decalage2 / oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
http://www.decalage.info/python/oletools
Other
2.81k stars 560 forks source link

ftguess: add strict/safe mode to match extension to file formats #848

Open decalage2 opened 3 months ago

decalage2 commented 3 months ago

add an exefilter-like mode, to recognize file types in a stricter/safer way by matching file extension and content, and avoid issue with polyglots:

  1. if the filename has an extension, find all the formats matching that extension
  2. then check each of those formats, if they recognise the file content with a proper structure
  3. if none of the formats matches the file extension, issue a warning that the format is incorrect or not supported, or the file extension is incorrect
  4. otherwise if the filename has no extension, or a generic extension like ".bin" or an extension not known by ftguess, guess the file type with the usual ftguess algorithm (and display a warning)

With this mode, ftguess will enforce that a file has a proper extension matching its content.