oletools_rs 0.1.0

Rust port of oletools — analysis tools for Microsoft Office files (VBA macros, DDE, OLE objects, RTF exploits)
Documentation
//! File type enums for format detection.

/// Detected file type.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum FileType {
    Unknown,
    // RTF
    Rtf,
    // OLE-based (legacy binary formats)
    Word97,
    Word6,
    Excel97,
    Excel5,
    Powerpoint97,
    // OOXML (ZIP-based)
    Word2007Docx,
    Word2007Docm,
    Word2007Dotx,
    Word2007Dotm,
    Excel2007Xlsx,
    Excel2007Xlsm,
    Excel2007Xlsb,
    Excel2007Xltx,
    Excel2007Xltm,
    Excel2007Xlam,
    Powerpoint2007Pptx,
    Powerpoint2007Pptm,
    Powerpoint2007Ppsx,
    Powerpoint2007Ppsm,
    Powerpoint2007Potx,
    Powerpoint2007Potm,
    Powerpoint2007Ppam,
    // Other OLE-based
    Msi,
    Visio,
    Access,
    Publisher,
    OneNote,
    // XML-based (non-ZIP)
    Word2003Xml,
    FlatOpc,
    // Non-Office
    Pdf,
    Png,
    Jpeg,
    Gif,
    ExePe,
    ExeElf,
    // Generic
    OleUnknown,
    ZipUnknown,
}

/// Container format.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum Container {
    Unknown,
    Rtf,
    Ole,
    Zip,
    OpenXml,
    FlatOpc,
    Mime,
    Xml,
}

/// Application that created the file.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum Application {
    Unknown,
    MsWord,
    MsExcel,
    MsPowerpoint,
    MsVisio,
    MsAccess,
    MsPublisher,
    MsOneNote,
    MsOffice,
}

/// Result of file type detection.
#[derive(Debug, Clone)]
pub struct FileTypeResult {
    /// Detected file type.
    pub file_type: FileType,
    /// Container format.
    pub container: Container,
    /// Application.
    pub application: Application,
    /// Whether the file may contain VBA macros.
    pub may_contain_vba: bool,
    /// Whether the file may contain XLM (Excel 4.0) macros.
    pub may_contain_xlm: bool,
    /// MIME type string.
    pub mime_type: &'static str,
}

impl Default for FileTypeResult {
    fn default() -> Self {
        Self {
            file_type: FileType::Unknown,
            container: Container::Unknown,
            application: Application::Unknown,
            may_contain_vba: false,
            may_contain_xlm: false,
            mime_type: "application/octet-stream",
        }
    }
}

impl std::fmt::Display for FileType {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            FileType::Unknown => write!(f, "Unknown"),
            FileType::Rtf => write!(f, "RTF"),
            FileType::Word97 => write!(f, "Word 97-2003 (.doc)"),
            FileType::Word6 => write!(f, "Word 6.0/95 (.doc)"),
            FileType::Excel97 => write!(f, "Excel 97-2003 (.xls)"),
            FileType::Excel5 => write!(f, "Excel 5.0/95 (.xls)"),
            FileType::Powerpoint97 => write!(f, "PowerPoint 97-2003 (.ppt)"),
            FileType::Word2007Docx => write!(f, "Word 2007+ (.docx)"),
            FileType::Word2007Docm => write!(f, "Word 2007+ Macro (.docm)"),
            FileType::Word2007Dotx => write!(f, "Word 2007+ Template (.dotx)"),
            FileType::Word2007Dotm => write!(f, "Word 2007+ Macro Template (.dotm)"),
            FileType::Excel2007Xlsx => write!(f, "Excel 2007+ (.xlsx)"),
            FileType::Excel2007Xlsm => write!(f, "Excel 2007+ Macro (.xlsm)"),
            FileType::Excel2007Xlsb => write!(f, "Excel 2007+ Binary (.xlsb)"),
            FileType::Excel2007Xltx => write!(f, "Excel 2007+ Template (.xltx)"),
            FileType::Excel2007Xltm => write!(f, "Excel 2007+ Macro Template (.xltm)"),
            FileType::Excel2007Xlam => write!(f, "Excel 2007+ Add-in (.xlam)"),
            FileType::Powerpoint2007Pptx => write!(f, "PowerPoint 2007+ (.pptx)"),
            FileType::Powerpoint2007Pptm => write!(f, "PowerPoint 2007+ Macro (.pptm)"),
            FileType::Powerpoint2007Ppsx => write!(f, "PowerPoint 2007+ Show (.ppsx)"),
            FileType::Powerpoint2007Ppsm => write!(f, "PowerPoint 2007+ Macro Show (.ppsm)"),
            FileType::Powerpoint2007Potx => write!(f, "PowerPoint 2007+ Template (.potx)"),
            FileType::Powerpoint2007Potm => write!(f, "PowerPoint 2007+ Macro Template (.potm)"),
            FileType::Powerpoint2007Ppam => write!(f, "PowerPoint 2007+ Add-in (.ppam)"),
            FileType::Msi => write!(f, "Windows Installer (.msi)"),
            FileType::Visio => write!(f, "Visio Drawing"),
            FileType::Access => write!(f, "Access Database"),
            FileType::Publisher => write!(f, "Publisher Document"),
            FileType::OneNote => write!(f, "OneNote Document"),
            FileType::Word2003Xml => write!(f, "Word 2003 XML"),
            FileType::FlatOpc => write!(f, "Flat OPC"),
            FileType::Pdf => write!(f, "PDF"),
            FileType::Png => write!(f, "PNG Image"),
            FileType::Jpeg => write!(f, "JPEG Image"),
            FileType::Gif => write!(f, "GIF Image"),
            FileType::ExePe => write!(f, "PE Executable"),
            FileType::ExeElf => write!(f, "ELF Executable"),
            FileType::OleUnknown => write!(f, "OLE (unknown app)"),
            FileType::ZipUnknown => write!(f, "ZIP (unknown)"),
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_default_result() {
        let result = FileTypeResult::default();
        assert_eq!(result.file_type, FileType::Unknown);
        assert!(!result.may_contain_vba);
    }

    #[test]
    fn test_file_type_display() {
        assert_eq!(FileType::Word97.to_string(), "Word 97-2003 (.doc)");
        assert_eq!(FileType::Excel2007Xlsm.to_string(), "Excel 2007+ Macro (.xlsm)");
    }
}