malwaredb_types/doc/
office95.rs

1// SPDX-License-Identifier: Apache-2.0
2
3use crate::doc::DocumentFile;
4use crate::utils::u64_from_offset;
5use crate::{Ordering, SpecimenFile};
6
7use std::fmt::{Display, Formatter};
8
9use anyhow::{Context, Result, ensure};
10use chrono::{DateTime, Utc};
11use tracing::instrument;
12use uuid::{Uuid, uuid};
13
14const DOCFILE_MAGIC: [u8; 8] = [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];
15
16/// Clsid is the UUID which matches a `Docfile` subtype, and the first three segments
17/// could be in big or little endian, so we have to check both
18/// <http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File>
19#[derive(Clone, Debug, Eq)]
20pub struct Clsid {
21    /// Little Endian representation, most common
22    pub le_uuid: Uuid,
23
24    /// Big Endian representation, unlikely to be encountered
25    pub be_uuid: Uuid,
26}
27
28impl PartialEq for Clsid {
29    fn eq(&self, other: &Self) -> bool {
30        self.be_uuid == other.be_uuid || self.le_uuid == other.le_uuid
31    }
32}
33
34impl Clsid {
35    /// Microsoft Excel 5 through '95
36    pub const EXCEL5: Self = Clsid {
37        le_uuid: uuid!("10080200-0000-0000-c000-000000000046"),
38        be_uuid: uuid!("00020810-0000-0000-c000-000000000046"),
39    };
40
41    /// Microsoft Excel '97
42    pub const EXCEL97: Self = Clsid {
43        le_uuid: uuid!("20080200-0000-0000-c000-000000000046"),
44        be_uuid: uuid!("00020820-0000-0000-c000-000000000046"),
45    };
46
47    /// Microsoft Word 6 through '95
48    pub const WORD6: Self = Clsid {
49        le_uuid: uuid!("00090200-0000-0000-c000-000000000046"),
50        be_uuid: uuid!("00020900-0000-0000-c000-000000000046"),
51    };
52
53    /// Microsoft Word document
54    pub const DOC: Self = Clsid {
55        le_uuid: uuid!("06090200-0000-0000-c000-000000000046"),
56        be_uuid: uuid!("00020906-0000-0000-c000-000000000046"),
57    };
58
59    /// Microsoft Power Point 4
60    pub const POWERPOINT4: Self = Clsid {
61        le_uuid: uuid!("51480400-0000-0000-c000-000000000046"),
62        be_uuid: uuid!("00044851-0000-0000-c000-000000000046"),
63    };
64
65    /// Microsoft Power Point '95
66    pub const POWERPOINT95: Self = Clsid {
67        le_uuid: uuid!("ea7bae70-fb3b-11cd-a903-00aa00510ea3"),
68        be_uuid: uuid!("70ae7bea-3bfb-cd11-a903-00aa00510ea3"),
69    };
70
71    /// Microsoft Power Point '97 through 2003
72    pub const PPT: Self = Clsid {
73        le_uuid: uuid!("108d8164-9b4f-cf11-86ea-00aa00b929e8"),
74        be_uuid: uuid!("64818d10-4f9b-11cf-86ea-00aa00b929e8"),
75    };
76
77    /// Microsoft Installer
78    pub const MSI: Self = Clsid {
79        le_uuid: uuid!("000c1084-0000-0000-c000-000000000046"),
80        be_uuid: uuid!("84100c00-0000-0000-c000-000000000046"),
81    };
82
83    /// Microsoft Windows Update Patch
84    pub const MSP: Self = Clsid {
85        le_uuid: uuid!("000c1086-0000-0000-c000-000000000046"),
86        be_uuid: uuid!("86100c00-0000-0000-c000-000000000046"),
87    };
88
89    /// Equality between a [Clsid] and byte array
90    #[must_use]
91    pub fn equal(&self, bytes: &[u8; 16]) -> bool {
92        self.be_uuid.as_bytes() == bytes || self.le_uuid.as_bytes() == bytes
93    }
94}
95
96/// UUID file type, of which only a subset is of interest
97/// This is how we can filter out container formats, like .msi (installer) files.
98#[derive(Clone, Debug, Eq, PartialEq)]
99pub enum ClsidType {
100    /// Microsoft Excel
101    Excel,
102
103    /// Microsoft Power Point
104    PowerPoint,
105
106    /// Microsoft Word
107    Word,
108
109    /// Microsoft Installer
110    MSI,
111
112    /// Microsoft Windows Patch
113    MSP,
114
115    /// Unknown or unsupported non-MS Office document type
116    Unknown([u8; 16]),
117}
118
119impl ClsidType {
120    /// Clsid from a byte array
121    #[instrument]
122    pub fn from(bytes: &[u8; 16]) -> Self {
123        if Clsid::EXCEL5.equal(bytes) || Clsid::EXCEL97.equal(bytes) {
124            return Self::Excel;
125        }
126
127        if Clsid::WORD6.equal(bytes) || Clsid::DOC.equal(bytes) {
128            return Self::Word;
129        }
130
131        if Clsid::PPT.equal(bytes)
132            || Clsid::POWERPOINT4.equal(bytes)
133            || Clsid::POWERPOINT95.equal(bytes)
134        {
135            return Self::PowerPoint;
136        }
137
138        if Clsid::MSI.equal(bytes) {
139            return Self::MSI;
140        }
141
142        if Clsid::MSP.equal(bytes) {
143            return Self::MSP;
144        }
145
146        Self::Unknown(*bytes)
147    }
148}
149
150impl ClsidType {
151    /// If the Clsid is a document type
152    #[inline]
153    #[must_use]
154    pub fn is_document(&self) -> bool {
155        matches!(self, ClsidType::Excel | ClsidType::PowerPoint | ClsidType::Word)
156    }
157}
158
159impl Display for ClsidType {
160    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
161        match self {
162            ClsidType::Excel => write!(f, "Excel"),
163            ClsidType::PowerPoint => write!(f, "PowerPoint"),
164            ClsidType::Word => write!(f, "Word"),
165            ClsidType::MSI => write!(f, "Installer"),
166            ClsidType::MSP => write!(f, "Windows Patch"),
167            ClsidType::Unknown(uuid) => write!(f, "Unknown/other {}", hex::encode(uuid)),
168        }
169    }
170}
171
172/// A struct representing the older Microsoft Office format, Office95, aka Docfile.
173///
174/// This format is really a container format, and could be used to hold a non-Office files,
175/// such as installers (.msi files), Windows update files, and others. Here we are only concerned
176/// with MS Office types.
177#[derive(Clone, Debug)]
178pub struct Office95<'a> {
179    /// Sub-type for the file
180    pub clsid: ClsidType,
181
182    /// Creation date of the document
183    pub creation_time: Option<DateTime<Utc>>,
184
185    /// Date the document was last modified
186    pub modification_time: Option<DateTime<Utc>>,
187
188    /// The array containing the raw bytes used to parse this document
189    pub contents: &'a [u8],
190}
191
192impl<'a> Office95<'a> {
193    /// Office95 `DOCFILE` type parsed from a sequence of bytes
194    ///
195    /// # Errors
196    ///
197    /// Returns an error if the document fails to parse as an Office95/Docfile, or if the CLSID isn't known.
198    #[instrument(name = "Office95/Docfile parser", skip(contents))]
199    pub fn from(contents: &'a [u8]) -> Result<Self> {
200        ensure!(contents.starts_with(&DOCFILE_MAGIC), "Not a DOCFILE");
201
202        let offset: [u8; 4] = contents[48..52]
203            .try_into()
204            .context("Failed to get slice for Office95 offset")?;
205        let offset_int = u32::from_le_bytes(offset);
206        let offset_int = (512 * (1 + offset_int) + 80) as usize;
207        let clsid: [u8; 16] = contents[offset_int..offset_int + 16]
208            .try_into()
209            .context("Failed to get slide for Office95 clsid")?;
210
211        let creation_time = if let Some(creation_time) =
212            u64_from_offset(contents, offset_int + 20, Ordering::LittleEndian)
213        {
214            if creation_time > 0 {
215                // The `nt_time` use of the From trait has `.expect()` which may be a problem, since
216                // we're dealing with malware, so we have to expect funny business.
217                // https://github.com/sorairolake/nt-time/issues/149
218                Some(DateTime::<Utc>::from(nt_time::FileTime::new(creation_time)))
219            } else {
220                None
221            }
222        } else {
223            None
224        };
225
226        let modification_time = if let Some(modification_time) =
227            u64_from_offset(contents, offset_int + 28, Ordering::LittleEndian)
228        {
229            if modification_time > 0 {
230                // The `nt_time` use of the From trait has `.expect()` which may be a problem, since
231                // we're dealing with malware, so we have to expect funny business.
232                // https://github.com/sorairolake/nt-time/issues/149
233                Some(DateTime::<Utc>::from(nt_time::FileTime::new(modification_time)))
234            } else {
235                None
236            }
237        } else {
238            None
239        };
240
241        let clsid = ClsidType::from(&clsid);
242        ensure!(
243            clsid.is_document(),
244            "Office95: CLSID `{clsid}` is not a known or supported document type"
245        );
246
247        Ok(Self {
248            clsid,
249            creation_time,
250            modification_time,
251            contents,
252        })
253    }
254}
255
256// TODO: Better Office95 parsing
257impl DocumentFile for Office95<'_> {
258    fn pages(&self) -> u32 {
259        0
260    }
261
262    fn author(&self) -> Option<String> {
263        None
264    }
265
266    fn title(&self) -> Option<String> {
267        None
268    }
269
270    fn has_javascript(&self) -> bool {
271        false
272    }
273
274    fn has_form(&self) -> bool {
275        false
276    }
277
278    fn creation_time(&self) -> Option<DateTime<Utc>> {
279        self.creation_time
280    }
281
282    fn modification_time(&self) -> Option<DateTime<Utc>> {
283        self.modification_time
284    }
285}
286
287impl SpecimenFile for Office95<'_> {
288    const MAGIC: &'static [&'static [u8]] = &[&DOCFILE_MAGIC];
289
290    fn type_name(&self) -> &'static str {
291        "Office95"
292    }
293}
294
295impl Display for Office95<'_> {
296    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
297        write!(f, "Type: {}", self.clsid)?;
298        if let Some(created) = self.creation_time {
299            write!(f, ", Created: {created}")?;
300        }
301        if let Some(modified) = self.modification_time {
302            write!(f, ", Modified: {modified}")?;
303        }
304        write!(f, ", Size: {}", self.contents.len())
305    }
306}
307
308#[cfg(test)]
309mod tests {
310    use super::*;
311    use rstest::rstest;
312
313    #[rstest]
314    #[case::word(include_bytes!("../../testdata/office95/word.doc"), ClsidType::Word)]
315    #[case::excel(include_bytes!("../../testdata/office95/excel.xls"), ClsidType::Excel)]
316    #[case::powerpoint(include_bytes!("../../testdata/office95/powerpoint.ppt"), ClsidType::PowerPoint)]
317    fn doc(#[case] bytes: &[u8], #[case] expected_clsid: ClsidType) {
318        let office = Office95::from(bytes).unwrap();
319        println!("{office}");
320        assert_eq!(office.clsid, expected_clsid);
321    }
322}
malwaredb_types/doc/office95.rs

malwaredb_types/doc/
office95.rs
