public static string GetRelevantRecordDumpString(WorkbookStream wbs, bool dumpHexBytes = false, bool showAttrInfo = false)
{
int numBytesToDump = 0;
if (dumpHexBytes)
{
numBytesToDump = 0x1000;
}
List <BiffRecord> relevantRecords = wbs.Records.Where(rec => RecordHelper.RelevantTypes.Contains(rec.Id)).ToList();
relevantRecords = RecordHelper.ConvertToSpecificRecords(relevantRecords);
relevantRecords = PtgHelper.UpdateGlobalsStreamReferences(relevantRecords);
string dumpString = "";
foreach (var record in relevantRecords)
{
dumpString += record.ToHexDumpString(numBytesToDump, showAttrInfo);
dumpString += "\n";
}
return(dumpString);
}
public static string GetRelevantRecordDumpString(WorkbookStream wbs, bool dumpHexBytes = false, bool showAttrInfo = false)
{
int numBytesToDump = 0;
if (dumpHexBytes)
{
numBytesToDump = 0x1000;
}
bool hasPassword = wbs.HasPasswordToOpen();
List <BiffRecord> relevantRecords = wbs.Records.Where(rec => RecordHelper.RelevantTypes.Contains(rec.Id)).ToList();
//We can only interpret the data of these records if they are not encrypted
if (!hasPassword)
{
relevantRecords = RecordHelper.ConvertToSpecificRecords(relevantRecords);
relevantRecords = PtgHelper.UpdateGlobalsStreamReferences(relevantRecords);
}
string dumpString = "";
foreach (var record in relevantRecords)
{
dumpString += record.ToHexDumpString(numBytesToDump, showAttrInfo);
dumpString += "\n";
}
return(dumpString);
}
/// <summary>
/// Dumps information about BIFF records that are relevant for analysis. Defaults to sheet, label, and formula data.
/// </summary>
/// <param name="path">Path to the XLS file to dump</param>
/// <param name="dumpAll">Dump all BIFF records, not the most commonly used by maldocs</param>
/// <param name="showAttrInfo">Explicitly display PtgAttr information in Formula strings. Defaults to False.</param>
/// <param name="dumpHexBytes">Dump the byte content of each BIFF record in addition to its content summary. Defaults to False.</param>
public static void Dump(FileInfo path, bool dumpAll = false, bool showAttrInfo = false, bool dumpHexBytes = false)
{
if (path == null)
{
Console.WriteLine("path argument must be specified in Dump mode. Run dump -h for usage instructions.");
return;
}
if (path.Exists == false)
{
Console.WriteLine("path file does not exist.");
return;
}
WorkbookStream wbs = new WorkbookStream(path.FullName);
List <RecordType> relevantTypes = new List <RecordType>()
{
RecordType.BoundSheet8, //Sheet definitions (Defines macro sheets + hides them)
RecordType.Lbl, //Named Cells (Contains Auto_Start)
RecordType.Formula, //The meat of most cell content
RecordType.SupBook, //Contains information for cross-sheet references
RecordType.ExternSheet //Contains the XTI records mapping ixti values to BoundSheet8
};
int numBytesToDump = 0;
if (dumpHexBytes)
{
numBytesToDump = 0x1000;
}
if (dumpAll)
{
WorkbookStream fullStream = new WorkbookStream(PtgHelper.UpdateGlobalsStreamReferences(wbs.Records));
foreach (var record in fullStream.Records)
{
Console.WriteLine(record.ToHexDumpString(numBytesToDump, showAttrInfo));
}
}
else
{
List <BiffRecord> relevantRecords = wbs.Records.Where(rec => relevantTypes.Contains(rec.Id)).ToList();
relevantRecords = RecordHelper.ConvertToSpecificRecords(relevantRecords);
relevantRecords = PtgHelper.UpdateGlobalsStreamReferences(relevantRecords);
foreach (var record in relevantRecords)
{
string dumpString = "";
dumpString += record.ToHexDumpString(numBytesToDump, showAttrInfo);
Console.WriteLine(dumpString);
}
}
}
