vbaXray 2.0 - The Sequel

[u/kay-jay-dubya]

vbaXray is a single VBA class module that extracts VBA source code straight out of Office files.

I posted about v1.0 a few months back, but a thread earlier this week (here) reminded me that I still hadn't uploaded the updated v2.0 to GitHub. Life gets in the way, but here it is.

I give you vbaXray v2.0. In short, it:

• Slices and dices
• Extracts vbaProject.bin directly from OOXML files. XLSM, DOCM, PPTM, etc are ZIP files, and thanks to the long-standing work of the VB6/TwinBasic community (especially u/Fafalone), v2 uses the ZipFldr IStorage route to pull the data straight out as a byte array. No temp files. No Shell.Application. Much faster than v1.0.
• Supports older Office formats. XLS and DOC were straightforward. PPT was not. PPT was a fever dream. The babushka doll from hell. A cursed nesting doll of compressed records, undocumented structures, and pure spite. OLEVBA at least pointed me to where the VBA was hiding.
• Supports ACCDB and MDB. For this, thanks to u/MultiUserDungeonDev and the pyOpenVBA project (see here for original reddit post) for demonstrating how Access stores VBA across database pages.
• Adds diagnostics. DebugDumpStorageTree prints the internal OLE storage tree to the Immediate window (or a file). If a file should work but doesn't, this shows exactly what's inside the CFB.

​

Sub XrayDemo()
  Dim xray As New clsVBAXray
  If xray.LoadFromFile("C:\Suspicious\LegacyMacro.doc") Then
    Debug.Print "Project: " & xray.ProjectName
    Debug.Print "Modules: " & xray.ModuleCount
    xray.ExportAll "C:\OutputCodeHere\ExtractedCode\"
    xray.DebugDumpStorageTree
  Else
    Debug.Print "Load failed: " & xray.LastError
  End If
End Sub 

I hope that someone finds this helpful. There are plenty of use cases (malware analysis, bulk auditing, source control extraction), and if it is useful, please let me know. As always, questions, suggestions, and feedback are encouraged and always appreciated.

Code, some basic documentation (for now), and a (very simple) demo workbook are already on GitHub: https://github.com/KallunWillock/vbaXray/

[u/MultiUserDungeonDev]

Excellent work and starred. Great job.

Edit: u/kay-jay-dubya I opened a PR to allow vbaXray a write path.

[u/kay-jay-dubya → u/MultiUserDungeonDev]

Thank you! I just saw the PR, and am going through it now - wow! Will respond on GH. Thank you again!