{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/setup.py",
    "https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/requirements.txt",
    "https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/SECURITY.md",
    "https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/.github/workflows/unittests.yml",
    "https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/.travis.yml",
    "https://github.com/decalage2/oletools/tree/ec10260989dbc48b9109e3d05d22beee19cf2333/tests/test-data",
    "https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/LICENSE.md",
    "https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/oletools/thirdparty/xxxswf/LICENSE.txt",
    "https://github.com/decalage2/oletools/releases/tag/v0.60.2",
    "https://pypi.org/project/oletools/0.60.2/"
  ],
  "category": "native-analysis",
  "description_en": "Python package by Philippe Lagadec for analyzing Microsoft OLE2 (Compound File Binary) files such as Office 97–2003 documents, MSI files and Outlook messages, as well as RTF and OpenXML documents, mainly for malware analysis, forensics and debugging. Its command-line tools detect and extract VBA and Excel 4 (XLM) macros, embedded OLE and Flash objects and DDE links (olevba, MacroRaptor, oleobj, rtfobj, pyxswf, msodde), flag characteristics common in malicious files with oleid and ftguess, and show directory entries, metadata, timestamps and sector maps with oledir, olemeta, oletimes and olemap. It is built on the same author's olefile parser.",
  "description_zh": "Philippe Lagadec 开发的 Python 工具包，用于分析 Microsoft OLE2（复合文件二进制格式）文件，如 Office 97–2003 文档、MSI 文件和 Outlook 邮件，也支持 RTF 与 OpenXML 文档，主要面向恶意软件分析、取证和调试。其命令行工具可检测并提取 VBA 与 Excel 4（XLM）宏、嵌入的 OLE 和 Flash 对象以及 DDE 链接（olevba、MacroRaptor、oleobj、rtfobj、pyxswf、msodde），用 oleid 和 ftguess 标记恶意文件中常见的特征，并通过 oledir、olemeta、oletimes 和 olemap 查看目录项、元数据、时间戳和扇区布局。它基于同一作者的 olefile 解析器。",
  "entry_url": "https://awesomerea.org/resources/oletools/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/oletools/",
  "evidence_url": "https://github.com/decalage2/oletools/blob/ec10260989dbc48b9109e3d05d22beee19cf2333/README.md",
  "group": "tools",
  "id": "oletools",
  "json_url": "https://awesomerea.org/resources/oletools/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/oletools/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/oletools/index.md",
  "name": "oletools",
  "name_zh": "oletools Office 文档与 OLE 文件分析工具集",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v0.60.2, published 2024-07-02 on GitHub and PyPI. The reviewed master commit (2026-01-26) already sets version 0.60.3, and its README news lists 0.60.3 under 2025-05-22 with an olevba fix for a security issue with ANSI escape codes in CLI output, but no 0.60.3 tag or PyPI upload existed at review. SECURITY.md lists 0.60.x and later as supported.",
    "Install with pip as oletools, or oletools[full] to add the optional XLMMacroDeobfuscator. Dependencies are pyparsing, olefile, easygui, colorclass and pcodedmp, plus msoffcrypto-tool for encrypted documents except on PyPy under Windows, macOS or Python 2. setup.py classifiers list Python 2.7 and 3.4 to 3.12; the GitHub workflow runs pylint -E and the unit tests on Linux, Windows and macOS with current CPython 3 and PyPy 3.9, while the older Travis configuration targets Python 2.7 to 3.8 and PyPy.",
    "Inputs are user-supplied documents, which in malware analysis may be malicious; the unit tests use sample documents committed under tests/test-data. The README describes oleid as detecting characteristics usually found in malicious files and MacroRaptor as detecting malicious VBA macros, so results are indicators that need analyst review.",
    "LICENSE.md applies a two-clause BSD license (copyright 2012–2025 Philippe Lagadec) to the package; olevba contains MIT-licensed code from officeparser, and the thirdparty folder keeps its own terms, including GPL-3.0 for xxxswf and public-domain oledump plugin code. The README notes that python-oletools is unrelated to BeCubed Software's OLETools."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v0.60.2，于 2024-07-02 在 GitHub 和 PyPI 发布。所审阅的 master 提交（2026-01-26）已将版本设为 0.60.3，README 的更新记录也在 2025-05-22 下列出 0.60.3，其中包括修复 olevba 命令行输出中 ANSI 转义码导致的安全问题；但审阅时并不存在 0.60.3 标签或 PyPI 上传。SECURITY.md 将 0.60.x 及之后版本列为受支持版本。",
    "通过 pip 安装 oletools，或安装 oletools[full] 以加入可选的 XLMMacroDeobfuscator。依赖 pyparsing、olefile、easygui、colorclass 和 pcodedmp，并依赖 msoffcrypto-tool 处理加密文档（在 Windows、macOS 或 Python 2 上使用 PyPy 时除外）。setup.py 的分类标签列出 Python 2.7 及 3.4 至 3.12；GitHub 工作流在 Linux、Windows 和 macOS 上用当前 CPython 3 与 PyPy 3.9 运行 pylint -E 和单元测试，较旧的 Travis 配置则针对 Python 2.7 至 3.8 及 PyPy。",
    "输入为使用者提供的文档，在恶意软件分析中可能是恶意文件；单元测试使用 tests/test-data 下提交的示例文档。README 称 oleid 用于检测恶意文件中常见的特征、MacroRaptor 用于检测恶意 VBA 宏，因此结果只是需要分析者复核的迹象。",
    "LICENSE.md 对该工具包采用两条款 BSD 许可证（版权 2012–2025 Philippe Lagadec）；olevba 包含来自 officeparser 的 MIT 许可代码，thirdparty 目录保留各自条款，其中 xxxswf 为 GPL-3.0，oledump 插件代码为公有领域。README 说明 python-oletools 与 BeCubed Software 的 OLETools 无关。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/decalage2/oletools",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}