1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
|
%global _empty_manifest_terminate_build 0
Name: python-pcodedmp
Version: 1.2.6
Release: 1
Summary: A VBA p-code disassembler
License: GPL
URL: https://github.com/bontchev/pcodedmp
Source0: https://mirrors.nju.edu.cn/pypi/web/packages/3d/20/6d461e29135f474408d0d7f95b2456a9ba245560768ee51b788af10f7429/pcodedmp-1.2.6.tar.gz
BuildArch: noarch
Requires: python3-oletools
Requires: python3-win-unicode-console
%description
Module streams:
Macros/VBA/ThisDocument - 1517 bytes
Line #0:
FuncDefn (Private Sub Document_Open())
Line #1:
LitStr 0x001D "This could have been a virus!"
Ld vbOKOnly
Ld vbInformation
Add
LitStr 0x0006 "Virus!"
ArgsCall MsgBox 0x0003
Line #2:
LitStr 0x0008 "calc.exe"
Paren
ArgsCall Shell 0x0001
Line #3:
EndSub
```
For reference, it is the result of compiling the following VBA code:
```vba
Private Sub Document_Open()
MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!"
Shell("calc.exe")
End Sub
```
## Known problems
- Office 2016 64-bit only: When disassembling variables declared as being of custom type (e.g., `Dim SomeVar As SomeType`), the type (`As SomeType`) is not disassembled.
- Office 2016 64-bit only: The `Private` property of `Sub`, `Function` and `Property` declarations is not disassembled.
- Office 2016 64-bit only: The `Declare` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled.
- Office 2000 and higher: The type of a subroutine or function argument of type `ParamArray` is not disassembled correctly. For instance, `Sub Foo (ParamArray arg())` will be disassembled as `Sub Foo (arg)`.
- All versions of Office: The `Alias "SomeName"` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled.
- All versions of Office: The `Public` property of custom type definitions (e.g., `Public Type SomeType`) is not disassembled.
- All versions of Office: The custom type of a subroutine or function argument is not disassembled correctly and `CustomType` is used instead. For instance, `Sub Foo (arg As Bar)` will be disassembled as `Sub Foo (arg As CustomType)`.
- If the output of the program is sent to a file, instead of to the console (either by using the `-o` option or by redirecting `stdout`), any non-ASCII strings (like module names, texsts used in the macros, etc.) might not be properly encoded.
I do not have access to 64-bit Office 2016 and the few samples of documents, generated by this version of Office, that I have, have been insufficient for me to figure out where the corresponding information resides. I know where it resides in the other versions of Office, but it has been moved elsewhere in 64-bit Office 2016 and the old algorithms no longer work.
## To do
- Implement support of VBA3 (Excel95).
- While the script should support documents created by MacOffice, this has not been tested (and you know how well untested code usually works). This should be tested and any bugs related to it should be fixed.
- I am not an experienced Python programmer and the code is ugly. Somebody more familiar with Python than me should probably rewrite the script and make it look better.
## Change log
Version 1.2.6:
- Changed it not to require the `win_unicode_console` module when it is not available - e.g., when not running on a Windows machine or when running under the PyPy implementation of Python, thanks to [Philippe Lagadec](https://github.com/decalage2).
Version 1.2.5:
- Added a sanity check to avoid errors when parsing object declarations
- The functions that produce output now have the output file (default is `stdout`) as a parameter, for better integration with other tools, thanks to [Philippe Lagadec](https://github.com/decalage2).
Version 1.2.4:
- Implemented support for module names with non-ASCII characters in their names. Thanks to [Philippe Lagadec](https://github.com/decalage2) for helping me with that.
- Fixed a parsing error when disassembling object declarations.
- Removed some unused variables.
- Improved the documentation a bit.
Version 1.2.3:
- Fixed a few crashes and documented better some disassembly failures.
- Converted the script into a package that can be installed with ``pip``. Use the command ``pip install pcodedmp``.
Version 1.2.2:
- Implemented handling of documents saved in Open XML format (which is the default format of Office 2007 and higher) - `.docm`, `.xlsm`, `.pptm`.
Version 1.2.1:
- Now runs under Python 3.x too.
- Improved support of 64-bit Office documents.
- Implemented support of some VBA7-specific features (`Friend`, `PtrSafe`, `LongPtr`).
- Improved the disassembling of `Dim` declarations.
Version 1.2.0:
- Disassembling the various declarations (`New`, `Type`, `Dim`, `ReDim`, `Sub`, `Function`, `Property`).
Version 1.1.0:
- Storing the opcodes in a more efficient manner.
- Implemented VBA7 support.
- Implemented support for documents created by the 64-bit version of Office.
Version 1.0.0:
- Initial version.
%package -n python3-pcodedmp
Summary: A VBA p-code disassembler
Provides: python-pcodedmp
BuildRequires: python3-devel
BuildRequires: python3-setuptools
BuildRequires: python3-pip
%description -n python3-pcodedmp
Module streams:
Macros/VBA/ThisDocument - 1517 bytes
Line #0:
FuncDefn (Private Sub Document_Open())
Line #1:
LitStr 0x001D "This could have been a virus!"
Ld vbOKOnly
Ld vbInformation
Add
LitStr 0x0006 "Virus!"
ArgsCall MsgBox 0x0003
Line #2:
LitStr 0x0008 "calc.exe"
Paren
ArgsCall Shell 0x0001
Line #3:
EndSub
```
For reference, it is the result of compiling the following VBA code:
```vba
Private Sub Document_Open()
MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!"
Shell("calc.exe")
End Sub
```
## Known problems
- Office 2016 64-bit only: When disassembling variables declared as being of custom type (e.g., `Dim SomeVar As SomeType`), the type (`As SomeType`) is not disassembled.
- Office 2016 64-bit only: The `Private` property of `Sub`, `Function` and `Property` declarations is not disassembled.
- Office 2016 64-bit only: The `Declare` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled.
- Office 2000 and higher: The type of a subroutine or function argument of type `ParamArray` is not disassembled correctly. For instance, `Sub Foo (ParamArray arg())` will be disassembled as `Sub Foo (arg)`.
- All versions of Office: The `Alias "SomeName"` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled.
- All versions of Office: The `Public` property of custom type definitions (e.g., `Public Type SomeType`) is not disassembled.
- All versions of Office: The custom type of a subroutine or function argument is not disassembled correctly and `CustomType` is used instead. For instance, `Sub Foo (arg As Bar)` will be disassembled as `Sub Foo (arg As CustomType)`.
- If the output of the program is sent to a file, instead of to the console (either by using the `-o` option or by redirecting `stdout`), any non-ASCII strings (like module names, texsts used in the macros, etc.) might not be properly encoded.
I do not have access to 64-bit Office 2016 and the few samples of documents, generated by this version of Office, that I have, have been insufficient for me to figure out where the corresponding information resides. I know where it resides in the other versions of Office, but it has been moved elsewhere in 64-bit Office 2016 and the old algorithms no longer work.
## To do
- Implement support of VBA3 (Excel95).
- While the script should support documents created by MacOffice, this has not been tested (and you know how well untested code usually works). This should be tested and any bugs related to it should be fixed.
- I am not an experienced Python programmer and the code is ugly. Somebody more familiar with Python than me should probably rewrite the script and make it look better.
## Change log
Version 1.2.6:
- Changed it not to require the `win_unicode_console` module when it is not available - e.g., when not running on a Windows machine or when running under the PyPy implementation of Python, thanks to [Philippe Lagadec](https://github.com/decalage2).
Version 1.2.5:
- Added a sanity check to avoid errors when parsing object declarations
- The functions that produce output now have the output file (default is `stdout`) as a parameter, for better integration with other tools, thanks to [Philippe Lagadec](https://github.com/decalage2).
Version 1.2.4:
- Implemented support for module names with non-ASCII characters in their names. Thanks to [Philippe Lagadec](https://github.com/decalage2) for helping me with that.
- Fixed a parsing error when disassembling object declarations.
- Removed some unused variables.
- Improved the documentation a bit.
Version 1.2.3:
- Fixed a few crashes and documented better some disassembly failures.
- Converted the script into a package that can be installed with ``pip``. Use the command ``pip install pcodedmp``.
Version 1.2.2:
- Implemented handling of documents saved in Open XML format (which is the default format of Office 2007 and higher) - `.docm`, `.xlsm`, `.pptm`.
Version 1.2.1:
- Now runs under Python 3.x too.
- Improved support of 64-bit Office documents.
- Implemented support of some VBA7-specific features (`Friend`, `PtrSafe`, `LongPtr`).
- Improved the disassembling of `Dim` declarations.
Version 1.2.0:
- Disassembling the various declarations (`New`, `Type`, `Dim`, `ReDim`, `Sub`, `Function`, `Property`).
Version 1.1.0:
- Storing the opcodes in a more efficient manner.
- Implemented VBA7 support.
- Implemented support for documents created by the 64-bit version of Office.
Version 1.0.0:
- Initial version.
%package help
Summary: Development documents and examples for pcodedmp
Provides: python3-pcodedmp-doc
%description help
Module streams:
Macros/VBA/ThisDocument - 1517 bytes
Line #0:
FuncDefn (Private Sub Document_Open())
Line #1:
LitStr 0x001D "This could have been a virus!"
Ld vbOKOnly
Ld vbInformation
Add
LitStr 0x0006 "Virus!"
ArgsCall MsgBox 0x0003
Line #2:
LitStr 0x0008 "calc.exe"
Paren
ArgsCall Shell 0x0001
Line #3:
EndSub
```
For reference, it is the result of compiling the following VBA code:
```vba
Private Sub Document_Open()
MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!"
Shell("calc.exe")
End Sub
```
## Known problems
- Office 2016 64-bit only: When disassembling variables declared as being of custom type (e.g., `Dim SomeVar As SomeType`), the type (`As SomeType`) is not disassembled.
- Office 2016 64-bit only: The `Private` property of `Sub`, `Function` and `Property` declarations is not disassembled.
- Office 2016 64-bit only: The `Declare` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled.
- Office 2000 and higher: The type of a subroutine or function argument of type `ParamArray` is not disassembled correctly. For instance, `Sub Foo (ParamArray arg())` will be disassembled as `Sub Foo (arg)`.
- All versions of Office: The `Alias "SomeName"` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled.
- All versions of Office: The `Public` property of custom type definitions (e.g., `Public Type SomeType`) is not disassembled.
- All versions of Office: The custom type of a subroutine or function argument is not disassembled correctly and `CustomType` is used instead. For instance, `Sub Foo (arg As Bar)` will be disassembled as `Sub Foo (arg As CustomType)`.
- If the output of the program is sent to a file, instead of to the console (either by using the `-o` option or by redirecting `stdout`), any non-ASCII strings (like module names, texsts used in the macros, etc.) might not be properly encoded.
I do not have access to 64-bit Office 2016 and the few samples of documents, generated by this version of Office, that I have, have been insufficient for me to figure out where the corresponding information resides. I know where it resides in the other versions of Office, but it has been moved elsewhere in 64-bit Office 2016 and the old algorithms no longer work.
## To do
- Implement support of VBA3 (Excel95).
- While the script should support documents created by MacOffice, this has not been tested (and you know how well untested code usually works). This should be tested and any bugs related to it should be fixed.
- I am not an experienced Python programmer and the code is ugly. Somebody more familiar with Python than me should probably rewrite the script and make it look better.
## Change log
Version 1.2.6:
- Changed it not to require the `win_unicode_console` module when it is not available - e.g., when not running on a Windows machine or when running under the PyPy implementation of Python, thanks to [Philippe Lagadec](https://github.com/decalage2).
Version 1.2.5:
- Added a sanity check to avoid errors when parsing object declarations
- The functions that produce output now have the output file (default is `stdout`) as a parameter, for better integration with other tools, thanks to [Philippe Lagadec](https://github.com/decalage2).
Version 1.2.4:
- Implemented support for module names with non-ASCII characters in their names. Thanks to [Philippe Lagadec](https://github.com/decalage2) for helping me with that.
- Fixed a parsing error when disassembling object declarations.
- Removed some unused variables.
- Improved the documentation a bit.
Version 1.2.3:
- Fixed a few crashes and documented better some disassembly failures.
- Converted the script into a package that can be installed with ``pip``. Use the command ``pip install pcodedmp``.
Version 1.2.2:
- Implemented handling of documents saved in Open XML format (which is the default format of Office 2007 and higher) - `.docm`, `.xlsm`, `.pptm`.
Version 1.2.1:
- Now runs under Python 3.x too.
- Improved support of 64-bit Office documents.
- Implemented support of some VBA7-specific features (`Friend`, `PtrSafe`, `LongPtr`).
- Improved the disassembling of `Dim` declarations.
Version 1.2.0:
- Disassembling the various declarations (`New`, `Type`, `Dim`, `ReDim`, `Sub`, `Function`, `Property`).
Version 1.1.0:
- Storing the opcodes in a more efficient manner.
- Implemented VBA7 support.
- Implemented support for documents created by the 64-bit version of Office.
Version 1.0.0:
- Initial version.
%prep
%autosetup -n pcodedmp-1.2.6
%build
%py3_build
%install
%py3_install
install -d -m755 %{buildroot}/%{_pkgdocdir}
if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi
if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi
if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi
if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi
pushd %{buildroot}
if [ -d usr/lib ]; then
find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst
fi
if [ -d usr/lib64 ]; then
find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst
fi
if [ -d usr/bin ]; then
find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst
fi
if [ -d usr/sbin ]; then
find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst
fi
touch doclist.lst
if [ -d usr/share/man ]; then
find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst
fi
popd
mv %{buildroot}/filelist.lst .
mv %{buildroot}/doclist.lst .
%files -n python3-pcodedmp -f filelist.lst
%dir %{python3_sitelib}/*
%files help -f doclist.lst
%{_docdir}/*
%changelog
* Fri Apr 21 2023 Python_Bot <Python_Bot@openeuler.org> - 1.2.6-1
- Package Spec generated
|
