Hello there, I'm trying to remove a directory structure from a Composite Document File V2 Document file, and my code is working in every cases I could test except one.
Here it is: https://gist.github.com/mguerreiro/7023cab737917e936ac40857cdc12035 sampleCall is the call I'm using. My issue is that when trying to nuke "Macros", I have a stale directory entry named "VBA". I can't find it using Apache POI's API: it doesn't seem to detect orphans (why would it, after all?), so I can't remove them manually either. The sample file I'm using: https://plik.root.gg/file/C1eIAG4bBN2Nteio/iakCcsP6tiFn22mG/bill44955.doc Beware, this is a malware. Auth.: user "plik" password "infected" To see the orphan entry, I use oletools (https://www.decalage.info/python/oletools, down at the moment): Results before and after are in the gist. I've tried to call "renameTo" instead of "remove", but it causes an infinite loop in oletools. What I thing is causing this issue: somehow the references are not updated, and for some reasons a stale pointer is left. Would you, by chance, have any idea on how I could prevent this from happening? Is this a bug on your side? PS/ All I want is the "VBA" directory to disappear, should I rename or remove it. Best regards, Maxime G. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
