|i^dZddlZGddeZGddeZGddeZGd d eZGd d eZGd deZ GddeZ GddeZ GddeZ GddeZ GddeZGddeZdZdZdZdZdZd Zd!Zd"Zd#Zd$Zd%Zd&Zd'Zd(Zd)Zd*ZdS)+a6 oleform.py oleform is a python module to parse VBA forms in Microsoft Office files. Authors: see https://github.com/decalage2/oletools/commits/master/oletools/oleform.py License: BSD, see source code or documentation oleform is part of the python-oletools package: http://www.decalage.info/python/oletools NceZdZdS)OleFormParsingErrorN)__name__ __module__ __qualname__>C:\PYTHON\_runtimes\venv\Lib\site-packages\oletools/oleform.pyrr0sDr rc2eZdZdZdZdZdZdZdZdS)MaskcRfdt|jD|_dS)Nc&g|] }d|zz|z S)r).0ivals r z!Mask.__init__..5s&BBB1cQTlQ&BBBr )range_size_val)selfrs `r __init__z Mask.__init__4s,BBBBdj0A0ABBB r cjdfdtjDS)Nz, c3LK|]}j|j|VdSN)r_names)rrrs r zMask.__str__..8s5SSAdiPQlSQSSSSSSr )joinrrrs`r __str__z Mask.__str__7s4yySSSStz1B1BSSSSSSr cL|j|j|Srrrindex)rnames r __getattr__zMask.__getattr__:sy**40011r c|jSr)sizers r __len__z Mask.__len__=s yr cL|j|j|Srr")rkeys r __getitem__zMask.__getitem__@sy**3//00r cP|D]"\}}||r||#dSr)read)rstreampropsr$r's r consumez Mask.consumeCs>! " "LT4Dz " D!!! " "r N) rrrrr r%r(r+r0rr r r r 3stCCCTTT222111"""""r r ceZdZdZdZgdZdS) FormPropMaskz"FormPropMask: [MS-OFORMS] 2.2.10.2)Unused1 fBackColor fForeColorfNextAvailableID Unused2_0 Unused2_1fBooleanPropertiesr: fMousePointer fScrollBarsfDisplayedSize fLogicalSizefScrollPosition fGroupCntReserved fMouseIconfCyclefSpecialEffect fBorderColorfCaptionfFontfPicturefZoomfPictureAlignmentfPictureTilingfPictureSizeMode fShapeCookie fDrawBufferNrrr__doc__rrrr r r2r2Hs*,, E---FFFr r2ceZdZdZdZgdZdS) SitePropMaskz%SitePropMask: [MS-OFORMS] 2.2.10.12.2)fNamefTagfIDfHelpContextID fBitFlagsfObjectStreamSize fTabIndexfClsidCacheIndex fPositionfGroupIDr4fControlTipTextfRuntimeLicKeyfControlSource fRowSourceNrOrr r rRrRRs-// ESSSFFFr rRceZdZdZdZgdZdS)MorphDataPropMaskz&MorphDataPropMask: [MS-OFORMS] 2.2.5.2!)!fVariousPropertyBitsr5r6 fMaxLength fBorderStyler< fDisplayStyler;fSize fPasswordChar fListWidth fBoundColumn fTextColumn fColumnCount fListRows fcColumnInfo fMatchEntry fListStylefShowDropButtonWhen UnusedBits1fDropButtonStyle fMultiSelectfValuerFfPicturePositionrErDrBrH fAccelerator UnusedBits2rA fGroupNameNrOrr r rcrcYs*00 E777FFFr rcceZdZdZdZgdZdS) ImagePropMaskz"ImagePropMask: [MS-OFORMS] 2.2.3.2rS) UnusedBits1_1 UnusedBits1_2 fAutoSizerEr5rgr;rLrDrirHrJrKrerBNrOrr r r}r}ds*,, EFFFr r}ceZdZdZdZgdZdS)CommandButtonPropMaskz*CommandButtonPropMask: [MS-OFORMS] 2.2.1.2 ) r6r5rerFrxrir;rHryfTakeFocusOnClickrBNrOrr r rrls*44 EFFFr rceZdZdZdZgdZdS)SpinButtonPropMaskz'SpinButtonPropMask: [MS-OFORMS] 2.2.8.2rS)r6r5rerirtfMinfMaxr\ fPrevEnabled fNextEnabled fSmallChange fOrientationfDelayrBr;NrOrr r rrss-11 EGGGFFFr rceZdZdZdZgdZdS)TabStripPropMaskz%TabStripPropMask: [MS-OFORMS] 2.2.9.2) fListIndexr5r6r4rifItemsr;Unused2fTabOrientation fTabStyle fMultiRowfTabFixedWidthfTabFixedHeight fTooltipsUnused3 fTipStringsUnused4fNamesre fNewVersionfTabsAllocatedfTagsfTabDataryrBNrOrr r rrzs-// EAAAFFFr rceZdZdZdZgdZdS) LabelPropMaskz"LabelPropMask: [MS-OFORMS] 2.2.4.2 ) r6r5rerFrxrir;rErgrDrHryrBNrOrr r rrs-,, EJJJFFFr rceZdZdZdZgdZdS)ScrollBarPropMaskz&ScrollBarPropMask: [MS-OFORMS] 2.2.7.2)r6r5rerir;rrr\rtrrr fLargeChangerfProportionalThumbrrBNrOrr r rrs*00 E&&&FFFr rc|eZdZdZedZdZddZdZdZ dZ d Z d Z d Z d Zd ZddZdZdZdS)ExtendedStreamcZd|_g|_||_||_d|_d|_dS)NrF)_pos_jumps_stream_path_padding _pad_start)rr.paths r rzExtendedStream.__init__s0     r cD||}|||Sr) openstream)clsole_filerr.s r openzExtendedStream.opens'$$T**s64   r cV|xj|z c_|j|Sr)rrr-rr's r _readzExtendedStream._reads( T |  &&&r cX|j|z |z}|r|||z dSdSr)rr)rstartr'offsets r _padzExtendedStream._padsA)e#t+  & JJtf} % % % % % & &r cp|jr||j|||Sr)rrrrrs r r-zExtendedStream.reads4 = - IIdot , , ,zz$r c&d|j|ff|_|S)Njumpr _next_jumprs r will_jump_tozExtendedStream.will_jump_tos!DIt#45 r c"d|jf|_|S)Npadrrs r will_padzExtendedStream.will_pads $), r cVd|j|jff|_d|_|j|_|S)NpaddedT)rrrrrs r padded_structzExtendedStream.padded_structs,#dmT_%EF ) r cd|jsJ|j|jd|_dSr)rrappendrs r __enter__zExtendedStream.__enter__s2 4?+++r c||j\}}|dkrX|\}}|j|z }||kr)|d|||||z dS|dkr||dS|dkr1|\} } ||j| |_| |_dSdSdS)Nrz#Bad jump: too much read ({0} > {1})rr) rpopr raise_errorformatr-rrr) rexc_type exc_value traceback jump_typedatarr' consummed prev_paddingprev_pad_starts r __exit__zExtendedStream.__exit__s   $  1 1 YF"" $  I- t##$$%J%Q%QR[]a%b%bccc $*+++++e## $h&&15.~ $/*** , "0  '&r cRtj|||Sr)structunpackr-rrr's r unpackszExtendedStream.unpackss}VTYYt__555r c:|||dS)Nr)rrs r rzExtendedStream.unpacks||FD))!,,r rcdtd|j|j|z |)Nz {0}:{1}: {2})rrrr)rreasonbacks r rzExtendedStream.raise_errors-!."7"7 DIPTDTV\"]"]^^^r c |||}||krF|d|t|t|dSdS)Nz!Invalid {0}: expected {1} got {2})rrrstr)rr$rr'expectedvalues r check_valueszExtendedStream.check_valuessf VT** H     @GGcRZmm]`af]g]ghh i i i i i  r c8|||||fdSr)r)rr$rr'rs r check_valuezExtendedStream.check_values$ $xk:::::r N)r)r)rrrr classmethodrrrr-rrrrrrrrrrrr r rrs!![!'''&&&&      111"666---____jjj ;;;;;r rc|dddd|dd}||dS)NzTextProps (versions)Q)iR 鑏Q8o zStdFont (version)>> .a;;; A==q)) H A A A&!!!!!7<<<<E5 dl @$1MMMdl qjj \ccdghmdndnooppp !r c R|dddd|dd}||5t|dd}|5dx}x}}|jrt |}|jrt |}|jr|dd}| |gddx}}|j r|dd}|j r|dd}|j r| dd}|jrt |}| |gddddn #1swxYwYd} |dkr| |} d} |dkr| |} |jr| d | |} t!| dkrd} | | |||dd| d cdddS#1swxYwYdS) Nz OleSiteConcreteControl (version)rrrrr))rWr)rXr)rYr))r_r)r`r)rarr)r$tagidtabindexClsidCacheIndexrcaptioncontrol_tip_text)rrrrRrrTrrUrVr0rZr[r]r-r^r\len) r.cbSitepropmaskname_lentag_lenrrrcontrol_tip_text_lenr$rrs r consume_OleSiteConcreteControlrs 94AFFF ]]4 # #F   V $ $+5+5 dA 6 677  ! ! # # h h&' 'H 'w~ KB6JJ} JA&II| ,]]4++   V%h%h%h i i i)* *H! 2!==q11( 9"(--a"8"8   A#$ ' W'Nv'V'V$   V%f%f%f g g g) h h h h h h h h h h h h h h h, qLL;;x((D  aKK++g&&C    KKNNN!;;';<<  ! !Q & &# S#2Td#355S+5+5+5+5+5+5+5+5+5+5+5+5+5+5+5+5+5+5s88H >HE> B HH #H c#K|dddd|dd}||5t|dd}||gd|jr|dd}|d zd z }nd }dddn #1swxYwY|jrt||jrt||j rt||s7|dd}t|D]}t|| d d \}}|} ||5|5| d kr| t|z} | d kdddn #1swxYwYt|D]}t!|V ddddS#1swxYwYdS)NzFormControl (versions)rr)rrrrr)r5rr6r)r7rirSrz>%#;#; \<#/   \ * *99 __   Y Y.22,0PQW0X0XX,/22 Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y|$$ 9 9A088 8 8 8 8 9 999999999999999999sIA$B66B:=B:,G(F, G(,F0 0G(3F0 4&G((G,/G,c|dddd|dd}||5t|dd}|5||gd|jrt|}nd }|jrt|}nd }||gd |j rt|}nd }dddn #1swxYwY| d| |}d }|d kr| |}d }|d kr| |}dddn #1swxYwY|j rt||j rt|t||||fS) NzMorphDataControl (versions)rrrrzs  95!VLLLmmD!,,O   _ - -AA(tQ)?)?@@AAAAAAAAAAAAAAA'v&&&'v&&&fr;c2|dddd|dd}||5t|dd}dddn #1swxYwY|jrt |dSdS)NzSpinButtonControl (versions)rrrrrr)rrrrrBr)r. cbSpinButtonrs r consume_SpinButtonControlrAs 6q&III==q))L   \ * *??&v}}T1'='=>>???????????????'v&&&&&''r;c |dddd|dd}||5t|dd}||gdd }|d r|dd}dddn #1swxYwY|jrt |t|t|D]}| ddS) NzTabStripControl (versions)rrrrrr))rrrr )rirr+)rr)rr)rr)rr)rr)rrr*)rr)rrrr) rrrrr0rBrrrr-)r. cbTabStriprtabDatars r consume_TabStripControlrEsc 4eQGGGtQ''J   Z ( ( - -#FMM$$:$:;;"G"G"G H H H J  -mmD!,,G - - - - - - - - - - - - - - -'v&&&f 7^^ QsAB,,B03B0c|dddd|dd}||5t|dd}|5||gd|jrt|}nd }||gd dddn #1swxYwY||}|d dddn #1swxYwY|j rt||j rt|t||S) NLabelControl (versions)rrrrrr)r rr*r)r,r+r-)rgr)rDrr/r0r.r) rrrrrr0rFrr-rHrrBr)r.cbLabelrr4rs r consume_LabelControlrIs 15!VDDDmmD!$$G   W % % tQ!7!788  ! ! # # O O   V&C&C&C D D D  !FvNN    V&N&N&N O O O O O O O O O O O O O O O O O O++l++ A!$'v&&&'v&&&f Ns78DrErIrLprintrr)r stream_dircontrol variablesrvars r extract_OleFormVariablesrbs!!(CHHZ3%5G,H,HIIG(1122I   x*u2D)E)E F FD  !Q & &  % % % % " #r ) )  & & & & " #r ) )  % % % % " #'C C C>VW[>\>\ ;CL#i.#l*;*; " #r ) ) %d + + + + " #r ) ) ( . . . . " #r ) ) #D ) ) ) ) " #r ) )1$77C NN " #r ) ) $T * * * * " #r ) )  % % % % DKKCPSTePfLgLghh i i i  r ) rPr Exceptionrobjectr r2rRrcr}rrrrrrrrrrr rrr(r7r:r>rArErIrLrbrr r res9  X      )   """""6"""*-----4---SSSSS4SSS 7 7 7 7 7 7 7 7DDGGGGGGGGAAAAAtAAAJJJJJDJJJ&&&&&&&&O;O;O;O;O;VO;O;O;d ==="     /5/5/5b!9!9!9F5(5(5(n ' ' '    ' ' '6< ' ' 'r