Skip to content

Decrypt in oleobj#464

Closed
christian-intra2net wants to merge 7 commits into
decalage2:masterfrom
christian-intra2net:decrypt-in-oledump
Closed

Decrypt in oleobj#464
christian-intra2net wants to merge 7 commits into
decalage2:masterfrom
christian-intra2net:decrypt-in-oledump

Conversation

@christian-intra2net

Copy link
Copy Markdown
Contributor

Integrated decrypt in oleobj.

This has 2 effects:
(1) can extract images and other embedded files from encrypted files
(2) treat the decrypted version of the file like an "extracted object"

Second one is for people (like me) who use oleobj as a general-purpose extractor of content from ole-files (much like ripOLE). This way, we can run e.g. an antivirus software over the decrypted/extracted contents.

Or should I maybe make (2) optional via command line switch?

@decalage2 decalage2 self-requested a review July 9, 2019 14:35
@decalage2 decalage2 changed the title Decrypt in oledump Decrypt in oleobj Jul 9, 2019
@decalage2 decalage2 added this to the oletools 0.55 milestone Jul 9, 2019
@christian-intra2net

Copy link
Copy Markdown
Contributor Author

Required a rebase after mergin #365

Imrove readability by making main() smaller
Move selection of output dir to main(), creation to point just before
it is actually needed. This way, we only create the dir when (and if)
it is actually needed.
Create wrapper around process_file, that first just runs process_file
but afterwards checks for encryption and re-runs on decrypted file if
encryption found.
Usually, decrypted files are treated like temp files, deleted after use.
Here, these are part of the result of oleobj, just like an extracted image.
Check decryption capability of oleobj. Created this sample in Word 2010 by
embedding a jpg into the office file and then encrypting the file with the
standard password used for "write protection".
@christian-intra2net christian-intra2net deleted the decrypt-in-oledump branch November 29, 2022 11:28
@christian-intra2net

Copy link
Copy Markdown
Contributor Author

Corrected the branch name, assuming github would manage to update the pull request associated with it.

Re-created this PR as #798

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants