Oledump

Description

oledump.py is a program to analyze OLE files (Compound File Binary Format). These files contain streams of data. oledump allows you to analyze these streams.

Many applications use this file format, the best known is MS Office. .doc, .xls, .ppt, … are OLE files (docx, xlsx, … is the new file format: XML inside ZIP).

Installation

Prerequisites

OleFileIO_PL

$ sudo pip install OleFileIO_PL

Yara (optional)

Refer to this page.

Installation of oledump

$ mkdir -p /data/tools/oledump/
$ cd /data/tools/oledump/
$ wget http://didierstevens.com/files/software/oledump_V0_0_16.zip
$ unzip oledump_V0_0_16.zip

Usage

Syntax

Usage: oledump.py [options] [file]

Options

--version

show program's version number and exit

-h, --help

show this help message and exit

-m, --man

Print manual

-s SELECT, --select=SELECT

select item nr for dumping (a for all)

-d, --dump

perform dump

-x, --hexdump

perform hex dump

-a, --asciidump

perform ascii dump

-v, --vbadecompress

VBA decompression

-r, --raw

read raw file (use with options -v or -p

-e, --extract

extract OLE embedded file

-i, --info

print extra info for selected item

-p PLUGINS, --plugins=PLUGINS

plugins to load (separate plugins with a comma , ; @file supported)

--pluginoptions=PLUGINOPTIONS

options for the plugin

-q, --quiet

only print output from plugins

-y YARA, --yara=YARA

YARA rule-file, @file or directory to check streams (YARA search doesn't work with -s option)

-D DECODERS, --decoders=DECODERS

decoders to load (separate decoders with a comma , ; @file supported)

--decoderoptions=DECODEROPTIONS

options for the decoder

--yarastrings

Print YARA strings

-M, --metadata

Print metadata

-c, --calc

Add extra calculated data to output, like hashes

--decompress

Search for compressed data in the stream and decompress it

--verbose

verbose output for plugins and decoders

Use cases

List streams

$ ./oledump.py /data/tmp/3e2c3e6904dda6fb9174713a34f44126
  1:      1376 'PROJECT'
  2:       614 'PROJECTwm'
  3: m     999 'VBA/Class1'
  4: m    1000 'VBA/Class10'
  5: m    1000 'VBA/Class11'
  6: m    1000 'VBA/Class12'
  7: m    1000 'VBA/Class13'
  8: m    1000 'VBA/Class14'
  9: m    1000 'VBA/Class15'
 10: m    1000 'VBA/Class16'
 11: m    1000 'VBA/Class17'
 12: m    1000 'VBA/Class18'
 13: m    1000 'VBA/Class19'
 14: m     999 'VBA/Class2'
 15: m    1000 'VBA/Class20'
 16: m    1000 'VBA/Class21'
 17: m    1000 'VBA/Class22'
 18: m    1000 'VBA/Class23'
 19: m    1000 'VBA/Class24'
 20: m     999 'VBA/Class3'
 21: m     999 'VBA/Class4'
 22: m     999 'VBA/Class5'
 23: m     999 'VBA/Class6'
 24: m     999 'VBA/Class7'
 25: m     999 'VBA/Class8'
 26: m     999 'VBA/Class9'
 27: M   13185 'VBA/Module1'
 28: M    1384 'VBA/ThisDocument'
 29:      6942 'VBA/_VBA_PROJECT'
 30:      1154 'VBA/dir'

Comments

Keywords: oledump ole doc xls ppt macro