Integrate decrypt from msoffcrypto-tools

[christian-intra2net]

Integrate decryption of files using library msoffrypto-tools by nolze. Related to issue #329

Main achievements:
Create a wrapper crypto.py around all calls to msoffcrypto, so can make it an optional dependency. If msoffcrypto is not installed, calls will just raise an exception (roughly same behavior as befor this PR).
Integrated decryption into olevba.py and msodde.py . Create lengthy description in crypto.py how to integrate with other scripts.
Create a few unittests with samples for excel which as a built-in default password used to achieve some kind of "write-protection".

Side-effect:
Changed the default behaviour of olevba, msodde and record_base with respect to encryption. It used to be: "check for encryption; if you find any, then raise an exception". Now it is "try to work on this file as if it were not encrypted. If that fails try decrypting (and if that fails raise error)". This means that lots of helper-code and data-analysis-code runs on more "garbage" data (=undecrypted input) and will less easily raise errors for that.

[decalage2]

Great work!
I'm just wondering why msoffcrypto couldn't be a mandatory dependency.

[decalage2]

Christian, is there a specific reason to put it as an optional dependency? I think it would be simpler to make it mandatory, to avoid several checks, specific exceptions, etc. What do you think?

[christian-intra2net]

msoffcrypto-tools depends on cryptography and others, so it would introduce a rather long tail of other dependencies. But if you do not mind we can make it a hard dependency. That would simplify the code a bit and leave fewer scenarios for testing.

[decalage2]

@christian-intra2net, I get a PermissionError when I run olevba on the DDE test files, such as dde-test-encrypt-standardpassword.xls, whereas it works fine on the files with macros.

[decalage2]

@christian-intra2net, there seems to be another small bug when running msodde on other encrypted test files such as encrypted.docm without the -p option:
(when the right password is provided with -p, it works)

py -3 \Users\decalage\oletools\oletools\msodde.py encrypted.docm
msodde 0.54dev12 - http://decalage.info/python/oletools
THIS IS WORK IN PROGRESS - Check updates regularly!
Please report any issue at https://github.com/decalage2/oletools/issues

Opening file: encrypted.docm
ERROR    'NoneType' object has no attribute 'exists'
Traceback (most recent call last):
  File "\Users\decalage\oletools\oletools\msodde.py", line 969, in process_maybe_encrypted
    result = process_file(filepath, **kwargs)
  File "\Users\decalage\oletools\oletools\msodde.py", line 906, in process_file
    if olefile.isOleFile(filepath):
  File "C:\Program Files (x86)\Python37-32\lib\site-packages\olefile\olefile.py", line 309, in isOleFile
    with open(filename, 'rb') as fp:
TypeError: expected str, bytes or os.PathLike object, not NoneType

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "\Users\decalage\oletools\oletools\msodde.py", line 1027, in main
    field_filter_mode=args.field_filter_mode)
  File "\Users\decalage\oletools\oletools\msodde.py", line 992, in process_maybe_encrypted
    crypto_nesting+1, **kwargs)
  File "\Users\decalage\oletools\oletools\msodde.py", line 973, in process_maybe_encrypted
    if not crypto.is_encrypted(filepath):
  File "c:\Users\decalage\oletools\oletools\crypto.py", line 145, in is_encrypted
    return is_encrypted_ole(some_file)   # assume it is OleFileIO
  File "c:\Users\decalage\oletools\oletools\crypto.py", line 171, in is_encrypted_ole
    if ole.exists("\x05SummaryInformation"):
AttributeError: 'NoneType' object has no attribute 'exists'
DDE Links:

[christian-intra2net]

Oh crap, I missed the last three mentions here. Sorry. Replying now to each

[christian-intra2net]

@christian-intra2net, I get a PermissionError when I run olevba on the DDE test files, such as dde-test-encrypt-standardpassword.xls, whereas it works fine on the files with macros.

Interesting. Probably some problem with the temp file creation. What system are you testing on?

[christian-intra2net]

@christian-intra2net, there seems to be another small bug when running msodde on other encrypted test files such as encrypted.docm without the -p option:
(when the right password is provided with -p, it works)

I will check this out next week