|iZ d Z dZddlZddlZddlZddlZddlZddlZej ej
ej e Z
ej ej e
d Zeej vrej de ddlZej dz fdZ ed Zd Zd Zd
Zd ez Z G d d
e Zd Zd Z d Z d Z G d de Z G d de Z! G d de! Z" G d de! Z# G d de! Z$ G d d e! Z% G d d e Z& G d d!e! Z' G d" d#e! Z( G d$ d%e! Z) G d& d'e! Z* G d( d)e! Z+ G d* d+e! Z, G d, d-e, Z- G d. d/e, Z.d0 Z/d1 Z0 G d2 d3e Z1d8d5Z2e3d6k r
e4d7 dS dS )9a( Parse a ppt (MS PowerPoint 97-2003) file
Based on olefile, parse the ppt-specific info
Code much influenced by olevba._extract_vba but much more object-oriented
(possibly slightly excessively so)
Currently quite narrowly focused on extracting VBA from ppt files, no slides or
stuff, but built to be extended to parsing more/all of the file. For better
"understanding" of ppt files, see module ppt_record_parser, which will probably
replace this module some time soon.
References:
* https://msdn.microsoft.com/en-us/library/dd921564%28v=office.12%29.aspx
and links there-in
WARNING!
Before thinking about understanding or even extending this module, please keep
in mind that module ppt_record_parser has a better "understanding" of the ppt
file structure and will replace this module some time soon!
z0.54 Nz.. c * | t j j j v r+t j | }| | |S t j | }| t j | | |S )an
Create a suitable logger object for this module.
The goal is not to change settings of the root logger, to avoid getting
other modules' logs on the screen.
If a logger exists with same name, reuse it. (Else it would have duplicate
handlers and messages would be doubled.)
The level is set to CRITICAL+1 by default, to avoid any logging.
)loggingLoggermanager
loggerDict getLoggersetLevel
addHandler NullHandler)namelevelloggers AC:\PYTHON\_runtimes\venv\Lib\site-packages\oletools/ppt_parser.py
get_loggerr J s w~%000 "4((
t
$
$F g)++,,,
OOE M pptc N t t j dS )z
Enable logging for this module (disabled by default).
This will set the module-specific logger level to NOTSET, which
means the main application controls the actual logging level.
N)logr
r NOTSET r r enable_loggingr k s LL r PowerPoint Documentz.https://bitbucket.org/decalage/oletools/issuesz Please report this issue on %sc " e Zd ZdZ fdZ xZS )PptUnexpectedDataz= raise by PptParser if some field's value is not as expected c d |||| | _ t t | | j d S )NzCIn stream "{0}" for field "{1}" found value "{2}" but expected {3}!)formatmsgsuperr __init__)selfstream
field_name found_valueexpected_value __class__s r r zPptUnexpectedData.__init__ sI Q
VFJ ^
D
D
&&//99999r )__name__
__module__ __qualname____doc__r
__classcell__r& s @r r r s> GG: : : : : : : : :r r c ^ t j d| d d S )z read 1 byte from stream
z check_value.. sD (= (=,/ )2(8(8(=(= (= (= (= (= (= (=r ] Current UserrC N)
isinstancelisttuplejoinr r )r
valueexpectedexp_strs r check_valuerR s (T5M**
A FKK (= (=3;(= (= (= = = =?BCG# ''2 2
2 !
U D U # #Y%5%5h%?%?A A A
r c F e Zd ZdZd Zed Zedd ZdS ) RecordHeaderz a record header, at start of many types found in ppt files
https://msdn.microsoft.com/en-us/library/dd926377%28v=office.12%29.aspx
https://msdn.microsoft.com/en-us/library/dd948895%28v=office.12%29.aspx
c > d | _ d | _ d | _ d | _ d S N)rec_ver rec_instancerec_typerec_lenr! s r r zRecordHeader.__init__ s#
r c d | }t j d| d \ }t |d \ |_ |_ t j d| d \ |_ t j d| d \ |_ |S )z reads 8 byte from stream r7 r8 r; r< )r0 r1 r2 divmodrX rW rY rZ )clzr" objversion_instances r extract_fromzRecordHeader.extract_from s cee "M$ A ? ?(./?(F(F%#+
dFKKNN;;
}T6;;q>>::
r Nr c |t d |d|z z }|t j d|| S t j d||| S )zv generate a record header string given values
length of result depends on rec_len being given or not
NzRECORD_TYPE not set!r] z. sL ,A ,A03 -6,<,2 ,A ,A7?,A ,A ,A !A !A ACFG)$hnt&; $$U++W6 6 9 9 %
~.H% (S.4"7 '')9)9()C)CE E H
H r c b d}||t d |||k rd}|||k rd}|r| j j }|d | }n.|d | }nd || }t | j |dz |z d | | gS g S )
aI simplify verification of values: check value is in given range
expect_lower or expected_upper can be given as None to check only one
boundary. If value equals one of the boundaries, that is also an error
(boundaries form an open interval)
:returns: list of PptUnexpectedData exceptions
FNz$need at least one non-None boundary!Tz < {0:04X}z > {0:04X}zwithin ({0:04X}, {1:04X})rx rC )rd r& r' r r ro )r! r
rO expect_lower expect_upperis_errry
expect_strs r check_rangezPptType.check_range s L$8 CDD D # $$ # $$ ~.H# ( / / = =
% ( / / = =
8 ? ? @L N N
%d&638M&/&6&6u&=&=zK K N
N Ir c g }| | d| j j | j | | d| j j | j | j t d | | d| j j | j |4| | d| j j
| |S )z to be called by check_validity to check the self.rec_head
uses self.RECORD_... constants, (not quite that constant for DummyType)
zrec_head.recVerzrec_head.recInstanceNzRECORD_TYPE not specified!zrec_head.recTypezrec_head.recLen) extendrR rp rW RECORD_VERSIONrX RECORD_INSTANCE RECORD_TYPErm rY rZ )r! lengtherrss r check_rec_headzPptType.check_rec_head. s D$$%6
8M%)%8: : ; ; ; D$$%;%)]%?%)%9; ; < < < #%&BCC C D$$%7%)]%;%)%57 7 8 8 8 KK(():)- )>H H
I
I
I r c Z t | j || j | j S )z6 call RecordHeader.generate with values for this type )rT rf r r r )r_ rZ s r generate_patternzPptType.generate_patternD s0 $$S_g%(%8#:LN N Nr rV )r' r( r) r* r r r rg rb MAIN_STREAM_NAMEr rs ru rR r r r r r r ri ri s
KON= = [= $4 : : :
=
=
= ( D , N N N [N N Nr ri c h e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z fd Z
d Zed
Zd Z xZS )CurrentUserAtoma An atom record that specifies information about the last user to modify
the file and where the most recent user edit is located. This is the only
record in the Current User Stream (section 2.1.1).
https://msdn.microsoft.com/en-us/library/dd948895%28v=office.12%29.aspx
l Dg l _@#G i i r c t t | d d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _
d | _ d | _ d | _
d S )NrJ )ro )r r r rp size header_tokenoffset_to_current_edit
len_user_namedoc_file_version
major_version
minor_versionansi_user_nameunicode_user_name rel_versionr! r& s r r zCurrentUserAtom.__init__b s
ot$$--.-III
&*# ! $ ! ! "!% r c " | j | j k S rV )r HEADER_TOKEN_ENCRYPTr[ s r is_encryptedz CurrentUserAtom.is_encryptedp s D$===r c | }t | |_ t j d| d \ |_ t j d| d \ |_ t j d| d \ |_ t j d| d \ |_ t j d| d \ |_
t j d| d \ |_ t j d| d \ |_ | d | |j |_
t j d| d \ |_ | d|j z |_ |S )z' create instance with info from stream r; r< r7 r8 r. r )rT rb rp r0 r1 r2 r r r r r r r r r r r_ r" r` s r rb z CurrentUserAtom.extract_froms sr cee $0088 M$ A77 "M$ A ? ?&,mD&++a..&I&I#" #]4Q @ @ &
dFKKNN C C #]4Q @ @ #]4Q @ @ A #[[): ; ;!=v{{1~~>> & A0A,A B B
r c | }| | d| j | j | | d| j | j | j g | | d| j d d | | d| j
| j | | d| j | j
| | d| j | j | | d| j | j | j g |S ) Nr headerToken lenUserName docFileVersion majorVersion minorVersion
relVersion)r r rR r SIZEr r HEADER_TOKEN_NOCRYPTr r r DOC_FILE_VERSIONr
MAJOR_VERSIONr
MINOR_VERSIONr REL_VERSION_CAN_USEREL_VERSION_NO_USEr! r s r ru z CurrentUserAtom.check_validity s ""$$ D$$VTY BBCCC D$$]D4E&*&?&*&?&AB B C C C
D$$]D4F%(* * + + + D$$%5t7L%)%:< < = = = D$$^T5G%)%79 9 : : : D$$^T5G%)%79 9 : : : D$$\43C&*&>&*&=&?@ @ A A A r )r' r( r) r* r r r r r r r r r r r rg rb ru r+ r, s @r r r K s &% %# K D MM > > > [, r r c L e Zd ZdZdZdZdZ fdZed Z d dZ
xZ S )
UserEditAtomz An atom record that specifies information about a user edit
https://msdn.microsoft.com/en-us/library/dd945746%28v=office.12%29.aspx
i r r c t t | d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _
d | _ d | _ d | _
d S rV )r r r rp last_slide_id_refversionr r offset_last_editoffset_persist_directorydoc_persist_id_refpersist_id_seed last_view encrypt_session_persist_id_refr s r r zUserEditAtom.__init__ sz
lD!!**,,,
!% ! ! $ (,%"& # .2+++r c v t d | }t | |_ t j d| d \ |_ t j d| d \ |_ t j d| d \ |_
t j d| d \ |_ t j d| d \ |_ t j d| d \ |_
t j d| d \ |_ t j d| d \ |_ t j d| d \ |_ | d |r0t j d| d \ |_ nd|_ |S ) z@ extract info from given stream (already positioned correctly!) z extract UserEditAtom from streamr; r< r7 r8 r. r N)r debugrT rb rp r0 r1 r2 r r r r r r r r r r )r_ r" r r` s r rb zUserEditAtom.extract_from s 4555cee $0088 !' tV[[^^!D!D }T6;;q>>:: #]4Q @ @ #]4Q @ @ &
dFKKNN C C (.
dFKKNN(K(K%$"(-fkk!nn"E"E %}T6;;q>> B B tV[[^^<<
A 6
dFKKNN33
0C . . 26C .
r Nc | }| | d| j | j | | d| j | j || j |k r=| t dd| j d
| | j |k s| j | j k rC| t dd| j d
| j | | | d| j d |S )
Nr r r zUserEditAtom.offsetLastEditz< {0}z#UserEditAtom.offsetPersistDirectoryz
in ({0}, {1})docPersistIdRefr )
r r rR r r r r r appendr r r r )r! offsetr s r ru zUserEditAtom.check_validity s} ""$$ D$$^T5G%)%79 9 : : : D$$^T5G%)%79 9 : : : $.. -)+H)7>>&+A+A C C D D D ,661T5JJJ -)9)#**4+@&II K K L L L
D$$%6%)% id is {1}, reading {2} offsetsc l g | ]0}t j d d d 1S )r; r< r r/ )rF _r" s r
z6PersistDirectoryEntry.extract_from..u sJ !@ !@ !@%& "( tV[[^^!D!DQ!G !@ !@ !@r zoffsets are: {0}) r r r0 r1 r2 r^ r r r ranger )r_ r" r` temps ` r rb z"PersistDirectoryEntry.extract_fromW s BCCCcee
dFKKNN33(.tU(;(;%
s~ H6$
>> @ @ @!@ !@ !@ !@*/
*>*>!@ !@ !@ $++C,ABBCCC
r Nc
g }| j dk rB| t t d| j d d | j dk r/| t t d| j d |gt
| j |k rO| t t dt
| j d | |gt | j |k rO| t t dt | j d | |S )
Ni z PersistDirectoryEntry.persist_idz< 0xFFFFE (dec: {0})r z PersistDirectoryEntry.c_persistz> 0z'PersistDirectoryEntry.rg_persist_offsetz > UserEdit.offsetLastEdit ({0})z%> PersistObjectDirectory offset ({0})) r r r r r r minr max)r! r persist_obj_dir_offsetr s r ru z$PersistDirectoryEntry.check_validityz sl ?W $ $ KK) "D!7!>!>w!G!GI I
J
J
J >Q KK) "C' '
(
(
( ! ,.//2GGG KK) "KD*++1-.. 0 0
1
1
1
" -.//2HHH KK) "KD*++7.// 1 1
2
2
2
r )NN)r' r( r) r* r rg rb ru r r r r r G se & & &
[ D 48.2 r r c F e Zd ZdZg dZ fdZed Zd Z xZ S ) DocInfoListSubContainerOrAtoma; one of various types found in a DocInfoListContainer
https://msdn.microsoft.com/en-us/library/dd921705%28v=office.12%29.aspx
actual type of this object is defined by the recVersion field in its Record
Head
Similar to DummyType, RECORD_TYPE varies from instance to instance for this
type
)i i i i i i c V t t | d S rV )r r r r s r r z&DocInfoListSubContainerOrAtom.__init__ s&
+T22;;=====r c t d | }| | |j j t
j k r!t
||j }nt d |j j t d |
| |j j t j
t d |
|S )+ build instance with info read from stream z1Parsing DocInfoListSubContainerOrAtom from streamz7skipping over {0} Byte in DocInfoListSubContainerOrAtomr r )r r rs rp rY VBAInfoContainerr rb r rZ r r r r r s r rb z*DocInfoListSubContainerOrAtom.extract_from s EFFFcee &!!! < $4$@ @ @"// EECC IIO vcl 233
5
5
5 II(//
>> ? ? ? KK ,bk : : : II&--fkkmm<< = = =
r c R | d| j j | j dS )z can be any of multiple types z
rh.recTypeN)rR rp rY VALID_RECORD_TYPESr[ s r ru z,DocInfoListSubContainerOrAtom.check_validity s3 t}'= 0 2 2 2 2 2r )
r' r( r) r* r r rg rb ru r+ r, s @r r r s~ " " "> > > > > ["2 2 2 2 2 2 2r r c F e Zd ZdZdZdZ fdZed Zd Z xZ
S )DocInfoListContainerz information about the document and document display settings
https://msdn.microsoft.com/en-us/library/dd926767%28v=office.12%29.aspx
i c d t t | d | _ d S rV )r r r rg_child_recr s r r z DocInfoListContainer.__init__ s.
"D))22444 r c t d | }| | | }||j j z }t d || g |_ ||k rt | }|j
| | }t d | ||k t d || dS )r z(Parsing DocInfoListContainer from streamz-start reading at pos {0}, will read until {1}r z>?? A A A "++F36"8 "8 "88D V8L8L %&S 3 B B D DEEFF H H H ))CV145 J J J , V 4 4 %&S 1 @ @ B BCCDD F F F
&&=v.1 3 3 33?<3G3G %&S . = = ? ?@@AA C C C $$=v,/1 1 11= f1E1E %&S_ ; ; = =>>?? A A A 1 = =f E Ep
r c | }| | j | | j | | j | | j | | j | | j | | j |S )z- check all values in object for valid values )
r r r ru r r r r r r r s r ru z DocumentContainer.check_validity s ""$$ D&5577888 D$3355666 D+::<<=== D)88::;;; D&5577888 D$3355666 D&5577888 r r r, s @r r r sw
K- - - - -, x x [xv
r r c P e Zd ZdZdZdZdZdZ fdZe d
d Z
d Z xZ S ) r z A container record that specifies VBA information for the document.
https://msdn.microsoft.com/en-us/library/dd952168%28v=office.12%29.aspx
i r r r c d t t | d | _ d S rV )r r r
vba_info_atomr s r r zVBAInfoContainer.__init__ s.
%%..000 !r Nc t d | }|| | n!t d ||_ t | |_ |S )zL since can determine this type only after reading header, it is arg
zparsing VBAInfoContainerNz skip parsing of RecordHeader)r r rs rp VBAInfoAtomrb r# )r_ r" rp r` s r rb z VBAInfoContainer.extract_from st ,---cee f % % % % II4 5 5 5#CL ' 4 4V < <
r c | | j }| | j |S )Nr )r
RECORD_LENGTHr r# ru r s r ru z VBAInfoContainer.check_validity sA ""$*<"== D&5577888 r rV )
r' r( r) r* r r r r( r rg rb ru r+ r, s @r r r s
KNOM" " " " " [ r r c J e Zd ZdZdZdZdZ fdZed Z d Z
xZ S )r% z An atom record that specifies a reference to the VBA project storage.
https://msdn.microsoft.com/en-us/library/dd948874%28v=office.12%29.aspx
r8 c t t | d | _ d | _ d | _ d S rV )r r% r persist_id_ref f_has_macrosr r s r r zVBAInfoAtom.__init__ s:
k4 ))+++ " r c t d | }| | t | |_ t | |_ t | |_ |S )Nzparsing VBAInfoAtom)r r rs r= r- r. r r s r rb zVBAInfoAtom.extract_from sh '(((cee &!!!
$F^^
"&>>
Vnn
r c | | j }| | d| j d d | | d| j d |S )Nr'
fHasMacrosr8 r )r r( r r r. rR r r s r ru zVBAInfoAtom.check_validity sq ""$*<"==
D$$\43DdANNOOO D$$Y a@@AAA r ) r' r( r) r* r r r( r rg rb ru r+ r, s @r r% r% s}
KNM [, r r% c < e Zd ZdZdZdZdZd fd Zd Zd Z xZ
S )
ExternalObjectStorageaI storage for compressed/uncompressed OLE/VBA/ActiveX control data
Matches types ExOleObjStgCompressedAtom, ExOleObjStgUncompressedAtom,
VbaProjectStgCompressedAtom, VbaProjectStgUncompressedAtom,
ExControlStgUncompressedAtom, ExControlStgCompressedAtom
Difference between compressed and uncompressed: RecordHeader.rec_instance
is 0 or 1, first variable after RecordHeader is decompressed_size
Data is not read at first, only its offset in the stream and size is saved
e.g.
https://msdn.microsoft.com/en-us/library/dd952169%28v=office.12%29.aspx
i r r Nc t t | |d | _ n)|r| j | _ d| _ n| j | _ d| _ d | _ d | _ d | _ d S )NTF)
r r3 r r RECORD_INSTANCE_COMPRESSED
is_compressed RECORD_INSTANCE_UNCOMPRESSEDuncompressed_size data_offset data_size)r! r6 r& s r r z ExternalObjectStorage.__init__ s}
#T**33555 #'D
'#'#BD !%D #'#DD !&D !% r c > t d | j | | | j j | _ | j r$t | | _ | xj dz c_ |
| _ dS )zX not a classmethod because of is_compressed attrib
see also: DummyType
z:Parsing ExternalObjectStorage (compressed={0}) from streamr< N) r r r r6 rs rp rZ r: r= r8 r r9 rr s r rb z"ExternalObjectStorage.extract_from s
N6$,-- / / / 6""" . %+F^^D " NNa NN!;;==r c * | S rV )r r[ s r ru z$ExternalObjectStorage.check_validity s ""$$$r rV ) r' r( r) r* r r5 r7 r rb ru r+ r, s @r r3 r3 sx
K!" #$ ) ) ) % % % % % % %r r3 c J e Zd ZdZej Z fdZe fd Z xZ
S )!ExternalObjectStorageUncompressedz< subclass of ExternalObjectStorage for uncompressed objects c X t t | d d S )NF)r r> r r s r r z*ExternalObjectStorageUncompressed.__init__' s(
/66??FFFFFr c l | }t t | | |S zL note the usage of super here: call instance method of super class!
)r r> rb r_ r" r` r& s r rb z.ExternalObjectStorageUncompressed.extract_from* s4 cee
/55BB6JJJ
r ) r' r( r) r* r3 r7 r r rg rb r+ r, s @r r> r> # sp FF+HOG G G G G [ r r> c J e Zd ZdZej Z fdZe fd Z xZ
S ) ExternalObjectStorageCompressedz: subclass of ExternalObjectStorage for compressed objects c X t t | d d S )NT)r rD r r s r r z(ExternalObjectStorageCompressed.__init__7 s(
-t44==dCCCCCr c l | }t t | | |S rA )r rD rb rB s r rb z,ExternalObjectStorageCompressed.extract_from: s4 cee
-s33@@HHH
r ) r' r( r) r* r3 r5 r r rg rb r+ r, s @r rD rD 3 sp DD+FOD D D D D [ r rD c fd}|S )z a decorator that can open and close the default stream for func
to be applied only to functions in PptParser that read from default stream
(:py:data:`MAIN_STREAM_NAME`)
Decorated functions need to accept args (self, stream, ...)
c d} | j ^t d t j | j t | _ d} | | j g|R i ||rYt d t j | j d | _ S S # t $ r | j
r | Y nw xY w |rZt d t j | j d | _ d S d S # |rXt d t j | j d | _ w xY wNFz opening stream {0!r} for {1}Tz closing stream {0!r} after {1}) _open_main_streamr r r r r' ole
openstreamclose Exception fast_fail_log_exception)r! argskwargsstream_opened_by_mefuncs r wrappedz(with_opened_main_stream..wrappedN s # .%- 8!6"2DMBBD D D)-)<)<=M)N)N&&*# 4d 4FtFFFvFF #
. :!6"2DMBBD D D&,,...)-&&
. & & &~
&##%%%%% & & #
. :!6"2DMBBD D D&,,...)-&&&
.
."
. :!6"2DMBBD D D&,,...)-&----s% A6C &D =E" ?D E" "A F>r rT rU s ` r with_opened_main_streamrW E s# . . . . .6 Nr c fd}|S )zB same as with_opened_main_stream but with yield instead of return c ? K d} | j ^t d t j | j t | _ d} | | j g|R i |D ]}|V n,# t $ r | j r |
Y nw xY w|rZt d t j | j d | _ d S d S # |rXt d t j | j d | _ w xY wrI ) rJ r r r r r' rK rL rN rO rP rM )r! rQ rR rS resultrT s r rU z2generator_with_opened_main_stream..wrappedo s # .%- 8!6"2DMBBD D D)-)<)<=M)N)N&&*# $tT%;MdMMMfMM
& & &~
&##%%%%% & #
. :!6"2DMBBD D D&,,...)-&&&
.
."
. :!6"2DMBBD D D&,,...)-&----s+ A>B D &B/,D .B//D A E,r rV s ` r !generator_with_opened_main_streamr[ l s# . . . . .8 Nr c e Zd ZdZddZddZd Zd Zed Z ed Z
e d
Z e d Z
e d Zed
Zed Ze d ZdS ) PptParserzW Parser for PowerPoint 97-2003 specific data structures
requires an OleFileIO
Fc t |t j r"t d || _ nFt d | t j | | _ || _ d| _ d| _ d| _
d| _ | j }t d |D r| dd|d d |D }d |vr| dd|d
t |vr | dd|t d| _ dS ) z constructor
:param ole: OleFileIO or anything that OleFileIO constructor accepts
:param bool fast_fail: if True, all unexpected data will raise a
PptUnexpectedData; if False will only log error
zusing open OleFileIOzOpening file {0}Nc 3 < K | ]}t | d k V dS )r N)r rF r" s r rH z%PptParser.__init__.. s- ;;Fs6{{a ;;;;;;r rootlistdirzlen = 1c B g | ] }|d S )r )lowerr` s r r z&PptParser.__init__.. s& EEEfq ))EEEr z current userrJ )rK olefile OleFileIOr r rK r rO current_user_atomnewest_user_editdocument_persist_objpersist_object_directoryrb any_failr rd rJ )r! rK rO root_streamss r r zPptParser.__init__ sR c7, - - . II, - - -DHH II(//44 5 5 5 (--DH"!% $ $(!(,% x'')) ;;l;;; ; ; C JJvy, B B BEE EEE -- JJvy, G G G %%''<77 JJvy,8H I I I!% r Nc | t j dd }n:t j \ }}}t j | }t | }t | t t j | D ]J\ }}|
D ]0}t d || 1KdS )a log an exception instead of raising it
call in one of 2 ways:
try:
if fail():
self._log_exception('this is the message')
except:
self._log_exception() # only possible in except clause
Nztrace {0}: {1})
traceback
extract_stacksysexc_info
extract_tbstrr error enumerate format_list
splitlinesr r ) r! r stackr exctracei_entryr lines r rP zPptParser._log_exception s ? +--crc2EE LNNMAsE (//Ec((C # ' (=e(D(D E E B BNGU ((**
B
B *11'4@@AAAA
B B Br c h | j r t | | t | j dS )zt depending on self.fast_fail raise PptUnexpectedData or just log err
args as for PptUnexpectedData
N)rO r rP r )r! rQ s r rl zPptParser._fail s<
> >#T* * 14 8 < = = = = =r c R | j t d t d d} t d | j d }t | | _ n,# t $ r | j r |
Y nw xY w|0t d | dS dS # |/t d | w w xY w)z parse the CurrentUserAtom record from stream 'Current User'
Structure described in
https://msdn.microsoft.com/en-us/library/dd948895%28v=office.12%29.aspx
Nz-::<< (*% $ kk
KK , , , %11&,GGI$,(1% II) * * * ++--D
0 = #VCII . .0 0 0
L
L > E Ec J JKKKK
1g
II* vi @AA
C
C
C KK :BK H H H 4 @ @ H H II) * * *#226::D
0 = #VCII . .0 0 0
*
* F #VC[[* * * *
1g
* *>
!
! *3u/F+G+GGI E!6%"2G"'"9 ; ;< < < &/u/F%G%G ! !ME6 1%2B52HII! /FY kkkkkkr c L | j t d | j | | j j }| j | }t d || t d | | |t j t
| | _ t d | j }|r:t d t | |D ]/}t d | 0|r| j r
|d dS dS ) z. Part 2: Identify the document persist object NzBre-reading and overwriting previously read document_persist_objectz)newest user edit ID is {0}, offset is {1}z seek to {0}r r z)check_validity(document_persist_obj): {0}r )ri r r rj r rh r r r r r r r rb ru r rO )r! r"
newest_refr r r s r parse_document_persist_objectz'PptParser.parse_document_persist_objectY s $ 0 KK B
C
C
C ( 0 / / 1 1 1
*=
.z: =6*f-- / / / -&&v../// FBK((( %6$B$B6$J$J! %&&&(7799 M KK9@@TKK L L L & &C KKC
&
&
&
& DN q'M r c # K d}t | }t d | ||k rt d d} | }|dz
}| | }| | }|dk rVt d ||z ||z V | ||dz }|dk Vt | |k r'| ||z |z
t j
n>t d t | || d
S ) z. search for pattern in stream, return indices r* zpattern length is {0}z need buf > pattern to search!r Tr ro zfound pattern at index {0}z1reached end of buf (read {0}<{1}) after {2} readsN) r r r r rd r r2 findr r r ) r! r" patternBUF_SIZE pattern_lenn_reads start_posbufidxs r search_patternzPptParser.search_pattern sj 'll )00==>>> ! ! <== =
I qLG ++h''C((7##C)) 6==imLLMMM #o%%%hhwA.. ))
3xx8## I 0; > LLLL M!6#c((Hg>>@ @ @% r c # K t d t t j t
t
j z }| | D ]|}| | t d | t | }n$# t $ r | Y w xY w| }|r;t
d t | nct d |j }t d |j |j |j |V |D ]/}t
d | 0|r| j r|d ~d S )
aY search through stream for VBAInfoContainer, alternative to parse...
quick-and-dirty: do not parse everything, just look for right bytes
"quick" here means quick to program. Runtime now is linear is document
size (--> for big documents the other method might be faster)
.. seealso:: search_vba_storage
z looking for VBA info containers)rZ extracting at idx {0}r zcontainer is okz2persist id ref is {0}, has_macros {1}, version {2}z%check_validity(VBAInfoContainer): {0}r N)r r r r r( r% r r r rb rN rP ru r r r# r- r. r rO )r! r" r r containerr atomr s r search_vba_infozPptParser.search_vba_info s 3444"33(8(F 4 H H ..(3(A / C CC &&w// C KK II-44S99 : : :
, 9 9& A A
##%%%
++--D
= #VCII . .0 0 0 0 +,,, . N!6$"5t7H"&, 0 01 1 1
*
* C #VC[[* * * *
1g
3 s C C?>C?c # K t d t t fD ]}| dt
j | }| | D ]a}| | t d | |
| }n$# t $ r | Y |w xY w|
}|r;t d t | nGt d |j |j j |j |V |D ]5}t d |j | 6|r| j r|d cdS )a search through stream for VBAProjectStg, alternative to parse...
quick-and-dirty: do not parse everything, just look for right bytes
"quick" here means quick to program. Runtime now is linear is document
size (--> for big documents the other method might be faster)
The storages found could also contain (instead of VBA data): ActiveX
data or general OLE data
yields results as it finds them
.. seealso:: :py:meth:`search_vba_info`
z looking for VBA storage objectsr r r z8storage is ok; compressed={0}, size={1}, size_decomp={2}zcheck_validity({0}): {1}N)r r r> rD r r r r r r rb rN rP ru r r r6 rp rZ r8 r' rO )r! r" obj_typer r storager r s r search_vba_storagez PptParser.search_vba_storage s " 3444:8: ! " ! "H
KK2; ' ' ' //11G **733
"
" C 188==>>> & 3 3F ; ;GG ''))) H --// "KK A!'D !2!24 4 4 4 II 0 %vg&;&-&6&>&-&? A AB B B
"MMM A ACKK :!'(93!?!?A A A A "DN " q'M3
"! " ! "s =C C43C4c D t d | |j t j t
||j \ }}}t d |t | | |r | j
r||S )z2 return decompressed data from search_vba_storage z.decompressing storage for VBA OLE data stream z-decompressed {0} to {1} bytes; found err: {2}) r r r r9 r r iterative_decompressr: r r rO )r! r" r decompn_readr s r decompress_vba_storagez PptParser.decompress_vba_storage s BCCC G'555 ): ; ; A6&#f++s33 5 5 5 4> I
r c t d |j |j | |j t j | |j }|S )z0 return data pointed to by uncompressed storage zCreading uncompressed VBA OLE data stream: {0} bytes starting at {1}) r r r r: r9 r r r r2 )r! r" r datas r read_vba_storage_dataz PptParser.read_vba_storage_data' sk .6'+W-@AA C C C G'555{{7,-- r c # K d}d}| D ] }|dz
}|j j dk r|dz
} d}d}| D ]B}|dz
}|j r |dz
}| | V +| | V Ct d |||| dS )z@ search vba infos and storages, yield uncompressed storage data r r zCfound {0} infos ({1} with macros) and {2} storages ({3} compressed)N)
r r# r. r r6 r r r r r )r! r" n_infosn_macrosr
n_storages n_compressedr s r
iter_vba_datazPptParser.iter_vba_data2 s
((** D qLG!.22A
..00 : :G !OJ$
: ! 11'::::::00999999 $&(J EE G G G G Gr )FrV )r' r( r) r* r rP rl r rW r r r[ r r r r r r r r r r] r] sU
%& %& %& %&NB B B B,> > > 8 _0 _0 _0B $ $ $V ' '& > ', , '&, \ '2" 2" '&2"h : 'G G '&G G Gr r] c t j }d}d}d} ||k rIt ||z
| }|| | | z
}||z
}||k In # t j $ r }|}Y d}~nd}~ww xY w|||fS )z( decompress data from stream chunk-wise r r N)zlib
decompressobjr
decompressr2 rv ) r" r
chunk_size decompressorr r
return_errn_newr s r r r M s %''L
F
FJtmmV Z00E l--fkk%.@.@AA AF eOF tmm :
6: %%s AA+ +B:BB__main__znothing here to run!)r )5r* __version__rr r r0 rp r r pathnormpathabspathdirname__file___thismodule_dirrN _parent_dirinsertre CRITICALr r r r URL_OLEVBA_ISSUESMSG_OLEVBA_ISSUESrN r r4 r9 r= rR objectrT ri r r r r r r r r r r% r3 r> rD rW r[ r] r r' printr r r r s Z
'""27??27??83L3L#M#MNNg rw||OT B BCC ch HOOA{### #+A- < j! ! ! ) E 47HH : : : : : : : :2 2 2
2 2 2
2 2 2
A A A"(L (L (L (L (L6 (L (L (LVqN qN qN qN qNf qN qN qNhP P P P Pg P P PfJ J J J J7 J J J^%7 %7 %7 %7 %7 %7 %7 %7P/ / / / /7 / / /dL L L L LF L L L^,2 ,2 ,2 ,2 ,2G ,2 ,2 ,2^, , , , ,7 , , ,^d d d d d d d dN w F. . . . .' . . .b1% 1% 1% 1% 1%G 1% 1% 1%h
(=
&;
$$ $ $N D|G |G |G |G |G |G |G |G~
& & & && z E
!!!!! r