Read VBA macros (or vbaProject.bin) of an Excel file without opening it in MS Excel [closed]

Question

I would like to analyze Excel files, especially those which contain VBA programs inside. because I plan to run this analysis on lots of Excel files one by one, I don't want to open these files within Microsoft Excel to analyze them.

One difficulty is to find and parse the VBA macros of an Excel file. We know that an Excel file can be converted to .zip file which contains lots of .xml and vbaProject.bin, it is pretty certain that VBA macros are in vbaProject.bin. However, the problem is how to read it?

Does anyone know if there is any tool or API to find and parse the VBA macros?

Does anyone know if there is any tool or API to read vbaProject.bin?

Surgy

So, have you succeeded? I have the similar problem - but I need to edit it a bit also :) Just wondering if you can help to read it at least – Postage

These tools decalage.info/vba_tools (exactly olevba) expose source code from .xlsm and vbaProject.bin – Northumberland

Answer 1

There is a very large PDF from Microsoft which documents how to extract functions from the vbaproject.bin:

https://interoperability.blob.core.windows.net/files/MS-OVBA/%5bMS-OVBA%5d.pdf [Source]

This resource is current & available as of June 27, 2019. The event that this link goes stale (Microsoft periodically changes their permalink structure or otherwise alters how they implement their documentation/answer repositories, etc.), search for MS-OVBA.pdf.

Some additional information which may or may not be complimentary to the above:

http://www.codeproject.com/Articles/15216/Office-2007-bin-file-format

Lights

Friendly hint: the mentioned main resource (extracting functions from` vbaproject.bin`) doesn't seem to be available, so that the principal part of this highly upvoted answer cannot be read any more - @DavidZemens – Deafanddumb

Thanks @Deafanddumb -- MS changes their repositories and documentation structure from time to time. I guess that sometime in the 6 years since this answer was posted, they made a breaking change w/r/t this resource. I've updated with current resource locations. Cheers. – Lights

Answer 2

Here's an article updated in 2017 that lists several tools for helping with this. I was able to extract the VBA code out of a vbaProject.bin using the OfficeMalScanner tool. Edit: some months after successfully using this tool, Windows is detecting malware in it. The link was www dot reconstructer dot org / code / OfficeMalScanner.zip. Use at your own risk - it worked for me to extract a bunch of needed VBA code from the project after the source was lost. Edit 2: per @HackSlash comment below, probably a false positive.

Phospholipide

The OfficeMalScanner tool link contains a virus in the download! – Forefend

It is not a virus. It's a tool that can be used to find a virus. Sometimes security tools get classified as "hacking" and blocked as "potentially unwanted programs". You'll have to be smarter than the virus scanner. – Granville