PCQRSCANER/venv/Lib/site-packages/extract_msg/constants.py

381 lines
9.9 KiB
Python
Raw Normal View History

2019-12-22 21:51:47 +01:00
"""
The constants used in extract_msg. If you modify any of these
without explicit instruction to do so from one of the
contributers, please do not complain about bugs.
"""
import struct
# DEFINE CONSTANTS
# WARNING DO NOT CHANGE ANY OF THESE VALUES UNLESS YOU KNOW
# WHAT YOU ARE DOING! FAILURE TO FOLLOW THIS INSTRUCTION
# CAN AND WILL BREAK THIS SCRIPT!
FIXED_LENGTH_PROPS = (
0x0000,
0x0001,
0x0002,
0x0003,
0x0004,
0x0005,
0x0006,
0x0007,
0x000A,
0x000B,
0x0014,
0x0040,
0x0048,
)
VARIABLE_LENGTH_PROPS = (
0x000D,
0x001E,
0x001F,
0x00FB,
0x00FD,
0x00FE,
0X0102,
0x1002,
0x1003,
0x1004,
0x1005,
0x1006,
0x1007,
0x1014,
0x101E,
0x101F,
0x1040,
0x1048,
0x1102,
)
INTELLIGENCE_DUMB = 0
INTELLIGENCE_SMART = 1
INTELLIGENCE_DICT = {
INTELLIGENCE_DUMB: 'INTELLIGENCE_DUMB',
INTELLIGENCE_SMART: 'INTELLIGENCE_SMART',
}
TYPE_MESSAGE = 0
TYPE_MESSAGE_EMBED = 1
TYPE_ATTACHMENT = 2
TYPE_RECIPIENT = 3
TYPE_DICT = {
TYPE_MESSAGE: 'TYPE_MESSAGE',
TYPE_MESSAGE_EMBED: 'TYPE_MESSAGE_EMBED',
TYPE_ATTACHMENT: 'TYPE_ATTACHMENT',
TYPE_RECIPIENT: 'TYPE_RECIPIENT',
}
RECIPIENT_SENDER = 0
RECIPIENT_TO = 1
RECIPIENT_CC = 2
RECIPIENT_BCC = 3
RECIPIENT_DICT = {
RECIPIENT_SENDER: 'RECIPIENT_SENDER',
RECIPIENT_TO: 'RECIPIENT_TO',
RECIPIENT_CC: 'RECIPIENT_CC',
RECIPIENT_BCC: 'RECIPIENT_BCC',
}
# Constants used for argparse stuff
KNOWN_FILE_FLAGS = [
'--out-name',
]
NEEDS_ARG = [
'--out-name',
]
MAINDOC = "extract_msg:\n\tExtracts emails and attachments saved in Microsoft Outlook's .msg files.\n\n" \
"https://github.com/mattgwwalker/msg-extractor"
# Define pre-compiled structs to make unpacking slightly faster
# General structs
ST1 = struct.Struct('<8x4I')
ST2 = struct.Struct('<H2xI8x')
ST3 = struct.Struct('<Q')
# Structs used by prop.py
STFIX = struct.Struct('<8x8s')
STVAR = struct.Struct('<8xi4s')
# Structs to help with email type to python type conversions
STI16 = struct.Struct('<h6x')
STI32 = struct.Struct('<i4x')
STI64 = struct.Struct('<q')
STF32 = struct.Struct('<f4x')
STF64 = struct.Struct('<d')
PTYPES = {
0x0000: 'PtypUnspecified',
0x0001: 'PtypNull',
0x0002: 'PtypInteger16', # Signed short
0x0003: 'PtypInteger32', # Signed int
0x0004: 'PtypFloating32', # Float
0x0005: 'PtypFloating64', # Double
0x0006: 'PtypCurrency',
0x0007: 'PtypFloatingTime',
0x000A: 'PtypErrorCode',
0x000B: 'PtypBoolean',
0x000D: 'PtypObject/PtypEmbeddedTable/Storage',
0x0014: 'PtypInteger64', # Signed longlong
0x001E: 'PtypString8',
0x001F: 'PtypString',
0x0040: 'PtypTime', # Use msgEpoch to convert to unix time stamp
0x0048: 'PtypGuid',
0x00FB: 'PtypServerId',
0x00FD: 'PtypRestriction',
0x00FE: 'PtypRuleAction',
0x0102: 'PtypBinary',
0x1002: 'PtypMultipleInteger16',
0x1003: 'PtypMultipleInteger32',
0x1004: 'PtypMultipleFloating32',
0x1005: 'PtypMultipleFloating64',
0x1006: 'PtypMultipleCurrency',
0x1007: 'PtypMultipleFloatingTime',
0x1014: 'PtypMultipleInteger64',
0x101E: 'PtypMultipleString8',
0x101F: 'PtypMultipleString',
0x1040: 'PtypMultipleTime',
0x1048: 'PtypMultipleGuid',
0x1102: 'PtypMultipleBinary',
}
# This property information was sourced from
# http://www.fileformat.info/format/outlookmsg/index.htm
# on 2013-07-22.
# It was extended by The Elemental of Creation on 2018-10-12
PROPERTIES = {
'00010102': 'Template data',
'0002000B': 'Alternate recipient allowed',
'0004001F': 'Auto forward comment',
'00040102': 'Script data',
'0005000B': 'Auto forwarded',
'000F000F': 'Deferred delivery time',
'00100040': 'Deliver time',
'00150040': 'Expiry time',
'00170003': 'Importance',
'001A001F': 'Message class',
'0023001F': 'Originator delivery report requested',
'00250102': 'Parent key',
'00260003': 'Priority',
'0029000B': 'Read receipt requested',
'002A0040': 'Receipt time',
'002B000B': 'Recipient reassignment prohibited',
'002E0003': 'Original sensitivity',
'00300040': 'Reply time',
'00310102': 'Report tag',
'00320040': 'Report time',
'00360003': 'Sensitivity',
'0037001F': 'Subject',
'00390040': 'Client Submit Time',
'003A001F': '',
'003B0102': '',
'003D001F': 'Subject prefix',
'003F0102': '',
'0040001F': 'Received by name',
'00410102': '',
'0042001F': 'Sent repr name',
'00430102': '',
'0044001F': 'Rcvd repr name',
'00450102': '',
'0046001F': '',
'00470102': '',
'0049001F': '',
'004B001F': '',
'004C0102': '',
'004D001F': 'Org author name',
'004E0040': '',
'004F0102': '',
'0050001F': 'Reply rcipnt names',
'00510102': '',
'00520102': '',
'00530102': '',
'00540102': '',
'00550040': '',
'0057000B': '',
'0058000B': '',
'0059000B': '',
'005A001F': 'Org sender name',
'005B0102': '',
'005C0102': '',
'005D001F': '',
'005E0102': '',
'005F0102': '',
'00600040': '',
'00610040': '',
'00620003': '',
'0063000B': '',
'0064001F': 'Sent repr adrtype',
'0065001F': 'Sent repr email',
'0066001F': '',
'00670102': '',
'0068001F': '',
'0069001F': '',
'0070001F': 'Topic',
'00710102': '',
'0072001F': '',
'0073001F': '',
'0074001F': '',
'0075001F': 'Rcvd by adrtype',
'0076001F': 'Rcvd by email',
'0077001F': 'Repr adrtype',
'0078001F': 'Repr email',
'007D001F': 'Message header',
'007F0102': '',
'0080001F': '',
'0081001F': '',
'08070003': '',
'0809001F': '',
'0C040003': '',
'0C050003': '',
'0C06000B': '',
'0C08000B': '',
'0C150003': '',
'0C17000B': '',
'0C190102': '',
'0C1A001F': 'Sender name',
'0C1B001F': '',
'0C1D0102': '',
'0C1E001F': 'Sender adr type',
'0C1F001F': 'Sender email',
'0C200003': '',
'0C21001F': '',
'0E01000B': '',
'0E02001F': 'Display BCC',
'0E03001F': 'Display CC',
'0E04001F': 'Display To',
'0E060040': '',
'0E070003': '',
'0E080003': '',
'0E080014': '',
'0E090102': '',
'0E0F000B': '',
'0E12000D': '',
'0E13000D': '',
'0E170003': '',
'0E1B000B': '',
'0E1D001F': 'Subject (normalized)',
'0E1F000B': '',
'0E200003': '',
'0E210003': '',
'0E28001F': 'Recvd account1 (uncertain)',
'0E29001F': 'Recvd account2 (uncertain)',
'1000001F': 'Message body',
'1008': 'RTF sync body tag', # Where did this come from ??? It's not listed in the docs
'10090102': 'Compressed RTF body',
'1013001F': 'HTML body',
'1035001F': 'Message ID (uncertain)',
'1046001F': 'Sender email (uncertain)',
'3001001F': 'Display name',
'3002001F': 'Address type',
'3003001F': 'Email address',
'30070040': 'Creation date',
'39FE001F': '7-bit email (uncertain)',
'39FF001F': '7-bit display name',
# Attachments (37xx)
'37010102': 'Attachment data',
'37020102': '',
'3703001F': 'Attachment extension',
'3704001F': 'Attachment short filename',
'37050003': 'Attachment attach method',
'3707001F': 'Attachment long filename',
'370E001F': 'Attachment mime tag',
'3712001F': 'Attachment ID (uncertain)',
# Address book (3Axx):
'3A00001F': 'Account',
'3A02001F': 'Callback phone no',
'3A05001F': 'Generation',
'3A06001F': 'Given name',
'3A08001F': 'Business phone',
'3A09001F': 'Home phone',
'3A0A001F': 'Initials',
'3A0B001F': 'Keyword',
'3A0C001F': 'Language',
'3A0D001F': 'Location',
'3A11001F': 'Surname',
'3A15001F': 'Postal address',
'3A16001F': 'Company name',
'3A17001F': 'Title',
'3A18001F': 'Department',
'3A19001F': 'Office location',
'3A1A001F': 'Primary phone',
'3A1B101F': 'Business phone 2',
'3A1C001F': 'Mobile phone',
'3A1D001F': 'Radio phone no',
'3A1E001F': 'Car phone no',
'3A1F001F': 'Other phone',
'3A20001F': 'Transmit dispname',
'3A21001F': 'Pager',
'3A220102': 'User certificate',
'3A23001F': 'Primary Fax',
'3A24001F': 'Business Fax',
'3A25001F': 'Home Fax',
'3A26001F': 'Country',
'3A27001F': 'Locality',
'3A28001F': 'State/Province',
'3A29001F': 'Street address',
'3A2A001F': 'Postal Code',
'3A2B001F': 'Post Office Box',
'3A2C001F': 'Telex',
'3A2D001F': 'ISDN',
'3A2E001F': 'Assistant phone',
'3A2F001F': 'Home phone 2',
'3A30001F': 'Assistant',
'3A44001F': 'Middle name',
'3A45001F': 'Dispname prefix',
'3A46001F': 'Profession',
'3A47001F': '',
'3A48001F': 'Spouse name',
'3A4B001F': 'TTYTTD radio phone',
'3A4C001F': 'FTP site',
'3A4E001F': 'Manager name',
'3A4F001F': 'Nickname',
'3A51001F': 'Business homepage',
'3A57001F': 'Company main phone',
'3A58101F': 'Childrens names',
'3A59001F': 'Home City',
'3A5A001F': 'Home Country',
'3A5B001F': 'Home Postal Code',
'3A5C001F': 'Home State/Provnce',
'3A5D001F': 'Home Street',
'3A5F001F': 'Other adr City',
'3A60': 'Other adr Country',
'3A61': 'Other adr PostCode',
'3A62': 'Other adr Province',
'3A63': 'Other adr Street',
'3A64': 'Other adr PO box',
'3FF7': 'Server (uncertain)',
'3FF8': 'Creator1 (uncertain)',
'3FFA': 'Creator2 (uncertain)',
'3FFC': 'To email (uncertain)',
'403D': 'To adrtype (uncertain)',
'403E': 'To email (uncertain)',
'5FF6': 'To (uncertain)',
}
# END CONSTANTS
def int_to_recipient_type(integer):
"""
Returns the name of the recipient type constant that has the value of :param integer:
"""
return RECIPIENT_DICT[integer]
def int_to_data_type(integer):
"""
Returns the name of the data type constant that has the value of :param integer:
"""
return TYPE_DICT[integer]
def int_to_intelligence(integer):
"""
Returns the name of the intelligence level constant that has the value of :param integer:
"""
return INTELLIGENCE_DICT[integer]