win32: structured storage

[tlviewer]

hello,

In honor of the chm exploit that I got hit by last week, I trying
to code some ActivePython to list the directory inside a CHM.

CHM is supposed to be structured storage (ITSF). If a given CHM
file is infected it most likely has an embedded EXE file -- mine
had one called [Open.exe].

The following code works for Excell sheets, XLS, but fails for
CHM files.

# begin python
from win32com import storagecon as sc
import os, win32api
import pythoncom as pyc
from pywintypes import IID

its_clsid = IID('{5d02926a-212e-11d0-9df9-00a0c922e6ec}')
its_iid= IID('{88cc31de-27ab-11d0-9df9-00a0c922e6ec}')
#
pyc.CoInitializ e()

# commented out after failing on my Win2k box
#pyc.CoCreateIn stance( its_clsid,None, pyc.CLSCTX_INPR OC_SERVER, its_iid)
m = sc.STGM_READ | sc.STGM_SHARE_E XCLUSIVE

# quarantined CHM virus
fname = "e:/batch/junkx.chm"
#fname = "C:/Documents and Settings/Administrator/My Documents/02_taxes.xls"
pss = pyc.StgOpenStor ageEx( fname, m, sc.STGFMT_STORA GE,0, pyc.IID_IStorag e)

ele = pss.EnumElement s( 0, None,0)
obj = ele.next()
print obj[0]
obj = ele.next()
print obj[0]
# end python

with the XLS file, I get the names of the two sheets.
Is there another way to parse the central directory out of
a CHM file?

tia,
tlviewer

[Steve Holden]

tlviewer wrote:

hello,

In honor of the chm exploit that I got hit by last week, I trying
to code some ActivePython to list the directory inside a CHM.
Welcome to the world of the "drive-by download". Now you know why people
are recommending migrating away from IE.
CHM is supposed to be structured storage (ITSF). If a given CHM
file is infected it most likely has an embedded EXE file -- mine
had one called [Open.exe].

Ironic, really, since Microsoft insist that the browser must be
fully-integrated with the operating system I suppose that measn we had
better all start using Linux.

regards
Steve
--
Steve Holden [phone] [phone]
Holden Web LLC http://www.holdenweb.com/
Python Web Programming http://pydish.holdenweb.com/

[Robert Kern]

tlviewer wrote:

Is there another way to parse the central directory out of
a CHM file?

google("chmlib python")

--
Robert Kern
rk***@ucsd.edu

"In the fields of hell where the grass grows high
Are the graves of dreams allowed to die."
-- Richard Harter

[Dave Benjamin]

Steve Holden wrote:

tlviewer wrote:

> CHM is supposed to be structured storage (ITSF). If a given CHM
> file is infected it most likely has an embedded EXE file -- mine
> had one called [Open.exe].
>

Ironic, really, since Microsoft insist that the browser must be
fully-integrated with the operating system I suppose that measn we had
better all start using Linux.

Even more ironically, it would seem that in effort to kill Netscape they
are killing Windows.

[Dave Benjamin]

Dave Benjamin wrote:

Steve Holden wrote:

tlviewer wrote:

> CHM is supposed to be structured storage (ITSF). If a given CHM
> file is infected it most likely has an embedded EXE file -- mine
> had one called [Open.exe].
>

Ironic, really, since Microsoft insist that the browser must be
fully-integrated with the operating system I suppose that measn we had
better all start using Linux.

Even more ironically, it would seem that in effort to kill Netscape they
are killing Windows.

Or perhaps I'm just restating your point. ;)

[tlviewer]

"Robert Kern" <rk***@ucsd.edu > wrote in message news:ma******** *************** **************@ python.org...

tlviewer wrote:

Is there another way to parse the central directory out of
a CHM file?

google("chmlib python")

Anyone know the calling syntax for the functions?

PythonWin 2.3.2 (#49, Nov 13 2003, 10:34:54) [MSC v.1200 32 bit (Intel)] on win32.
Portions Copyright 1994-2001 Mark Hammond
(mh******@skipp inet.com.au) - see 'Help/About PythonWin' for further copyright information.

import os, sys
import pychm._chmlib as chm
obj=chm.chm_ope n('e:/batch/AdvCrypto')
obj
chm.chm_open('e :/batch/AdvCrypto')
chm <module 'pychm._chmlib' from 'E:\Python23\Li b\site-packages\pychm\ _chmlib.pyd'> enm=chm.chm_enu merate() Traceback (most recent call last):
File "<interacti ve input>", line 1, in ?
TypeError: chm_enumerate() takes exactly 4 arguments (0 given) chm.chm_enumera te(obj)

I doubt if the build is good ...

regards,
tlviewer