decalage2/oletools

Found xlm_macros even if in empty xls document

nurpabuccu opened this issue · 0 comments

Affected tool:
olevba

Describe the bug
When using extract_macros function after detect_macros executed, i realized it adds not macro sheets to xlm_macros list. _extract_xlm_plugin_biff function causes this issue.It finds BOUNDSHEET records without Excel 4.0 macro sheet in it and doesn't clear the list when it doesn't contain macro.

How To Reproduce the bug
It extracts xlm_maros stream even in empty xls files.

Expected behavior
nurpabuccu/oletools@29aca49 fixes this issue

Console output

from oletools.olevba import VBA_Parser
vbaparser = VBA_Parser(filepath)
vbaparser.detect_macros()
for (filename, stream_path, vba_filename, vba_code) in vbaparser.extract_macros():
    print('-'*79)
    print('Filename    :', filename)
    print('OLE stream  :', stream_path)
    print('VBA filename:', vba_filename)
    print('- '*39)
    print(vba_code)

---output---

OLE stream  : xlm_macro
VBA filename: xlm_macro.txt
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
' 0085     13 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet1
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet2
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet3
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet4
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Sheet5

Version information:

  • OS: Mac
  • OS version: 12.6
  • Python version: 3.8 - 64 bits
  • oletools version: 0.60.1