAMPOWERPOINT97POWERPOINT2007POWERPOINT2007_PPTXPOWERPOINT2007_PPSXPOWERPOINT2007_PPTMPOWERPOINT2007_PPSMrG   rH   rI   rJ   rK   rL   rM   GENERIC_OLEGENERIC_XMLGENERIC_OPENXMLUNKNOWNrQ   ONENOTErS   r   r   r   r   r+   r+      s     CDEFH#M#M#M#MEFGI%N%N%N%N%N%N!L%N////
C
CD
CEDFKKO!G
CG
Cr   r+   c                   D    \ rS rSrSrSrSrSrSrSr	Sr
S	rS
rSrSrSrSrg)	CONTAINER   z$
Constants for file container types
rH   r.   rN   rP   FlatOPCOpenDocumentMIMEBinaryzUnknown ContainerrR   rS   r   N)r   r   r   r   r   rH   rT   rN   rP   ru   rv   rw   BINARYrp   rq   rS   r   r   r   r   rs   rs      s@     C
C
CGG!LDF!GG
Cr   rs   c                   D    \ rS rSrSrSrSrSrSrSr	Sr
S	rS
rSrSrSrSrg)APP   r-   zMS WordzMS ExcelzMS PowerPointz	MS AccesszMS Visioz
MS Projectz	MS Officez
MS OneNotezAny Zip ArchiverWindowszUnknown Applicationr   N)r   r   r   r   r   MSWORDMSEXCELMSPOWERPOINTMSACCESSMSVISIO	MSPROJECTMSOFFICE	MSONENOTEZIP_ARCHIVERWINDOWSrp   r   r   r   r   r{   r{      s@     FG"LHGIHI%LG#Gr   r{   z>{http://schemas.openxmlformats.org/package/2006/relationships}RelationshipsRelationshipTypeTargetzRhttp://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocumentzFhttp://purl.oclc.org/ooxml/officeDocument/relationships/officeDocumentz<http://schemas.microsoft.com/xps/2005/06/fixedrepresentationz>{http://schemas.openxmlformats.org/package/2006/content-types}DefaultOverridez5{http://schemas.microsoft.com/office/2006/xmlPackage}packagepartr!   contentTypez$application/vnd.ms-office.vbaProject
binaryDatac                       \ rS rSr\R
                  r\R
                  r\	R
                  r
SrSr/ r/ rSrSrSrSr\S 5       rSrg)
FType_Basei  zUnknown file typeNFc                     g)zr
return True if the provided file matches the type of this class
:param ftg: FileTypeGuesser object
:return: bool
Fr   clsftgs     r   	recognizeFType_Base.recognize  s     r   r   )r   r   r   r   rs   rp   	containerr{   applicationr+   filetyper!   longname
extensionscontent_typesPUIDmay_contain_vbamay_contain_xlmmay_contain_oleclassmethodr   r   r   r   r   r   r     sY    !!I++K}}HD"HJMDOOO r   r   c                       \ rS rSrSrg)FType_Unknowni"  r   N)r   r   r   r   r   r   r   r   r   r   "  s    r   r   c                       \ rS rSr\R
                  r\R                  r	\
R
                  rSrSrSS/rSrSr\S 5       rS	rg
)	FType_RTFi%  rH   zRich Text Formatrtfdoc)zapplication/rtfztext/rtfzfmt/355c                 J    UR                   R                  S5      (       a  S$ S$ )Ns   {\rtTFdata
startswithr   s     r   r   FType_RTF.recognize/  s#     xx**844t?%?r   r   N)r   r   r   r   rs   rH   r   r{   r~   r   r+   r   r!   r   r   r   r   r   r   r   r   r   r   r   r   %  sN    I**KyyHD!HJ3MD@ @r   r   c                   t    \ rS rSr\R
                  r\R                  r	\
R                  rSrSr\S 5       rSrg)FType_Generic_OLEi6  zGeneric OLE/CFB filez1Generic OLE file / Compound File (unknown format)c                    [        UR                  5      S:  a  UR                  S-   nOUR                  n[        R                  " U5      (       a{   [        R                  " UR                  5      Ul        UR                  R
                  R                  Ul        [        R                  R                  UR                  S 5      Ul
        gg!    g= f)Ni   s                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   FT)lenr   olefile	isOleFile	OleFileIOrootr   
root_clsidKNOWN_CLSIDSgetroot_clsid_name)r   r   r   s      r   r   FType_Generic_OLE.recognize=  s     sxx=88|,D88DT""%//9!$!1!1!7!7&+&8&8&<&<S^^T&R# s   A9C Cr   N)r   r   r   r   rs   rN   r   r{   rp   r   r+   rm   r   r!   r   r   r   r   r   r   r   r   r   6  s;    I++K  H!DBH r   r   c                   0    \ rS rSrSr/ r/ r\S 5       rSr	g)FType_OLE_CLSID_BaseiW  zB
Base class to recognize OLE files based on CLSID or stream names
c                 V    UR                   b  UR                   U R                  ;   a  ggg)NTF)r   CLSIDSr   s     r   r   FType_OLE_CLSID_Base.recognize^  s)     >>%~~+ r   r   N)
r   r   r   r   r   r   STREAMSr   r   r   r   r   r   r   r   W  s%     FG r   r   c                   z    \ rS rSr\R
                  r\R                  r	\
R
                  rSrSrS/r\S 5       rSrg)FType_Generic_Zipil  zZip ArchivezGeneric Zip Archivezipc                     [         R                  " UR                  5      (       d  g [         R                  " UR                  5      Ul         g! [         R                   a     gf = f)NFT)zipfile
is_zipfiledata_bytesioZipFile
BadZipfiler   s     r   r   FType_Generic_Zip.recognizet  sZ     !!#"2"233	!//#*:*:;CK
 	 !! 	 	s   %A A%$A%r   N)r   r   r   r   rs   rT   r   r{   r   r   r+   r   r!   r   r   r   r   r   r   r   r   r   r   l  sB    I""KyyHD$HJ r   r   c                   x    \ rS rSr\R
                  r\R                  r	\
R                  rSrSr/ r\S 5       rSrg)FType_Generic_OpenXMLi  zOpenXML filezGeneric OpenXML filec           	      <   [         R                  S5         UR                  R                  S5         UR                  R                  S5      n[        R                  " U5      nUR                  [        :w  a  gS nUR                  [        S9 Ht  nUR                  [        5      n[         R                  SU< SUR                  [        5      < 35        U[         ["        [$        4;   d  M_  UR                  [        5      n  O   [         R                  SU-  5        Uc  [         R'                  S5        g UR                  R                  S	5      n[        R                  " U5      n0 n	0 n
UR                  [(        S9 H3  nUR                  S
5      nUR                  S5      nUc  M*  Uc  M/  XU'   M5     UR                  [*        S9 HD  nUR                  S5      nUR-                  S5      nUR                  S5      nUc  M;  Uc  M@  XU'   MF     S nXJ;   a  X   nO0[.        R0                  R3                  U5      S   SS  nUU	;   a  U	U   nUUl        [         R                  SU-  5        g! [         a     gf = f! [         a     gf = f! [         a     gf = f)NzOpen XML - recognizez_rels/.relsF)tagzRelationship: type=z target=zMain part: %sz5Failed to find any known relationship in OpenXML-filez[Content_Types].xml	ExtensionContentTypePartName/r   zMain part content-type: %sT)r'   debugr   getinfoKeyErrorreadRuntimeErrorET
fromstringr   TAG_RELSiterTAG_RELr   ATTR_REL_TYPEATTR_REL_TARGETURL_REL_OFFICEDOCURL_REL_OFFICEDOC_STRICTURL_REL_XPSwarningTAG_CTYPES_DEFAULTTAG_CTYPES_OVERRIDElstripospathsplitextmain_part_content_type)r   r   	root_rels	elem_rels	main_partelem_relrel_typer   elem_ctypes
ctypes_extctypes_partelem_ext	extensioncontent_type	elem_partpartnamer   main_part_exts                     r   r   FType_Generic_OpenXML.recognize  sl   		()	KK.	((7I
 MM),	==H$	!73H||M2HII8X\\RaEbcd-/GUU$LL9	 4 			/I-.  KKOP	KK,,-BCM
 mmM2
#((/A(BH [1I#<<6L$)A(49% C %))0C)DI }}Z0Hs+H$==7L#(@(4H% E "&#%0%;" GG,,Y7:12>M
*)3M)B&%;"		.1GGH]  		  		T  		s4   I. I> 8J .
I;:I;>
J
J
JJr   N)r   r   r   r   rs   rP   r   r{   r   r   r+   ro   r   r!   r   r   r   r   r   r   r   r   r   r     sD    !!I,,K$$HD%HJT Tr   r   c                   8    \ rS rSrSr\R                  rSrSr	Sr
g)
FType_Wordi  z%Base class for all MS Word file typeszMS Word (generic)z&MS Word Document or Template (generic)r   N)r   r   r   r   r   r{   r~   r   r!   r   r   r   r   r   r   r     s    /**KD7Hr   r   c                   j    \ rS rSr\R
                  r\R                  r	Sr
SrSrSS/rS/rSrS	rS	rS
rg)FType_Word97i  zMS Word 97 Documentz$MS Word 97-2003 Document or Template)$00020906-0000-0000-C000-000000000046r   dotapplication/mswordzfmt/40Tr   N)r   r   r   r   r{   r~   r   r+   rW   r   r!   r   r   r   r   r   r   r   r   r   r   r   r   r     sC    **K||H D5H6FJ)*MDOOr   r   c                   f    \ rS rSr\R
                  r\R                  r	Sr
SrSrSS/rS/rSrS	rS
rg)FType_Word6i  zMS Word 6 Documentz MS Word 6-7 Document or Template)$00020900-0000-0000-C000-000000000046r   r   r  zfmt/39Tr   N)r   r   r   r   r{   r~   r   r+   rV   r   r!   r   r   r   r   r   r   r   r   r   r   r  r    s>    **K{{HD1H6FJ)*MDOr   r  c                   4    \ rS rSr\R
                  rSrSrSr	g)FType_Word2007_Basei  zMS Word 2007+ FilezMS Word 2007+ File (.doc?)r   N)
r   r   r   r   r{   r~   r   r!   r   r   r   r   r   r  r    s    **KD+Hr   r  c                   R    \ rS rSr\R
                  r\R                  r	Sr
SrS/rSrg)FType_Word2007i	  zMS Word 2007+ DocumentzMS Word 2007+ Document (.docx)docxr   N)r   r   r   r   r{   r~   r   r+   rY   r   r!   r   r   r   r   r   r   r  r  	  '    **K""H#D/HJr   r  c                   R    \ rS rSr\R
                  r\R                  r	Sr
SrS/rSrg)FType_Word2007_Macroi  z$MS Word 2007+ Macro-Enabled Documentz,MS Word 2007+ Macro-Enabled Document (.docm)docmr   N)r   r   r   r   r{   r~   r   r+   r[   r   r!   r   r   r   r   r   r   r  r    '    **K""H1D=HJr   r  c                   R    \ rS rSr\R
                  r\R                  r	Sr
SrS/rSrg)FType_Word2007_Templatei  zMS Word 2007+ TemplatezMS Word 2007+ Template (.dotx)dotxr   N)r   r   r   r   r{   r~   r   r+   rZ   r   r!   r   r   r   r   r   r   r  r    r
  r   r  c                   R    \ rS rSr\R
                  r\R                  r	Sr
SrS/rSrg)FType_Word2007_Template_Macroi  z$MS Word 2007+ Macro-Enabled Templatez,MS Word 2007+ Macro-Enabled Template (.dotm)dotmr   N)r   r   r   r   r{   r~   r   r+   r\   r   r!   r   r   r   r   r   r   r  r    r  r   r  c                   8    \ rS rSrSr\R                  rSrSr	Sr
g)FType_Exceli'  z&Base class for all MS Excel file typeszMS Excel (generic)z+MS Excel Workbook/Template/Add-in (generic)r   N)r   r   r   r   r   r{   r   r   r!   r   r   r   r   r   r  r  '  s    0++KD<Hr   r  c                   @    \ rS rSr\R
                  rSrSrSr	/ SQr
Srg)FType_Excel97i-  zMS Excel 97 Workbookz%MS Excel 97-2003 Workbook or Template)$00020820-0000-0000-C000-000000000046xlsxltxlar   N)r   r   r   r   r+   r_   r   r!   r   r   r   r   r   r   r   r  r  -  s    }}H!D6H6F&Jr   r  c                   @    \ rS rSr\R
                  rSrSrSr	/ SQr
Srg)FType_Excel5i5  zMS Excel 5.0/95 Workbookz,MS Excel 5.0/95 Workbook, Template or Add-in)$00020810-0000-0000-C000-000000000046r  r   N)r   r   r   r   r+   r^   r   r!   r   r   r   r   r   r   r   r  r  5  s    ||H%D=H6F&Jr   r  c                   $    \ rS rSrSrSrSrSrSrg)FType_Excel2007i=  z+Base class for all MS Excel 2007 file typeszMS Excel 2007+ (generic)z-MS Excel 2007+ Workbook or Template (generic))zAapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheetr   N)	r   r   r   r   r   r!   r   r   r   r   r   r   r"  r"  =  s    5%D>HZMr   r"  c                   >    \ rS rSr\R
                  rSrSrS/r	Sr
Srg)FType_Excel2007_XLSXiD  zMS Excel 2007+ WorkbookzMS Excel 2007+ Workbook (.xlsx)xlsxzfmt/214r   N)r   r   r   r   r+   ra   r   r!   r   r   r   r   r   r   r   r$  r$  D  s#    ##H$D0HJDr   r$  c                   B    \ rS rSr\R
                  rSrSrS/r	Sr
SrSrg)	FType_Excel2007_XLSMiK  z%MS Excel 2007+ Macro-Enabled Workbookz-MS Excel 2007+ Macro-Enabled Workbook (.xlsm)xlsm)z.application/vnd.ms-excel.sheet.macroEnabled.12zfmt/445r   N)r   r   r   r   r+   rb   r   r!   r   r   r   r   r   r   r   r   r'  r'  K  s(    ##H2D>HJGMDr   r'  c                   B    \ rS rSr\R
                  rSrSrS/r	Sr
SrSrg)	FType_Excel2007_XLSBiS  zMS Excel 2007+ Binary Workbookz&MS Excel 2007+ Binary Workbook (.xlsb)xlsb)z5application/vnd.ms-excel.sheet.binary.macroEnabled.12zfmt/595r   N)r   r   r   r   r+   re   r   r!   r   r   r   r   r   r   r   r   r*  r*  S  s(    ##H+D7HJNMDr   r*  c                   :    \ rS rSr\R
                  rSrSrS/r	Sr
g)FType_Excel2007_Templatei[  zMS Excel 2007+ TemplatezMS Excel 2007+ Template (.xltx)xltxr   N)r   r   r   r   r+   rc   r   r!   r   r   r   r   r   r   r-  r-  [  s    ##H$D0HJr   r-  c                   :    \ rS rSr\R
                  rSrSrS/r	Sr
g)FType_Excel2007_Template_Macroia  z%MS Excel 2007+ Macro-Enabled Templatez-MS Excel 2007+ Macro-Enabled Template (.xltm)xltmr   N)r   r   r   r   r+   rd   r   r!   r   r   r   r   r   r   r0  r0  a  s    ##H2D>HJr   r0  c                   :    \ rS rSr\R
                  rSrSrS/r	Sr
g)FType_Excel2007_Addin_Macroig  z#MS Excel 2007+ Macro-Enabled Add-inz+MS Excel 2007+ Macro-Enabled Add-in (.xlam)xlamr   N)r   r   r   r   r+   rf   r   r!   r   r   r   r   r   r   r3  r3  g  s    ##H0D<HJr   r3  c                   8    \ rS rSrSr\R                  rSrSr	Sr
g)FType_Powerpointio  z+Base class for all MS Powerpoint file typeszMS Powerpoint (generic)zAMS Powerpoint Presentation/Slideshow/Template/Addin/... (generic)r   N)r   r   r   r   r   r{   r   r   r!   r   r   r   r   r   r6  r6  o  s    5""K$DRHr   r6  c                   @    \ rS rSr\R
                  rSrSrSr	/ SQr
Srg)FType_Powerpoint97iu  zMS Powerpoint 97 Presentationz5MS Powerpoint 97-2003 Presentation/Slideshow/Template)$64818D10-4F9B-11CF-86EA-00AA00B929E8)pptppspotr   N)r   r   r   r   r+   rg   r   r!   r   r   r   r   r   r   r   r8  r8  u  s!    !!H*DFH6F&Jr   r8  c                   <    \ rS rSrSr\R                  rSrSr	Sr
Srg)FType_Powerpoint2007i}  z0Base class for all MS Powerpoint 2007 file typeszMS Powerpoint 2007+ (generic)z=MS Powerpoint 2007+ Presentation/Slideshow/Template (generic)zIapplication/vnd.openxmlformats-officedocument.presentationml.presentationr   N)r   r   r   r   r   r+   rh   r   r!   r   r   r   r   r   r   r>  r>  }  s    :##H*DNHbMr   r>  c                   >    \ rS rSr\R
                  rSrSrSr	S/r
Srg)!FType_Powerpoint2007_Presentationi  zMSPowerpoint 2007+ Presentationz'MSPowerpoint 2007+ Presentation (.pptx)r?  pptxr   N)r   r   r   r   r+   ri   r   r!   r   r   r   r   r   r   r   rA  rA    s#    ((H,D8HbMJr   rA  c                   >    \ rS rSr\R
                  rSrSrSr	S/r
Srg)FType_Powerpoint2007_Slideshowi  zMSPowerpoint 2007+ Slideshowz$MSPowerpoint 2007+ Slideshow (.ppsx))zFapplication/vnd.openxmlformats-officedocument.presentationml.slideshowppsxr   N)r   r   r   r   r+   rj   r   r!   r   r   r   r   r   r   r   rD  rD    s#    ((H)D5H_MJr   rD  c                   >    \ rS rSr\R
                  rSrSrSr	S/r
Srg)FType_Powerpoint2007_Macroi  z-MSPowerpoint 2007+ Macro-Enabled Presentationz5MSPowerpoint 2007+ Macro-Enabled Presentation (.pptm))z:application/vnd.ms-powerpoint.presentation.macroEnabled.12pptmr   N)r   r   r   r   r+   rk   r   r!   r   r   r   r   r   r   r   rG  rG    s#    ((H:DFHSMJr   rG  c                   >    \ rS rSr\R
                  rSrSrSr	S/r
Srg)$FType_Powerpoint2007_Slideshow_Macroi  z*MSPowerpoint 2007+ Macro-Enabled Slideshowz2MSPowerpoint 2007+ Macro-Enabled Slideshow (.ppsm))z7application/vnd.ms-powerpoint.slideshow.macroEnabled.12ppsmr   N)r   r   r   r   r+   rl   r   r!   r   r   r   r   r   r   r   rJ  rJ    s#    ((H7DCHPMJr   rJ  c                   R    \ rS rSr\R
                  r\R                  r	Sr
SrS/rSrg)	FType_XPSi  rG   )zFixed-Page Document (.xps)xpsr   N)r   r   r   r   r{   r   r   r+   rG   r   r!   r   r   r   r   r   r   rM  rM    s%    ++KyyHD,HJr   rM  c                   R    \ rS rSr\R
                  r\R                  r	Sr
SrS/rSrg)	FType_MSIi  rQ   z Windows Installer Package (.msi)msir   N)r   r   r   r   r{   r   r   r+   rQ   r   r!   r   r   r   r   r   r   rP  rP    s%    ++KyyHD1HJr   rP  c                       \ rS rSr\R
                  r\R                  r	\
R
                  rSrSrS/rSrSr\S 5       rSrg	)
FType_OneNotei  rR   z MS OneNote Revision Store (.one)one)zapplication/msonenotezfmt/637c                 J    UR                   R                  S5      (       a  S$ S$ )Ns   R\{اMSx)TFr   r   s     r   r   FType_OneNote.recognize  s%     xx**+nootzuzzr   r   N)r   r   r   r   rs   rq   r   r{   r   r   r+   r   r!   r   r   r   r   r   r   r   r   r   r   rS  rS    sP    !!I--K}}HD1HJ.MD { {r   rS  c                       \ rS rSr\R
                  r\R                  r	\
R
                  rSrSrS/rSrSr\S 5       rSrg	)
	FType_PNGi  rS   z(Portable Network Graphics picture (.png)png)z	image/pngzfmt/13c                 J    UR                   R                  S5      (       a  S$ S$ )Ns   PNG

TFr   r   s     r   r   FType_PNG.recognize  s#    xx**+NOOtZUZZr   r   N)r   r   r   r   rs   rS   r   r{   rp   r   r+   r   r!   r   r   r   r   r   r   r   r   r   r   rX  rX    sN    I++KyyHD9HJ"MD [ [r   rX  )r   r  r  r   r9  z$000C1084-0000-0000-C000-000000000046)zPapplication/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xmlz6application/vnd.ms-word.document.macroEnabled.main+xmlzPapplication/vnd.openxmlformats-officedocument.wordprocessingml.template.main+xmlz>application/vnd.ms-word.template.macroEnabledTemplate.main+xmlzJapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xmlz4application/vnd.ms-excel.sheet.macroEnabled.main+xmlz7application/vnd.ms-excel.sheet.binary.macroEnabled.mainzMapplication/vnd.openxmlformats-officedocument.spreadsheetml.template.main+xmlz7application/vnd.ms-excel.template.macroEnabled.main+xmlz4application/vnd.ms-excel.addin.macroEnabled.main+xmlzRapplication/vnd.openxmlformats-officedocument.presentationml.presentation.main+xmlzOapplication/vnd.openxmlformats-officedocument.presentationml.slideshow.main+xmlz@application/vnd.ms-powerpoint.presentation.macroEnabled.main+xmlz=application/vnd.ms-powerpoint.slideshow.macroEnabled.main+xmlz8application/vnd.ms-package.xps-fixeddocumentsequence+xmlc                       \ rS rSr\R
                  r\R                  r	\
R                  rSrSrSrSrSr\S 5       rSrg	)
FType_EXE_PEi  zWindows PE Executable or DLLz,Windows Portable Executable or DLL (EXE,DLL))exedllsysscr)z-application/vnd.microsoft.portable-executablezfmt/899c                 J    UR                   R                  S5      (       a  S$ S$ )Ns   MZTFr   r   s     r   r   FType_EXE_PE.recognize  s!    xx**511t<u<r   r   N)r   r   r   r   r+   rM   r   rs   ry   r   r{   r   r   r!   r   r   r   r   r   r   r   r   r   r   r]  r]    sJ    ||H  I++K)D=H-JFMD= =r   r]  c                   L    \ rS rSrSrSS jrS rS rS rS r	S	 r
S
 rS rSrg)FileTypeGuesseri  zI
A class to guess the type of a file, focused on MS Office, RTF and ZIP.
Nc                 t   Xl         X l        S U l        S U l        S U l        [
        U l        S U l        S U l        S U l	        S U l
        S U l        S U l        S U l        S U l        S U l        Uc  Uc  [!        S5      eUc*  [#        US5       nUR%                  5       U l        S S S 5        [&        R(                  " U R                  5      U l        [*        [,        [.        [0        [2        4 H!  nUR5                  U 5      (       d  M  X@l          O   U R                  R                  U l        U R                  R                  U l        U R                  R                  U l        U R                  [6        R8                  :X  a)  [:        R=                  U R                  S 5      nUb  XPl        U R                  [6        R>                  :X  aN  [@        R5                  U 5      (       a4  [@        U l        [B        R=                  U R                  S 5      nUb  XPl        U R                  [6        RD                  :X  a%  [F        R5                  U 5      (       a  [F        U l        U R                  R                  U l        U R                  R                  U l        U R                  R                  U l        g ! , (       d  f       GN= f)NzAFileTypeGuesser requires either a file path or file data, or bothrb)$filepathr   r   r   r   r   ftyper   r   r   r   r   r   r   root_xmltagxmlroot
ValueErroropenr   ioBytesIOr   r   r   rS  rX  r   rs   rN   clsid_ftypesr   rT   r   openxml_ftypesrp   r]  )r   rh  r   fri  fts         r   __init__FileTypeGuesser.__init__  s    	"
 #&*#`aa<h%FFH	 &JJtyy1  !24E}V_`Et$$"
 a --

++::11 >>Y]]*
 !!$//48B~
 >>Y]]*$..t442
#''(C(CTJ>!#J >>Y...%%d++)
--

++::11M &%s   J((
J7c                     SR                  U R                  c  SO([        R                  R	                  U R                  5      U R
                  U R                  U R                  5      $ )z2Give a short string representation of this object.z.[FileTypeGuesser for {0}: {1} from {2} in {3}]r   )formatrh  r   r   basenamer   r   r   r   s    r   __str__FileTypeGuesser.__str__\  sL    ?FFmm+F!!$--0MM4++T^^= 	=r   c                 T    U R                   b  U R                   R                  5         gg)z5
This method must be called at the end of processing
N)r   closery  s    r   r}  FileTypeGuesser.closec  s#    
 <<#LL  $r   c                 ~    [        U R                  [        5      =(       d    U R                  [        R
                  :H  $ )z9
Shortcut to check if the container is OLE
:return: bool
)
issubclassri  r   r   rs   rN   ry  s    r   is_oleFileTypeGuesser.is_olek  s(    
 $**&78[DNNimm<[[r   c                 ~    [        U R                  [        5      =(       d    U R                  [        R
                  :H  $ )z=
Shortcut to check if the container is OpenXML
:return: bool
)r  ri  r   r   rs   rP   ry  s    r   
is_openxmlFileTypeGuesser.is_openxmlr  s+    
 $**&;<cR[RcRc@ccr   c                 6    [        U R                  [        5      $ zT
Shortcut to check if a file is an Excel workbook, template or add-in
:return: bool
)r  ri  r   ry  s    r   is_wordFileTypeGuesser.is_wordy  s    
 $**j11r   c                 6    [        U R                  [        5      $ r  )r  ri  r  ry  s    r   is_excelFileTypeGuesser.is_excel  s    
 $**k22r   c                 6    [        U R                  [        5      $ )zJ
Shortcut to check if a file is Powerpoint file of any kind
:return: bool
)r  ri  r6  ry  s    r   is_powerpointFileTypeGuesser.is_powerpoint  s    
 $**&677r   )r   r   r   r   rh  r   ri  r   r   r   r   r   rj  rk  r   NN)r   r   r   r   r   rt  rz  r}  r  r  r  r  r  r   r   r   r   re  re    s2    ?2B=!\d238r   re  c                     [        X5      $ r
   )re  rh  r   s     r   ftype_guessr    s    8**r   c                 P   [        SU-  5        [        XS9n[        SUR                  R                  -  5        [        SUR                  R                  -  5        [        SUR                  R
                  -  5        [        SUR                  -  5        UR                  b'  [        SUR                  < SUR                  < 35        [        S	S
R                  UR                  R                  5      -  5        [        SUR                  R                  -  5        [        5         g )NzFile       : %sr  zFile Type  : %szDescription: %szApplication: %szContainer  : %szRoot CLSID : z - zContent-type(s) : %s,zPUID       : %s)printr  ri  r!   r   r   r   r   r   joinr   r   )r   filenamer   r   s       r   process_filer    s    	
h
&'
x
3C	
ciinn
,-	
cii00
01	
cii33
34	
cmm
+,
~~!8K8KLM	
 388CII,C,C#D
DE	
ciinn
,-	Gr   c            	         S[         R                  SS -  n [        S[        < SU < S35        [        S5        [        S5        [        S	5        S
n[        R
                  [        R                  [        R                  [        R                  [        R                  S.nSn[        R                  " US9nUR                  SSSSS9  UR                  SSSSS SS9  UR                  SSSSSSS9  UR                  SSS S!US"S#9  UR                  5       u  pV[        U5      S:X  a4  [        [        5        UR!                  5         [         R"                  " 5         [        R$                  " X%R&                     [         R(                  S$S%9  [+        5         [,        R.                  " XeR0                  UR2                  UR4                  S&9 H1  u  pxn	U(       a  UR7                  S'5      (       a  M%  [9        XxU	5        M3     g )(Nz%d.%d.%dr      zftguess z on Python z' - http://decalage.info/python/oletoolsz3THIS IS WORK IN PROGRESS - Check updates regularly!zGPlease report any issue at https://github.com/decalage2/oletools/issues r   )r   infor   errorcriticalz1usage: %prog [options] <filename> [filename2 ...])usagez-r
store_true	recursivez)find files recursively in subdirectories.)actiondesthelpz-zz--zipzip_passwordstrzRif the file is a zip archive, open first file from it, using the provided password)r  typedefaultr  z-fz
--zipfname	zip_fname*zoif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)z-lz
--loglevelloglevelstorezBlogging level debug/info/warning/error/critical (default=%default))r  r  r  r  z%(levelname)-8s %(message)s)r"   streamrw  )r  r  r  r   )r`  version_infor  __version__r   DEBUGINFOWARNINGERRORCRITICALoptparseOptionParser
add_option
parse_argsr   r   
print_helpexitbasicConfigr  stdoutr)   r   
iter_filesr  r  r  endswithr  )
python_versionDEFAULT_LOG_LEVEL
LOG_LEVELSr  parseroptionsargsr   r  r   s
             r   mainr    s   #"2"21Q"77N	) *	@A	TU	2J!MMLLOOMM$$
J @E""/F d<k8  :
dG.uda  c
dL{PS~  @
dLz'Sd!e  g '')OW 4yA~w

 j)9)9:3::<> %*%5%5dFWFW))W5F5F&H!	T **3//Y$/&Hr   __main__r  )hr   
__future__r   r  r`  rn  r   r   r   r   r  
lxml.etreeetreer   ImportErrorxml.etree.ElementTreeElementTreeelementtree.cElementTreecElementTreer   normpathabspathdirname__file___thismodule_dirr  _parent_dirinsertoletools.commonr   oletools.thirdparty.xglobr   Handlerr   r  r$   r'   r)   objectr+   rs   r{   NS_RELSr   r   r   r   r   r   r   NS_CONTENT_TYPESr   r   NS_XMLPACKAGETAG_PACKAGETAG_PKGPARTATTR_PKG_NAMEATTR_PKG_CONTENTTYPECTYPE_VBAPROJECTTAG_PKGBINDATAr   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r  r  r"  r$  r'  r*  r-  r0  r3  r6  r8  r>  rA  rD  rG  rJ  rM  rP  rS  rX  rp  rq  r]  re  r  r  r  r   r   r   r   <module>r     s}  
R &   	  	   P& ''""277??277??83L#MNggrww||OTBCchhHHOOA{# ! +'//  #++A- 6 !+F +Z  $& $. K_$
N
"h c LS %	1 &3 
 Hi' f$&$}4 9 -& ,	J 	@
 @"
 B, *
 .]J ]D8 8
' 
	&
 	,/ ,( . 1 $7 =* ='K!2 ''; 1 '[k#8 [O O O  _ / Sz S')+< 'c+-B c(< %9 !5 +? % ! {J {&[
 [0 -9,7,9,8,>,5$ Yg>RXoFcRf<P?SUm?]<WZ{WuHbEi AJ5>=J =v8f v8v+ 40n zF k  P
P** P	P11 	P O P P	P	P	Ps5   M N!	M--N4M>:N>NNN