1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
|
From 2ef513c9a5bd0751db6d879b7ea80ffbbee7dd05 Mon Sep 17 00:00:00 2001
From: Leon Anavi <leon.anavi@konsulko.com>
Date: Tue, 14 Jul 2026 23:56:57 +0300
Subject: [PATCH] oletools/olevba.py: Fix deprecation warnings
Replace deprecated pyparsing APIs with their current equivalents:
enablePackrat -> enable_packrat, setParseAction -> set_parse_action,
escQuote -> esc_quote, initChars/bodyChars -> init_chars/body_chars,
infixNotation -> infix_notation, scanString -> scan_string.
Fixes:
PyparsingDeprecationWarning: 'enablePackrat' deprecated - use 'enable_packrat'
PyparsingDeprecationWarning: 'setParseAction' deprecated - use 'set_parse_action'
PyparsingDeprecationWarning: 'escQuote' argument is deprecated, use 'esc_quote'
PyparsingDeprecationWarning: 'initChars' argument is deprecated, use 'init_chars'
PyparsingDeprecationWarning: 'infixNotation' deprecated - use 'infix_notation'
PyparsingDeprecationWarning: 'scanString' deprecated - use 'scan_string'
Upstream-Status: Pending [https://github.com/decalage2/oletools/pull/888]
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
---
oletools/olevba.py | 40 ++++++++++++++++++++--------------------
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/oletools/olevba.py b/oletools/olevba.py
index 23be15b..c9a3bce 100644
--- a/oletools/olevba.py
+++ b/oletools/olevba.py
@@ -313,7 +313,7 @@ from pyparsing import \
CaselessKeyword, CaselessLiteral, Combine, Forward, Literal, \
Optional, QuotedString,Regex, Suppress, Word, WordStart, \
alphanums, alphas, hexnums,nums, opAssoc, srange, \
- infixNotation, ParserElement
+ infix_notation, ParserElement
# attempt to import XLMMacroDeobfuscator (optional)
try:
@@ -917,7 +917,7 @@ re_printable_string = re.compile(b'[\\t\\r\\n\\x20-\\xFF]{5,}')
# Enable PackRat for better performance:
# (see https://pythonhosted.org/pyparsing/pyparsing.ParserElement-class.html#enablePackrat)
-ParserElement.enablePackrat()
+ParserElement.enable_packrat()
# VBA identifier chars (from MS-VBAL 3.3.5)
vba_identifier_chars = alphanums + '_'
@@ -954,15 +954,15 @@ class VbaExpressionString(str):
# letters or underscore (e.g. "VBT1" or "ABC_34"), when using scanString
decimal_literal = Combine(Optional('-') + WordStart(vba_identifier_chars) + Word(nums)
+ Suppress(Optional(Word('%&^', exact=1))))
-decimal_literal.setParseAction(lambda t: int(t[0]))
+decimal_literal.set_parse_action(lambda t: int(t[0]))
octal_literal = Combine(Suppress(Literal('&') + Optional((CaselessLiteral('o')))) + Word(srange('[0-7]'))
+ Suppress(Optional(Word('%&^', exact=1))))
-octal_literal.setParseAction(lambda t: int(t[0], base=8))
+octal_literal.set_parse_action(lambda t: int(t[0], base=8))
hex_literal = Combine(Suppress(CaselessLiteral('&h')) + Word(srange('[0-9a-fA-F]'))
+ Suppress(Optional(Word('%&^', exact=1))))
-hex_literal.setParseAction(lambda t: int(t[0], base=16))
+hex_literal.set_parse_action(lambda t: int(t[0], base=16))
integer = decimal_literal | octal_literal | hex_literal
@@ -974,8 +974,8 @@ integer = decimal_literal | octal_literal | hex_literal
# double-quote = %x0022 ; "
# string-character = NO-LINE-CONTINUATION ((double-quote double-quote) termination-character)
-quoted_string = QuotedString('"', escQuote='""')
-quoted_string.setParseAction(lambda t: str(t[0]))
+quoted_string = QuotedString('"', esc_quote='""')
+quoted_string.set_parse_action(lambda t: str(t[0]))
#--- VBA Expressions ---------------------------------------------------------
@@ -1056,7 +1056,7 @@ def vba_chr_tostr(t):
log.exception('ERROR: incorrect parameter value for chr(): %r' % i)
return VbaExpressionString('Chr(%r)' % i)
-vba_chr.setParseAction(vba_chr_tostr)
+vba_chr.set_parse_action(vba_chr_tostr)
# --- ASC --------------------------------------------------------------------
@@ -1064,7 +1064,7 @@ vba_chr.setParseAction(vba_chr_tostr)
# Asc(char) => int
#TODO: see MS-VBAL 6.1.2.11.1.1 page 240 => AscB, AscW
vba_asc = Suppress(CaselessKeyword('Asc') + '(') + vba_expr_str + Suppress(')')
-vba_asc.setParseAction(lambda t: ord(t[0]))
+vba_asc.set_parse_action(lambda t: ord(t[0]))
# --- VAL --------------------------------------------------------------------
@@ -1072,21 +1072,21 @@ vba_asc.setParseAction(lambda t: ord(t[0]))
# Val(string) => int
# TODO: make sure the behavior of VBA's val is fully covered
vba_val = Suppress(CaselessKeyword('Val') + '(') + vba_expr_str + Suppress(')')
-vba_val.setParseAction(lambda t: int(t[0].strip()))
+vba_val.set_parse_action(lambda t: int(t[0].strip()))
# --- StrReverse() --------------------------------------------------------------------
# StrReverse(string) => string
strReverse = Suppress(CaselessKeyword('StrReverse') + '(') + vba_expr_str + Suppress(')')
-strReverse.setParseAction(lambda t: VbaExpressionString(str(t[0])[::-1]))
+strReverse.set_parse_action(lambda t: VbaExpressionString(str(t[0])[::-1]))
# --- ENVIRON() --------------------------------------------------------------------
# Environ("name") => just translated to "%name%", that is enough for malware analysis
environ = Suppress(CaselessKeyword('Environ') + '(') + vba_expr_str + Suppress(')')
-environ.setParseAction(lambda t: VbaExpressionString('%%%s%%' % t[0]))
+environ.set_parse_action(lambda t: VbaExpressionString('%%%s%%' % t[0]))
# --- IDENTIFIER -------------------------------------------------------------
@@ -1096,7 +1096,7 @@ environ.setParseAction(lambda t: VbaExpressionString('%%%s%%' % t[0]))
# Latin-identifier = first-Latin-identifier-character *subsequent-Latin-identifier-character
# first-Latin-identifier-character = (%x0041-005A / %x0061-007A) ; A-Z / a-z
# subsequent-Latin-identifier-character = first-Latin-identifier-character / DIGIT / %x5F ; underscore
-latin_identifier = Word(initChars=alphas, bodyChars=alphanums + '_')
+latin_identifier = Word(init_chars=alphas, body_chars=alphanums + '_')
# --- HEX FUNCTION -----------------------------------------------------------
@@ -1105,11 +1105,11 @@ latin_identifier = Word(initChars=alphas, bodyChars=alphanums + '_')
# quoted string of at least two hexadecimal numbers of two digits:
quoted_hex_string = Suppress('"') + Combine(Word(hexnums, exact=2) * (2, None)) + Suppress('"')
-quoted_hex_string.setParseAction(lambda t: str(t[0]))
+quoted_hex_string.set_parse_action(lambda t: str(t[0]))
hex_function_call = Suppress(latin_identifier) + Suppress('(') + \
quoted_hex_string('hex_string') + Suppress(')')
-hex_function_call.setParseAction(lambda t: VbaExpressionString(binascii.a2b_hex(t.hex_string)))
+hex_function_call.set_parse_action(lambda t: VbaExpressionString(binascii.a2b_hex(t.hex_string)))
# --- BASE64 FUNCTION -----------------------------------------------------------
@@ -1119,11 +1119,11 @@ hex_function_call.setParseAction(lambda t: VbaExpressionString(binascii.a2b_hex(
# quoted string of at least two hexadecimal numbers of two digits:
quoted_base64_string = Suppress('"') + Regex(BASE64_RE) + Suppress('"')
-quoted_base64_string.setParseAction(lambda t: str(t[0]))
+quoted_base64_string.set_parse_action(lambda t: str(t[0]))
base64_function_call = Suppress(latin_identifier) + Suppress('(') + \
quoted_base64_string('base64_string') + Suppress(')')
-base64_function_call.setParseAction(lambda t: VbaExpressionString(binascii.a2b_base64(t.base64_string)))
+base64_function_call.set_parse_action(lambda t: VbaExpressionString(binascii.a2b_base64(t.base64_string)))
# ---STRING EXPRESSION -------------------------------------------------------
@@ -1140,7 +1140,7 @@ def concat_strings_list(tokens):
vba_expr_str_item = (vba_chr | strReverse | environ | quoted_string | hex_function_call | base64_function_call)
-vba_expr_str <<= infixNotation(vba_expr_str_item,
+vba_expr_str <<= infix_notation(vba_expr_str_item,
[
("+", 2, opAssoc.LEFT, concat_strings_list),
("&", 2, opAssoc.LEFT, concat_strings_list),
@@ -1195,7 +1195,7 @@ vba_expr_int_item = (vba_asc | vba_val | integer)
# operators associativity:
# https://en.wikipedia.org/wiki/Operator_associativity
-vba_expr_int <<= infixNotation(vba_expr_int_item,
+vba_expr_int <<= infix_notation(vba_expr_int_item,
[
("*", 2, opAssoc.LEFT, multiply_ints_list),
("/", 2, opAssoc.LEFT, divide_ints_list),
@@ -2393,7 +2393,7 @@ def detect_vba_strings(vba_code):
vba_code = vba_code.expandtabs()
# Split the VBA code line by line to avoid MemoryError on large scripts:
for vba_line in vba_code.splitlines():
- for tokens, start, end in vba_expr_str.scanString(vba_line):
+ for tokens, start, end in vba_expr_str.scan_string(vba_line):
encoded = vba_line[start:end]
decoded = tokens[0]
if isinstance(decoded, VbaExpressionString):
--
2.43.0
|
