Search code examples
excelvbacomhexole

how to read vba code from hex stream extracted from vbaProject.bin?

I have a corrupted Excel vbaproject.bin extracted from .xlam add-in. How can I read modules with vba code extracted from this bin file as HEX streams? I'm using oletools, more details in this thread:

https://bitbucket.org/decalage/oletools/issues/38/extracted-vba-hex-files-from-vbaprojectbin

Solution

  • I never succeeded in recovering the VBA code with oletools. However I had some success with oledump:

    http://blog.didierstevens.com/programs/oledump-py/

    I found it better suited to work with a corrupted workbook. So if you want to give it a try, download oledump.py:

    https://github.com/DidierStevens/DidierStevensSuite/raw/master/oledump.py

    You also need to install the module dependency "olefile" :

    C:\temp>pip install olefile

    Next, open your workbook with 7zip and extract the "xl\vbaProject.bin". You can also extract each module present in "xl\vbaProject.bin\VBA\" if oledump is unable to read vbaProject.bin.

    Then execute this command to display all the modules in the vbaProject.bin:

    C:\temp>python oledump.py --vbadecompresscorrupt  C:\temp\vbaProject.bin

    And to display the code from a module, add -s followed by the module number:

    C:\temp>python oledump.py --vbadecompresscorrupt -s 3  C:\temp\vbaProject.bin

    If reading the vbaProject.bin failed, extract the targeted module with 7zip and try to read it directly:

    C:\temp>python oledump.py -r -v --vbadecompresscorrupt C:\temp\Module1
C:\temp>python oledump.py -r -v --vbadecompresscorrupt C:\temp\ThisWorkbook

    Now, if at this point you haven't seen a line of VBA, then the code is most probably unrecoverable.