修改为东南天坐标系
This commit is contained in:
@@ -0,0 +1,17 @@
|
||||
CONTRIBUTORS for the olefile project
|
||||
====================================
|
||||
|
||||
This is a non-exhaustive list of all the people who helped me improve the
|
||||
olefile project (formerly OleFileIO_PL), in approximative chronological order.
|
||||
Please contact me if I forgot to mention your name.
|
||||
|
||||
A big thank you to all of them:
|
||||
|
||||
- Niko Ehrenfeuchter: added support for Jython
|
||||
- Niko Ehrenfeuchter, Martijn Berger and Dave Jones: helped fix 4K sector support
|
||||
- Martin Panter: conversion to Python 3.x/2.6+
|
||||
- mete0r_kr: added support for file-like objects
|
||||
- chuckleberryfinn: fixed bug in getproperties
|
||||
- Martijn, Ben G.: bug report for 64 bits platforms
|
||||
- Philippe Lagadec: main author and maintainer since 2005
|
||||
- and of course Fredrik Lundh: original author of OleFileIO from 1995 to 2005
|
||||
@@ -0,0 +1,56 @@
|
||||
LICENSE for the olefile package:
|
||||
|
||||
olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec
|
||||
(http://www.decalage.info)
|
||||
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without modification,
|
||||
are permitted provided that the following conditions are met:
|
||||
|
||||
* Redistributions of source code must retain the above copyright notice, this
|
||||
list of conditions and the following disclaimer.
|
||||
* Redistributions in binary form must reproduce the above copyright notice,
|
||||
this list of conditions and the following disclaimer in the documentation
|
||||
and/or other materials provided with the distribution.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
|
||||
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
||||
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
||||
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
|
||||
----------
|
||||
|
||||
olefile is based on source code from the OleFileIO module of the Python
|
||||
Imaging Library (PIL) published by Fredrik Lundh under the following license:
|
||||
|
||||
The Python Imaging Library (PIL) is
|
||||
- Copyright (c) 1997-2005 by Secret Labs AB
|
||||
- Copyright (c) 1995-2005 by Fredrik Lundh
|
||||
|
||||
By obtaining, using, and/or copying this software and/or its associated
|
||||
documentation, you agree that you have read, understood, and will comply with
|
||||
the following terms and conditions:
|
||||
|
||||
Permission to use, copy, modify, and distribute this software and its
|
||||
associated documentation for any purpose and without fee is hereby granted,
|
||||
provided that the above copyright notice appears in all copies, and that both
|
||||
that copyright notice and this permission notice appear in supporting
|
||||
documentation, and that the name of Secret Labs AB or the author not be used
|
||||
in advertising or publicity pertaining to distribution of the software without
|
||||
specific, written prior permission.
|
||||
|
||||
SECRET LABS AB AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS
|
||||
SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN
|
||||
NO EVENT SHALL SECRET LABS AB OR THE AUTHOR BE LIABLE FOR ANY SPECIAL,
|
||||
INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
PERFORMANCE OF THIS SOFTWARE.
|
||||
@@ -0,0 +1,91 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta http-equiv="Content-Style-Type" content="text/css" />
|
||||
<meta name="generator" content="pandoc" />
|
||||
<title></title>
|
||||
</head>
|
||||
<body>
|
||||
<h1 id="olefile-formerly-olefileio_pl">olefile (formerly OleFileIO_PL)</h1>
|
||||
<p><a href="http://www.decalage.info/olefile">olefile</a> is a Python package to parse, read and write <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, vbaProject.bin in MS Office 2007+ files, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
|
||||
<p><strong>Quick links:</strong> <a href="http://www.decalage.info/olefile">Home page</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/olefileio_pl">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
|
||||
<h2 id="news">News</h2>
|
||||
<p>Follow all updates and news on Twitter: <a href="https://twitter.com/decalage2"><code class="url">https://twitter.com/decalage2</code></a></p>
|
||||
<ul>
|
||||
<li><strong>2015-01-25 v0.42</strong>: improved handling of special characters in stream/storage names on Python 2.x (using UTF-8 instead of Latin-1), fixed bug in listdir with empty storages.</li>
|
||||
<li>2014-11-25 v0.41: OleFileIO.open and isOleFile now support OLE files stored in byte strings, fixed installer for python 3, added support for Jython (Niko Ehrenfeuchter)</li>
|
||||
<li>2014-10-01 v0.40: renamed OleFileIO_PL to olefile, added initial write support for streams >4K, updated doc and license, improved the setup script.</li>
|
||||
<li>2014-07-27 v0.31: fixed support for large files with 4K sectors, thanks to Niko Ehrenfeuchter, Martijn Berger and Dave Jones. Added test scripts from Pillow (by hugovk). Fixed setup for Python 3 (Martin Panter)</li>
|
||||
<li>2014-02-04 v0.30: now compatible with Python 3.x, thanks to Martin Panter who did most of the hard work.</li>
|
||||
<li>2013-07-24 v0.26: added methods to parse stream/storage timestamps, improved listdir to include storages, fixed parsing of direntry timestamps</li>
|
||||
<li>2013-05-27 v0.25: improved metadata extraction, properties parsing and exception handling, fixed <a href="https://bitbucket.org/decalage/olefileio_pl/issue/12/error-when-converting-timestamps-in-ole">issue #12</a></li>
|
||||
<li>2013-05-07 v0.24: new features to extract metadata (get_metadata method and OleMetadata class), improved getproperties to convert timestamps to Python datetime</li>
|
||||
<li>2012-10-09: published <a href="http://www.decalage.info/python/oletools">python-oletools</a>, a package of analysis tools based on OleFileIO_PL</li>
|
||||
<li>2012-09-11 v0.23: added support for file-like objects, fixed <a href="https://bitbucket.org/decalage/olefileio_pl/issue/8/bug-with-file-object">issue #8</a></li>
|
||||
<li>2012-02-17 v0.22: fixed issues #7 (bug in getproperties) and #2 (added close method)</li>
|
||||
<li>2011-10-20: code hosted on bitbucket to ease contributions and bug tracking</li>
|
||||
<li>2010-01-24 v0.21: fixed support for big-endian CPUs, such as PowerPC Macs.</li>
|
||||
<li>2009-12-11 v0.20: small bugfix in OleFileIO.open when filename is not plain str.</li>
|
||||
<li>2009-12-10 v0.19: fixed support for 64 bits platforms (thanks to Ben G. and Martijn for reporting the bug)</li>
|
||||
<li>see changelog in source code for more info.</li>
|
||||
</ul>
|
||||
<h2 id="downloadinstall">Download/Install</h2>
|
||||
<p>If you have pip or setuptools installed (pip is included in Python 2.7.9+), you may simply run <strong>pip install olefile</strong> or <strong>easy_install olefile</strong> for the first installation.</p>
|
||||
<p>To update olefile, run <strong>pip install -U olefile</strong>.</p>
|
||||
<p>Otherwise, see https://bitbucket.org/decalage/olefileio_pl/wiki/Install</p>
|
||||
<h2 id="features">Features</h2>
|
||||
<ul>
|
||||
<li>Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc</li>
|
||||
<li>List all the streams and storages contained in an OLE file</li>
|
||||
<li>Open streams as files</li>
|
||||
<li>Parse and read property streams, containing metadata of the file</li>
|
||||
<li>Portable, pure Python module, no dependency</li>
|
||||
</ul>
|
||||
<p>olefile can be used as an independent package or with PIL/Pillow.</p>
|
||||
<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my <a href="http://www.decalage.info/python/oletools">python-oletools</a>, which are built upon olefile and provide a higher-level interface.</p>
|
||||
<h2 id="history">History</h2>
|
||||
<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>
|
||||
<p>As far as I know, olefile is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>
|
||||
<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>
|
||||
<h2 id="main-improvements-over-the-original-version-of-olefileio-in-pil">Main improvements over the original version of OleFileIO in PIL:</h2>
|
||||
<ul>
|
||||
<li>Compatible with Python 3.x and 2.6+</li>
|
||||
<li>Many bug fixes</li>
|
||||
<li>Support for files larger than 6.8MB</li>
|
||||
<li>Support for 64 bits platforms and big-endian CPUs</li>
|
||||
<li>Robust: many checks to detect malformed files</li>
|
||||
<li>Runtime option to choose if malformed files should be parsed or raise exceptions</li>
|
||||
<li>Improved API</li>
|
||||
<li>Metadata extraction, stream/storage timestamps (e.g. for document forensics)</li>
|
||||
<li>Can open file-like objects</li>
|
||||
<li>Added setup.py and install.bat to ease installation</li>
|
||||
<li>More convenient slash-based syntax for stream paths</li>
|
||||
<li>Write features</li>
|
||||
</ul>
|
||||
<h2 id="documentation">Documentation</h2>
|
||||
<p>Please see the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online documentation</a> for more information, especially the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview">OLE overview</a> and the <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/API">API page</a> which describe how to use olefile in Python applications. A copy of the same documentation is also provided in the doc subfolder of the olefile package.</p>
|
||||
<h2 id="real-life-examples">Real-life examples</h2>
|
||||
<p>A real-life example: <a href="http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/">using OleFileIO_PL for malware analysis and forensics</a>.</p>
|
||||
<p>See also <a href="https://computer-forensics.sans.org/community/papers/gcfa/grow-forensic-tools-taxonomy-python-libraries-helpful-forensic-analysis_6879">this paper</a> about python tools for forensics, which features olefile.</p>
|
||||
<h2 id="license">License</h2>
|
||||
<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
|
||||
<p>All rights reserved.</p>
|
||||
<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
|
||||
<ul>
|
||||
<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
|
||||
<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
|
||||
</ul>
|
||||
<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
|
||||
<hr />
|
||||
<p>olefile is based on source code from the OleFileIO module of the Python Imaging Library (PIL) published by Fredrik Lundh under the following license:</p>
|
||||
<p>The Python Imaging Library (PIL) is</p>
|
||||
<ul>
|
||||
<li>Copyright (c) 1997-2005 by Secret Labs AB</li>
|
||||
<li>Copyright (c) 1995-2005 by Fredrik Lundh</li>
|
||||
</ul>
|
||||
<p>By obtaining, using, and/or copying this software and/or its associated documentation, you agree that you have read, understood, and will comply with the following terms and conditions:</p>
|
||||
<p>Permission to use, copy, modify, and distribute this software and its associated documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies, and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of Secret Labs AB or the author not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.</p>
|
||||
<p>SECRET LABS AB AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL SECRET LABS AB OR THE AUTHOR BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.</p>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,221 @@
|
||||
olefile (formerly OleFileIO\_PL)
|
||||
================================
|
||||
|
||||
`olefile <http://www.decalage.info/olefile>`_ is a Python package to
|
||||
parse, read and write `Microsoft OLE2
|
||||
files <http://en.wikipedia.org/wiki/Compound_File_Binary_Format>`_ (also
|
||||
called Structured Storage, Compound File Binary Format or Compound
|
||||
Document File Format), such as Microsoft Office 97-2003 documents,
|
||||
vbaProject.bin in MS Office 2007+ files, Image Composer and FlashPix
|
||||
files, Outlook messages, StickyNotes, several Microscopy file formats,
|
||||
McAfee antivirus quarantine files, etc.
|
||||
|
||||
**Quick links:** `Home page <http://www.decalage.info/olefile>`_ -
|
||||
`Download/Install <https://bitbucket.org/decalage/olefileio_pl/wiki/Install>`_
|
||||
- `Documentation <https://bitbucket.org/decalage/olefileio_pl/wiki>`_ -
|
||||
`Report
|
||||
Issues/Suggestions/Questions <https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open>`_
|
||||
- `Contact the author <http://decalage.info/contact>`_ -
|
||||
`Repository <https://bitbucket.org/decalage/olefileio_pl>`_ - `Updates
|
||||
on Twitter <https://twitter.com/decalage2>`_
|
||||
|
||||
News
|
||||
----
|
||||
|
||||
Follow all updates and news on Twitter: https://twitter.com/decalage2
|
||||
|
||||
- **2015-01-25 v0.42**: improved handling of special characters in
|
||||
stream/storage names on Python 2.x (using UTF-8 instead of Latin-1),
|
||||
fixed bug in listdir with empty storages.
|
||||
- 2014-11-25 v0.41: OleFileIO.open and isOleFile now support OLE files
|
||||
stored in byte strings, fixed installer for python 3, added support
|
||||
for Jython (Niko Ehrenfeuchter)
|
||||
- 2014-10-01 v0.40: renamed OleFileIO\_PL to olefile, added initial
|
||||
write support for streams >4K, updated doc and license, improved the
|
||||
setup script.
|
||||
- 2014-07-27 v0.31: fixed support for large files with 4K sectors,
|
||||
thanks to Niko Ehrenfeuchter, Martijn Berger and Dave Jones. Added
|
||||
test scripts from Pillow (by hugovk). Fixed setup for Python 3
|
||||
(Martin Panter)
|
||||
- 2014-02-04 v0.30: now compatible with Python 3.x, thanks to Martin
|
||||
Panter who did most of the hard work.
|
||||
- 2013-07-24 v0.26: added methods to parse stream/storage timestamps,
|
||||
improved listdir to include storages, fixed parsing of direntry
|
||||
timestamps
|
||||
- 2013-05-27 v0.25: improved metadata extraction, properties parsing
|
||||
and exception handling, fixed `issue
|
||||
#12 <https://bitbucket.org/decalage/olefileio_pl/issue/12/error-when-converting-timestamps-in-ole>`_
|
||||
- 2013-05-07 v0.24: new features to extract metadata (get\_metadata
|
||||
method and OleMetadata class), improved getproperties to convert
|
||||
timestamps to Python datetime
|
||||
- 2012-10-09: published
|
||||
`python-oletools <http://www.decalage.info/python/oletools>`_, a
|
||||
package of analysis tools based on OleFileIO\_PL
|
||||
- 2012-09-11 v0.23: added support for file-like objects, fixed `issue
|
||||
#8 <https://bitbucket.org/decalage/olefileio_pl/issue/8/bug-with-file-object>`_
|
||||
- 2012-02-17 v0.22: fixed issues #7 (bug in getproperties) and #2
|
||||
(added close method)
|
||||
- 2011-10-20: code hosted on bitbucket to ease contributions and bug
|
||||
tracking
|
||||
- 2010-01-24 v0.21: fixed support for big-endian CPUs, such as PowerPC
|
||||
Macs.
|
||||
- 2009-12-11 v0.20: small bugfix in OleFileIO.open when filename is not
|
||||
plain str.
|
||||
- 2009-12-10 v0.19: fixed support for 64 bits platforms (thanks to Ben
|
||||
G. and Martijn for reporting the bug)
|
||||
- see changelog in source code for more info.
|
||||
|
||||
Download/Install
|
||||
----------------
|
||||
|
||||
If you have pip or setuptools installed (pip is included in Python
|
||||
2.7.9+), you may simply run **pip install olefile** or **easy\_install
|
||||
olefile** for the first installation.
|
||||
|
||||
To update olefile, run **pip install -U olefile**.
|
||||
|
||||
Otherwise, see https://bitbucket.org/decalage/olefileio\_pl/wiki/Install
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
- Parse, read and write any OLE file such as Microsoft Office 97-2003
|
||||
legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt,
|
||||
Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook
|
||||
messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView
|
||||
OIB files, etc
|
||||
- List all the streams and storages contained in an OLE file
|
||||
- Open streams as files
|
||||
- Parse and read property streams, containing metadata of the file
|
||||
- Portable, pure Python module, no dependency
|
||||
|
||||
olefile can be used as an independent package or with PIL/Pillow.
|
||||
|
||||
olefile is mostly meant for developers. If you are looking for tools to
|
||||
analyze OLE files or to extract data (especially for security purposes
|
||||
such as malware analysis and forensics), then please also check my
|
||||
`python-oletools <http://www.decalage.info/python/oletools>`_, which are
|
||||
built upon olefile and provide a higher-level interface.
|
||||
|
||||
History
|
||||
-------
|
||||
|
||||
olefile is based on the OleFileIO module from
|
||||
`PIL <http://www.pythonware.com/products/pil/index.htm>`_, the excellent
|
||||
Python Imaging Library, created and maintained by Fredrik Lundh. The
|
||||
olefile API is still compatible with PIL, but since 2005 I have improved
|
||||
the internal implementation significantly, with new features, bugfixes
|
||||
and a more robust design. From 2005 to 2014 the project was called
|
||||
OleFileIO\_PL, and in 2014 I changed its name to olefile to celebrate
|
||||
its 9 years and its new write features.
|
||||
|
||||
As far as I know, olefile is the most complete and robust Python
|
||||
implementation to read MS OLE2 files, portable on several operating
|
||||
systems. (please tell me if you know other similar Python modules)
|
||||
|
||||
Since 2014 olefile/OleFileIO\_PL has been integrated into
|
||||
`Pillow <http://python-imaging.github.io/>`_, the friendly fork of PIL.
|
||||
olefile will continue to be improved as a separate project, and new
|
||||
versions will be merged into Pillow regularly.
|
||||
|
||||
Main improvements over the original version of OleFileIO in PIL:
|
||||
----------------------------------------------------------------
|
||||
|
||||
- Compatible with Python 3.x and 2.6+
|
||||
- Many bug fixes
|
||||
- Support for files larger than 6.8MB
|
||||
- Support for 64 bits platforms and big-endian CPUs
|
||||
- Robust: many checks to detect malformed files
|
||||
- Runtime option to choose if malformed files should be parsed or raise
|
||||
exceptions
|
||||
- Improved API
|
||||
- Metadata extraction, stream/storage timestamps (e.g. for document
|
||||
forensics)
|
||||
- Can open file-like objects
|
||||
- Added setup.py and install.bat to ease installation
|
||||
- More convenient slash-based syntax for stream paths
|
||||
- Write features
|
||||
|
||||
Documentation
|
||||
-------------
|
||||
|
||||
Please see the `online
|
||||
documentation <https://bitbucket.org/decalage/olefileio_pl/wiki>`_ for
|
||||
more information, especially the `OLE
|
||||
overview <https://bitbucket.org/decalage/olefileio_pl/wiki/OLE_Overview>`_
|
||||
and the `API
|
||||
page <https://bitbucket.org/decalage/olefileio_pl/wiki/API>`_ which
|
||||
describe how to use olefile in Python applications. A copy of the same
|
||||
documentation is also provided in the doc subfolder of the olefile
|
||||
package.
|
||||
|
||||
Real-life examples
|
||||
------------------
|
||||
|
||||
A real-life example: `using OleFileIO\_PL for malware analysis and
|
||||
forensics <http://blog.gregback.net/2011/03/using-remnux-for-forensic-puzzle-6/>`_.
|
||||
|
||||
See also `this
|
||||
paper <https://computer-forensics.sans.org/community/papers/gcfa/grow-forensic-tools-taxonomy-python-libraries-helpful-forensic-analysis_6879>`_
|
||||
about python tools for forensics, which features olefile.
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
olefile (formerly OleFileIO\_PL) is copyright (c) 2005-2015 Philippe
|
||||
Lagadec (`http://www.decalage.info <http://www.decalage.info>`_)
|
||||
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions are
|
||||
met:
|
||||
|
||||
- Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
- Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
|
||||
IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
||||
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
|
||||
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
|
||||
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
||||
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
||||
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
||||
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
--------------
|
||||
|
||||
olefile is based on source code from the OleFileIO module of the Python
|
||||
Imaging Library (PIL) published by Fredrik Lundh under the following
|
||||
license:
|
||||
|
||||
The Python Imaging Library (PIL) is
|
||||
|
||||
- Copyright (c) 1997-2005 by Secret Labs AB
|
||||
- Copyright (c) 1995-2005 by Fredrik Lundh
|
||||
|
||||
By obtaining, using, and/or copying this software and/or its associated
|
||||
documentation, you agree that you have read, understood, and will comply
|
||||
with the following terms and conditions:
|
||||
|
||||
Permission to use, copy, modify, and distribute this software and its
|
||||
associated documentation for any purpose and without fee is hereby
|
||||
granted, provided that the above copyright notice appears in all copies,
|
||||
and that both that copyright notice and this permission notice appear in
|
||||
supporting documentation, and that the name of Secret Labs AB or the
|
||||
author not be used in advertising or publicity pertaining to
|
||||
distribution of the software without specific, written prior permission.
|
||||
|
||||
SECRET LABS AB AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO
|
||||
THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
||||
FITNESS. IN NO EVENT SHALL SECRET LABS AB OR THE AUTHOR BE LIABLE FOR
|
||||
ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER
|
||||
RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
|
||||
CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
|
||||
CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
@@ -0,0 +1,28 @@
|
||||
"""
|
||||
olefile (formerly OleFileIO_PL)
|
||||
|
||||
Module to read/write Microsoft OLE2 files (also called Structured Storage or
|
||||
Microsoft Compound Document File Format), such as Microsoft Office 97-2003
|
||||
documents, Image Composer and FlashPix files, Outlook messages, ...
|
||||
This version is compatible with Python 2.7 and 3.5+
|
||||
|
||||
Project website: https://www.decalage.info/olefile
|
||||
|
||||
olefile is copyright (c) 2005-2023 Philippe Lagadec (https://www.decalage.info)
|
||||
|
||||
olefile is based on the OleFileIO module from the PIL library v1.1.7
|
||||
See: http://www.pythonware.com/products/pil/index.htm
|
||||
and http://svn.effbot.org/public/tags/pil-1.1.7/PIL/OleFileIO.py
|
||||
|
||||
The Python Imaging Library (PIL) is
|
||||
Copyright (c) 1997-2009 by Secret Labs AB
|
||||
Copyright (c) 1995-2009 by Fredrik Lundh
|
||||
|
||||
See source code and LICENSE.txt for information on usage and redistribution.
|
||||
"""
|
||||
|
||||
from .olefile import *
|
||||
# import metadata not covered by *:
|
||||
from .olefile import __version__, __author__, __date__, __all__
|
||||
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,164 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta http-equiv="Content-Style-Type" content="text/css" />
|
||||
<meta name="generator" content="pandoc" />
|
||||
<title></title>
|
||||
</head>
|
||||
<body>
|
||||
<h1 id="how-to-use-olefile---api">How to use olefile - API</h1>
|
||||
<p>This page is part of the documentation for <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">olefile</a>. It explains how to use all its features to parse and write OLE files. For more information about OLE files, see <a href="OLE_Overview.html">OLE_Overview</a>.</p>
|
||||
<p>olefile can be used as an independent module or with PIL/Pillow. The main functions and methods are explained below.</p>
|
||||
<p>For more information, see also the file <strong>olefile.html</strong>, sample code at the end of the module itself, and docstrings within the code.</p>
|
||||
<h2 id="import-olefile">Import olefile</h2>
|
||||
<p>When the olefile package has been installed, it can be imported in Python applications with this statement:</p>
|
||||
<pre><code>import olefile</code></pre>
|
||||
<p>Before v0.40, olefile was named OleFileIO_PL. To maintain backward compatibility with older applications and samples, a simple script is also installed so that the following statement imports olefile as OleFileIO_PL:</p>
|
||||
<pre><code>import OleFileIO_PL</code></pre>
|
||||
<p>As of version 0.30, the code has been changed to be compatible with Python 3.x. As a consequence, compatibility with Python 2.5 or older is not provided anymore. However, a copy of OleFileIO_PL v0.26 (with some backported enhancements) is available as olefile2.py. When importing the olefile package, it falls back automatically to olefile2 if running on Python 2.5 or older. This is implemented in olefile/<strong>init</strong>.py. (new in v0.40)</p>
|
||||
<p>If you think olefile should stay compatible with Python 2.5 or older, please <a href="http://decalage.info/contact">contact me</a>.</p>
|
||||
<h2 id="test-if-a-file-is-an-ole-container">Test if a file is an OLE container</h2>
|
||||
<p>Use <strong>isOleFile</strong> to check if the first bytes of the file contain the Magic for OLE files, before opening it. isOleFile returns True if it is an OLE file, False otherwise (new in v0.16).</p>
|
||||
<pre><code>assert olefile.isOleFile('myfile.doc')</code></pre>
|
||||
<p>The argument of isOleFile can be (new in v0.41):</p>
|
||||
<ul>
|
||||
<li>the path of the file to open on disk (bytes or unicode string smaller than 1536 bytes),</li>
|
||||
<li>or a bytes string containing the file in memory. (bytes string longer than 1535 bytes),</li>
|
||||
<li>or a file-like object (with read and seek methods).</li>
|
||||
</ul>
|
||||
<h2 id="open-an-ole-file-from-disk">Open an OLE file from disk</h2>
|
||||
<p>Create an <strong>OleFileIO</strong> object with the file path as parameter:</p>
|
||||
<pre><code>ole = olefile.OleFileIO('myfile.doc')</code></pre>
|
||||
<h2 id="open-an-ole-file-from-a-bytes-string">Open an OLE file from a bytes string</h2>
|
||||
<p>This is useful if the file is already stored in memory as a bytes string.</p>
|
||||
<pre><code>ole = olefile.OleFileIO(s)</code></pre>
|
||||
<p>Note: olefile checks the size of the string provided as argument to determine if it is a file path or the content of an OLE file. An OLE file cannot be smaller than 1536 bytes. If the string is larger than 1535 bytes, then it is expected to contain an OLE file, otherwise it is expected to be a file path.</p>
|
||||
<p>(new in v0.41)</p>
|
||||
<h2 id="open-an-ole-file-from-a-file-like-object">Open an OLE file from a file-like object</h2>
|
||||
<p>This is useful if the file is not on disk but only available as a file-like object (with read, seek and tell methods).</p>
|
||||
<pre><code>ole = olefile.OleFileIO(f)</code></pre>
|
||||
<p>If the file-like object does not have seek or tell methods, the easiest solution is to read the file entirely in a bytes string before parsing:</p>
|
||||
<pre><code>data = f.read()
|
||||
ole = olefile.OleFileIO(data)</code></pre>
|
||||
<h2 id="how-to-handle-malformed-ole-files">How to handle malformed OLE files</h2>
|
||||
<p>By default, the parser is configured to be as robust and permissive as possible, allowing to parse most malformed OLE files. Only fatal errors will raise an exception. It is possible to tell the parser to be more strict in order to raise exceptions for files that do not fully conform to the OLE specifications, using the raise_defect option (new in v0.14):</p>
|
||||
<pre><code>ole = olefile.OleFileIO('myfile.doc', raise_defects=olefile.DEFECT_INCORRECT)</code></pre>
|
||||
<p>When the parsing is done, the list of non-fatal issues detected is available as a list in the parsing_issues attribute of the OleFileIO object (new in 0.25):</p>
|
||||
<pre><code>print('Non-fatal issues raised during parsing:')
|
||||
if ole.parsing_issues:
|
||||
for exctype, msg in ole.parsing_issues:
|
||||
print('- %s: %s' % (exctype.__name__, msg))
|
||||
else:
|
||||
print('None')</code></pre>
|
||||
<h2 id="open-an-ole-file-in-write-mode">Open an OLE file in write mode</h2>
|
||||
<p>Before using the write features, the OLE file must be opened in read/write mode:</p>
|
||||
<pre><code>ole = olefile.OleFileIO('test.doc', write_mode=True)</code></pre>
|
||||
<p>(new in v0.40)</p>
|
||||
<p>The code for write features is new and it has not been thoroughly tested yet. See <a href="https://bitbucket.org/decalage/olefileio_pl/issue/6/improve-olefileio_pl-to-write-ole-files">issue #6</a> for the roadmap and the implementation status. If you encounter any issue, please send me your <a href="http://www.decalage.info/en/contact">feedback</a> or <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open">report issues</a>.</p>
|
||||
<h2 id="syntax-for-stream-and-storage-paths">Syntax for stream and storage paths</h2>
|
||||
<p>Two different syntaxes are allowed for methods that need or return the path of streams and storages:</p>
|
||||
<ol style="list-style-type: decimal">
|
||||
<li><p>Either a <strong>list of strings</strong> including all the storages from the root up to the stream/storage name. For example a stream called "WordDocument" at the root will have ['WordDocument'] as full path. A stream called "ThisDocument" located in the storage "Macros/VBA" will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL. While hard to read and not very convenient, this syntax works in all cases.</p></li>
|
||||
<li><p>Or a <strong>single string with slashes</strong> to separate storage and stream names (similar to the Unix path syntax). The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a stream or storage name contains a slash (which is normally not allowed, according to the Microsoft specifications [MS-CFB]). (new in v0.15)</p></li>
|
||||
</ol>
|
||||
<p>Both are case-insensitive.</p>
|
||||
<p>Switching between the two is easy:</p>
|
||||
<pre><code>slash_path = '/'.join(list_path)
|
||||
list_path = slash_path.split('/')</code></pre>
|
||||
<p><strong>Encoding</strong>:</p>
|
||||
<ul>
|
||||
<li>Stream and Storage names are stored in Unicode format in OLE files, which means they may contain special characters (e.g. Greek, Cyrillic, Japanese, etc) that applications must support to avoid exceptions.</li>
|
||||
<li><strong>On Python 2.x</strong>, all stream and storage paths are handled by olefile in bytes strings, using the <strong>UTF-8 encoding</strong> by default. If you need to use Unicode instead, add the option <strong>path_encoding=None</strong> when creating the OleFileIO object. This is new in v0.42. Olefile was using the Latin-1 encoding until v0.41, therefore special characters were not supported.<br /></li>
|
||||
<li><strong>On Python 3.x</strong>, all stream and storage paths are handled by olefile in unicode strings, without encoding.</li>
|
||||
</ul>
|
||||
<h2 id="get-the-list-of-streams">Get the list of streams</h2>
|
||||
<p>listdir() returns a list of all the streams contained in the OLE file, including those stored in storages. Each stream is listed itself as a list, as described above.</p>
|
||||
<pre><code>print(ole.listdir())</code></pre>
|
||||
<p>Sample result:</p>
|
||||
<pre><code>[['\x01CompObj'], ['\x05DocumentSummaryInformation'], ['\x05SummaryInformation']
|
||||
, ['1Table'], ['Macros', 'PROJECT'], ['Macros', 'PROJECTwm'], ['Macros', 'VBA',
|
||||
'Module1'], ['Macros', 'VBA', 'ThisDocument'], ['Macros', 'VBA', '_VBA_PROJECT']
|
||||
, ['Macros', 'VBA', 'dir'], ['ObjectPool'], ['WordDocument']]</code></pre>
|
||||
<p>As an option it is possible to choose if storages should also be listed, with or without streams (new in v0.26):</p>
|
||||
<pre><code>ole.listdir (streams=False, storages=True)</code></pre>
|
||||
<h2 id="test-if-known-streamsstorages-exist">Test if known streams/storages exist:</h2>
|
||||
<p>exists(path) checks if a given stream or storage exists in the OLE file (new in v0.16). The provided path is case-insensitive.</p>
|
||||
<pre><code>if ole.exists('worddocument'):
|
||||
print("This is a Word document.")
|
||||
if ole.exists('macros/vba'):
|
||||
print("This document seems to contain VBA macros.")</code></pre>
|
||||
<h2 id="read-data-from-a-stream">Read data from a stream</h2>
|
||||
<p>openstream(path) opens a stream as a file-like object. The provided path is case-insensitive.</p>
|
||||
<p>The following example extracts the "Pictures" stream from a PPT file:</p>
|
||||
<pre><code>pics = ole.openstream('Pictures')
|
||||
data = pics.read()</code></pre>
|
||||
<h2 id="get-information-about-a-streamstorage">Get information about a stream/storage</h2>
|
||||
<p>Several methods can provide the size, type and timestamps of a given stream/storage:</p>
|
||||
<p>get_size(path) returns the size of a stream in bytes (new in v0.16):</p>
|
||||
<pre><code>s = ole.get_size('WordDocument')</code></pre>
|
||||
<p>get_type(path) returns the type of a stream/storage, as one of the following constants: STGTY_STREAM for a stream, STGTY_STORAGE for a storage, STGTY_ROOT for the root entry, and False for a non existing path (new in v0.15).</p>
|
||||
<pre><code>t = ole.get_type('WordDocument')</code></pre>
|
||||
<p>get_ctime(path) and get_mtime(path) return the creation and modification timestamps of a stream/storage, as a Python datetime object with UTC timezone. Please note that these timestamps are only present if the application that created the OLE file explicitly stored them, which is rarely the case. When not present, these methods return None (new in v0.26).</p>
|
||||
<pre><code>c = ole.get_ctime('WordDocument')
|
||||
m = ole.get_mtime('WordDocument')</code></pre>
|
||||
<p>The root storage is a special case: You can get its creation and modification timestamps using the OleFileIO.root attribute (new in v0.26):</p>
|
||||
<pre><code>c = ole.root.getctime()
|
||||
m = ole.root.getmtime()</code></pre>
|
||||
<p>Note: all these methods are case-insensitive.</p>
|
||||
<h2 id="overwriting-a-sector">Overwriting a sector</h2>
|
||||
<p>The write_sect method can overwrite any sector of the file. If the provided data is smaller than the sector size (normally 512 bytes, sometimes 4KB), data is padded with null characters. (new in v0.40)</p>
|
||||
<p>Here is an example:</p>
|
||||
<pre><code>ole.write_sect(0x17, b'TEST')</code></pre>
|
||||
<p>Note: following the <a href="http://msdn.microsoft.com/en-us/library/dd942138.aspx">MS-CFB specifications</a>, sector 0 is actually the second sector of the file. You may use -1 as index to write the first sector.</p>
|
||||
<h2 id="overwriting-a-stream">Overwriting a stream</h2>
|
||||
<p>The write_stream method can overwrite an existing stream in the file. The new stream data must be the exact same size as the existing one. For now, write_stream can only write streams of 4KB or larger (stored in the main FAT).</p>
|
||||
<p>For example, you may change text in a MS Word document:</p>
|
||||
<pre><code>ole = olefile.OleFileIO('test.doc', write_mode=True)
|
||||
data = ole.openstream('WordDocument').read()
|
||||
data = data.replace(b'foo', b'bar')
|
||||
ole.write_stream('WordDocument', data)
|
||||
ole.close()</code></pre>
|
||||
<p>(new in v0.40)</p>
|
||||
<h2 id="extract-metadata">Extract metadata</h2>
|
||||
<p>get_metadata() will check if standard property streams exist, parse all the properties they contain, and return an OleMetadata object with the found properties as attributes (new in v0.24).</p>
|
||||
<pre><code>meta = ole.get_metadata()
|
||||
print('Author:', meta.author)
|
||||
print('Title:', meta.title)
|
||||
print('Creation date:', meta.create_time)
|
||||
# print all metadata:
|
||||
meta.dump()</code></pre>
|
||||
<p>Available attributes include:</p>
|
||||
<pre><code>codepage, title, subject, author, keywords, comments, template,
|
||||
last_saved_by, revision_number, total_edit_time, last_printed, create_time,
|
||||
last_saved_time, num_pages, num_words, num_chars, thumbnail,
|
||||
creating_application, security, codepage_doc, category, presentation_target,
|
||||
bytes, lines, paragraphs, slides, notes, hidden_slides, mm_clips,
|
||||
scale_crop, heading_pairs, titles_of_parts, manager, company, links_dirty,
|
||||
chars_with_spaces, unused, shared_doc, link_base, hlinks, hlinks_changed,
|
||||
version, dig_sig, content_type, content_status, language, doc_version</code></pre>
|
||||
<p>See the source code of the OleMetadata class for more information.</p>
|
||||
<h2 id="parse-a-property-stream">Parse a property stream</h2>
|
||||
<p>get_properties(path) can be used to parse any property stream that is not handled by get_metadata. It returns a dictionary indexed by integers. Each integer is the index of the property, pointing to its value. For example in the standard property stream '05SummaryInformation', the document title is property #2, and the subject is #3.</p>
|
||||
<pre><code>p = ole.getproperties('specialprops')</code></pre>
|
||||
<p>By default as in the original PIL version, timestamp properties are converted into a number of seconds since Jan 1,1601. With the option convert_time, you can obtain more convenient Python datetime objects (UTC timezone). If some time properties should not be converted (such as total editing time in '05SummaryInformation'), the list of indexes can be passed as no_conversion (new in v0.25):</p>
|
||||
<pre><code>p = ole.getproperties('specialprops', convert_time=True, no_conversion=[10])</code></pre>
|
||||
<h2 id="close-the-ole-file">Close the OLE file</h2>
|
||||
<p>Unless your application is a simple script that terminates after processing an OLE file, do not forget to close each OleFileIO object after parsing to close the file on disk. (new in v0.22)</p>
|
||||
<pre><code>ole.close()</code></pre>
|
||||
<h2 id="use-olefile-as-a-script-for-testingdebugging">Use olefile as a script for testing/debugging</h2>
|
||||
<p>olefile can also be used as a script from the command-line to display the structure of an OLE file and its metadata, for example:</p>
|
||||
<pre><code>olefile.py myfile.doc</code></pre>
|
||||
<p>You can use the option -c to check that all streams can be read fully, and -d to generate very verbose debugging information.</p>
|
||||
<hr />
|
||||
<h2 id="olefile-documentation">olefile documentation</h2>
|
||||
<ul>
|
||||
<li><a href="Home.html">Home</a></li>
|
||||
<li><a href="License.html">License</a></li>
|
||||
<li><a href="Install.html">Install</a></li>
|
||||
<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
|
||||
<li><a href="OLE_Overview.html">OLE_Overview</a></li>
|
||||
<li><a href="API.html">API</a> and Usage</li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,313 @@
|
||||
How to use olefile - API
|
||||
========================
|
||||
|
||||
This page is part of the documentation for [olefile](https://bitbucket.org/decalage/olefileio_pl/wiki). It explains
|
||||
how to use all its features to parse and write OLE files. For more information about OLE files, see [[OLE_Overview]].
|
||||
|
||||
olefile can be used as an independent module or with PIL/Pillow. The main functions and methods are explained below.
|
||||
|
||||
For more information, see also the file **olefile.html**, sample code at the end of the module itself, and docstrings within the code.
|
||||
|
||||
|
||||
|
||||
Import olefile
|
||||
--------------
|
||||
|
||||
When the olefile package has been installed, it can be imported in Python applications with this statement:
|
||||
|
||||
:::python
|
||||
import olefile
|
||||
|
||||
Before v0.40, olefile was named OleFileIO_PL. To maintain backward compatibility with older applications and samples, a
|
||||
simple script is also installed so that the following statement imports olefile as OleFileIO_PL:
|
||||
|
||||
:::python
|
||||
import OleFileIO_PL
|
||||
|
||||
As of version 0.30, the code has been changed to be compatible with Python 3.x. As a consequence, compatibility with
|
||||
Python 2.5 or older is not provided anymore. However, a copy of OleFileIO_PL v0.26 (with some backported enhancements)
|
||||
is available as olefile2.py. When importing the olefile package, it falls back automatically to olefile2 if running on
|
||||
Python 2.5 or older. This is implemented in olefile/__init__.py. (new in v0.40)
|
||||
|
||||
If you think olefile should stay compatible with Python 2.5 or older, please [contact me](http://decalage.info/contact).
|
||||
|
||||
|
||||
## Test if a file is an OLE container
|
||||
|
||||
Use **isOleFile** to check if the first bytes of the file contain the Magic for OLE files, before opening it. isOleFile
|
||||
returns True if it is an OLE file, False otherwise (new in v0.16).
|
||||
|
||||
:::python
|
||||
assert olefile.isOleFile('myfile.doc')
|
||||
|
||||
The argument of isOleFile can be (new in v0.41):
|
||||
|
||||
- the path of the file to open on disk (bytes or unicode string smaller than 1536 bytes),
|
||||
- or a bytes string containing the file in memory. (bytes string longer than 1535 bytes),
|
||||
- or a file-like object (with read and seek methods).
|
||||
|
||||
## Open an OLE file from disk
|
||||
|
||||
Create an **OleFileIO** object with the file path as parameter:
|
||||
|
||||
:::python
|
||||
ole = olefile.OleFileIO('myfile.doc')
|
||||
|
||||
## Open an OLE file from a bytes string
|
||||
|
||||
This is useful if the file is already stored in memory as a bytes string.
|
||||
|
||||
:::python
|
||||
ole = olefile.OleFileIO(s)
|
||||
|
||||
Note: olefile checks the size of the string provided as argument to determine if it is a file path or the content of an
|
||||
OLE file. An OLE file cannot be smaller than 1536 bytes. If the string is larger than 1535 bytes, then it is expected to
|
||||
contain an OLE file, otherwise it is expected to be a file path.
|
||||
|
||||
(new in v0.41)
|
||||
|
||||
|
||||
## Open an OLE file from a file-like object
|
||||
|
||||
This is useful if the file is not on disk but only available as a file-like object (with read, seek and tell methods).
|
||||
|
||||
:::python
|
||||
ole = olefile.OleFileIO(f)
|
||||
|
||||
If the file-like object does not have seek or tell methods, the easiest solution is to read the file entirely in
|
||||
a bytes string before parsing:
|
||||
|
||||
:::python
|
||||
data = f.read()
|
||||
ole = olefile.OleFileIO(data)
|
||||
|
||||
|
||||
## How to handle malformed OLE files
|
||||
|
||||
By default, the parser is configured to be as robust and permissive as possible, allowing to parse most malformed OLE files. Only fatal errors will raise an exception. It is possible to tell the parser to be more strict in order to raise exceptions for files that do not fully conform to the OLE specifications, using the raise_defect option (new in v0.14):
|
||||
|
||||
:::python
|
||||
ole = olefile.OleFileIO('myfile.doc', raise_defects=olefile.DEFECT_INCORRECT)
|
||||
|
||||
When the parsing is done, the list of non-fatal issues detected is available as a list in the parsing_issues attribute of the OleFileIO object (new in 0.25):
|
||||
|
||||
:::python
|
||||
print('Non-fatal issues raised during parsing:')
|
||||
if ole.parsing_issues:
|
||||
for exctype, msg in ole.parsing_issues:
|
||||
print('- %s: %s' % (exctype.__name__, msg))
|
||||
else:
|
||||
print('None')
|
||||
|
||||
|
||||
## Open an OLE file in write mode
|
||||
|
||||
Before using the write features, the OLE file must be opened in read/write mode:
|
||||
|
||||
:::python
|
||||
ole = olefile.OleFileIO('test.doc', write_mode=True)
|
||||
|
||||
(new in v0.40)
|
||||
|
||||
The code for write features is new and it has not been thoroughly tested yet. See [issue #6](https://bitbucket.org/decalage/olefileio_pl/issue/6/improve-olefileio_pl-to-write-ole-files) for the roadmap and the implementation status. If you encounter any issue, please send me your [feedback](http://www.decalage.info/en/contact) or [report issues](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open).
|
||||
|
||||
|
||||
## Syntax for stream and storage paths
|
||||
|
||||
Two different syntaxes are allowed for methods that need or return the path of streams and storages:
|
||||
|
||||
1) Either a **list of strings** including all the storages from the root up to the stream/storage name. For example a
|
||||
stream called "WordDocument" at the root will have ['WordDocument'] as full path. A stream called "ThisDocument"
|
||||
located in the storage "Macros/VBA" will be ['Macros', 'VBA', 'ThisDocument']. This is the original syntax from PIL.
|
||||
While hard to read and not very convenient, this syntax works in all cases.
|
||||
|
||||
2) Or a **single string with slashes** to separate storage and stream names (similar to the Unix path syntax).
|
||||
The previous examples would be 'WordDocument' and 'Macros/VBA/ThisDocument'. This syntax is easier, but may fail if a
|
||||
stream or storage name contains a slash (which is normally not allowed, according to the Microsoft specifications [MS-CFB]). (new in v0.15)
|
||||
|
||||
Both are case-insensitive.
|
||||
|
||||
Switching between the two is easy:
|
||||
|
||||
:::python
|
||||
slash_path = '/'.join(list_path)
|
||||
list_path = slash_path.split('/')
|
||||
|
||||
**Encoding**:
|
||||
|
||||
- Stream and Storage names are stored in Unicode format in OLE files, which means they may contain special characters
|
||||
(e.g. Greek, Cyrillic, Japanese, etc) that applications must support to avoid exceptions.
|
||||
- **On Python 2.x**, all stream and storage paths are handled by olefile in bytes strings, using the **UTF-8 encoding**
|
||||
by default. If you need to use Unicode instead, add the option **path_encoding=None** when creating the OleFileIO
|
||||
object. This is new in v0.42. Olefile was using the Latin-1 encoding until v0.41, therefore special characters were
|
||||
not supported.
|
||||
- **On Python 3.x**, all stream and storage paths are handled by olefile in unicode strings, without encoding.
|
||||
|
||||
## Get the list of streams
|
||||
|
||||
listdir() returns a list of all the streams contained in the OLE file, including those stored in storages.
|
||||
Each stream is listed itself as a list, as described above.
|
||||
|
||||
:::python
|
||||
print(ole.listdir())
|
||||
|
||||
Sample result:
|
||||
|
||||
:::python
|
||||
[['\x01CompObj'], ['\x05DocumentSummaryInformation'], ['\x05SummaryInformation']
|
||||
, ['1Table'], ['Macros', 'PROJECT'], ['Macros', 'PROJECTwm'], ['Macros', 'VBA',
|
||||
'Module1'], ['Macros', 'VBA', 'ThisDocument'], ['Macros', 'VBA', '_VBA_PROJECT']
|
||||
, ['Macros', 'VBA', 'dir'], ['ObjectPool'], ['WordDocument']]
|
||||
|
||||
As an option it is possible to choose if storages should also be listed, with or without streams (new in v0.26):
|
||||
|
||||
:::python
|
||||
ole.listdir (streams=False, storages=True)
|
||||
|
||||
|
||||
## Test if known streams/storages exist:
|
||||
|
||||
exists(path) checks if a given stream or storage exists in the OLE file (new in v0.16). The provided path is case-insensitive.
|
||||
|
||||
:::python
|
||||
if ole.exists('worddocument'):
|
||||
print("This is a Word document.")
|
||||
if ole.exists('macros/vba'):
|
||||
print("This document seems to contain VBA macros.")
|
||||
|
||||
|
||||
## Read data from a stream
|
||||
|
||||
openstream(path) opens a stream as a file-like object. The provided path is case-insensitive.
|
||||
|
||||
The following example extracts the "Pictures" stream from a PPT file:
|
||||
|
||||
:::python
|
||||
pics = ole.openstream('Pictures')
|
||||
data = pics.read()
|
||||
|
||||
|
||||
## Get information about a stream/storage
|
||||
|
||||
Several methods can provide the size, type and timestamps of a given stream/storage:
|
||||
|
||||
get_size(path) returns the size of a stream in bytes (new in v0.16):
|
||||
|
||||
:::python
|
||||
s = ole.get_size('WordDocument')
|
||||
|
||||
get_type(path) returns the type of a stream/storage, as one of the following constants: STGTY\_STREAM for a stream, STGTY\_STORAGE for a storage, STGTY\_ROOT for the root entry, and False for a non existing path (new in v0.15).
|
||||
|
||||
:::python
|
||||
t = ole.get_type('WordDocument')
|
||||
|
||||
get\_ctime(path) and get\_mtime(path) return the creation and modification timestamps of a stream/storage, as a Python datetime object with UTC timezone. Please note that these timestamps are only present if the application that created the OLE file explicitly stored them, which is rarely the case. When not present, these methods return None (new in v0.26).
|
||||
|
||||
:::python
|
||||
c = ole.get_ctime('WordDocument')
|
||||
m = ole.get_mtime('WordDocument')
|
||||
|
||||
The root storage is a special case: You can get its creation and modification timestamps using the OleFileIO.root attribute (new in v0.26):
|
||||
|
||||
:::python
|
||||
c = ole.root.getctime()
|
||||
m = ole.root.getmtime()
|
||||
|
||||
Note: all these methods are case-insensitive.
|
||||
|
||||
## Overwriting a sector
|
||||
|
||||
The write_sect method can overwrite any sector of the file. If the provided data is smaller than the sector size (normally 512 bytes, sometimes 4KB), data is padded with null characters. (new in v0.40)
|
||||
|
||||
Here is an example:
|
||||
|
||||
:::python
|
||||
ole.write_sect(0x17, b'TEST')
|
||||
|
||||
Note: following the [MS-CFB specifications](http://msdn.microsoft.com/en-us/library/dd942138.aspx), sector 0 is actually the second sector of the file. You may use -1 as index to write the first sector.
|
||||
|
||||
|
||||
## Overwriting a stream
|
||||
|
||||
The write_stream method can overwrite an existing stream in the file. The new stream data must be the exact same size as the existing one. For now, write_stream can only write streams of 4KB or larger (stored in the main FAT).
|
||||
|
||||
For example, you may change text in a MS Word document:
|
||||
|
||||
:::python
|
||||
ole = olefile.OleFileIO('test.doc', write_mode=True)
|
||||
data = ole.openstream('WordDocument').read()
|
||||
data = data.replace(b'foo', b'bar')
|
||||
ole.write_stream('WordDocument', data)
|
||||
ole.close()
|
||||
|
||||
(new in v0.40)
|
||||
|
||||
|
||||
|
||||
## Extract metadata
|
||||
|
||||
get_metadata() will check if standard property streams exist, parse all the properties they contain, and return an OleMetadata object with the found properties as attributes (new in v0.24).
|
||||
|
||||
:::python
|
||||
meta = ole.get_metadata()
|
||||
print('Author:', meta.author)
|
||||
print('Title:', meta.title)
|
||||
print('Creation date:', meta.create_time)
|
||||
# print all metadata:
|
||||
meta.dump()
|
||||
|
||||
Available attributes include:
|
||||
|
||||
:::text
|
||||
codepage, title, subject, author, keywords, comments, template,
|
||||
last_saved_by, revision_number, total_edit_time, last_printed, create_time,
|
||||
last_saved_time, num_pages, num_words, num_chars, thumbnail,
|
||||
creating_application, security, codepage_doc, category, presentation_target,
|
||||
bytes, lines, paragraphs, slides, notes, hidden_slides, mm_clips,
|
||||
scale_crop, heading_pairs, titles_of_parts, manager, company, links_dirty,
|
||||
chars_with_spaces, unused, shared_doc, link_base, hlinks, hlinks_changed,
|
||||
version, dig_sig, content_type, content_status, language, doc_version
|
||||
|
||||
See the source code of the OleMetadata class for more information.
|
||||
|
||||
|
||||
## Parse a property stream
|
||||
|
||||
get\_properties(path) can be used to parse any property stream that is not handled by get\_metadata. It returns a dictionary indexed by integers. Each integer is the index of the property, pointing to its value. For example in the standard property stream '\x05SummaryInformation', the document title is property #2, and the subject is #3.
|
||||
|
||||
:::python
|
||||
p = ole.getproperties('specialprops')
|
||||
|
||||
By default as in the original PIL version, timestamp properties are converted into a number of seconds since Jan 1,1601. With the option convert\_time, you can obtain more convenient Python datetime objects (UTC timezone). If some time properties should not be converted (such as total editing time in '\x05SummaryInformation'), the list of indexes can be passed as no_conversion (new in v0.25):
|
||||
|
||||
:::python
|
||||
p = ole.getproperties('specialprops', convert_time=True, no_conversion=[10])
|
||||
|
||||
|
||||
## Close the OLE file
|
||||
|
||||
Unless your application is a simple script that terminates after processing an OLE file, do not forget to close each OleFileIO object after parsing to close the file on disk. (new in v0.22)
|
||||
|
||||
:::python
|
||||
ole.close()
|
||||
|
||||
## Use olefile as a script for testing/debugging
|
||||
|
||||
olefile can also be used as a script from the command-line to display the structure of an OLE file and its metadata, for example:
|
||||
|
||||
:::text
|
||||
olefile.py myfile.doc
|
||||
|
||||
You can use the option -c to check that all streams can be read fully, and -d to generate very verbose debugging information.
|
||||
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
olefile documentation
|
||||
---------------------
|
||||
|
||||
- [[Home]]
|
||||
- [[License]]
|
||||
- [[Install]]
|
||||
- [[Contribute]], Suggest Improvements or Report Issues
|
||||
- [[OLE_Overview]]
|
||||
- [[API]] and Usage
|
||||
@@ -0,0 +1,28 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta http-equiv="Content-Style-Type" content="text/css" />
|
||||
<meta name="generator" content="pandoc" />
|
||||
<title></title>
|
||||
</head>
|
||||
<body>
|
||||
<h1 id="how-to-suggest-improvements-report-issues-or-contribute">How to Suggest Improvements, Report Issues or Contribute</h1>
|
||||
<p>This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.</p>
|
||||
<p>To <strong>suggest improvements, report a bug or any issue</strong>, please use the <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open">issue reporting page</a>, providing all the information and files to reproduce the problem.</p>
|
||||
<p>If possible please join the debugging output of olefile. For this, launch the following command :</p>
|
||||
<pre><code> olefile.py -d -c file >debug.txt </code></pre>
|
||||
<p>You may also <a href="http://decalage.info/contact">contact the author</a> directly to <strong>provide feedback</strong>.</p>
|
||||
<p>The code is available in <a href="https://bitbucket.org/decalage/olefileio_pl">a Mercurial repository on Bitbucket</a>. You may use it to <strong>submit enhancements</strong> using forks and pull requests.</p>
|
||||
<hr />
|
||||
<h2 id="olefile-documentation">olefile documentation</h2>
|
||||
<ul>
|
||||
<li><a href="Home.html">Home</a></li>
|
||||
<li><a href="License.html">License</a></li>
|
||||
<li><a href="Install.html">Install</a></li>
|
||||
<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
|
||||
<li><a href="OLE_Overview.html">OLE_Overview</a></li>
|
||||
<li><a href="API.html">API</a> and Usage</li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,28 @@
|
||||
How to Suggest Improvements, Report Issues or Contribute
|
||||
========================================================
|
||||
|
||||
This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug report is welcome.
|
||||
|
||||
To **suggest improvements, report a bug or any issue**, please use the [issue reporting page](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open), providing all the information and files to reproduce the problem.
|
||||
|
||||
If possible please join the debugging output of olefile. For this, launch the following command :
|
||||
|
||||
:::text
|
||||
olefile.py -d -c file >debug.txt
|
||||
|
||||
|
||||
You may also [contact the author](http://decalage.info/contact) directly to **provide feedback**.
|
||||
|
||||
The code is available in [a Mercurial repository on Bitbucket](https://bitbucket.org/decalage/olefileio_pl). You may use it to **submit enhancements** using forks and pull requests.
|
||||
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
olefile documentation
|
||||
---------------------
|
||||
|
||||
- [[Home]]
|
||||
- [[License]]
|
||||
- [[Install]]
|
||||
- [[Contribute]], Suggest Improvements or Report Issues
|
||||
- [[OLE_Overview]]
|
||||
- [[API]] and Usage
|
||||
@@ -0,0 +1,62 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta http-equiv="Content-Style-Type" content="text/css" />
|
||||
<meta name="generator" content="pandoc" />
|
||||
<title></title>
|
||||
</head>
|
||||
<body>
|
||||
<h1 id="olefile-v0.42-documentation">olefile v0.42 documentation</h1>
|
||||
<p>This is the home page of the documentation for olefile. The latest version can be found <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">online</a>, otherwise a copy is provided in the doc subfolder of the package.</p>
|
||||
<p><a href="http://www.decalage.info/olefile">olefile</a> is a Python package to parse, read and write <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files</a> (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
|
||||
<p><strong>Quick links:</strong> <a href="http://www.decalage.info/olefile">Home page</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki/Install">Download/Install</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">Documentation</a> - <a href="https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open">Report Issues/Suggestions/Questions</a> - <a href="http://decalage.info/contact">Contact the author</a> - <a href="https://bitbucket.org/decalage/olefileio_pl">Repository</a> - <a href="https://twitter.com/decalage2">Updates on Twitter</a></p>
|
||||
<h2 id="documentation-pages">Documentation pages</h2>
|
||||
<ul>
|
||||
<li><a href="License.html">License</a></li>
|
||||
<li><a href="Install.html">Install</a></li>
|
||||
<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
|
||||
<li><a href="OLE_Overview.html">OLE_Overview</a></li>
|
||||
<li><a href="API.html">API</a> and Usage</li>
|
||||
</ul>
|
||||
<h2 id="features">Features</h2>
|
||||
<ul>
|
||||
<li>Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls, PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss AxioVision ZVI files, Olympus FluoView OIB files, etc</li>
|
||||
<li>List all the streams and storages contained in an OLE file</li>
|
||||
<li>Open streams as files</li>
|
||||
<li>Parse and read property streams, containing metadata of the file</li>
|
||||
<li>Portable, pure Python module, no dependency</li>
|
||||
</ul>
|
||||
<p>olefile can be used as an independent module or with PIL/Pillow.</p>
|
||||
<p>olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data (especially for security purposes such as malware analysis and forensics), then please also check my <a href="http://www.decalage.info/python/oletools">python-oletools</a>, which are built upon olefile and provide a higher-level interface.</p>
|
||||
<h2 id="history">History</h2>
|
||||
<p>olefile is based on the OleFileIO module from <a href="http://www.pythonware.com/products/pil/index.htm">PIL</a>, the excellent Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate its 9 years and its new write features.</p>
|
||||
<p>As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on several operating systems. (please tell me if you know other similar Python modules)</p>
|
||||
<p>Since 2014 olefile/OleFileIO_PL has been integrated into <a href="http://python-imaging.github.io/">Pillow</a>, the friendly fork of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.</p>
|
||||
<h2 id="main-improvements-over-the-original-version-of-olefileio-in-pil">Main improvements over the original version of OleFileIO in PIL:</h2>
|
||||
<ul>
|
||||
<li>Compatible with Python 3.x and 2.6+</li>
|
||||
<li>Many bug fixes</li>
|
||||
<li>Support for files larger than 6.8MB</li>
|
||||
<li>Support for 64 bits platforms and big-endian CPUs</li>
|
||||
<li>Robust: many checks to detect malformed files</li>
|
||||
<li>Runtime option to choose if malformed files should be parsed or raise exceptions</li>
|
||||
<li>Improved API</li>
|
||||
<li>Metadata extraction, stream/storage timestamps (e.g. for document forensics)</li>
|
||||
<li>Can open file-like objects</li>
|
||||
<li>Added setup.py and install.bat to ease installation</li>
|
||||
<li>More convenient slash-based syntax for stream paths</li>
|
||||
<li>Write features</li>
|
||||
</ul>
|
||||
<hr />
|
||||
<h2 id="olefile-documentation">olefile documentation</h2>
|
||||
<ul>
|
||||
<li><a href="Home.html">Home</a></li>
|
||||
<li><a href="License.html">License</a></li>
|
||||
<li><a href="Install.html">Install</a></li>
|
||||
<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
|
||||
<li><a href="OLE_Overview.html">OLE_Overview</a></li>
|
||||
<li><a href="API.html">API</a> and Usage</li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,94 @@
|
||||
olefile v0.42 documentation
|
||||
===========================
|
||||
|
||||
This is the home page of the documentation for olefile. The latest version can be found
|
||||
[online](https://bitbucket.org/decalage/olefileio_pl/wiki), otherwise a copy is provided in the doc subfolder of the package.
|
||||
|
||||
[olefile](http://www.decalage.info/olefile) is a Python package to parse, read and write
|
||||
[Microsoft OLE2 files](http://en.wikipedia.org/wiki/Compound_File_Binary_Format)
|
||||
(also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft
|
||||
Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file
|
||||
formats, McAfee antivirus quarantine files, etc.
|
||||
|
||||
|
||||
**Quick links:**
|
||||
[Home page](http://www.decalage.info/olefile) -
|
||||
[Download/Install](https://bitbucket.org/decalage/olefileio_pl/wiki/Install) -
|
||||
[Documentation](https://bitbucket.org/decalage/olefileio_pl/wiki) -
|
||||
[Report Issues/Suggestions/Questions](https://bitbucket.org/decalage/olefileio_pl/issues?status=new&status=open) -
|
||||
[Contact the author](http://decalage.info/contact) -
|
||||
[Repository](https://bitbucket.org/decalage/olefileio_pl) -
|
||||
[Updates on Twitter](https://twitter.com/decalage2)
|
||||
|
||||
Documentation pages
|
||||
-------------------
|
||||
|
||||
- [[License]]
|
||||
- [[Install]]
|
||||
- [[Contribute]], Suggest Improvements or Report Issues
|
||||
- [[OLE_Overview]]
|
||||
- [[API]] and Usage
|
||||
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
- Parse, read and write any OLE file such as Microsoft Office 97-2003 legacy document formats (Word .doc, Excel .xls,
|
||||
PowerPoint .ppt, Visio .vsd, Project .mpp), Image Composer and FlashPix files, Outlook messages, StickyNotes, Zeiss
|
||||
AxioVision ZVI files, Olympus FluoView OIB files, etc
|
||||
- List all the streams and storages contained in an OLE file
|
||||
- Open streams as files
|
||||
- Parse and read property streams, containing metadata of the file
|
||||
- Portable, pure Python module, no dependency
|
||||
|
||||
olefile can be used as an independent module or with PIL/Pillow.
|
||||
|
||||
olefile is mostly meant for developers. If you are looking for tools to analyze OLE files or to extract data
|
||||
(especially for security purposes such as malware analysis and forensics), then please also check my
|
||||
[python-oletools](http://www.decalage.info/python/oletools), which are built upon olefile and provide a higher-level
|
||||
interface.
|
||||
|
||||
|
||||
History
|
||||
-------
|
||||
|
||||
olefile is based on the OleFileIO module from [PIL](http://www.pythonware.com/products/pil/index.htm), the excellent
|
||||
Python Imaging Library, created and maintained by Fredrik Lundh. The olefile API is still compatible with PIL, but
|
||||
since 2005 I have improved the internal implementation significantly, with new features, bugfixes and a more robust
|
||||
design. From 2005 to 2014 the project was called OleFileIO_PL, and in 2014 I changed its name to olefile to celebrate
|
||||
its 9 years and its new write features.
|
||||
|
||||
As far as I know, this module is the most complete and robust Python implementation to read MS OLE2 files, portable on
|
||||
several operating systems. (please tell me if you know other similar Python modules)
|
||||
|
||||
Since 2014 olefile/OleFileIO_PL has been integrated into [Pillow](http://python-imaging.github.io/), the friendly fork
|
||||
of PIL. olefile will continue to be improved as a separate project, and new versions will be merged into Pillow regularly.
|
||||
|
||||
Main improvements over the original version of OleFileIO in PIL:
|
||||
----------------------------------------------------------------
|
||||
|
||||
- Compatible with Python 3.x and 2.6+
|
||||
- Many bug fixes
|
||||
- Support for files larger than 6.8MB
|
||||
- Support for 64 bits platforms and big-endian CPUs
|
||||
- Robust: many checks to detect malformed files
|
||||
- Runtime option to choose if malformed files should be parsed or raise exceptions
|
||||
- Improved API
|
||||
- Metadata extraction, stream/storage timestamps (e.g. for document forensics)
|
||||
- Can open file-like objects
|
||||
- Added setup.py and install.bat to ease installation
|
||||
- More convenient slash-based syntax for stream paths
|
||||
- Write features
|
||||
|
||||
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
olefile documentation
|
||||
---------------------
|
||||
|
||||
- [[Home]]
|
||||
- [[License]]
|
||||
- [[Install]]
|
||||
- [[Contribute]], Suggest Improvements or Report Issues
|
||||
- [[OLE_Overview]]
|
||||
- [[API]] and Usage
|
||||
@@ -0,0 +1,30 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta http-equiv="Content-Style-Type" content="text/css" />
|
||||
<meta name="generator" content="pandoc" />
|
||||
<title></title>
|
||||
</head>
|
||||
<body>
|
||||
<h1 id="how-to-download-and-install-olefile">How to Download and Install olefile</h1>
|
||||
<h2 id="pre-requisites">Pre-requisites</h2>
|
||||
<p>olefile requires Python 2.6, 2.7 or 3.x.</p>
|
||||
<p>For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain all the enhancements implemented in olefile.</p>
|
||||
<h2 id="download-and-install">Download and Install</h2>
|
||||
<p>To use olefile with other Python applications or your own scripts, the simplest solution is to run <strong>pip install olefile</strong> or <strong>easy_install olefile</strong>, to download and install the package in one go. Pip is part of the standard Python distribution since v2.7.9.</p>
|
||||
<p>To update olefile if a previous version is already installed, run <strong>pip install -U olefile</strong>.</p>
|
||||
<p>Otherwise you may download/extract the <a href="https://bitbucket.org/decalage/olefileio_pl/downloads">zip archive</a> in a temporary directory and run <strong>python setup.py install</strong>.</p>
|
||||
<p>On Windows you may simply double-click on <strong>install.bat</strong>.</p>
|
||||
<hr />
|
||||
<h2 id="olefile-documentation">olefile documentation</h2>
|
||||
<ul>
|
||||
<li><a href="Home.html">Home</a></li>
|
||||
<li><a href="License.html">License</a></li>
|
||||
<li><a href="Install.html">Install</a></li>
|
||||
<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
|
||||
<li><a href="OLE_Overview.html">OLE_Overview</a></li>
|
||||
<li><a href="API.html">API</a> and Usage</li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,37 @@
|
||||
How to Download and Install olefile
|
||||
===================================
|
||||
|
||||
Pre-requisites
|
||||
--------------
|
||||
|
||||
olefile requires Python 2.6, 2.7 or 3.x.
|
||||
|
||||
For Python 2.5 and older, olefile falls back to an older version (based on OleFileIO_PL 0.26) which might not contain
|
||||
all the enhancements implemented in olefile.
|
||||
|
||||
|
||||
Download and Install
|
||||
--------------------
|
||||
|
||||
To use olefile with other Python applications or your own scripts, the simplest solution is to run **pip install olefile**
|
||||
or **easy_install olefile**, to download and install the package in one go. Pip is part of the standard Python
|
||||
distribution since v2.7.9.
|
||||
|
||||
To update olefile if a previous version is already installed, run **pip install -U olefile**.
|
||||
|
||||
Otherwise you may download/extract the [zip archive](https://bitbucket.org/decalage/olefileio_pl/downloads) in a
|
||||
temporary directory and run **python setup.py install**.
|
||||
|
||||
On Windows you may simply double-click on **install.bat**.
|
||||
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
olefile documentation
|
||||
---------------------
|
||||
|
||||
- [[Home]]
|
||||
- [[License]]
|
||||
- [[Install]]
|
||||
- [[Contribute]], Suggest Improvements or Report Issues
|
||||
- [[OLE_Overview]]
|
||||
- [[API]] and Usage
|
||||
@@ -0,0 +1,40 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta http-equiv="Content-Style-Type" content="text/css" />
|
||||
<meta name="generator" content="pandoc" />
|
||||
<title></title>
|
||||
</head>
|
||||
<body>
|
||||
<h1 id="license-for-olefile">License for olefile</h1>
|
||||
<p>olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)</p>
|
||||
<p>All rights reserved.</p>
|
||||
<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
|
||||
<ul>
|
||||
<li>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</li>
|
||||
<li>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</li>
|
||||
</ul>
|
||||
<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
|
||||
<hr />
|
||||
<p>olefile is based on source code from the OleFileIO module of the Python Imaging Library (PIL) published by Fredrik Lundh under the following license:</p>
|
||||
<p>The Python Imaging Library (PIL) is</p>
|
||||
<ul>
|
||||
<li>Copyright (c) 1997-2005 by Secret Labs AB</li>
|
||||
<li>Copyright (c) 1995-2005 by Fredrik Lundh</li>
|
||||
</ul>
|
||||
<p>By obtaining, using, and/or copying this software and/or its associated documentation, you agree that you have read, understood, and will comply with the following terms and conditions:</p>
|
||||
<p>Permission to use, copy, modify, and distribute this software and its associated documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies, and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of Secret Labs AB or the author not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.</p>
|
||||
<p>SECRET LABS AB AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL SECRET LABS AB OR THE AUTHOR BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.</p>
|
||||
<hr />
|
||||
<h2 id="olefile-documentation">olefile documentation</h2>
|
||||
<ul>
|
||||
<li><a href="Home.html">Home</a></li>
|
||||
<li><a href="License.html">License</a></li>
|
||||
<li><a href="Install.html">Install</a></li>
|
||||
<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
|
||||
<li><a href="OLE_Overview.html">OLE_Overview</a></li>
|
||||
<li><a href="API.html">API</a> and Usage</li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,54 @@
|
||||
License for olefile
|
||||
===================
|
||||
|
||||
olefile (formerly OleFileIO_PL) is copyright (c) 2005-2015 Philippe Lagadec ([http://www.decalage.info](http://www.decalage.info))
|
||||
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without modification,
|
||||
are permitted provided that the following conditions are met:
|
||||
|
||||
* Redistributions of source code must retain the above copyright notice, this
|
||||
list of conditions and the following disclaimer.
|
||||
* Redistributions in binary form must reproduce the above copyright notice,
|
||||
this list of conditions and the following disclaimer in the documentation
|
||||
and/or other materials provided with the distribution.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
|
||||
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
||||
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
||||
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
|
||||
----------
|
||||
|
||||
olefile is based on source code from the OleFileIO module of the Python Imaging Library (PIL) published by Fredrik Lundh under the following license:
|
||||
|
||||
The Python Imaging Library (PIL) is
|
||||
|
||||
- Copyright (c) 1997-2005 by Secret Labs AB
|
||||
- Copyright (c) 1995-2005 by Fredrik Lundh
|
||||
|
||||
By obtaining, using, and/or copying this software and/or its associated documentation, you agree that you have read, understood, and will comply with the following terms and conditions:
|
||||
|
||||
Permission to use, copy, modify, and distribute this software and its associated documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies, and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of Secret Labs AB or the author not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.
|
||||
|
||||
SECRET LABS AB AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL SECRET LABS AB OR THE AUTHOR BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
olefile documentation
|
||||
---------------------
|
||||
|
||||
- [[Home]]
|
||||
- [[License]]
|
||||
- [[Install]]
|
||||
- [[Contribute]], Suggest Improvements or Report Issues
|
||||
- [[OLE_Overview]]
|
||||
- [[API]] and Usage
|
||||
@@ -0,0 +1,31 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta http-equiv="Content-Style-Type" content="text/css" />
|
||||
<meta name="generator" content="pandoc" />
|
||||
<title></title>
|
||||
</head>
|
||||
<body>
|
||||
<h1 id="about-the-structure-of-ole-files">About the structure of OLE files</h1>
|
||||
<p>This page is part of the documentation for <a href="https://bitbucket.org/decalage/olefileio_pl/wiki">olefile</a>. It provides a brief overview of the structure of <a href="http://en.wikipedia.org/wiki/Compound_File_Binary_Format">Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)</a>, such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.</p>
|
||||
<p>An OLE file can be seen as a mini file system or a Zip archive: It contains <strong>streams</strong> of data that look like files embedded within the OLE file. Each stream has a name. For example, the main stream of a MS Word document containing its text is named "WordDocument".</p>
|
||||
<p>An OLE file can also contain <strong>storages</strong>. A storage is a folder that contains streams or other storages. For example, a MS Word document with VBA macros has a storage called "Macros".</p>
|
||||
<p>Special streams can contain <strong>properties</strong>. A property is a specific value that can be used to store information such as the metadata of a document (title, author, creation date, etc). Property stream names usually start with the character '05'.</p>
|
||||
<p>For example, a typical MS Word document may look like this:</p>
|
||||
<div class="figure">
|
||||
<img src="OLE_VBA_sample.png" /><p class="caption"></p>
|
||||
</div>
|
||||
<p>Go to the <a href="API.html">API</a> page to see how to use all olefile features to parse OLE files.</p>
|
||||
<hr />
|
||||
<h2 id="olefile-documentation">olefile documentation</h2>
|
||||
<ul>
|
||||
<li><a href="Home.html">Home</a></li>
|
||||
<li><a href="License.html">License</a></li>
|
||||
<li><a href="Install.html">Install</a></li>
|
||||
<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or Report Issues</li>
|
||||
<li><a href="OLE_Overview.html">OLE_Overview</a></li>
|
||||
<li><a href="API.html">API</a> and Usage</li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,29 @@
|
||||
About the structure of OLE files
|
||||
================================
|
||||
|
||||
This page is part of the documentation for [olefile](https://bitbucket.org/decalage/olefileio_pl/wiki). It provides a brief overview of the structure of [Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format)](http://en.wikipedia.org/wiki/Compound_File_Binary_Format), such as Microsoft Office 97-2003 documents, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.
|
||||
|
||||
An OLE file can be seen as a mini file system or a Zip archive: It contains **streams** of data that look like files embedded within the OLE file. Each stream has a name. For example, the main stream of a MS Word document containing its text is named "WordDocument".
|
||||
|
||||
An OLE file can also contain **storages**. A storage is a folder that contains streams or other storages. For example, a MS Word document with VBA macros has a storage called "Macros".
|
||||
|
||||
Special streams can contain **properties**. A property is a specific value that can be used to store information such as the metadata of a document (title, author, creation date, etc). Property stream names usually start with the character '\x05'.
|
||||
|
||||
For example, a typical MS Word document may look like this:
|
||||
|
||||
|
||||
|
||||
Go to the [[API]] page to see how to use all olefile features to parse OLE files.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
olefile documentation
|
||||
---------------------
|
||||
|
||||
- [[Home]]
|
||||
- [[License]]
|
||||
- [[Install]]
|
||||
- [[Contribute]], Suggest Improvements or Report Issues
|
||||
- [[OLE_Overview]]
|
||||
- [[API]] and Usage
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 3.5 KiB |
@@ -0,0 +1,432 @@
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
||||
<html><head><title>Python: module olefile</title>
|
||||
</head><body bgcolor="#f0f0f8">
|
||||
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="heading">
|
||||
<tr bgcolor="#7799ee">
|
||||
<td valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"> <br><big><big><strong>olefile</strong></big></big> (version 0.42, 2015-01-24)</font></td
|
||||
><td align=right valign=bottom
|
||||
><font color="#ffffff" face="helvetica, arial"><a href=".">index</a><br><a href="file:./olefile.py">.\olefile.py</a></font></td></tr></table>
|
||||
<p><tt># olefile (formerly OleFileIO_PL) version 0.42 2015-01-24<br>
|
||||
#<br>
|
||||
# Module to read/write Microsoft OLE2 files (also called Structured Storage or<br>
|
||||
# Microsoft Compound Document File Format), such as Microsoft Office 97-2003<br>
|
||||
# documents, Image Composer and FlashPix files, Outlook messages, ...<br>
|
||||
# This version is compatible with Python 2.6+ and 3.x<br>
|
||||
#<br>
|
||||
# Project website: <a href="http://www.decalage.info/olefile">http://www.decalage.info/olefile</a><br>
|
||||
#<br>
|
||||
# olefile is copyright (c) 2005-2015 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)<br>
|
||||
#<br>
|
||||
# olefile is based on the <a href="#OleFileIO">OleFileIO</a> module from the PIL library v1.1.6<br>
|
||||
# See: <a href="http://www.pythonware.com/products/pil/index.htm">http://www.pythonware.com/products/pil/index.htm</a><br>
|
||||
#<br>
|
||||
# The Python Imaging Library (PIL) is<br>
|
||||
# Copyright (c) 1997-2005 by Secret Labs AB<br>
|
||||
# Copyright (c) 1995-2005 by Fredrik Lundh<br>
|
||||
#<br>
|
||||
# See source code and LICENSE.txt for information on usage and redistribution.</tt></p>
|
||||
<p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#aa55cc">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Modules</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#aa55cc"><tt> </tt></td><td> </td>
|
||||
<td width="100%"><table width="100%" summary="list"><tr><td width="25%" valign=top><a href="array.html">array</a><br>
|
||||
<a href="datetime.html">datetime</a><br>
|
||||
</td><td width="25%" valign=top><a href="io.html">io</a><br>
|
||||
<a href="os.html">os</a><br>
|
||||
</td><td width="25%" valign=top><a href="struct.html">struct</a><br>
|
||||
<a href="sys.html">sys</a><br>
|
||||
</td><td width="25%" valign=top></td></tr></table></td></tr></table><p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#ee77aa">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Classes</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#ee77aa"><tt> </tt></td><td> </td>
|
||||
<td width="100%"><dl>
|
||||
<dt><font face="helvetica, arial"><a href="olefile.html#OleFileIO">OleFileIO</a>
|
||||
</font></dt><dt><font face="helvetica, arial"><a href="olefile.html#OleMetadata">OleMetadata</a>
|
||||
</font></dt></dl>
|
||||
<p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#ffc8d8">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#000000" face="helvetica, arial"><a name="OleFileIO">class <strong>OleFileIO</strong></a></font></td></tr>
|
||||
|
||||
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
|
||||
<td colspan=2><tt>OLE container object<br>
|
||||
<br>
|
||||
This class encapsulates the interface to an OLE 2 structured<br>
|
||||
storage file. Use the listdir and openstream methods to<br>
|
||||
access the contents of this file.<br>
|
||||
<br>
|
||||
Object names are given as a list of strings, one for each subentry<br>
|
||||
level. The root entry should be omitted. For example, the following<br>
|
||||
code extracts all image streams from a Microsoft Image Composer file::<br>
|
||||
<br>
|
||||
ole = <a href="#OleFileIO">OleFileIO</a>("fan.mic")<br>
|
||||
<br>
|
||||
for entry in ole.<a href="#OleFileIO-listdir">listdir</a>():<br>
|
||||
if entry[1:2] == "Image":<br>
|
||||
fin = ole.<a href="#OleFileIO-openstream">openstream</a>(entry)<br>
|
||||
fout = <a href="#OleFileIO-open">open</a>(entry[0:1], "wb")<br>
|
||||
while True:<br>
|
||||
s = fin.read(8192)<br>
|
||||
if not s:<br>
|
||||
break<br>
|
||||
fout.write(s)<br>
|
||||
<br>
|
||||
You can use the viewer application provided with the Python Imaging<br>
|
||||
Library to view the resulting files (which happens to be standard<br>
|
||||
TIFF files).<br> </tt></td></tr>
|
||||
<tr><td> </td>
|
||||
<td width="100%">Methods defined here:<br>
|
||||
<dl><dt><a name="OleFileIO-__init__"><strong>__init__</strong></a>(self, filename<font color="#909090">=None</font>, raise_defects<font color="#909090">=40</font>, write_mode<font color="#909090">=False</font>, debug<font color="#909090">=False</font>, path_encoding<font color="#909090">='utf-8'</font>)</dt><dd><tt>Constructor for the <a href="#OleFileIO">OleFileIO</a> class.<br>
|
||||
<br>
|
||||
:param filename: file to open.<br>
|
||||
<br>
|
||||
- if filename is a string smaller than 1536 bytes, it is the path<br>
|
||||
of the file to open. (bytes or unicode string)<br>
|
||||
- if filename is a string longer than 1535 bytes, it is parsed<br>
|
||||
as the content of an OLE file in memory. (bytes type only)<br>
|
||||
- if filename is a file-like object (with read, seek and tell methods),<br>
|
||||
it is parsed as-is.<br>
|
||||
<br>
|
||||
:param raise_defects: minimal level for defects to be raised as exceptions.<br>
|
||||
(use DEFECT_FATAL for a typical application, DEFECT_INCORRECT for a<br>
|
||||
security-oriented application, see source code for details)<br>
|
||||
<br>
|
||||
:param write_mode: bool, if True the file is opened in read/write mode instead<br>
|
||||
of read-only by default.<br>
|
||||
<br>
|
||||
:param debug: bool, set debug mode<br>
|
||||
<br>
|
||||
:param path_encoding: None or str, name of the codec to use for path<br>
|
||||
names (streams and storages), or None for Unicode.<br>
|
||||
Unicode by default on Python 3+, UTF-8 on Python 2.x.<br>
|
||||
(new in olefile 0.42, was hardcoded to Latin-1 until olefile v0.41)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-close"><strong>close</strong></a>(self)</dt><dd><tt>close the OLE file, to release the file object</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-dumpdirectory"><strong>dumpdirectory</strong></a>(self)</dt><dd><tt>Dump directory (for debugging only)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-dumpfat"><strong>dumpfat</strong></a>(self, fat, firstindex<font color="#909090">=0</font>)</dt><dd><tt>Displays a part of FAT in human-readable form for debugging purpose</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-dumpsect"><strong>dumpsect</strong></a>(self, sector, firstindex<font color="#909090">=0</font>)</dt><dd><tt>Displays a sector in a human-readable form, for debugging purpose.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-exists"><strong>exists</strong></a>(self, filename)</dt><dd><tt>Test if given filename exists as a stream or a storage in the OLE<br>
|
||||
container.<br>
|
||||
Note: filename is case-insensitive.<br>
|
||||
<br>
|
||||
:param filename: path of stream in storage tree. (see openstream for syntax)<br>
|
||||
:returns: True if object exist, else False.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-get_metadata"><strong>get_metadata</strong></a>(self)</dt><dd><tt>Parse standard properties streams, return an <a href="#OleMetadata">OleMetadata</a> object<br>
|
||||
containing all the available metadata.<br>
|
||||
(also stored in the metadata attribute of the <a href="#OleFileIO">OleFileIO</a> object)<br>
|
||||
<br>
|
||||
new in version 0.25</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-get_rootentry_name"><strong>get_rootentry_name</strong></a>(self)</dt><dd><tt>Return root entry name. Should usually be 'Root Entry' or 'R' in most<br>
|
||||
implementations.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-get_size"><strong>get_size</strong></a>(self, filename)</dt><dd><tt>Return size of a stream in the OLE container, in bytes.<br>
|
||||
<br>
|
||||
:param filename: path of stream in storage tree (see openstream for syntax)<br>
|
||||
:returns: size in bytes (long integer)<br>
|
||||
:exception IOError: if file not found<br>
|
||||
:exception TypeError: if this is not a stream.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-get_type"><strong>get_type</strong></a>(self, filename)</dt><dd><tt>Test if given filename exists as a stream or a storage in the OLE<br>
|
||||
container, and return its type.<br>
|
||||
<br>
|
||||
:param filename: path of stream in storage tree. (see openstream for syntax)<br>
|
||||
:returns: False if object does not exist, its entry type (>0) otherwise:<br>
|
||||
<br>
|
||||
- STGTY_STREAM: a stream<br>
|
||||
- STGTY_STORAGE: a storage<br>
|
||||
- STGTY_ROOT: the root entry</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-getctime"><strong>getctime</strong></a>(self, filename)</dt><dd><tt>Return creation time of a stream/storage.<br>
|
||||
<br>
|
||||
:param filename: path of stream/storage in storage tree. (see openstream for<br>
|
||||
syntax)<br>
|
||||
:returns: None if creation time is null, a python datetime object<br>
|
||||
otherwise (UTC timezone)<br>
|
||||
<br>
|
||||
new in version 0.26</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-getmtime"><strong>getmtime</strong></a>(self, filename)</dt><dd><tt>Return modification time of a stream/storage.<br>
|
||||
<br>
|
||||
:param filename: path of stream/storage in storage tree. (see openstream for<br>
|
||||
syntax)<br>
|
||||
:returns: None if modification time is null, a python datetime object<br>
|
||||
otherwise (UTC timezone)<br>
|
||||
<br>
|
||||
new in version 0.26</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-getproperties"><strong>getproperties</strong></a>(self, filename, convert_time<font color="#909090">=False</font>, no_conversion<font color="#909090">=None</font>)</dt><dd><tt>Return properties described in substream.<br>
|
||||
<br>
|
||||
:param filename: path of stream in storage tree (see openstream for syntax)<br>
|
||||
:param convert_time: bool, if True timestamps will be converted to Python datetime<br>
|
||||
:param no_conversion: None or list of int, timestamps not to be converted<br>
|
||||
(for example total editing time is not a real timestamp)<br>
|
||||
<br>
|
||||
:returns: a dictionary of values indexed by id (integer)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-getsect"><strong>getsect</strong></a>(self, sect)</dt><dd><tt>Read given sector from file on disk.<br>
|
||||
<br>
|
||||
:param sect: int, sector index<br>
|
||||
:returns: a string containing the sector data.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-listdir"><strong>listdir</strong></a>(self, streams<font color="#909090">=True</font>, storages<font color="#909090">=False</font>)</dt><dd><tt>Return a list of streams and/or storages stored in this file<br>
|
||||
<br>
|
||||
:param streams: bool, include streams if True (True by default) - new in v0.26<br>
|
||||
:param storages: bool, include storages if True (False by default) - new in v0.26<br>
|
||||
(note: the root storage is never included)<br>
|
||||
:returns: list of stream and/or storage paths</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-loaddirectory"><strong>loaddirectory</strong></a>(self, sect)</dt><dd><tt>Load the directory.<br>
|
||||
<br>
|
||||
:param sect: sector index of directory stream.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-loadfat"><strong>loadfat</strong></a>(self, header)</dt><dd><tt>Load the FAT table.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-loadfat_sect"><strong>loadfat_sect</strong></a>(self, sect)</dt><dd><tt>Adds the indexes of the given sector to the FAT<br>
|
||||
<br>
|
||||
:param sect: string containing the first FAT sector, or array of long integers<br>
|
||||
:returns: index of last FAT sector.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-loadminifat"><strong>loadminifat</strong></a>(self)</dt><dd><tt>Load the MiniFAT table.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-open"><strong>open</strong></a>(self, filename, write_mode<font color="#909090">=False</font>)</dt><dd><tt>Open an OLE2 file in read-only or read/write mode.<br>
|
||||
Read and parse the header, FAT and directory.<br>
|
||||
<br>
|
||||
:param filename: string-like or file-like object, OLE file to parse<br>
|
||||
<br>
|
||||
- if filename is a string smaller than 1536 bytes, it is the path<br>
|
||||
of the file to open. (bytes or unicode string)<br>
|
||||
- if filename is a string longer than 1535 bytes, it is parsed<br>
|
||||
as the content of an OLE file in memory. (bytes type only)<br>
|
||||
- if filename is a file-like object (with read, seek and tell methods),<br>
|
||||
it is parsed as-is.<br>
|
||||
<br>
|
||||
:param write_mode: bool, if True the file is opened in read/write mode instead<br>
|
||||
of read-only by default. (ignored if filename is not a path)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-openstream"><strong>openstream</strong></a>(self, filename)</dt><dd><tt>Open a stream as a read-only file object (BytesIO).<br>
|
||||
Note: filename is case-insensitive.<br>
|
||||
<br>
|
||||
:param filename: path of stream in storage tree (except root entry), either:<br>
|
||||
<br>
|
||||
- a string using Unix path syntax, for example:<br>
|
||||
'storage_1/storage_1.2/stream'<br>
|
||||
- or a list of storage filenames, path to the desired stream/storage.<br>
|
||||
Example: ['storage_1', 'storage_1.2', 'stream']<br>
|
||||
<br>
|
||||
:returns: file object (read-only)<br>
|
||||
:exception IOError: if filename not found, or if this is not a stream.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-sect2array"><strong>sect2array</strong></a>(self, sect)</dt><dd><tt>convert a sector to an array of 32 bits unsigned integers,<br>
|
||||
swapping bytes on big endian CPUs such as PowerPC (old Macs)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-write_sect"><strong>write_sect</strong></a>(self, sect, data, padding<font color="#909090">='<font color="#c040c0">\x00</font>'</font>)</dt><dd><tt>Write given sector to file on disk.<br>
|
||||
<br>
|
||||
:param sect: int, sector index<br>
|
||||
:param data: bytes, sector data<br>
|
||||
:param padding: single byte, padding character if data < sector size</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-write_stream"><strong>write_stream</strong></a>(self, stream_name, data)</dt><dd><tt>Write a stream to disk. For now, it is only possible to replace an<br>
|
||||
existing stream by data of the same size.<br>
|
||||
<br>
|
||||
:param stream_name: path of stream in storage tree (except root entry), either:<br>
|
||||
<br>
|
||||
- a string using Unix path syntax, for example:<br>
|
||||
'storage_1/storage_1.2/stream'<br>
|
||||
- or a list of storage filenames, path to the desired stream/storage.<br>
|
||||
Example: ['storage_1', 'storage_1.2', 'stream']<br>
|
||||
<br>
|
||||
:param data: bytes, data to be written, must be the same size as the original<br>
|
||||
stream.</tt></dd></dl>
|
||||
|
||||
</td></tr></table> <p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#ffc8d8">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#000000" face="helvetica, arial"><a name="OleMetadata">class <strong>OleMetadata</strong></a></font></td></tr>
|
||||
|
||||
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
|
||||
<td colspan=2><tt>class to parse and store metadata from standard properties of OLE files.<br>
|
||||
<br>
|
||||
Available attributes:<br>
|
||||
codepage, title, subject, author, keywords, comments, template,<br>
|
||||
last_saved_by, revision_number, total_edit_time, last_printed, create_time,<br>
|
||||
last_saved_time, num_pages, num_words, num_chars, thumbnail,<br>
|
||||
creating_application, security, codepage_doc, category, presentation_target,<br>
|
||||
bytes, lines, paragraphs, slides, notes, hidden_slides, mm_clips,<br>
|
||||
scale_crop, heading_pairs, titles_of_parts, manager, company, links_dirty,<br>
|
||||
chars_with_spaces, unused, shared_doc, link_base, hlinks, hlinks_changed,<br>
|
||||
version, dig_sig, content_type, content_status, language, doc_version<br>
|
||||
<br>
|
||||
Note: an attribute is set to None when not present in the properties of the<br>
|
||||
OLE file.<br>
|
||||
<br>
|
||||
References for SummaryInformation stream:<br>
|
||||
- <a href="http://msdn.microsoft.com/en-us/library/dd942545.aspx">http://msdn.microsoft.com/en-us/library/dd942545.aspx</a><br>
|
||||
- <a href="http://msdn.microsoft.com/en-us/library/dd925819%28v=office.12%29.aspx">http://msdn.microsoft.com/en-us/library/dd925819%28v=office.12%29.aspx</a><br>
|
||||
- <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa380376%28v=vs.85%29.aspx">http://msdn.microsoft.com/en-us/library/windows/desktop/aa380376%28v=vs.85%29.aspx</a><br>
|
||||
- <a href="http://msdn.microsoft.com/en-us/library/aa372045.aspx">http://msdn.microsoft.com/en-us/library/aa372045.aspx</a><br>
|
||||
- <a href="http://sedna-soft.de/summary-information-stream/">http://sedna-soft.de/summary-information-stream/</a><br>
|
||||
- <a href="http://poi.apache.org/apidocs/org/apache/poi/hpsf/SummaryInformation.html">http://poi.apache.org/apidocs/org/apache/poi/hpsf/SummaryInformation.html</a><br>
|
||||
<br>
|
||||
References for DocumentSummaryInformation stream:<br>
|
||||
- <a href="http://msdn.microsoft.com/en-us/library/dd945671%28v=office.12%29.aspx">http://msdn.microsoft.com/en-us/library/dd945671%28v=office.12%29.aspx</a><br>
|
||||
- <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa380374%28v=vs.85%29.aspx">http://msdn.microsoft.com/en-us/library/windows/desktop/aa380374%28v=vs.85%29.aspx</a><br>
|
||||
- <a href="http://poi.apache.org/apidocs/org/apache/poi/hpsf/DocumentSummaryInformation.html">http://poi.apache.org/apidocs/org/apache/poi/hpsf/DocumentSummaryInformation.html</a><br>
|
||||
<br>
|
||||
new in version 0.25<br> </tt></td></tr>
|
||||
<tr><td> </td>
|
||||
<td width="100%">Methods defined here:<br>
|
||||
<dl><dt><a name="OleMetadata-__init__"><strong>__init__</strong></a>(self)</dt><dd><tt>Constructor for <a href="#OleMetadata">OleMetadata</a><br>
|
||||
All attributes are set to None by default</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleMetadata-dump"><strong>dump</strong></a>(self)</dt><dd><tt>Dump all metadata, for debugging purposes.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleMetadata-parse_properties"><strong>parse_properties</strong></a>(self, olefile)</dt><dd><tt>Parse standard properties of an OLE file, from the streams<br>
|
||||
"SummaryInformation" and "DocumentSummaryInformation",<br>
|
||||
if present.<br>
|
||||
Properties are converted to strings, integers or python datetime objects.<br>
|
||||
If a property is not present, its value is set to None.</tt></dd></dl>
|
||||
|
||||
<hr>
|
||||
Data and other attributes defined here:<br>
|
||||
<dl><dt><strong>DOCSUM_ATTRIBS</strong> = ['codepage_doc', 'category', 'presentation_target', 'bytes', 'lines', 'paragraphs', 'slides', 'notes', 'hidden_slides', 'mm_clips', 'scale_crop', 'heading_pairs', 'titles_of_parts', 'manager', 'company', 'links_dirty', 'chars_with_spaces', 'unused', 'shared_doc', 'link_base', ...]</dl>
|
||||
|
||||
<dl><dt><strong>SUMMARY_ATTRIBS</strong> = ['codepage', 'title', 'subject', 'author', 'keywords', 'comments', 'template', 'last_saved_by', 'revision_number', 'total_edit_time', 'last_printed', 'create_time', 'last_saved_time', 'num_pages', 'num_words', 'num_chars', 'thumbnail', 'creating_application', 'security']</dl>
|
||||
|
||||
</td></tr></table></td></tr></table><p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#eeaa77">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Functions</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#eeaa77"><tt> </tt></td><td> </td>
|
||||
<td width="100%"><dl><dt><a name="-debug"><strong>debug</strong></a> = debug_pass(msg)</dt></dl>
|
||||
<dl><dt><a name="-debug_pass"><strong>debug_pass</strong></a>(msg)</dt></dl>
|
||||
<dl><dt><a name="-debug_print"><strong>debug_print</strong></a>(msg)</dt></dl>
|
||||
<dl><dt><a name="-filetime2datetime"><strong>filetime2datetime</strong></a>(filetime)</dt><dd><tt>convert FILETIME (64 bits int) to Python datetime.datetime</tt></dd></dl>
|
||||
<dl><dt><a name="-i16"><strong>i16</strong></a>(c, o<font color="#909090">=0</font>)</dt><dd><tt>Converts a 2-bytes (16 bits) string to an integer.<br>
|
||||
<br>
|
||||
:param c: string containing bytes to convert<br>
|
||||
:param o: offset of bytes to convert in string</tt></dd></dl>
|
||||
<dl><dt><a name="-i32"><strong>i32</strong></a>(c, o<font color="#909090">=0</font>)</dt><dd><tt>Converts a 4-bytes (32 bits) string to an integer.<br>
|
||||
<br>
|
||||
:param c: string containing bytes to convert<br>
|
||||
:param o: offset of bytes to convert in string</tt></dd></dl>
|
||||
<dl><dt><a name="-i8"><strong>i8</strong></a>(c)</dt><dd><tt># version for Python 2.x</tt></dd></dl>
|
||||
<dl><dt><a name="-isOleFile"><strong>isOleFile</strong></a>(filename)</dt><dd><tt>Test if a file is an OLE container (according to the magic bytes in its header).<br>
|
||||
<br>
|
||||
:param filename: string-like or file-like object, OLE file to parse<br>
|
||||
<br>
|
||||
- if filename is a string smaller than 1536 bytes, it is the path<br>
|
||||
of the file to open. (bytes or unicode string)<br>
|
||||
- if filename is a string longer than 1535 bytes, it is parsed<br>
|
||||
as the content of an OLE file in memory. (bytes type only)<br>
|
||||
- if filename is a file-like object (with read and seek methods),<br>
|
||||
it is parsed as-is.<br>
|
||||
<br>
|
||||
:returns: True if OLE, False otherwise.</tt></dd></dl>
|
||||
<dl><dt><a name="-set_debug_mode"><strong>set_debug_mode</strong></a>(debug_mode)</dt><dd><tt>Set debug mode on or off, to control display of debugging messages.<br>
|
||||
:param mode: True or False</tt></dd></dl>
|
||||
</td></tr></table><p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#55aa55">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Data</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#55aa55"><tt> </tt></td><td> </td>
|
||||
<td width="100%"><strong>DEBUG_MODE</strong> = False<br>
|
||||
<strong>DEFAULT_PATH_ENCODING</strong> = 'utf-8'<br>
|
||||
<strong>DEFECT_FATAL</strong> = 40<br>
|
||||
<strong>DEFECT_INCORRECT</strong> = 30<br>
|
||||
<strong>DEFECT_POTENTIAL</strong> = 20<br>
|
||||
<strong>DEFECT_UNSURE</strong> = 10<br>
|
||||
<strong>DIFSECT</strong> = 4294967292L<br>
|
||||
<strong>ENDOFCHAIN</strong> = 4294967294L<br>
|
||||
<strong>FATSECT</strong> = 4294967293L<br>
|
||||
<strong>FREESECT</strong> = 4294967295L<br>
|
||||
<strong>KEEP_UNICODE_NAMES</strong> = True<br>
|
||||
<strong>MAGIC</strong> = '<font color="#c040c0">\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1</font>'<br>
|
||||
<strong>MAXREGSECT</strong> = 4294967290L<br>
|
||||
<strong>MAXREGSID</strong> = 4294967290L<br>
|
||||
<strong>MINIMAL_OLEFILE_SIZE</strong> = 1536<br>
|
||||
<strong>NOSTREAM</strong> = 4294967295L<br>
|
||||
<strong>STGTY_EMPTY</strong> = 0<br>
|
||||
<strong>STGTY_LOCKBYTES</strong> = 3<br>
|
||||
<strong>STGTY_PROPERTY</strong> = 4<br>
|
||||
<strong>STGTY_ROOT</strong> = 5<br>
|
||||
<strong>STGTY_STORAGE</strong> = 1<br>
|
||||
<strong>STGTY_STREAM</strong> = 2<br>
|
||||
<strong>UINT32</strong> = 'L'<br>
|
||||
<strong>VT</strong> = {0: 'VT_EMPTY', 1: 'VT_NULL', 2: 'VT_I2', 3: 'VT_I4', 4: 'VT_R4', 5: 'VT_R8', 6: 'VT_CY', 7: 'VT_DATE', 8: 'VT_BSTR', 9: 'VT_DISPATCH', ...}<br>
|
||||
<strong>VT_BLOB</strong> = 65<br>
|
||||
<strong>VT_BLOB_OBJECT</strong> = 70<br>
|
||||
<strong>VT_BOOL</strong> = 11<br>
|
||||
<strong>VT_BSTR</strong> = 8<br>
|
||||
<strong>VT_CARRAY</strong> = 28<br>
|
||||
<strong>VT_CF</strong> = 71<br>
|
||||
<strong>VT_CLSID</strong> = 72<br>
|
||||
<strong>VT_CY</strong> = 6<br>
|
||||
<strong>VT_DATE</strong> = 7<br>
|
||||
<strong>VT_DECIMAL</strong> = 14<br>
|
||||
<strong>VT_DISPATCH</strong> = 9<br>
|
||||
<strong>VT_EMPTY</strong> = 0<br>
|
||||
<strong>VT_ERROR</strong> = 10<br>
|
||||
<strong>VT_FILETIME</strong> = 64<br>
|
||||
<strong>VT_HRESULT</strong> = 25<br>
|
||||
<strong>VT_I1</strong> = 16<br>
|
||||
<strong>VT_I2</strong> = 2<br>
|
||||
<strong>VT_I4</strong> = 3<br>
|
||||
<strong>VT_I8</strong> = 20<br>
|
||||
<strong>VT_INT</strong> = 22<br>
|
||||
<strong>VT_LPSTR</strong> = 30<br>
|
||||
<strong>VT_LPWSTR</strong> = 31<br>
|
||||
<strong>VT_NULL</strong> = 1<br>
|
||||
<strong>VT_PTR</strong> = 26<br>
|
||||
<strong>VT_R4</strong> = 4<br>
|
||||
<strong>VT_R8</strong> = 5<br>
|
||||
<strong>VT_SAFEARRAY</strong> = 27<br>
|
||||
<strong>VT_STORAGE</strong> = 67<br>
|
||||
<strong>VT_STORED_OBJECT</strong> = 69<br>
|
||||
<strong>VT_STREAM</strong> = 66<br>
|
||||
<strong>VT_STREAMED_OBJECT</strong> = 68<br>
|
||||
<strong>VT_UI1</strong> = 17<br>
|
||||
<strong>VT_UI2</strong> = 18<br>
|
||||
<strong>VT_UI4</strong> = 19<br>
|
||||
<strong>VT_UI8</strong> = 21<br>
|
||||
<strong>VT_UINT</strong> = 23<br>
|
||||
<strong>VT_UNKNOWN</strong> = 13<br>
|
||||
<strong>VT_USERDEFINED</strong> = 29<br>
|
||||
<strong>VT_VARIANT</strong> = 12<br>
|
||||
<strong>VT_VECTOR</strong> = 4096<br>
|
||||
<strong>VT_VOID</strong> = 24<br>
|
||||
<strong>WORD_CLSID</strong> = '00020900-0000-0000-C000-000000000046'<br>
|
||||
<strong>__author__</strong> = 'Philippe Lagadec'<br>
|
||||
<strong>__date__</strong> = '2015-01-24'<br>
|
||||
<strong>__version__</strong> = '0.42'<br>
|
||||
<strong>keyword</strong> = 'VT_UNKNOWN'<br>
|
||||
<strong>print_function</strong> = _Feature((2, 6, 0, 'alpha', 2), (3, 0, 0, 'alpha', 0), 65536)<br>
|
||||
<strong>var</strong> = 13</td></tr></table><p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#7799ee">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Author</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#7799ee"><tt> </tt></td><td> </td>
|
||||
<td width="100%">Philippe Lagadec</td></tr></table>
|
||||
</body></html>
|
||||
2696
backend_service/venv/lib/python3.13/site-packages/olefile/olefile.py
Normal file
2696
backend_service/venv/lib/python3.13/site-packages/olefile/olefile.py
Normal file
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,241 @@
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
||||
<html><head><title>Python: module olefile2</title>
|
||||
</head><body bgcolor="#f0f0f8">
|
||||
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="heading">
|
||||
<tr bgcolor="#7799ee">
|
||||
<td valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"> <br><big><big><strong>olefile2</strong></big></big> (version 0.40py2, 2014-10-01)</font></td
|
||||
><td align=right valign=bottom
|
||||
><font color="#ffffff" face="helvetica, arial"><a href=".">index</a><br><a href="file:./olefile2.py">.\olefile2.py</a></font></td></tr></table>
|
||||
<p><tt>olefile2 (formerly OleFileIO_PL2) version 0.40py2 2014-10-01<br>
|
||||
<br>
|
||||
Module to read Microsoft OLE2 files (also called Structured Storage or<br>
|
||||
Microsoft Compound Document File Format), such as Microsoft Office<br>
|
||||
documents, Image Composer and FlashPix files, Outlook messages, ...<br>
|
||||
<br>
|
||||
IMPORTANT NOTE: olefile2 is an old version of olefile meant to be used<br>
|
||||
as fallback for Python 2.5 and older. For Python 2.6, 2.7 and 3.x, please use<br>
|
||||
olefile which is more up-to-date. The improvements in olefile might<br>
|
||||
not always be backported to olefile2.<br>
|
||||
<br>
|
||||
Project website: <a href="http://www.decalage.info/python/olefileio">http://www.decalage.info/python/olefileio</a><br>
|
||||
<br>
|
||||
olefile2 is copyright (c) 2005-2014 Philippe Lagadec (<a href="http://www.decalage.info">http://www.decalage.info</a>)<br>
|
||||
<br>
|
||||
olefile2 is based on the <a href="#OleFileIO">OleFileIO</a> module from the PIL library v1.1.6<br>
|
||||
See: <a href="http://www.pythonware.com/products/pil/index.htm">http://www.pythonware.com/products/pil/index.htm</a><br>
|
||||
<br>
|
||||
The Python Imaging Library (PIL) is<br>
|
||||
Copyright (c) 1997-2005 by Secret Labs AB<br>
|
||||
Copyright (c) 1995-2005 by Fredrik Lundh<br>
|
||||
<br>
|
||||
See source code and LICENSE.txt for information on usage and redistribution.</tt></p>
|
||||
<p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#aa55cc">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Modules</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#aa55cc"><tt> </tt></td><td> </td>
|
||||
<td width="100%"><table width="100%" summary="list"><tr><td width="25%" valign=top><a href="StringIO.html">StringIO</a><br>
|
||||
<a href="array.html">array</a><br>
|
||||
</td><td width="25%" valign=top><a href="datetime.html">datetime</a><br>
|
||||
<a href="os.html">os</a><br>
|
||||
</td><td width="25%" valign=top><a href="string.html">string</a><br>
|
||||
<a href="struct.html">struct</a><br>
|
||||
</td><td width="25%" valign=top><a href="sys.html">sys</a><br>
|
||||
</td></tr></table></td></tr></table><p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#ee77aa">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Classes</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#ee77aa"><tt> </tt></td><td> </td>
|
||||
<td width="100%"><dl>
|
||||
<dt><font face="helvetica, arial"><a href="olefile2.html#OleFileIO">OleFileIO</a>
|
||||
</font></dt></dl>
|
||||
<p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#ffc8d8">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#000000" face="helvetica, arial"><a name="OleFileIO">class <strong>OleFileIO</strong></a></font></td></tr>
|
||||
|
||||
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
|
||||
<td colspan=2><tt>OLE container object<br>
|
||||
<br>
|
||||
This class encapsulates the interface to an OLE 2 structured<br>
|
||||
storage file. Use the {@link listdir} and {@link openstream} methods to<br>
|
||||
access the contents of this file.<br>
|
||||
<br>
|
||||
Object names are given as a list of strings, one for each subentry<br>
|
||||
level. The root entry should be omitted. For example, the following<br>
|
||||
code extracts all image streams from a Microsoft Image Composer file:<br>
|
||||
<br>
|
||||
ole = <a href="#OleFileIO">OleFileIO</a>("fan.mic")<br>
|
||||
<br>
|
||||
for entry in ole.<a href="#OleFileIO-listdir">listdir</a>():<br>
|
||||
if entry[1:2] == "Image":<br>
|
||||
fin = ole.<a href="#OleFileIO-openstream">openstream</a>(entry)<br>
|
||||
fout = <a href="#OleFileIO-open">open</a>(entry[0:1], "wb")<br>
|
||||
while True:<br>
|
||||
s = fin.read(8192)<br>
|
||||
if not s:<br>
|
||||
break<br>
|
||||
fout.write(s)<br>
|
||||
<br>
|
||||
You can use the viewer application provided with the Python Imaging<br>
|
||||
Library to view the resulting files (which happens to be standard<br>
|
||||
TIFF files).<br> </tt></td></tr>
|
||||
<tr><td> </td>
|
||||
<td width="100%">Methods defined here:<br>
|
||||
<dl><dt><a name="OleFileIO-__init__"><strong>__init__</strong></a>(self, filename<font color="#909090">=None</font>, raise_defects<font color="#909090">=40</font>)</dt><dd><tt>Constructor for <a href="#OleFileIO">OleFileIO</a> class.<br>
|
||||
<br>
|
||||
filename: file to open.<br>
|
||||
raise_defects: minimal level for defects to be raised as exceptions.<br>
|
||||
(use DEFECT_FATAL for a typical application, DEFECT_INCORRECT for a<br>
|
||||
security-oriented application, see source code for details)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-close"><strong>close</strong></a>(self)</dt><dd><tt>close the OLE file, to release the file object</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-dumpdirectory"><strong>dumpdirectory</strong></a>(self)</dt><dd><tt>Dump directory (for debugging only)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-dumpfat"><strong>dumpfat</strong></a>(self, fat, firstindex<font color="#909090">=0</font>)</dt><dd><tt>Displays a part of FAT in human-readable form for debugging purpose</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-dumpsect"><strong>dumpsect</strong></a>(self, sector, firstindex<font color="#909090">=0</font>)</dt><dd><tt>Displays a sector in a human-readable form, for debugging purpose.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-exists"><strong>exists</strong></a>(self, filename)</dt><dd><tt>Test if given filename exists as a stream or a storage in the OLE<br>
|
||||
container.<br>
|
||||
<br>
|
||||
filename: path of stream in storage tree. (see openstream for syntax)<br>
|
||||
return: True if object exist, else False.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-get_metadata"><strong>get_metadata</strong></a>(self)</dt><dd><tt>Parse standard properties streams, return an OleMetadata object<br>
|
||||
containing all the available metadata.<br>
|
||||
(also stored in the metadata attribute of the <a href="#OleFileIO">OleFileIO</a> object)<br>
|
||||
<br>
|
||||
new in version 0.25</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-get_rootentry_name"><strong>get_rootentry_name</strong></a>(self)</dt><dd><tt>Return root entry name. Should usually be 'Root Entry' or 'R' in most<br>
|
||||
implementations.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-get_size"><strong>get_size</strong></a>(self, filename)</dt><dd><tt>Return size of a stream in the OLE container, in bytes.<br>
|
||||
<br>
|
||||
filename: path of stream in storage tree (see openstream for syntax)<br>
|
||||
return: size in bytes (long integer)<br>
|
||||
raise: IOError if file not found, TypeError if this is not a stream.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-get_type"><strong>get_type</strong></a>(self, filename)</dt><dd><tt>Test if given filename exists as a stream or a storage in the OLE<br>
|
||||
container, and return its type.<br>
|
||||
<br>
|
||||
filename: path of stream in storage tree. (see openstream for syntax)<br>
|
||||
return: False if object does not exist, its entry type (>0) otherwise:<br>
|
||||
- STGTY_STREAM: a stream<br>
|
||||
- STGTY_STORAGE: a storage<br>
|
||||
- STGTY_ROOT: the root entry</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-getctime"><strong>getctime</strong></a>(self, filename)</dt><dd><tt>Return creation time of a stream/storage.<br>
|
||||
<br>
|
||||
filename: path of stream/storage in storage tree. (see openstream for<br>
|
||||
syntax)<br>
|
||||
return: None if creation time is null, a python datetime object<br>
|
||||
otherwise (UTC timezone)<br>
|
||||
<br>
|
||||
new in version 0.26</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-getmtime"><strong>getmtime</strong></a>(self, filename)</dt><dd><tt>Return modification time of a stream/storage.<br>
|
||||
<br>
|
||||
filename: path of stream/storage in storage tree. (see openstream for<br>
|
||||
syntax)<br>
|
||||
return: None if modification time is null, a python datetime object<br>
|
||||
otherwise (UTC timezone)<br>
|
||||
<br>
|
||||
new in version 0.26</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-getproperties"><strong>getproperties</strong></a>(self, filename, convert_time<font color="#909090">=False</font>, no_conversion<font color="#909090">=None</font>)</dt><dd><tt>Return properties described in substream.<br>
|
||||
<br>
|
||||
filename: path of stream in storage tree (see openstream for syntax)<br>
|
||||
convert_time: bool, if True timestamps will be converted to Python datetime<br>
|
||||
no_conversion: None or list of int, timestamps not to be converted<br>
|
||||
(for example total editing time is not a real timestamp)<br>
|
||||
return: a dictionary of values indexed by id (integer)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-getsect"><strong>getsect</strong></a>(self, sect)</dt><dd><tt>Read given sector from file on disk.<br>
|
||||
sect: sector index<br>
|
||||
returns a string containing the sector data.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-listdir"><strong>listdir</strong></a>(self, streams<font color="#909090">=True</font>, storages<font color="#909090">=False</font>)</dt><dd><tt>Return a list of streams stored in this file<br>
|
||||
<br>
|
||||
streams: bool, include streams if True (True by default) - new in v0.26<br>
|
||||
storages: bool, include storages if True (False by default) - new in v0.26<br>
|
||||
(note: the root storage is never included)</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-loaddirectory"><strong>loaddirectory</strong></a>(self, sect)</dt><dd><tt>Load the directory.<br>
|
||||
sect: sector index of directory stream.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-loadfat"><strong>loadfat</strong></a>(self, header)</dt><dd><tt>Load the FAT table.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-loadfat_sect"><strong>loadfat_sect</strong></a>(self, sect)</dt><dd><tt>Adds the indexes of the given sector to the FAT<br>
|
||||
sect: string containing the first FAT sector, or array of long integers<br>
|
||||
return: index of last FAT sector.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-loadminifat"><strong>loadminifat</strong></a>(self)</dt><dd><tt>Load the MiniFAT table.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-open"><strong>open</strong></a>(self, filename)</dt><dd><tt>Open an OLE2 file.<br>
|
||||
Reads the header, FAT and directory.<br>
|
||||
<br>
|
||||
filename: string-like or file-like object</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-openstream"><strong>openstream</strong></a>(self, filename)</dt><dd><tt>Open a stream as a read-only file object (StringIO).<br>
|
||||
<br>
|
||||
filename: path of stream in storage tree (except root entry), either:<br>
|
||||
- a string using Unix path syntax, for example:<br>
|
||||
'storage_1/storage_1.2/stream'<br>
|
||||
- a list of storage filenames, path to the desired stream/storage.<br>
|
||||
Example: ['storage_1', 'storage_1.2', 'stream']<br>
|
||||
return: file object (read-only)<br>
|
||||
raise IOError if filename not found, or if this is not a stream.</tt></dd></dl>
|
||||
|
||||
<dl><dt><a name="OleFileIO-sect2array"><strong>sect2array</strong></a>(self, sect)</dt><dd><tt>convert a sector to an array of 32 bits unsigned integers,<br>
|
||||
swapping bytes on big endian CPUs such as PowerPC (old Macs)</tt></dd></dl>
|
||||
|
||||
</td></tr></table></td></tr></table><p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#eeaa77">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Functions</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#eeaa77"><tt> </tt></td><td> </td>
|
||||
<td width="100%"><dl><dt><a name="-isOleFile"><strong>isOleFile</strong></a>(filename)</dt><dd><tt>Test if file is an OLE container (according to its header).<br>
|
||||
filename: file name or path (str, unicode)<br>
|
||||
return: True if OLE, False otherwise.</tt></dd></dl>
|
||||
</td></tr></table><p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#55aa55">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Data</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#55aa55"><tt> </tt></td><td> </td>
|
||||
<td width="100%"><strong>DEFECT_FATAL</strong> = 40<br>
|
||||
<strong>DEFECT_INCORRECT</strong> = 30<br>
|
||||
<strong>DEFECT_POTENTIAL</strong> = 20<br>
|
||||
<strong>DEFECT_UNSURE</strong> = 10<br>
|
||||
<strong>STGTY_EMPTY</strong> = 0<br>
|
||||
<strong>STGTY_LOCKBYTES</strong> = 3<br>
|
||||
<strong>STGTY_PROPERTY</strong> = 4<br>
|
||||
<strong>STGTY_ROOT</strong> = 5<br>
|
||||
<strong>STGTY_STORAGE</strong> = 1<br>
|
||||
<strong>STGTY_STREAM</strong> = 2<br>
|
||||
<strong>__all__</strong> = ['OleFileIO', 'isOleFile', 'DEFECT_UNSURE', 'STGTY_STREAM', 'DEFECT_FATAL', 'STGTY_EMPTY', 'STGTY_LOCKBYTES', 'STGTY_STORAGE', 'STGTY_PROPERTY', 'DEFECT_INCORRECT', 'DEFECT_POTENTIAL', 'STGTY_ROOT']<br>
|
||||
<strong>__author__</strong> = 'Philippe Lagadec'<br>
|
||||
<strong>__date__</strong> = '2014-10-01'<br>
|
||||
<strong>__version__</strong> = '0.40py2'</td></tr></table><p>
|
||||
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
|
||||
<tr bgcolor="#7799ee">
|
||||
<td colspan=3 valign=bottom> <br>
|
||||
<font color="#ffffff" face="helvetica, arial"><big><strong>Author</strong></big></font></td></tr>
|
||||
|
||||
<tr><td bgcolor="#7799ee"><tt> </tt></td><td> </td>
|
||||
<td width="100%">Philippe Lagadec</td></tr></table>
|
||||
</body></html>
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user