decalage2/oletools

下载页面

不同的Python脚本提取的内容（个人工作向笔记）

OLE

olebrowse.py

oledir.py

oleform.py

oleid.py

• 语言
• 作者
• 是否存在Macros（宏代码）
  • VBA
  • XLM

--------------------+--------------------+----------+--------------------------
Indicator           |Value               |Risk      |Description
--------------------+--------------------+----------+--------------------------
File format         |MS Word 97-2003     |info      |
                    |Document or Template|          |
--------------------+--------------------+----------+--------------------------
Container format    |OLE                 |info      |Container type
--------------------+--------------------+----------+--------------------------
Application name    |Microsoft Office    |info      |Application name declared
                    |Word                |          |in properties
--------------------+--------------------+----------+--------------------------
Properties code page|1254: ANSI Turkish; |info      |Code page used for
                    |Turkish (Windows)   |          |properties
--------------------+--------------------+----------+--------------------------
Author              |kinger              |info      |Author declared in
                    |                    |          |properties
--------------------+--------------------+----------+--------------------------
Encrypted           |False               |none      |The file is not encrypted
--------------------+--------------------+----------+--------------------------
VBA Macros          |No                  |none      |This file does not contain
                    |                    |          |VBA macros.
--------------------+--------------------+----------+--------------------------
XLM Macros          |No                  |none      |This file does not contain
                    |                    |          |Excel 4/XLM macros.
--------------------+--------------------+----------+--------------------------
External            |0                   |none      |External relationships
Relationships       |                    |          |such as remote templates,
                    |                    |          |remote OLE objects, etc
--------------------+--------------------+----------+--------------------------

olemap.py

olemeta.py

• title：标题
• subject：主题
• author：作者
• keywords：关键字
• comments：评论
• last_saved_by：最后保存者
• last_saved_time：最后保存时间
• create_time：创建时间
• total_edit_time：总编辑时长

Properties from the SummaryInformation stream:
+---------------------+------------------------------+
|Property             |Value                         |
+---------------------+------------------------------+
|codepage             |1254                          |
|title                |nominelo                      |
|subject              |Topara                        |
|author               |kinger                        |
|keywords             |Nunc lobortis mattis aliquam  |
|                     |faucibus puru                 |
|comments             |Turpis cursus in hac habitasse|
|                     |platea dictumst quisque. Velit|
|                     |laoreet id donec ultrices. At |
|                     |elementum eu facilisis sed. In|
|                     |pellentesque massa placerat   |
|                     |duis ultricies lacus sed      |
|                     |turpis. Purus ut faucibus     |
|                     |pulvinar elementum integer    |
|                     |enim neque volutpat. Magna    |
|                     |eget est lorem ipsum dolor sit|
|                     |amet consectetur. Eget aliquet|
|                     |nibh praesent tristique.      |
|template             |Normal.dotm                   |
|last_saved_by        |--                            |
|revision_number      |1                             |
|total_edit_time      |0                             |
|create_time          |2018-03-01 23:16:00           |
|last_saved_time      |2018-03-01 23:16:00           |
|num_pages            |1                             |
|num_words            |0                             |
|num_chars            |3                             |
|creating_application |Microsoft Office Word         |
|security             |0                             |
+---------------------+------------------------------+

Properties from the DocumentSummaryInformation stream:
+---------------------+------------------------------+
|Property             |Value                         |
+---------------------+------------------------------+
|codepage_doc         |1254                          |
|bytes                |11000                         |
|lines                |1                             |
|paragraphs           |1                             |
|scale_crop           |False                         |
|company              |--                            |
|links_dirty          |False                         |
|chars_with_spaces    |3                             |
|shared_doc           |False                         |
|hlinks_changed       |False                         |
|version              |1048576                       |
+---------------------+------------------------------+

oleobj.py

oletimes.py

olevba.py

olevba3.py