Is there any way to programmatically determine if an .xls contains macros, without actually opening it in Excel?
Also are there any methods to examine which certificate (including timestamp cert) these macros are signed with? Again without using Excel.
I'm wondering in particular if there are any strings that always show up in the raw data of an Excel file when macros are present.
Yes, you can open the .xls file as a compound document file and check whether is contains a VBA folder and streams containing VBA code.
Sample code is available in this CodeProject article:
Another OLE Doc Viewer but with editing facility
The certificate information is stored in the DocumentSummaryInformation stream. If you want to read out the information from there you should dig into the file format specifications available from Microsoft:
[MS-OSHARED]: Office Common Data Types and Objects Structure Specification
[MS-OFFCRYPTO]: Office Document Cryptography Structure Specification
An xls file containing a macro should contain a string looking something like
Keyboard Shortcut:
Don't know if this is a surefire solution though
Related
I'm attempting to build a monthly process that converts an excel file to a PDF with bookmarks for each respective sheet. I'm not seeing a method to successfully create PDF bookmarks from within the Excel workbook. Can this be accomplished without third-party software?
What I've tried:
Using Header 1 for a cell as well as an entire row.
Putting Excel Book Mark within the file using a hyperlink reference.
Adding named range.
OneDrive flow Convert File
Adding a Header.
Reviewed some VBA Ref libraries hoping to find an object.bookmark type approach.
Unfortunately, all attempts have resulted in a PDF file with no bookmarks.
Is there a method to create PDF Bookmarks from Excel? Possibly a VBA ref library that I am unaware of or some front-end trick? Unfortunately, I'm stuck working only with Microsoft tools. Adobe's Excel Add-On does exactly what I'm trying to achieve.
I have an Excel spreadsheet on a Sharepoint site that I would like to keep as read-only. However, my users will occasionally need to add small amounts of data, which I thought could be best stored in a small text file. I can read the text data into the Excel userform easily enough, and I can amend the text file with new data equally easy - but only if I have already checked the text file out. This doesn't work for other users of course. Is there some method of checking out a file - which isn't a workbook - out via Excel VBA, or will I have to switch to storing the updateable data in another workbook?
It is possible to use VBA to read textfiles. You can use this example for instance: https://www.excel-easy.com/vba/examples/read-data-from-text-file.html where you can read the data per line.
I need to know for a school project how Excel work. Precisely I need to know what kind of structure is behind an Excel file and how the Excel program work with this file.
I know Excel is a Microsoft propriety and it' s not Open Source so I know I can' t find too much on this argument... But everything that can help me to understand how excel work it' s useful.
If I could not find something about Excel I will try to take a look at Open Office or Open Document format. So even some information about this will be real useful.
Thanks to all
You can find details of the MS Office BIFF file formats here in the microsoft.com library, while the Office Open XML format is published here on the ECMA site and here in the microsoft.com library.
You can find specifications for the OpenDocument format used by Open Office on the OASIS site
It is simpler than you may think.
An excel file is just a zip file of multiple XML documents. Each XML document corresponds to one spreadsheet in the Excel file.
You will find the XML sheets at xl\worksheets inside the zip folder.
You can scripting reading and writing to it.
Is anyone familiar with a library or tool that can determine which format an excel file is in? Or, failing that, documentation on the different formats that would allow me to write my own?
The Excel file format is called the Binary Interchange File Format (BIFF) there are different versions of Excel that use the same version of BIFF.
Open Office document on the Excel File Format.
Take a look at the Open Office API, this should help you.
Excel 97-2003 workbooks are known as Biff8. They are actually OLE Compound documents which are essentially a file system within a file. They store the main workbook in a stream named "Workbook" and they have other streams for VBA modules, OLE objects, document properties, etc...
Win32 includes APIs for reading OLE Compound Documents. They are far from trivial. Once you get the "Workbook" stream, the first Biff record identifies the file as being an Excel file.
You can find excellent documentation from Microsoft on the Biff8 file format on the Microsoft Office Binary File Formats page.
The new Excel 2007 Open XML (xlsx) format is actually a zip file with workbook parts and is documented at OpenXmlDeveloper.org.
I am not aware of a tool which will simply tell you the format of a workbook. You could take the easy, but not very reliable approach of just looking at the extension which will be right 99%+ of the time - if accuracy is not an issue.
There are many tools to read xls and xlsx workbooks, including SpreadsheetGear for .NET which reads both.
Disclaimer: I own SpreadsheetGear LLC
This question is related to my previous one.
Can you explain or provide a link to an explanation of how Excel VBA code password protection actually works in versions prior to 2007? What is the difference in Excel 2007 and previous versions in terms of password protection?
Also does Excel's password protection actually encrypt the code? How does Excel execute the code if it is encrypted?
Lastly, how does password removal software for excel work?
VBA security is widely considered to be pretty poor. The VBA code isn't compiled, and the source is available in the excel file. The password protection is pretty easy to circumvent.
As I understand it, Office 2003 and earlier saves the vba code as part of the binary format of the worksheet (or document / presentation). When you fire up the VBA IDE, it simply looks to see whether the VBA code has been "protected" or not. This doesn't mean it's encrypted - just unavailable for viewing. The theory is that this stops your users from meddling with your code, but a hard-core coder would be able to get around the password.
So Excel doesn't need to unencrypt any code - it just needs to stop people from viewing it.
Office 2007 does encrypt macros (don't ask me how or what algorithm). This is necessary presumably because XLSM files (or any Office 2007 file) are just zip files with a different extension. Anyone can get into those files and poke around.
To answer your last question - how does the password removal work on older Office formats, I'm not entirely sure. Different vendors will possibly approach the problem different ways, but I suspect the most common approach will be a brute-force attack on the passwords until a match is found.
The Excel VBProject object has a Protection property which will return different enumerations depending on the protection status of the macro (vbext_pp_locked if the macro is protected, for example). If you were to keep trying passwords programmatically until the vbext_pp_locked evaluated to false, you would have found your password.
Phil is correct - the password prevent you from looking at the modules, they are not encrypted themselves. I know in excel 2007 a file is essentially a zipped collection of XML and other files, but I don't know the details of how encryption is handled. For earlier versions - excel 2, 3, 4, 5, 95, 97, 2000, XP, & 2003, there is the comprehensive OpenOffice.org's Documentation of the Microsoft Excel File Format:
The Excel file format is named BIFF (Binary Interchange File Format). It is used to store all types of documents: worksheet documents, workbook documents, and workspace documents. There are different versions of this file format, depending on the version of Excel that has written the file, and depending on the document type.
A workbook document with several sheets (BIFF5-BIFF8) is usually stored using the compound document file format (also known as “OLE2 storage file format” or “Microsoft Office compatible storage file format”). It contains several streams for different types of data. A complete documentation of the format of compound document files can be found here.
The Workbook Protection Block occurs just after the DEFINEDNAME block (i.e. Named Ranges) in most BIFF streams, although BIFF8 is a major departure from that pattern. The record protection block In Biff5 - Biff8 the structure of the Workbook Protection Block:
WINDOWPROTECT Window settings: 1 = protected
PROTECT Workbook contents: 1 = protected
PASSWORD Hash value of the password; 0 = no password
PROT4REV Shared workbook: 1 = protected
PROT4REVPASS Hash value of the shared password; 0 = no password
The password block stores a 16-bit hash value, calculated from the worksheet or workbook protection password.
Someone made a working vba code that changes the vba protection password to "macro", for all excel files, including .xlsm (2007+ versions). You can see how it works by browsing his code.
Here's the guy blog: http://lbeliarl.blogspot.com/2014/03/excel-removing-password-from-vba.html
Here's the file that does the work: https://docs.google.com/file/d/0B6sFi5sSqEKbLUIwUTVhY3lWZE0/edit
Pasted from a previous post from his blog:
For Excel 2007/2010 (.xlsm) files do following steps:
Create a new .xlsm file.
In the VBA part, set a simple password (for instance 'macro').
Save the file and exit.
Change file extention to '.zip', open it by any archiver program.
Find the file: 'vbaProject.bin' (in 'xl' folder).
Extract it from archive.
Open the file you just extracted with a hex editor.
Find and copy the value from parameter DPB (value in quotation mark), example:
DPB="282A84CBA1CBA1345FCCB154E20721DE77F7D2378D0EAC90427A22021A46E9CE6F17188A". (This value generated for 'macro' password. You can use this DPB value to skip steps 1-8)
Do steps 4-7 for file with unknown password (file you want to unlock).
Change DBP value in this file on value that you have copied in step 8.
If copied value is shorter than in encrypted file you should populate missing characters with 0 (zero). If value is longer - that is not a problem (paste it as is).
Save the 'vbaProject.bin' file and exit from hex editor.
Replace existing 'vbaProject.bin' file with modified one.
Change extention from '.zip' back to '.xlsm'
Now, open the excel file you need to see the VBA code in. The password for the VBA code
will simply be macro (as in the example I'm showing here).