6 Commits (2e55c901b1b0571a340602ee2681255876f63f1a)

Author	SHA1	Message	Date
mko-x	a21cc6dcd7	Add explicit log level parameter to application logging API ... * Added loglevel parameter to logg() * Fix logg and mprintf internals with new loglevels * Update all logg calls to set loglevel * Update all mprintf calls to set loglevel * Fix hidden logg calls * Executed clam-format	4 years ago
micasnyd	140c88aa4e	Bump copyright for 2022 ... Includes minor format corrections.	4 years ago
Micah Snyder	7c25968eb9	OLE2: doc summary, emb. ole10 scans skipped if XLM macro found ... Also resolved the following issue: If XLM (and now images) are found when parsing an ole2 files the following other embedded content may not be processed: - document summary metadata - embedded ole10 files - ole2 temp subdirectories (i.e. recursion) The logic to process the above ole2 extracted temp files was present in the function which processes extracted VBA. When we added support for extracting XLM macros, processing these other data was lost. Really, the above need to be processed if any temp files were saved. I fixed this by restructuring the features to extract any type of temp file into separate functions per type of temp file. I then wrappped those in an ole2 temp dir scanning function. OLE2 temp directory scanning is recursive if there are subdirectories.	4 years ago
Micah Snyder	90e4d66f7c	OLE2 / XLS document image extraction ... Added a feature to extract images from OLE2 BIFF streams. This work was derived from InQuests blog post about extracting XLM and images from XLS files: https://inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files Assorted ole2 parser code cleanup and massive error handling cleanup. Also fixed the following: - The XLS parser may fail to process all BIFF records if some of the records contain unexpected data or is otherwise malformed. Because the record size is already known, we can skip over the "malformed" record and continue with the rest. - Fixed an issue where the ole2 header size was improperly calculated, failing to account for the new "has_xlm" boolean added for context.	4 years ago
Micah Snyder (micasnyd)	b9ca6ea103	Update copyright dates for 2021 ... Also fixes up clang-format.	5 years ago
Jonas Zaddach (jzaddach)	d5a733ef90	XLM (Excel 4.0) macro detection and extraction ... XLM is a macro language in Excel that was used before VBA (before 1996). It is still parsed and executed by modern Excel and is gaining popularity with malware authors. This patch adds rudimentary support for detecting and extracting Excel 4.0 (XLM) macros. The code is based on Didier Steven's plugin_biff for oletools.py.	6 years ago