ZiǙSrSSKJr SrSSKrSSKrSSKrSSKrSSKJ r J r SSK r SSK r SSK r SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKJr SSKr\R<S:Xa\R>RASS 9 SS K!J"r"J#r#J$r$J%r%J&r&J'r'J(r(J)r)J*r*J+r+J,r,J-r-J.r.J/r/J0r0J1r1J2r2J3r3J4r4 SS K5J6r7 Sr8\RrRu\RrRw\RrRy\=555r>\RrRu\RrR\>S 55r@\@\Rr;a\RrRS\@5 SSKBrBSSKCJDrD SSKEJFrFJGrG SSKHJIrI SSKJJKrK SSKJJLrL SSKJJMrM SSKJJNrN SSKOJPrP SSKQJRrR SSKJJSrS SSKTJUrU \RSS::aSrW\XrYSrZOOS rWSrY\[r\\]r^\_r`SSKaJbrb SrZ\RS:a,SSKcrc\cR"S5reSrf\cR"S\f5 S rhGS9S!jri\UR"S"5rkS#rl"S$S%\m5rn"S&S'\n5ro"S(S)\n5rp"S*S+\q\n5rr"S,S-\o5rs"S.S/\n5rtSruS0rvSrwS1rxS2ryS3rzS4r{S5r|S6r}S7r~S8S9S:S;SS?S@SASBS:SC. rSDrSE\-rSFrSGrSHrSIrSJrSKrSLrSMr\SN\SO\SP\SQ\SR\SS\ST\SU0rSVrSWrSXrSYrSZr\S[-r\S\-rS]r\S^-r\S_-r\S\-r\S`-rSar\Sb-rScSdSeSfSgShSiSjSkSl. rSmSnSo.r0SpSq_SrSs_StSu_SvSw_SxSy_SzS{_S|S}_S~S_SS_SS_SS_SS_SS_SS_SS_SS_SS_0SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_ESSSSSSSSSSSSS. ErSSSSSSSS.rSS0rSrSrS\-S-rSrS\-S-\-rS\-S-\-S-rSr\\-rSr\S-\-\-r\ GRP"\5rSS/rS\ GRP"\54S\ GRP"\54S\ GRP"S\-S-54S\ GRP"S544r\ GRP"S5rSr\ GRP"S\-S-5r\"/SQ5r\ GRP"S5r\ GRP"S5r\ GRP"S5r\4GRh"5 \-S-r"SS\_5r\$"\'"S5\,"\5-\+"\05-\*"\'"\+"SS0S955-5r\GRqS5 \$"\*"\&"S5\'"\#"S55-5\+"\2"S55-\*"\'"\+"SS0S955-5r\GRqS5 \$"\*"\#"S55\+"\2"S55-\*"\'"\+"SS0S955-5r\GRqS5 \\-\-r\("SSS9r\GRqS5 \%"5r\%"5r\*"\$"\,"\5\#"S5-\'"\#"S5\#"S5-5-\'"S5-5S-5\-\*"S5-rSr\GRq\5 \*"\""S5S-5\-\*"S5-r\GRqS5 \*"\""S5S-5\-\*"S5-r\GRqGS5 \*"\""GS5S-5\-\*"S5-r\GRqGS5 \*"\""GS5S-5\-\*"S5-r\GRqGS5 \+"\.\-S-GS9r\*"S5\$"\+"\/SS9GS-5-\*"S5-r\GRqGS5 \*"\5\*"S5-\"GS5-\*"S5-r\GRqGS 5 \*"S5\)"\5-\*"S5-r\GRqGS 5 \*"\5\*"S5-\"GS 5-\*"S5-r\GRqGS 5 GS r\\-\-\-\-\-r\\3"\GSS\1GR\4SS\1GR\4/5-rGSrGSrGSrGSr\\-\-r\\3"\GSS\1GR\4GSS\1GR\4SS\1GR\4GSS\1GR\4/5-rGSr\ GRP"GS5rGSr\"\GR5rGSrGSrGSr"GSGS\5r"GSGS\5rGS:GSjrGS rGS!rGS;GS"jrGS;GS#jrGS;GS$jrGS%rGS&rGS'rGS(rGS)rGS*rGS+rGSGS0jr"GS1GS2\5r"GS3GS4\5rGS;GS5jrGS?GS6jrGS;GS7jr\GS8:Xa\"5 gg!\a5 SSKJs Jr G NE!\a SSKJr G NV!\a \"S5ef=ff=ff=f!\a S r8G Nf=f(@ao olevba.py olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to extract VBA Macro code in clear text, deobfuscate and analyze malicious macros. XLM/Excel 4 Macros are also supported in Excel and SLK files. Supported formats: - Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm) - Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb) - PowerPoint 97-2003 (.ppt), PowerPoint 2007+ (.pptm, .ppsm) - Word/PowerPoint 2007+ XML (aka Flat OPC) - Word 2003 XML (.xml) - Word/Excel Single File Web Page / MHTML (.mht) - Publisher (.pub) - SYLK/SLK files (.slk) - Text file containing VBA or VBScript source code - Password-protected Zip archive containing any of the above - raises an error if run with files encrypted using MS Crypto API RC4 Author: Philippe Lagadec - http://www.decalage.info License: BSD, see source code or documentation olevba is part of the python-oletools package: http://www.decalage.info/python/oletools olevba is based on source code from officeparser by John William Davison https://github.com/unixfreak0037/officeparser )print_functionz0.60.2N)BytesIOStringIOzplxml or ElementTree are not installed, see http://codespeak.net/lxml or http://effbot.org/zone/element-index.htmntT) auto_colors)CaselessKeywordCaselessLiteralCombineForwardLiteralOptional QuotedStringRegexSuppressWord WordStart alphanumsalphashexnumsnumsopAssocsrange infixNotation ParserElement) deobfuscatorFz..) tablestream)xglobPathNotFoundException)cBIFF) ppt_parser)oleform)rtfobj)crypto)ensure_stdout_handles_unicode) codepages)ftguess) log_helperutf8cU$N)xs i/var/www/eduai.edurigo.com/question_generate/ques_gen_env/lib/python3.13/site-packages/oletools/olevba.pybyte_ordr/nsreduce)backslashreplacec[U[5(aFSRSURURUR 55nXR 4$[ U5$)Nc3D# UHnSRU5v M g7f)z \x{0:02x}Nformat).0cs r. *backslashreplace_errors..s Z>r0c<[(aU$URUSS9$)ad convert a bytes string to a native str: - on Python 2, it returns the same string (bytes=str) - on Python 3, the string is decoded using the provided encoding (UTF-8 by default) to a unicode str :param bytes_string: bytes string to be converted :param encoding: codec to be used for decoding :return: the string converted to str :rtype: str rKrL)rNdecode) bytes_stringencodings r. bytes2strrVs%w""8I">>r0olevbac[R[R5 [R "5 [ R "5 g)a Enable logging for this module (disabled by default). For use by third-party libraries that import `olevba` as module. This will set the module-specific logger level to `NOTSET`, which means the main application controls the actual logging level. This also enables logging for the modules used by us, but not the global common logging mechanism (:py:mod:`oletools.common.log_helper.log_helper`). Use :py:func:`oletools.common.log_helper.log_helper.enable_logging` for that. N)logsetLevelr'NOTSETr enable_loggingr#r,r0r.r\r\s.LL""# r0c0^\rSrSrSrSU4SjjrSrU=r$)OlevbaBaseExceptionizCBase class for exceptions produced here for simpler except clauses c >U(a([[U] "USRU5-40UD6 O[[U] "U40UD6 XlX lX0lg)Nz ({0}))superr^__init__r:msgfilenameorig_exc)selfrbrcrdkwargs __class__s r.raOlevbaBaseException.__init__sZ  %t 5c6>ooh6O7P @8> @ %t 5c DV D  r0)rcrbrd)NN__name__ __module__ __qualname____firstlineno____doc__ra__static_attributes__ __classcell__rgs@r.r^r^sN ! !r0r^c0^\rSrSrSrSU4SjjrSrU=r$) FileOpenErrorizpraised by VBA_Parser constructor if all open_... attempts failed probably means the file type is not supported c4>[[U] SU-X5 g)NzFailed to open file %s)r`rsrarercrdrgs r.raFileOpenError.__init__s mT+ $x / Er0r,r+rirqs@r.rsrss EEr0rsc,^\rSrSrSrU4SjrSrU=r$)ProcessingErroriz-raised by VBA_Parser.process_file* functions c4>[[U] SU-X5 g)NzError processing file %s)r`rxrarus r.raProcessingError.__init__s ot- & 18 Gr0r,rirqs@r.rxrxs8GGr0rxc\rSrSrSrSrSrg)MsoExtractionErrorizAraised by mso_file_extract if parsing MSO/ActiveMIME data failed cX[RX5 [RX5 gr+)r|rar^)rerbs r.raMsoExtractionError.__init__s##D.$$T/r0r,Nrjrkrlrmrnraror,r0r.r|r|s L0r0r|c0^\rSrSrSrSU4SjjrSrU=r$)SubstreamOpenErrorizDspecial kind of FileOpenError: file is a substream of original file cv>[[U] [U5S-[U5-U5 XlX lgN/)r`rrastrrc subfilename)rercrrdrgs r.raSubstreamOpenError.__init__s6  $0 MC #k"2 2H > &r0)rcrr+rirqs@r.rrsO''r0rc,^\rSrSrSrU4SjrSrU=r$)UnexpectedDataErrorizDraised when parsing is strict (=not relaxed) and data is unexpected c>[U[5(aSRU5nOb[U[5(a*SR SU55nSRU5nO#[ SR[ U555e[[U]'SRXXT55 Xl X l X0l X@l g)N{0:04X},c3D# UHnSRU5v M g7f)rNr9)r;es r.r=/UnexpectedDataError.__init__..s@x!)**1--xr?z({0})zUnknown type encountered: {0}zIUnexpected value in {0} for variable {1}: expected {2} but found {3:04X}!)r@intr:tuplerB ValueErrortyper`rra stream_pathvariableexpectedvalue)rerrrresrgs r.raUnexpectedDataError.__init__s h $ $!!(+B % ( (@x@@B..$B<CCDNST T !41 . VK2 5 7'   r0)rrrrrirqs@r.rrsOr0rr3r4 z mac-romanshiftjisasciigb2321big5hebrewz mac-arabicz mac-greekz mac-turkishthaimaccentraleurope) i'i'i'i'i'i'i'i'ia'i%'i-'i'z,https://github.com/decalage2/oletools/issueszPlease report this issue on %sOLEOpenXML FlatOPC_XML Word2003_XMLMHTMLTextPPTSLKzOLE:zOpX:zFlX:zXML:zMHT:zTXT:zPPT:zSLK:s ActiveMimebasclsfrmz6{http://schemas.microsoft.com/office/word/2003/wordml}binDatanamez5{http://schemas.microsoft.com/office/2006/xmlPackage}packagepart contentTypez$application/vnd.ms-office.vbaProject binaryData)AutoExecAutoOpen DocumentOpen)AutoExit AutoCloseDocument_CloseDocumentBeforeClose)DocumentChange)AutoNew Document_New NewDocument) Document_Open)Document_BeforeClose) Auto_Open Workbook_OpenWorkbook_ActivateAuto_Ope) Auto_CloseWorkbook_CloseWorkbook_BeforeClose)Worksheet_Calculate) z%Runs when the Word document is openedz%Runs when the Word document is closedz'Runs when the Word document is modifiedz(Runs when a new Word document is createdz2Runs when the Word or Publisher document is openedz*Runs when the Publisher document is closedz&Runs when the Excel Workbook is openedz&Runs when the Excel Workbook is closedz)May run when an Excel WorkSheet is opened)z \w+_Paintedz \w+_Painting)z \w+_GotFocusz \w+_LostFocusz\w+_MouseHoverz \w+_Clickz \w+_Changez \w+_Resizez\w+_BeforeNavigate2z\w+_BeforeScriptExecutez\w+_DocumentCompletez\w+_DownloadBeginz\w+_DownloadCompletez\w+_FileDownloadz\w+_NavigateComplete2z\w+_NavigateErrorz\w+_ProgressChangez\w+_PropertyChangez\w+_SetSecureLockIconz\w+_StatusTextChangez\w+_TitleChangez \w+_MouseMovez\w+_MouseEnterz\w+_MouseLeavez \w+_Layoutz\w+_OnConnectingz\w+_FollowHyperlinkz\w+_ContentControlOnEnter)z>Runs when the file is opened (using InkPicture ActiveX object)z?Runs when the file is opened and ActiveX objects trigger eventsz%May read system environment variables)EnvironWin32_Environment EnvironmentExpandEnvironmentStringszHKCU\EnvironmentzHKEY_CURRENT_USER\EnvironmentzMay open a file)Openz+May write to a file (if combined with Open))WritePutOutputzPrint #z7May read or write a binary file (if combined with Open))BinaryzMay copy a file)FileCopyCopyFileCopyHere CopyFolderzMay move a file)MoveHereMoveFile MoveFolderzMay delete a file)KillzMay create a text file)CreateTextFilez ADODB.Stream WriteText SaveToFilez.May run an executable file or a system command)ShellvbNormal vbNormalFocusvbHidevbMinimizedFocusvbMaximizedFocusvbNormalNoFocusvbMinimizedNoFocusz WScript.ShellRun ShellExecute ShellExecuteAshell32 InvokeVerb InvokeVerbExDoItz May run a dll)ControlPanelItemz0May execute file or a system command through WMI)Createz7May run an executable file or a system command on a Mac) MacScript AppleScriptzMay run PowerShell commands) PowerShellnoexitExecutionPolicy noprofilecommandEncodedCommandzinvoke-command scriptblockzInvoke-ExpressionAuthorizationManagerz?May run an executable file or a system command using PowerShell)z Start-Process-May call a DLL using Excel 4 Macros (XLM/XLF))CALLzMay hide the application)zApplication.Visible ShowWindowSW_HIDEzMay create a directory)MkDirzMay save the current workbook)zActiveWorkbook.SaveAszrVs QqTr0&oz[0-7]c[USSS9$)NrrbaserSrTs r.rVrVss1Q4a'8r0z&hz [0-9a-fA-F]c[USSS9$)NrrZrSrTs r.rVrVsS1B%7r0"")escQuotec[US5$rRrrTs r.rVrVs s1Q4yr0rBW$(cUSnUS:aUS::a[[U55$[[U5RSS55$![a) [ R SW-5 [SU-5s$f=f)Nrzutf-8r5z.ERROR: incorrect parameter value for chr(): %rzChr(%r))rNchrunichrrOrrY exception)rUis r. vba_chr_tostrrls} 2 aD a4AsF's1v. . 'vay'7'7AS'TU U 2 FJK"9q=112s$A #A 0A>=A>Ascc[US5$rR)ordrTs r.rVrV+s QqTr0Valc:[USR55$rR)rstriprTs r.rVrV3sQqTZZ\!2r0rc<[[US5SSS25$)Nr)rNrrTs r.rVrV:s$7AaD $B$$Hr0rc$[SUS-5$)Nz%%%s%%r)rNrTs r.rVrVAs!4X!_!Er0) initChars bodyChars)r(Nc[US5$rRrarTs r.rVrVTs 3qt9r0 hex_stringcT[[R"UR55$r+)rNbinasciia2b_hexryrTs r.rVrVXs+>x?O?OPQP\P\?]+^r0c[US5$rRrarTs r.rVrVbs c!A$ir0 base64_stringcT[[R"UR55$r+)rNr{ a2b_base64r~rTs r.rVrVfs.A(BUBUVWVeVeBf.gr0cLUSSSS2n[SRU55$)zS parse action to concatenate strings in a VBA expression with operators '+' or '&' rNr(r7)rNrB)tokensstringss r.concat_strings_listrks) Qi!nG rwww/ 00r0+c.USSSS2n[U5$)zD parse action to sum integers in a VBA expression with operator '+' rNr()sumrintegerss r. sum_ints_listrs ay1~H x=r0c2USSSS2n[SU5$)zI parse action to subtract integers in a VBA expression with operator '-' rNr(c X- $r+r,r-ys r.rV$subtract_ints_list..QSr0r1rs r.subtract_ints_listrs" ay1~H .( ++r0c2USSSS2n[SU5$)zI parse action to multiply integers in a VBA expression with operator '*' rNr(c X-$r+r,rs r.rV$multiply_ints_list..rr0r1rs r.multiply_ints_listr" ay1~H .( ++r0c2USSSS2n[SU5$)zG parse action to divide integers in a VBA expression with operator '/' rNr(c X- $r+r,rs r.rV"divide_ints_list..rr0r1rs r.divide_ints_listrrr0*rc,UR[5$)a Check if the provided data is the content of a MSO/ActiveMime file, such as the ones created by Outlook in some cases, or Word/Excel when saving a file with the MHTML format or the Word 2003 XML format. This function only checks the ActiveMime magic at the beginning of data. :param data: bytes string, MSO/ActiveMime file content :return: bool, True if the file is MSO, False otherwise ) startswithMSO_ACTIVEMIME_HEADERdatas r. is_mso_filers ??0 11r0r-c  [U5(deSS/n[R"SUSS9SS-n[R SU-5 UR SU5 UH6n[R SU-5 [R"XS5nUs $ [R S5 [RU5HFnUR5n[R SU-5 [R"XS5nUs $ [S5e![R a<n[RS U-5 [R S S S 9 [S 5eSnAff=f![R a>n[RSU<SU<S35 [R S S S 9 SnAGMYSnAff=f![R a8n[RSU-5 [R S S S 9 SnAGMDSnAff=f)ae Extract the data stored into a MSO/ActiveMime file, such as the ones created by Outlook in some cases, or Word/Excel when saving a file with the MHTML format or the Word 2003 XML format. :param data: bytes string, MSO/ActiveMime file content :return: bytes string, extracted data (uncompressed) raise a MsoExtractionError if the data cannot be extracted 2i*z8Looking for potential zlib-compressed blocks in MSO filezzlib decompression failed (%s)z4Unable to decompress data from a MSO/ActiveMime file)rstruct unpack_fromrYdebuginserterrorinfor|zlib decompressre_zlib_headerfinditerrD)roffsetsrrGrDextracted_datamatchs r.mso_file_extractrs t    UmG O##D$t2F99F>H ,HH c>[U5R[5$)z returns True if string s only contains printable ASCII characters (i.e. contained in string.printable) This is similar to Python 3's str.isprintable, for Python 2.x. :param s: str :return: bool )setissubset_PRINTABLE_SET)ss r. is_printablers q6??> **r0cX- n[[R"[R"US555n[ US/5nSU- nU)nSU- S-nXEX64$)aF compute bit masks to decode a CopyToken according to MS-OVBA 2.4.1.3.19.1 CopyToken Help decompressed_current: number of decompressed bytes so far, i.e. len(decompressed_container) decompressed_chunk_start: offset of the current chunk in the decompressed container return length_mask, offset_mask, bit_count, maximum_length r(rir3)rmathceilrYmax)decompressed_currentdecompressed_chunk_start difference bit_count length_mask offset_maskmaximum_lengths r.copytoken_helprsc&@JDIIdhhz1567IYN#II%K,K )Q.N Y >>r0cT[U[5(d [U5n[RSR [ U555 [5nSnXnUS:wa[ SR U55eUS- nU[ U5:Ga Un[R"SXUS-5SnUS-S-nUS - S -nUS:wa [ S 5eUS - S-n[RS R XdU55 US:XaUS:a[ SU-5eUS:XaUS:wa[ SU-5eXF-[ U5:a[RS5 [[ U5XF-/5n US-nUS:XaURXUS-5 US- nO[ U5n X):aXn US- n[SS5Hn X):a OX- S-n U S:XaURX/5 US- nM2[R"SXUS-5Sn[[ U5U 5unnnnX-S-nUU-nSU- nUU- S-n[ U5U- n[UUU-5HnURUU/5 M US- nM X):aMU[ U5:aGM [U5$)z Decompress a stream according to MS-OVBA section 2.4.1 :param compressed_container bytearray: bytearray or bytes compressed according to the MS-OVBA 2.4.1.3.6 Compression algorithm :return: the decompressed container as a bytes string :rtype: bytes z-decompress_stream: compressed size = {} bytesrrzinvalid signature byte {0:02X}rr(ir3 rz9Invalid CompressedChunkSignature in VBA compressed streamz2chunk size = {}, offset = {}, compressed flag = {}iz:CompressedChunkSize=%d > 4098 but CompressedChunkFlag == 1z;CompressedChunkSize=%d != 4098 but CompressedChunkFlag == 0z3Chunk size is larger than remaining compressed datairr])r@ bytearrayrYrr:lenrrunpackwarningminextendxrangerbytes)compressed_containerdecompressed_containercompressed_currentsig_bytecompressed_chunk_startcompressed_chunk_header chunk_sizechunk_signature chunk_flagcompressed_endr flag_byte bit_indexflag_bit copy_tokenrrrrLlengthtemp1temp2r copy_sourceindexs r.decompress_streamr%s2: *I 6 6()=>II=DDSI]E^_`&[#7H49@@JKK! s#78 8!3 MM$ 4LbefLf g hij k .6!; 2b8D@ e #XY Y-3t;  FMMjr|}~ ?zD0Y\ffg g ?zT1Z]ggh h " .5I1J J KKM Nc"679O9\]^3a7 ? # ) )*>RdgkRk*l m $ & (++A'B $$5 1D "a'"!'1I);!* 6!;H1}.557K7_6`a*a/*#MM$0DXjmnXn0opqrs#BP 679QBS> [)Q",":a!? *[ 8 "Y"'5.A!5&)*@&AF&J %+Kv9M%NE299;QRW;X:YZ&O*a/*7".%5Y s#78 8` ' ((r0c\rSrSrSrSrSrg) VBA_Moduleizp Class to parse a VBA module from an OLE file, and to store all the corresponding metadata and VBA source code. c LXlSUlSUlSUlSUlSUlSUlSUlSUlSUl SUl SUl SUl SUl SUlSUlSUlSUlSUl[&R("SUR+S55SnUR-SSU5 [&R("SUR+S 55SnUR+U5nUR/U5Ul[1UR5Ul[&R("SUR+S55SnUS :Xax[&R("SUR+S 55SnUR+U5R3S S 5Ul[&R("SUR+S55SnUS :XGa[&R("SUR+S 55SnUR+U5nUR/U5Ul[1UR5Ul[&R("SUR+S55Sn UR-SSU 5 [&R("SUR+S 55SnUR+U5R3S S 5Ul[&R("SUR+S55SnUS:Xa[&R("SUR+S 55SnUR+U5n UR/U 5Ul[&R("SUR+S55Sn UR-SSU 5 [&R("SUR+S 55SnUR+U5Ul[&R("SUR+S55SnUS:Xa[&R("SUR+S 55SnUR-SS U5 [&R("SUR+S 55SUl [&R("SUR+S55SnUS:Xa[&R("SUR+S 55Sn UR-SS U 5 [&R("SUR+S 55Sn [&R("SUR+S55SnUS:Xa[&R("SUR+S 55SnUR-SSU5 [&R("SUR+S55Sn [&R("SUR+S55SnUS:XdUS:XaXXpl [&R("SUR+S 55Sn [&R("SUR+S55SnUS:XalSUl [&R("SUR+S 55Sn UR-SSU 5 [&R("SUR+S55SnUS:XalSUl [&R("SUR+S 55Sn UR-SSU 5 [&R("SUR+S55SnUS :Xa>[&R("SUR+S 55Sn UR-S!SU 5 SnUS:wa$[4R7S"R9U55 [4R;S#R9UR55 [4R;S$R9UR 55 [4R;S%R9UR55 SnURUR URUR4nUHunUcMUR<S&-U-Ul[4R;S'UR$-5 UR>RAUR$5R+5n O Uce[4RES+X1RFS,RIS-U554-5 URJ(ag[MS.S&UR-5e[4R;S/R9[OU555 [4R;S0R9UR55 XRSn[OU5S:a[Q[SU55nXl UR/U5Ul[1UR5UlURRTRWURRY5S15nS2R9URU5Ul[1UR 5Ul[4R;S3R9UR"55 g[4R7S4R9UR 55 g![Ba*n[4R;S(U<S)U<S*35 SnAGMSnAff=f![Z[L4a e[\a3n[4RES5R9X1RF5SS69 eSnAff=f)7a] Parse a VBA Module record from the dir stream of a VBA project. Reference: MS-OVBA 2.3.4.2.3.2 MODULE Record :param VBA_Project project: VBA_Project, corresponding VBA project :param olefile.OleStream dir_stream: olefile.OleStream, file object containing the module record :param int module_index: int, index of the module in the VBA project list NFrr(r MODULENAME_Id.Rs"%C8A&);%6%<8Asz[BASE]zlength of code_data = {0}zoffset of code_data = {0}vbaz{0}.{1}zextracted file {0}z(module stream {0} has code data length 0z Error parsing module {0} of {1}:r)/projectrname_str _name_unicode streamnamestreamname_str_streamname_unicode docstring_docstring_unicode textoffsetrreadonlyprivatecode_rawcodecode_strrc filename_str code_pathrrread check_value decode_bytesrQrSrYrr:rvba_rootole openstreamIOErrorr modules_countrBrelaxedrrrr module_extgetlowerr Exception)rer  dir_stream module_index_idsizemodulename_bytes section_idstreamname_bytesreserveddocstring_bytesmodulehelpcontext_size helpcontextcookie code_data try_namesrioefilextrGs r.raVBA_Module.__init__s    !"#' "&        b --jooa&89!DI' 2DM tZ__Q-?@CJV#}}T:??1+=>qA%/__T%:%A%A*i%X"#]]41CDQG V#}}T:??1+=>qA#-??4#8 ")"6"67G"H&1$//&B#!==zq/AB1E##$?R}}T:??1+=>qA+5??4+@+G+G T]+^(#]]41CDQG V#}}T:??1+=>qA",//$"7!(!5!5o!F!==zq/AB1E##$>Q}}T:??1+=>qA*4//$*?'#]]41CDQG V#}}T:??1+=>qA##$7F"(--jooa6H"I!"L#]]41CDQG V#*0tZ__Q=O)PQR)S&##$qA##$7FtZ__Q-?@C#]]41CDQG V#zV';' !==zq/AB1E#]]41CDQG V#!% !==zq/AB1E##$=vxP#]]41CDQG V# $ !==zq/AB1E##$"OP$+KK$:$:4>>$J$O$O$Q  ) O(*?*?HH%C8A%CCDDE??,Xv 7IJJ II188YH I II188I J!//"23I9~!-i .BC ) #00; +DII 6 0044TYY__5FN * 1 1$))V D $/ $>! .55d6G6GHI FMMdNaNabc?#8 %0##7888@$%78    HH7f\+@+@A"  $   sR^#k.A,jAk-Fk0.k k)kkkkl#0.ll#)rr rrrrrrrcrrr rr rr r rrNrr,r0r.rrs  Ir0rc>\rSrSrSrS SjrSrSrSrS Sjr Sr g ) VBA_Projectixzm Class to parse a VBA project from an OLE file, and to store all the corresponding metadata and VBA modules. cj(XlX lX0lX@lXPl/Ul0Ul[RSU-5 URU5R5n[[[U555nXpl[R "SURS55SnUR#SSU5 [R "SURS55Sn UR#S SU 5 [R "SURS55SUlS S S S S.n U R'UR$S5Ul[RSUR$UR(4-5 UR$U ;a.[R+SR-UR$55 [R "SURS55Sn U S:XaU n UR#SSU 5 [R "SURS55Sn UR#SSU 5 [R "SURS55Sn[RSR-US95 [R "SURS55Sn U nUR#SSU5 [R "SURS55SnUR#SSU5 [R "SURS55SUlUR#SSUR.5 [R "SURS55SnUR#SSU5 [R "SURS55SnUR#SSU5 [R "SURS55SUlUR#SSUR05 [R "SURS55SnUR#SS U5 [R "SURS55SnUR#S!SU5 [R "SURS55SUl[4R6"UR25Ul[RS"UR2<S#UR8<35 [4R:"UR25Ul[RS$UR2UR<4-5 [R "SURS55SnUR#S%SU5 [R "SURS55Sn[RS&U-5 US:dUS':a$[R+S(R-U55 URU5nUR?U5Ul [R "SURS55SnUR#S)S*U5 [R "SURS55SnUS+:a$[R+S,R-U55 URU5nUR?U5Ul![R "SURS55SnUR#S-S.U5 [R "SURS55SnUS-S:wa[R+S/5 URU5nURES0S1S29Ul#[R "SURS55SnUR#S3S4U5 [R "SURS55SnUS5:a$[R+S6R-U55 URU5n [R "SURS55Sn!UR#S7S8U!5 [R "SURS55Sn"U"U:wa[R+S95 URU"5n#U#U :wa[R+S:5 [R "SURS55Sn$UR#S;SS?U(5 [R "SURS55Sn)UR#S@SU)5 [R "SURS55Sn*UR#SASU*5 [R "SURS55Sn+UR#SBSCU+5 [R "SURS55Sn,UR#SDSU,5 [R "SURS55Sn-[R "SURS55Sn.U-n'U.n'[R "SURS55Sn/UR#SESFU/5 [R "SURS55Sn0U0SG:a$[R+SHR-U055 URU05n1[R "SURS55Sn2UR#SISJU25 [R "SURS55Sn3U3S-S:wa[R+SK5 URU35n4U1n'U4n'SLn5[R "SURS55Sn5[RSMR-U555 U5SN:XagLU5SO:XGaU5n6[R "SURS55Sn7URU75n8[RSP[IUR?U855-5 [R "SURS55Sn9U9SQ:XaC[R "SURS55Sn:URU:5n;U6n'U8n'U;n'GM:U9n5[RSMR-U555 U5SR:XasU5n<[R "SURS55Sn=URU=5n>[RSS[IUR?U>55-5 Un'GMU5ST:XGa^U5n?[R "SURS55Sn@[R "SURS55SnAURUA5nB[RSU[IUR?UB55-5 [R "SURS55SnCUR#SVSUC5 [R "SURS55SnDUR#SWSUD5 U?n'U@n'UBn'[R "SURS55SnEUESO:XGaU5nF[R "SURS55SnGURUG5nH[RSX[IUR?UH55-5 [R "SURS55SnIUISQ:Xaj[R "SURS55SnJURUJ5nK[R "SURS55SnLWFn'WHn'UKn'OWInLOWEnLUR#SYSZWL5 [R "SURS55SnM[R "SURS55SnNURUN5nO[R "SURS55SnP[R "SURS55SnQURS[5nR[R "SURS55SnSUMn'UOn'UPn'UQn'URn'USn'GM>U5S\:XGaU5nT[R "SURS55SnU[R "SURS55SnVURUV5nW[RS][IUR?UW55-5 [R "SURS55SnXUR#S^SUX5 [R "SURS55SnYUR#S_SUY5 UTn'UUn'UWn'GM[U5S`:XGa`U5nZ[R "SURS55Sn[[R "SURS55Sn\URU\5n][RSa[IUR?U]55-5 [R "SURS55Sn^URU^5n_[RSb[IUR?U_55-5 [R "SURS55Sn`[R "SURS55SnaUZn'U[n'U]n'U_n'U`n'Uan'GM[R+ScR-U555 [KUSdSeU55e)fak Extract VBA macros from an OleFileIO object. :param vba_root: path to the VBA root storage, containing the VBA storage and the PROJECT stream :param project_path: path to the PROJECT stream :param relaxed: If True, only create info/debug log entry if data is not as expected (e.g. opening substream fails); if False, raise an error in this case zParsing the dir stream from %rrr(rPROJECTSYSKIND_IdrrrPROJECTSYSKIND_Sizez16-bit Windowsz32-bit Windows Macintoshz64-bit Windows)rrr(r3UnknownzPROJECTSYSKIND_SysKind: %d - %sz&invalid PROJECTSYSKIND_SysKind {0:04X}JPROJETCOMPATVERSION_IdPROJECTCOMPATVERSION_Sizez compat version: {compat_version})compat_versionPROJECTLCID_IdPROJECTLCID_SizePROJECTLCID_Lcidi PROJECTLCIDINVOKE_IdPROJECTLCIDINVOKE_SizePROJECTLCIDINVOKE_LcidInvokePROJECTCODEPAGE_Idr3PROJECTCODEPAGE_SizezProject Code Page:  - z.Python codec corresponding to code page %d: %sPROJECTNAME_IdzProject name size: %d bytesz=PROJECTNAME_SizeOfProjectName value not in range [1-128]: {0}PROJECTDOCSTRING_Idr4iz8PROJECTDOCSTRING_SizeOfDocString value not in range: {0}PROJECTDOCSTRING_Reserved@z3PROJECTDOCSTRING_SizeOfDocStringUnicode is not evenutf16rKrLPROJECTHELPFILEPATH_Idriz;PROJECTHELPFILEPATH_SizeOfHelpFile1 value not in range: {0}PROJECTHELPFILEPATH_Reserved=zVPROJECTHELPFILEPATH_SizeOfHelpFile1 does not equal PROJECTHELPFILEPATH_SizeOfHelpFile2zJPROJECTHELPFILEPATH_HelpFile1 does not equal PROJECTHELPFILEPATH_HelpFile2PROJECTHELPCONTEXT_IdrPROJECTHELPCONTEXT_SizePROJECTLIBFLAGS_IdrPROJECTLIBFLAGS_SizePROJECTLIBFLAGS_ProjectLibFlagsPROJECTVERSION_IdrPROJECTVERSION_ReservedPROJECTCONSTANTS_Idriz8PROJECTCONSTANTS_SizeOfConstants value not in range: {0}PROJECTCONSTANTS_Reserved<z3PROJECTCONSTANTS_SizeOfConstantsUnicode is not evenNzreference type = {0:04X}rzREFERENCE name: %s>3zREFERENCE original lib id: %s/z%REFERENCE control twiddled lib id: %sREFERENCECONTROL_Reserved1REFERENCECONTROL_Reserved2z*REFERENCE control name record extended: %sREFERENCECONTROL_Reserved30r] zREFERENCE registered lib id: %sREFERENCEREGISTERED_Reserved1REFERENCEREGISTERED_Reserved2z%REFERENCE project lib id absolute: %sz%REFERENCE project lib id relative: %sz#invalid or unknown check Id {0:04X}zreference type)rr_rarbrgrj)&rr project_pathdir_pathr!modulesr"rYrrrrrrr&rrrsyskindr# syskind_namerr:lcid lcidinvokecodepager%get_codepage_name codepage_namecodepage2codeccodecr projectnamerrSdocstring_unicoderQr)brerrrkrlr!dir_compressedr&projectsyskind_idprojectsyskind_size SYSKIND_NAME project_idprojectcompatversion_idprojectcompatversion_size"projectcompatversion_compatversionprojectlcid_idprojectlcid_sizeprojectlcidinvoke_idprojectlcidinvoke_sizeprojectcodepage_idprojectcodepage_sizeprojectname_idsizeof_projectnameprojectname_bytesprojectdocstring_id!projectdocstring_sizeof_docstringr.projectdocstring_reserved)projectdocstring_sizeof_docstring_unicodedocstring_unicode_bytesprojecthelpfilepath_id$projecthelpfilepath_sizeof_helpfile1projecthelpfilepath_helpfile1projecthelpfilepath_reserved$projecthelpfilepath_sizeof_helpfile2projecthelpfilepath_helpfile2projecthelpcontext_idprojecthelpcontext_sizeprojecthelpcontext_helpcontextunusedprojectlibflags_idprojectlibflags_sizeprojectlibflags_projectlibflagsprojectversion_idprojectversion_reservedprojectversion_versionmajorprojectversion_versionminorprojectconstants_id!projectconstants_sizeof_constantsprojectconstants_constantsprojectconstants_reserved)projectconstants_sizeof_constants_unicode"projectconstants_constants_unicodecheck reference_idreference_sizeof_namereference_namereference_reservedreference_sizeof_name_unicodereference_name_unicodereferenceoriginal_id&referenceoriginal_sizeof_libidoriginalreferenceoriginal_libidoriginalreferencecontrol_idreferencecontrol_sizetwiddled%referencecontrol_sizeof_libidtwiddledreferencecontrol_libidtwiddledreferencecontrol_reserved1referencecontrol_reserved2check2&referencecontrol_namerecordextended_id/referencecontrol_namerecordextended_sizeof_name(referencecontrol_namerecordextended_name,referencecontrol_namerecordextended_reserved7referencecontrol_namerecordextended_sizeof_name_unicode0referencecontrol_namerecordextended_name_unicodereferencecontrol_reserved3referencecontrol_sizeextended%referencecontrol_sizeof_libidextendedreferencecontrol_libidextendedreferencecontrol_reserved4referencecontrol_reserved5 referencecontrol_originaltypelibreferencecontrol_cookiereferenceregistered_idreferenceregistered_size referenceregistered_sizeof_libidreferenceregistered_libidreferenceregistered_reserved1referenceregistered_reserved2referenceproject_idreferenceproject_size%referenceproject_sizeof_libidabsolutereferenceproject_libidabsolute%referenceproject_sizeof_libidrelativereferenceproject_libidrelativereferenceproject_majorversionreferenceproject_minorversionsb r.raVBA_Project.__init__~s )    2X=>1668.y/HIJ $ #MM$ 0BCAF ,f6GH$mmD*//!2DEaH .8KL}}T:??1+=>qA """  ),,T\\9E 3t||TEVEV6WWX <<| + II>EEdllS T]]4);B!==zq/AB1E +V5EFMM$ (:;A>  +UDII> &}}T:??13EFqI /9MN!'tZ__Q5G!H!K 16;QR --jooa.@A!D 7P$]]41CDQG -v7IJ%}}T:??13EFqI /9MN dJOOA,>?B &88G $--ASASTU--dmm<  BdmmUYU_U_E``a  tZ__Q-?@C )6>B#]]41CDQG /2DDE  !%7#%= IIU\\]op q&OO,>?,,->? %mmD*//!2DEaH .8KL,2MM$ PQ@R,STU,V) ,t 3 IIJQQRst v %//*KL**?;$*MM$ 8J$KA$N! 4f>WX4:MM$ XYHZ4[\]4^1 4q 8A = IIK L#-//2["\!8!?!?PY!?!Z"(tZ__Q5G!H!K 16;QR/5}}T:??STCU/VWX/Y, /# 5 IIMTTUyz |(28\(]%'-}}T:??1;M'Nq'Q$ 7A]^/5}}T:??STCU/VWX/Y, /3W W IIn o(28\(]% (,I I IIb c!' dJOOA4F G J 0&:OP"(--jooa6H"I!"L 2FP*QRS*T' :FDcd#MM$ 0BCAF ,f6GH"(--jooa6H"I!"L 2FWX4:MM$ XYHZ4[\]4^1 4q 8A = IIK L-7__=f-g*+3MM$ (:;A>E II077> ? % (. dJOOA dJOO\]L^8_`a8b51;Af1g. AKPTPaPacAQBECCD-3]]4QRAS-TUV-W*  !=vGab-3]]4QRAS-TUV-W*  !=vGab,67tZ__Q-?@CV#=B:FLmmTXZdZiZijkZlFmnoFpC?IG@I<IIJ[))*RSNUUVCI==QUWaWfWfghWiCjklCm@CvMRXR_R_`dfpfufuvwfxRyz{R|OKU??SLUH5;]]4YZI[5\]^5_2!G!I!Q5a217.  !=vGab06 dJOOTUDV0WXY0Z-8> dJOO\]L^8_`a8b51;Af1g.-3]]4QRAS-TUV-W*-3]]4QRAS-TUV-W*3=??23F0*0--jooa>P*QRS*T'673390*/&+1==zq?Q+RST+U(39==zWXGY3Z[\3]0,6OO<\,]) ;k$J[J[\uJv>wwx06 dJOOTUDV0WXY0Z-  !@&Jgh06 dJOOTUDV0WXY0Z-  !@&Jgh/12',#(. dJOOA dJOO\]L^8_`a8b51;Af1g. AKPTPaPacAQBECCD8> dJOO\]L^8_`a8b51;Af1g. AKPTPaPacAQBECCD06 dJOOTUDV0WXY0Z-06 dJOOTUDV0WXY0Z-,.7766 II;BB5I J%h0@Bfhmn nr0cX#:waNUR(a&[RSRXU55 g[ UR XU5eg)Nz2invalid value for {0} expected {1:04X} got {2:04X})r!rYrr:rrl)rerrrs r.rVBA_Project.check_valuesF  || P!6$%8:*$--OO r0c:URRUR5n0UlUHnUR U5n[ R SU-5 UR5nSU;dMDURSS5up4UR5nUS:Xa*URSS5Sn[URU'MUS:Xa[URU'MUS:Xa[URU'MUS :XdM[URU'M g ) z8 Parse the PROJECT stream from the VBA project :return: z PROJECT: %r=rDocumentrrModuleClass BaseClassN) rrrkr"rrYrrrsplitr$CLASS_EXTENSIONMODULE_EXTENSIONFORM_EXTENSION)reproject_streamlinerrs r.parse_project_stream VBA_Project.parse_project_streams,,T->->?,"D$$T*D IImd* +::c6URURUS9$)z Decode a bytes string to a unicode string, using the project code page :param bytes_string: bytes, bytes string to be decoded :param errors: str, mode to handle unicode conversion errors :return: str/unicode, decoded string rL)rSrv)rerTrMs r.rVBA_Project.decode_bytes*s""4::f"==r0)rvrrrtrlr&rrxrprqr"rmr rrkrwr!rnrorNT)rK) rjrkrlrmrnrarrrrror,r0r.r8r8xs% Qoh P4r0r8c## [RSU-5 [XX#U5nUR5 UR 5H upgnXgU4v M g7f)a Extract VBA macros from an OleFileIO object. Internal function, do not call directly. vba_root: path to the VBA root storage, containing the VBA storage and the PROJECT stream vba_project: path to the PROJECT stream :param relaxed: If True, only create info/debug log entry if data is not as expected (e.g. opening substream fails); if False, raise an error in this case This is a generator, yielding (stream path, VBA filename, VBA source code) for each VBA code stream z relaxed is %sN)rYrr8rr) rrrkrlr!r rrcr2s r. _extract_vbar5sVIIo'(#IG   "*1*?*?*A& YI..+BsAAcURSS5nURSS5nURSS5nU$! [RS[U5-5 e=f)z Parse a VBA module code to detect continuation line characters (underscore) and collapse split lines. Continuation line characters are replaced by spaces. :param vba_code: str, VBA module code :return: str, VBA module code with long lines collapsed z _  z _ z _ ztype(vba_code)=%s)rKrYrjr)vba_codes r.vba_collapse_long_linesrIsd##Hc2##FC0##FC0 O )DN:; s 6:$AcUR5nSnUH&nURS5(a SU;aUS- nM& O SRXS5nU$)a Filter VBA source code to remove the first lines starting with "Attribute VB_", which are automatically added by MS Office and not displayed in the VBA Editor. This should only be used when displaying source code for human analysis. Note: lines are not filtered if they contain a colon, because it could be used to hide malicious instructions. :param vba_code: str, VBA source code :return: str, filtered VBA source code rz Attribute VB_:r N) splitlinesrrB)r vba_linesrDrrs r. filter_vbar\s\##%I E ??? + +C4K QJE   ))If% &C Jr0c/nSnU(aSU-n[R5HmupEUHbn[R"S[R"U5-S-U5nU(dM=UR 5nUR XU-45 Md Mo [R5HYupEUHNn[R"SU-S-U5nU(dM)UR 5nUR XU-45 MP M[ U$)aQ Detect if the VBA code contains keywords corresponding to macros running automatically when triggered by specific actions (e.g. when a document is opened or closed). :param vba_code: str, VBA source code :param obfuscation: None or str, name of obfuscation to be added to description :return: list of str tuples (keyword, description) r7 (obfuscation: %s)(?i)\b\b)AUTOEXEC_KEYWORDSitemsresearchescapegrouprAUTOEXEC_KEYWORDS_REGEX r obfuscationresultsobf_text descriptionkeywordskeywordr found_keywords r.detect_autoexecrtsGH'+5!2!8!8!: GIIi"))G*<!>!@ GIIi'1E98DEu %  X/EFG  "A Nr0c/nSnU(aSU-n[R5HmupEUHbn[R"S[R"U5-S-U5nU(dM=UR 5nUR XU-45 Md Mo [R5HYupEUHNn[R"SU-S-U5nU(dM)UR 5nUR XU-45 MP M[ [R5HDupEUH9nUR5U;dMUS:XaUbM$UR XdU-45 M; MF U$)a  Detect if the VBA code contains suspicious keywords corresponding to potential malware behaviour. :param vba_code: str, VBA source code :param obfuscation: None or str, name of obfuscation to be added to description :return: list of str tuples (keyword, description) r7rrrr=) SUSPICIOUS_KEYWORDSrrrrrrSUSPICIOUS_KEYWORDS_REGEXSUSPICIOUS_KEYWORDS_NOREGEXr$r s r.detect_suspiciousrs?GH'+5!4!:!:!< GIIi"))G*<XB;dMEUR5[;dM_[[R"U55nURXE45 URU5 M U$![[4a#n[ R#SU-5 SnAMSnAff=f)z Detect if the VBA code contains strings encoded in base64. :param vba_code: str, VBA source code :return: list of str tuples (encoded string, decoded string) rAzFailed to base64-decode (%s)N)rre_base64_stringrrrrre_nothex_checkrr$BASE64_WHITELISTrVbase64 b64decoderr TypeErrorrrYrrr rrrr$rGs r.detect_base64_stringsr.sG EE!**84 ##C(%%e,,   %++-7G"G @#F$4$4U$;</0 % 5 Nz* @ 83>?? @sAC  C=C88C=cdSnUHnUR5(dMX- nM [U5$)Nr7isdigitrinputresultr<s r. StripCharsr5 s/ F  99;; KF v;r0cnSnUH#nUR5(aX- nMUS- nM% [U5$)Nr70r0r2s r.StripCharsWithZeror8 s8 F  99;; KF cMF  v;r0cxUSSn[U[U5S- S- [U5S- 5n[U[U5S- [U5S- S-5nX2- nUS[U5S- S- U[U5S- S-S-n[U[U5S- US- - [U5S- US- -5nUS[U5S- US- - U[U5S- US- -S-n[S[U5U5Vs/sH oaXfU-PM nnSnUHn U[ [U 5U- 5- nM U$s snf)Nrr(rr7)r8rr5rangerh) inputTextwork strKeyEnc strKeySize nCharSize strKeyEnc2rk work_splitr$rs r.DridexUrlDecoderC sg Qr?D"4TQ!(;c$i!m#MNI#D#d)a-3t9q=A:M$NOJ&I $#d)a-1$ %c$i!mq-@-A(B BDD#d)a-IaK!@3t9q=U^_`U`BabcJ 0#d)a-IaK0 1D#d)a-IVWK9X9Y4Z ZD/4QD 9/MN/M!q9%/MJNG3z%(344 N Os>D7c/n[5n[RU5HqnUR5SSn[R U5(dM2XB;dM9[ [U55nURXE45 URU5 Ms U$![a#n[RSU-5 SnAMSnAff=f)z Detect if the VBA code contains strings obfuscated with a specific algorithm found in Dridex samples. :param vba_code: str, VBA source code :return: list of str tuples (encoded string, decoded string) rrtzFailed to Dridex-decode (%s)N) rre_dridex_stringrrr(rrVrCrrr%rYrr-s r.detect_dridex_stringsrF2 sG EE!**84 a#%%e,,    @#OE$:;/0 % 5 N @ 83>?? @s7B C#CCcL/n[5nUR5nUR5Hsn[R U5HWupEnX5UnUSn[ U[ 5(dM&Xr;dM-X:wdM4URXx45 URU5 MY Mu U$)z Detect if the VBA code contains strings obfuscated with VBA expressions using keywords such as Chr, Asc, Val, StrReverse, etc. :param vba_code: str, VBA source code :return: list of str tuples (encoded string, decoded string) r) r expandtabsr vba_expr_str scanStringr@rNrr) rr rvba_linerrDrEencodedr$s r.detect_vba_stringsrMK sG EE""$H'')"."9"9("C F3S)GQiG'#677'G,>NNG#56IIg&#D*$ Nr0cUcU$[U[[[45(aU$[U[5(a[ (aUR X5RX5nX0:wa\[RSRU[U555 [RSRU[U555 U$U$[U[5(aB[ (a7URX5n[RSRU55 U$[U[5(aB[ (d7UR X5n[RSRU55 U$[U[5(aUHn[X5X'M U$[U[ ["45(aUHn[U5nM U$[RSR[%U555 U$)z ensure there is no unicode in json and all strings are safe to decode works recursively, decodes and re-encodes every string to/from unicode to ensure there will be no trouble in loading the dumped json output z#json2ascii: replaced: {0} (len {1})z#json2ascii: with: {0} (len {1})zjson2ascii: encode unicode: {0}z1unexpected type in json2ascii: {0} -- leave as is)r@boolrfloatrrNrSrOrYrr:runicoderdict json2asciilistrr)json_objrUrMdencodedjson_obj_bytes json_obj_strkeyitems r.rSrSp s P OO HtS%0 1 1 L OK Hc " " 7x8??QH# ? &3x=9; ? &3x=9;OO Hg & &77!: 3::>JK He $ $WWx8  3::<HI Hd # #C&x}5HM O HtEl + +Dd#D O E6$x.) + Or0c U(aU(a [S5eUb8[U[5(d#[SR[ U555eU(aUn[ R "[U5SSSS9R5nU(dgU(a[SUS-5 O[S US-5 US SHn[SUR5-5 M! g) aline-wise print of json.dumps(json2ascii(..)) with options and indent+1 can use in two ways: (1) print_json(some_dict) (2) print_json(key1=value1, key2=value2, ...) This is compatible with :py:mod:`oletools.common.log_helper`: log messages can be mixed if arg `use_json` was `True` in :py:func:`log_helper.enable_logging` provided this function is called before the first "regular" logging with `_json_is_first=True` (and non-empty input) but after log_helper.enable_logging. zOInvalid json argument: want either single dict or key=value parts but got both)Nz^Invalid json argument: want either single dict or key=value parts but got {0} instead of dict)Fr)check_circularindent ensure_asciiz rz, r) rr@rRr:rjsondumpsrSrprintrstrip) json_dict_json_is_first json_partslinesrs r. print_jsonrg sZ9: :  *Y*E*EH &i13 3 JJz),Ue 55?Z\  hq!" hq!"ab  h&'r0c.\rSrSrSrSrSSjrSrSrg) VBA_Scanneri z Class to scan the source code of a VBA module to find obfuscated strings, suspicious keywords, IOCs, auto-executable macros, etc. c[U5UlSUlSUlSUlSUlSUlSUlSUlSUl SUl SUl SUl SUl SUlSUlSUlg)zO VBA_Scanner constructor :param vba_code: str, VBA source code to be analyzed r7N)rrcode_hex code_hex_rev code_rev_hex code_base64 code_dridexcode_vba strReverser autoexec_keywordssuspicious_keywordsiocs hex_stringsbase64_stringsdridex_strings vba_strings)rers r.raVBA_Scanner.__init__ s,H5    !%#'  ""r0c j [UR5UlSUlSURR 5;aSUlURHup4U=R SU-- slUR(dM0U=R SUSSS2-- slU=RS[[R"USSS255-- slM [UR5Ul URHup4U=RSU-- sl M [UR5UlURHup4U=R SU-- slM U(a[#UR5UlO/UlUR$Hup4U=R&SU-- slM /n/Ul/Ul/UlURS4UR S4UR S4URS 4URS 4UR S 4UR&S 44H_upgU=R([/Xg5- slU=R*[1Xg5- slU=R,[3Xg5- slMa UR(aUR*R5S 5 UR(aUR*R5S5 UR(aUR*R5S5 UR$(aUR*R5S5 [75nUR(H0upX;dM UR5SX45 UR9U 5 M2 [75nUR*H0upX;dM UR5SX45 UR9U 5 M2 [75nUR,H0upX;dM UR5SX45 UR9U 5 M2 URH1up4U(d[;U5(dMUR5SXC45 M3 URH1up4U(d[;U5(dMUR5SXC45 M3 URH1up4U(d[;U5(dMUR5SXC45 M3 UR$H1up4U(d[;U5(dMUR5SXC45 M3 XPlU$)a Analyze the provided VBA code to detect suspicious keywords, auto-executable macros, IOC patterns, obfuscation patterns such as hex-encoded strings. :param include_decoded_strings: bool, if True, all encoded strings will be included with their decoded content. :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow) :return: list of tuples (type, keyword, description) (type = 'AutoExec', 'Suspicious', 'IOC', 'Hex String', 'Base64 String' or 'Dridex String') F strreverseTrNrtHexzHex+StrReversezStrReverse+HexBase64DridexzVBA expression)z Hex Stringsz`Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all))zBase64 StringszcBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all))zDridex StringszcDridex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all))zVBA obfuscated StringszcVBA string expressions were detected, may be used to obfuscate strings (option --decode to see all)r SuspiciousIOCz Hex Stringz Base64 Stringz Dridex string VBA string)r%rrurqr$rkrlrmrVr{r#r.rvrnrFrwrorMrxrprrrsrtrrr rrrrr ) reinclude_decoded_strings deobfuscaterLr$r rr  keyword_setrr rrs r.scanVBA_Scanner.scan s^.dii8 499??, ,do $ 0 0 G MMTG^ +M!!TGDbDM%99!!!TIh6H6HQUSUQU6W,X%XX!!14DII> $ 3 3 G   w . !44DII> $ 3 3 G   w . !4 1$)).>*?A Ar0)rrrvrrnrorkrlrmrprwrurtr rqrsrxNFF) rjrkrlrmrnrarrror,r0r.riri s  4hTAr0ric6[U5RX5$)aN Analyze the provided VBA code to detect suspicious keywords, auto-executable macros, IOC patterns, obfuscation patterns such as hex-encoded strings. (shortcut for VBA_Scanner(vba_code).scan()) :param vba_code: str, VBA source code to be analyzed :param include_decoded_strings: bool, if True all encoded strings will be included with their decoded content. :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow) :return: list of tuples (type, keyword, description) with type = 'AutoExec', 'Suspicious', 'IOC', 'Hex String', 'Base64 String' or 'Dridex String' )rir)rrrs r.scan_vbarc s x % %&= KKr0c\rSrSrSrSSS\S4SjrSrSrS r S r S r S r S r SrS%SjrSrSrSrSrSrSrSrS%SjrSrSrSrSrS&SjrSrSrSrS r S!r!S"r"S#r#S$r$g)' VBA_Parseriu zR Class to parse MS Office files, to detect VBA macros and extract VBA source code NTFcUc UnSUlO[U5nSUlSUl/UlXlX0lX@lSUlSUlSUl SUl SUl SUl SUl SUlSUlSUlSUlSUlSUlSUlSUlSUlXPl/UlSUlX`lSUlSUlSUlSUlSUl[@RB"URUS9Ul"[FRISURDRJRL<SURDR <35 [NRP"U5(a!URSU5 URU5 URc,[VRX"U5(aUR[U5 URGcZUc%[]US5nUR_5nSSS5 S U;aURaU5 S U;aURcU5 URe5n URcSS U ;aMS U ;aGS U ;aA[gU RiS 5U RiS 5- 5S:aURkU5 [lRn"USS9(a/SUR-n [FRqU 5 [sU 5eURuS5(aURwU5 URcSU;aURyU5 URc/SUR-n [FRqU 5 [sU 5eg!,(df  GN~=f)a Constructor for VBA_Parser :param str filename: filename or path of file to parse, or file-like object :param bytes data: None or bytes str, if None the file will be read from disk (or from the file-like object). If data is provided as a bytes string, it will be parsed as the content of the file in memory, and not read from disk. Note: files must be read in binary mode, i.e. open(f, 'rb'). :param str container: str, path and filename of container if the file is within a zip archive, None otherwise. :param bool relaxed: if True, treat mal-formed documents and missing streams more like MS office: do nothing; if False (default), raise errors in these cases :param str encoding: encoding for VBA source code and strings. Default: UTF-8 bytes strings on Python 2, unicode strings on Python 3 (None) raises a FileOpenError if all attempts to interpret the data header failed. NTFrrzftguess: file type=z - container=rbs4http://schemas.microsoft.com/office/word/2003/wordmls3http://schemas.microsoft.com/office/2006/xmlPackagesmimesversions multipartrF)treat_str_as_datazL%s is RTF, which cannot contain VBA Macros. Please use rtfobj to analyse it.sIDz;%s is not a supported file type, cannot extract VBA Macros.)= file_on_diskrole_file ole_subfilesrc containerr!r vba_projects vba_formscontains_vba_macroscontains_xlm_macrosvba_code_all_modulesrmanalysis_results nb_macros nb_autoexec nb_suspiciousnb_iocs nb_hexstringsnb_base64stringsnb_dridexstrings nb_vbastringsrU xlm_macrosno_xlm disable_pcodepcodedmp_outputvba_stomping_detected is_encryptedxlm_macrosheet_foundtemplate_injection_foundr&FileTypeGuesserftgrYrftyperolefile isOleFileopen_oleopen_pptzipfile is_zipfile open_openxmlrGropen_word2003xml open_flatopcr$absropen_mhtr"is_rtfrrsropen_slk open_text) rercrrr!rUr_file file_handledata_lowercaserbs r.raVBA_Parser.__init__{ s2 <E $D DME %D   "   #' #' $(! $  ! !  *#%)"!$)!(-%**4==tD DHHNN)n,.N((4~7K7KG7TTUXZZ d#}}TT:egkgtgtt #C((u%% d#yy WD%8t$ 99 ORVR_R__C HHSM$ $ O*)s 2M:: N cP[RSUR-5 [R"USS9Ul[ Ulg![[[4aFn[RSUR<SU<S35 [RSSS 9 SnAgSnAff=f) z\ Open an OLE file :param _file: filename or file contents in a file object :return: nothing zOpening OLE file %sN) path_encodingzFailed OLE parsing for file rr>rTr) rYrrcr OleFileIOrTYPE_OLErrr,rr)rerrGs r.rVBA_Parser.open_ole sv &67 /#--e4HDM DIJ/ / HHdmmSQ R IIhI . /s%A B%rTrz4Error {0} caught in Zip/OpenXML parsing for file {1}z$Failed Zip/OpenXML parsing for file r)rYrrcrZipFilenamelistrr:rGrrrMAGICappend_subfiler^r!rclose TYPE_OpenXMLr RuntimeError BadZipfile LargeZipFiler)rerzsubfilermagicole_datarGs r.rVBA_Parser.open_openxml s .>?E /&A::< .55g>?VVG_ (,,S-?@E -< "BW"LMVVG_ '2'7'7'9H- > //x/PO%_(d GGI$DI-_ 3>#|| #gWZ)[ \ # (T B (Y%_\'99<'>!> >Q%_f# ||O &mm46 (T 2g00'2F2FP / HH!]]C1 2 IIhI .  /sAGA&G(D:9GE 'G: E G GAF=G G&F==GG G  G J2"AH;:H;;1J2,[RSR#XG55 [R%SSS9 SnAM['URXG5eSnAff=f![aXnUR (aA[RS UR<S U<S 35 [R%SSS9 SnAgeSnAf[,aFn[RS UR<S U<S 35 [R%SSS9 SnAgSnAff=f) z\ Open a Word 2003 XML file :param data: file contents in a string or bytes :return: nothing zOpening Word 2003 XML file %sz noname.msorError parsing subfile {0}: {1}rTrNz%s is not a valid MSO fileFailed XML parsing for file rr>)rYrrcET fromstringiter TAG_BINDATAr# ATTR_NAMEr{rtextrrrr^r!r:rrTYPE_Word2003_XMLrr%)reretbindatafnamemso_datarrGs r.rVBA_Parser.open_word2003xmlm sw 04==@A( /t$B77;/ I|<#..w||<x(( P#3H#=++U+JHH9EAB+0.*DI/P<<HH%E&,fU&8:IIhI>"4T]]E"OO P# ||$--QTUV (T 2 / HHdmmSQ R IIhI .  /s\A4EC3)E E'A E 0E6E  EE HA F10F11 H>[RSR'XH55 [R)SSS9 SnAM[+URXH5eSnAff=f!["aXnUR$(aA[RS UR<S U<S 35 [R)SSS9 SnAgeSnAf[0aFn[RS UR<S U<S 35 [R)SSS9 SnAgSnAff=f) z{ Open a Word or PowerPoint 2007+ XML file, aka "Flat OPC" :param data: file contents in a string or bytes :return: nothing z,Opening Flat OPC Word/PowerPoint XML file %sunknownrrrTrNrrr>)rYrrcrrr TAG_PKGPARTr# ATTR_PKG_NAMEATTR_PKG_CONTENTTYPECTYPE_VBAPROJECTiterfindTAG_PKGBINDATAr{rrrr^r!r:rrTYPE_FlatOPC_XMLrr%) rerrpkgpartr content_typerrrGs r.rVBA_Parser.open_flatopc s~ ?$--OP" /t$B77;/ M9=&{{+?K #33#*#3#3N#C T'/':':7<<'HH ///N$D 0 )DI 3T#|| #)I*0&*<!> # (T B&8&S S T# ||$--QTUV (T 2 / HHdmmSQ R IIhI .  /sbA"E E#/C&E& E0A E9E?EEE H 'A F:9F:: H [RSUR-5 URS5nUR S5nUR S5nSUs=:aU::aO OX#SnO US:aX$Sn[ R Rn[R"S5nU[ R l[(a[ R"U5nO[ R"U5nU[ R lUR5HnUR5n URS5n [R!SU <S U <35 UR#S S 9n [%U [&5(aB[)U 5(a2[R!S 5 [+U 5n UR-XS 9 M[R!S[5U 5-5 [R!SU SS-5 M [8Ulg!U[ R lf=f![.adn UR0(a8[RU <SU <S35 [R!SS S9 Sn A GMa[3URX5eSn A ff=f![6a!n[R!S5 SnAGMSnAff=f![.a e[:aB [RSUR<S[<<35 [R!SS S9 gf=f)zT Open a MHTML file :param data: file contents in a string or bytes :return: nothing zOpening MHTML file %ss sMIMEsContentrtNz)^(From |[\041-\071\073-\176]{1,}:?|[\t ])zMHTML part: filename=z, content-type=T)rSz4Found ActiveMime header, decompressing MSO containerrz$ does not contain a valid OLE file (r>rrztype(part_data) = %szpart_data[0:20] = %rrrFzpart_data has no __getitem__zFailed MIME parsing for file rK)rYrrclstripfindemail feedparserheaderRErcompilerNmessage_from_stringmessage_from_byteswalkget_content_type get_filenamer get_payloadr@rrrrr^r!rrr, TYPE_MHTMLr%MSG_OLEVBA_ISSUES)rer stripped_data mime_offsetcontent_offset oldHeaderRE loosyHeaderREmhtmlrrr part_datarrGerrs r.rVBA_Parser.open_mht s (4==89G /!KK 3M(,,W5K*// ;NK1>1 -l ;  "$ -o >  **33KJJ'STM(5E   % 87!55mDE"44]CE,7  ) #446 ))$/ |\] ,,D,9 i//K 4J4JIITU P#3I#>++U+JII4tIFGB "89Qr?"JK=%D#DII-8  )*/P<<HH).&56IIhI>>#5T]]E"OOP%B "@AAB#   / HH!]],=? @ IIhI . /sBK<8H 4B/K$H'>#K"J=K H$$K' J1AJ3K:JJK K"J>7K>KKALLc[RS5 [R"URSS9nUR 5HnUR SUSS9 M [RS5 URR5 SUl[Ul g![R[4aLnURS:Xa[RS5 SnAg[RS U-5 SnAgSnAff=f) atry to interpret self.ole_file as PowerPoint 97-2003 using PptParser Although self.ole_file is a valid olefile.OleFileIO, we set self.ole_file = None in here and instead set self.ole_subfiles to the VBA ole streams found within the main ole file. That makes most of the code below treat this like an OpenXML file and only look at the ole_subfiles (except find_vba_* which needs to explicitly check for self.type) zCheck whether OLE file is PPTT) fast_failN PptParser)rz File is PPTzPPT subfile is not a PPT filez&File appears not to be a ppt file (%s))rYrr r r iter_vba_datarrTYPE_PPTrPptUnexpectedDatarrr)repptvba_datarGs r.rVBA_Parser.open_ppt s 01 J&&t}}EC--/##D(k#J0 HH] # MM   ! DM DI,,j9 J~~, 9:: BSHII  JsBB D:%D$DDc [RSUR-5 Sn/nURS5 UR S5GH[nUR S5(aIUR S5H2nUR S5(dMSn[RS5 M4 McUR S 5(aoU(ahUR S5HQnUR S 5(dMUR5S :wdM1URS [US S 5-5 MS MUR S5(dGMU(dGM UR S5H;nUR S5(dMURS[US S 5-5 M= GM^ U(a SUl X0l [Ul g )zu Open a SLK file, which may contain XLM/Excel 4 macros :param data: file contents in a bytes string :return: nothing zOpening SLK file %sFz8Formulas and XLM/Excel 4 macros extracted from SLK file:O;ETzSLK parser: found macro sheetsNNNzNamed cell: %srNCzFormula or Macro: %s)rYrrcrrrrrrrrVrrTYPE_SLKr)rerxlm_macro_foundrrrs r.rVBA_Parser.open_slk5 sY &67 TUOOE*Dt$$D)A||D))*. "AB*''OD)A||D))aggi5.@"))*:Yqu=M*MN*&&??D)A||D))"))*@9QqrUCS*ST*+" '+D $(O r0c[RSUR-5 [U5UlSUl[ Ulg)zz Open a text file containing VBA or VBScript source code :param data: file contents in a string or bytes :return: nothing zOpening text file %sTN)rYrrcrVrr TYPE_TEXTr)rers r.rVBA_Parser.open_textW s7 '$--78%.dO!#'  r0c URR[XUURURUR S95 g)zB Create sub-parser for given subfile/data and append to subfiles. )r!rUrN)rrrr!rUr)rercrrs r.rVBA_Parser.append_subfilef s<   HI48LL59]]:>:L:L"N Or0c[RS5 URcUR[:wagUR b UR $UR[:Xad[R S5 /UlURH,nUR RUR55 M. UR $Sn/UlURnURSSS9Hn[RSU-5 US R5S :XdM4[RS S RU5-5 S RUSS 5nUS :waUS - n[RSU-5 U"X5S5nU(dMU"X5S5nU(dMU"X5S5nU(dM[RSU-5 UR RXVU45 M UR $)a Finds all the VBA projects stored in an OLE file. Return None if the file is not OLE but OpenXML. Return a list of tuples (vba_root, project_path, dir_path) for each VBA project. vba_root is the path of the root OLE storage containing the VBA project, including a trailing slash unless it is the root of the OLE file. project_path is the path of the OLE stream named "PROJECT" within the VBA project. dir_path is the path of the OLE stream named "VBA/dir" within the VBA project. If this function returns an empty list for one of the supported formats (i.e. Word, Excel, Powerpoint), then the file does not contain VBA macros. :return: None if OpenXML file, list of tuples (vba_root, project_path, dir_path) for each VBA project found if OLE file zVBA_Parser.find_vba_projectsN,Returned info is not complete for PPT types!cX-nURU5(aBURU5[R:Xa[R SU<SU<35 U$[R SU-5 g)NzFound z stream: z.check_vba_stream s\ .Izz)$$i)@GDXDX)X ; JK   X[ffgr0FTstreamsstoragesChecking storage %rrtVBAzFound VBA storage: %srr7zChecking vba_root="%s"PROJECTzVBA/_VBA_PROJECTzVBA/dirzVBA root storage: "%s")rYrrrrrrrrfind_vba_projectslistdirupperrBr) rerr)rstoragerrkvba_project_pathrls r.r1VBA_Parser.find_vba_projectso s" 01 == TYY(%:    ($$ $ 99  KKF G "D ,,!!(()B)B)DE-$$ $  mm{{54{@G II+g5 6r{  "e+ 1SXXg5FGH88GCRL1r>OH 2X=> 0yI #X#3CCU#V '+C9E 2X=>!!(((()KL1A2   r0c~UR5nSnUR(dUR5nU=(d U$)a Detect the potential presence of VBA or Excel4/XLM macros in the file, by calling detect_vba_macros and detect_xlm_macros. (if the no_xlm option is set, XLM macros are not checked) :return: bool, True if at least one VBA project has been found, False otherwise F)detect_vba_macrosrdetect_xlm_macros)rerxlms r. detect_macrosVBA_Parser.detect_macros s6$$&{{((*C sr0c[RS5 URb UR$URcnURHVn[RSR U55 UR UlUR5(dMOSUl g SUlgUR5n[U5S:XaSUlOSUlURn[[UR55GHmn[RSU-5 URUnUc&URU5n[RS5 UR[R:XdMt[RS UR UR"4-5 UR%UR&UR"5R)5n[RS [U5-5 [U5S :a#[RUSS <S USS<35 O[R[+U55 SU;a[RS5 SUlGMmGMp UR$![,atnUR.(a=[R1SUR -5 [RSSS9 SnAGM[3UR4UR U5eSnAff=f)ay Detect the potential presence of VBA macros in the file, by checking if it contains VBA projects. Both OLE and OpenXML files are supported. Important: for now, results are accurate only for Word, Excel and PowerPoint Note: this method does NOT attempt to check the actual presence or validity of VBA macro source code, so there might be false positives. It may also detect VBA macros in files embedded within the main file, for example an Excel workbook with macros embedded into a Word document without macros may be detected, without distinction. :return: bool, True if at least one VBA project has been found, False otherwise zdetect vba macrosNzole subfile {}TFrChecking DirEntry #%d$This DirEntry is an orphan or unusedz,Reading data from stream %r - size: %d bytesz Read %d bytesdz...[much more data]...is AttributzFound VBA compressed codez Error when reading OLE Stream %rr) exc_trace)rYrrrrr:rr8r1rr direntries_load_direntry entry_typerr'rr)_open isectStartrreprrr!rrrc)re ole_subfilerrsiddrrGs r.r8VBA_Parser.detect_vba_macros sU %&  # # /++ + == #00  *11+>?%)[[ "0022/3D, 1(-D $--/ |  !',D $'+D $mm#cnn-.C II-3 4s#Ay&&s+ @A||w333 HAFFTUTZTZK[[\M99Q\\166:??ADIIoD 9:4y3 $t*dSVSWj"YZ $t*-&$. "=>370/%/6''' M||!Caff!LM (d ;;0LL Ms %CJ K> AK9!K99K>c[RS5 URb UR$UR[:Xa UR$/UlUR R5(dSUlg[(a8UR(d[RS5 OUR5$URcgUR5$![a [RS5 N?f=f)a Detect the potential presence of Excel 4/XLM macros in the file, by checking if it contains a macro worksheet. Both OLE and OpenXML files are supported. Only Excel files may contain XLM macros, and also SLK and CSV files. If XLMMacroDeobfuscator is available, it will be used. Otherwise plugin_biff is used as fallback (plugin_biff only supports OLE files, not XLSX or XLSB) :return: bool, True if at least one macro worksheet has been found, False otherwise zdetect xlm macrosFzcXLMMacroDeobfuscator only works with files on disk, not in memory. Analysis might be less complete.z'Error when running XLMMacroDeobfuscator)rYrrrrrris_excelXLMDEOBFUSCATORrr_extract_xlm_xlmdeobfr%rr_extract_xlm_plugin_biffrs r.r9VBA_Parser.detect_xlm_macros! s %&  # # /++ + 99 ++ +xx  ""',D $ ?$$ BCI5577 == ,,.. !IIIGHIs0CD?Dc [RS5 S[lS/n[R"UR SSSSSS9n[ U5S:XaSUlgX- nURS5 URS 5 [R"UR SSSSS 9nX- n[RU5 Xl SUlg) z Run XLMMacroDeobfuscator to detect and extract XLM macros :return: bool, True if at least one macro worksheet has been found, False otherwise z=Calling XLMMacroDeobfuscator to detect and extract XLM macrosTzRAW EXCEL4/XLM MACRO FORMULAS:r)filenoninteractivenoindentreturn_deobfuscatedtimeout extract_onlyrFzL- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - z3EMULATION - DEOBFUSCATED EXCEL4/XLM MACRO FORMULAS:)rTrUrVrWrX) rYrxlmdeobfuscatorSILENT process_filercrrrr)rer:r4s r.rP VBA_Parser._extract_xlm_xlmdeobfI s QR!%/0 --4==:>48?C358< - v;! ',D $  9 HI --4==:>48?C35 -  ##' r0cd[RS5 SGHhnURRU5(dM&[RSU-5 URR U5R 5n[RS5 [ U/USS9nUR5UlSSRUR5;a[RS 5 [ U/US S9nU=RUR5- sl[ U/US S9nU=RUR5- sl[ U/US S9nU=RUR5- slS Ul g GMk SUl g! [RS[-5 GM=f)z Run plugin_biff to detect and extract XLM macros :return: bool, True if at least one macro worksheet has been found, False otherwise rQ)WorkbookBookzFound Excel stream %rz Running BIFF plugin from oledumpz -o BOUNDSHEET)rstreamoptionszExcel 4.0 macro sheetrzFound XLM macrosz-o LABEL -r LNz-c -r LNz -o DCONN -sTz;Error when running oledump.plugin_biff, please report to %sF) rYrrr%rrrAnalyzerrBrrjURL_OLEVBA_ISSUES)re excel_streamr biff_plugins r.rQ#VBA_Parser._extract_xlm_plugin_biffp sm ,-0L}}##L11 1L@A}}// =BBD <=u#(l^DRa"bK&1&9&9&;DO.$))DOO2LL "45&+,Vf&g ;+>+>+@@&+,V`&a ;+>+>+@@',,Vc&d ;+>+>+@@370#M14$) uMM"_bs"stts C)F  F/cUR(a%[R"UR5UlUR$r+)rr#rrs r.detect_is_encryptedVBA_Parser.detect_is_encrypted s, == & 3 3DMM BD    r0cSnUR5(a^[RnU(a&[U[5(aUR U5 [R "URU5nU$r+)rir#DEFAULT_PASSWORDSr@rTrdecryptrc)repasswords_listdecrypted_file passwordss r. decrypt_fileVBA_Parser.decrypt_file sX  # # % %00I*^T"B"B  0#^^DMM9ENr0cTURcU$URURSS9$)z Encode a unicode string to bytes or str, using the specified encoding for the VBA_parser. By default, it will be bytes/UTF-8 on Python 2, and a normal unicode string on Python 3. :param str unicode_str: string to be encoded :return: encoded string rKrL)rUrO)re unicode_strs r. encode_stringVBA_Parser.encode_string s. ==  %%dmmI%F Fr0c ## [RS5 URcUR[:Xa'UR SUR UR 4v gUR[:Xa;UR(a)SnURHnUSU-S-- nM SSSU4v ggURHnUR5HnUv M M UR(a)SnURHnUSU-S-- nM SSSU4v ggUR5 [5nURHmupgn[URXgXR5HAupnUR!URR#U 55 UR XU4v MC Mo URn [)[+U R,55GHn [RS U -5 X;a[RS 5 M8U R,U nUc&U R/U 5n[RS 5 UR0[2R4:XdM[RS UR6-5 U R9UR:UR<5R?5n[@RB"S U[@RDS9HxnURG5S- n[RSU-5 UUSn[I[KU55n[MUSS9nUR UR6UR6U4v Mz GM UR(a(SnURHnUSU-S-- nM SSSU4v URO5(a7SnURPRS5HnUSU-S-- nM SSSU4v gg![$a!n [R'S5 Sn A GMSn A ff=f![$aVn[RSUR6<SUR <SU<S35 [RSSS9 SnAGMSnAff=f7f)a Extract and decompress source code for each VBA macro found in the file Iterator: yields (filename, stream_path, vba_filename, vba_code) for each VBA macro found If the file is OLE, filename is the path of the file. If the file is OpenXML, filename is the path of the OLE subfile containing VBA macros within the zip archive, e.g. word/vbaProject.bin. If the file is PPT, result is as for OpenXML but filename is useless zextract_macros:Nr7z' r xlm_macroz xlm_macro.txtzError in _extract_vbar>zAlready extractedr?zReading data from stream %rs\x00Attribut[^e])flagsr3z%Found VBA compressed code at index %Xcp1252)rUzError processing stream z in file rr> Traceback:Trz VBA P-codezVBA_P-code.txt)*rYrrrrrcrrrrextract_macrosr1rrrr!r_findr%rjrrrCrDrErr'rrFrGr)rrr IGNORECASErDrrrVdetect_vba_stompingrr)rerrrIr vba_stream_idsrrkrlr vba_filenamerrrJrKrrrDcompressed_codevba_code_bytes vba_code_strrGs r.r|VBA_Parser.extract_macros s #$ == yyI%}}b$--9R9RSSh&??!H $ D4K$$66!0& _hOO #$(#4#4K#.#=#=#?% $@$5??!H $ D4K$$66!0& _hOO #  " " $ UN484E4E0 ;()1<<A< 8'**4==+>+>{+KL#}}kRR A5F --Cc#..12 1C78(II12NN3'9**3/AIIDE<<7#7#77II;affDE99Q\\166:??AD!#-A4r}}!] %  1 "IE"QR*.uv,C->y?Y-ZN,5^h+WL#'==!&&!&&,"OO"^3F OODt d 22H,"K(KK'')) 00;;=Dt d 22H>#\3CXNN *a!;MM"9::;F )CIIVWV\V\^b^k^kmp&qrIIlTIBBCsfEQ;A&O*+B:Q;)B-Q;APBQ;* P4P Q;PQ; Q8"A Q3,Q;3Q88Q;cURc>/UlUR5H#upp4URRXX445 M% [UR5UlUR$)a6 Extract and decompress source code for each VBA macro found in the file by calling extract_macros(), store the results as a list of tuples (filename, stream_path, vba_filename, vba_code) in self.modules. See extract_macros for details. :returns: list of tuples (filename, stream_path, vba_filename, vba_code) )rmr|rrr)rerrrrs r.extract_all_macrosVBA_Parser.extract_all_macross` << DLFJFYFYF[B< ##[|$VWG\T\\*||r0cSnUR5H:u p#[U[5(d[R S5 M3XS-- nM< U$)a Extract the VBA macro source code from all modules, and return it as a single string (str) with all modules concatenated. If an exception is triggered when decompressing a VBA module, it will not be included. The error is logged but the exception is not raised further. :return: str r7z7VBA code returned by extract_all_macros is not a stringr)rr@rrYr)rerrLrs r.get_vba_code_all_modules#VBA_Parser.get_vba_code_all_modules(sS "#'#:#:#< Q1h,, ST$47$ $= $#r0c UR5(GamURb UR$URcGUR5UlUR 5Hu p4U=RUS-- slM [ UR5nUR X5UlUR5(aR[RS5 SnSnURRXg45 URRSXg45 UR(aR[RS5 SnSnURRXg45 URRSXg45 UR(aR[RS 5 S nS nURRXg45 URRSXg45 UR5upppnU=R U- slU=R"U - slU=R$U - slU=R&U - slU=R(U - slU=R*U - slU=R,U- slUR$) a[ runs extract_macros and analyze the source code of all VBA+XLM macros found in the file. All results are stored in self.analysis_results. If called more than once, simply returns the previous results. :return: list of tuples (type, keyword, description) (type = 'AutoExec', 'Suspicious', 'IOC', 'Hex String', 'Base64 String' or 'Dridex String') rz*adding VBA stomping to suspicious keywordsz VBA StompingzwVBA Stomping was detected: the VBA source code and P-code are different, this may have been used to hide malicious coderz2adding XLM macrosheet found to suspicious keywordsz XLM macroz.XLM macro found. It may contain malicious codez0adding Template Injection to suspicious keywordszTemplate Injectionz^Template injection found. A malicious template could have been uploaded from a remote location)r;rrrextract_form_stringsrirrrYrrsrr rrrrrrrrrr)reshow_decoded_stringsrrL form_stringscannerrr autoexec suspiciousrt hexstrings base64stringsdridex vbastringss r.analyze_macrosVBA_Parser.analyze_macros:s'     $$0,,,((0,0,I,I,K)+/+D+D+F'Q--t1CC-,G"$";";.wsSI]^_I`Ear0T)rYreverserrAr^z"%s"rer>z(%s))rsortedrrrrKrendswith)reanalysis deobf_codekw_typer$rLs r.revealVBA_Parser.revealrs&&E&B((akop-T-F-FG  + )1 %Gg,&"//#t4 7*%%c**w/?/?/D/D$w.G'//A *2r0c d[RS5 URcUR[:wagUR[:Xa"UR n[R S5 O UR/n/UlUGHnURSSS9GHn[RSU-5 US/-nUS /-n[RS U<S U<S 35 URU5(dM^URU5[R:XdMURU5(dMURU5[R:XdMS RU5n[RSU-5 URRU5 GM GM UR$)a Finds all the VBA forms stored in an OLE file. Return None if the file is not OLE but OpenXML. Return a list of tuples (vba_root, project_path, dir_path) for each VBA project. vba_root is the path of the root OLE storage containing the VBA project, including a trailing slash unless it is the root of the OLE file. project_path is the path of the OLE stream named "PROJECT" within the VBA project. dir_path is the path of the OLE stream named "VBA/dir" within the VBA project. If this function returns an empty list for one of the supported formats (i.e. Word, Excel, Powerpoint), then the file does not contain VBA forms. :return: None if OpenXML file, list of tuples (vba_root, project_path, dir_path) for each VBA project found if OLE file zVBA_Parser.find_vba_formsNr#FTr+r.rXfzChecking if streams z and z existrzFound VBA Form: %r)rYrrrrrrrr2r%r&rr'rBr)re ole_filesrr4o_streamf_stream form_paths r.find_vba_formsVBA_Parser.find_vba_formssM" -. == TYY(%:$ 99 ))I KKF G)IC;;ut;D /'9:"cU?"cU? 8XVW::h''CLL,BgFZFZ,ZJJx((S\\(-CwG[G[-[ # 1III2Y>?NN))'2E~~r0c## URcDUR[:XagURHnUR 5HnUv M M gUR 5 URnUR HnUS/-n[RSSRU5-5 URU5R5n[RU5Hn[RSUR5-5 [(aUR5nOUR5R!SSS9nUS :wdMkUR"SRU5U4v M M g7f) a Extract printable strings from each VBA Form found in the file Iterator: yields (filename, stream_path, form_string) for each printable string found in forms If the file is OLE, filename is the path of the file. If the file is OpenXML, filename is the path of the OLE subfile containing VBA macros within the zip archive, e.g. word/vbaProject.bin. If the file is PPT, result is as for OpenXML but filename is useless Note: form_string is a raw bytes string on Python 2, a unicode str on Python 3 NrXzOpening form object stream %rrz"Printable string found in form: %rr)rKrLTahoma)rrrrrrrrYrrBrrre_printable_stringrrrNrSrc) rerIr r form_storager form_datam found_strs r.rVBA_Parser.extract_form_stringss) == yyI%$(#4#4K#.#C#C#E% $F$5    !--C $ '3%/ 9CHHX.argsi7TFr,N)rjrkrlrm disasmOnlyverboseror,r0r.argsr7s ! r0rzbefore pcodedmp) output_filezafter pcodedmpzError while running pcodedmp)rrrrrrYrrr%rr:r\rNrrsysstderr processFilercrjgetvalue)rerroutputrrs r. extract_pcodeVBA_Parser.extract_pcode sF 999- -#%D    #%D     ' IIR S -   w "   > +,# $$T]]D$M#  *+$*??#4D ###] @GGJK')$  F > <==  >s1D%A*E'% E$/+EE$' F1F  Fc[RS5 URb UR$UR[[ 4;aSUlgUR (d[RS5 SUlgURGcd[RS5 UR5 [RS5 [5nURR5GHJnURS5(dM[RSUR5-5 URSS 5nUS nS n[U5S :XaUS R5nUS ;aWURS5(aUSSnURSS 5S nURS5(dUR!U5 US:XdMURSS 5S n[U5S :a3US S:Xa USS:XdeUS SnUR#SS5nSU-S-nUR!U5 GMM [RS[%['U55-5 SUlUR)5nUHJn X;dM [RSR+U 55 [RS5 SUl O UR(d[RS5 UR$)z Detect VBA stomping, by comparing the keywords present in the P-code and in the VBA source code. :return: True if VBA stomping detected, False otherwise :rtype: bool rNFz[[U] "U0UD6 g)ze Constructor for VBA_Parser_CLI. Calls __init__ from VBA_Parser with all arguments --> see doc there N)r`rra)rerrfrgs r.raVBA_Parser_CLI.__init__s nd,d=f=r0c[RR5(a([SSS9 [RR 5 UR X5 g)a@ Analyze the provided VBA code, without printing the results (yet) All results are stored in self.analysis_results. :param show_decoded_strings: bool, if True hex-encoded strings will be displayed with their decoded content. :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow) :return: None Analysis... r7rEN)rstdoutisattyraflushr)rerrs r. run_analysisVBA_Parser_CLI.run_analysiss@ ::     /r * JJ    0>r0cURnU(a[R"SSS9nSSSS.nUHcupgn[U5(d [ U5n[U5(d [ U5nUR US5n UR XgU4U SS4S 9 Me UR5 UR(a [S 5 gg[S 5 g) z print the analysis results in a table :param show_decoded_strings: bool, if True hex-encoded strings will be displayed with their decoded content. :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow) :return: None ) rF-)TypeKeyword Description) column_width header_rowyellowredcyanrrrN)colorszVBA Stomping detection is experimental: please report any false positive/negative at https://github.com/decalage2/oletools/issuesz#No suspicious keyword or IOC found.) rr TableStreamrrHr# write_rowrrra) rerrr rU COLOR_TYPErrr  color_types r.print_analysisVBA_Parser_CLI.print_analysiss'' ''\3UWA%#J 29-+#G,,"7mG#K00"&{"3K'^^GT:  W{;ZQUW[D\ ]29 GGI))Z[* 7 8r0c [RR5(a([SSS9 [RR 5 UR X5VVVs/sHup4n[ X4US9PM snnn$s snnnf)aH Analyze the provided VBA code, and return the results in json format :param vba_code: str, VBA source code to be analyzed :param show_decoded_strings: bool, if True hex-encoded strings will be displayed with their decoded content. :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow) :return: dict rr7r)rrr )rrrrarrrR)rerrrrr s r.print_analysis_json"VBA_Parser_CLI.print_analysis_jsonsr ::     /r * JJ   595H5HI]5km5k1Gk' L5km mms!A=c URnU(aLSSSS.nUH@upEnURUS5nU(dM!URUSU<SU<SU<S35nMB U$) z Colorize keywords found during the VBA code analysis :param vba_code: str, VBA code to be colorized :return: str, VBA code including color tags for Colorclass rrrrNz{auto}z{/)rr#rK)rerr rrrr rs r.colorize_keywords VBA_Parser_CLI.colorize_keywordssj '' $#J 29-+'^^GT: :'//jZacm9noH29r0c vXlU(a U(dSnUR(aUR<SUR<3n O URn [S5 [SU -5 [SUR-5 UR 5(GaUR XS9 UR5GHCuppU(a [U 5nOU n[S5 [SU -5 [S U <S [U 5<35 U(dMZ[S 5 UR5S :Xa [S 5 MSU;ac[RS5 [RR5(a[ R""S5nOSnUR%SU5n[RR5(a%[ R""UR'U55n[U5 GMF UR-5H?upnUcM [S5 [SU <S U <35 [S 5 [U5 MA UR/5HRupnUcM [S5 [SUS<SU <S U <35 [S 5 [[1US55 MT U(a1[S5 [S5 UR95n[U5 U(dUR;X5 U(a$[S5 [UR=55 O [S5 [S 5 g![(a [R+S5 GNf=f![2a6n[R5SU-5 [R7SSS9 SnANSnAff=f![>a e[2aln[R5SUR<S U<S!35 [@RB"5 [R7SSS9 [EURU5eSnAff=f)"a Process a single file :param filename: str, path and filename of file on disk, or within the container. :param data: bytes, content of the file if it is in a container, None if it is a file on disk. :param show_decoded_strings: bool, if True hex-encoded strings will be displayed with their decoded content. :param display_code: bool, if False VBA source code is not displayed (default True) :param global_analysis: bool, if True all modules are merged for a single analysis (default), otherwise each module is analyzed separately (old behaviour) :param hide_attributes: bool, if True the first lines starting with "Attribute VB" are hidden (default) :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow) :param show_pcode bool: if True, call pcodedmp to disassemble P-code and display it :param no_xlm bool: if True, don't use the BIFF plugin to extract old style XLM macros Tz in zO===============================================================================zFILE: %szType: %srrzO-------------------------------------------------------------------------------z VBA MACRO %s z in file: z - OLE stream: zN- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - r7z (empty macro)r=z]The VBA code contains special characters such as backspace, that may be used for obfuscation.s{autored}\x08{/red}z\x08z;Unicode conversion to be fixed before colorizing the outputNzVBA FORM STRING IN zVBA FORM Variable "rz" IN rzError parsing form: %sr{rzP-CODE disassembly:zAMACRO SOURCE CODE WITH DEOBFUSCATED VBA STRINGS (EXPERIMENTAL): zNo VBA or XLM macros found.Error processing file rr>)#rrrcrarr;rrrrHrrrYrrrr colorclassColorrKr UnicodeErrorrrrrr%rrrrrr^ traceback print_excrx)rer display_codehide_attributes vba_code_onlyshow_deobfuscated_coder show_pcoderdisplay_filenamerrrrvba_code_filtered backspacerform_variablesrGpcodes r.r\VBA_Parser_CLI.process_filesl( L >>-1]]DNNK #}}  h j++,[ 6 *dii' (!!##!!7K!eJNJaJaJcF[|&,6x,@),4)(O/L89KkIZ[\#|i(,224:!/2 &):: # -L!M#&::#4#4#6#60:0@0@AX0YI07I4E4M4MfV_4` 1i$'::#4#4#6#68B8H8HI_I_`qIr8s$5""34CKdD@D?X?X?Z;[{".h+Wbcdi(k* @[ ;FJFhFhFjB>)5!(O!UcdjUkmx{F#GH!),!#nW&=">? Gk(O/0 ..0E%L%''(<J)_`$++-(34 b o$0i # *g hi"!;HH5;<IIlTI:;<#   6 HH sK L    ! IIlTI 2!$--5 5  6s,B#N8BN8)AM1'N88N8M50A M5;A;N87 N8M2.N81M22N85 N5?,N0+N80N55N88P8 A'P33P8c rXlU(a U(dSn0n UR(aURU S'OSU S'URU S'SU S'SU S'SU S'XiS 'XyS 'URU S '/n UR 5(aUR 5HZupp0nU(a [ U5nOUnXS 'XS 'XS'U(aUR5US'OSUS'U RU5 M\ U(dURUU5U S'U(aUR5U S'U(aUR5U S'XS'SU S'U $![aWn[RSUR<SU<S35 [RSSS9 [!URU5eSnAff=f)a Process a single file every "show" or "print" here is to be translated as "add to json" :param filename: str, path and filename of file on disk, or within the container. :param data: bytes, content of the file if it is in a container, None if it is a file on disk. :param show_decoded_strings: bool, if True hex-encoded strings will be displayed with their decoded content. :param display_code: bool, if False VBA source code is not displayed (default True) :param global_analysis: bool, if True all modules are merged for a single analysis (default), otherwise each module is analyzed separately (old behaviour) :param hide_attributes: bool, if True the first lines starting with "Attribute VB" are hidden (default) :param show_deobfuscated_code: bool, if True add deobfuscated code to result :param deobfuscate: bool, if True attempt to deobfuscate VBA expressions (slow) :param show_pcode: bool, if True add extracted pcode to result TrNrTFjson_conversion_successfulrcode_deobfuscateddo_deobfuscater rrr ole_streamrrmacrosrrr>r{r)rrrcrr;rrrrrrrrr%rYrrrx)rerrrrrrr rr4rrrrr curr_macror rGs r.process_file_json VBA_Parser_CLI.process_file_jsons, L >>"&..F; "&F; v/4+,!z&*"##. )|# 6!YYF6NF!!##JNJaJaJcF[|!#J&,6x,@),4)1=~.0;}-/:|,#->-D-D-F 6*-1 6*MM*-Kd %)-)A)ABVBM*OF:&)26++-F./&*&8&8&:F7O%8 37F/ 0  6 HH sK L IIlTI 2!$--5 5  6s&C-E F6AF11F6c nUR5(a[[RR5(a([ SSS9 [RR 5 UR UUS9 [URnS=n=n=n=n=n =n =pUR(aSnUR(aSnUR(aSnUR(aS nUR(aS n UR(aS n UR(aS n UR (aS n XE<U<U<U<U <U <U <U <3- nU<SSUR"<3n [ U 5 g![$aBn[&R)SUR"<SU<S3SS9 [+UR"U5eSnAff=f)zJ Process a file in triage mode, showing only summary results on one line. rr7rrrOMASIHrbDV12rrrr>TrN)r;rrrrarrTYPE2TAGrrrrrrrrrrcr%rYrrx)rerrrryrrrrtr base64obfrvba_obfrrGs r.process_file_triage"VBA_Parser_CLI.process_file_triageso  6!!##::$$&&/r2JJ$$&##9M0;$=TYY'E`c cF cX c cT cJ c cV''#C!!:||CT!!:$$#i$$sf!!S7 68Zz)2FGE EE"' 6D $K 6 IIL#  %!$--5 5  6sE%E(( F42=F//F4)rr)FTTFFFFF)FFF)rjrkrlrmrnrarrrrr\rr%rorprqs@r.rrsV > ? 9>m"&168S2S?S49 URS@S SASBS 9 URSCSDSESFUSGSH9 URSISJS S8SKSH9 URSLSMS S2SNSH9 URSOSPS S8SQSH9 URSRS SSST9 URSUSVS S8SWSH9 UR U5n[ UR5SX:XagSY[RSXSZ-n[S[[<S\U<S]35 [[5 UR5 [R"[5 UR (a"UR"(aUR%S^5 U$)_zBparse command line arguments (given ones or per default sys.argv) rz2usage: olevba [options] [filename2 ...])usage filenamesrzFiles to analyze)nargshelpz-r store_true recursivez)find files recursively in subdirectories.)actiondestr+z-zz--zip zip_passwordNzRif the file is a zip archive, open all files from it, using the provided password.)r/rdefaultr+z-pz --passwordrz^if encrypted office files are encountered, try decryption with this password. May be repeated.)rr.r1r+z-fz --zipfname zip_fnamezzif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default: %(default)s)z Output mode (mutually exclusive))titlez-tz--triage store_const output_modetriage unspecifiedzLtriage mode, display results as a summary table (default for multiple files))r.r/constr1r+z-dz --detaileddetailedz=detailed mode, display full results (default for single file)z-jz--jsonr_z2json mode, detailed in json format (never default)z-az --analysis store_falserTz8display only analysis results, not the macro source code)r.r/r1r+z-cz--coderFz/display only VBA source code, do not analyze itz--decoderzedisplay all the obfuscated strings with their decoded content (Hex, Base64, StrReverse, Dridex, VBA).z--attrrz?display the attribute lines at the beginning of VBA source codez--revealrzbdisplay the macro source code after replacing all the obfuscated strings by their decoded content.z-lz --loglevelloglevelstorezElogging level debug/info/warning/error/critical (default=%(default)s))r/r.r1r+z--deobfrz-Attempt to deobfuscate VBA expressions (slow)z --relaxedr!zeDo not raise errors if opening of substream fails (this option is now deprecated, enabled by default)z --show-pcoder z)Show disassembled P-code (using pcodedmp)z --no-pcodez(Disable extraction and analysis of pcode)r.r+z--no-xlmrzKDo not extract XLM Excel macros. This may speed up analysis of large files.r%d.%d.%dr3olevba on Python ' - http://decalage.info/python/oletoolsz6You cannot combine options --no-pcode and --show-pcode)argparseArgumentParser add_argumentradd_argument_group parse_argsrr)r version_infora __version__rn print_helprHRETURN_WRONG_ARGSr no_pcoder) cmd_line_argsDEFAULT_LOG_LEVELr(parsermodesrbpython_versions r.rErEs_" @E  $ $5 1F  35GH  \ HJ gN $EF lX "OP l3 #AB  % %,N % OE tZ ),;<  t\-),+,  tXm)./ l=+T+, h|,eNP  <3-.  =N $/0  <5()  lG 156  l %LN  )L $YZ \, %HJ  \GI  ,PU!np .G 7  "#c&6&6q&;; N, - g "#g.. MN Nr0c  Sn[XUURURS9nURS:XagUR UR UR URURURURURURS9 OURS:Xa0URUR URURS9 OURS:Xap[URUR UR URURURURURURS95 O$[!SR#UR55eUR%5 [&R)S 5 [*R,"U5(d[&R)S 5 [.$U[*RL:a[*RN"X@5eSn[&R)SR#URP55 URP[*RR-n[*RT"X5nU(d+[&RWS5 [*RX"U5e[&R[S 5 [ XqU=(d UX4S!-5[&R)S"R#U55 [\R^"U5 $![0GaVn[&R)S S S 9 W(aUR%5 [&R)S5 [*R,"U5(aSnAGN[3U[4[645(aURS;a[9S<SSU<S35 OQURS:Xa)[US[;U5R<[?U5S9 O[&RASU-5 [BsSnA$[3U[D5(aURS;a[9S<SSU<S35 OQURS:Xa)[US[;U5R<[?U5S9 O[&RASU-5 [BsSnA$[3U[F5(aURS;a"[9S<SSU<SURH<35 OkURS:Xa3[US[;U5R<[?URH5S9 O([&RASU<SURH<S35 [JsSnA$eSnAff=f![0a $f=f![&R)S"R#U55 [\R^"U5 f![0a ff=f=f)#z Part of main function that processes a single file. This is meant to be used only for the command-line interface of olevba This handles exceptions and encryption. Returns a single code summarizing the status of processing of this file N)rrr!rr9)rrrrrrr rr6)rrrr_zunexpected output mode: "{0}"!z Checking for encryption (normal)zno encryption detectedzCaught exception:Trz)Checking for encryption (after exception))r6r7?r!rz0 - Error opening substream or uenxpected contentrrTrrmessagez3Error opening substream or unexpected content in %sz - File format not supportedz,Failed to open %s -- probably not supported!z!ERRORrKrrz)!z Checking encryption passwords {}z4Decrypt failed, run with debug output to get detailszWorking on decrypted filerzRemoving crypt temp file {})0rr!rJr5r\rrrrrrr rr%rgrrr:rrYrr#r RETURN_OKr%r@rrrarrjrrjRETURN_OPEN_ERRORrsrxrdRETURN_PARSE_ERRORMAX_NESTING_DEPTHMaxCryptoNestingReachedpasswordrlrmrWrongEncryptionPasswordrosunlink) rcrrrbcrypto_nesting vba_parserrGrorps r.r\r\lsN $H9,3OO292B2BD    * ,  # #9U9U&-&:&:)0)@)@PWPePe070N0N%,%8%8WEWEW+2>> $ ;  H ,  * *@\@\7>7J7JSZSaSa + c  F * ,,'B^B^&-&:&:)0)@)@PWPePe070N0N%,%8%8WEWEW4;NN -D E=DDWEXEXYZ Z 45""8,, II. / -`111,,^FFN 4;;GJ K IIn %} ) % 5      =>   x ( ( # 24GHII&&*CC'*H67((F2H7%)#Y%7%7SKMM#24<#=>((C//&&*CCCRS((F2H7%)#Y%7%7SKMM"PS["[\((C11&&*CCXxNO((F2H7%)#Y%7%7'*3<<'8:MM%-s||#=>))S)~     II3::>J K IIn %   sGLCU8 :U( U%AU 0BU U% BU U%"B7U U%U  U%( U54U58W::V54W5 W?WWWc [U5n[R"URS:HURSS9 URS:Xa$[ S[ [RSSSSSS 9 O.S [RSS-n[S [ <S U<S 35 UR(a-UR(d[RS5 SUl [S[R "UR"UR$UR&UR(S955nURS:Xa[+U5S:XaSUlOSUlURS:XaLUR(a[RS5 UR,(a[RS5 URS:Xa[SS-5 [SS-5 SnSnS=n=px[.n UGHupgn[1U[25(Ga[45(a`URS:Xa[S<SSU<S35 O(URS:wa[R7SU-5 U S:Xa[8O[:n OkURS:Xa[S<SSU<S U<35 O1URS:wa![R7S!U<S"U<S#U<35 U S:Xa[<O[:n URS:Xa([ US$[?U5R@[CU5S%9 GM8URS:XaXd:waUb[S&U-5 Un[EXxXa5n US- nU [.:XaGM~U [.:XaU n GM[:n GM URS:Xa [S'5 [RS+U -5 [RR"5 [RT"U 5 g![FRHaKn [RKS(RMU 5SS)9 U [.:Xa [Nn Sn A NU [::H Sn A NSn A f[2a'n [RKS*U -SS)9 [Pn Sn A NSn A ff=f),z Main function, called when olevba is run from the command line Optional argument: command line arguments to be forwarded to ArgumentParser in process_args. Per default (cmd_line_args=None), sys.argv is used. Option mainly added for unit-testing r_T)other_logger_has_first_linerWrr3z$http://decalage.info/python/oletoolsMetaInformation) script_nameversionrOurlrrdr=r>r?r@z$set --deobf because --reveal was setc3n# UH+upnU(aURS5(aM%XU4v M- g7f)rN)r)r;rrcrs r.r=main..s:J9<49$-1B1B31G 7I69@f$x"%"2"21Q"7=)$ @ $c&6&6q&;; N, -%%g.A.A 89"J8=8H8H&00Grs `&z B    P77d?$/%%%%%%DO''""277??277??83L#MNggrww||OTBC chhHHOOA{#7B9E%1A!GH!GF FG  & #)#6#67I#J  1 02IJ ?*,,X6, !) !E'EG)G0':0''-.               C47HH   "     f&fv v f f &@Y 6M H i' f$ & $}49- 1J2 ! H A !3D * v "^, * ^ ^2-^>^8^&.)^*-^.E1^<5 ?^DG^J7M^T>#W^\"  Wi^lFo^p4s^t8w^x{^|$"^@C'E^FI^L4O^P0S^T=W^X6[^\T!_^`e^f+k^l+ o^v$ y^|+ A^H<;M^ND#Q^T8W^ZT4_^f 9 R   4     L E{^F   .:5>9#,a 1 #c )C /E  y(<7 $ x '# -tm 8 ' K '( 2 F =8 BJJv RZZ%&rzz":V"Cd"JKLRZZ hij   45 f ::cIo3489 ::34**[)jj!>?!3  #  <(3-)4H*IIDQUJV$Xd5.B%CDEF23/#:N0P!PQTXY_`gYhTii8Da$89:;< 89ht45VM=R8SS8Da$89:;< 78 M )K 7S40 01y y d  I23oe6LLs+oc.BBCDFNsmT U  " "%-SM 2 2 }% ?5)C/ 0< ?(3- O*+ ?5)C/ 0< ?(3- O23 ol3c9 :\ IHUXM Y HI ?9-3 4| Chsm SEF&IODSMGD,BY,N$OORZ[^R__ !45-.#>%l346>smD !^_ }uY'77(3-G##$78 01HSMA(9:&y>z /(&0#L%P4$@ (2"J0f"(JXA&XAv L$|"|"@*M6ZM6d bJpLfAF zF{I P P++ P P 1 1 POP P P P P:OsHf.gg ff?"f,(g,f;;f??ggg