%global _empty_manifest_terminate_build 0 Name: python-pcodedmp Version: 1.2.6 Release: 1 Summary: A VBA p-code disassembler License: GPL URL: https://github.com/bontchev/pcodedmp Source0: https://mirrors.nju.edu.cn/pypi/web/packages/3d/20/6d461e29135f474408d0d7f95b2456a9ba245560768ee51b788af10f7429/pcodedmp-1.2.6.tar.gz BuildArch: noarch Requires: python3-oletools Requires: python3-win-unicode-console %description Module streams: Macros/VBA/ThisDocument - 1517 bytes Line #0: FuncDefn (Private Sub Document_Open()) Line #1: LitStr 0x001D "This could have been a virus!" Ld vbOKOnly Ld vbInformation Add LitStr 0x0006 "Virus!" ArgsCall MsgBox 0x0003 Line #2: LitStr 0x0008 "calc.exe" Paren ArgsCall Shell 0x0001 Line #3: EndSub ``` For reference, it is the result of compiling the following VBA code: ```vba Private Sub Document_Open() MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!" Shell("calc.exe") End Sub ``` ## Known problems - Office 2016 64-bit only: When disassembling variables declared as being of custom type (e.g., `Dim SomeVar As SomeType`), the type (`As SomeType`) is not disassembled. - Office 2016 64-bit only: The `Private` property of `Sub`, `Function` and `Property` declarations is not disassembled. - Office 2016 64-bit only: The `Declare` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled. - Office 2000 and higher: The type of a subroutine or function argument of type `ParamArray` is not disassembled correctly. For instance, `Sub Foo (ParamArray arg())` will be disassembled as `Sub Foo (arg)`. - All versions of Office: The `Alias "SomeName"` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled. - All versions of Office: The `Public` property of custom type definitions (e.g., `Public Type SomeType`) is not disassembled. - All versions of Office: The custom type of a subroutine or function argument is not disassembled correctly and `CustomType` is used instead. For instance, `Sub Foo (arg As Bar)` will be disassembled as `Sub Foo (arg As CustomType)`. - If the output of the program is sent to a file, instead of to the console (either by using the `-o` option or by redirecting `stdout`), any non-ASCII strings (like module names, texsts used in the macros, etc.) might not be properly encoded. I do not have access to 64-bit Office 2016 and the few samples of documents, generated by this version of Office, that I have, have been insufficient for me to figure out where the corresponding information resides. I know where it resides in the other versions of Office, but it has been moved elsewhere in 64-bit Office 2016 and the old algorithms no longer work. ## To do - Implement support of VBA3 (Excel95). - While the script should support documents created by MacOffice, this has not been tested (and you know how well untested code usually works). This should be tested and any bugs related to it should be fixed. - I am not an experienced Python programmer and the code is ugly. Somebody more familiar with Python than me should probably rewrite the script and make it look better. ## Change log Version 1.2.6: - Changed it not to require the `win_unicode_console` module when it is not available - e.g., when not running on a Windows machine or when running under the PyPy implementation of Python, thanks to [Philippe Lagadec](https://github.com/decalage2). Version 1.2.5: - Added a sanity check to avoid errors when parsing object declarations - The functions that produce output now have the output file (default is `stdout`) as a parameter, for better integration with other tools, thanks to [Philippe Lagadec](https://github.com/decalage2). Version 1.2.4: - Implemented support for module names with non-ASCII characters in their names. Thanks to [Philippe Lagadec](https://github.com/decalage2) for helping me with that. - Fixed a parsing error when disassembling object declarations. - Removed some unused variables. - Improved the documentation a bit. Version 1.2.3: - Fixed a few crashes and documented better some disassembly failures. - Converted the script into a package that can be installed with ``pip``. Use the command ``pip install pcodedmp``. Version 1.2.2: - Implemented handling of documents saved in Open XML format (which is the default format of Office 2007 and higher) - `.docm`, `.xlsm`, `.pptm`. Version 1.2.1: - Now runs under Python 3.x too. - Improved support of 64-bit Office documents. - Implemented support of some VBA7-specific features (`Friend`, `PtrSafe`, `LongPtr`). - Improved the disassembling of `Dim` declarations. Version 1.2.0: - Disassembling the various declarations (`New`, `Type`, `Dim`, `ReDim`, `Sub`, `Function`, `Property`). Version 1.1.0: - Storing the opcodes in a more efficient manner. - Implemented VBA7 support. - Implemented support for documents created by the 64-bit version of Office. Version 1.0.0: - Initial version. %package -n python3-pcodedmp Summary: A VBA p-code disassembler Provides: python-pcodedmp BuildRequires: python3-devel BuildRequires: python3-setuptools BuildRequires: python3-pip %description -n python3-pcodedmp Module streams: Macros/VBA/ThisDocument - 1517 bytes Line #0: FuncDefn (Private Sub Document_Open()) Line #1: LitStr 0x001D "This could have been a virus!" Ld vbOKOnly Ld vbInformation Add LitStr 0x0006 "Virus!" ArgsCall MsgBox 0x0003 Line #2: LitStr 0x0008 "calc.exe" Paren ArgsCall Shell 0x0001 Line #3: EndSub ``` For reference, it is the result of compiling the following VBA code: ```vba Private Sub Document_Open() MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!" Shell("calc.exe") End Sub ``` ## Known problems - Office 2016 64-bit only: When disassembling variables declared as being of custom type (e.g., `Dim SomeVar As SomeType`), the type (`As SomeType`) is not disassembled. - Office 2016 64-bit only: The `Private` property of `Sub`, `Function` and `Property` declarations is not disassembled. - Office 2016 64-bit only: The `Declare` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled. - Office 2000 and higher: The type of a subroutine or function argument of type `ParamArray` is not disassembled correctly. For instance, `Sub Foo (ParamArray arg())` will be disassembled as `Sub Foo (arg)`. - All versions of Office: The `Alias "SomeName"` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled. - All versions of Office: The `Public` property of custom type definitions (e.g., `Public Type SomeType`) is not disassembled. - All versions of Office: The custom type of a subroutine or function argument is not disassembled correctly and `CustomType` is used instead. For instance, `Sub Foo (arg As Bar)` will be disassembled as `Sub Foo (arg As CustomType)`. - If the output of the program is sent to a file, instead of to the console (either by using the `-o` option or by redirecting `stdout`), any non-ASCII strings (like module names, texsts used in the macros, etc.) might not be properly encoded. I do not have access to 64-bit Office 2016 and the few samples of documents, generated by this version of Office, that I have, have been insufficient for me to figure out where the corresponding information resides. I know where it resides in the other versions of Office, but it has been moved elsewhere in 64-bit Office 2016 and the old algorithms no longer work. ## To do - Implement support of VBA3 (Excel95). - While the script should support documents created by MacOffice, this has not been tested (and you know how well untested code usually works). This should be tested and any bugs related to it should be fixed. - I am not an experienced Python programmer and the code is ugly. Somebody more familiar with Python than me should probably rewrite the script and make it look better. ## Change log Version 1.2.6: - Changed it not to require the `win_unicode_console` module when it is not available - e.g., when not running on a Windows machine or when running under the PyPy implementation of Python, thanks to [Philippe Lagadec](https://github.com/decalage2). Version 1.2.5: - Added a sanity check to avoid errors when parsing object declarations - The functions that produce output now have the output file (default is `stdout`) as a parameter, for better integration with other tools, thanks to [Philippe Lagadec](https://github.com/decalage2). Version 1.2.4: - Implemented support for module names with non-ASCII characters in their names. Thanks to [Philippe Lagadec](https://github.com/decalage2) for helping me with that. - Fixed a parsing error when disassembling object declarations. - Removed some unused variables. - Improved the documentation a bit. Version 1.2.3: - Fixed a few crashes and documented better some disassembly failures. - Converted the script into a package that can be installed with ``pip``. Use the command ``pip install pcodedmp``. Version 1.2.2: - Implemented handling of documents saved in Open XML format (which is the default format of Office 2007 and higher) - `.docm`, `.xlsm`, `.pptm`. Version 1.2.1: - Now runs under Python 3.x too. - Improved support of 64-bit Office documents. - Implemented support of some VBA7-specific features (`Friend`, `PtrSafe`, `LongPtr`). - Improved the disassembling of `Dim` declarations. Version 1.2.0: - Disassembling the various declarations (`New`, `Type`, `Dim`, `ReDim`, `Sub`, `Function`, `Property`). Version 1.1.0: - Storing the opcodes in a more efficient manner. - Implemented VBA7 support. - Implemented support for documents created by the 64-bit version of Office. Version 1.0.0: - Initial version. %package help Summary: Development documents and examples for pcodedmp Provides: python3-pcodedmp-doc %description help Module streams: Macros/VBA/ThisDocument - 1517 bytes Line #0: FuncDefn (Private Sub Document_Open()) Line #1: LitStr 0x001D "This could have been a virus!" Ld vbOKOnly Ld vbInformation Add LitStr 0x0006 "Virus!" ArgsCall MsgBox 0x0003 Line #2: LitStr 0x0008 "calc.exe" Paren ArgsCall Shell 0x0001 Line #3: EndSub ``` For reference, it is the result of compiling the following VBA code: ```vba Private Sub Document_Open() MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!" Shell("calc.exe") End Sub ``` ## Known problems - Office 2016 64-bit only: When disassembling variables declared as being of custom type (e.g., `Dim SomeVar As SomeType`), the type (`As SomeType`) is not disassembled. - Office 2016 64-bit only: The `Private` property of `Sub`, `Function` and `Property` declarations is not disassembled. - Office 2016 64-bit only: The `Declare` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled. - Office 2000 and higher: The type of a subroutine or function argument of type `ParamArray` is not disassembled correctly. For instance, `Sub Foo (ParamArray arg())` will be disassembled as `Sub Foo (arg)`. - All versions of Office: The `Alias "SomeName"` part of external function declarations (e.g., `Private Declare PtrSafe Function SomeFunc Lib "SomeLib" Alias "SomeName" () As Long`) is not disassembled. - All versions of Office: The `Public` property of custom type definitions (e.g., `Public Type SomeType`) is not disassembled. - All versions of Office: The custom type of a subroutine or function argument is not disassembled correctly and `CustomType` is used instead. For instance, `Sub Foo (arg As Bar)` will be disassembled as `Sub Foo (arg As CustomType)`. - If the output of the program is sent to a file, instead of to the console (either by using the `-o` option or by redirecting `stdout`), any non-ASCII strings (like module names, texsts used in the macros, etc.) might not be properly encoded. I do not have access to 64-bit Office 2016 and the few samples of documents, generated by this version of Office, that I have, have been insufficient for me to figure out where the corresponding information resides. I know where it resides in the other versions of Office, but it has been moved elsewhere in 64-bit Office 2016 and the old algorithms no longer work. ## To do - Implement support of VBA3 (Excel95). - While the script should support documents created by MacOffice, this has not been tested (and you know how well untested code usually works). This should be tested and any bugs related to it should be fixed. - I am not an experienced Python programmer and the code is ugly. Somebody more familiar with Python than me should probably rewrite the script and make it look better. ## Change log Version 1.2.6: - Changed it not to require the `win_unicode_console` module when it is not available - e.g., when not running on a Windows machine or when running under the PyPy implementation of Python, thanks to [Philippe Lagadec](https://github.com/decalage2). Version 1.2.5: - Added a sanity check to avoid errors when parsing object declarations - The functions that produce output now have the output file (default is `stdout`) as a parameter, for better integration with other tools, thanks to [Philippe Lagadec](https://github.com/decalage2). Version 1.2.4: - Implemented support for module names with non-ASCII characters in their names. Thanks to [Philippe Lagadec](https://github.com/decalage2) for helping me with that. - Fixed a parsing error when disassembling object declarations. - Removed some unused variables. - Improved the documentation a bit. Version 1.2.3: - Fixed a few crashes and documented better some disassembly failures. - Converted the script into a package that can be installed with ``pip``. Use the command ``pip install pcodedmp``. Version 1.2.2: - Implemented handling of documents saved in Open XML format (which is the default format of Office 2007 and higher) - `.docm`, `.xlsm`, `.pptm`. Version 1.2.1: - Now runs under Python 3.x too. - Improved support of 64-bit Office documents. - Implemented support of some VBA7-specific features (`Friend`, `PtrSafe`, `LongPtr`). - Improved the disassembling of `Dim` declarations. Version 1.2.0: - Disassembling the various declarations (`New`, `Type`, `Dim`, `ReDim`, `Sub`, `Function`, `Property`). Version 1.1.0: - Storing the opcodes in a more efficient manner. - Implemented VBA7 support. - Implemented support for documents created by the 64-bit version of Office. Version 1.0.0: - Initial version. %prep %autosetup -n pcodedmp-1.2.6 %build %py3_build %install %py3_install install -d -m755 %{buildroot}/%{_pkgdocdir} if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi pushd %{buildroot} if [ -d usr/lib ]; then find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst fi if [ -d usr/lib64 ]; then find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst fi if [ -d usr/bin ]; then find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst fi if [ -d usr/sbin ]; then find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst fi touch doclist.lst if [ -d usr/share/man ]; then find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst fi popd mv %{buildroot}/filelist.lst . mv %{buildroot}/doclist.lst . %files -n python3-pcodedmp -f filelist.lst %dir %{python3_sitelib}/* %files help -f doclist.lst %{_docdir}/* %changelog * Fri Apr 21 2023 Python_Bot - 1.2.6-1 - Package Spec generated