Skip to content

Commit

Permalink
Updated the documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
bontchev committed Nov 13, 2016
1 parent 0ea83ab commit 283425a
Showing 1 changed file with 21 additions and 1 deletion.
22 changes: 21 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,14 @@ Since most of the time it is the p-code that determines what exactly a macro wou

## Installation

The script will work only in Python version 2.6 or higher. It won't work in Python 3.x, because one of the imported modules (`oletools`) does not support Python 3.x. It depends on Philippe Lagadec's package [oletools](https://github.com/decalage2/oletools), so this package has to be installed before using the script. It can be installed with the command
The script will work both in Python version 2.6+ and in Python 3.x. It depends on Philippe Lagadec's package [oletools](https://github.com/decalage2/oletools), so this package has to be installed before using the script. It can be installed with the command

pip install oletools

Make sure you have a fairly recent version of it, as the versions before 0.50 do not support Python 3.x. If you have an older version of the module, upgrade it to the latest one with the command

pip install oletools --upgrade

## Usage

The script takes as a command-line argument a list of one or more names of files or directories. If the name is an OLE2 document, it will be inspected for VBA code and the p-code of each code module will be disassembled. If the name is a directory, all the files in this directory and its subdirectories will be similarly processed. In addition to the disassembled p-code, by default the script also displays the parsed records of the `dir` stream, as well as the identifiers (variable and function names) used in the VBA modules and stored in the `_VBA_PROJECT` stream.
Expand Down Expand Up @@ -67,6 +71,20 @@ For reference, it is the result of compiling the following VBA code:
Shell("calc.exe")
End Sub

## Known problems

- Office 2016 64-bit only: When disassembling variables declared as being of custom type (e.g., `Dim SomeVar As SomeType`), the type (`As SomeType`) is not disassembled.

- Office 2016 64-bit only: The `Private` property of `Sub`, `Function` and `Property` declarations is not disassembled.

- Office 2016 64-bit only: The `Declare` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled.

- All versions of Office: The `Alias "SomeName"` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled.

- All versions of Office: The `Public` property of custom type definitions (e.g., `Public Type SomeType`) is not disassembled.

I do not have access to 64-bit Office 2016 and the few samples of documents, generated by this version of Office, that I have, have been insufficient for me to figure out where the corresponding information resides. I know where it resides in the other versions of Office, but it has been moved elsewhere in 64-bit Office 2016 and the old algorithms no longer work.

## To do

- Implement support of VBA3 (Excel95).
Expand All @@ -82,3 +100,5 @@ Version 1.0.0: Initial version.
Version 1.1.0: Storing the opcodes in a more efficient manner. Implemented VBA7 support. Implemented support for documents created by the 64-bit version of Office.

Version 1.2.0: Disassembling the various declarations (`New`, `Type`, `Dim`, `ReDim`, `Sub`, `Function`, `Property`).

Version 1.2.1: Now runs under Python 3.x too. Improved support of 64-bit Office documents. Implemented support of some VBA7-specific features (`Friend`, `PtrSafe`, `LongPtr`). Improved the disassembling of `Dim` declarations.

0 comments on commit 283425a

Please sign in to comment.