oleparse

README

Parse VBA macros from office documents.

This work is the golang port of https://github.com/unixfreak0037/officeparser

The goal is to be able to extract VBA macros embedded within an office document.

The code tries to stay as close as possible to the python original, even though the original code is not idiomatic for Go.

Documentation

Index

• Constants
• Variables
• func Debug(arg interface{})
• func DebugPrintf(fmt_str string, args ...interface{})
• func DecompressStream(compressed_container []byte) []byte
• type Directory
  • func NewDirectory(data []byte, index uint32) (*Directory, error)
• type DirectoryHeader
• type OLEFile
  • func NewOLEFile(data []byte) (*OLEFile, error)
  • func (self *OLEFile) FindStreamByName(name string) *Directory
  • func (self *OLEFile) GetStream(index uint32) []byte
  • func (self *OLEFile) OpenStreamByName(name string) ([]byte, error)
  • func (self *OLEFile) ReadChain(start uint32) []byte
  • func (self *OLEFile) ReadFat(sector uint32) uint32
  • func (self *OLEFile) ReadMiniChain(start uint32) []byte
  • func (self *OLEFile) ReadMiniFat(sector uint32) uint32
  • func (self *OLEFile) ReadMiniSector(sector uint32) []byte
  • func (self *OLEFile) ReadSector(sector uint32) []byte
• type OLEHeader
• type VBAModule
  • func ExtractMacros(ofdoc *OLEFile) ([]*VBAModule, error)
  • func ParseBuffer(data []byte) ([]*VBAModule, error)
  • func ParseFile(filename string) ([]*VBAModule, error)

Constants

const (
	// Limit the size of the document
	MAX_SECTORS = 1024 * 1024

	MAX_SECTOR_SHIFT = 10
)

const (
	FREESECT      = 0xFFFFFFFF
	ENDOFCHAIN    = 0xFFFFFFFE
	OLE_SIGNATURE = "\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1"

	MODULE_EXTENSION = "bas"
	CLASS_EXTENSION  = "cls"
	FORM_EXTENSION   = "frm"
)

Variables

var (
	MAC_CODEPAGES = map[uint16]string{}
	BINFILE_NAME  = regexp.MustCompile("(?i).bin$")
)

var (
	OLE_DEBUG *bool
)

Functions

func Debug

func Debug(arg interface{})

func DebugPrintf

func DebugPrintf(fmt_str string, args ...interface{})

func DecompressStream

func DecompressStream(compressed_container []byte) []byte

Types

type Directory

type Directory struct {
	Header DirectoryHeader
	Index  uint32
	Name   string
	// contains filtered or unexported fields
}

func NewDirectory

func NewDirectory(data []byte, index uint32) (*Directory, error)

type DirectoryHeader

type DirectoryHeader struct {
	AB          [32]uint16
	CB          uint16
	Mse         byte
	Flags       byte
	SidLeftSib  uint32
	SidRightSib uint32
	SidChild    uint32
	ClsId       [16]byte
	UserFlags   uint32
	CreateTime  uint64
	ModifyTime  uint64
	SectStart   uint32
	Size        uint32
	PropType    uint16
}

type OLEFile

type OLEFile struct {
	Header         OLEHeader
	SectorSize     int
	MiniSectorSize int
	SectorCount    int
	FatSectors     []uint32
	Fat            []uint32
	MiniFat        []uint32
	Directory      []*Directory
	// contains filtered or unexported fields
}

func NewOLEFile

func NewOLEFile(data []byte) (*OLEFile, error)

func (*OLEFile) FindStreamByName

func (self *OLEFile) FindStreamByName(name string) *Directory

func (*OLEFile) GetStream

func (self *OLEFile) GetStream(index uint32) []byte

func (*OLEFile) OpenStreamByName

func (self *OLEFile) OpenStreamByName(name string) ([]byte, error)

func (*OLEFile) ReadChain

func (self *OLEFile) ReadChain(start uint32) []byte

func (*OLEFile) ReadFat

func (self *OLEFile) ReadFat(sector uint32) uint32

func (*OLEFile) ReadMiniChain

func (self *OLEFile) ReadMiniChain(start uint32) []byte

func (*OLEFile) ReadMiniFat

func (self *OLEFile) ReadMiniFat(sector uint32) uint32

func (*OLEFile) ReadMiniSector

func (self *OLEFile) ReadMiniSector(sector uint32) []byte

func (*OLEFile) ReadSector

func (self *OLEFile) ReadSector(sector uint32) []byte

type OLEHeader

type OLEHeader struct {
	AbSig [8]byte
	Clid  [16]byte

	MinorVersion    uint16
	DllVersion      uint16
	ByteOrder       uint16
	SectorShift     uint16
	MiniSectorShift uint16
	Reserved        uint16

	Reserved1        uint32
	Reserved2        uint32
	CsectFat         uint32
	SectDirStart     uint32
	Signature        uint32
	MiniSectorCutoff uint32
	SectMiniFatStart uint32
	CsectMiniFat     uint32
	SectDifStart     uint32
	CsectDif         uint32

	SectFat [109]uint32
}

type VBAModule

type VBAModule struct {
	Code       string
	ModuleName string
	StreamName string
	Type       string
}

func ExtractMacros

func ExtractMacros(ofdoc *OLEFile) ([]*VBAModule, error)

func ParseBuffer

func ParseBuffer(data []byte) ([]*VBAModule, error)

func ParseFile

func ParseFile(filename string) ([]*VBAModule, error)