dir stream parsing is too strict

[peterferrie]

Affected tool: olevba

Describe the bug sig_byte and chunk_signature compare exact byte-values. Office only checks individual bits, not the entire byte. For sig_byte, only bits 0-1 are checked, bits 2-7 are not checked. For chunk_signature, only bit 15 is checked, bits 12-24 are not checked.

File/Malware sample to reproduce the bug pw_clean.zip

How To Reproduce the bug olevba doc1.doc

Expected behavior dir stream should be parsed correctly, no error from _extract_vba

Console output / Screenshots If applicable, add screenshots to help explain your problem. Use the option "-l debug" to add debugging information, if possible.

Version information:

• OS: Windows
• OS version: 10.0.19045 - 64 bits
• Python version: 3.8.5 - 64 bits
• oletools version: 0.60.2

Additional context In the sample file, the sig_byte is changed from 01 to 05; chunk_signature is changed from B2 to 82. The file opens correctly in Word 2019.