/ open-webui.git / app / env / lib64 / python3.11 / site-packages / oletools / doc / Changelog.md

Python-oletools Changelog ========================= - **2024-07-02 v0.60.2**: - olevba: - fixed a bug in open_slk (issue #797, PR #769) - fixed a bug due to new PROJECTCOMPATVERSION record in dir stream (PR #723, issues #700, #701, #725, #791, #808, #811, #833) - oleobj: fixed SyntaxError with Python 3.12 (PR #855), SyntaxWarning (PR #774) - rtfobj: fixed SyntaxError with Python 3.12 (PR #854) - clsid: added CLSIDs for MSI, Zed - ftguess: added MSI, PNG and OneNote formats - pyxswf: fixed python 3.12 compatibility (PR #841, issue #813) - setup/requirements: allow pyparsing 3 to solve install issues (PR #812, issue #762) - **2022-05-09 v0.60.1**: - olevba: - fixed a bug when calling XLMMacroDeobfuscator (PR #737) - removed keyword "sample" causing false positives - oleid: fixed OleID init issue (issue #695, PR #696) - oleobj: - added simple detection of CVE-2021-40444 initial stage - added detection for customUI onLoad - improved handling of incorrect filenames in OLE package (PR #451) - rtfobj: fixed code to find URLs in OLE2Link objects for Py3 (issue #692) - ftguess: - added PowerPoint and XPS formats (PR #716) - fixed issue with XPS and malformed documents (issue #711) - added XLSB format (issue #758) - improved logging with common module log_helper (PR #449) - **2021-06-02 v0.60**: - ftguess: new tool to identify file formats and containers (issue #680) - oleid: (issue #679) - each indicator now has a risk level - calls ftguess to identify file formats - calls olevba+mraptor to detect and analyse VBA+XLM macros - olevba: - when XLMMacroDeobfuscator is available, use it to extract and deobfuscate XLM macros - rtfobj: - use ftguess to identify file type of OLE Package (issue #682) - fixed bug in re_executable_extensions - crypto: added PowerPoint transparent password '/01Hannes Ruescher/01' (issue #627) - setup: XLMMacroDeobfuscator, xlrd2 and pyxlsb2 added as optional dependencies - **2021-05-07 v0.56.2**: - olevba: - updated plugin_biff to v0.0.22 to fix a bug (issues #647, #674) - olevba, mraptor: - added detection of Workbook_BeforeClose (issue #518) - rtfobj: - fixed bug when OLE package class name ends with null characters (issue #507, PR #648) - oleid: - fixed bug in check_excel (issue #584, PR #585) - clsid: - added several CLSIDs related to MS Office click-to-run issue CVE-2021-27058 - added checks to ensure that all CLSIDs are uppercase (PR #678) - **2021-04-02 v0.56.1**: - olevba: - fixed bug when parsing some malformed files (issue #629) - oleobj: - fixed bug preventing detection of links 'externalReference', 'frame', 'hyperlink' (issue #641, PR #670) - setup: - avoid installing msoffcrypto-tool when platform is PyPy+Windows (issue #473) - PyPI version is now a wheel package to improve installation and avoid antivirus false positives due to test files (issues #215, #398) - **2020-09-28 v0.56**: - olevba/mraptor: - added detection of trigger _OnConnecting - olevba: - updated plugin_biff to v0.0.17 to improve Excel 4/XLM macros parsing - added simple analysis of Excel 4/XLM macros in XLSM files (PR #569) - added detection of template injection (PR #569) - added detection of many suspicious keywords (PR #591 and #569, see https://www.certego.net/en/news/advanced-vba-macros/) - improved MHT detection (PR #532) - added --no-xlm option to disable Excel 4/XLM macros parsing (PR #532) - fixed bug when decompressing raw chunks in VBA (issue #575) - fixed bug with email package due to monkeypatch for MHT parsing (issue #602, PR #604) - fixed option --relaxed (issue #596, PR #595) - enabled relaxed mode by default (issues #477, #593) - fixed detect_vba_macros to always return VBA code as unicode on Python 3 (issues #455, #477, #587, #593) - replaced option --pcode by --show-pcode and --no-pcode, replaced optparse by argparse (PR #479) - oleform: improved form parsing (PR #532) - oleobj: "Ole10Native" is now case insensitive (issue #541) - clsid: added PDF (issue #552), Microsoft Word Picture (issue #571) - ppt_parser: fixed bug on Python 3 (issues #177, #607, PR #450) - **2019-12-16 v0.55.2**: - rtfobj: - removed "\rtf" from the list of destination control words (issue #522) - fixed process_file to detect Equation class (issue #525) - **2019-12-03 v0.55**: - olevba: - added support for SLK files and XLM macro extraction from SLK - VBA Stomping detection - integrated pcodedmp to extract and disassemble P-code - detection of suspicious keywords and IOCs in P-code - new option --pcode to display P-code disassembly - improved detection of auto execution triggers - rtfobj: added URL carver for CVE-2017-0199 - better handling of unicode for systems with locale that does not support UTF-8, e.g. LANG=C (PR #365) - tests: - test files can now be encrypted, to avoid antivirus alerts (PR #217, issue #215) - tests that trigger antivirus alerts have been temporarily disabled (issue #215) - **2019-05-22 v0.54.2**: - msoffcrypto-tool is now a required dependency (simplified install) - plugin_biff: fixed issues #428, #434 and #444, improved Python 3 support - olevba, msodde, crypto: improved handling of encrypted files (PR #441) - olevba: initialize VBA_Parser.xlm_macros (fixes #433) - various fixes (PR #446) - olevba and msodde now handle documents encrypted with common passwords such as 123, 1234, 4321, 12345, 123456, VelvetSweatShop automatically. - **2019-04-09 v0.54.1**: - olevba: decompress_stream now accepts both bytes and bytearray (fixes #422) - **2019-04-04 v0.54**: - olevba, msodde: added support for encrypted MS Office files - olevba: added detection and extraction of XLM/XLF Excel 4 macros (thanks to plugin_biff from Didier Stevens' oledump) - olevba, mraptor: added detection of VBA running Excel 4 macros - olevba: detect and display special characters such as backspace - olevba: colorized output showing suspicious keywords in the VBA code - olevba, mraptor: full Python 3 compatibility, no separate olevba3/mraptor3 anymore - olevba: improved handling of code pages and unicode - olevba: fixed a false-positive in VBA macro detection - rtfobj: improved OLE Package handling, improved Equation object detection - oleobj: added detection of external links to objects in OpenXML - replaced third party packages by PyPI dependencies - **2018-06-13 v0.53.1**: - rtfobj: fixed issue #316, whitespace after \bin on Python 3 - olevba3: fixed #320, chr instead of unichr on python 3 - olevba3: fixed #322, import reduce from functools - **2018-05-30 v0.53**: - olevba and mraptor can now parse Word/PowerPoint 2007+ pure XML files (aka Flat OPC format) - improved support for VBA forms in olevba (oleform) - rtfobj now displays the CLSID of OLE objects, which is the best way to identify them. Known-bad CLSIDs such as MS Equation Editor are highlighted in red. - Updated rtfobj to handle obfuscated RTF samples. - rtfobj now handles the "\\'" obfuscation trick seen in recent samples such as https://twitter.com/buffaloverflow/status/989798880295444480, by emulating the MS Word bug described in https://securelist.com/disappearing-bytes/84017/ - msodde: improved detection of DDE formulas in CSV files - oledir now displays the tree of storage/streams, along with CLSIDs and their meaning. - common.clsid contains the list of known CLSIDs, and their links to CVE vulnerabilities when relevant. - oleid now detects encrypted OpenXML files - fixed bugs in oleobj, rtfobj, oleid, olevba - **2018-03-11 v0.52.2**: - Fixed issue #265 (error when installing on Python 3) - **2018-02-18 v0.52**: - New tool [msodde](https://github.com/decalage2/oletools/wiki/msodde) to detect and extract DDE links from MS Office files, RTF and CSV; - Fixed bugs in olevba, rtfobj and olefile, to better handle malformed/obfuscated files; - Performance improvements in olevba and rtfobj; - VBA form parsing in olevba; - Office 2007+ support in oleobj. - 2017-06-29 v0.51: - added the [oletools cheatsheet](https://github.com/decalage2/oletools/blob/master/cheatsheet/oletools_cheatsheet.pdf) - improved [rtfobj](https://github.com/decalage2/oletools/wiki/rtfobj) to handle malformed RTF files, detect vulnerability CVE-2017-0199 - olevba: improved deobfuscation and Mac files support - [mraptor](https://github.com/decalage2/oletools/wiki/mraptor): added more ActiveX macro triggers - added [DocVarDump.vba](https://github.com/decalage2/oletools/blob/master/oletools/DocVarDump.vba) to dump document variables using Word - olemap: can now detect and extract [extra data at end of file](http://decalage.info/en/ole_extradata), improved display - oledir, olemeta, oletimes: added support for zip files and wildcards - many [bugfixes](https://github.com/decalage2/oletools/milestone/3?closed=1) in all the tools - improved Python 2+3 support - 2016-11-01 v0.50: all oletools now support python 2 and 3. - olevba: several bugfixes and improvements. - mraptor: improved detection, added mraptor_milter for Sendmail/Postfix integration. - rtfobj: brand new RTF parser, obfuscation-aware, improved display, detect executable files in OLE Package objects. - setup: now creates handy command-line scripts to run oletools from any directory. - 2016-06-10 v0.47: [olevba](https://github.com/decalage2/oletools/wiki/olevba) added PPT97 macros support, improved handling of malformed/incomplete documents, improved error handling and JSON output, now returns an exit code based on analysis results, new --relaxed option. [rtfobj](https://github.com/decalage2/oletools/wiki/rtfobj): improved parsing to handle obfuscated RTF documents, added -d option to set output dir. Moved repository and documentation to GitHub. - 2016-04-19 v0.46: [olevba](https://github.com/decalage2/oletools/wiki/olevba) does not deobfuscate VBA expressions by default (much faster), new option --deobf to enable it. Fixed color display bug on Windows for several tools. - 2016-04-12 v0.45: improved [rtfobj](https://github.com/decalage2/oletools/wiki/rtfobj) to handle several [anti-analysis tricks](http://www.decalage.info/rtf_tricks), improved [olevba](https://github.com/decalage2/oletools/wiki/olevba) to export results in JSON format. - 2016-03-11 v0.44: improved [olevba](https://github.com/decalage2/oletools/wiki/olevba) to extract and analyse strings from VBA Forms. - 2016-03-04 v0.43: added new tool [MacroRaptor](https://github.com/decalage2/oletools/wiki/mraptor) (mraptor) to detect malicious macros, bugfix and slight improvements in [olevba](https://github.com/decalage2/oletools/wiki/olevba). - 2016-02-07 v0.42: added two new tools oledir and olemap, better handling of malformed files and several bugfixes in [olevba](https://github.com/decalage2/oletools/wiki/olevba), improved display for [olemeta](https://github.com/decalage2/oletools/wiki/olemeta). - 2015-09-22 v0.41: added new --reveal option to [olevba](https://github.com/decalage2/oletools/wiki/olevba), to show the macro code with VBA strings deobfuscated. - 2015-09-17 v0.40: Improved macro deobfuscation in [olevba](https://github.com/decalage2/oletools/wiki/olevba), to decode Hex and Base64 within VBA expressions. Display printable deobfuscated strings by default. Improved the VBA_Parser API. Improved performance. Fixed [issue #23](https://github.com/decalage2/oletools/issues/23) with sys.stderr. - 2015-06-19 v0.12: [olevba](https://github.com/decalage2/oletools/wiki/olevba) can now deobfuscate VBA expressions with any combination of Chr, Asc, Val, StrReverse, Environ, +, &, using a VBA parser built with [pyparsing](http://pyparsing.wikispaces.com). New options to display only the analysis results or only the macros source code. The analysis is now done on all the VBA modules at once. - 2015-05-29 v0.11: Improved parsing of MHTML and ActiveMime/MSO files in [olevba](https://github.com/decalage2/oletools/wiki/olevba), added several suspicious keywords to VBA scanner (thanks to @ozhermit and Davy Douhine for the suggestions) - 2015-05-06 v0.10: [olevba](https://github.com/decalage2/oletools/wiki/olevba) now supports Word MHTML files with macros, aka "Single File Web Page" (.mht) - see [issue #10](https://github.com/decalage2/oletools/issues/10) for more info - 2015-03-23 v0.09: [olevba](https://github.com/decalage2/oletools/wiki/olevba) now supports Word 2003 XML files, added anti-sandboxing/VM detection - 2015-02-08 v0.08: [olevba](https://github.com/decalage2/oletools/wiki/olevba) can now decode strings obfuscated with Hex/StrReverse/Base64/Dridex and extract IOCs. Added new triage mode, support for non-western codepages with olefile 0.42, improved API and display, several bugfixes. - 2015-01-05 v0.07: improved [olevba](https://github.com/decalage2/oletools/wiki/olevba) to detect suspicious keywords and IOCs in VBA macros, can now scan several files and open password-protected zip archives, added a Python API, upgraded OleFileIO_PL to olefile v0.41 - 2014-08-28 v0.06: added [olevba](https://github.com/decalage2/oletools/wiki/olevba), a new tool to extract VBA Macro source code from MS Office documents (97-2003 and 2007+). Improved [documentation](https://github.com/decalage2/oletools/wiki) - 2013-07-24 v0.05: added new tools [olemeta](https://github.com/decalage2/oletools/wiki/olemeta) and [oletimes](https://github.com/decalage2/oletools/wiki/oletimes) - 2013-04-18 v0.04: fixed bug in rtfobj, added documentation for [rtfobj](https://github.com/decalage2/oletools/wiki/rtfobj) - 2012-11-09 v0.03: Improved [pyxswf](https://github.com/decalage2/oletools/wiki/pyxswf) to extract Flash objects from RTF - 2012-10-29 v0.02: Added [oleid](https://github.com/decalage2/oletools/wiki/oleid) - 2012-10-09 v0.01: Initial version of [olebrowse](https://github.com/decalage2/oletools/wiki/olebrowse) and pyxswf See also the changelog in each source file for more details.