Menu
I would like to analyze Excel files, especially those which contain VBA programs inside. because I plan to run this analysis on lots of Excel files one by one, I don't want to open these files within Microsoft Excel to analyze them.
One difficulty is to find and parse the VBA macros of an Excel file. We know that an Excel file can be converted to .zip file which contains lots of .xml and vbaProject.bin, it is pretty certain that VBA macros are in vbaProject.bin. However, the problem is how to read it?
Does anyone know if there is any tool or API to find and parse the VBA macros?
Does anyone know if there is any tool or API to read vbaProject.bin?
965
Run "officeparser.py --extract-macros <file>" to extract VBA code.
If you want to run the code while closing workbook each time, select Deactiviate from the right drop down list in the Code window, and copy the code you will run and paste between Private Sub Workbook_Deactivate() and End Sub.
Extracting data from a closed file in another workbook is a common request by most of the excel user. They would like to pull or consolidate data from closed files; however, this is not possible.
There is a very large PDF from Microsoft which documents how to extract functions from the vbaproject.bin:
https://interoperability.blob.core.windows.net/files/MS-OVBA/%5bMS-OVBA%5d.pdf [Source]
This resource is current & available as of June 27, 2019. The event that this link goes stale (Microsoft periodically changes their permalink structure or otherwise alters how they implement their documentation/answer repositories, etc.), search for MS-OVBA.pdf.
Some additional information which may or may not be complimentary to the above:
http://www.codeproject.com/Articles/15216/Office-2007-bin-file-format
105
Here's an article updated in 2017 that lists several tools for helping with this. I was able to extract the VBA code out of a vbaProject.bin using the OfficeMalScanner tool. Edit: some months after successfully using this tool, Windows is detecting malware in it. The link was www dot reconstructer dot org / code / OfficeMalScanner.zip. Use at your own risk - it worked for me to extract a bunch of needed VBA code from the project after the source was lost. Edit 2: per @HackSlash comment below, probably a false positive.
26
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
