oletools
oletools copied to clipboard
ftguess: add strict/safe mode to match extension to file formats
add an exefilter-like mode, to recognize file types in a stricter/safer way by matching file extension and content, and avoid issue with polyglots:
- if the filename has an extension, find all the formats matching that extension
- then check each of those formats, if they recognise the file content with a proper structure
- if none of the formats matches the file extension, issue a warning that the format is incorrect or not supported, or the file extension is incorrect
- otherwise if the filename has no extension, or a generic extension like ".bin" or an extension not known by ftguess, guess the file type with the usual ftguess algorithm (and display a warning)
With this mode, ftguess will enforce that a file has a proper extension matching its content.