MpjZ d Z dZddlZddlZddlZddlZddlZddlZej j ej j ej j e Z
ej j ej j e
d Zeej vr ej j! de ddlZej$ dz fdZ ed Zd Zd Zd
Zd ez Z G d d
e Zd Zd Z d Z d Z G d de Z G d de Z! G d de! Z" G d de! Z# G d de! Z$ G d d e! Z% G d d e Z& G d d!e! Z' G d" d#e! Z( G d$ d%e! Z) G d& d'e! Z* G d( d)e! Z+ G d* d+e! Z, G d, d-e, Z- G d. d/e, Z.d0 Z/d1 Z0 G d2 d3e Z1d7d4Z2e3d5k( r e4d6 yy)8a( Parse a ppt (MS PowerPoint 97-2003) file
Based on olefile, parse the ppt-specific info
Code much influenced by olevba._extract_vba but much more object-oriented
(possibly slightly excessively so)
Currently quite narrowly focused on extracting VBA from ppt files, no slides or
stuff, but built to be extended to parsing more/all of the file. For better
"understanding" of ppt files, see module ppt_record_parser, which will probably
replace this module some time soon.
References:
* https://msdn.microsoft.com/en-us/library/dd921564%28v=office.12%29.aspx
and links there-in
WARNING!
Before thinking about understanding or even extending this module, please keep
in mind that module ppt_record_parser has a better "understanding" of the ppt
file structure and will replace this module some time soon!
z0.54 Nz.. c 4 | t j j j v r(t j | }|j | |S t j | }|j
t j |j | |S )an
Create a suitable logger object for this module.
The goal is not to change settings of the root logger, to avoid getting
other modules' logs on the screen.
If a logger exists with same name, reuse it. (Else it would have duplicate
handlers and messages would be doubled.)
The level is set to CRITICAL+1 by default, to avoid any logging.
)loggingLoggermanager
loggerDict getLoggersetLevel
addHandler NullHandler)namelevelloggers a/mnt/ssd/data/Dropbox/adrian/scripts/msg_venv/lib/python3.12/site-packages/oletools/ppt_parser.py
get_loggerr J sy w~~%%000 ""4(
t
$F g))+,
OOE M pptc J t j t j y)z
Enable logging for this module (disabled by default).
This will set the module-specific logger level to NOTSET, which
means the main application controls the actual logging level.
N)logr
r NOTSET r r enable_loggingr k s LL r PowerPoint Documentz.https://bitbucket.org/decalage/oletools/issuesz Please report this issue on %sc " e Zd ZdZ fdZ xZS )PptUnexpectedDataz= raise by PptParser if some field's value is not as expected c r dj |||| | _ t t | | j y )NzCIn stream "{0}" for field "{1}" found value "{2}" but expected {3}!)formatmsgsuperr __init__)selfstream
field_name found_valueexpected_value __class__s r r zPptUnexpectedData.__init__ s3 Q
VFJ ^
D
/9r )__name__
__module__ __qualname____doc__r
__classcell__r& s @r r r s G: :r r c R t j d| j d d S )z read 1 byte from stream
K | ] }d j | yw{0:04X}Nr .0vals r z check_value.. s# (=,/ )2(8(8(= (= ] Current UserrC N)
isinstancelisttuplejoinr r )r
valueexpectedexp_strs r check_valuerS s (T5M* FKK (=3;(= = =?BCG# '2
2 !
U D U #Y%5%5h%?A A
r c 8 e Zd ZdZd Zed Zedd Zy) RecordHeaderz a record header, at start of many types found in ppt files
https://msdn.microsoft.com/en-us/library/dd926377%28v=office.12%29.aspx
https://msdn.microsoft.com/en-us/library/dd948895%28v=office.12%29.aspx
c < d | _ d | _ d | _ d | _ y N)rec_ver rec_instancerec_typerec_lenr! s r r zRecordHeader.__init__ s
r c D | }t j d|j d \ }t |d \ |_ |_ t j d|j d \ |_ t j d|j d \ |_ |S )z reads 8 byte from stream r7 r8 r; r< )r0 r1 r2 divmodrY rX rZ r[ )clzr" objversion_instances r extract_fromzRecordHeader.extract_from s} e "MM$ A ?(./?(F%#+
dFKKN;
}}T6;;q>:
r Nc | t d |d|z z }|t j d|| S t j d||| S )zv generate a record header string given values
length of result depends on rec_len being given or not
zRECORD_TYPE not set!r^ z K | ] }d j | ywrB rD rE s r rH z&PptType.check_value.. s% ,A03 -6,<,>22 ,A7?,A !A ACFG)$$hnt&; $$U+W6 9 9
~~..H% (S.4"7 ')9)9()CE H
H r c L d}|
| t d |||k rd}|||k\ rd}|r~| j j }|dj | }n&|dj | }ndj || }t | j
|dz |z dj | | gS g S ) aI simplify verification of values: check value is in given range
expect_lower or expected_upper can be given as None to check only one
boundary. If value equals one of the boundaries, that is also an error
(boundaries form an open interval)
:returns: list of PptUnexpectedData exceptions
Fz$need at least one non-None boundary!Tz < {0:04X}z > {0:04X}zwithin ({0:04X}, {1:04X})ry rC )re r& r' r r rp )r! r
rP expect_lower expect_upperis_errrz
expect_strs r check_rangezPptType.check_range s L$8 CD D # $ # $ ~~..H# ( / / =
% ( / / =
8 ? ? @L N
%d&6&638M&/&6&6u&=zK N
N Ir c ( g }|j | j d| j j | j |j | j d| j j
| j | j t d |j | j d| j j | j |6|j | j d| j j | |S )z to be called by check_validity to check the self.rec_head
uses self.RECORD_... constants, (not quite that constant for DummyType)
zrec_head.recVerzrec_head.recInstancezRECORD_TYPE not specified!zrec_head.recTypezrec_head.recLen) extendrS rq rX RECORD_VERSIONrY RECORD_INSTANCE RECORD_TYPErn rZ r[ )r! lengtherrss r check_rec_headzPptType.check_rec_head. s D$$%6
8M8M%)%8%8: ; D$$%;%)]]%?%?%)%9%9; < #%&BC C D$$%7%)]]%;%;%)%5%57 8 KK(():)- )>)>H
I r c n t j | j || j | j S )z6 call RecordHeader.generate with values for this type )rU rg r r r )r` r[ s r generate_patternzPptType.generate_patternD s2 $$S__g%(%8%8#:L:LN Nr rW )r' r( r) r* r r r rh rc MAIN_STREAM_NAMEr rt rv rS r r r r r r rj rj sd
KON= = $4 :
=( D, N Nr rj c b e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z fd Z
d Zed
Zd Z xZS )CurrentUserAtoma An atom record that specifies information about the last user to modify
the file and where the most recent user edit is located. This is the only
record in the Current User Stream (section 2.1.1).
https://msdn.microsoft.com/en-us/library/dd948895%28v=office.12%29.aspx
l Dg l _@#G i i r c t t | d d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _
d | _ d | _ d | _
y )NrK )rp )r r r rq size header_tokenoffset_to_current_edit
len_user_namedoc_file_version
major_version
minor_versionansi_user_nameunicode_user_name rel_versionr! r& s r r zCurrentUserAtom.__init__b sk
ot-.-I
&*# ! $ ! ! "!% r c 4 | j | j k( S rW )r HEADER_TOKEN_ENCRYPTr\ s r is_encryptedz CurrentUserAtom.is_encryptedp s D$=$===r c | }t j | |_ t j d|j d \ |_ t j d|j d \ |_ t j d|j d \ |_ t j d|j d \ |_ t j d|j d \ |_
t j d|j d \ |_ t j d|j d \ |_ |j d |j |j |_
t j d|j d \ |_ |j d|j z |_ |S )z' create instance with info from stream r; r< r7 r8 r. r )rU rc rq r0 r1 r2 r r r r r r r r r r r` r" ra s r rc z CurrentUserAtom.extract_froms sO e $008 MM$ A7 "MM$ A ?&,mmD&++a.&I#" #]]4Q @ &
dFKKN C #]]4Q @ #]]4Q @ A #[[):): ;!==v{{1~> & A0A0A,A B
r c 8 | j }|j | j d| j | j |j | j d| j
| j | j g |j | j d| j d d |j | j d| j | j |j | j d| j | j |j | j d| j | j |j | j d| j | j" | j$ g |S ) Nr headerToken lenUserName docFileVersion majorVersion minorVersion
relVersion)r r rS r SIZEr r HEADER_TOKEN_NOCRYPTr r r DOC_FILE_VERSIONr
MAJOR_VERSIONr
MINOR_VERSIONr REL_VERSION_CAN_USEREL_VERSION_NO_USEr! r s r rv z CurrentUserAtom.check_validity sb ""$ D$$VTYY BC D$$]D4E4E&*&?&?&*&?&?&AB C
D$$]D4F4F%(* + D$$%5t7L7L%)%:%:< = D$$^T5G5G%)%7%79 : D$$^T5G5G%)%7%79 : D$$\43C3C&*&>&>&*&=&=&?@ A r )r' r( r) r* r r r r r r r r r r r rh rc rv r+ r, s @r r r K sc &% %# K D MM > ,r r c F e Zd ZdZdZdZdZ fdZed Z ddZ
xZ S ) UserEditAtomz An atom record that specifies information about a user edit
https://msdn.microsoft.com/en-us/library/dd945746%28v=office.12%29.aspx
i r r c t t | d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _
d | _ d | _ d | _
y rW )r r r rq last_slide_id_refversionr r offset_last_editoffset_persist_directorydoc_persist_id_refpersist_id_seed last_view encrypt_session_persist_id_refr s r r zUserEditAtom.__init__ se
lD*,
!% ! ! $ (,%"& # .2+r c t j d | }t j | |_ t j d|j d \ |_ t j d|j d \ |_ t j d|j d \ |_
t j d|j d \ |_ t j d|j d \ |_ t j d|j d \ |_
t j d|j d \ |_ t j d|j d \ |_ t j d|j d \ |_ |j d |r.t j d|j d \ |_ |S d|_ |S ) z@ extract info from given stream (already positioned correctly!) z extract UserEditAtom from streamr; r< r7 r8 r. r N)r debugrU rc rq r0 r1 r2 r r r r r r r r r r )r` r" r ra s r rc zUserEditAtom.extract_from sz 45e $008 !' tV[[^!D }}T6;;q>: #]]4Q @ #]]4Q @ &
dFKKN C (.
dFKKN(K%$"(--fkk!n"E %}}T6;;q> B tV[[^<
A
dFKKN3
0C .
26C .
r c | j }|j | j d| j | j |j | j d| j
| j || j |k\ r6|j t dd| j dj | | j |k\ s| j | j k rA|j t dd| j dj | j | |j | j d| j d |S )
Nr r r zUserEditAtom.offsetLastEditz< {0}z#UserEditAtom.offsetPersistDirectoryz
in ({0}, {1})docPersistIdRefr )
r r rS r r r r r appendr r r r )r! offsetr s r rv zUserEditAtom.check_validity s; ""$ D$$^T5G5G%)%7%79 : D$$^T5G5G%)%7%79 : $$. -)+H))7>>&+A C D ,,611T5J5JJ -)9))#**4+@+@&I K L
D$$%6%)%<% e Zd ZdZdZ fdZed ZddZ xZ S )PersistDirectoryAtomz one part of a persist object directory with unique persist object id
contains PersistDirectoryEntry objects
https://msdn.microsoft.com/en-us/library/dd952680%28v=office.12%29.aspx
ir c F t t | d | _ d | _ y rW )r r r rg_persist_dir_entry
stream_offsetr s r r z PersistDirectoryAtom.__init__ s!
"D24$(! !r c t j d | }|j |_ |j | |j }||j
j z }t j dj || g |_ ||k rjt j | }|j j | |j }t j dj | ||k rj|S )z6 create and return object with data from given stream z-Extracting a PersistDirectoryAtom from streamz(start reading at pos {0}, read until {1}z
at pos {0}) r r r r rt rq r[ r r PersistDirectoryEntryrc r )r` r" ra curr_posstop_pos new_entrys r rc z!PersistDirectoryAtom.extract_from$ s ABe #KKM &! ;;=cll 2 22 <6(H- /#% !-::6BI $ $ + +I 6 {{}H IIl))(3 4 !
r c | j }| j D ]- }|j |j || j / |S rW )r r r rv r )r! user_edit_last_offsetr entrys r rv z#PersistDirectoryAtom.check_validity? sU ""$.. BE KK,,-B-1-?-?A
B B r rW
r' r( r) r* r r rh rc rv r+ r, s @r r r s- K"
4r r c 2 e Zd ZdZd Zed Z ddZy)r aa an entry contained in a PersistDirectoryAtom.rg_persist_dir_entry
A structure that specifies a compressed table of sequential persist object
identifiers and stream offsets to associated persist objects.
NOT a subclass of PptType because has no RecordHeader
https://msdn.microsoft.com/en-us/library/dd947347%28v=office.12%29.aspx
c . d | _ d | _ d | _ y rW )
persist_id c_persistrg_persist_offsetr\ s r r z PersistDirectoryEntry.__init__R s !% r c 4 t j d | }t j d|j d \ }t |d \ |_ |_ t j dj ||j |j t |j D cg c]* }t j d|j d d , c}|_
t j dj |j |S c c}w )Nz.Extracting a PersistDirectoryEntry from streamr; r< i z4temp is 0x{0:04X} --> id is {1}, reading {2} offsetsr zoffsets are: {0}) r r r0 r1 r2 r_ r r r ranger )r` r" ra temp_s r rc z"PersistDirectoryEntry.extract_fromW s BCe
dFKKN3(.tU(;%
s~ H6$
> @ +0
*>!@%& "( tV[[^!DQ!G !@ $++C,A,ABC
!@s ./DNc
g }| j dkD r:|j t t d| j dj d | j
dk( r+|j t t d| j
d |[t
| j |k rC|j t t dt
| j dj | |[t | j |kD rC|j t t dt | j d j | |S )
Ni z PersistDirectoryEntry.persist_idz< 0xFFFFE (dec: {0})r z PersistDirectoryEntry.c_persistz> 0z'PersistDirectoryEntry.rg_persist_offsetz > UserEdit.offsetLastEdit ({0})z%> PersistObjectDirectory offset ({0})) r r r r r r minr max)r! r persist_obj_dir_offsetr s r rv z$PersistDirectoryEntry.check_validityz s ??W $ KK) "D!7!>!>w!GI
J >>Q KK) "C'
( ! ,../2GG KK) "KD**+1-. 0
1
" -../2HH KK) "KD**+7./ 1
2
r )NN)r' r( r) r* r rh rc rv r r r r r G s. &
D 48.2r r c @ e Zd ZdZg dZ fdZed Zd Z xZ S ) DocInfoListSubContainerOrAtoma; one of various types found in a DocInfoListContainer
https://msdn.microsoft.com/en-us/library/dd921705%28v=office.12%29.aspx
actual type of this object is defined by the recVersion field in its Record
Head
Similar to DummyType, RECORD_TYPE varies from instance to instance for this
type
)i i i i i i c * t t | y rW )r r r r s r r z&DocInfoListSubContainerOrAtom.__init__ s
+T;=r c t j d | }|j | |j j t
j k( r"t
j ||j }|S t j dj |j j t j dj |j |j |j j t j t j dj |j |S )+ build instance with info read from stream z1Parsing DocInfoListSubContainerOrAtom from streamz7skipping over {0} Byte in DocInfoListSubContainerOrAtomr r )r r rt rq rZ VBAInfoContainerr rc r r[ r r r r r s r rc z*DocInfoListSubContainerOrAtom.extract_from s EFe &! << $4$@$@ @"// EC
IIO vcll 2 23
5 II(//
> ? KK ,,bkk : II&--fkkm< =
r c f | j d| j j | j y)z can be any of multiple types z
rh.recTypeN)rS rq rZ VALID_RECORD_TYPESr\ s r rv z,DocInfoListSubContainerOrAtom.check_validity s' t}}'='= 00 2r )
r' r( r) r* r r rh rc rv r+ r, s @r r r s. "> "2r r c @ e Zd ZdZdZdZ fdZed Zd Z xZ
S )DocInfoListContainerz information about the document and document display settings
https://msdn.microsoft.com/en-us/library/dd926767%28v=office.12%29.aspx
i c 8 t t | d | _ y rW )r r r rg_child_recr s r r z DocInfoListContainer.__init__ s
"D24 r c 8 t j d | }|j | |j }||j j
z }t j dj
|| g |_ ||k rnt j | }|j j | |j }t j dj
| ||k rnt j dj
|| y)r z(Parsing DocInfoListContainer from streamz-start reading at pos {0}, will read until {1}r z? A "++F36"88D V8L %&S 3 3 B B DEF H ))CV145 J , V 4 %&S 1 1 @ @ BCD F
&&=v.1 33?<3G %&S . . = = ?@A C $$=v,/11= f1E %&S__ ; ; =>? A 1 = =f Ep
r c d | j }|j | j j |j | j j |j | j
j |j | j j |j | j j |j | j j |j | j j |S )z- check all values in object for valid values )
r r r rv r r r r r r r s r rv z DocumentContainer.check_validity s ""$ D&&5578 D$$3356 D++::<= D))88:; D&&5578 D$$3356 D&&5578 r r r, s @r r r s0
K-, x xv
r r c J e Zd ZdZdZdZdZdZ fdZe d d Z
d Z xZ S )
r z A container record that specifies VBA information for the document.
https://msdn.microsoft.com/en-us/library/dd952168%28v=office.12%29.aspx
i r r r c 8 t t | d | _ y rW )r r r
vba_info_atomr s r r zVBAInfoContainer.__init__ s
.0 !r c t j d | }||j | n t j d ||_ t j | |_ |S )zL since can determine this type only after reading header, it is arg
zparsing VBAInfoContainerz skip parsing of RecordHeader)r r rt rq VBAInfoAtomrc r" )r` r" rq ra s r rc z VBAInfoContainer.extract_from sX ,-e f % II4 5#CL ' 4 4V <
r c | j | j }|j | j j |S )Nr )r
RECORD_LENGTHr r" rv r s r rv z VBAInfoContainer.check_validity s; ""$*<*<"= D&&5578 r rW )
r' r( r) r* r r r r' r rh rc rv r+ r, s @r r r s<
KNOM" r r c D e Zd ZdZdZdZdZ fdZed Z d Z
xZ S )r$ z An atom record that specifies a reference to the VBA project storage.
https://msdn.microsoft.com/en-us/library/dd948874%28v=office.12%29.aspx
r8 c T t t | d | _ d | _ d | _ y rW )r r$ r persist_id_ref f_has_macrosr r s r r zVBAInfoAtom.__init__ s'
k4)+ " r c t j d | }|j | t | |_ t | |_ t | |_ |S )Nzparsing VBAInfoAtom)r r rt r= r, r- r r s r rc zVBAInfoAtom.extract_from sR '(e &!
$F^
"&>
Vn
r c | j | j }|j | j d| j d d |j | j d| j d |S )Nr&
fHasMacrosr8 r )r r' r r r- rS r r s r rv zVBAInfoAtom.check_validity sd ""$*<*<"=
D$$\43D3DdANO D$$Y a@A r ) r' r( r) r* r r r' r rh rc rv r+ r, s @r r$ r$ s7
KNM ,r r$ c < e Zd ZdZdZdZdZd fd Zd Zd Z xZ
S ) ExternalObjectStorageaI storage for compressed/uncompressed OLE/VBA/ActiveX control data
Matches types ExOleObjStgCompressedAtom, ExOleObjStgUncompressedAtom,
VbaProjectStgCompressedAtom, VbaProjectStgUncompressedAtom,
ExControlStgUncompressedAtom, ExControlStgCompressedAtom
Difference between compressed and uncompressed: RecordHeader.rec_instance
is 0 or 1, first variable after RecordHeader is decompressed_size
Data is not read at first, only its offset in the stream and size is saved
e.g.
https://msdn.microsoft.com/en-us/library/dd952169%28v=office.12%29.aspx
i r r c t t | |d | _ n3|r| j | _ d| _ n| j | _ d| _ d | _ d | _ d | _ y )NTF)
r r2 r r RECORD_INSTANCE_COMPRESSED
is_compressed RECORD_INSTANCE_UNCOMPRESSEDuncompressed_size data_offset data_size)r! r5 r& s r r z ExternalObjectStorage.__init__ se
#T35 #'D
#'#B#BD !%D #'#D#DD !&D !% r c D t j dj | j | j | | j
j | _ | j r%t | | _ | xj dz c_ |j | _ y)zX not a classmethod because of is_compressed attrib
see also: DummyType
z:Parsing ExternalObjectStorage (compressed={0}) from streamr< N) r r r r5 rt rq r[ r9 r= r7 r r8 rs s r rc z"ExternalObjectStorage.extract_from ss
N6$,,- / 6" .. %+F^D " NNa N!;;=r c " | j S rW )r r\ s r rv z$ExternalObjectStorage.check_validity s ""$$r rW ) r' r( r) r* r r4 r6 r rc rv r+ r, s @r r2 r2 s*
K!" #$ ) %r r2 c N e Zd ZdZej
Z fdZe fd Z xZ
S )!ExternalObjectStorageUncompressedz< subclass of ExternalObjectStorage for uncompressed objects c , t t | d y )NF)r r= r r s r r z*ExternalObjectStorageUncompressed.__init__' s
/?Fr c < | }t t | | |S zL note the usage of super here: call instance method of super class!
)r r= rc r` r" ra r& s r rc z.ExternalObjectStorageUncompressed.extract_from* s! e
/B6J
r ) r' r( r) r* r2 r6 r r rh rc r+ r, s @r r= r= # s+ F+HHOG r r= c N e Zd ZdZej
Z fdZe fd Z xZ
S ) ExternalObjectStorageCompressedz: subclass of ExternalObjectStorage for compressed objects c , t t | d y )NT)r rC r r s r r z(ExternalObjectStorageCompressed.__init__7 s
-t=dCr c < | }t t | | |S r@ )r rC rc rA s r rc z,ExternalObjectStorageCompressed.extract_from: s! e
-s@H
r ) r' r( r) r* r2 r4 r r rh rc r+ r, s @r rC rC 3 s+ D+FFOD r rC c fd}|S )z a decorator that can open and close the default stream for func
to be applied only to functions in PptParser that read from default stream
(:py:data:`MAIN_STREAM_NAME`)
Decorated functions need to accept args (self, stream, ...)
c r d} | j Yt j dj t j
| j j t | _ d} | | j g|i ||rUt j dj t j
| j j d | _ S S # t $ r | j r | j Y nw xY w |rUt j dj t j
| j j d | _ y y # |rUt j dj t j
| j j d | _ w w xY wNFz opening stream {0!r} for {1}Tz closing stream {0!r} after {1}) _open_main_streamr r r r r' ole
openstreamclose Exception fast_fail_log_exception)r! argskwargsstream_opened_by_mefuncs r wrappedz(with_opened_main_stream..wrappedN sp # .%%- 8!6"2DMMBD)-)<)<=M)N&&*# d 4 4FtFvF # :!6"2DMMBD&&,,.)-& # &~~##% & & # :!6"2DMMBD&&,,.)-& #" :!6"2DMMBD&&,,.)-& #s% A;C &D>E DE AF6r rS rT s ` r with_opened_main_streamrV E s .6 Nr c fd}|S )zB same as with_opened_main_stream but with yield instead of return c ? K d} | j Yt j dj t j
| j j t | _ d} | | j g|i |D ] }| |rUt j dj t j
| j j d | _ y y # t $ r | j r | j Y w xY w# |rUt j dj t j
| j j d | _ w w xY wwrH ) rI r r r r r' rJ rK rM rN rO rL )r! rP rQ rR resultrS s r rT z2generator_with_opened_main_stream..wrappedo s; # .%%- 8!6"2DMMBD)-)<)<=M)N&&*# tT%;%;MdMfM
# :!6"2DMMBD&&,,.)-& # &~~##% & # :!6"2DMMBD&&,,.)-& #s= E-BC% D
AE-%&D D
DD AE**E-r rU s ` r !generator_with_opened_main_streamrZ l s .8 Nr c e Zd ZdZddZddZd Zd Zed Z ed Z
e d Z e d
Z
e d Zed Zed
Ze d Zy) PptParserzW Parser for PowerPoint 97-2003 specific data structures
requires an OleFileIO
c t |t j r t j d || _ n>t j dj
| t j | | _ || _ d| _ d| _ d| _
d| _ | j
j }t d |D r| j dd|d |D cg c] }|d j }}d |vr| j dd|d
t j |vr| j dd|t d| _ yc c}w ) z constructor
:param ole: OleFileIO or anything that OleFileIO constructor accepts
:param bool fast_fail: if True, all unexpected data will raise a
PptUnexpectedData; if False will only log error
zusing open OleFileIOzOpening file {0}Nc 3 8 K | ] }t | d k7 yw)r N)r )rF r" s r rH z%PptParser.__init__.. s ;Fs6{a ;s rootlistdirzlen = 1r z current userrK )rL olefile OleFileIOr r rJ r rN current_user_atomnewest_user_editdocument_persist_objpersist_object_directoryr` any_faillowerr rI )r! rJ rN root_streamsr" s r r zPptParser.__init__ s c7,, - II, -DH II(//4 5 ((-DH"!% $ $(!(,% xx'') ;l; ; JJvy, B8DEfq )E E - JJvy, G %%'<7 JJvy,8H I!%
Fs ENc |t j dd }n8t j \ }}}t j | }t | }t j | t t j | D ]? \ }}|j D ]' }t j dj || ) A y)a log an exception instead of raising it
call in one of 2 ways:
try:
if fail():
self._log_exception('this is the message')
except:
self._log_exception() # only possible in except clause
Nztrace {0}: {1})
traceback
extract_stacksysexc_info
extract_tbstrr error enumerate format_list
splitlinesr r ) r! r stackr exctracei_entryr lines r rO zPptParser._log_exception s ? ++-cr2E LLNMAsE ((/Ec(C # ' (=(=e(D E BNGU ((*
B *11'4@A
B Br c n | j rt | | j t | j y)zt depending on self.fast_fail raise PptUnexpectedData or just log err
args as for PptUnexpectedData
N)rN r rO r )r! rP s r rh zPptParser._fail s0
>>#T* * 14 8 < < =r c | j t j d t j d d} t j d | j j d }t j | | _ |&t j d |j yy# t $ r | j r | j Y Qw xY w# |&t j d |j w w xY w)z parse the CurrentUserAtom record from stream 'Current User'
Structure described in
https://msdn.microsoft.com/en-us/library/dd948895%28v=office.12%29.aspx
Nz>--::< (*% $ k
KK , %11&,GI$$,(1% II) * ++-D = #VCI .0
L > E Ec JK
L1g
II* vi @ @A
C KK ::BKK H 4 @ @ H II) *#226:D = #VCI .0
* F #VC[*
* 1g
* *>>
! **3u/F/F+GGI E!6%"2"2G"'"9"9 ;< &/u/F/F%G !ME6 11%2B2B52HI!
! //FY kr c | j t j d | j | j | j
j }| j | }t j dj || t j dj | |j |t j t j | | _ t j d | j j }|r-t j dj t | |D ]& }t j dj | ( |r| j r|d yy) z. Part 2: Identify the document persist object NzBre-reading and overwriting previously read document_persist_objectz)newest user edit ID is {0}, offset is {1}z seek to {0}r r z)check_validity(document_persist_obj): {0}r )re r r~ rf r rd r r r r r r r rc rv r rN )r! r"
newest_refr r r s r parse_document_persist_objectz'PptParser.parse_document_persist_objectY s= $ $ 0 KK B
C ( ( 0 / / 1
**==
..z: =6*f- / -&&v./ FBKK( %6$B$B6$J! %&((779 KK9@@TK L &C KKC
& & DNNq'M #4r c # h K d}t | }t j dj | ||kD r t d d} |j }|dz
}|j
| }|j | }|dk7 rIt j dj ||z ||z |j ||dz }|dk7 rIt | |k( r'|j ||z |z
t j n0t j dj t | || y w)
z. search for pattern in stream, return indices r) zpattern length is {0}z need buf > pattern to search!r r rl zfound pattern at index {0}z1reached end of buf (read {0}<{1}) after {2} readsN) r r r r re r r2 findr r r ) r! r" patternBUF_SIZE pattern_lenn_reads start_posbufidxs r search_patternzPptParser.search_pattern s 'l )00=> ! <= =
I qLG ++h'C((7#C) 6==imLM #o%hhwA. )
3x8# I 0; > L M!6#c(Hg>@% s
C D2 A&D2c # K t j d t j t j t
j t
j z }| j
| D ]7 }|j | t j dj | t j | }|j }|r.t j dj t | nit j d |j }t j dj |j |j" |j$ | |D ]& }t j dj | ( |s'| j& s5|d y # t $ r | j Y Xw xY ww)
aY search through stream for VBAInfoContainer, alternative to parse...
quick-and-dirty: do not parse everything, just look for right bytes
"quick" here means quick to program. Runtime now is linear is document
size (--> for big documents the other method might be faster)
.. seealso:: search_vba_storage
z looking for VBA info containers)r[ extracting at idx {0}r zcontainer is okz2persist id ref is {0}, has_macros {1}, version {2}z%check_validity(VBAInfoContainer): {0}r N)r r r r r' r$ r r r rc rM rO rv r~ r r" r, r- r rN )r! r" r r containerr atomr s r search_vba_infozPptParser.search_vba_info s 34"33(8(F(F 4 H ..(3(A(A / CC &&w/ C KK II-44S9 :
, 9 9& A
++-D = #VCI .0 +, .. N!6$"5"5t7H7H"&,, 01
* C #VC[*
* 1g
3
##%
s7 B)G,F.CG G'G.G G
G Gc # t K t j d t t fD ]o }|j dt
j |j }| j | D ]' }|j | t j dj | |j | }|j }|r.t j dj t | nRt j dj |j |j" j$ |j& | |D ]1 }t j dj |j( | 3 |s| j* s%|d r y# t $ r | j Y Kw xY ww)a search through stream for VBAProjectStg, alternative to parse...
quick-and-dirty: do not parse everything, just look for right bytes
"quick" here means quick to program. Runtime now is linear is document
size (--> for big documents the other method might be faster)
The storages found could also contain (instead of VBA data): ActiveX
data or general OLE data
yields results as it finds them
.. seealso:: :py:meth:`search_vba_info`
z looking for VBA storage objectsr r r z8storage is ok; compressed={0}, size={1}, size_decomp={2}zcheck_validity({0}): {1}N)r r r= rC r r r r r r rc rM rO rv r~ r r5 rq r[ r7 r' rN )r! r" obj_typer r storager r s r search_vba_storagez PptParser.search_vba_storage s " 34:8: ! "H
KK2;; ' //1G **73
" C 188=> & 3 3F ;G
--/KK A!'D !24 II 0 %vg&;&;&-&6&6&>&>&-&?&? AB
"M ACKK :!'(9(93!?AA DNN q'M3
"! " ! '') s7 B F8#F4C
F8 F8
F8F51F84F55F8c 6 t j d |j |j t j
t
||j \ }}}t j dj |t | | |r| j r||S )z2 return decompressed data from search_vba_storage z.decompressing storage for VBA OLE data stream z-decompressed {0} to {1} bytes; found err: {2}) r r r r8 r r iterative_decompressr9 r r rN )r! r" r decompn_readr s r decompress_vba_storagez PptParser.decompress_vba_storage s| BC G''5 ):): ; A6&#f+s3 5 4>>I
r c t j dj |j |j |j |j t j |j |j }|S )z0 return data pointed to by uncompressed storage zCreading uncompressed VBA OLE data stream: {0} bytes starting at {1}) r r r r9 r8 r r r r2 )r! r" r datas r read_vba_storage_dataz PptParser.read_vba_storage_data' sa .6'++W-@-@A C G''5{{7,,- r c # K d}d}| j D ]& }|dz
}|j j dkD s"|dz
}( d}d}| j D ]? }|dz
}|j r|dz
}| j | -| j
| A t j dj |||| yw)z@ search vba infos and storages, yield uncompressed storage data r r zCfound {0} infos ({1} with macros) and {2} storages ({3} compressed)N)
r r" r- r r5 r r r r r )r! r" n_infosn_macrosr
n_storages n_compressedr s r
iter_vba_datazPptParser.iter_vba_data2 s ((* D qLG!!..2A
..0 :G !OJ$$ ! 11'::0099
: $&(J E Gs 6B>BB>)FrW )r' r( r) r* r rO rh r rV r r rZ r r r r r r r r r r\ r\ s
%&NB,> 8 _0 _0B $ $V ' ' > ', ', \ '2" '2"h : 'G 'Gr r\ c
t j }d}d}d} ||k r=t ||z
| }||j | j | z
}||z
}||k r=|||fS # t j
$ r }|}Y d}~ d}~ww xY w)z( decompress data from stream chunk-wise r r N)zlib
decompressobjr
decompressr2 rs ) r" r
chunk_size decompressorr r
return_errn_newr s r r r M s %%'L
F
FJtmV Z0E l--fkk%.@A AF eOF tm 6: %% ::
s AA# #B6A==B__main__znothing here to run!)i )5r* __version__ro r r0 rm r r pathnormpathabspathdirname__file___thismodule_dirrO _parent_dirinsertra CRITICALr r r r URL_OLEVBA_ISSUESMSG_OLEVBA_ISSUESrM r r4 r9 r= rS objectrU rj r r r r r r r r r r$ r2 r= rC rV rZ r\ r r' printr r r r s Z
''""277??277??83L#MNgg rww||OT BC chh HHOOA{# #++A- < ! ) E 47HH : :2
2
2
A"(L6 (LVqNf qNhPg PfJ7 J^%7 %7P/7 /dLF L^,2G ,2^,7 ,^d dN w F.' .b1%G 1%h
(=
&;
$$N D|G |G~
&& z
! r