MS-CFB
About
MS-CFB allows users to create, modify, and disassemble Microsoft Compound File Binary Files. This software can be used from the command line, or as a library within other projects.
This software operates as recommended in the Microsoft interoperability guidelines
Requirements
MS-CFB is tested on python 3.7 and higher.
Installation
Use the package manager pip to install MS_OVBA_Compression.
pip install ms_cfb
Getting Started
MS-CFB will take a specified directory, and combine all directories and files within the directory tree into a compound binary file. Each storage directory will be given the name of the directory, and each stream directory will be given the name of the file minus its extension.
For example, the following
./project
├── PROJECT.txt
└───VBA
├── Sheet1.bin
├── ThisWorkbook.bin
├── Module1.bin
├── dir.bin
└── _VBA_PROJECT.bin
Will be transformed to:
Root Entry
├── PROJECT
└───VBA
├── Sheet1
├── ThisWorkbook
├── Module1
├── dir
└── _VBA_PROJECT
To run the program
python ole_file.py [-h] [-c] [-l] [-x] [-v {3,4}]
[-f FILE] [-X EXTRA]
[directory]
positional arguments:
directory The input or output directory.
options:
-h, --help show this help message and
exit
-c, --create Create an OLE file from a
directory.
-l, --list Display metadata on the OLE
file and list the files that
it contains.
-x, --extract Extract files from an OLE file
to a directory.
-v {3,4}, --version {3,4}
The OLE version to use.
-f FILE, --file FILE The input or output bin file
name
-X EXTRA, --extra EXTRA
Path to exta settings yml
file.
examples:
python -m ms_cfb -c -f vbaProject.bin -v 3 -X info.yml ./project
python -m ms_cfb -x -f vbaProject.bin ./project
python -m ms_cfb -l -f vbaProject.bin
Some directory settings can be specified from a YAML file. Directory paths are relative to the project root. Users can specify creation and modification date in ISO format, class id as a UUID string, and user flags as a four byte integer.
directories:
.:
clsid: 56616700-C154-11CE-8553-00AA00A1F95B
Storage 1:
created: "1995-11-16 17:43:44"
clsid: 56616100-C154-11CE-8553-00AA00A1F95B
Tests
The tests directory contains examples of how the classes can be used within other projects. There are also complete functional tests that include full working examples of creating the OLE file from CLI or using the module's objects.
Contributing
Contributions are welcome. Please ensure new features include unit tests to maintain 100% coverage. All code must adhere to the PEP8 Standards for both formatting and naming. Method signatures must be fully annotated.
Metadata
Release files for ms-cfb 0.0.6
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| ms_cfb-0.0.6.tar.gz | 20.5 kB | With provenance | Details for ms_cfb-0.0.6.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| ms_cfb-0.0.6-py3-none-any.whl | Python 3 | none | any | Details for ms_cfb-0.0.6-py3-none-any.whl |
Total release size: 50.9 kB
Release files / ms_cfb-0.0.6.tar.gz
| Download URL | ms_cfb-0.0.6.tar.gz |
|---|---|
| Size | 20.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f49fcd18345a6f834ca33aa3d64c41ba973cb65ce6f7900b3ac529bbf6503992
|
|
BLAKE2b-256 checksum How to use checksums |
41921de35547c3742e8b6d6be6cc7e2fbd9c1cf76a380e92317ed79d327b7958
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Mar 30, 2026.
Transparency logRelease files / ms_cfb-0.0.6-py3-none-any.whl
| Download URL | ms_cfb-0.0.6-py3-none-any.whl |
|---|---|
| Size | 30.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
785f05a306262e95496551cebe6e17290a4ac2f69cabd08b577e8726e66365d7
|
|
BLAKE2b-256 checksum How to use checksums |
a2e34dfc661edad9e7ec031b85534441c08a5283947d1706c49b93f5c93b632d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Mar 30, 2026.
Transparency logSecurity for ms-cfb 0.0.6
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for ms_cfb-0.0.6.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Mar 30, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.