You are on page 1of 35

3/23/2019 Is there a way to crack the password on an Excel VBA Project?

- Stack Overflow

Is there a way to crack the password on Ask Question

an Excel VBA Project?

I've been asked to


update some Excel
426 2003 macros, but the
VBA projects are
password protected,
and it seems there's a
lack of
415 documentation... no-
one knows the
passwords.

Is there a way of
removing or cracking
the password on a VBA
project?

excel vba

passwords

edited Dec 16 '18 at 9:41


user10791298

asked Jun 22 '09 at 10:37


Jonathan Sayce
4,905 3 29 45

Are you able to


Save-As an .xls
instead of an .xla as
the examples in
your link suggest?
Not sure if this
would make a
difference. – B Hart
By using our site, you acknowledge
Oct 29 that
'13 atyou have read and understand our Cookie Policy, Privacy Policy, and our
22:27
Terms of Service.
2 good to known : xlsb
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 1/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
is robust against
password cracking
tricks – Qbik Nov 16
'15 at 10:38

12 @Fandango68 This
question was
discussed years ago
on meta. TLDR: Lots
(most?) of the
questions on SO
could be abused by
bad actors, but
unless there is clear
evidence of
wrongdoing, we
assume good faith.
There are plenty of
legitimately legal
and ethical reasons
to crack a VBA
password.
Additionally,
discussing
weaknesses of the
current systems
ultimately
contributes to better
security in the future
and discourages
people from blindly
relying on insecure
systems now. –
jmbpiano Jan 3 '18
at 15:26

22 Answers

You can try this direct


VBA approach which
609 doesn't require HEX
editing. It will work for
any files (*.xls, *.xlsm,
*.xlam ...).

Tested and works on

Excel 2007
Excel 2010
Excel 2013 - 32 bit
version.
Excel 2016
By using our site, you acknowledge that -you
32 have
bit read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service.
version.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 2/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

Looking for 64 bit


version? See
https://stackoverflow.c
om/a/31005696/43424
79

how it works

I will try my best to


explain how it works -
please excuse my
english.

1. The VBE will call


a system function
to create the
password dialog
box.
2. If user enters the
right password
and click OK, this
function returns 1.
If user enters the
wrong password
or click Cancel,
this function
returns 0.
3. After the dialog
box is closed, the
VBE checks the
returned value of
the system
function
4. if this value is 1,
the VBE will
"think" that the
password is right,
hence the locked
VBA project will
be opened.
5. The code below
swaps the
memory of the
original function
used to display
the password
dialog with a user
defined function
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
that will always
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 3/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

return 1 when
being called.

using the code

Please backup your


files first!

1. Open the file(s)


that contain your
locked VBA
Projects
2. Create a new
xlsm file and store
this code in
Module1

code credited to
Siwtom (nick
name), a
Vietnamese
developer

Option Explicit

Private Const PA

Private Declare
(Destina

Private Declare
ByVal dw
As Long

Private Declare
String) As Long

Private Declare
ByVal lp

Private Declare
hInstance As Lon
ByVal pT
ByVal lp

Dim HookBytes(0
Dim OriginBytes(
Dim pFunc As Lon
Dim Flag As Bool

Private Function
GetPtr = Val
End Function

Public Sub Recov


If Flag Then
By using our site, you acknowledge
End that
Sub you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service.
Public Function

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 4/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
Dim TmpBytes
Dim p As Lon
Dim OriginPr

Hook = False

pFunc = GetP

If VirtualPr
Then

MoveMemo
If TmpBy

Move

p =

Hook
Move
Hook

Move
Flag
Hook
End If
End If
End Function

Private Function
ByVal pT
ByVal lp
If pTemplate
MyDialog
Else
RecoverB
MyDialog

Hook
End If
End Function

3. Paste this code


under the above
code in Module1
and run it

Sub unprotected(
If Hook Then
MsgBox "
End If
End Sub

4. Come back to
your VBA Projects
and enjoy.

By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
edited Nov 19 '18 at 8:07
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 5/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

answered Dec 16 '14 at 15:32


Đức Thanh Nguyễn
6,629 1 10 17

4 Doesn't seem to
work on 64Bit
versions of office. –
Chris Feb 25 '15 at
21:17

3 @Chris you are


absolutely right.
Because the
Windows API
functions are
defined for win 32 in
this code. –
Đức Thanh Nguyễn
Feb 25 '15 at 21:21

5 Some explanation
would be nice of
how this is working.
– Dennis G Mar 21
'15 at 12:53

11 Now the only


question left (after
seeing this
impressive method
works perfectly), is
how the hell can I
make my VBA
project protected
stronger to prevent
others from using
this hack on it :) –
EranG Jan 25 '16
at 12:01

6 This code works


perfectly in
unlocking the VBA
code although each
time I have used
this it prevents me
from re-protecting
the project with a
different password,
has anyone else
had this problem? –
Matthew Bond Nov
21 '16 at 12:49

By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 6/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

Yes there is, as long as


you are using a .xls
206 format spreadsheet
(the default for Excel
up to 2003). For Excel
2007 onwards, the
default is .xlsx ,
which is a fairly secure
format, and this
method will not work.

As Treb says, it's a


simple comparison.
One method is to
simply swap out the
password entry in the
file using a hex editor
(see Hex editors for
Windows ). Step by
step example:

1. Create a new
simple excel file.
2. In the VBA part,
set a simple
password (say -
1234).
3. Save the file and
exit. Then check
the file size - see
Stewbob's
gotcha
4. Open the file you
just created with a
hex editor.
5. Copy the lines
starting with the
following keys:

CMG=....
DPB=...
GC=...
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 7/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

6. FIRST BACKUP
the excel file you
don't know the
VBA password for,
then open it with
your hex editor,
and paste the
above copied lines
from the dummy
file.
7. Save the excel file
and exit.
8. Now, open the
excel file you need
to see the VBA
code in. The
password for the
VBA code will
simply be 1234
(as in the example
I'm showing here).

If you need to work with


Excel 2007 or 2010,
there are some other
answers below which
might help, particularly
these: 1, 2, 3.

EDIT Feb 2015: for


another method that
looks very promising,
look at this new
answer by Đức Thanh
Nguyễn.

edited May 23 '17 at 11:55


Community ♦
1 1

answered Jun 22 '09 at 10:58


Colin Pickard
38.5k 9 82 137

What if there are no


lines that start with
CMG=...? –
systemovich Sep 2
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
'09 at 13:03
Terms of Service.
1 In the blank excel

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 8/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
file, or the locked
one? Check the file
size of the blank file.
If its the locked file,
make sure your
backup is safe, then
try changing just the
other two lines. You
sure it's encrypted
file? – Colin Pickard
Sep 2 '09 at 13:43

2 It is xlsm, macro-
enabled. –
systemovich Sep 2
'09 at 14:25

6 Excel 2007
password protection
(and file format) is
radically different
than Excel 2003. I
included some
specifics about it in
my answer below. In
my opinion, the
password protected
option on an Excel
2007 file is the first
time in Microsoft
Office history that
they have produced
a reasonably secure
file. – Stewbob Sep
10 '10 at 17:42

1 This approach
worked for me on a
.xlsm file. I saved it
as a .xls, did this,
and then converted it
back to .xlsm. It
should be noted you
can safely increase
the length of the file
if the new CMG...
string is longer than
the original. –
Drew Chapin May
10 '16 at 16:33

There is another
(somewhat easier)
159 solution, without the
By using our site, you acknowledge that you
size problems. have read and understand our Cookie Policy, Privacy Policy, and our
I used
Terms of Service. this approach today (on

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 9/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

a 2003 XLS file, using


Excel 2007) and was
successful.

1. Backup the xls file


2. Open the file in a
HEX editor and
locate the
DPB=... part

3. Change the
DPB=... string to
DPx=...

4. Open the xls file in


Excel
5. Open the VBA
editor ( ALT +
F11 )

6. the magic: Excel


discovers an
invalid key (DPx)
and asks whether
you want to
continue loading
the project
(basically ignoring
the protection)
7. You will be able to
overwrite the
password, so
change it to
something you
can remember
8. Save the xls file*
9. Close and reopen
the document and
work your VBA
magic!

*NOTE: Be sure that


you have changed the
password to a new
value, otherwise the
next time you open the
spreadsheet Excel will
report errors
(Unexpected Error),
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
then when you access
Terms of Service.
the list of VBA modules
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 10/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

you will now see the


names of the source
modules but receive
another error when
trying to open
forms/code/etc. To
remedy this, go back to
the VBA Project
Properties and set the
password to a new
value. Save and re-
open the Excel
document and you
should be good to go!

edited Apr 3 '17 at 16:01


MD XF
4,190 5 29 55

answered Nov 5 '10 at 15:25


Pieter
1,915 1 11 5

This method worked


great on an Excel
2000 .xls file. – jtolle
Nov 30 '10 at 1:29

3 Unfortunately, this
didn't work for me
with Excel for Mac
2011 v14.2.5. I got
the option to repair
the file, not to reset
the password, and
the effect was losing
all the VBA scripts.
– Joe Carroll Dec 15
'12 at 10:49

Perfect solution - I
did this with a 2003
file using HxD Hex
Editor – Chris W Feb
4 '13 at 14:26

4
I just tried it (.xls,
Excel 2007) and it
did not work. Result
is: The Modules are
visible, code does
indeed seem to
work, but when
openingthat
By using our site, you acknowledge a module, it read and understand our Cookie Policy, Privacy Policy, and our
you have
says unexpected
Terms of Service.
error (40230). –

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 11/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
KekuSemau Jun 22
'13 at 17:07

2 Same error here


(Excel 2010) - but
then I realised I'd
skipped the 'set a
new password and
save/reopen' (steps
7-9) from Pieter. –
Owen B Aug 15 '13
at 11:08

I've built upon Đức


Thanh Nguyễn's
139 fantastic answer to
allow this method to
work with 64-bit
versions of Excel. I'm
running Excel 2010 64-
Bit on 64-Bit Windows
7.

1. Open the file(s)


that contain your
locked VBA
Projects.
2. Create a new xlsm
file and store this
code in Module1

Option Explicit

Private Const PAG

Private Declare P
(Destination As L

Private Declare P
LongPtr, _
ByVal dwSize As L
As LongPtr

Private Declare P
lpModuleName As S

Private Declare P
LongPtr, _
ByVal lpProcName

Private Declare P
"DialogBoxParamA"
ByVal pTemplateNa
ByValthat
By using our site, you acknowledge lpDialogFun
you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service. Dim HookBytes(0 T

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 12/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
Dim OriginBytes(0
Dim pFunc As Long
Dim Flag As Boole

Private Function
GetPtr = Valu
End Function

Public Sub Recove


If Flag Then
End Sub

Public Function H
Dim TmpBytes(
Dim p As Long
Dim OriginPro

Hook = False

pFunc = GetPr

If VirtualPro
Then

MoveMemor
If TmpByt

MoveM

p = G

HookB
MoveM
HookB

MoveM
Flag
Hook
End If
End If
End Function

Private Function
ByVal pTemplateNa
ByVal lpDialogFun

If pTemplateN
MyDialogB
Else
RecoverBy
MyDialogB

Hook
End If
End Function

3. Paste this code in


Module2 and run
it
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
Sub unprotected()
Terms of Service.
If Hook Then

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 13/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
MsgBox "V
End If
End Sub

DISCLAIMER This
worked for me and I
have documented it
here in the hope it will
help someone out. I
have not fully tested it.
Please be sure to save
all open files before
proceeding with this
option.

edited Jun 25 '15 at 15:15

answered Jun 23 '15 at 14:32


kaybee99
2,708 2 23 30

4 Works great,
thanks! ;) For
others, be sure not
to read too quickly
and miss the step
"and run it", lol. :P (I
didn't have my coffee
yet, so give me a
break lol) –
James Wilkins Apr
26 '16 at 17:16

13 Shame - but this


causes Excel 2016
64 bit to crash when
I try it. – GodEater
Aug 20 '16 at 14:34

4 This causes my
Excel 2013 64 bit to
crash too. :-( –
Maxime Jan 10 '17
at 20:26

1 Not working, I get an


out of memory
message. – Mundi
Oct 27 '17 at 19:48

1
Instead of having two
modules (64 and 32
By using our site, you acknowledge
bit) justthat
useyou
the have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service. Conditional
Compilation and
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 14/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
have the 64 bit
declarations then
the 32 bit
declarations: #If
Win64 Then
Private Declare
PtrSafe Sub...
(etc) 'Remaining
64 Bit
Declarations
#Else Private
Declare Sub...
'Remaining 64 Bit
Declarations #End
If – Charles Byrne
Apr 23 '18 at 13:51

Colin Pickard has an


excellent answer, but
61 there is one 'watch out'
with this. There are
instances (I haven't
figured out the cause
yet) where the total
length of the
"CMG=........GC=...."
entry in the file is
different from one excel
file to the next. In some
cases, this entry will be
137 bytes, and in
others it will be 143
bytes. The 137 byte
length is the odd one,
and if this happens
when you create your
file with the '1234'
password, just create
another file, and it
should jump to the 143
byte length.

If you try to paste the


wrong number of bytes
into the file, you will
lose your VBA project
when you try to open
By using our site, you acknowledge
the file withthat you have read and understand our Cookie Policy, Privacy Policy, and our
Excel.
Terms of Service.
EDIT
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 15/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

This is not valid for


Excel 2007/2010 files.
The standard .xlsx file
format is actually a .zip
file containing
numerous sub-folders
with the formatting,
layout, content, etc,
stored as xml data. For
an unprotected Excel
2007 file, you can just
change the .xlsx
extension to .zip, then
open the zip file and
look through all the xml
data. It's very
straightforward.

However, when you


password protect an
Excel 2007 file, the
entire .zip (.xlsx) file is
actually encrypted
using RSA encryption.
It is no longer possible
to change the
extension to .zip and
browse the file
contents.

edited Feb 16 '12 at 19:04

answered Jun 24 '09 at 14:36


Stewbob
14.9k 8 53 95

Then you need to


use standard zip
hacking tools. Its no
longer a "how do i
back an excel file"
problem. –
Anonymous Type
Sep 27 '10 at 22:37

3
@Anonymous Type:
I think a zip cracking
tool won't help. As I
understand
By using our site, you acknowledge that Stewbob,
you have read and understand our Cookie Policy, Privacy Policy, and our
it's not the file
Terms of Service. entries in the zip file

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 16/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
that are encrypted,
but the whole zip file
itself, which should
include the header
and the central
directory. – Treb Sep
28 '10 at 6:58

2 Just curious: how


could it be RSA
when I just enter one
password
(symmetric)? –
kizzx2 Feb 2 '11 at
18:58

How about when the


file you want to get
into has the shorter
keys? Just keep
creating vba docs
until you get one that
has 137? – onlynone
Oct 5 '15 at 19:43

Are you sure that the


entire zipfile is
encrypted when you
lock the VBA
project? I can still
open the zipfile and
see the file
structure.... And
subfolder xl\
contains the file
vbaProject.bin
which has the
familiar "CMG=...
GC=" hashing block.
– Nigel Heffernan
Oct 19 '17 at 15:10

For a .xlsm or .dotm


file type you need to do
47 it a slightly different
way.

1. Change the
extension of the
.xlsm file to
.zip .

2. Open the .zip file


(with WinZip or
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
WinRar etc) and
Terms of Service.
go to the xl folder.
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 17/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

3. Extract the
vbaProject.bin
file and open it in a
Hex Editor (I use
HxD, its
completely free
and lightweight.)
4. Search for DPB
and replace with
DPx and save the
file.
5. Replace the old
vbaProject.bin
file with this new
on in the zipped
file.
6. Change the file
extension back to
.xlsm .

7. Open workbook
skip through the
warning
messages.
8. Open up Visual
Basic inside
Excel.
9. Go to Tools >
VBAProject
Properties >
Protection Tab.
10. Put in a new
password and
save the .xlsm
file.
11. Close and re open
and your new
password will
work.

edited Jun 15 '18 at 7:47

answered Jun 26 '15 at 12:21


Matt
10.9k 21 that
By using our site, you acknowledge 69 you
100
have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service.
6 Worked in Excel
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 18/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
2016, Windows 10
64bit. (xlsm files) –
LimaNightHawk Oct
11 '16 at 13:16

1 Worked in Word
2016, Windows 10
64bit (dotm files) –
NBajanca Sep 8 '17
at 13:11

4 Great solution,
worked for me in
Excel 2013 64 bit.
You may skip
changing of file
extensions to .zip
if you have 7-Zip
installed. In this
case, you can just
right-click on the
.xlsm file and
choose "7-Zip ->
Open Archive" –
nkatsar Jun 20 '18
at 9:31

works with Word


2013, win7x64. (It's
very sad, being so
easily tricked to
believe the code is
somewhat secure). –
Berry Tsakala Oct
18 '18 at 17:42

WAO!!! Hats off


@Matt how do you
even come up with
that stuff? –
ThierryMichel Nov
15 '18 at 1:03

It's worth pointing out


that if you have an
33 Excel 2007 (xlsm) file,
then you can simply
save it as an Excel
2003 (xls) file and use
the methods outlined in
other answers.

answered Mar 25 '11 at 1:29


Andy
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
365 3 3
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 19/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

4 that is not true, I've


worked with files for
which conversion to
xls/xla from xlsm
was impossible,
Excel 2007 and 2010
crashed each time,
I've tried various
instances, from one
erros message - Kod
wyjątku: c0000005
Przesunięcie
wyjątku: 005d211d –
Qbik Jun 17 '14 at
7:02

4 YES you can do it.


I've done it many
times. If there is
something on sheets
which is necessary
and what is not
transferred to the
older version I do
this: 1. convert
.xlsm to .xls 2.
crack the code of
.xls 3. convert
.xlsm to .xlsx 4.
Put the code from
modules in .xls to
.xlsx and save that
as .xlsm – ZygD Oct
1 '15 at 18:45

It works after
converting xlsm to
xls as in the answer.
– Purus Feb 3 '17 at
7:08

Have you tried simply


opening them in
15 OpenOffice.org?

I had a similar problem


some time ago and
found that Excel and
Calc didn't understand
each other's
encryption, and so
allowed direct access
to just about
everything.that you have read and understand our Cookie Policy, Privacy Policy, and our
By using our site, you acknowledge
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 20/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

This was a while ago,


so if that wasn't just a
fluke on my part it also
may have been
patched.

answered Apr 12 '10 at 15:50


greg
209 3 2

For Excel 2007 onward


you need to change
11 your file extension to
.zip In the archive there
is a subfolder xl, in
there you will find
vbaProject.bin. Follow
the step above with
vbaProject.bin then
save it back in the
archive. Modify back
your extension and
voilà! (meaning follow
steps above)

answered Jun 20 '14 at 18:11


user3761175
119 1 2

I can confirm this


works for .xlam files
with Excel 2010 as
well. +1! – Gimelist
Oct 27 '14 at 14:17

Colin Pickard is mostly


correct, but don't
8 confuse the "password
to open" protection for
the entire file with the
VBA password
protection, which is
completely different
from the former and is
the same for Office
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
2003 and 2007 (for
Terms of Service.
Office 2007, rename
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 21/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

the file to .zip and look


for the vbaProject.bin
inside the zip). And that
technically the correct
way to edit the file is to
use a OLE compound
document viewer like
CFX to open up the
correct stream. Of
course, if you are just
replacing bytes, the
plain old binary editor
may work.

BTW, if you are


wondering about the
exact format of these
fields, they have it
documented now:

http://msdn.microsoft.c
om/en-
us/library/dd926151%2
8v=office.12%29.aspx

edited Nov 30 '10 at 0:55

answered Nov 30 '10 at 0:41


Yuhong Bao
3,273 1 15 17

1 The following link


gives details for the
XSLM format files.
gbanik.blogspot.co.u
k/2010/08/… The
solution's the same
as the one outlined
by Yuhong Bao
above, but makes for
interesting reading
and includes
screenshots. –
JohnLBevan Jul 19
'12 at 10:51

In the event that your


By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
block of
Terms of Service.
8 CMG="XXXX"\r\nDPB="XX

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 22/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

XXX"\r\nGC="XXXXXX"
in your 'known
password' file is
shorter than the
existing block in the
'unknown password'
file, pad your hex
strings with trailing
zeros to reach the
correct length.

e.g.

CMG="xxxxxx"\r\nDPB="
xxxxxxxx"\r\nGC="xxxx
xxxxxx"

in the unknown
password file, should
be set to

CMG="XXXX00"\r\nDPB="
XXXXX000"\r\nGC="XXXX
XX0000" to preserve
file length.

I have also had this


working with .XLA
(97/2003 format) files
in office 2007.

answered Apr 6 '11 at 14:21


Spangen
1,920 3 18 24

1 This works, but as


I've recently
discovered
(commented above)
you can also simply
add null characters
after the final close
quote in the GC="..."
block until you hit
the same length. –
tobriand Jul 20 '13
at 11:21

VBA Project
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
Passwords on Access,
Terms of Service. Excel, Powerpoint, or
8
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 23/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

Word documents
( 2007, 2010, 2013 or
2016 versions with
extensions .ACCDB
.XLSM .XLTM .DOCM
.DOTM .POTM .PPSM )
can be easily
removed.

It's simply a matter of


changing the filename
extension to .ZIP ,
unzipping the file, and
using any basic Hex
Editor (like XVI32) to
"break" the existing
password, which
"confuses" Office so it
prompts for a new
password next time the
file is opened.

A summary of
the steps:

rename the file so


it has a .ZIP
extension.
open the ZIP and
go to the XL
folder.
extract
vbaProject.bin
and open it with a
Hex Editor
"Search &
Replace" to
"replace all"
changing DPB to
DPX .

Save changes,
place the .bin
file back into the
zip, return it to it's
normal extension
and open the file
like normal.
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 24/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

ALT+F11 to enter
the VB Editor and
right-click in the
Project Explorer to
choose VBA
Project
Properties .
On the
Protection tab,
Set a new
password.
Click OK , Close
the file, Re-open it,
hit ALT+F11.
Enter the new
password that you
set.

At this point you can


remove the password
completely if you
choose to.

Complete
instructions with a
step-by-step video I
made "way back when"
are on YouTube here .

It's kind of shocking


that this workaround
has been out there for
years, and Microsoft
hasn't fixed the issue.

The moral of
the story?

Microsoft Office
VBA Project
passwords are not
to be relied upon
for security of any
sensitive
information. If
security is
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
important, use third-
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 25/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

party encryption
software.

answered Feb 10 '18 at 14:57


ashleedawg
12.9k 4 25 52

If the file is a valid zip


file (the first few bytes
6 are 50 4B -- used in
formats like .xlsm ),
then unzip the file and
look for the subfile
xl/vbaProject.bin .
This is a CFB file just
like the .xls files.
Follow the instructions
for the XLS format
(applied to the subfile)
and then just zip the
contents.

For the XLS format,


you can follow some of
the other methods in
this post. I personally
prefer searching for the
DPB= block and
replacing the text

CMG="..."
DPB="..."
GC="..."

with blank spaces. This


obviates CFB container
size issues.

answered Oct 8 '13 at 2:32


SheetJS
16.6k 10 50 67

With my turn, this is


built upon kaybee99's
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
excellent answer which
Terms of Service. 6
is built upon Đức
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 26/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

Thanh Nguyễn's
fantastic answer to
allow this method to
work with both x86 and
amd64 versions of
Office.

An overview of what is
changed, we avoid
push/ret which is
limited to 32bit
addresses and replace
it with mov/jmp reg.

Tested and works on

Word/Excel 2016 -
32 bit version.
Word/Excel 2016 -
64 bit version.

how it works

1. Open the file(s)


that contain your
locked VBA
Projects.
2. Create a new file
with the same type
as the above and
store this code in
Module1

Option Explicit

Private Const PAG

Private Declare P
(Destination As L

Private Declare P
LongPtr, _
ByVal dwSize As L
As LongPtr

Private Declare P
lpModuleName As S

Private Declare P
LongPtr, _
ByVal lpProcName

Private Declare P
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
"DialogBoxParamA"
Terms of Service. ByVal pTemplateNa
ByVal lpDialogFun
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 27/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

Dim HookBytes(0 T
Dim OriginBytes(0
Dim pFunc As Long
Dim Flag As Boole

Private Function
GetPtr = Valu
End Function

Public Sub Recove


If Flag Then
End Sub

Public Function H
Dim TmpBytes(
Dim p As Long
Dim OriginPro

Hook = False

#If Win64 The


osi = 1
#Else
osi = 0
#End If

pFunc = GetPr

If VirtualPro
Then

MoveMemor
If TmpByt

MoveM

p = G

If os
HookB
osi =
MoveM
HookB
HookB

MoveM
Flag
Hook
End If
End If
End Function

Private Function
ByVal pTemplateNa
ByVal lpDialogFun

If pTemplateN
MyDialogB
Else
RecoverBy
MyDialogB
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service. Hook

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 28/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
End If
End Function

3. Paste this code in


Module2 and run
it

Sub unprotected()
If Hook Then
MsgBox "V
End If
End Sub

edited Nov 18 '18 at 11:10

answered Nov 18 '18 at 8:03


VePe
108 1 5

ElcomSoft makes
Advanced Office
5 Password Breaker and
Advanced Office
Password Recovery
products which may
apply to this case, as
long as the document
was created in Office
2007 or prior.

answered Apr 12 '10 at 15:44


Charles Duffy
180k 26 205 260

I tried some of
solutions above and
5 none of them works for
me (excel 2007 xlsm
file). Then i found
another solution that
even retrieve
password, not just
crack it. that you have read and understand our Cookie Policy, Privacy Policy, and our
By using our site, you acknowledge
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 29/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

Insert this code into


module, run it and give
it some time. It will
recover your password
by brute force.

Sub PasswordBreaker()

'Breaks worksheet pas

Dim i As Integer, j A
Dim l As Integer, m A
Dim i1 As Integer, i2
Dim i4 As Integer, i5
On Error Resume Next
For i = 65 To 66: For
For l = 65 To 66: For
For i2 = 65 To 66: Fo
For i5 = 65 To 66: Fo
ActiveSheet.Unprotect
Chr(l) & Chr(m) & Chr
Chr(i4) & Chr(i5) & C
If ActiveSheet.Protec
MsgBox "One usable pa
Chr(k) & Chr(l) & Chr
Chr(i3) & Chr(i4) & C
Exit Sub
End If
Next: Next: Next: Nex
Next: Next: Next: Nex
End Sub

answered Nov 20 '15 at 11:52


Luboš Suk
960 7 21

1 Nice! I think you got


one downvote
because your
solution unlocks the
worksheet rather
than the VBA
module.
Nevertheless I found
it helpful - so thanks!
– PBD10017 Apr 16
'16 at 18:05

18 This is the right


answer to the wrong
question. – brettdj
May 8 '16 at 0:12

1
I have this one it my
Personal Workbook.
Authors cited Bob
By using our site, you acknowledge that you
McCormick as have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service. original author later
modified by Norman
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 30/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
Harker and JE
McGimpsey 2002. –
Charles Byrne Apr
18 '18 at 19:53

Tom - I made a
schoolboy error initially
4 as I didn't watch the
byte size and instead I
copied and pasted
from the "CMG" set up
to the subsequent
entry. This was two
different text sizes
between the two files,
though, and I lost the
VBA project just as
Stewbob warned.

Using HxD, there is a


counter tracking how
much file you're
selecting. Copy starting
from CMG until the
counter reads 8F (hex
for 143) and likewise
when pasting into the
locked file - I ended up
with twice the number
of "..." at the end of the
paste, which looked
odd somehow and felt
almost unnatural, but it
worked.

I don't know if it is
crucial, but I made sure
I shut both the hex
editor and excel down
before reopening the
file in Excel. I then had
to go through the
menus to open the VB
Editor, into VBProject
Properties and entered
in the 'new' password
to unlock the code.
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service. I hope this helps.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 31/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

answered Apr 12 '10 at 15:35


Scoob
41 1

My tool, VbaDiff, reads


VBA directly from the
3 file, so you can use it to
recover protected VBA
code from most office
documents without
resorting to a hex
editor.

edited May 24 '16 at 13:30

answered May 3 '11 at 10:02


Chris Spicer
1,719 1 10 20

The protection is a
simple text comparison
2 in Excel. Load Excel in
your favourite debugger
(Ollydbg being my tool
of choice), find the
code that does the
comparison and fix it to
always return true, this
should let you access
the macros.

answered Jun 22 '09 at 10:54


Treb
17.3k 5 47 82

6 No longer valid with


new formats. –
Anonymous Type
Sep 27 '10 at 22:37

your excel that


By using our site, you acknowledge file'syou have read and understand our Cookie Policy, Privacy Policy, and our
extension change to
Terms of Service.
0 xml. And open it in
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 32/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

notepad. password text


find in xml file.

you see like below line;

Sheets("Sheet1").Unpr

(sorry for my bad


english)

edited Jun 6 '17 at 11:40

answered Jun 5 '17 at 10:43


Developer33
29 4

Can you explain how


your answer is better
than the very good
ones already
provided? –
Noel Widmer Jun 5
'17 at 11:09

my solution has not


a code. so very
compact solution
other than. –
Developer33 Jun 6
'17 at 11:32

If you work in Java


you may try
0 VBAMacroExtractor .
After extracting VBA
scripts from .xlsm I've
found there password
in plaintext.

answered Apr 8 '18 at 13:37


Grez
86 1 6

For Excel 2016


By using our site, you acknowledge 64-bit
that you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service. on a Windows 10
machine, I have used a
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 33/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow

-1 hex editor to be able to


change the password
of a protected xla (have
not tested this for any
other extensions). Tip:
create a backup before
you do this.

The steps I took:

1. Open the vba in


the hex editor (for
example XVI)
2. Search on this
DPB
3. Change DPB to
something else,
like DPX
4. Save it!
5. Reopen the .xla,
an error message
will appear, just
continue.
6. You can now
change the
password of the
.xla by opening the
properties and go
to the password
tab.

I hope this helped


some of you!

answered Jan 29 '18 at 9:09


Edwin van der V
144 1 7

protected by
Robert Harvey ♦ Feb
11 '11 at 22:17
Thank you for your
interest in this
question. Because it
has attracted low-
By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
quality or spam
Terms of Service. answers that had to be
removed, posting an
https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 34/35
3/23/2019 Is there a way to crack the password on an Excel VBA Project? - Stack Overflow
answer now requires
10 reputation on this
site (the association
bonus does not count).

Would you like to


answer one of these
unanswered questions
instead?

By using our site, you acknowledge that you have read and understand our Cookie Policy, Privacy Policy, and our
Terms of Service.

https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project 35/35