|i| dZddlmZdZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z n=#e$r5 ddlm cmZ n'#e$r ddlmZ n#e$r edwxYwYnwxYwYnwxYwejejejeZejejedZeejvrejdeddlmZddlmZGd d e j Z!e j"d zfd Z#e#d Z$dZ%Gdde&Z'Gdde&Z(Gdde&Z)dZ*e*dzZ+e*dzZ,dZ-dZ.dZ/dZ0dZ1dZ2e2dzZ3e2dzZ4d Z5e5d!zZ6e5d"zZ7e5d#zZ8e5d$zZ9d%Z:e5d&zZ;Gd'd(e&Z<Gd)d*e<Z=Gd+d,e<Z>Gd-d.e<Z?Gd/d0e?Z@Gd1d2e<ZAGd3d4e<ZBGd5d6e<ZCGd7d8e@eCZDGd9d:e@eCZEGd;deFZGGd?d@eFZHGdAdBeFZIGdCdDeFZJGdEdFe<ZKGdGdHeKe?ZLGdIdJeKe?ZMGdKdLeKeBZNGdMdNeNZOGdOdPeNZPGdQdReNZQGdSdTeNZRGdUdVeNZSGdWdXeNZTGdYdZe<ZUGd[d\eUe?ZVGd]d^eUeBZWGd_d`eWZXGdadbeWZYGdcddeWZZGdedfeWZ[GdgdheBZ\Gdidje?Z]Gdkdle<Z^Gdmdne<Z_eDeEeLeMeVe]doZ`eGeHeIeJeOePeQeReSeTeXeYeZe[e\dpZaGdqdre<ZbGdsdte&ZcdyduZddvZedwZfegdxkr efdSdS)za  ftguess.py ftguess is a Python module to determine the type of a file based on its contents. It can be used as a Python library or a command-line tool. Usage: ftguess ftguess is part of the python-oletools package: http://www.decalage.info/python/oletools )print_functionz0.60.2Nzplxml or ElementTree are not installed, see http://codespeak.net/lxml or http://effbot.org/zone/element-index.htmz..)clsid)xglobceZdZdZdZdS) NullHandlera Log Handler without output, to avoid printing messages if logging is not configured by the main application. Python 2.7 has logging.NullHandler, but this is necessary for 2.6: see https://docs.python.org/2.6/library/logging.html#configuring-logging-for-a-library cdSN)selfrecords >C:\PYTHON\_runtimes\venv\Lib\site-packages\oletools/ftguess.pyemitzNullHandler.emitks N)__name__ __module__ __qualname____doc__rr rr rrds-      rrc |tjjjvr+tj|}|||Stj|}|t|||S)an Create a suitable logger object for this module. The goal is not to change settings of the root logger, to avoid getting other modules' logs on the screen. If a logger exists with same name, reuse it. (Else it would have duplicate handlers and messages would be doubled.) The level is set to CRITICAL+1 by default, to avoid any logging. )loggingLoggermanager loggerDict getLoggersetLevel addHandlerr)namelevelloggers r get_loggerr ns w~%000"4((  t $ $F kmm$$$ OOE MrftguesscNttjdS)z Enable logging for this module (disabled by default). This will set the module-specific logger level to NOTSET, which means the main application controls the actual logging level. N)logrrNOTSETr rr enable_loggingr%s LL     rceZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Z*d)S)*FTYPE" Constants for file types ZipWordWord6Word97Word2007 Word2007_DOCX Word2007_DOTX Word2007_DOCM Word2007_DOTMExcelExcel5Excel97 Excel2007Excel2007_XLSXExcel2007_XLSMExcel2007_XLTXExcel2007_XLTMExcel2007_XLSBExcel2007_XLAM Powerpoint97Powerpoint2007Powerpoint2007_PPTXPowerpoint2007_PPSXPowerpoint2007_PPTMPowerpoint2007_PPSMXPSRTFHTMLPDFMHTMLTEXTEXE_PEOLEXMLOpenXMLzUnknown File TypeMSIOneNotePNGN)+rrrrZIPWORDWORD6WORD97WORD2007 WORD2007_DOCX WORD2007_DOTX WORD2007_DOCM WORD2007_DOTMEXCELEXCEL5EXCEL97 EXCEL2007EXCEL2007_XLSXEXCEL2007_XLSMEXCEL2007_XLTXEXCEL2007_XLTMEXCEL2007_XLSBEXCEL2007_XLAM POWERPOINT97POWERPOINT2007POWERPOINT2007_PPTXPOWERPOINT2007_PPSXPOWERPOINT2007_PPTMPOWERPOINT2007_PPSMrBrCrDrErFrGrH GENERIC_OLE GENERIC_XMLGENERIC_OPENXMLUNKNOWNrLONENOTErNr rr r'r's C D E FH#M#M#M#M E FGI%N%N%N%N%N%N!L%N//// C C D C E D FKKO!G CG CCCrr'c>eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd S) CONTAINERz, Constants for file container types rCr)rIrKFlatOPC OpenDocumentMIMEBinaryzUnknown ContainerrMrNN)rrrrrCrOrIrKrorprqBINARYrkrlrNr rr rnrnsQ C C CGG!L D F!GG CCCrrnc>eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd S)APPr(zMS WordzMS Excelz MS PowerPointz MS AccesszMS Visioz MS Projectz MS Officez MS OneNotezAny Zip ArchiverWindowszUnknown ApplicationN)rrrrMSWORDMSEXCEL MSPOWERPOINTMSACCESSMSVISIO MSPROJECTMSOFFICE MSONENOTE ZIP_ARCHIVERWINDOWSrkr rr rurusQFG"LHGIHI%LG#GGGrruz>{http://schemas.openxmlformats.org/package/2006/relationships} Relationships RelationshipTypeTargetzRhttp://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocumentzFhttp://purl.oclc.org/ooxml/officeDocument/relationships/officeDocumentz{http://schemas.openxmlformats.org/package/2006/content-types}DefaultOverridez5{http://schemas.microsoft.com/office/2006/xmlPackage}packagepartr contentTypez$application/vnd.ms-office.vbaProject binaryDatacneZdZejZejZejZ dZ dZ gZ gZ dZdZdZdZedZdS) FType_BasezUnknown file typeNFcdS)z return True if the provided file matches the type of this class :param ftg: FileTypeGuesser object :return: bool Fr clsftgs r recognizezFType_Base.recognizes ur)rrrrnrk containerru applicationr'filetyperlongname extensions content_typesPUIDmay_contain_vbamay_contain_xlmmay_contain_ole classmethodrr rr rr sk!I+K}H D"HJM DOOO[rrceZdZdS) FType_UnknownN)rrrr rr rr"sDrrcfeZdZejZejZe jZ dZ dZ ddgZ dZdZedZdS) FType_RTFrCzRich Text Formatrtfdoc)zapplication/rtfztext/rtfzfmt/355c>|jdrdndS)Ns{\rtTFdata startswithrs r rzFType_RTF.recognize/s#x**844?tt%?rN)rrrrnrCrrurwrr'rrrrrrrrr rr rr%sd I*KyH D!HJ3M D@@[@@@rrcVeZdZejZejZe j Z dZ dZ edZdS)FType_Generic_OLEzGeneric OLE/CFB filez1Generic OLE file / Compound File (unknown format)cVt|jdkr |jdz}n|j}tj|rj tj|j|_|jjj|_t j |jd|_ n#YdSxYwdSdS)NisFT) lenrolefile isOleFile OleFileIOrootr root_clsid KNOWN_CLSIDSgetroot_clsid_name)rrrs r rzFType_Generic_OLE.recognize=s sx==  8|,DD8D  T " "  %/99 !$!1!7&+&8&<& %~++tu5rN)rrrrrSTREAMSrrr rr rrWsCFG  [   rrc\eZdZejZejZe jZ dZ dZ dgZ edZdS)FType_Generic_Zipz Zip ArchivezGeneric Zip Archivezipctj|jsdS tj|j|_n#tj$rYdSwxYwdS)NFT)zipfile is_zipfile data_bytesioZipFile BadZipfilers r rzFType_Generic_Zip.recognizetsh!#"233 5 !/#*:;;CKK!   55 ts<AAN)rrrrnrOrrurrr'rrrrrrr rr rrlsT I"KyH D$HJ  [   rrcZeZdZejZejZe j Z dZ dZ gZedZdS)FType_Generic_OpenXMLz OpenXML filezGeneric OpenXML filec td |jdn#t$rYdSwxYw |jd}n#t $rYdSwxYwtj|}|j tkrdSd}| tD]}| t}td|d| t|t t"t$fvr| t}ntd|z|tddS |jd }n#t $rYdSwxYwtj|}i} i} | t(D]5} | d } | d } | | | | | <6| t*D]J}| d }|d }| d } || | | |<Kd}|| vr | |}n9t.j|ddd}|| vr| |}||_td|zdS)NzOpen XML - recognizez _rels/.relsF)tagzRelationship: type=z target=z Main part: %sz5Failed to find any known relationship in OpenXML-filez[Content_Types].xml Extension ContentTypePartName/rzMain part content-type: %sT)r#debugrgetinfoKeyErrorread RuntimeErrorET fromstringrTAG_RELSiterTAG_RELr ATTR_REL_TYPEATTR_REL_TARGETURL_REL_OFFICEDOCURL_REL_OFFICEDOC_STRICT URL_REL_XPSwarningTAG_CTYPES_DEFAULTTAG_CTYPES_OVERRIDElstripospathsplitextmain_part_content_type)rr root_rels elem_rels main_partelem_relrel_typer elem_ctypes ctypes_ext ctypes_partelem_ext extension content_type elem_partpartnamer main_part_exts r rzFType_Generic_OpenXML.recognizes ()))  K   . . . .   55   ((77II   55 M),, =H $ $5 !733  H||M22H III888X\\RaEbEbEbc d d d-/GUUU$LL99  V /I-...   KKO P P P5 K,,-BCCMM   55 mM22   #((/A(BB 5 5H [11I#<< 66L$)A(4 9%$))0C)DD 5 5I }}Z00Hs++H$==77L# (@(4 H%!%  # #%0%; " "G,,Y77:122>M **)3M)B&%;" .1GGHHHts37 AA A$$ A21A2;F F$#F$N)rrrrnrKrrur}rr'rjrrrrrrr rr rrsX!I,K$H D%HJTT[TTTrrc(eZdZdZejZdZdZdS) FType_Wordz%Base class for all MS Word file typeszMS Word (generic)z&MS Word Document or Template (generic)N) rrrrrurwrrrr rr rrs%//*K D7HHHrrcPeZdZejZejZdZ dZ dZ ddgZ dgZ dZdZdZd S) FType_Word97zMS Word 97 Documentz$MS Word 97-2003 Document or Template)$00020906-0000-0000-C000-000000000046rdotapplication/mswordzfmt/40TN)rrrrurwrr'rRrrrrrrrrrr rr rrsK*K|H D5H 6FJ)*M DOOOOrrcLeZdZejZejZdZ dZ dZ ddgZ dgZ dZdZd S) FType_Word6zMS Word 6 Documentz MS Word 6-7 Document or Template)$00020900-0000-0000-C000-000000000046rrrzfmt/39TN)rrrrurwrr'rQrrrrrrrrr rr rrsF*K{H D1H 6FJ)*M DOOOrrc$eZdZejZdZdZdS)FType_Word2007_BasezMS Word 2007+ FilezMS Word 2007+ File (.doc?)N)rrrrurwrrrr rr rrs*K D+HHHrrc8eZdZejZejZdZ dZ dgZ dS)FType_Word2007zMS Word 2007+ DocumentzMS Word 2007+ Document (.docx)docxN) rrrrurwrr'rTrrrrr rr rr .*K"H #D/HJJJrrc8eZdZejZejZdZ dZ dgZ dS)FType_Word2007_Macroz$MS Word 2007+ Macro-Enabled Documentz,MS Word 2007+ Macro-Enabled Document (.docm)docmN) rrrrurwrr'rVrrrrr rr rr.*K"H 1D=HJJJrrc8eZdZejZejZdZ dZ dgZ dS)FType_Word2007_TemplatezMS Word 2007+ TemplatezMS Word 2007+ Template (.dotx)dotxN) rrrrurwrr'rUrrrrr rr rrrrrc8eZdZejZejZdZ dZ dgZ dS)FType_Word2007_Template_Macroz$MS Word 2007+ Macro-Enabled Templatez,MS Word 2007+ Macro-Enabled Template (.dotm)dotmN) rrrrurwrr'rWrrrrr rr rrrrrc(eZdZdZejZdZdZdS) FType_Excelz&Base class for all MS Excel file typeszMS Excel (generic)z+MS Excel Workbook/Template/Add-in (generic)N) rrrrrurxrrrr rr r r 's%00+K DHZMMMrrc.eZdZejZdZdZdgZdZ dS)FType_Excel2007_XLSXzMS Excel 2007+ WorkbookzMS Excel 2007+ Workbook (.xlsx)xlsxzfmt/214N) rrrr'r\rrrrrr rr rrDs,#H $D0HJ DDDrrc2eZdZejZdZdZdgZdZ dZ dS)FType_Excel2007_XLSMz%MS Excel 2007+ Macro-Enabled Workbookz-MS Excel 2007+ Macro-Enabled Workbook (.xlsm)xlsm)z.application/vnd.ms-excel.sheet.macroEnabled.12zfmt/445N) rrrr'r]rrrrrrr rr rrKs1#H 2D>HJGM DDDrrc2eZdZejZdZdZdgZdZ dZ dS)FType_Excel2007_XLSBzMS Excel 2007+ Binary Workbookz&MS Excel 2007+ Binary Workbook (.xlsb)xlsb)z5application/vnd.ms-excel.sheet.binary.macroEnabled.12zfmt/595N) rrrr'r`rrrrrrr rr rrSs1#H +D7HJNM DDDrrc*eZdZejZdZdZdgZdS)FType_Excel2007_TemplatezMS Excel 2007+ TemplatezMS Excel 2007+ Template (.xltx)xltxN) rrrr'r^rrrrr rr r r [s'#H $D0HJJJrr c*eZdZejZdZdZdgZdS)FType_Excel2007_Template_Macroz%MS Excel 2007+ Macro-Enabled Templatez-MS Excel 2007+ Macro-Enabled Template (.xltm)xltmN) rrrr'r_rrrrr rr r#r#as'#H 2D>HJJJrr#c*eZdZejZdZdZdgZdS)FType_Excel2007_Addin_Macroz#MS Excel 2007+ Macro-Enabled Add-inz+MS Excel 2007+ Macro-Enabled Add-in (.xlam)xlamN) rrrr'rarrrrr rr r&r&gs'#H 0D|jdrdndS)NsR\{اMSx)TFrrs r rzFType_OneNote.recognizes%x**+noozttuzzrN)rrrrnrlrrur~rr'rrrrrrrrr rr rFrFse!I-K}H D1HJ.M D{{[{{{rrFcdeZdZejZejZe jZ dZ dZ dgZ dZdZedZdS) FType_PNGrNz(Portable Network Graphics picture (.png)png)z image/pngzfmt/13c>|jdrdndS)NsPNG  TFrrs r rzFType_PNG.recognizes#x**+NOOZttUZZrN)rrrrnrNrrurkrr'rrrrrrrrr rr rJrJsd I+KyH D9HJ"M D[[[[[[rrJ)rrr rr,z$000C1084-0000-0000-C000-000000000046)zPapplication/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xmlz6application/vnd.ms-word.document.macroEnabled.main+xmlzPapplication/vnd.openxmlformats-officedocument.wordprocessingml.template.main+xmlz>application/vnd.ms-word.template.macroEnabledTemplate.main+xmlzJapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xmlz4application/vnd.ms-excel.sheet.macroEnabled.main+xmlz7application/vnd.ms-excel.sheet.binary.macroEnabled.mainzMapplication/vnd.openxmlformats-officedocument.spreadsheetml.template.main+xmlz7application/vnd.ms-excel.template.macroEnabled.main+xmlz4application/vnd.ms-excel.addin.macroEnabled.main+xmlzRapplication/vnd.openxmlformats-officedocument.presentationml.presentation.main+xmlzOapplication/vnd.openxmlformats-officedocument.presentationml.slideshow.main+xmlz@application/vnd.ms-powerpoint.presentation.macroEnabled.main+xmlz=application/vnd.ms-powerpoint.slideshow.macroEnabled.main+xmlz8application/vnd.ms-package.xps-fixeddocumentsequence+xmlcbeZdZejZejZe j Z dZ dZ dZdZdZedZdS) FType_EXE_PEzWindows PE Executable or DLLz,Windows Portable Executable or DLL (EXE,DLL))exedllsysscr)z-application/vnd.microsoft.portable-executablezfmt/899c>|jdrdndS)NsMZTFrrs r rzFType_EXE_PE.recognizes!x**511Y] * * !!$/488B~  >Y] * *$..t44 $2 #''(CTJJ>!#DJ >Y. . .%%d++ *) - + :1sB::B>B>cd|jdn#tj|j|j|j|jS)z2Give a short string representation of this object.z.[FileTypeGuesser for {0}: {1} from {2} in {3}]Nr)formatrXrrbasenamerrrr s r __str__zFileTypeGuesser.__str__\sI?FFm+FF!!$-00 M4+T^== =rcJ|j|jdSdS)zE This method must be called at the end of processing N)rcloserhs r rkzFileTypeGuesser.closecs. < # L    $ #rc`t|jtp|jtjkS)zQ Shortcut to check if the container is OLE :return: bool ) issubclassrYrrrnrIrhs r is_olezFileTypeGuesser.is_oleks% $*&788[DNim<[[rc`t|jtp|jtjkS)zU Shortcut to check if the container is OpenXML :return: bool )rmrYrrrnrKrhs r is_openxmlzFileTypeGuesser.is_openxmlrs' $*&;<<cR[Rc@ccrc6t|jtSzl Shortcut to check if a file is an Excel workbook, template or add-in :return: bool )rmrYrrhs r is_wordzFileTypeGuesser.is_wordys $*j111rc6t|jtSrr)rmrYr rhs r is_excelzFileTypeGuesser.is_excels $*k222rc6t|jtS)zb Shortcut to check if a file is Powerpoint file of any kind :return: bool )rmrYr)rhs r is_powerpointzFileTypeGuesser.is_powerpoints $*&6777rNN) rrrrrdrirkrnrprsrurwr rr rUrUs?2?2?2?2B===!!!\\\ddd22233388888rrUc"t||Sr )rUrXrs r ftype_guessr{s 8T * **rc td|zt||}td|jjztd|jjztd|jjztd|jz|jtd|jd|jtd d |jj ztd |jj ztdS) NzFile : %srzzFile Type : %szDescription: %szApplication: %szContainer : %sz Root CLSID : z - zContent-type(s) : %s,zPUID : %s) printr{rYrrrrrrjoinrr)rfilenamerrs r process_filers h &''' xd 3 3 3C cin ,--- ci0 0111 ci3 3444 cm +,,, ~! 8K8KLMMM 388CI,C#D#D DEEE cin ,--- GGGGGrc*dtjddz}tdtd|dtdtdtd d }tjtjtjtjtj d }d }tj | }| dddd| dddddd| dddddd| ddd d!|d"#| \}}t|dkr;tt|tjt j||jtjd$%t+t-j||j|j|j&D]/\}}} |r|d'rt9||| 0dS)(Nz%d.%d.%drzftguess z on Python z' - http://decalage.info/python/oletoolsz3THIS IS WORK IN PROGRESS - Check updates regularly!zGPlease report any issue at https://github.com/decalage2/oletools/issuesr)rinforerrorcriticalz1usage: %prog [options] [filename2 ...])usagez-r store_true recursivez)find files recursively in subdirectories.)actiondesthelpz-zz--zip zip_passwordstrzRif the file is a zip archive, open first file from it, using the provided password)rtypedefaultrz-fz --zipfname zip_fname*zoif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)z-lz --loglevelloglevelstorezBlogging level debug/info/warning/error/critical (default=%default))rrrrz%(levelname)-8s %(message)s)rstreamrf)rrrr)rQ version_infor~ __version__rDEBUGINFOWARNINGERRORCRITICALoptparse OptionParser add_option parse_argsrr print_helpexit basicConfigrstdoutr%r iter_filesrrrendswithr) python_versionDEFAULT_LOG_LEVEL LOG_LEVELSrparseroptionsargsrrrs r mainrsh#"21Q3"77N E KK )*** @AAA TUUU 2JJJ!MLOM$   J @E  " / / /F d>>>%*%5dgFW)W5F&H&H&H00! 8T  **3//  Y$//// 00r__main__rx)hr __future__rrrQr^rrrrr lxml.etreeetreer ImportErrorxml.etree.ElementTree ElementTreeelementtree.cElementTree cElementTreernormpathabspathdirname__file___thismodule_dirr _parent_dirinsertoletools.commonroletools.thirdparty.xglobrHandlerrrr r#r%objectr'rnruNS_RELSrrrrrrrNS_CONTENT_TYPESrr NS_XMLPACKAGE TAG_PACKAGE TAG_PKGPART ATTR_PKG_NAMEATTR_PKG_CONTENTTYPECTYPE_VBAPROJECTTAG_PKGBINDATArrrrrrrrrrrrrrrr r rrrrrr r#r&r)r+r1r4r7r:r=r@rCrFrJr`rarNrUr{rrrr rr rs   R&%%%%%   P P P P P********** PPP P 1 1 1 1 1 1 1 P P P+OPP P P 2 1P P$'""27??27??83L3L#M#MNNgrw||OTBBCC chHOOA{###!!!!!!++++++     '/   #+A-6j!!!+++++F+++Z $$$$$&$$$. K _ $ N " hcL S% 1&3 H i' f$ & $}49-&,     J   @@@@@ @@@" B,* .]]]]]J]]]D88888888     '        &   ,,,,,/,,, (.1$7=====*=== '''''K!2''''''''; 1'''[[[[[k#8[[[OOO _ /SSSSSzSSS ''''')+<'''ccccc+-Bccc(<%9!5+?%!{{{{{J{{{&[[[[[ [[[0-9,7,9,8,>,5   $Yg>RXoFcRf = = = = =J = = =v8v8v8v8v8fv8v8v8v++++    404040n zDFFFFFsG/A) ?A)A#A  A# AA# A)"A##A)(A)