Mpj| dZddlmZdZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z ej&j)ej&j+ej&j-eZej&j)ej&j3edZeej&vrej&j7deddlmZddlmZGd d e j@Z!e jDd zfd Z#e#d Z$dZ%Gdde&Z'Gdde&Z(Gdde&Z)dZ*e*dzZ+e*dzZ,dZ-dZ.dZ/dZ0dZ1dZ2e2dzZ3e2dzZ4d Z5e5d!zZ6e5d"zZ7e5d#zZ8e5d$zZ9d%Z:e5d&zZ;Gd'd(e&Z<Gd)d*e<Z=Gd+d,e<Z>Gd-d.e<Z?Gd/d0e?Z@Gd1d2e<ZAGd3d4e<ZBGd5d6e<ZCGd7d8e@eCZDGd9d:e@eCZEGd;deFZGGd?d@eFZHGdAdBeFZIGdCdDeFZJGdEdFe<ZKGdGdHeKe?ZLGdIdJeKe?ZMGdKdLeKeBZNGdMdNeNZOGdOdPeNZPGdQdReNZQGdSdTeNZRGdUdVeNZSGdWdXeNZTGdYdZe<ZUGd[d\eUe?ZVGd]d^eUeBZWGd_d`eWZXGdadbeWZYGdcddeWZZGdedfeWZ[GdgdheBZ\Gdidje?Z]Gdkdle<Z^Gdmdne<Z_eDeEeLeMeVe]doZ`eGeHeIeJeOePeQeReSeTeXeYeZe[e\dpZaGdqdre<ZbGdsdte&ZcdyduZddvZedwZfegdxk(refyy#e$r3 ddlm cmZ n$#e$r ddlmZ n#e$r edwxYwYnwxYwY^wxYw)za  ftguess.py ftguess is a Python module to determine the type of a file based on its contents. It can be used as a Python library or a command-line tool. Usage: ftguess ftguess is part of the python-oletools package: http://www.decalage.info/python/oletools )print_functionz0.60.2Nzplxml or ElementTree are not installed, see http://codespeak.net/lxml or http://effbot.org/zone/element-index.htmz..)clsid)xglobceZdZdZdZy) NullHandlera Log Handler without output, to avoid printing messages if logging is not configured by the main application. Python 2.7 has logging.NullHandler, but this is necessary for 2.6: see https://docs.python.org/2.6/library/logging.html#configuring-logging-for-a-library cyN)selfrecords ^/mnt/ssd/data/Dropbox/adrian/scripts/msg_venv/lib/python3.12/site-packages/oletools/ftguess.pyemitzNullHandler.emitks N)__name__ __module__ __qualname____doc__rr rr rrds   rrc |tjjjvr(tj|}|j ||Stj|}|j t|j ||S)an Create a suitable logger object for this module. The goal is not to change settings of the root logger, to avoid getting other modules' logs on the screen. If a logger exists with same name, reuse it. (Else it would have duplicate handlers and messages would be doubled.) The level is set to CRITICAL+1 by default, to avoid any logging. )loggingLoggermanager loggerDict getLoggersetLevel addHandlerr)namelevelloggers r get_loggerr nsr w~~%%000""4(   t $F km$ OOE MrftguesscJtjtjy)z Enable logging for this module (disabled by default). This will set the module-specific logger level to NOTSET, which means the main application controls the actual logging level. N)logrrNOTSETr rr enable_loggingr%s LL rceZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Z*y))*FTYPE" Constants for file types ZipWordWord6Word97Word2007 Word2007_DOCX Word2007_DOTX Word2007_DOCM Word2007_DOTMExcelExcel5Excel97 Excel2007Excel2007_XLSXExcel2007_XLSMExcel2007_XLTXExcel2007_XLTMExcel2007_XLSBExcel2007_XLAM Powerpoint97Powerpoint2007Powerpoint2007_PPTXPowerpoint2007_PPSXPowerpoint2007_PPTMPowerpoint2007_PPSMXPSRTFHTMLPDFMHTMLTEXTEXE_PEOLEXMLOpenXMLzUnknown File TypeMSIOneNotePNGN)+rrrrZIPWORDWORD6WORD97WORD2007 WORD2007_DOCX WORD2007_DOTX WORD2007_DOCM WORD2007_DOTMEXCELEXCEL5EXCEL97 EXCEL2007EXCEL2007_XLSXEXCEL2007_XLSMEXCEL2007_XLTXEXCEL2007_XLTMEXCEL2007_XLSBEXCEL2007_XLAM POWERPOINT97POWERPOINT2007POWERPOINT2007_PPTXPOWERPOINT2007_PPSXPOWERPOINT2007_PPTMPOWERPOINT2007_PPSMrBrCrDrErFrGrH GENERIC_OLE GENERIC_XMLGENERIC_OPENXMLUNKNOWNrLONENOTErNr rr r'r's C D E FH#M#M#M#M E FGI%N%N%N%N%N%N!L%N//// C C D C E D FKKO!G CG Crr'c<eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zy ) CONTAINERz, Constants for file container types rCr)rIrKFlatOPC OpenDocumentMIMEBinaryzUnknown ContainerrMrNN)rrrrrCrOrIrKrorprqBINARYrkrlrNr rr rnrns@ C C CGG!L D F!GG Crrnc<eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zy )APPr(zMS WordzMS Excelz MS PowerPointz MS AccesszMS Visioz MS Projectz MS Officez MS OneNotezAny Zip ArchiverWindowszUnknown ApplicationN)rrrrMSWORDMSEXCEL MSPOWERPOINTMSACCESSMSVISIO MSPROJECTMSOFFICE MSONENOTE ZIP_ARCHIVERWINDOWSrkr rr rurus@FG"LHGIHI%LG#Grruz>{http://schemas.openxmlformats.org/package/2006/relationships} Relationships RelationshipTypeTargetzRhttp://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocumentzFhttp://purl.oclc.org/ooxml/officeDocument/relationships/officeDocumentz{http://schemas.openxmlformats.org/package/2006/content-types}DefaultOverridez5{http://schemas.microsoft.com/office/2006/xmlPackage}packagepartr contentTypez$application/vnd.ms-office.vbaProject binaryDataceZdZejZejZejZ dZ dZ gZ gZ dZdZdZdZedZy) FType_BasezUnknown file typeNFcy)z return True if the provided file matches the type of this class :param ftg: FileTypeGuesser object :return: bool Fr clsftgs r recognizezFType_Base.recognizesr)rrrrnrk containerru applicationr'filetyperlongname extensions content_typesPUIDmay_contain_vbamay_contain_xlmmay_contain_ole classmethodrr rr rr sY!!I++K}}H D"HJM DOOOrrc eZdZy) FType_UnknownN)rrrr rr rr"srrc|eZdZejZejZe jZ dZ dZ ddgZ dZdZedZy) FType_RTFrCzRich Text Formatrtfdoc)zapplication/rtfztext/rtfzfmt/355c@|jjdrdSdS)Ns{\rtTFdata startswithrs r rzFType_RTF.recognize/s xx**84t?%?rN)rrrrnrCrrurwrr'rrrrrrrrr rr rr%sN I**KyyH D!HJ3M D@@rrcleZdZejZejZe jZ dZ dZ edZy)FType_Generic_OLEzGeneric OLE/CFB filez1Generic OLE file / Compound File (unknown format)ct|jdkr|jdz}n |j}tj|rz tj|j|_|jj j |_t jj|jd|_ yy#YyxYw)NisFT) lenrolefile isOleFile OleFileIOrootr root_clsid KNOWN_CLSIDSgetroot_clsid_name)rrrs r rzFType_Generic_OLE.recognize=s sxx= 88|,D88D   T " %//9 !$!1!1!7!7&+&8&8&<&> %~~+rN)rrrrrSTREAMSrrr rr rrWs%FG  rrcreZdZejZejZe jZ dZ dZ dgZ edZy)FType_Generic_Zipz Zip ArchivezGeneric Zip Archivezipctj|jsy tj|j|_y#tj$rYywxYw)NFT)zipfile is_zipfile data_bytesioZipFile BadZipfilers r rzFType_Generic_Zip.recognizetsW!!#"2"23 !//#*:*:;CK  !!  s$AAAN)rrrrnrOrrurrr'rrrrrrr rr rrlsB I""KyyH D$HJ  rrcpeZdZejZejZe jZ dZ dZ gZedZy)FType_Generic_OpenXMLz OpenXML filezGeneric OpenXML filec tjd |jjd |jj d}tj|}|jtk7ryd}|jtD]o}|jt}tjd|d|jt|t t"t$fvsZ|jt}ntjd|z|tj'dy |jj d }tj|}i} i} |jt(D]/} | jd } | jd } | (| +| | | <1|jt*D]@}|jd }|j-d }|jd } |9| <| | |<Bd}|| vr| |}n.t.j0j3|ddd}|| vr| |}||_tjd|zy#t$rYywxYw#t $rYywxYw#t $rYywxYw)NzOpen XML - recognizez _rels/.relsF)tagzRelationship: type=z target=z Main part: %sz5Failed to find any known relationship in OpenXML-filez[Content_Types].xml Extension ContentTypePartName/rzMain part content-type: %sT)r#debugrgetinfoKeyErrorread RuntimeErrorET fromstringrTAG_RELSiterTAG_RELr ATTR_REL_TYPEATTR_REL_TARGETURL_REL_OFFICEDOCURL_REL_OFFICEDOC_STRICT URL_REL_XPSwarningTAG_CTYPES_DEFAULTTAG_CTYPES_OVERRIDElstripospathsplitextmain_part_content_type)rr root_rels elem_rels main_partelem_relrel_typer elem_ctypes ctypes_ext ctypes_partelem_ext extension content_type elem_partpartnamer main_part_exts r rzFType_Generic_OpenXML.recognizes ()  KK   .  ((7I MM), ==H $ !73 H||M2H II8X\\RaEbc d-/GUU$LL9   /I-.   KKO P KK,,-BCM mmM2   #((/A(B 5H [1I#<< 6L$)A(4 9%  5 %))0C)D 5I }}Z0Hs+H$==7L# (@(4 H% 5"&  #%0%; "GG,,Y7:12>M *)3M)B&%;" .1GGH]    T  s4I!I02I?! I-,I-0 I<;I<? J  J N)rrrrnrKrrur}rr'rjrrrrrrr rr rrsD!!I,,K$$H D%HJTTrrc0eZdZdZej ZdZdZy) FType_Wordz%Base class for all MS Word file typeszMS Word (generic)z&MS Word Document or Template (generic)N) rrrrrurwrrrr rr rrs/**K D7HrrcbeZdZejZejZdZ dZ dZ ddgZ dgZ dZdZdZy ) FType_Word97zMS Word 97 Documentz$MS Word 97-2003 Document or Template)$00020906-0000-0000-C000-000000000046rdotapplication/mswordzfmt/40TN)rrrrurwrr'rRrrrrrrrrrr rr rrsC**K||H D5H 6FJ)*M DOOrrc^eZdZejZejZdZ dZ dZ ddgZ dgZ dZdZy ) FType_Word6zMS Word 6 Documentz MS Word 6-7 Document or Template)$00020900-0000-0000-C000-000000000046rrrzfmt/39TN)rrrrurwrr'rQrrrrrrrrr rr rrs>**K{{H D1H 6FJ)*M DOrrc,eZdZejZdZdZy)FType_Word2007_BasezMS Word 2007+ FilezMS Word 2007+ File (.doc?)N)rrrrurwrrrr rr rrs**K D+HrrcJeZdZejZejZdZ dZ dgZ y)FType_Word2007zMS Word 2007+ DocumentzMS Word 2007+ Document (.docx)docxN) rrrrurwrr'rTrrrrr rr rr '**K""H #D/HJrrcJeZdZejZejZdZ dZ dgZ y)FType_Word2007_Macroz$MS Word 2007+ Macro-Enabled Documentz,MS Word 2007+ Macro-Enabled Document (.docm)docmN) rrrrurwrr'rVrrrrr rr rr'**K""H 1D=HJrrcJeZdZejZejZdZ dZ dgZ y)FType_Word2007_TemplatezMS Word 2007+ TemplatezMS Word 2007+ Template (.dotx)dotxN) rrrrurwrr'rUrrrrr rr rrrrrcJeZdZejZejZdZ dZ dgZ y)FType_Word2007_Template_Macroz$MS Word 2007+ Macro-Enabled Templatez,MS Word 2007+ Macro-Enabled Template (.dotm)dotmN) rrrrurwrr'rWrrrrr rr rrrrrc0eZdZdZej ZdZdZy) FType_Excelz&Base class for all MS Excel file typeszMS Excel (generic)z+MS Excel Workbook/Template/Add-in (generic)N) rrrrrurxrrrr rr r r 's0++K DHZMrrc6eZdZejZdZdZdgZdZ y)FType_Excel2007_XLSXzMS Excel 2007+ WorkbookzMS Excel 2007+ Workbook (.xlsx)xlsxzfmt/214N) rrrr'r\rrrrrr rr rrDs###H $D0HJ Drrc:eZdZejZdZdZdgZdZ dZ y)FType_Excel2007_XLSMz%MS Excel 2007+ Macro-Enabled Workbookz-MS Excel 2007+ Macro-Enabled Workbook (.xlsm)xlsm)z.application/vnd.ms-excel.sheet.macroEnabled.12zfmt/445N) rrrr'r]rrrrrrr rr rrKs(##H 2D>HJGM Drrc:eZdZejZdZdZdgZdZ dZ y)FType_Excel2007_XLSBzMS Excel 2007+ Binary Workbookz&MS Excel 2007+ Binary Workbook (.xlsb)xlsb)z5application/vnd.ms-excel.sheet.binary.macroEnabled.12zfmt/595N) rrrr'r`rrrrrrr rr rrSs(##H +D7HJNM Drrc2eZdZejZdZdZdgZy)FType_Excel2007_TemplatezMS Excel 2007+ TemplatezMS Excel 2007+ Template (.xltx)xltxN) rrrr'r^rrrrr rr r r [s##H $D0HJrr c2eZdZejZdZdZdgZy)FType_Excel2007_Template_Macroz%MS Excel 2007+ Macro-Enabled Templatez-MS Excel 2007+ Macro-Enabled Template (.xltm)xltmN) rrrr'r_rrrrr rr r#r#as##H 2D>HJrr#c2eZdZejZdZdZdgZy)FType_Excel2007_Addin_Macroz#MS Excel 2007+ Macro-Enabled Add-inz+MS Excel 2007+ Macro-Enabled Add-in (.xlam)xlamN) rrrr'rarrrrr rr r&r&gs##H 0Dapplication/vnd.ms-word.template.macroEnabledTemplate.main+xmlzJapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xmlz4application/vnd.ms-excel.sheet.macroEnabled.main+xmlz7application/vnd.ms-excel.sheet.binary.macroEnabled.mainzMapplication/vnd.openxmlformats-officedocument.spreadsheetml.template.main+xmlz7application/vnd.ms-excel.template.macroEnabled.main+xmlz4application/vnd.ms-excel.addin.macroEnabled.main+xmlzRapplication/vnd.openxmlformats-officedocument.presentationml.presentation.main+xmlzOapplication/vnd.openxmlformats-officedocument.presentationml.slideshow.main+xmlz@application/vnd.ms-powerpoint.presentation.macroEnabled.main+xmlz=application/vnd.ms-powerpoint.slideshow.macroEnabled.main+xmlz8application/vnd.ms-package.xps-fixeddocumentsequence+xmlcxeZdZejZejZe jZ dZ dZ dZdZdZedZy) FType_EXE_PEzWindows PE Executable or DLLz,Windows Portable Executable or DLL (EXE,DLL))exedllsysscr)z-application/vnd.microsoft.portable-executablezfmt/899c@|jjdrdSdS)NsMZTFrrs r rzFType_EXE_PE.recognizesxx**51tk(rIt@j5|r4t@|_tBj=|jd}|||_|jt6jDk(r tFj5|r tF|_|j j|_|j j|_|j j|_y#1swYxYw)NzAFileTypeGuesser requires either a file path or file data, or bothrb)$filepathrrrrrftyperrrrrrr root_xmltagxmlroot ValueErroropenrioBytesIOrrrrFrJrrnrI clsid_ftypesrrOropenxml_ftypesrkrN)r rXrfrYfts r __init__zFileTypeGuesser.__init__s    "   # &*#   `a a <h% %FFH  %JJtyy1 !24E}V_` Et$"  -- ++ ::11 >>Y]] * !!$//48B~  >>Y]] *$..t42 #''(C(CTJ>!#DJ >>Y.. .%%d+) -- ++ ::11M % %s JJcdj|jdn(tjj |j|j |j |jS)z2Give a short string representation of this object.z.[FileTypeGuesser for {0}: {1} from {2} in {3}]r)formatrXrrbasenamerrrr s r __str__zFileTypeGuesser.__str__\sL?FFmm+F!!$--0 MM4++T^^= =rcR|j|jjyy)zE This method must be called at the end of processing N)rcloserhs r rkzFileTypeGuesser.closecs# << # LL    $rctt|jtxs|jtj k(S)zQ Shortcut to check if the container is OLE :return: bool ) issubclassrYrrrnrIrhs r is_olezFileTypeGuesser.is_oleks( $**&78[DNNimm<[[rctt|jtxs|jtj k(S)zU Shortcut to check if the container is OpenXML :return: bool )rmrYrrrnrKrhs r is_openxmlzFileTypeGuesser.is_openxmlrs+ $**&;<cR[RcRc@ccrc6t|jtSzl Shortcut to check if a file is an Excel workbook, template or add-in :return: bool )rmrYrrhs r is_wordzFileTypeGuesser.is_wordys $**j11rc6t|jtSrr)rmrYr rhs r is_excelzFileTypeGuesser.is_excels $**k22rc6t|jtS)zb Shortcut to check if a file is Powerpoint file of any kind :return: bool )rmrYr)rhs r is_powerpointzFileTypeGuesser.is_powerpoints $**&677rNN) rrrrrdrirkrnrprsrurwr rr rUrUs2?2B=!\d238rrUct||Sr )rUrXrs r ftype_guessr{s 8T **rcRtd|zt||}td|jjztd|jjztd|jj ztd|j z|j%td|jd|jtd d j|jjztd |jjzty) NzFile : %srzzFile Type : %szDescription: %szApplication: %szContainer : %sz Root CLSID : z - zContent-type(s) : %s,zPUID : %s) printr{rYrrrrrrjoinrr)rfilenamerrs r process_filers h &' xd 3C ciinn ,- cii00 01 cii33 34 cmm +, ~~! 8K8KLM 388CII,C,C#D DE ciinn ,- Grcdtjddz}tdtd|dtdtdtd d }tj tj tjtjtjd }d }tj| }|jdddd|jdddddd|jdddddd|jddd d!|d"#|j\}}t|dk(r3tt|j!tj"t j$||j&tj(d$%t+t-j.||j0|j2|j4&D]'\}}} |r|j7d'rt9||| )y)(Nz%d.%d.%drzftguess z on Python z' - http://decalage.info/python/oletoolsz3THIS IS WORK IN PROGRESS - Check updates regularly!zGPlease report any issue at https://github.com/decalage2/oletools/issuesr)rinforerrorcriticalz1usage: %prog [options] [filename2 ...])usagez-r store_true recursivez)find files recursively in subdirectories.)actiondesthelpz-zz--zip zip_passwordstrzRif the file is a zip archive, open first file from it, using the provided password)rtypedefaultrz-fz --zipfname zip_fname*zoif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)z-lz --loglevelloglevelstorezBlogging level debug/info/warning/error/critical (default=%default))rrrrz%(levelname)-8s %(message)s)rstreamrf)rrrr)rQ version_infor~ __version__rDEBUGINFOWARNINGERRORCRITICALoptparse OptionParser add_option parse_argsrr print_helpexit basicConfigrstdoutr%r iter_filesrrrendswithr) python_versionDEFAULT_LOG_LEVEL LOG_LEVELSrparseroptionsargsrrrs r mainrs#"2"21Q"77N  )* @A TU 2J!MMLLOOMM$$  J @E  " " /F d%*%5%5dgFWFW))W5F5F&H0! 8T **3/ Y$/ 0r__main__rx)hr __future__rrrQr^rrrrr lxml.etreeetreer ImportErrorxml.etree.ElementTree ElementTreeelementtree.cElementTree cElementTreernormpathabspathdirname__file___thismodule_dirr _parent_dirinsertoletools.commonroletools.thirdparty.xglobrHandlerrrr r#r%objectr'rnruNS_RELSrrrrrrrNS_CONTENT_TYPESrr NS_XMLPACKAGE TAG_PACKAGE TAG_PKGPART ATTR_PKG_NAMEATTR_PKG_CONTENTTYPECTYPE_VBAPROJECTTAG_PKGBINDATArrrrrrrrrrrrrrrr r rrrrrr r#r&r)r+r1r4r7r:r=r@rCrFrJr`rarNrUr{rrrr rr rs R&   P&''""277??277??83L#MNggrww||OTBC chhHHOOA{#!+ '// #++A-6!+F+Z $&$. K _ $ N " hcL S% 1&3 H i' f$ & $}49-&, J @ @" B,* .]J]D88 '  & ,/, (.1$7=*= 'K!2''; 1'[k#8[OOO _ /SzS ')+<'c+-Bc(<%9!5+?%!{J{&[ [0-9,7,9,8,>,5  $Yg>RXoFcRf =J =v8fv8v+  40n zFk P P** P P 1 POP P P 2P PsMMN  M%$N %N+M21N2NNN NN  N