static void do_biff (MsOle *ole) { char *ptr; MsOleStream *stream; ptr = arg_data[arg_cur++]; if (!ptr) { printf ("Need a stream name\n"); return; } if (test_stream_open (&stream, ole, cur_dir, ptr, 'r') != MS_OLE_ERR_OK) { printf ("Error opening '%s'\n", ptr); return; } { BiffQuery *q = ms_biff_query_new (stream); guint16 last_opcode=0xffff; guint32 last_length=0; guint32 count=0; while (ms_biff_query_next(q)) { if (q->opcode == last_opcode && q->length == last_length) count++; else { if (count>0) printf (" x %d\n", count+1); else printf ("\n"); count=0; printf ("Opcode 0x%3x : %15s, length %d", q->opcode, get_biff_opcode_name (q->opcode), q->length); } last_opcode=q->opcode; last_length=q->length; } printf ("\n"); ms_ole_stream_close (&stream); } }
static void dump_biff_stream (GsfInput *stream) { guint8 const *data; guint16 len, opcode; unsigned pos = gsf_input_tell (stream); while (NULL != (data = gsf_input_read (stream, 4, NULL))) { gboolean enable_dump = TRUE; opcode = GSF_LE_GET_GUINT16 (data); len = GSF_LE_GET_GUINT16 (data+2); if (len > 15000) { enable_dump = TRUE; g_warning ("Suspicious import of biff record > 15,000 (0x%x) for opcode 0x%hx", len, opcode); } else if ((opcode & 0xff00) > 0x1000) { enable_dump = TRUE; g_warning ("Suspicious import of biff record with opcode 0x%hx", opcode); } if (enable_dump) printf ("Opcode 0x%3hx : %15s, length 0x%hx (=%hd)\n", opcode, get_biff_opcode_name (opcode), len, len); if (len > 0) { data = gsf_input_read (stream, len, NULL); if (data == NULL) break; if (enable_dump) gsf_mem_dump (data, len); } pos = gsf_input_tell (stream); } }
static void do_biff_raw (MsOle *ole) { char *ptr; MsOleStream *stream; ptr = arg_data[arg_cur++]; if (!ptr) { printf ("Need a stream name\n"); return; } if (test_stream_open (&stream, ole, cur_dir, ptr, 'r') != MS_OLE_ERR_OK) { printf ("Error opening '%s'\n", ptr); return; } { guint8 data[4], *buffer; buffer = g_new (guint8, 65550); while (stream->read_copy (stream, data, 4)) { guint32 len=MS_OLE_GET_GUINT16(data+2); /* printf ("0x%4x Opcode 0x%3x : %15s, length 0x%x (=%d)\n", stream->position, MS_OLE_GET_GUINT16(data), get_biff_opcode_name (MS_OLE_GET_GUINT16(data)), len, len);*/ printf ("Opcode 0x%3x : %15s, length 0x%x (=%d)\n", MS_OLE_GET_GUINT16(data), get_biff_opcode_name (MS_OLE_GET_GUINT16(data)), len, len); stream->read_copy (stream, buffer, len); ms_ole_dump (buffer, len); buffer[0]=0; buffer[len-1]=0; } ms_ole_stream_close (&stream); } }