How to disable a directory entry in OLE file

Parth Gupta 100

Hi,

I am trying to parse a .doc file (OLE file) (MS-97-2003) by reading it byte by byte in python. I am so far successful in extracting the directory structure of the file. Suppose i find a directory named "Macros" in the .doc file and i want to disable it. My idea is to overwrite the type of directory (at byteoffset 66 decimal from the start of directory entry) to '0' indicating an Unused directory. Howeer it did not seem to work for me.

Can you tell me, if i want to disable a directory entry (say Macros) without making the file corrupt, how can i do it.

Thanks.

KristianSmith-MSFT 31 Reputation points Microsoft Employee

2023-05-19T15:42:40.0333333+00:00

Hi Parth,

Thank you for your request. One of our team members will review this and follow-up with you soon.

Regards,
Kristian S
Support Escalation Engineer
Microsoft Open Specifications
Tom Jebo 1,906 Reputation points Microsoft Employee

2023-05-19T18:40:46.9733333+00:00

Hi Parth,

I will assist you with this question. One thing that may add context here is if you can tell me why you are doing this? Is your goal to create one of the effects of disabling macros, for example, the list in this article: https://support.microsoft.com/en-us/office/enable-or-disable-macros-in-microsoft-365-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6?

If so, there may be more to do than just disabling a storage in the directory.

Best regards,
Tom Jebo
Microsoft Open Specifications Support
Parth Gupta 100 Reputation points

2023-05-24T11:02:28.4533333+00:00

Hi @Tom Jebo , Apologies for the delay.

I am trying to do this because I am making a program to manually parse a .doc file and detect malicious activity associated with it (if any). So I want to disable Macros in a given .doc file. Now my approach was to change the DirectoryType of 'Macros' to 0 by overwriting the file (0 means invalid directory) in the hope that it would disable the Macros. However, it doesn't seem to work. Kindly guide me on what I need to do to disable the Macros directory entry.

Thanks a lot
Parth Gupta 100 Reputation points

2023-05-24T11:07:47.8433333+00:00

Hi @Tom Jebo

I am making a program as part of my final year project where I analyze a .doc file for malicious activity. I am parsing the file byte by byte, and I can extract the directory entries. Since I want to sanitize the .doc file, I want to remove the Macros in it. I thought one way would be to overwrite the Directory type of Macros Directory to '0', which means invalid. However, it did not seem to work out and made the file corrupt. Please tell me what changes I need to make to the file inorder to make a directory invalid.

Thanks
Tom Jebo 1,906 Reputation points Microsoft Employee

2023-05-25T05:02:44.1566667+00:00

Hi @Parth Gupta,

Marking the directory entry as unknown or unallocated using a type of 0x00 may not suffice for Word to overlook the macro storage. There are references to macros that Word may check and that may cause the "corruption" when opening the file with Word. For example, structures like CidMacro, Cmt.cmdMacro, MacroNames and Mcd refer to a macro. These are typically pointed to by PlfMcd via Tcg255/Tcg which are eventually pointed to by FibRgFcLcb.fcCmds. Therefore, you would likely have to clean out references to the macros and this might be sticky.

I will do some more checking with our Word team to see if there is a simpler way to do what you are asking and get back to you.

Best regards,
Tom Jebo
Microsoft Open Specifications Support
Tom Jebo 1,906 Reputation points Microsoft Employee

2023-05-25T18:06:36.47+00:00

Hi @Parth Gupta,

I also should point out that you should probably be removing the Macros storage completely, not marking it as unknown or unallocated. This would best be done by using an API that is already designed and tested to manipulate structured storage per MS-CFB. On Windows that would be Structured Storage. On other platforms there may be 3rd party libraries that can do this for you from your Python code.

I'm not saying that removing the Macros root storage is sufficient. I'm still checking on what would be needed, if anything, in addition to that.

Tom
Tom Jebo 1,906 Reputation points Microsoft Employee

2023-05-25T20:42:11.5933333+00:00

@Parth Gupta,

Perhaps you could share the Word document that you are using to test this so that I can take a look? If so, you can reach out to me on dochelp at microsoft.com. Just include the URL for this thread and my name.

Edit: and if you can do this, please prepare to send both the before and after file.

Tom

Accepted answer

Tom Jebo 1,906 Reputation points Microsoft Employee

2023-05-26T22:01:29.55+00:00
Hi @Parth Gupta,

I did a small test and was able to remove the Macros root storage by using the structured storage Windows API's. This appears to have removed the macros. Word will still show the names of macros that previously existed but when you attempt to edit them in the Developer window, it will report that they no longer exist.

Here is the small snippet using the Windows API's to remove the storage:

STGOPTIONS stgOptions = { 2, 0, 512, 0 }; IStorage* pStg = 0; HRESULT hr = StgOpenStorageEx(L"<path>\test.doc", STGM_TRANSACTED | STGM_READWRITE | STGM_SHARE_EXCLUSIVE, STGFMT_DOCFILE, 0, & stgOptions, 0, IID_IStorage, (void **) & pStg); hr = pStg->DestroyElement(L"Macros"); pStg->Commit(STGC_DEFAULT); pStg->Release();

I don't have the equivalent code in Python to do this but I would recommend using a library that is designed to manipulate OLE compound files.

Tom
Please sign in to rate this answer.
Parth Gupta 100 Reputation points

2023-05-28T10:38:30.01+00:00

Thanks a lot Tom, this works for me too.
Sign in to comment

How to disable a directory entry in OLE file

0 additional answers