Reversing OLE
Last modified: 2024-02-18
OLE is a mechanism that allows users to create and edit documents containing items or "objects" created by multiple applications.
Oledump
It dumps the information of the OLE files.
oledump.py example.doc
# -s: stream number to analyze
# -d: dump
oledump.py -s 8 -d example.doc
oledump.py -s 9 -d example.doc
Then decrypt the output using online tools like CyberChef.
Olevba
Download the Oletools to use it.
olevba example.docm
Copy the above Visual Basic code, and access to OneCompiler.
Select the programming language "Visual Basic".
Paste the copied code to the editor, then click Run.