how to read vba code from hex stream extracted from vbaProject.bin?

Question

I have a corrupted Excel vbaproject.bin extracted from .xlam add-in. How can I read modules with vba code extracted from this bin file as HEX streams? I'm using oletools, more details in this thread:

https://bitbucket.org/decalage/oletools/issues/38/extracted-vba-hex-files-from-vbaprojectbin

Answer 1

I never succeeded in recovering the VBA code with oletools. However I had some success with oledump:

http://blog.didierstevens.com/programs/oledump-py/

I found it better suited to work with a corrupted workbook. So if you want to give it a try, download oledump.py:

https://github.com/DidierStevens/DidierStevensSuite/raw/master/oledump.py

You also need to install the module dependency "olefile" :

C:\temp>pip install olefile

Next, open your workbook with 7zip and extract the "xl\vbaProject.bin". You can also extract each module present in "xl\vbaProject.bin\VBA\" if oledump is unable to read vbaProject.bin.

Then execute this command to display all the modules in the vbaProject.bin:

C:\temp>python oledump.py --vbadecompresscorrupt  C:\temp\vbaProject.bin

And to display the code from a module, add -s followed by the module number:

C:\temp>python oledump.py --vbadecompresscorrupt -s 3  C:\temp\vbaProject.bin

If reading the vbaProject.bin failed, extract the targeted module with 7zip and try to read it directly:

C:\temp>python oledump.py -r -v --vbadecompresscorrupt C:\temp\Module1
C:\temp>python oledump.py -r -v --vbadecompresscorrupt C:\temp\ThisWorkbook

Now, if at this point you haven't seen a line of VBA, then the code is most probably unrecoverable.