decalage2 / oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
http://www.decalage.info/python/oletools
Other
2.81k stars 560 forks source link

mraptor: should ignore directories when using wildcards #829

Open catafest opened 9 months ago

catafest commented 9 months ago

I run it with administrator rights. I got this:

C:\WINDOWS\system32>mraptor "C:\*"
MacroRaptor 0.56.2 - http://decalage.info/python/oletools
This is work in progress, please report issues at https://github.com/decalage2/oletools/issues
----------+-----+----+--------------------------------------------------------
Result    |Flags|Type|File
----------+-----+----+--------------------------------------------------------
ERROR     |     |??? |C:\$RECYCLE.BIN
          |     |    |[Errno 13] Permission denied: 'C:\\$RECYCLE.BIN'
ERROR     |     |??? |C:\android
          |     |    |[Errno 13] Permission denied: 'C:\\android'
ERROR     |     |??? |C:\Arc
          |     |    |[Errno 13] Permission denied: 'C:\\Arc'
Macro OK  |---  |TXT:|C:\av.mof
ERROR     |     |??? |C:\BACKUP
          |     |    |[Errno 13] Permission denied: 'C:\\BACKUP'
ERROR     |     |??? |C:\blender-4.1.0-alpha+main.f54205cfdd11-windows.amd64-
          |     |    |release
          |     |    |[Errno 13] Permission denied: 'C:\\blender-4.1.0-
          |     |    |alpha+main.f54205cfdd11-windows.amd64-release'
ERROR     |     |??? |C:\BlenderCache
          |     |    |[Errno 13] Permission denied: 'C:\\BlenderCache'
decalage2 commented 8 months ago

It's normal that some system files like $recycle.bin are not accessible to administrators by default, access is prevented by access list. Moreover here you are asking mraptor to scan C:*, which includes directories and triggers read errors. I agree that it would look better if mraptor ignored anything that is not a file. That can be fixed. (note that it is not related to the fact that it is running as admin or not, so I will change the issue title)