{"id":76,"date":"2018-08-01T10:52:39","date_gmt":"2018-08-01T08:52:39","guid":{"rendered":"http:\/\/wp.famlarsson.net\/?p=76"},"modified":"2018-08-01T10:52:39","modified_gmt":"2018-08-01T08:52:39","slug":"ta-sig-forbi-losenordsskydd-excel-macro","status":"publish","type":"post","link":"https:\/\/wp.famlarsson.net\/?p=76","title":{"rendered":"Ta sig f\u00f6rbi l\u00f6senordsskydd Excel macro"},"content":{"rendered":"

Written by Mathieu Guindon<\/span><\/u><\/a><\/p>\n

found on<\/p>\n

https:\/\/stackoverflow.com\/questions\/1026483\/is-there-a-way-to-crack-the-password-on-an-excel-vba-project<\/p>\n

You can try this direct VBA<\/span><\/code> approach which doesn’t require HEX editing. It will work for any files (*.xls, *.xlsm, *.xlam …).<\/span><\/p>\n

\n
\n

Tested and works on<\/p>\n

Excel 2007
\nExcel 2010
\nExcel 2013 – 32 bit version<\/strong>.
\nExcel 2016 – 32 bit version<\/strong>.<\/p><\/blockquote>\n

Looking for 64 bit version? See https:\/\/stackoverflow.com\/a\/31005696\/4342479<\/span><\/u><\/a><\/p>\n

how it works<\/strong><\/p>\n

I will try my best to explain how it works – please excuse my english.<\/p>\n

    \n
  1. The VBE will call a system function to create the password dialog box.<\/li>\n
  2. If user enters the right password and click OK, this function returns 1. If user enters the wrong password or click Cancel, this function returns 0.<\/li>\n
  3. After the dialog box is closed, the VBE checks the returned value of the system function<\/li>\n
  4. if this value is 1, the VBE will ”think” that the password is right, hence the locked VBA project will be opened.<\/li>\n
  5. The code below swaps the memory of the original function used to display the password dialog with a user defined function that will always return 1 when being called.<\/li>\n<\/ol>\n

    using the code<\/em><\/p>\n

      \n
    1. Open the file(s) that contain your locked VBA Projects<\/li>\n
    2. Create a new xlsm file and store this code in Module1<\/strong>\n

      code credited to Siwtom (nick name), a Vietnamese developer<\/span><\/code><\/p>\n

      Option<\/span> Explicit\r\n\r\n<\/span>Private<\/span> Const<\/span> PAGE_EXECUTE_READWRITE <\/span>=<\/span> &H40<\/span>\r\n\r\nPrivate<\/span> Declare<\/span> Sub<\/span> MoveMemory <\/span>Lib<\/span> \"kernel32\"<\/span> Alias<\/span> \"RtlMoveMemory\"<\/span> _\r\n        <\/span>(<\/span>Destination <\/span>As<\/span> Long<\/span>,<\/span> Source <\/span>As<\/span> Long<\/span>,<\/span> ByVal<\/span> Length <\/span>As<\/span> Long<\/span>)<\/span>\r\n\r\nPrivate<\/span> Declare<\/span> Function<\/span> VirtualProtect <\/span>Lib<\/span> \"kernel32\"<\/span> (<\/span>lpAddress <\/span>As<\/span> Long<\/span>,<\/span> _\r\n        <\/span>ByVal<\/span> dwSize <\/span>As<\/span> Long<\/span>,<\/span> ByVal<\/span> flNewProtect <\/span>As<\/span> Long<\/span>,<\/span> lpflOldProtect <\/span>As<\/span> Long<\/span>)<\/span> As<\/span> Long<\/span>\r\n\r\nPrivate<\/span> Declare<\/span> Function<\/span> GetModuleHandleA <\/span>Lib<\/span> \"kernel32\"<\/span> (<\/span>ByVal<\/span> lpModuleName <\/span>As<\/span> String<\/span>)<\/span> As<\/span> Long<\/span>\r\n\r\nPrivate<\/span> Declare<\/span> Function<\/span> GetProcAddress <\/span>Lib<\/span> \"kernel32\"<\/span> (<\/span>ByVal<\/span> hModule <\/span>As<\/span> Long<\/span>,<\/span> _\r\n        <\/span>ByVal<\/span> lpProcName <\/span>As<\/span> String<\/span>)<\/span> As<\/span> Long<\/span>\r\n\r\nPrivate<\/span> Declare<\/span> Function<\/span> DialogBoxParam <\/span>Lib<\/span> \"user32\"<\/span> Alias<\/span> \"DialogBoxParamA\"<\/span> (<\/span>ByVal<\/span> hInstance <\/span>As<\/span> Long<\/span>,<\/span> _\r\n        <\/span>ByVal<\/span> pTemplateName <\/span>As<\/span> Long<\/span>,<\/span> ByVal<\/span> hWndParent <\/span>As<\/span> Long<\/span>,<\/span> _\r\n        <\/span>ByVal<\/span> lpDialogFunc <\/span>As<\/span> Long<\/span>,<\/span> ByVal<\/span> dwInitParam <\/span>As<\/span> Long<\/span>)<\/span> As<\/span> Integer<\/span>\r\n\r\nDim<\/span> HookBytes<\/span>(<\/span>0<\/span> To<\/span> 5<\/span>)<\/span> As<\/span> Byte<\/span>\r\nDim<\/span> OriginBytes<\/span>(<\/span>0<\/span> To<\/span> 5<\/span>)<\/span> As<\/span> Byte<\/span>\r\nDim<\/span> pFunc <\/span>As<\/span> Long<\/span>\r\nDim<\/span> Flag <\/span>As<\/span> Boolean<\/span>\r\n\r\nPrivate<\/span> Function<\/span> GetPtr<\/span>(<\/span>ByVal<\/span> Value <\/span>As<\/span> Long<\/span>)<\/span> As<\/span> Long<\/span>\r\n    GetPtr <\/span>=<\/span> Value\r\n<\/span>End<\/span> Function<\/span>\r\n\r\nPublic<\/span> Sub<\/span> RecoverBytes<\/span>()<\/span>\r\n    If<\/span> Flag <\/span>Then<\/span> MoveMemory <\/span>ByVal<\/span> pFunc<\/span>,<\/span> ByVal<\/span> VarPtr<\/span>(<\/span>OriginBytes<\/span>(<\/span>0<\/span>)),<\/span> 6<\/span>\r\nEnd<\/span> Sub<\/span>\r\n\r\nPublic<\/span> Function<\/span> Hook<\/span>()<\/span> As<\/span> Boolean<\/span>\r\n    Dim<\/span> TmpBytes<\/span>(<\/span>0<\/span> To<\/span> 5<\/span>)<\/span> As<\/span> Byte<\/span>\r\n    Dim<\/span> p <\/span>As<\/span> Long<\/span>\r\n    Dim<\/span> OriginProtect <\/span>As<\/span> Long<\/span>\r\n\r\n    Hook <\/span>=<\/span> False<\/span>\r\n\r\n    pFunc <\/span>=<\/span> GetProcAddress<\/span>(<\/span>GetModuleHandleA<\/span>(<\/span>\"user32.dll\"<\/span>),<\/span> \"DialogBoxParamA\"<\/span>)<\/span>\r\n\r\n\r\n    If<\/span> VirtualProtect<\/span>(<\/span>ByVal<\/span> pFunc<\/span>,<\/span> 6<\/span>,<\/span> PAGE_EXECUTE_READWRITE<\/span>,<\/span> OriginProtect<\/span>)<\/span> <><\/span> 0<\/span> Then<\/span>\r\n\r\n        MoveMemory <\/span>ByVal<\/span> VarPtr<\/span>(<\/span>TmpBytes<\/span>(<\/span>0<\/span>)),<\/span> ByVal<\/span> pFunc<\/span>,<\/span> 6<\/span>\r\n        If<\/span> TmpBytes<\/span>(<\/span>0<\/span>)<\/span> <><\/span> &H68<\/span> Then<\/span>\r\n\r\n            MoveMemory <\/span>ByVal<\/span> VarPtr<\/span>(<\/span>OriginBytes<\/span>(<\/span>0<\/span>)),<\/span> ByVal<\/span> pFunc<\/span>,<\/span> 6<\/span>\r\n\r\n            p <\/span>=<\/span> GetPtr<\/span>(<\/span>AddressOf<\/span> MyDialogBoxParam<\/span>)<\/span>\r\n\r\n            HookBytes<\/span>(<\/span>0<\/span>)<\/span> =<\/span> &H68<\/span>\r\n            MoveMemory <\/span>ByVal<\/span> VarPtr<\/span>(<\/span>HookBytes<\/span>(<\/span>1<\/span>)),<\/span> ByVal<\/span> VarPtr<\/span>(<\/span>p<\/span>),<\/span> 4<\/span>\r\n            HookBytes<\/span>(<\/span>5<\/span>)<\/span> =<\/span> &HC3<\/span>\r\n\r\n            MoveMemory <\/span>ByVal<\/span> pFunc<\/span>,<\/span> ByVal<\/span> VarPtr<\/span>(<\/span>HookBytes<\/span>(<\/span>0<\/span>)),<\/span> 6<\/span>\r\n            Flag <\/span>=<\/span> True<\/span>\r\n            Hook <\/span>=<\/span> True<\/span>\r\n        End<\/span> If<\/span>\r\n    End<\/span> If<\/span>\r\nEnd<\/span> Function<\/span>\r\n\r\nPrivate<\/span> Function<\/span> MyDialogBoxParam<\/span>(<\/span>ByVal<\/span> hInstance <\/span>As<\/span> Long<\/span>,<\/span> _\r\n        <\/span>ByVal<\/span> pTemplateName <\/span>As<\/span> Long<\/span>,<\/span> ByVal<\/span> hWndParent <\/span>As<\/span> Long<\/span>,<\/span> _\r\n        <\/span>ByVal<\/span> lpDialogFunc <\/span>As<\/span> Long<\/span>,<\/span> ByVal<\/span> dwInitParam <\/span>As<\/span> Long<\/span>)<\/span> As<\/span> Integer<\/span>\r\n    If<\/span> pTemplateName <\/span>=<\/span> 4070<\/span> Then<\/span>\r\n        MyDialogBoxParam <\/span>=<\/span> 1<\/span>\r\n    Else<\/span>\r\n        RecoverBytes\r\n        MyDialogBoxParam <\/span>=<\/span> DialogBoxParam<\/span>(<\/span>hInstance<\/span>,<\/span> pTemplateName<\/span>,<\/span> _\r\n                           hWndParent<\/span>,<\/span> lpDialogFunc<\/span>,<\/span> dwInitParam<\/span>)<\/span>\r\n        Hook\r\n    <\/span>End<\/span> If<\/span>\r\nEnd<\/span> Function<\/span><\/code><\/pre>\n<\/li>\n
    3. Paste this code in Module2<\/strong> and run it\n
      Sub<\/span> unprotected<\/span>()<\/span>\r\n    If<\/span> Hook <\/span>Then<\/span>\r\n        MsgBox <\/span>\"VBA Project is unprotected!\"<\/span>,<\/span> vbInformation<\/span>,<\/span> \"*****\"<\/span>\r\n    End<\/span> If<\/span>\r\nEnd<\/span> Sub<\/span><\/code><\/pre>\n<\/li>\n
    4. Come back to your VBA Projects and enjoy.<\/li>\n<\/ol>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
      Written by Mathieu Guindon found on https:\/\/stackoverflow.com\/questions\/1026483\/is-there-a-way-to-crack-the-password-on-an-excel-vba-project You can try this direct VBA approach which doesn’t require HEX editing. It will work for any files (*.xls, *.xlsm, *.xlam …). Tested and works on Excel 2007 Excel 2010 Excel 2013 – 32 bit version. Excel 2016 – 32 bit version. Looking for 64 bit version? See […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=\/wp\/v2\/posts\/76"}],"collection":[{"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=76"}],"version-history":[{"count":1,"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=\/wp\/v2\/posts\/76\/revisions"}],"predecessor-version":[{"id":77,"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=\/wp\/v2\/posts\/76\/revisions\/77"}],"wp:attachment":[{"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=76"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=76"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.famlarsson.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=76"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}