decalage2/oletools issues and pull requests

#867 - Files in test-data triigerclamsca virus detections

Issue - State: open - Opened by brett060102 about 1 month ago
Labels: :bug: bug, tests

#866 - parsing error/exception seen inside open_ppt() of oletools 0.60.2

Issue - State: open - Opened by ghanashyams 2 months ago
Labels: :bug: bug, olevba, ppt_parser

#865 - ppt parsing error seen in latest versionof oletools 0.60.2

Issue - State: open - Opened by ghanashyams 2 months ago
Labels: :bug: bug, olevba, ppt_parser

#864 - olevba - keywords to detect remote template unlinking and VBA removal

Issue - State: open - Opened by decalage2 3 months ago
Labels: :+1: enhancement, olevba

#863 - dir stream parsing is too strict

Issue - State: open - Opened by peterferrie 4 months ago
Labels: :bug: bug, olevba

#862 - Add the vba ppt sample to the `find_vba` list in the `test_macros` function.

Pull Request - State: open - Opened by kijeong 5 months ago - 2 comments
Labels: :bug: bug, tests

#861 - clsid - add CLSIDs

Issue - State: open - Opened by decalage2 5 months ago - 1 comment
Labels: :+1: enhancement, clsid

#860 - Edit regex to exclude comments (to avoid false positives)

Pull Request - State: open - Opened by DecimalTurn 5 months ago - 3 comments
Labels: :+1: enhancement, olevba

#859 - Fix unittests

Pull Request - State: closed - Opened by christian-intra2net 6 months ago - 1 comment
Labels: :bug: bug, ppt_parser, tests

#858 - rtfobj/oleid: Equation Editor objects not detected

Issue - State: open - Opened by decalage2 6 months ago
Labels: :bug: bug, rtfobj, oleid

#857 - requirements: made easygui optional with [gui] extra

Pull Request - State: open - Opened by ideeockus 6 months ago - 2 comments
Labels: :+1: enhancement, setup.py, olebrowse

#856 - detect_vba_macros() false positives?

Issue - State: open - Opened by xme 6 months ago - 2 comments
Labels: question, olevba

#855 - oleobj.py syntax error

Pull Request - State: closed - Opened by xambroz 7 months ago
Labels: :bug: bug, Python 3.x, oleobj

#854 - rtfobj.py syntax error

Pull Request - State: closed - Opened by xambroz 7 months ago
Labels: :bug: bug, rtfobj, Python 3.x

#853 - oleid, ftguess: parsing issues with PPTM file

Issue - State: open - Opened by decalage2 8 months ago
Labels: :bug: bug, oleid, ftguess

#852 - olevba+mraptor: add keywords from malapi.io

Issue - State: open - Opened by decalage2 8 months ago
Labels: :+1: enhancement, olevba, mraptor

#851 - olevba, mraptor: add keywords LoadXML/transformNode for XSL to script

Issue - State: open - Opened by decalage2 8 months ago - 1 comment
Labels: :+1: enhancement, olevba, mraptor

#850 - ftguess: add option to rename files with extension matching format

Issue - State: open - Opened by decalage2 8 months ago
Labels: :+1: enhancement, ftguess

#846 - oleobj/oleid: very large OLE object not reported

Issue - State: open - Opened by decalage2 9 months ago
Labels: :bug: bug, oleobj, oleid

#845 - olevba: ignore malformed OLE files inside OpenXML

Issue - State: open - Opened by decalage2 9 months ago
Labels: :bug: bug, olevba

#844 - olevba/mraptor: extract info from vbaData.xml

Issue - State: open - Opened by decalage2 9 months ago
Labels: :+1: enhancement, olevba, mraptor

#843 - ftguess: fallback to magika (or others) when file type not identified

Issue - State: open - Opened by decalage2 9 months ago
Labels: :+1: enhancement, ftguess

#842 - password discovery and decrypted filepath dstfile

Pull Request - State: open - Opened by federicofantini 9 months ago - 4 comments
Labels: :+1: enhancement, olevba, msodde, crypto

#841 - Remove imp import from xxxswf for python 3.12 compatability

Pull Request - State: closed - Opened by cccs-jh 9 months ago - 1 comment
Labels: :bug: bug, pyxswf

#840 - Relax pyparsing version specifier

Pull Request - State: closed - Opened by ninoseki 9 months ago - 1 comment
Labels: :+1: enhancement, olevba

#839 - Expose References via VBA Parser object

Pull Request - State: open - Opened by AndrewJLockhart 9 months ago
Labels: :+1: enhancement, olevba

#838 - Make VBA Tools->References Information available

Issue - State: open - Opened by AndrewJLockhart 9 months ago - 2 comments
Labels: :+1: enhancement, olevba

#837 - Macro detection issues

Issue - State: open - Opened by tstallings 10 months ago - 2 comments
Labels: :bug: bug, olevba, mraptor

#836 - Recognize txt

Pull Request - State: open - Opened by christian-intra2net 11 months ago
Labels: :+1: enhancement, olevba, proposal, ftguess

#835 - Offline installation without active internet connection crashes on windows

Issue - State: open - Opened by testtomat 11 months ago - 3 comments
Labels: setup.py, :memo: documentation

#834 - clsid/ftguess: add ZED container format

Issue - State: open - Opened by decalage2 12 months ago
Labels: :+1: enhancement, clsid, ftguess

#833 - Olevba not expecting optional ProjectCompatVersion record

Issue - State: closed - Opened by Beakerboy about 1 year ago - 9 comments
Labels: :bug: bug, olevba

#832 - clsid: add tag to select suspicious CLSIDs

Issue - State: open - Opened by decalage2 about 1 year ago
Labels: :+1: enhancement, clsid

#831 - oleid/oleobj/msodde: sensibility to zipbomb packaged inside OOXML files

Issue - State: open - Opened by guzmud about 1 year ago
Labels: :bug: bug, oleobj, oleid, msodde

#830 - ftguess: file type not detected due to lack of root storage CLSID

Issue - State: open - Opened by decalage2 about 1 year ago
Labels: :bug: bug, ftguess

#829 - mraptor: should ignore directories when using wildcards

Issue - State: open - Opened by catafest about 1 year ago - 1 comment
Labels: :bug: bug, mraptor

#828 - ftguess: DOCX not identified properly

Issue - State: open - Opened by decalage2 about 1 year ago
Labels: :bug: bug, ftguess

#827 - doc: update install instructions for recent Ubuntu/Debian

Issue - State: open - Opened by decalage2 about 1 year ago
Labels: :+1: enhancement, setup.py, olebrowse, :memo: documentation

#826 - oleobj: detect remote templates and other remote references in OLE files

Issue - State: open - Opened by decalage2 about 1 year ago - 2 comments
Labels: :+1: enhancement, oleobj

#823 - Add "Modules" as keyword for self-modification

Pull Request - State: open - Opened by DecimalTurn about 1 year ago - 1 comment
Labels: :+1: enhancement, olevba

#822 - olevba - bug with PDF/MHT

Issue - State: open - Opened by decalage2 about 1 year ago
Labels: :bug: bug, olevba

#821 - Detect CVE-2023-36884

Issue - State: open - Opened by yoshimo over 1 year ago - 1 comment
Labels: :+1: enhancement, rtfobj, proposal, oleobj, oleid

#820 - Remove cycle between oletools and pcodedmp

Issue - State: open - Opened by youngcho22 over 1 year ago
Labels: :bug: bug, olevba, setup.py

#819 - handle new record in new vbaproject.bin if present

Pull Request - State: closed - Opened by beauvankirk over 1 year ago - 3 comments
Labels: :bug: bug, olevba

#818 - add hint about existing parameter when stomping is detected

Pull Request - State: open - Opened by security-companion over 1 year ago - 1 comment
Labels: :+1: enhancement, olevba

#817 - Comments are causing false positives

Issue - State: open - Opened by DecimalTurn over 1 year ago
Labels: :bug: bug, olevba, mraptor

#816 - Cant run the script after installation

Issue - State: open - Opened by Ondjultomte over 1 year ago

#815 - Exclude RTF files from language statistics

Pull Request - State: closed - Opened by DecimalTurn over 1 year ago - 1 comment
Labels: :+1: enhancement

#814 - OleID contains_xlm_macros indicator

Issue - State: open - Opened by TheOfficer123 over 1 year ago

#813 - Replace deprecated imp module with importlib

Issue - State: closed - Opened by hugovk over 1 year ago - 1 comment
Labels: :bug: bug, olevba, rtfobj, mraptor, pyxswf, Python 3.x, oleid

#812 - Relax pyparsing requirement.

Pull Request - State: closed - Opened by vEpiphyte over 1 year ago - 8 comments
Labels: olevba, setup.py

#811 - olevba dropping file extensions

Issue - State: closed - Opened by samspoerl over 1 year ago - 2 comments
Labels: :bug: bug, olevba

#810 - Massive speedup in analyze_macros

Pull Request - State: open - Opened by Rafiot over 1 year ago - 3 comments
Labels: :+1: enhancement, olevba, oleform

#809 - rtfobj/oleid: add detection for CVE-2023-21716

Issue - State: open - Opened by decalage2 over 1 year ago
Labels: :+1: enhancement, rtfobj, oleid

#808 - An ERROR occurs in olevba when parsing a simple .xlsm.

Issue - State: closed - Opened by yuichi-github over 1 year ago - 3 comments
Labels: :bug: bug, olevba

#807 - msodde: Fix detecting DDE in the nested field.

Pull Request - State: open - Opened by kijeong over 1 year ago
Labels: :bug: bug, msodde

#806 - Sanitize vbaProject.bin (remove pCode)?

Issue - State: open - Opened by ckrueger1979 over 1 year ago - 2 comments
Labels: question, olevba

#805 - Error in olevba

Issue - State: open - Opened by utkucorbaci almost 2 years ago
Labels: :bug: bug, olevba

#804 - Fix xlm_macro false positive

Pull Request - State: open - Opened by nurpabuccu almost 2 years ago
Labels: :bug: bug, olevba, plugin_biff

#800 - Single independent commits

Pull Request - State: open - Opened by christian-intra2net almost 2 years ago
Labels: :+1: enhancement

#799 - Capture warnings into log-helper

Pull Request - State: open - Opened by christian-intra2net almost 2 years ago
Labels: :+1: enhancement, tests

#798 - Decrypt in oleobj

Pull Request - State: open - Opened by christian-intra2net almost 2 years ago
Labels: :+1: enhancement, oleobj, crypto

#797 - olevba: splitlines error on Python 2 when parsing SLK files

Issue - State: closed - Opened by decalage2 almost 2 years ago
Labels: :bug: bug, olevba, Python 2.7

#796 - Run unittests automatically on github

Pull Request - State: closed - Opened by christian-intra2net almost 2 years ago - 3 comments
Labels: :+1: enhancement, tests

#795 - Require py3 for msoffcrypto

Pull Request - State: open - Opened by christian-intra2net almost 2 years ago
Labels: :bug: bug, setup.py, crypto

#794 - tests: Re-enable samples skipped because of #215

Pull Request - State: closed - Opened by christian-intra2net almost 2 years ago - 1 comment
Labels: tests

#793 - Found xlm_macros even if in empty xls document

Issue - State: open - Opened by nurpabuccu almost 2 years ago

#792 - release oletools-0.60.1 fails test_xlm tests with python 3.11

Issue - State: open - Opened by xambroz about 2 years ago - 2 comments
Labels: :bug: bug, olevba, Python 3.x, XLM

#791 - Error in marptor

Issue - State: closed - Opened by FS-Code-zz about 2 years ago - 4 comments
Labels: :bug: bug, olevba, mraptor

#790 - NUL-Bytes in olevba output: Bug or Feature?

Issue - State: open - Opened by albrechtd about 2 years ago
Labels: :bug: bug, question, olevba

#789 - rtfobj: OLE object not found in obfuscated RTF

Issue - State: open - Opened by decalage2 about 2 years ago
Labels: :bug: bug, rtfobj

#788 - olevba: Add zipfile content read limit

Issue - State: open - Opened by dlucredativ about 2 years ago
Labels: :+1: enhancement, olevba

#787 - olevba: detect renamed vbaProject.bin

Issue - State: open - Opened by decalage2 about 2 years ago
Labels: :+1: enhancement, olevba

#786 - Detect interactive ppt features

Pull Request - State: open - Opened by christian-intra2net about 2 years ago - 4 comments
Labels: :bug: bug, olevba, oleobj, ppt_parser

#785 - olevba, oleid: add detection for CustomXML parts

Issue - State: open - Opened by decalage2 about 2 years ago - 1 comment
Labels: :+1: enhancement, olevba, oleid

#784 - oleobj: PPT triggers exceptions

Issue - State: open - Opened by decalage2 about 2 years ago - 4 comments
Labels: :bug: bug, oleobj

#783 - Binary "printable characters" regex seems to contain non-printable characters.

Issue - State: open - Opened by anerbe about 2 years ago - 2 comments
Labels: :bug: bug, olevba

#781 - rtfobj - parsing error

Issue - State: open - Opened by decalage2 over 2 years ago - 1 comment
Labels: :bug: bug, rtfobj

#780 - Decode Properties

Pull Request - State: open - Opened by malvidin over 2 years ago
Labels: :+1: enhancement, oleid

#779 - Find ole inside CDFv2-disguise

Issue - State: open - Opened by dlucredativ over 2 years ago

#778 - check embedded office documents

Issue - State: open - Opened by pH-T over 2 years ago - 1 comment
Labels: :+1: enhancement, question, olevba

#775 - Update oleform to fix a padding bug and add an enhancement

Pull Request - State: open - Opened by nvdp01 over 2 years ago - 1 comment
Labels: :bug: bug, :+1: enhancement, oleform

#774 - Fix a SyntaxWarning in Python 3.8+

Pull Request - State: closed - Opened by vEpiphyte over 2 years ago - 1 comment
Labels: :bug: bug, Python 3.x, oleobj

#773 - oleid: report external relationships from RTF

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, rtfobj, oleobj, oleid

#772 - Add oleobj arg to just find external relations

Pull Request - State: open - Opened by christian-intra2net over 2 years ago
Labels: olevba, oleobj, msodde

#771 - log-helper and json-output from oleobj

Pull Request - State: open - Opened by christian-intra2net over 2 years ago - 1 comment

#770 - ftguess: Handle error when [Content_Types].xml is not present.

Pull Request - State: open - Opened by enkelli over 2 years ago - 2 comments
Labels: :bug: bug, ftguess

#769 - Fix unittests

Pull Request - State: closed - Opened by christian-intra2net over 2 years ago - 1 comment
Labels: :bug: bug, olevba, Python 2.7, tests

#768 - Find ms-msdt: links

Issue - State: open - Opened by christian-intra2net over 2 years ago - 2 comments
Labels: question, rtfobj, oleobj, msodde

#767 - Multiple test fails on Python 3.9

Issue - State: open - Opened by sebix over 2 years ago - 12 comments
Labels: :bug: bug, tests

#766 - mraptor 0.56.2 can't find the Macro

Issue - State: open - Opened by amoy9812 over 2 years ago
Labels: :bug: bug, olevba, mraptor

#765 - setup: only install XLMMacroDeobfuscator on Python 2

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :bug: bug, setup.py, Python 2.7, XLM

#764 - olevba: extract plaintext password from VBA project

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, olevba

#763 - mraptor: write and execute should lead to "suspicious"

Issue - State: open - Opened by rsaccani over 2 years ago

#762 - Oletools unable to install because of Pyparsing version problem

Issue - State: open - Opened by noadekel-DI over 2 years ago - 6 comments
Labels: :bug: bug, setup.py

#761 - tests: Treat xlsb properly in ftguess tests

Pull Request - State: closed - Opened by christian-intra2net over 2 years ago - 1 comment
Labels: :+1: enhancement, tests

#760 - rtfobj.py cannot handle uppercase Comment cword obfuscation inside objdata

Issue - State: open - Opened by arpitest over 2 years ago
Labels: :bug: bug, rtfobj

#759 - ftguess: add Visio formats

Issue - State: open - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, ftguess

#758 - ftguess: add XLSB detection

Issue - State: closed - Opened by decalage2 over 2 years ago
Labels: :+1: enhancement, ftguess

#755 - Failed to detect OOXML XLSX file

Issue - State: open - Opened by randubin over 2 years ago
Labels: :bug: bug, olevba

GitHub / decalage2/oletools issues and pull requests