|i2 dZdZddlZddlZddlZddlZejejej e Z ejej e dZ e ejvrejde ddlZddlmZddlmZddlmZdezZejd ejd ejd ejd ejd ejdiZejdejdej dej!diZ"ejdejdej dej!dddiZ#dZ$ddZ%dZ&dZ'dZ(e)dkr e(dSdS) a olemap olemap parses OLE files to display technical information about its structure. Author: Philippe Lagadec - http://www.decalage.info License: BSD, see source code or documentation olemap is part of the python-oletools package: http://www.decalage.info/python/oletools z0.55Nz..) tablestream)xglob)hexdump3z0olemap %s - http://decalage.info/python/oletoolsEmptyStorageStream ILockBytesIPropertyStorageRootFreez End of Chainz FAT Sectorz DIFAT Sectorgreenyellowcyanbluedefaultc*|tjkrdS|S)N)olefileNOSTREAM)sids =C:\PYTHON\_runtimes\venv\Lib\site-packages\oletools/olemap.py sid_displayrrs gt Fc tdtjgdgd}|dt j|jdg|d|jdg|d d |j zd g|d d |j zd g|dd |j zdg|dd |j zdg|d|j dg|d|jdg|dd|jzdg|d|jdg|d|jdg|dd|jzdg|d|jdg|dd|jzdg|d |jdg|tdtd!tjgdgd}|d"|jd#g|d$|jd%g|jd&z }||jz}|d'z|jz}|d(|d)g|j|kr |j|z }d*}nd+}d}|d,|d-g|||g.t3|jd'z }t7t3|jd'z d+d/D]!} | }|j| t8jkrn"|j|d0zz} |d1d| zd2g|j| z } | d+krd*nd}|d3| d4g|||g.|td|rtd5| d+krtd6ng|j | |j!} t3| | ksJttE| d7| 8tddSdS)9Nz OLE HEADER:)#) AttributeValue Description header_rowzOLE Signature (hex)zShould be D0CF11E0A1B11AE1z Header CLSIDzShould be empty (0)z Minor Versionz%04XzShould be 003Ez Major VersionzShould be 3 or 4z Byte OrderzShould be FFFE (little endian)z Sector ShiftzShould be 0009 or 000Cz# of Dir Sectorsz!Should be 0 if major version is 3z# of FAT SectorszFirst Dir Sector%08Xz(hex)zTransaction Sig Numberz Should be 0zMiniStream cutoffzShould be 4096 byteszFirst MiniFAT Sectorz# of MiniFAT SectorszFirst DIFAT Sectorz# of DIFAT SectorszCALCULATED ATTRIBUTES:zSector Size (bytes)zShould be 512 or 4096 byteszActual File Size (bytes)zReal file size on diskzMax File Size in FATzMax file size covered by FATredrzExtra data beyond FATz(Only if file is larger than FAT coveragecolorszExtra data offset in FATz+Offset of the 1st free sector at end of FATzExtra data sizez:Size of data starting at the 1st free sector at end of FATzHEX DUMP OF EXTRA DATA: z#No extra data found at end of file.r)length startindex)#printr TableStream write_rowbinasciib2a_hexheader_signatureupper header_clsid minor_version dll_version byte_order sector_shiftnum_dir_sectorsnum_fat_sectorsfirst_dir_sectortransaction_signature_numbermini_stream_cutoff_sizefirst_mini_fat_sectornum_mini_fat_sectorsfirst_difat_sectornum_difat_sectorsclose sector_size _filesizelenfatrangerFREESECT sectorsizefpseekreadr) ole extra_datatnum_sectors_per_fat_sectornum_sectors_in_fatmax_filesize_fatextra_size_beyond_fatcolorlast_used_sectorioffset_extra_dataextra_data_sizeexdatas r show_headerrZys - 6 6 6ChChChiiiAKK&(89M(N(N(T(T(V(VXtuvvvKK!13HIJJJKK&3+<"<>NOPPPKK&3?":>>KK#Vc.B%BGLMMMKK)3+K][\\\KK$c&ACYZ[[[KK'#2K)KWUVVVKK')A2FGGGKK%v0F'FPQQQKK%s'1b ) ) 71:) ) ) E **:Q*>?KK+V6G-GIvwxxxm&77O$q((EEdEKK"O5qrue,...GGIII "III  )*** a   7 8 8 8 8 FKK) * * *V[[]]Fv;;/1111 (6"9JKKK L L L b   rctdtjgdgd}tt |jD]}|j|}t |d}t|td}|j |dzz}| d|z|d |zd|zgd|ddg | td dS) NzFAT: r]r]zSector #TypeOffsetzNext #r zrr%%8Xr#r'r") r-rr.rGrErF FAT_TYPESget FAT_COLORSrIr/rB)rMrOrV fat_valuefat_type color_typeoffsets rshow_fatrjs &MMM :b:b:bcccA 3sw<< ;;GAJ ==H55^^Iz)/DEE 1q5) UQY&6/59;LM *dD9  ; ; ; ;GGIII "IIIIIrctd|tjgdgd}t t |jD]u}|j|}t|d}t|td}| d|z|dd|zgd|ddg v| td dS) NzMiniFAT:r\r_r DatarrbzN/Ar'r") r- loadminifatrr.rGrEminifatrcrdrer/rB)rMrOrVrfrgrhs r show_minifatros *OO :b:b:bcccA 3s{## $ $;;KN ==F33^^Iz)/DEE  UQY%1BC *dD9  ; ; ; ;GGIII "IIIIIrcd}tj|}|dddd|dd d d dd |dddd dd |dddd|dddd|dddd|ddddd|\}}t |d krOt t t t|tj d!}|j s|j s|j s d"|_ d"}t t tj||j|j|j#D]\}}}|r|d$r|r|d%|n|}t d&t d'|z|t)j|} nt)j|} |j rt-| |j(|j rt1| |j rt3| | |rt d)dSdS)*Nz2usage: olemap [options] [filename2 ...])usagez-r store_true recursivez)find files recursively in subdirectories.)actiondesthelpz-zz--zip zip_passwordstrzhif the file is a zip archive, open all files from it, using the provided password (requires Python 2.6+))rutyperrvz-fz --zipfname zip_fname*zoif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)z--headerheaderz%Display the OLE header (default: yes)z--fatrFzDisplay the FAT (default: no)z --minifatrnz!Display the MiniFAT (default: no)z-xz--exdatarNz/Display a hex dump of extra data at end of filerFT)rsrwrz/z in zO-------------------------------------------------------------------------------z FILE: %s )rNzZTo display the FAT or MiniFAT structures, use options --fat or --minifat, and -h for help.)optparse OptionParser add_option parse_argsrEr-BANNER__doc__ print_helpsysexitr|rFrnr iter_filesrsrwrzendswithr OleFileIOrZrNrjrorB) rqparseroptionsargsdefault_options containerfilenamedata full_namerMs rmainrs, @E  " / / /F d@@@ dJ|,LNNN ''))OWd 4yyA~~ f  g  O NgkW_ &MMM%*%5dgFWCJCWcjct&v&v&v! 8T  **3//  :CQ(((II66  h lY&'''  #D))CC#H--C > < (: ; ; ; ; ;  SMMM ?      l jkkkkkllr__main__)F)*r __version__rosr~r0pathnormpathabspathdirname__file___thismodule_dirjoin _parent_dirinsertroletools.thirdparty.tablestreamroletools.thirdparty.xglobroletools.ezhexviewerrr STGTY_EMPTY STGTY_STORAGE STGTY_STREAMSTGTY_LOCKBYTESSTGTY_PROPERTY STGTY_ROOT STORAGE_NAMESrH ENDOFCHAINFATSECTDIFSECTrcrerrZrjror__name__rrrs  n #"""""""""""""""'""27??27??83L3L#M#MNNgrw||OTBBCC chHOOA{###777777++++++))))))