VBA Project References

Published: 2023-05-02. Last Updated: 2023-05-02 06:38:09 UTC
by Didier Stevens (Version: 1)
0 comment(s)

I was asked where one can find VBA project references inside an ole file with VBA code.

Document [MS-OVBA] gives all the details: project references are found inside the dir stream (together with project and modules information), and a "compiled" version of that information (PerformanceCache) can be found inside the _VBA_PROJECT stream.

The content of the dir stream is compressed, and can be viewed like this:

The content of the _VBA_PROJECT stream is not compressed:

I developed a plugin to parse the records of the dir stream (as documented in [MS-OVBA]): plugin_vba_dir.

Since the PerformanceCache data is not documented (and optional), I don't know how to parse it. But you can extract strings from it and infer references.

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com

Keywords:
0 comment(s)
ISC Stormcast For Tuesday, May 2nd, 2023 https://isc.sans.edu/podcastdetail.html?id=8478

Comments


Diary Archives