Didier Stevens

Saturday 22 July 2017

oledump.py *.vir

Filed under: My Software — Didier Stevens @ 22:17

I was asked if oledump.py can “scan” multiple files: it can not, it can only analyze a single file at a time.

However, you can use it in a loop (bash, cmd, …) and call it each time with a different file. oledump.py will return 0 if there were no errors, 1 if there were, and 2 if the analyzed file contains VBA code.

My process-command.py tool can also be used to run a tool on many files. Here is an example with oledump:

process-command.py -r “oledump.py %f%” *.vir

While doing the analysis on all *.vir files in the current directory, 2 log files will be created in the current directory, one being a CSV file with the return value of the command (e.g. oledump):

0;sample1.vir
0;sample2.vir
2;sample3.vir
2;sample4.vir
0;sample5.vir
2;sample6.vir
2;sample7.vir
2;sample8.vir
0;sample9.vir
0;sample10.vir

3 Comments »

  1. […] oledump.py *.vir […]

    Pingback by Overview of Content Published In July | Didier Stevens — Tuesday 1 August 2017 @ 21:52

  2. How can I alter the method of using process-command.py on oledump.py to recurse subdirectories?

    Comment by Greg Kelley — Sunday 6 August 2017 @ 14:00

  3. That is not possible. What you can do, is create a list of files and pass that to process-command.py @list.txt.

    Comment by Didier Stevens — Wednesday 16 August 2017 @ 20:53


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Blog at WordPress.com.

%d bloggers like this: