oletools icon indicating copy to clipboard operation
oletools copied to clipboard

olevba: add projectcompatversion record

Open kijeong opened this issue 2 years ago • 0 comments

Hello @decalage2,

Recently, while analyzing the PowerPoint document containing VBAs, I found that some errors were outputted in the olevba output result.

The error was better revealed by activating the oletools debug option(--loglevel debug).

It was, I think, due to the newly added PROJECTCOMPATVERSION Record on dir Stream. So I added the PROJECTCOMPATVERSION processing code to olevba.py.

If this is okay, I hope it merges.

Tested PowerPoint Application version: Microsoft® PowerPoint® Microsoft 365 MSO(version 2110 build 16.0.14527.20234) 64bit

Refs: 2.3.4.2.1.2 PROJECTCOMPATVERSION Record, https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-ovba/ed5d7ede-5d7d-4645-bba3-ddfd9bdc76ed, Perhaps this was issued in 2021-08-17.

Thank you for your work.😀

Best, Kijeong

kijeong avatar Nov 09 '21 06:11 kijeong