how to read vba code from hex stream extracted from vbaProject.bin? how to read vba code from hex stream extracted from vbaProject.bin? vba vba

how to read vba code from hex stream extracted from vbaProject.bin?


I never succeeded in recovering the VBA code with oletools. However I had some success with oledump:

http://blog.didierstevens.com/programs/oledump-py/

I found it better suited to work with a corrupted workbook. So if you want to give it a try, download oledump.py:

https://github.com/DidierStevens/DidierStevensSuite/raw/master/oledump.py

You also need to install the module dependency "olefile" :

C:\temp>pip install olefile

Next, open your workbook with 7zip and extract the "xl\vbaProject.bin".You can also extract each module present in "xl\vbaProject.bin\VBA\" if oledump is unable to read vbaProject.bin.

Then execute this command to display all the modules in the vbaProject.bin:

C:\temp>python oledump.py --vbadecompresscorrupt  C:\temp\vbaProject.bin

And to display the code from a module, add -s followed by the module number:

C:\temp>python oledump.py --vbadecompresscorrupt -s 3  C:\temp\vbaProject.bin

If reading the vbaProject.bin failed, extract the targeted module with 7zip and try to read it directly:

C:\temp>python oledump.py -r -v --vbadecompresscorrupt C:\temp\Module1C:\temp>python oledump.py -r -v --vbadecompresscorrupt C:\temp\ThisWorkbook

Now, if at this point you haven't seen a line of VBA, then the code is most probably unrecoverable.