oleparse

package module

v0.0.0-...-383a012 Latest Latest Go to latest Published: Feb 17, 2023 License: MIT Imports: 14 Imported by: 1

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/Velocidex/oleparse

Links

Open Source Insights

README ¶

Parse VBA macros from office documents.

This work is the golang port of https://github.com/unixfreak0037/officeparser

The goal is to be able to extract VBA macros embedded within an office document.

The code tries to stay as close as possible to the python original, even though the original code is not idiomatic for Go.

Documentation ¶

Index ¶

Constants
Variables
func Debug(arg interface{})
func DebugPrintf(fmt_str string, args ...interface{})
func DecompressStream(compressed_container []byte) []byte
type Directory
- func NewDirectory(data []byte, index uint32) (*Directory, error)
type DirectoryHeader
type OLEFile
- func NewOLEFile(data []byte) (*OLEFile, error)
type OLEHeader
type VBAModule

Constants ¶

View Source

const (
	// Limit the size of the document
	MAX_SECTORS = 1024 * 1024

	MAX_SECTOR_SHIFT = 10
)

View Source

const (
	FREESECT      = 0xFFFFFFFF
	ENDOFCHAIN    = 0xFFFFFFFE
	OLE_SIGNATURE = "\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1"

	MODULE_EXTENSION = "bas"
	CLASS_EXTENSION  = "cls"
	FORM_EXTENSION   = "frm"
)

Variables ¶

View Source

var (
	MAC_CODEPAGES = map[uint16]string{}
	BINFILE_NAME  = regexp.MustCompile("(?i).bin$")
)

View Source

var (
	OLE_DEBUG *bool
)

Functions ¶

func Debug ¶

func Debug(arg interface{})

func DebugPrintf ¶

func DebugPrintf(fmt_str string, args ...interface{})

func DecompressStream ¶

func DecompressStream(compressed_container []byte) []byte

Types ¶

type Directory ¶

type Directory struct {
	Header DirectoryHeader
	Index  uint32
	Name   string
	// contains filtered or unexported fields
}

func NewDirectory ¶

func NewDirectory(data []byte, index uint32) (*Directory, error)

type DirectoryHeader ¶

type DirectoryHeader struct {
	AB          [32]uint16
	CB          uint16
	Mse         byte
	Flags       byte
	SidLeftSib  uint32
	SidRightSib uint32
	SidChild    uint32
	ClsId       [16]byte
	UserFlags   uint32
	CreateTime  uint64
	ModifyTime  uint64
	SectStart   uint32
	Size        uint32
	PropType    uint16
}

type OLEFile ¶

type OLEFile struct {
	Header         OLEHeader
	SectorSize     int
	MiniSectorSize int
	SectorCount    int
	FatSectors     []uint32
	Fat            []uint32
	MiniFat        []uint32
	Directory      []*Directory
	// contains filtered or unexported fields
}

func NewOLEFile ¶

func NewOLEFile(data []byte) (*OLEFile, error)

func (*OLEFile) FindStreamByName ¶

func (self *OLEFile) FindStreamByName(name string) *Directory

func (*OLEFile) GetStream ¶

func (self *OLEFile) GetStream(index uint32) []byte

func (*OLEFile) OpenStreamByName ¶

func (self *OLEFile) OpenStreamByName(name string) ([]byte, error)

func (*OLEFile) ReadChain ¶

func (self *OLEFile) ReadChain(start uint32) []byte

func (*OLEFile) ReadFat ¶

func (self *OLEFile) ReadFat(sector uint32) uint32

func (*OLEFile) ReadMiniChain ¶

func (self *OLEFile) ReadMiniChain(start uint32) []byte

func (*OLEFile) ReadMiniFat ¶

func (self *OLEFile) ReadMiniFat(sector uint32) uint32

func (*OLEFile) ReadMiniSector ¶

func (self *OLEFile) ReadMiniSector(sector uint32) []byte

func (*OLEFile) ReadSector ¶

func (self *OLEFile) ReadSector(sector uint32) []byte

type OLEHeader ¶

type OLEHeader struct {
	AbSig [8]byte
	Clid  [16]byte

	MinorVersion    uint16
	DllVersion      uint16
	ByteOrder       uint16
	SectorShift     uint16
	MiniSectorShift uint16
	Reserved        uint16

	Reserved1        uint32
	Reserved2        uint32
	CsectFat         uint32
	SectDirStart     uint32
	Signature        uint32
	MiniSectorCutoff uint32
	SectMiniFatStart uint32
	CsectMiniFat     uint32
	SectDifStart     uint32
	CsectDif         uint32

	SectFat [109]uint32
}

type VBAModule ¶

type VBAModule struct {
	Code       string
	ModuleName string
	StreamName string
	Type       string
}

func ExtractMacros ¶

func ExtractMacros(ofdoc *OLEFile) ([]*VBAModule, error)

func ParseBuffer ¶

func ParseBuffer(data []byte) ([]*VBAModule, error)

func ParseFile ¶

func ParseFile(filename string) ([]*VBAModule, error)

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
cmd

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL