private void GetImagesPpt(OleDocument doc) { using (Stream stmPictures = doc.OpenStream("Pictures")) { if (stmPictures == null) { return; } int ImagesFound = 0; stmPictures.Seek(0, SeekOrigin.Begin); while (stmPictures.Position < stmPictures.Length - 0x19) { stmPictures.Seek(0x4, SeekOrigin.Current); BinaryReader brData = new BinaryReader(stmPictures); UInt32 PICLength = brData.ReadUInt32(); if (PICLength == 0 || stmPictures.Position + PICLength > stmPictures.Length) { break; } byte[] bufferPIC = brData.ReadBytes((int)PICLength); string strImageName = "Image" + ImagesFound++; using (MemoryStream msJPG = new MemoryStream(bufferPIC, 0x11, bufferPIC.Length - 0x11)) { EXIFDocument eDoc = new EXIFDocument(msJPG, ".jpg"); eDoc.analyzeFile(); eDoc.Close(); if (eDoc.Thumbnail != null) { lon += eDoc.Thumbnail.Length; } cont++; System.Diagnostics.Debug.WriteLine(cont.ToString()); System.Diagnostics.Debug.WriteLine(lon / (1024 * 1024) + " Megacas"); dicPictureEXIF.Add(strImageName, eDoc); foreach (UserItem uiEXIF in eDoc.FoundUsers.Items) { FoundUsers.AddUniqueItem(uiEXIF.Name, false, uiEXIF.Notes); } foreach (ApplicationsItem Application in eDoc.FoundMetaData.Applications.Items) { string strApplication = Application.Name; if (!string.IsNullOrEmpty(strApplication.Trim()) && !FoundMetaData.Applications.Items.Any(A => A.Name == strApplication.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strApplication.Trim())); } } } } } }
private void GetImagesDoc(OleDocument doc) { using (Stream WordDocument = doc.OpenStream("WordDocument")) { using (Stream stmData = doc.OpenStream("Data")) { if (WordDocument == null || stmData == null) { return; } WordDocument.Seek(0x18, SeekOrigin.Begin); BinaryReader br = new BinaryReader(WordDocument); Int32 fcMin = br.ReadInt32(); Int32 fcMac = br.ReadInt32(); Int32 FKPStart = fcMac % 0x200 == 0 ? fcMac : (fcMac - fcMac % 0x200) + 0x200; WordDocument.Seek(FKPStart, SeekOrigin.Begin); int ImagesFound = 0; while (WordDocument.Position + 0x200 < WordDocument.Length) { byte[] FKP = br.ReadBytes(0x200); if (FKP[0x1FF] == 00) { break; } foreach (int offset in Functions.SearchBytesInBytes(FKP, new byte[] { 0x03, 0x6A })) { if (offset < 0x200 - 5) { int PICOffset = FKP[offset + 5] * 0x1000000 + FKP[offset + 4] * 0x10000 + FKP[offset + 3] * 0x100 + FKP[offset + 2]; if (PICOffset >= 0 && PICOffset < stmData.Length) { stmData.Seek(PICOffset, SeekOrigin.Begin); BinaryReader brData = new BinaryReader(stmData); UInt32 PICLength = brData.ReadUInt32(); long posOri = stmData.Position; int bufferLen = PICLength < stmData.Length - stmData.Position ? (int)PICLength - 4 : (int)(stmData.Length - stmData.Position); if (bufferLen == 0) { continue; } byte[] bufferPIC = brData.ReadBytes(bufferLen); string strImageName = "Image" + ImagesFound++; using (StreamReader sr = new StreamReader(new MemoryStream(bufferPIC), Encoding.Unicode)) { String sRead = sr.ReadToEnd(); foreach (Match m in Regex.Matches(sRead, @"([a-z]:|\\)\\[a-zá-ú0-9\\\s,;.\-_#\$%&()=ñ´'¨{}Ç`/n/r\[\]+^@]+\\[a-zá-ú0-9\\\s,;.\-_#\$%&()=ñ´'¨{}Ç`/n/r\[\]+^@]+", RegexOptions.IgnoreCase)) { String path = m.Value.Trim(); FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(path), true); strImageName = Path.GetFileName(path); } } List <int> lstJPEG = Functions.SearchBytesInBytes(bufferPIC, new byte[] { 0xFF, 0xD8 }); if (lstJPEG.Count > 0) { using (MemoryStream msJPG = new MemoryStream(bufferPIC, lstJPEG[0], bufferPIC.Length - lstJPEG[0])) { EXIFDocument eDoc = new EXIFDocument(msJPG, ".jpg"); eDoc.analyzeFile(); dicPictureEXIF.Add(strImageName, eDoc); foreach (UserItem uiEXIF in eDoc.FoundUsers.Items) { FoundUsers.AddUniqueItem(uiEXIF.Name, false, uiEXIF.Notes); } foreach (ApplicationsItem Application in eDoc.FoundMetaData.Applications.Items) { string strApplication = Application.Name; if (!string.IsNullOrEmpty(strApplication.Trim()) && !FoundMetaData.Applications.Items.Any(A => A.Name == strApplication.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strApplication.Trim())); } } eDoc.Close(); } } } } } } } } }