pyOneNote
pyOneNote copied to clipboard
DissectMalware
`pyonenote` not working from the command line
I installed pyonenote via pip install pyonenote and tried running pyonenote -f example-docs/QuickNotes.one and got the following error:
Traceback (most recent call last):
File ".../pyonenote", line 8, in <module>
sys.exit(main())
^^^^^^
File ".../site-packages/pyOneNote/Main.py", line 97, in main
sys.exit("File: %s doesn't exist", args.file)
TypeError: exit expected at most 1 argument, got 2
I also tried cloning the repo, changing the sys.exit line to and f-string, but still got an error:
$ python Main.py -f QuickNotes.one
Traceback (most recent call last):
File ".../pyOneNote/pyOneNote/Main.py", line 104, in <module>
main()
File ".../pyOneNote/pyOneNote/Main.py", line 100, in main
process_onenote_file(file, args.output_dir, args.extension, args.json)
File ".../pyOneNote/pyOneNote/Main.py", line 28, in process_onenote_file
document = OneDocment(file)
^^^^^^^^^^^^^^^^
File ".../pyOneNote/lib/python3.11/site-packages/pyOneNote/OneDocument.py", line 11, in __init__
self.root_file_node_list = FileNodeList(file, self, self.header.fcrFileNodeListRoot)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File ".../pyOneNote/lib/python3.11/site-packages/pyOneNote/FileNode.py", line 16, in __init__
file.seek(file_chunk_reference.stp)
ValueError: cannot fit 'int' into an offset-sized integer
Can you share the sample? or if it is on VirusTotal, share the SHA256? Without having the sample it is very hard to debug. Most probably the .one file contains a structure that is not supported by pyOneNote... Did you test with another .one document?
I'm getting a message saying the file type (.one) isn't supported when I try to add it here. And no, I didn't try with another file since I created this file for testing.
@DissectMalware Hello, thank you for this tool. I got the same error: 'ValueError: cannot fit 'int' into an offset-sized integer' for a different sample, that can be obtained from VT (sha256: f770bf655720539c6171e77758383744be087b480a3f70256cc5043c489e529e). Hope this helps.
Traceback (most recent call last):
File "Main.py", line 104, in
I got the same error. Here is a zipped example file to trigger this: Schnelle Notizen.one.zip
I copy/paste the file on my computer and I don't have any problem (your file size is much larger than my copy). I am trying to understand this library to fork it (no news of owner), you can contact me at [email protected] if you are interested to this
@Kev744 at the moment I am swamped with my other responsibilities but try to help if something is blocking you from contributing...
I copy/paste the file on my computer and I don't have any problem (your file size is much larger than my copy).
It might be caused by a different python version (or different module version). I'm using Python 3.11.8.
@Kev744 at the moment I am swamped with my other responsibilities but try to help if something is blocking you from contributing...
No problem before the responsabilities. Thanks, How can I contact you ?
It might be caused by a different python version (or different module version). I'm using Python 3.11.8.
I am using Python 3.9.12 and module 0.0.2, but the main source doesn't probably come from the Python and module because when I use your file (it doesn't work also), I need to copy/paste the file with OneNote (Move or Copy) in order to work, maybe OneNote version, what version you use for comparing with mine ? I am using Microsoft® OneNote® for Microsoft 365 MSO (Version 2402)
what version you use for comparing with mine ?
I use the web version at https://www.onenote.com/notebooks (couldn't find a specific version there). I don't use it actively yet. Just trying out the functions and seeing what tools around are available.
Check it : https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-onestore/93a9831c-553f-4547-9d44-b8d6f879aaaa#Appendix_A_11
The code should to be updated for OneNote Online unfortunately...
Thanks for looking into it! Just for understanding: Is it
<9> Section 2.7.2: Microsoft OneNote Online generates an Extended GUID not following this algorithm
?
Thanks for looking into it! Just for understanding: Is it
<9> Section 2.7.2: Microsoft OneNote Online generates an Extended GUID not following this algorithm
?
Yes it is.
Actually it's not just the different GUID, but for exports from OneNote Online there is at least one more layer that needs to be decoded. I. e. FSSHTTP. I managed to write a parser for this layer (at least for my test files), but I stopped, because it takes too much time.
The only alternative for parsing OneNote Online files seems to be https://github.com/msiemens/onenote.rs. I didn't try it yet, though.