add VT_VECTOR support for properties

decalage2 / olefile

olefile is a Python package to parse, read and write Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, vbaProject.bin in MS Office 2007+ files, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.

http://www.decalage.info/olefile

Other

231 stars 77 forks source link

add VT_VECTOR support for properties #135

Closed mak closed 4 years ago

coveralls commented 4 years ago

Coverage increased (+0.9%) to 56.986% when pulling 8cc753d6fd56231a45dd30230d73911cb6620578 on MalwareLab-pl:master into d344bc25e0f6f549e1b6d48cf40af76cdac70f9b on decalage2:master.

decalage2 commented 4 years ago

Thanks a lot @mak, nice addition! By any chance, do you have sample files containing different kinds of VT_VECTOR, so that I can test it?

mak commented 4 years ago

Thanks, i used recent zloader lures, for example: 5c7052b45ada75b48b04026e3adb6460. It has vector + string and vector+variant. vector + string should be easy to obtain by creating xls with few sheets