Navigation

4.6. lf.win.ole.ps — OLE property sets

This package provides support to work with OLE property sets. Microsoft OLE property sets are a generic format for persisting metadata. They are commonly used with OLE structured storage (e.g. lf.win.ole.cfb)

Several of the classes take a decoder parameter. This parameter is used to decode (interpret) embedded strings.

Additionally, some of the classes truncate strings at the first NULL byte. Any class that does truncate a string can only do so if a valid decoder is available.

4.6.1. Inheritance Diagrams

4.6.1.1. Base classes

digraph oleps_base_classes { fontname = "Courier New" fontsize = 10 node [ fontname = "Courier New" fontsize = 10 shape = "record" ] edge [ arrowhead = "none" arrowtail = "empty" fontsize = 8 ] Packet [ label = "{Packet\l|\l|}" ] ActiveStructuple [ label = "{ActiveStructuple\l|\l|}" ] ActivePacket [ label = "{ActivePacket\l|\l|}" ] PropertyPacket [ label = "{PropertyPacket\l|size\lvalue\l|}" ] ValuePacket [ label = "{ValuePacket\l|size\lvalue\l|}" ] Packet -> ActivePacket; ActiveStructuple -> ActivePacket; ActivePacket -> PropertyPacket; ActivePacket -> ValuePacket; }

4.6.1.2. Common OLE data types

digraph oleps_common_data_types { fontname = "Courier New" fontsize = 10 node [ fontname = "Courier New" fontsize = 10 shape = "record" ] edge [ arrowhead = "none" arrowtail = "empty" fontsize = 8 ] ValuePacket [ label = "{ValuePacket\l|size\lvalue\l|}" ] CURRENCY [ label = "{CURRENCY\l|\l|}" ] DATE [ label = "{DATE\l|\l|}" ] CodePageString [ label = "{CodePageString\l|\l|}" ] DECIMAL [ label = "{DECIMAL\l|\l|}" ] UnicodeString [ label = "{UnicodeString\l|\l|}" ] FILETIME [ label = "{FILETIME\l|\l|}" ] BLOB [ label = "{BLOB\l|\l|}" ] IndirectPropertyName [ label = "{IndirectPropertyName\l|\l|}" ] ClipboardData [ label = "{ClipboardData\l|\l|}" ] GUID [ label = "{GUID\l|\l|}" ] VersionedStream [ label = "{VersionedStream\l|\l|}" ] HRESULT [ label = "{HRESULT\l|\l|}" ] Array [ label = "{Array\l|\l|}" ] Vector [ label = "{Vector\l|\l|}" ] Sequence [ label = "{Sequence\l|\l|}" ] ValuePacket -> CURRENCY; ValuePacket -> DATE; ValuePacket -> CodePageString; ValuePacket -> DECIMAL; ValuePacket -> UnicodeString; ValuePacket -> FILETIME; ValuePacket -> BLOB; CodePageString -> IndirectPropertyName; ValuePacket -> ClipboardData; ValuePacket -> GUID; ValuePacket -> VersionedStream; ValuePacket -> HRESULT; ValuePacket -> Array; ValuePacket -> Vector; ValuePacket -> Sequence; }

4.6.1.3. Typed Property Value (TPV) classes

digraph oleps_tpv_classes { fontname = "Courier New" fontsize = 10 node [ fontname = "Courier New" fontsize = 10 shape = "record" ] edge [ arrowhead = "none" arrowtail = "empty" fontsize = 8 ] PropertyPacket [ label = "{PropertyPacket\l|size\lvalue\l|}" ] TypedPropertyValue [ label = "{TypedPropertyValue\l|type\l_ctype\l|}" ] VT_EMPTY [ label = "{VT_EMPTY\l|\l|}" ] VT_NULL [ label = "{VT_NULL\l|\l|}" ] VT_I2 [ label = "{VT_I2\l|\l|}" ] VT_I4 [ label = "{VT_I4\l|\l|}" ] VT_R4 [ label = "{VT_R4\l|\l|}" ] VT_R8 [ label = "{VT_R8\l|\l|}" ] VT_CY [ label = "{VT_CY\l|\l|}" ] VT_DATE [ label = "{VT_DATE\l|\l|}" ] VT_LPSTR [ label = "{VT_LPSTR\l|\l|}" ] VT_ERROR [ label = "{VT_ERROR\l|\l|}" ] VT_BOOL [ label = "{VT_BOOL\l|\l|}" ] VT_DECIMAL [ label = "{VT_DECIMAL\l|\l|}" ] VT_I1 [ label = "{VT_I1\l|\l|}" ] VT_UI1 [ label = "{VT_UI1\l|\l|}" ] VT_UI2 [ label = "{VT_UI2\l|\l|}" ] VT_UI4 [ label = "{VT_UI4\l|\l|}" ] VT_I8 [ label = "{VT_I8\l|\l|}" ] VT_UI8 [ label = "{VT_UI8\l|\l|}" ] VT_INT [ label = "{VT_INT\l|\l|}" ] VT_UINT [ label = "{VT_UINT\l|\l|}" ] VT_BSTR [ label = "{VT_BSTR\l|\l|}" ] VT_LPWSTR [ label = "{VT_LPWSTR\l|\l|}" ] VT_FILETIME [ label = "{VT_FILETIME\l|\l|}" ] VT_BLOB [ label = "{VT_BLOB\l|\l|}" ] VT_STREAM [ label = "{VT_STREAM\l|\l|}" ] VT_STORAGE [ label = "{VT_STORAGE\l|\l|}" ] VT_STREAMED_OBJECT [ label = "{VT_STREAMED_OBJECT\l|\l|}" ] VT_STORED_OBJECT [ label = "{VT_STORED_OBJECT\l|\l|}" ] VT_BLOB_OBJECT [ label = "{VT_BLOB_OBJECT\l|\l|}" ] VT_CF [ label = "{VT_CF\l|\l|}" ] VT_CLSID [ label = "{VT_CLSID\l|\l|}" ] VT_VERSIONED_STREAM [ label = "{VT_VERSIONED_STREAM\l|\l|}" ] VT_ARRAY [ label = "{VT_ARRAY\l|\l|}" ] VT_VECTOR [ label = "{VT_VECTOR\l|\l|}" ] PropertyPacket -> TypedPropertyValue; TypedPropertyValue -> VT_EMPTY; TypedPropertyValue -> VT_NULL; TypedPropertyValue -> VT_I2; TypedPropertyValue -> VT_I4; TypedPropertyValue -> VT_R4; TypedPropertyValue -> VT_R8; TypedPropertyValue -> VT_CY; TypedPropertyValue -> VT_DATE; TypedPropertyValue -> VT_LPSTR; TypedPropertyValue -> VT_ERROR; TypedPropertyValue -> VT_BOOL; TypedPropertyValue -> VT_DECIMAL; TypedPropertyValue -> VT_I1; TypedPropertyValue -> VT_UI1; TypedPropertyValue -> VT_UI2; TypedPropertyValue -> VT_UI4; TypedPropertyValue -> VT_I8; TypedPropertyValue -> VT_UI8; VT_I4 -> VT_INT; VT_UI4 -> VT_UINT; TypedPropertyValue -> VT_BSTR; TypedPropertyValue -> VT_LPWSTR; TypedPropertyValue -> VT_FILETIME; TypedPropertyValue -> VT_BLOB; VT_BSTR -> VT_STREAM; VT_BSTR -> VT_STORAGE; VT_BSTR -> VT_STREAMED_OBJECT; VT_BSTR -> VT_STORED_OBJECT; VT_BLOB -> VT_BLOB_OBJECT; TypedPropertyValue -> VT_CF; TypedPropertyValue -> VT_CLSID; TypedPropertyValue -> VT_VERSIONED_STREAM; TypedPropertyValue -> VT_ARRAY; TypedPropertyValue -> VT_VECTOR; }

4.6.2. Base Classes

class lf.win.ole.ps.Packet
Base class for packet types.
class lf.win.ole.ps.ActivePacket
Base class for a packet type that can read from streams/ctypes.
class lf.win.ole.ps.PropertyPacket

Base class for packet types associated with a property.

size
The total number of bytes in the packet, including any header, value, and padding fields.
value
The represented value.
class lf.win.ole.ps.ValuePacket

Base class for packet types associated with the value of a property.

size
The total number of bytes in the packet, including any header, value, and padding fields.
value
The represented value.

4.6.3. Headers

class lf.win.ole.ps.PropertySetStreamHeader

Represents the header of a PropertySetStream structure (packet).

byte_order
The byte order field.
version
The version of the OLE property set.
sys_id
The system identifier field.
clsid
The CLSID of the associated property set(s).
property_set_count
The number of property sets in the stream.
fmtid0
A GUID that identifies the property set format of the first property set.
offset0
The offset of the first property set, relative to the start of the PropertySetStreamHeader structure.
fmtid1
A GUID that identifiers the property set format of the second property set. If there is only one property set, this is set to None.
offset1
The offset of the second property set, relative to the start of the PropertySetStreamHeader structure. If there is only one property set, this is set to None.
classmethod from_stream(stream, offset=None)

Creates a PropertySetStreamHeader object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the PropertySetStreamHeader structure.
  • offset (int) – The start of the structure in stream.
Return type:

PropertySetStreamHeader
Returns:

The corresponding PropertySetStreamHeader object.
class lf.win.ole.ps.PropertySetHeader

Represents the header of a PropertySet structure. (packet)

size
The total size (in bytes) of the PropertySetHeader structure.
pair_count
The number of pid/offset pairs.
pids_offsets
A dictionary of property identifiers and the corresponding properties.
classmethod from_stream(stream, offset=None)

Creates a PropertySetHeader object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the PropertySetHeader structure.
  • offset (int) – The start of the structure in stream.
Return type:

PropertySetHeader
Returns:

The corresponding PropertySetHeader object.

4.6.4. Special Properties

class lf.win.ole.ps.Dictionary

Represents a Dictionary property.

property_count
A count of the number of properties in the mapping. This is a field in the data type (i.e. not len(mapping)).
mapping
A dictionary of property identifiers (keys) and names (values).
value
An alias for the mapping attribute.
classmethod from_stream(stream, offset=None, code_page=None, decoder=None)

Creates a Dictionary object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the Dictionary property.
  • offset (int) – The start of the property in stream.
  • code_page (int) – The value of the CodePage property.
  • decoder (codecs.codec) – An optional codec to decode the names.
Return type:

Dictionary
Returns:

The corresponding Dictionary object.
class lf.win.ole.ps.DictionaryEntry

Represents a DictionaryEntry structure (packet).

pid
The property identifier
name
The name associated with the property identifier.
value
An alias for the name attribute.
classmethod from_stream(stream, offset=None, code_page=None, decoder=None)

Creates a DictionaryEntry object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the DictionaryEntry property.
  • offset (int) – The start of the property in stream.
  • code_page (int) – The value of the CodePage property.
  • decoder (codecs.codec) – An optional codec to decode the names.
Return type:

DictionaryEntry
Returns:

The corresponding DictionaryEntry object.

4.6.5. Common OLE data types

class lf.win.ole.ps.CURRENCY

Represents a CURRENCY structure (packet).

classmethod from_stream(stream, offset=None, decoder=None)

Creates a CURRENCY object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the CURRENCY structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

CURRENCY
Returns:

The corresponding CURRENCY object.
class lf.win.ole.ps.DATE

Represents a DATE structure (packet).

classmethod from_stream(stream, offset=None, decoder=None)

Creates a DATE object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the DATE structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

DATE
Returns:

The corresponding DATE object.
class lf.win.ole.ps.CodePageString

Represents a CodePageString structure (packet).

classmethod from_stream(stream, offset=None, decoder=None)

Creates a CodePageString object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the CodePageString structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode the string.
Return type:

CodePageString
Returns:

The corresponding CodePageString object.
class lf.win.ole.ps.DECIMAL

Represents a DECIMAL structure (packet).

classmethod from_stream(stream, offset=None, decoder=None)

Creates a DECIMAL object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the DECIMAL structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

DECIMAL
Returns:

The corresponding DECIMAL object.
class lf.win.ole.ps.UnicodeString

Represents a UnicodeString structure (packet).

classmethod from_stream(stream, offset=None, decoder=None)

Creates a UnicodeString object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the UnicodeString structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode the string.
Return type:

UnicodeString
Returns:

The corresponding UnicodeString object.
class lf.win.ole.ps.FILETIME

Represents a FILETIME structure (packet).

classmethod from_stream(stream, offset=None, decoder=None)

Creates a FILETIME object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the FILETIME structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

FILETIME
Returns:

The corresponding FILETIME object.
class lf.win.ole.ps.BLOB

Represents a BLOB structure (packet).

classmethod from_stream(stream, offset=None, decoder=None)

Creates a BLOB object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the BLOB structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

BLOB
Returns:

The corresponding BLOB object.
class lf.win.ole.ps.IndirectPropertyName
Represents an IndirectPropertyName structure (packet).
class lf.win.ole.ps.ClipboardData

Represents a ClipboardData structure (packet).

format
The format field.
data
The data field.
value
An alias for the data attribute.
classmethod from_stream(stream, offset=None, decoder=None)

Creates a ClipboardData object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the ClipboardData structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

ClipboardData
Returns:

The corresponding ClipboardData object.
class lf.win.ole.ps.GUID

Represents a GUID structure (packet).

classmethod from_stream(stream, offset=None, decoder=None)

Creates a GUID object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the GUID structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

GUID
Returns:

The corresponding GUID object.
class lf.win.ole.ps.VersionedStream

Represents a VersionedStream structure (packet).

version_guid
The VersionGuid field.
stream_name
The StreamName field.
value
An alias for the stream_name attribute.
classmethod from_stream(stream, offset=None, decoder=None)

Creates a VersionedStream object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the VersionedStream structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode the stream name.
Return type:

VersionedStream
Returns:

The corresponding VersionedStream object.
class lf.win.ole.ps.HRESULT

Represents an HRESULT structure (packet).

Note

The value attribute is an instance of lf.win.objects.HRESULT

classmethod from_stream(stream, offset=None, decoder=None)

Creates a HRESULT object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the HRESULT structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

HRESULT
Returns:

The corresponding HRESULT object.
classmethod from_ctype(ctype)

Creates a HRESULT object from a ctype.

Parameter:ctype (hresult_le or hresult_be) – An hresult ctypes object.
Return type:HRESULT
Returns:The corresponding HRESULT object.
class lf.win.ole.ps.Array

Represents the value from a VT_ARRAY property.

scalar_type
The property type contained in the array. This is an extracted value.
dimension_count
The number of dimensions in the array.
dimensions
A list of the (size, index_offset) attributes for each dimension.
value
A flattened list of the values.
classmethod from_stream(stream, offset=None, decoder=None)

Creates an Array object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the Array structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode the string properties.
Raises ValueError:
 

If the extracted scalar type is an invalid property type.
Return type:

Array
Returns:

The corresponding Array object.
class lf.win.ole.ps.Vector

Represents the value from a VT_VECTOR packet.

scalar_count
The number of elements in the vector.
value
A list of elements in the vector.
classmethod from_stream(stream, scalar_type, offset=None, decoder=None)

Creates a Vector object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the Vector structure.
  • scalar_type (lf.win.ole.ps.consts.PropertyType) – The type of the properties in the Vector structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode the string properties.
Raises ValueError:
 

If scalar_type is an invalid property type.
Return type:

Vector
Returns:

The corresponding Vector object.
class lf.win.ole.ps.Sequence

A ValuePacket that is composed of a sequence of values.

The value attribute is a list of (possibly more lists of) the values in the sequence.

Note

This is used internally by the Array and Vector classes to extract the individual elements.

classmethod from_stream(stream, ptype, count, offset=None, decoder=None)

Creates a sequence of various properties from a stream.

Note

This method will round the size up to the nearest multiple of 4.

Parameters:
  • stream (IStream) – A stream that contains the sequence.
  • ptype (lf.win.ole.ps.consts.PropertyType) – The property type of the elements in the Sequence.
  • count (int) – The number of elements in the sequence.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode string properties.
Raises ValueError:
 

If ptype is an invalid property type.
Return type:

Sequence
Returns:

The corresponding Sequence object.
classmethod from_factory(stream, factory, count, offset=None, decoder=None)

Creates a sequence of various properties, given a factory.

Note

It is up to the calling function to round the size up to the nearest multiple of 4 (if necessary).

Parameters:
  • stream (IStream) – A stream that contains the sequence.
  • factory (function) – A factory function to create the properties. This function must accept the same arguments as TypedPropertyValue.from_stream().
  • count (int) – The number of elements in the sequence.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode string properties.
Return type:

Sequence
Returns:

The corresponding Sequence object.

4.6.6. Typed Property Value (TPV) classes

The following classes represent typed values of a property.

class lf.win.ole.ps.TypedPropertyValue

Base class for TypedPropertyValue packets.

type
The property type.
_ctype
A ctypes ctype used to extract the various properties.
classmethod from_stream(stream, offset=None, decoder=None)

Creates a TypedPropertyValue object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec, used only if the property requires a decoder.
Return type:

TypedPropertyValue
Returns:

The corresponding TypedPropertyValue object.
class lf.win.ole.ps.VT_EMPTY
Typed value VT_EMPTY.
class lf.win.ole.ps.VT_NULL
Typed value VT_NULL.
class lf.win.ole.ps.VT_I2
Typed value VT_I2.
class lf.win.ole.ps.VT_I4
Typed value VT_I4.
class lf.win.ole.ps.VT_R4
Typed value VT_R4.
class lf.win.ole.ps.VT_R8
Typed value VT_R8.
class lf.win.ole.ps.VT_CY

Typed value VT_CY.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_CY object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec, used only if the property requires a decoder.
Return type:

VT_CY
Returns:

The corresponding VT_CY object.
class lf.win.ole.ps.VT_DATE

Typed value VT_DATE.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_DATE object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec, used only if the property requires a decoder.
Return type:

VT_DATE
Returns:

The corresponding VT_DATE object.
class lf.win.ole.ps.VT_LPSTR

Typed value VT_LPSTR.

Note

The value attribute is the value attribute from a CodePageString object.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_LPSTR object from a stream.

Note

If a decoder is specified, then the string will be decoded and trimmed to the first null terminator (if found).

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec, used only if the property requires a decoder.
Return type:

VT_LPSTR
Returns:

The corresponding VT_LPSTR object.
class lf.win.ole.ps.VT_ERROR

Typed value VT_ERROR.

Note

The value attribute is an instance of an HRESULT class.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_ERROR object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

VT_ERROR
Returns:

The corresponding VT_ERROR object.
class lf.win.ole.ps.VT_BOOL
Typed value VT_BOOL.
class lf.win.ole.ps.VT_DECIMAL

Typed value VT_DECIMAL.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_DECIMAL object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec, used only if the property requires a decoder.
Return type:

VT_DECIMAL
Returns:

The corresponding VT_DECIMAL object.
class lf.win.ole.ps.VT_I1
Typed value VT_I1.
class lf.win.ole.ps.VT_UI1
Typed value VT_UI1.
class lf.win.ole.ps.VT_UI2
Typed value VT_UI2.
class lf.win.ole.ps.VT_UI4
Typed value VT_UI4.
class lf.win.ole.ps.VT_I8
Typed value VT_I8.
class lf.win.ole.ps.VT_UI8
Typed value VT_UI8.
class lf.win.ole.ps.VT_INT
Typed value VT_INT.
class lf.win.ole.ps.VT_UINT
Typed value VT_UINT.
class lf.win.ole.ps.VT_BSTR

Typed value VT_BSTR.

Note

The value attribute is the value attribute from a CodePageString.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_BSTR object from a stream.

Note

If a decoder is specified, then the string will be decoded. Unlike VT_LPSTR classes, the string is not trimmed, since it may contain embedded NULLs.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec, used only if the property requires a decoder.
Return type:

VT_BSTR
Returns:

The corresponding VT_BSTR object.
class lf.win.ole.ps.VT_LPWSTR

Typed value VT_LPWSTR.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_LPWSTR object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec, used only if the property requires a decoder.
Return type:

VT_LPWSTR
Returns:

The corresponding VT_LPWSTR object.
class lf.win.ole.ps.VT_FILETIME

Typed value VT_FILETIME.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_FILETIME object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

VT_FILETIME
Returns:

The corresponding VT_FILETIME object.
class lf.win.ole.ps.VT_BLOB

Typed value VT_BLOB.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_BLOB object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

VT_BLOB
Returns:

The corresponding VT_BLOB object.
class lf.win.ole.ps.VT_STREAM
Typed value VT_STREAM.
class lf.win.ole.ps.VT_STORAGE
Typed value VT_STORAGE.
class lf.win.ole.ps.VT_STREAMED_OBJECT
Typed value VT_STREAMED_OBJECT.
class lf.win.ole.ps.VT_STORED_OBJECT
Type value
class lf.win.ole.ps.VT_BLOB_OBJECT
Typed value VT_BLOB_OBJECT.
class lf.win.ole.ps.VT_CF

Typed value VT_CF.

value
An instance of ClipboardData.
classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_CF object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

VT_CF
Returns:

The corresponding VT_CF object.
class lf.win.ole.ps.VT_CLSID

Typed value VT_CLSID.

classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_CLSID object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (None) – This parameter is not used.
Return type:

VT_CLSID
Returns:

The corresponding VT_CLSID object.
class lf.win.ole.ps.VT_VERSIONED_STREAM

Typed value VT_VERSIONED_STREAM.

value
An instance of a VersionedStream object.
classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_VERSIONED_STREAM object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode string properties.
Return type:

VT_VERSIONED_STREAM
Returns:

The corresponding VT_VERSIONED_STREAM object.
class lf.win.ole.ps.VT_ARRAY

Typed value VT_ARRAY.

value
An instance of an Array object.
classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_ARRAY object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode string properties.
Return type:

VT_ARRAY
Returns:

The corresponding VT_ARRAY object.
class lf.win.ole.ps.VT_VECTOR

Typed value VT_VECTOR.

value
An instance of a Vector object.
classmethod from_stream(stream, offset=None, decoder=None)

Creates a VT_VECTOR object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode string properties.
Return type:

VT_VECTOR
Returns:

The corresponding VT_VECTOR object.

4.6.7. Building properties

These classes are used to build properties and property sets.

class lf.win.ole.ps.PropertyFactory

A class that makes properties.

classmethod make(stream, offset=None, decoder=None)

Makes a property object from a stream.

Parameters:
  • stream (IStream) – A stream that contains the property structure.
  • offset (int) – The start of the structure in stream.
  • decoder (codecs.codec) – An optional codec to decode string properties.
Return type:

PropertyPacket
Returns:

The corresponding PropertyPacket (or subclass) object.
class lf.win.ole.ps.PropertySet

Represents a PropertySet structure (packet).

size
The size in bytes of the PropertySetHeader structure.
pair_count
The number of pid/offset pairs.
pids_offsets
A dictionary of property identifiers and the offsets of the corresponding properties.
properties
A dictionary of property identifiers and the corresponding properties.
class lf.win.ole.ps.PropertySetStream

Represents a PropertySetStream structure (packet).

byte_order
The byte order field.
version
The version of the OLE property set.
sys_id
The system identifier field.
clsid
The CLSID of the associated property set(s).
property_set_count
The number of property sets in the stream.
fmtid0
A GUID that identifies the property set format of the first property set. If there are no property sets, this should be None.
offset0
The offset of the first property set, relative to the start of the PropertySetStreamHeader structure. If there are no property sets, this should be None.
fmtid1
A GUID that idientifies the property set format of the second property set. If there is only one property set, this should be None.
offset1
The offset of the second property set, relative to the start of the PropertySetStreamHeader structure. If there is only one property set, this should be None.
property_set_0
An instance of PropertySet that represents the first property set. If there are no property sets, this should be None.
property_set_1
An instance of PropertySet that represents the second property set. If there are no property sets, this should be None.
class lf.win.ole.ps.Builder

Builds property set streams.

classmethod build(stream, offset=None, decoder=None)

Builds property set streams from a stream.

Parameters:
  • stream (IStream) – A stream that contains the property (and related) structures.
  • offset (int) – The start of the structures in stream.
  • decoder (codecs.codec) – An optional codec to decode string properties. If this value is None, one is guessed by using the CodePage property.
Return type:

PropertySetStream
Returns:

The corresponding PropertySetStream object.
classmethod build_property_set_stream_header(stream, offset=None)

Builds a PropertySetStreamHeader object.

Parameters:
  • stream (IStream) – A stream that contains the structure.
  • offset (int) – The start of the structure in stream.
Return type:

PropertySetStreamHeader
Returns:

The corresponding PropertySetStreamHeader object.
classmethod build_property_set_header(stream, offset=None, fmtid=None)

Builds a PropertySetHeader object.

Parameters:
  • stream (IStream) – A stream that contains the property set header structure.
  • offset (int) – The start of the structure in stream.
  • fmtid (UUID) – The FMTID of the property set.
Return type:

PropertySetHeader
Returns:

The corresponding PropertySetHeader object.
classmethod build_properties(stream, property_set, offset=None, fmtid=None, decoder=None)

Builds a dictionary of PropertyPacket objects.

Parameters:
  • stream (IStream) – A stream that contains the property structures.
  • property_set (PropertySetHeader) – A PropertySetHeader object that describes the properties in the property set.
  • offset (int) – The start of the structures in stream.
  • fmtid (UUID) – The FMTID of the property set.
  • decoder (codecs.codec) – A codec to decode string properties.
Return type:

dict
Returns:

A dictionary of property identifiers (keys) and the corresponding PropertyPacket objects (values).

4.6.8. Metadata

These classes extract metadata from OLE property sets. Right now, it is just a subset of the existing properties in a property set.

class lf.win.ole.ps.PropertySetMetadata

Metadata for a PropertySet.

byte_order
The value of the byte order field.
version
The version of the OLE property set.
sys_id
The system identifier field.
clsid
The CLSID of the associated property set.
fmtid0
The FMTID of the first property set.
fmtid1
The FMTID of the second property set.
classmethod from_property_set(property_set)

Creates a PropertySetMetadata from a property set.

Parameter:property_set (PropertySet) – The property set to examine.
Return type:PropertySetMetadata
Returns:The corresponding PropertySetMetadata object.
class lf.win.ole.ps.PropertiesMetadata

Metadata for the properties of a PropertySet.

code_page
The value of the CodePage property.
dictionary
A dictionary of property identifiers (keys) and names (values).
locale
The value of the locale property.
behavior
The value of the behavior property.
attr_exists
A set of the attribute names that were found in the property set.
classmethod from_properties(properties)

Creates a PropertiesMetadata object from properties.

Parameter:properties (dict) – A dictionary of property identifiers (keys) and the corresponding PropertyPacket objects.
Return type:PropertiesMetadata
Returns:The corresponding PropertiesMetadata object.

Table Of Contents

Previous topic

4.5. lf.win.ole.cfb.ctypes — OLE structured storage ctypes

Next topic

4.7. lf.win.ole.ps.consts — Constants for OLE property sets

This Page

Navigation

© Copyright 2010, Michael Murr <mmurr@codeforensics.net>. Created using Sphinx 0.6.5.