From c014dfac25a6e60e3fbf2bb3aba724fb0f55c23e Mon Sep 17 00:00:00 2001 From: Dobin Rutishauser Date: Fri, 30 Dec 2022 04:19:38 +0100 Subject: [PATCH] feature: support module for vba-physicaladdr --- plugins/file_office.py | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/plugins/file_office.py b/plugins/file_office.py index 86a2e5d..57f9dcd 100644 --- a/plugins/file_office.py +++ b/plugins/file_office.py @@ -97,7 +97,24 @@ class VbaAddressConverter(): return d - def physicalAddressFor(self, offset: int) -> int: + def physicalAddressFor(self, modulepath: str, offset: int) -> int: + # sanity checks + mp = modulepath.split('/') + if len (mp) != 2: + return 0 + if mp[0] != 'VBA': + return 0 + moduleName = mp[1] + + # find offset of module into VBA/ storage + # these are mini-sectors (usually 64 byte) + moduleOffsetSect = self._findSectorForDir(moduleName).isectStart + moduleOffset = moduleOffsetSect * self.ole.minisectorsize + + # offset is originally relative to its module (e.g. "VBA/Thisdocument") + # make it an offset into "VBA/"" storage + offset += moduleOffset + # e.g. offset = 1664 # roundDown = 1536 (multiple of 512) # use roundDown to find effective sector in file via self.correlation, @@ -106,3 +123,4 @@ class VbaAddressConverter(): physBase: int = self.correlation[roundDown] result: int = physBase + (offset - roundDown) return result + \ No newline at end of file