Is there a way to crack the password on an Excel VBA Project

Question

I ve been asked to update some Excel 2003 macros  but the VBA projects are password protected  and it seems there s a lack of documentation    no-one knows the passwords   Is there a way of removing or cracking the password on a VBA project

User · Answer

If the file is a valid zip file  the first few bytes are 50 4B -- used in formats like  xlsm   then unzip the file and look for the subfile xl vbaProject bin   This is a CFB file just like the  xls files   Follow the instructions for the XLS format  applied to the subfile  and then just zip the contents   For the XLS format  you can follow some of the other methods in this post   I personally prefer searching for the DPB  block and replacing the text   CMG       DPB       GC         with blank spaces   This obviates CFB container size issues

User · Answer

You can try this direct VBA approach which doesn t require HEX editing  It will work for any files    xls    xlsm    xlam         Tested and works on       Excel 2007     Excel 2010     Excel 2013 - 32 bit version     Excel 2016 - 32 bit version   Looking for 64 bit version  See this answer    How it works  I will try my best to explain how it works - please excuse my English    The VBE will call a system function to create the password dialog box  If user enters the right password and click OK  this function returns 1  If user enters the wrong password or click Cancel  this function returns 0  After the dialog box is closed  the VBE checks the returned value of the system function   if this value is 1  the VBE will  think  that the password is right  hence the locked VBA project will be opened   The code below swaps the memory of the original function used to display the password dialog with a user defined function that will always return 1 when being called     Using the code  Please backup your files first    Open the file s  that contain your locked VBA Projects Create a new xlsm file and store this code in Module1  code credited to Siwtom  nick name   a Vietnamese developer   Option Explicit  Private Const PAGE EXECUTE READWRITE    amp H40  Private Declare Sub MoveMemory Lib  kernel32  Alias  RtlMoveMemory             Destination As Long  Source As Long  ByVal Length As Long   Private Declare Function VirtualProtect Lib  kernel32   lpAddress As Long            ByVal dwSize As Long  ByVal flNewProtect As Long  lpflOldProtect As Long  As Long  Private Declare Function GetModuleHandleA Lib  kernel32   ByVal lpModuleName As String  As Long  Private Declare Function GetProcAddress Lib  kernel32   ByVal hModule As Long            ByVal lpProcName As String  As Long  Private Declare Function DialogBoxParam Lib  user32  Alias  DialogBoxParamA   ByVal hInstance As Long            ByVal pTemplateName As Long  ByVal hWndParent As Long            ByVal lpDialogFunc As Long  ByVal dwInitParam As Long  As Integer  Dim HookBytes 0 To 5  As Byte Dim OriginBytes 0 To 5  As Byte Dim pFunc As Long Dim Flag As Boolean  Private Function GetPtr ByVal Value As Long  As Long     GetPtr   Value End Function  Public Sub RecoverBytes       If Flag Then MoveMemory ByVal pFunc  ByVal VarPtr OriginBytes 0    6 End Sub  Public Function Hook   As Boolean     Dim TmpBytes 0 To 5  As Byte     Dim p As Long     Dim OriginProtect As Long      Hook   False      pFunc   GetProcAddress GetModuleHandleA  user32 dll     DialogBoxParamA         If VirtualProtect ByVal pFunc  6  PAGE EXECUTE READWRITE  OriginProtect   lt  gt  0 Then          MoveMemory ByVal VarPtr TmpBytes 0    ByVal pFunc  6         If TmpBytes 0   lt  gt   amp H68 Then              MoveMemory ByVal VarPtr OriginBytes 0    ByVal pFunc  6              p   GetPtr AddressOf MyDialogBoxParam               HookBytes 0     amp H68             MoveMemory ByVal VarPtr HookBytes 1    ByVal VarPtr p   4             HookBytes 5     amp HC3              MoveMemory ByVal pFunc  ByVal VarPtr HookBytes 0    6             Flag   True             Hook   True         End If     End If End Function  Private Function MyDialogBoxParam ByVal hInstance As Long            ByVal pTemplateName As Long  ByVal hWndParent As Long            ByVal lpDialogFunc As Long  ByVal dwInitParam As Long  As Integer     If pTemplateName   4070 Then         MyDialogBoxParam   1     Else         RecoverBytes         MyDialogBoxParam   DialogBoxParam hInstance  pTemplateName                               hWndParent  lpDialogFunc  dwInitParam          Hook     End If End Function  Paste this code under the above code in Module1 and run it  Sub unprotected       If Hook Then         MsgBox  VBA Project is unprotected    vbInformation              End If End Sub  Come back to your VBA Projects and enjoy

User · Answer

Colin Pickard has an excellent answer  but there is one  watch out  with this   There are instances  I haven t figured out the cause yet  where the total length of the  CMG         GC       entry in the file is different from one excel file to the next   In some cases  this entry will be 137 bytes  and in others it will be 143 bytes   The 137 byte length is the odd one  and if this happens when you create your file with the  1234  password  just create another file  and it should jump to the 143 byte length   If you try to paste the wrong number of bytes into the file  you will lose your VBA project when you try to open the file with Excel   EDIT  This is not valid for Excel 2007 2010 files   The standard  xlsx file format is actually a  zip file containing numerous sub-folders with the formatting  layout  content  etc  stored as xml data   For an unprotected Excel 2007 file  you can just change the  xlsx extension to  zip  then open the zip file and look through all the xml data   It s very straightforward   However  when you password protect an Excel 2007 file  the entire  zip   xlsx  file is actually encrypted using RSA encryption   It is no longer possible to change the extension to  zip and browse the file contents

User · Answer

VBA Project Passwords on Access  Excel  Powerpoint  or Word documents  2007  2010  2013 or 2016 versions with extensions  ACCDB  XLSM  XLTM  DOCM  DOTM  POTM  PPSM  can be easily removed   It s simply a matter of changing the filename extension to  ZIP  unzipping the file  and using any basic Hex Editor  like XVI32  to  break  the existing password  which  confuses  Office so it prompts for a new password next time the file is opened   A summary of the steps    rename the file so it has a  ZIP extension  open the ZIP and go to the XL folder  extract vbaProject bin and open it with a Hex Editor  Search  amp  Replace  to  replace all  changing DPB to DPX  Save changes  place the  bin file back into the zip  return it to it s normal extension and open the file like normal  ALT F11 to enter the VB Editor and right-click in the Project Explorer to choose VBA Project Properties  On the Protection tab  Set a new password  Click OK  Close the file  Re-open it  hit ALT F11  Enter the new password that you set    At this point you can remove the password completely if you choose to   Complete instructions with a step-by-step video I made  way back when  are on YouTube here   It s kind of shocking that this workaround has been out there for years  and Microsoft hasn t fixed the issue        The moral of the story       Microsoft Office VBA Project passwords are not to be relied upon for security of any sensitive information   If security is important  use third-party encryption software

User · Answer

My tool  VbaDiff  reads VBA directly from the file  so you can use it to recover protected VBA code from most office documents without resorting to a hex editor

User · Answer

Yes there is  as long as you are using a  xls format spreadsheet  the default for Excel up to 2003    For Excel 2007 onwards  the default is  xlsx  which is a fairly secure format  and this method will not work   As Treb says  it s a simple comparison  One method is to simply swap out the password entry in the file using a hex editor  see Hex editors for Windows    Step by step example    Create a new simple excel file  In the VBA part  set a simple password  say - 1234   Save the file and exit  Then check the file size - see Stewbob s gotcha Open the file you just created with a hex editor  Copy the lines starting with the following keys   CMG      DPB     GC      FIRST BACKUP the excel file you don t know the VBA password for  then open it with your hex editor  and paste the above copied lines from the dummy file  Save the excel file and exit  Now  open the excel file you need to see the VBA code in  The password for the VBA code will simply be 1234  as in the example I m showing here     If you need to work with Excel 2007 or 2010  there are some other answers below which might help  particularly these  1  2  3   EDIT Feb 2015  for another method that looks very promising  look at this new answer by    c Thanh Nguy n

User · Answer

For Excel 2007 onward you need to change your file extension to  zip In the archive there is a subfolder xl  in there you will find vbaProject bin  Follow the step above with vbaProject bin then save it back in the archive  Modify back your extension and voil     meaning follow steps above

User · Answer

For Excel 2016 64-bit on a Windows 10 machine  I have used a hex editor to be able to change the password of a protected xla  have not tested this for any other extensions   Tip  create a backup before you do this   The steps I took    Open the vba in the hex editor  for example XVI  Search on this DPB Change DPB to something else  like DPX Save it  Reopen the  xla  an error message will appear  just continue  You can now change the password of the  xla by opening the properties and go to the password tab    I hope this helped some of you

User · Answer

I tried some of solutions above and none of them works for me  excel 2007 xlsm file   Then i found another solution that even retrieve password  not just crack it   Insert this code into module  run it and give it some time  It will recover your password by brute force   Sub PasswordBreaker     Breaks worksheet password protection   Dim i As Integer  j As Integer  k As Integer Dim l As Integer  m As Integer  n As Integer Dim i1 As Integer  i2 As Integer  i3 As Integer Dim i4 As Integer  i5 As Integer  i6 As Integer On Error Resume Next For i   65 To 66  For j   65 To 66  For k   65 To 66 For l   65 To 66  For m   65 To 66  For i1   65 To 66 For i2   65 To 66  For i3   65 To 66  For i4   65 To 66 For i5   65 To 66  For i6   65 To 66  For n   32 To 126 ActiveSheet Unprotect Chr i   amp  Chr j   amp  Chr k   amp    Chr l   amp  Chr m   amp  Chr i1   amp  Chr i2   amp  Chr i3   amp    Chr i4   amp  Chr i5   amp  Chr i6   amp  Chr n  If ActiveSheet ProtectContents   False Then MsgBox  One usable password is    amp  Chr i   amp  Chr j   amp    Chr k   amp  Chr l   amp  Chr m   amp  Chr i1   amp  Chr i2   amp    Chr i3   amp  Chr i4   amp  Chr i5   amp  Chr i6   amp  Chr n  Exit Sub End If Next  Next  Next  Next  Next  Next Next  Next  Next  Next  Next  Next End Sub

User · Answer

your excel file s extension change to xml  And open it in notepad  password text find in xml file   you see like below line   Sheets  Sheet1   Unprotect Password   blabla     sorry for my bad english

User · Answer

Colin Pickard is mostly correct  but don t confuse the  password to open  protection for the entire file with the VBA password protection  which is completely different from the former and is the same for Office 2003 and 2007  for Office 2007  rename the file to  zip and look for the vbaProject bin inside the zip   And that technically the correct way to edit the file is to use a OLE compound document viewer like CFX to open up the correct stream  Of course   if you are just replacing bytes  the plain old binary editor may work   BTW  if you are wondering about the exact format of these fields  they have it documented now   http   msdn microsoft com en-us library dd926151 28v office 12 29 aspx

User · Answer

With my turn  this is built upon kaybee99 s excellent answer which is built upon    c Thanh Nguy n s fantastic answer to allow this method to work with both x86 and amd64 versions of Office    An overview of what is changed  we avoid push ret which is limited to 32bit addresses and replace it with mov jmp reg   Tested and works on       Word Excel 2016 - 32 bit version      Word Excel 2016 - 64 bit version    how it works   Open the file s  that contain your locked VBA Projects  Create a new file with the same type as the above and store this code in Module1  Option Explicit  Private Const PAGE EXECUTE READWRITE    amp H40  Private Declare PtrSafe Sub MoveMemory Lib  kernel32  Alias  RtlMoveMemory     Destination As LongPtr  Source As LongPtr  ByVal Length As LongPtr   Private Declare PtrSafe Function VirtualProtect Lib  kernel32   lpAddress As LongPtr    ByVal dwSize As LongPtr  ByVal flNewProtect As LongPtr  lpflOldProtect As LongPtr  As LongPtr  Private Declare PtrSafe Function GetModuleHandleA Lib  kernel32   ByVal lpModuleName As String  As LongPtr  Private Declare PtrSafe Function GetProcAddress Lib  kernel32   ByVal hModule As LongPtr    ByVal lpProcName As String  As LongPtr  Private Declare PtrSafe Function DialogBoxParam Lib  user32  Alias  DialogBoxParamA   ByVal hInstance As LongPtr    ByVal pTemplateName As LongPtr  ByVal hWndParent As LongPtr    ByVal lpDialogFunc As LongPtr  ByVal dwInitParam As LongPtr  As Integer  Dim HookBytes 0 To 11  As Byte Dim OriginBytes 0 To 11  As Byte Dim pFunc As LongPtr Dim Flag As Boolean  Private Function GetPtr ByVal Value As LongPtr  As LongPtr     GetPtr   Value End Function  Public Sub RecoverBytes       If Flag Then MoveMemory ByVal pFunc  ByVal VarPtr OriginBytes 0    12 End Sub  Public Function Hook   As Boolean     Dim TmpBytes 0 To 11  As Byte     Dim p As LongPtr  osi As Byte     Dim OriginProtect As LongPtr      Hook   False       If Win64 Then         osi   1      Else         osi   0      End If      pFunc   GetProcAddress GetModuleHandleA  user32 dll     DialogBoxParamA        If VirtualProtect ByVal pFunc  12  PAGE EXECUTE READWRITE  OriginProtect   lt  gt  0 Then          MoveMemory ByVal VarPtr TmpBytes 0    ByVal pFunc  osi 1         If TmpBytes osi   lt  gt   amp HB8 Then              MoveMemory ByVal VarPtr OriginBytes 0    ByVal pFunc  12              p   GetPtr AddressOf MyDialogBoxParam               If osi Then HookBytes 0     amp H48             HookBytes osi     amp HB8             osi   osi   1             MoveMemory ByVal VarPtr HookBytes osi    ByVal VarPtr p   4   osi             HookBytes osi   4   osi     amp HFF             HookBytes osi   4   osi   1     amp HE0              MoveMemory ByVal pFunc  ByVal VarPtr HookBytes 0    12             Flag   True             Hook   True         End If     End If End Function  Private Function MyDialogBoxParam ByVal hInstance As LongPtr    ByVal pTemplateName As LongPtr  ByVal hWndParent As LongPtr    ByVal lpDialogFunc As LongPtr  ByVal dwInitParam As LongPtr  As Integer      If pTemplateName   4070 Then         MyDialogBoxParam   1     Else         RecoverBytes         MyDialogBoxParam   DialogBoxParam hInstance  pTemplateName                       hWndParent  lpDialogFunc  dwInitParam          Hook     End If End Function  Paste this code in Module2 and run it  Sub unprotected       If Hook Then         MsgBox  VBA Project is unprotected    vbInformation              End If End Sub

User · Answer

The accepted answer didn t work in Excel 2019 on Windows 10  Found out the extra steps we need to take to see the locked macro  I am summarizing the steps   Add a  zip to the end of the excel filename and hit enter  Once the file has been changed to a ZIP file  open it by double clicking on it  Inside you would see a folder called xl like below  Inside xl  you ll find a file called vbaProject bin  copy paste it on the desktop  Go to the online Hexadecimal Editor HexEd it  Search for the following texts DPB     and change them to DPx      Save the file and close HexEd it  Copy Paste the updated file from your desktop inside the ZIP file  you would need to overwrite it   Remove the  zip extension from the end of the filename and add the excel extention again   Open the file in excel - you may receive a couple of error notifications  just click through them         EXTRA STEPS OVER THE ACCEPTED ANSWER         Open the Visual Basic window  usually ALT F11 if I remember correctly  and open the VBAProject properties  Tools menu   Click on the Protection tab and change  do not remove at this stage  the password to something short and easy to remember  we ll be removing in next step   Save the workbook and then close and reopen  Open again the Visual Basic window and enter the password you just put in   Redo the previous step but this time you can remove  delete  the password  Save the workbook and you have now removed the password    Extra steps are taken from following site https   confluence jaytaala com display TKB Remove Excel VBA password

User · Answer

In the event that your block of  CMG  XXXX  r nDPB  XXXXX  r nGC  XXXXXX  in your  known password  file is shorter than the existing block in the  unknown password  file  pad your hex strings with trailing zeros to reach the correct length   e g   CMG  xxxxxx  r nDPB  xxxxxxxx  r nGC  xxxxxxxxxx   in the unknown password file  should be set to  CMG  XXXX00  r nDPB  XXXXX000  r nGC  XXXXXX0000  to preserve file length   I have also had this working with  XLA  97 2003 format  files in office 2007

User · Answer

It s worth pointing out that if you have an Excel 2007  xlsm  file  then you can simply save it as an Excel 2003  xls  file and use the methods outlined in other answers

User · Answer

If you work in Java you may try VBAMacroExtractor  After extracting VBA scripts from  xlsm I ve found there password in plaintext

User · Answer

There is another  somewhat easier  solution  without the size problems  I used this approach today  on a 2003 XLS file  using Excel 2007  and was successful     Backup the xls file Open the file in a HEX editor and locate the DPB     part Change the DPB     string to DPx     Open the xls file in Excel Open the VBA editor  ALT   F11  the magic  Excel discovers an invalid key  DPx  and asks whether you want to continue loading the project  basically ignoring the protection  You will be able to overwrite the password  so change it to something you can remember Save the xls file  Close and reopen the document and work your VBA magic     NOTE  Be sure that you have changed the password to a new value  otherwise the next time you open the spreadsheet Excel will report errors  Unexpected Error   then when you access the list of VBA modules you will now see the names of the source modules but receive another error when trying to open forms code etc   To remedy this  go back to the VBA Project Properties and set the password to a new value   Save and re-open the Excel document and you should be good to go

User · Answer

I ve built upon    c Thanh Nguy n s fantastic answer to allow this method to work with 64-bit versions of Excel  I m running Excel 2010 64-Bit on 64-Bit Windows 7    Open the file s  that contain your locked VBA Projects  Create a new xlsm file and store this code in Module1  Option Explicit  Private Const PAGE EXECUTE READWRITE    amp H40  Private Declare PtrSafe Sub MoveMemory Lib  kernel32  Alias  RtlMoveMemory     Destination As LongPtr  Source As LongPtr  ByVal Length As LongPtr   Private Declare PtrSafe Function VirtualProtect Lib  kernel32   lpAddress As LongPtr    ByVal dwSize As LongPtr  ByVal flNewProtect As LongPtr  lpflOldProtect As LongPtr  As LongPtr  Private Declare PtrSafe Function GetModuleHandleA Lib  kernel32   ByVal lpModuleName As String  As LongPtr  Private Declare PtrSafe Function GetProcAddress Lib  kernel32   ByVal hModule As LongPtr    ByVal lpProcName As String  As LongPtr  Private Declare PtrSafe Function DialogBoxParam Lib  user32  Alias  DialogBoxParamA   ByVal hInstance As LongPtr    ByVal pTemplateName As LongPtr  ByVal hWndParent As LongPtr    ByVal lpDialogFunc As LongPtr  ByVal dwInitParam As LongPtr  As Integer  Dim HookBytes 0 To 5  As Byte Dim OriginBytes 0 To 5  As Byte Dim pFunc As LongPtr Dim Flag As Boolean  Private Function GetPtr ByVal Value As LongPtr  As LongPtr     GetPtr   Value End Function  Public Sub RecoverBytes       If Flag Then MoveMemory ByVal pFunc  ByVal VarPtr OriginBytes 0    6 End Sub  Public Function Hook   As Boolean     Dim TmpBytes 0 To 5  As Byte     Dim p As LongPtr     Dim OriginProtect As LongPtr      Hook   False      pFunc   GetProcAddress GetModuleHandleA  user32 dll     DialogBoxParamA         If VirtualProtect ByVal pFunc  6  PAGE EXECUTE READWRITE  OriginProtect   lt  gt  0 Then          MoveMemory ByVal VarPtr TmpBytes 0    ByVal pFunc  6         If TmpBytes 0   lt  gt   amp H68 Then              MoveMemory ByVal VarPtr OriginBytes 0    ByVal pFunc  6              p   GetPtr AddressOf MyDialogBoxParam               HookBytes 0     amp H68             MoveMemory ByVal VarPtr HookBytes 1    ByVal VarPtr p   4             HookBytes 5     amp HC3              MoveMemory ByVal pFunc  ByVal VarPtr HookBytes 0    6             Flag   True             Hook   True         End If     End If End Function  Private Function MyDialogBoxParam ByVal hInstance As LongPtr    ByVal pTemplateName As LongPtr  ByVal hWndParent As LongPtr    ByVal lpDialogFunc As LongPtr  ByVal dwInitParam As LongPtr  As Integer      If pTemplateName   4070 Then         MyDialogBoxParam   1     Else         RecoverBytes         MyDialogBoxParam   DialogBoxParam hInstance  pTemplateName                       hWndParent  lpDialogFunc  dwInitParam          Hook     End If End Function  Paste this code in Module2 and run it  Sub unprotected       If Hook Then         MsgBox  VBA Project is unprotected    vbInformation              End If End Sub    DISCLAIMER This worked for me and I have documented it here in the hope it will help someone out  I have not fully tested it  Please be sure to save all open files before proceeding with this option

User · Answer

ElcomSoft makes Advanced Office Password Breaker and Advanced Office Password Recovery products which may apply to this case  as long as the document was created in Office 2007 or prior

User · Answer

Have you tried simply opening them in OpenOffice org    I had a similar problem some time ago and found that Excel and Calc didn t understand each other s encryption  and so allowed direct access to just about everything    This was a while ago  so if that wasn t just a fluke on my part it also may have been patched

User · Answer

Tom - I made a schoolboy error initially as I didn t watch the byte size and instead I copied and pasted from the  CMG  set up to the subsequent entry  This was two different text sizes between the two files  though  and I lost the VBA project just as Stewbob warned   Using HxD  there is a counter tracking how much file you re selecting  Copy starting from CMG until the counter reads 8F  hex for 143  and likewise when pasting into the locked file - I ended up with twice the number of       at the end of the paste  which looked odd somehow and felt almost unnatural  but it worked    I don t know if it is crucial  but I made sure I shut both the hex editor and excel down before reopening the file in Excel  I then had to go through the menus to open the VB Editor  into VBProject Properties and entered in the  new  password to unlock the code   I hope this helps

User · Answer

For a  xlsm or  dotm file type you need to do it a slightly different way    Change the extension of the  xlsm file to  zip  Open the  zip file  with WinZip or WinRar etc  and go to the xl folder  Extract the vbaProject bin file and open it in a Hex Editor  I use HxD  its completely free and lightweight   Search for DPB and replace with DPx and save the file  Replace the old vbaProject bin file with this new on in the zipped file  Change the file extension back to  xlsm  Open workbook skip through the warning messages  Open up Visual Basic inside Excel  Go to Tools   VBAProject Properties   Protection Tab  Put in a new password and save the  xlsm file  Close and re open and your new password will work

User · Answer

The protection is a simple text comparison in Excel  Load Excel in your favourite debugger  Ollydbg being my tool of choice   find the code that does the comparison and fix it to always return true  this should let you access the macros

[excel] Is there a way to crack the password on an Excel VBA Project?

Examples related to excel

Examples related to vba

Examples related to passwords