Восстановление пароля excel vba

The truth is that the code files for most macro-enabled Office documents are not encrypted and the password only prevents opening the project with Office programs.
This means that, as other answers suggested, you can usually use an Office alternative to access and edit the file.

However, if you just need access to the code, you can use a tool like oledump.py to extract the Macro code. This is useful for malware analysis, as well as getting most of the code from the file so that you don’t have to start from scratch if you forget the password.

In addition, many excel files dynamically set the password when the file is opened. This means that if you can read the code, you can usually find the password in plaintext or de-obfuscate it.

oledump.py Examples:

List all «streams» (embedded binary or code files) within an office document:

python oledump.py -v yourExcelFile.xlsm

Output:

A: xl/vbaProject.bin
 A1:      2000 'PROJECT'
 A2:      1500 'PROJECTwm'
 A3: M    1224 'VBA/Module1'
 A4: M   18694 'VBA/Module2'
 A5: M   11877 'VBA/Module3'
...

Streams with an M next to them are macros, which is unencrypted VBA code

Extract a stream

python oledump.py -s A3 -v yourExcelFile.xlsm > Module1.vba

This will output the code contained in the A3 stream to Module1.vba.

I usually combine this with a loop to extract all files to a folder. This quick PowerShell script will extract all streams in most files:

New-Item -ItemType Directory "Output"

# just hardcode the highest stream outputted by oledump.py -v
$max = 5 
for ($i = 1; $i -le $max; $i++) {
    python oledump.py -s "A$i" -v yourExcelFile.xlsm > ".OutputA$i"
}

Note that this will only extract human-readable files.

Время на прочтение
2 мин

Количество просмотров 17K

Здравствуйте, друзья!
Последние дни бился над такой задачей:
Имеется файл .xls, в нем макрос на VBA, защищенный паролем. Файл создается путем экспортирования из программы ГрандСмета и содержит в себе смету, которая должна обрабатываться макросом.
На 32х разрядных версиях — отрабатывает без проблем.

На 64х столкнулся со следующей ошибкой:

Справка Microsoft дает однозначный ответ:

Связывался с Тех.Поддержкой, объяснял причину. Ответ был один:

У нас все работает. Проверяли на 64х разрядных версиях.

Тогда я решился самостоятельно править код макроса. Сложность, с которой столкнулся — модуль защищен паролем. О том, как сбросить/изменить пароль не используя специализированное ПО для взлома пароля
Итак, приступим. Заранее предупрежу — я не профессиональный программист, а скорее ЭниКейщик, так что возможны некорректные формулировки, а кому-то может и вовсе не понравиться выбранный мной путь.
Первым делом я стал бороздить просторы Сети в поисках решения. В основном полным-полно ссылок на ПО, из разряда PasswordCracker. Одно из решений опубликованное на Ru-Board’e полностью удаляло код модуля VBA.
В конце концов, мои старания вознаградились — предлагаю Вам вольный перевод найденного решения (к сожалению не могу указать первоисточник — не помню) + попытка понять суть выявленной «уязвимости».

Думаю, что ни для кого не секрет, что начиная с Excel 2007 использует Microsoft Office Open XML в качестве своего основного формата.

FarManager превосходно открывает xls файл с отображением всей структуры документа.
1. Запускаем FarManager.
2. Открываем файл для редактирования.
3. Ищем строку с определением ключа DPB, и изменяем имя ключа на DPW.
4. Сохраняем.
4. Открываем файл в Excel.
5. Подтверждаем загрузку проекта, не смотря на некорректный ключ (который мы сами и сделали некорректным в п.3):

6. В окнах с сообщениями об ошибке смело жмем ОК.
7. С помощью комбинации Alt+F11 — запускаем VBA Editor и, вуаля, код макроса доступен для редактирования.

Теперь причина возникавшей ошибки при запуске макроса в среде x64 — очевидна!

Компилятор подсказывает о том, что код в данном проекте должен быть обновлен для использования на 64х разрядных системах, конкретно указав, что надо было всего лишь добавить ключевое слово PtrSafe при объявлении функции.

Изменения внес, пересохранил, проверил. Все работает. Порадовал коллег решением наболевшей проблемы + приобрел опыт.

Пытаюсь решить последний вопрос, на котором я и застопорился:
Как вразумительно, и не обидев, объяснить Тех.Поддержке о решении возникшей проблемы с запуском макроса? Не должен же я самостоятельно перелапачивать все шаблоны (а их порядка 50), чтобы макрос корректно отрабатывал на x64 версиях Офиса. К тому же вопрос этики — пришлось «обходить» защиту кода макроса.

Благодарен за внимание. Надеюсь, что для некоторой части сообщества информация была полезна.

P.S. Вдохновленный решением возникшей проблемы, и оставшись только с одним вопросом, который задал чуть выше, я решился создать свой первый топик на Хабре, в надежде на профессиональный дружеский совет.

Stuck with an Excel VBA document that’s locked with a password? We’ll show you how to remove the password protection to recover the contents of the VBA macro.

Stuck with a VBA document that’s password protected? Here’s how to pick the lock.

It’s not unusual to take ownership of someone else’s Excel document, especially in the workplace. Usually, the transition goes smoothly — but there are pitfalls that can cause some real headaches.

For instance, six months down the line you might try edit one of the VBA macros that’s integral to the spreadsheet, only to find that it’s password protected. What happens now? Well, with a bit of tinkering behind the scenes, it’s not too difficult to remove that protection entirely.

Here’s how to eliminate password protection from a VBA document in Excel. It might just make you think twice about how secure your spreadsheets really are.

How to Set Up a Password

If you need to crack a password, you may already be aware how to set one up. However, it’s still worth laying out how this kind of protection works.

Head to the Developer tab in Excel and click Macros.

In case you don’t see the Developer tab, go to File > Options and then Customize Ribbon. Now move the Developer command group from the left pane over to the right.

Once you selected Macros in the Developer tab, enter a name for your macro (it’s just an example, so the specifics don’t matter) and then click Create.

Copy and paste the following code into the Visual Basic Editor. This is a simple macro that will enter the quoted text into cell A1. It serves no real purpose, but we need something to protect with a password.

  Range("A1").Value = "Password Protected" 

You should end up with something that looks like this.

In the Visual Basic Editor, navigate to Tools > VBAProject Properties.

Head to the Protection tab and you’ll be able to set a password. You’ll also need to check the box labeled Lock project for viewing.

Click OK, make sure to save your Excel document as an XLSM file, and we can test out whether our password works. Close your document and reopen it, then head to the Developer tab and click Visual Basic.

When you try to access the relevant VBAProject, you’ll see a password prompt. Now we can figure out how to remove this kind of protection.

How to Remove a Password

Now for the difficult part, although it’s really quite straightforward once you know what you’re doing. First, we’re going to need to download a hex editor. If you don’t have one already, HxD is a good free option, but there are plenty of alternatives available.

Our process differs slightly depending on whether we’re cracking a password in an older XLS file or a newer XLSM file. If you’re working with the former, feel free to skip the next section.

Preparing Our XLSM File

We need to perform a little extra preparatory work to remove a password from an XLSM file. Find it on your hard drive, then rename it, adding .zip onto the end.

Next, open it with archive compression software like WinRAR or 7-Zip. You should find a folder labelled xl.

Inside this folder, you’re looking for a file with the name vbaProject.bin.

Extract this file and open it with your Hex Editor.

Disabling the Password

Here’s where being able to set up a password comes in handy. Create a dummy Excel document, add a macro into it, and set a password as described at the beginning of this article. Next, we’re going to take the Hex code that stipulates what the password is, and we’ll insert it into the file we want to access.

Once you have that file set up, save it and perform the same process we did a minute ago so that you end up with another vbaProject.bin file. Make sure to remember the password!

You should now have both of your vbaProject.bin files open in your Hex Editor. Don’t get them mixed up or we’re going to have big problems.

Use Ctrl + F in the file you created to find the following string:

  CMG= 

This is the start of the code that stipulates the current password. We need to copy and paste three values:

  CMG=DPB=GC= 

Below you can see how I did it.

Transfer this code over to your other vbaProject.bin file, and place it in the corresponding position, making sure not to delete anything else. Save your edited hex file.

Now, delete the original vbaProject.bin file from the document we’re trying to remove the protections from. Replace it with your edited vbaProject.bin file, then change its filename back from .zip to .xlms or .xls.

Open up the file in Excel. Head to the Developer tab and click Visual Basic, and try to access the Project menu. You should see the password prompt, and with any luck, the correct password should be the one we set up in our dummy document.

We’re back in the document! Now you can get along with whatever you were meant to be doing.

Notes on Beating the System

This trick can be very handy when you’re in a bind, and you desperately need access to a password protected VBA macro. However, it should also illustrate a major security flaw that’s present in Excel.

If you’re using this kind of password protection to defend your VBA code, know that a workaround is out there. It’s a deterrent at best — anyone with the ability to run a Google search will know exactly how to cut through your defenses.

It just goes to show how important it is for us to constantly question our security practices. Applying password protection might seem to offer valuable piece of mind, but in a situation like this one, it’s not all that effective.

Do you have questions about removing password protection from an Excel document? Or do you have a security tip you want to share with others? Why not join the conversation in the comments section below?

Image Credit: OrelPhoto via Shutterstock.com

Is it possible to break into my Excel VBA project if the code is protected with a lost or forgotten password? And if so, how can this be done? The answer is yes. Cracking an Excel VBA password is not a difficult task if you have the right tools. In fact, once you have the right tool and methodology in place, it can be quite easy to crack even complicated passwords.

In this article, we will show you how to hack VBA passwords by using a few simple methods. But first let’s take a look at what VBA password is in Excel.

VBA Password—How Does It Work?

VBA (Visual Basic for Applications) is a programming language used to make Microsoft Office applications such as Excel and Access more powerful and easier to use. VBA is also used to create custom applications.

A VBA project can be protected with a password to prevent unauthorized access. When you open a VBA project in Excel spreadsheet, you may be prompted to enter the password (as the image shown below). If you do not enter the correct password, you will not be able to view or edit the VBA code.

How to Crack an Excel VBA Password

There are a few different methods that can be used to crack an Excel VBA password. We will look at each of these methods in detail below.

Method 1: Using VBA Password Reset a

“VBA Password Reset a” is a powerful Excel password recovery plugin that can quickly reset the password to “a” from most VBA projects. This tool is compatible with Excel 2007 and above on a Windows computer, as well as Excel 2016 and higher on a Mac.

The Excel VBA Password Reset a add-in, once installed and enabled, will be accessible from the Excel ribbon. It takes only two actions to remove a macro password in Excel.

Step 1. Open workbook file with password prompt—click on “Reset VBA password – a”.

Step 2. Select an option to reset the password—here we may select “Unprotect all sheets in active workbook” from the menu.

You will be given a copy of your Excel file at the same location as where it was originally created and with an “a” VBA password.

Method 2: Using SysTools VBA Password Remover

SysTools introduced a Windows application called “SysTools VBA Password Remover” for Excel 97 and later versions. This program will crack VBA passwords in Excel workbooks easily without any technical knowledge required.

Step 1. Click the button below and download this program.

Free Download

Step 2. After you’ve launched the program, you’ll see a page with the heading “Check for Prerequisites”, where we need to click “OK” in order continue.

Step 3. Select the Excel workbook with encrypted content using the “Add File(s)” button. Then click “Reset” in order to unlock all its VBA codes.

Step 4. Now you can see that a new password has been set for this file and the status says “Pass”, which means this will be the password for accessing your VBA project.

Method 3: Change Extension + Hex Editor

In order to reset or remove a password from an Excel workbook using Hex Editor, we first need to back up the file that has been protected by VBA password. After you have backed up the file, follow these steps:

Step 1. Change the Excel file extension from “xlsm” to “zip”. This will make the file appear to be a ZIP archive.

For many people, the “Hide extensions for known file types” box in Folder Options is checked by default. Unchecking this box will make extensions visible in File Explorer.

Step 2. Extract the ZIP file with a tool like WinZip or 7-Zip.

Step 3. Open up the unzipped folder. Inside of this one there is an “xl” subfolder where you can find the “vbaProject.bin” file.

Step 4. Open the “vbaProject.bin” file with a hex editor such as HxD.

Step 5. Look for “DPB” within the file.

Step 6. Now change “DPB” to “DPx”. Save the changes and exit.

Only “B” should be changed to “x”, and don’t eliminate the equal sign by mistake.

Step 7. Compress all the folders and files to a ZIP.

Step 8. Change the extension from “zip” to “xlsm”, and then opening it.

Step 9. Okay, so you’re in the xlsm file. The first thing that may happen is a lot of errors popping up but don’t worry: just press “Yes” to dismiss them.

Open the VB editor by clicking “Developer” then “Visual Basic”. Then, under “Tools” > “VBAProject Properties”, remove the check for “Lock project for viewing”.

Step 10. Close the editor and save the Excel file. It’s possible that it’ll notify you to save in a different location as a new file.

Step 11. Open the new file. Your VBA code will now be visible without the need to enter a password!

*We have tested this method on an Excel 2007 file.

Conclusion

VBA Password has been used by many developers in order to protect their code from being seen or edited by other people who will misuse it. This is a good technique in most cases, but when you forget your Excel VBA password and need to see your project code, the above methods will help you.

In this article we’ve covered three ways you can gain access to your VBA project without the need of a password. Whether you want to use an add-in tool or download a password remover program from SysTools, it doesn’t take long before your file is open and available for editing again.

There is nothing more frustrating than finding out a previous employee has used passwords to protect an Excel file, and it turns out nobody else knows the password. Or maybe it’s worse when it’s your file, your password and you’ve forgotten it. Either way… you’re stuffed! However, before you give in, let me share some ideas on how to remove Excel passwords with VBA.

By the way, if you’re not familiar with VBA or find these methods too difficult, you can try a simpler solution. Password-Find is paid Excel password remover.

Download the example file

I recommend you download the example file for this post. Then you’ll be able to work along with examples and see the solution in action, plus the file will be useful for future reference.

Download the file: 0012 Remove passwords.zip

The download includes a free Excel password remover. Please see the sections below for full details on how to use the tool.

WARNING! – When messing around with password removal, it is easy to make files unreadable, so make sure you back up before doing anything. After all, there is no point in cracking a password, if the file can’t be viewed afterward.

Before we even start discussing how to remove passwords, we need to understand the different types of passwords within an Excel file. The removal approach will vary for each.

Setting different types of passwords

There are five different passwords within Excel:

• File open
• File modify
• Workbook protection
• Worksheet protection
• VBA project

Each of them is applied differently and serves a different purpose. Let’s look at each in turn.

File open passwords

The file open password prevents an Excel workbook from opening until the password is entered.

To set a file open password in Excel:

1. Click File > Save As > More Options…
   
2. Next, in the Save As dialog box, click Tools > General Options…
3. The General Options dialog box appears. Enter a password in the password to open box, then click OK.
   .
4. In the Confirm Password window, re-enter the password and click OK.
   
5. Finally, enter a file name and click Save in the Save As window.
   

The file open password has now been set. A user cannot open the workbook until the password has been entered.

Warning Message

Did you notice the warning message which appeared when setting the password?

Caution: If you lose or forget the password, it cannot be recovered. It is advisable to keep a list of passwords and their corresponding workbook and sheet names in a safe place. (Remember that passwords are case-sensitive.)

This is good advice. As these passwords cannot be easily recovered.

File modify passwords

The file modify password prevents the workbook from being changed until a password has been entered. Some of the steps are the same as the file open password, but they are repeated here for completeness.

1. Click File > Save As > More Options…
   
2. The Save As window appears, click Tools > General Options…
3. The General Options box appears. Enter a password in the password to modify box, then click OK.
4. In the Confirm Password window, re-enter the password and click OK.
   
5. Finally, click Save on the Save As window.
   

The File Modify password has now been set. A user can open the workbook, but it is set as read-only unless they enter the password.

Warning Message

Did you notice the warning message this time?

Caution: Password to modify is not a secure feature. This document is protected from unintentional editing. However, the document is not encrypted. Malicious users can edit the file and remove the password.

Did you see the difference in tone of the warning message? Even Microsoft recognizes that this password is not secure. We will cover how to remove this password later in the post.

Worksheet protection passwords

Worksheet protection passwords prevent specific cells from being changed. A user can open and interact with the worksheet but is restricted in the activities they can do.

1. Start by setting the lock property of a cell or range of cells. Select some cells then click Home > Format > Format Cells from the ribbon (or the shortcut is Ctrl + 1)
2. The Format Cells window opens. Select the Protection tab, tick or untick the Locked option as required, then click OK.
   
3. To apply the protection, click Review > Protect Sheet.
4. The Protect Sheet window opens. Enter a password, and use the tick boxes to set the protection to be applied, then click OK.
5. In the Confirm Password window, re-enter the password and click OK again.
   

Done. The worksheet is now protected. If a user tries to make changes to a locked cell, an error message appears:

Warning Message

When setting the password, the warning message is the same as the file open password.

Caution: If you lose or forget the password, it cannot be recovered.  It is advisable to keep a list of passwords and their corresponding workbook and sheet names in a safe place. (Remember that passwords are case-sensitive.)

This would imply it is the same level of security as the file open password, which isn’t true. As you’ll see later in this post, we can remove this password (it’s not as secure as they make it seem).

Workbook protection passwords

Workbook protection is applied in a similar way to worksheet protection, but with fewer options. It prevents users from changing the structure of a workbook, such as creating or renaming worksheets.

1. Click Review > Protect Workbook from the ribbon.
   
2. The Protect Structure window opens. Enter a password, then click OK.
   
   Note: Prior to Excel 2013, both the Structure and Window options were available. Due to the Single Document Interface introduced in Excel 2013, the Windows option is no longer relevant and greyed out.
3. In the Confirm Password window, re-enter the password and click OK.
   

The workbook structure is now protected.

Warning Message

Did you notice the warning message again?

Caution: If you lose or forget the password, it cannot be recovered. It is advisable to keep a list of passwords and their corresponding workbook and sheet names in a safe place. (Remember that passwords are case-sensitive.)

Again, this message would imply it has high security. However, this just isn’t true. As we will see later in this post, we can remove this password (it’s not as secure as Microsoft make it seem).

VBA project passwords

VBA project passwords prevent users from viewing or changing the code of a VBA Project.

1. In the Visual Basic Editor window, click Tools > VBA Project Properties…
2. The VBA Project – Project Properties window opens. Select the Protection tab, tick the Lock project for viewing, enter and confirm a password, then click OK.

The VBA project is now protected. Close and re-open the workbook. When expanding the VBA project, the user is presented with a box to enter the password.

How Excel handles passwords

Whilst we have considered five different types of passwords, a standard xlsx file handles these in only three ways:

• XML file code
• Encryption
• VBA Project binary

Notes: Excel files can be saved in many different spreadsheet file formats. The most common of which are:

• .xlsx – The standard file format which primarily compressed XML files
• .xls – The legacy file format which was replaced in Excel 2007
• .xlsb – Stores the Excel file as compressed binary files. It is a proprietary file format, which is generally not supported outside of Excel.
• .xlsm – A .xlsx file which contains a macro
• .xlam – A .xlsm file saved with a setting identifying it as an add-in

The remainder of this post only covers the xlsx, xlsm and xlam file formats.

XML file code (worksheet, workbook and modify passwords)

From Excel 2007, the standard file format changed to an xlsx format. This means the file is built using mostly code written in an XML structure. That might sound confusing, but don’t worry. All you need to know is that with a bit of knowledge we can edit XML code ourselves

Encryption (file open password)

From Excel 2007, Microsoft’s level of protection increased significantly. When saving a file with the file open password, Excel applies encryption to the XML code.

VBA Project binary (VBA passwords)

VBA Projects are stored as binary files within the Excel file format structure. The passwords, or the encrypted versions of those passwords are stored within the VBA binary file itself.

Removing each type of password

Since the passwords are stored in different ways, the method of removing them is also different.

Crack the file open password (encrypted)

For this first password method, it’s bad news. The only way I know to open one of these files is through a brute-force attack. This means trying every combination of every letter until the password is identified.

Just using numbers, uppercase and lowercase letters, an 8-digit password has 218,340,105,584,896 possible character combinations. Therefore, to speed things up, any software which uses this approach tends to focus on known patterns and word combinations. The more complex the password, the longer it will take to crack.

If you’re looking for an Excel password cracker to detail with these types of passwords, then I recommend third-party software tools and services which can perform this attack at high speed. 

I have tried one of these services, and have good results, try them out: https://www.password-find.com. They claim to be able to find 80% of passwords, which is pretty good going.

Crack the modify file password

The truth is, we don’t even need an Excel password remover for the file modify password. The password can be removed by re-saving the file with a new name.

That’s it. It pretty much serves no security purpose. Nice and simple.

Cracking worksheet and workbook passwords

As noted above, Excel files are just text files that are written in a specific format, which Excel can interpret. So, if we can edit the code, we can remove the password.

Excel does not store the password itself within the file. Instead, it uses an algorithm to create an adjusted code; then it stores the adjusted code within the file.

Any password we enter is processed through the same algorithm. If that algorithm creates the same result, then it follows that it must be the same password, and Excel allows us to edit the worksheet or workbook.

Thankfully, we do not have to try a brute-force attack. As noted above, we can simply edit the code.

Crack the workbook and worksheet passwords manually

If you think that you need software to remove Excel passwords, you will be surprised by this method. All it needs is a text editor, like Notepad.

I keep talking about the XML file and the file structure; let’s have a look at it. You’ll see it’s not too scary.

This method can corrupt a file. So, before trying this, make sure you back up the file.

1. Make sure the file extensions are visible on your computer. On any Windows folder, click View > Options.
2. In the Folder Options dialog box, click the View tab, remove the tick from hide extensions for known file types, then click OK.
   
3. It is now possible to see the .xlsx file extension. Rename the file to include the .zip extension.
   
4. Open the zip file, then navigate to the xlworkbooks.xml file. The highlighted section below shows where the modify and workbook passwords are coded:
   
5. Next, navigate to xlworksheetssheet1.xml. The highlighted section below shows where the worksheet protection password code is:
   
6. Save the worksheet and workbook XML files outside of the zip folder.
7. Open the files with a text editor and remove the highlighted sections of code.
8. Save the XML files, then copy them back into the zip folders.
9. Rename the file to include the .xlsx, .xlsm or .xlam file extension.

Note: For this to work. We need to adjust the XML files, then insert them, back into the zip folder in the same location. Don’t unzip the folder completely, as the zipping and unzipping process can make the Excel file unusable.

Alternatively, we could use a macro to remove the code automatically.

Crack the workbook, worksheet and modify passwords with a macro

The following is my VBA code for cracking Excel passwords. It may not be the best tool available, but based on feedback I’ve received, it has successfully helped thousands of use.

The download file already includes this macro and can be used to remove Excel passwords for workbook, worksheet and modify scenarios.

Close the file with the password to be removed.

Open a new Excel workbook and copy the following code into a standard module within the Visual Basic Editor.

Sub RemoveProtection()

Dim dialogBox As FileDialog
Dim sourceFullName As String
Dim sourceFilePath As String
Dim sourceFileName As String
Dim sourceFileType As String
Dim newFileName As Variant
Dim tempFileName As String
Dim zipFilePath As Variant
Dim oApp As Object
Dim FSO As Object
Dim xmlSheetFile As String
Dim xmlFile As Integer
Dim xmlFileContent As String
Dim xmlStartProtectionCode As Double
Dim xmlEndProtectionCode As Double
Dim xmlProtectionString As String

'Open dialog box to select a file
Set dialogBox = Application.FileDialog(msoFileDialogFilePicker)
dialogBox.AllowMultiSelect = False
dialogBox.Title = "Select file to remove protection from"

If dialogBox.Show = -1 Then
    sourceFullName = dialogBox.SelectedItems(1)
Else
    Exit Sub
End If

'Get folder path, file type and file name from the sourceFullName
sourceFilePath = Left(sourceFullName, InStrRev(sourceFullName, ""))
sourceFileType = Mid(sourceFullName, InStrRev(sourceFullName, ".") + 1)
sourceFileName = Mid(sourceFullName, Len(sourceFilePath) + 1)
sourceFileName = Left(sourceFileName, InStrRev(sourceFileName, ".") - 1)

'Use the date and time to create a unique file name
tempFileName = "Temp" & Format(Now, " dd-mmm-yy h-mm-ss")

'Copy and rename original file to a zip file with a unique name
newFileName = sourceFilePath & tempFileName & ".zip"
On Error Resume Next
FileCopy sourceFullName, newFileName

If Err.Number <> 0 Then
    MsgBox "Unable to copy " & sourceFullName & vbNewLine _
        & "Check the file is closed and try again"
    Exit Sub
End If
On Error GoTo 0

'Create folder to unzip to
zipFilePath = sourceFilePath & tempFileName & ""
MkDir zipFilePath

'Extract the files into the newly created folder
Set oApp = CreateObject("Shell.Application")
oApp.Namespace(zipFilePath).CopyHere oApp.Namespace(newFileName).items

'loop through each file in the xlworksheets folder of the unzipped file
xmlSheetFile = Dir(zipFilePath & "xlworksheets*.xml*")
Do While xmlSheetFile <> ""

    'Read text of the file to a variable
    xmlFile = FreeFile
    Open zipFilePath & "xlworksheets" & xmlSheetFile For Input As xmlFile
    xmlFileContent = Input(LOF(xmlFile), xmlFile)
    Close xmlFile

    'Manipulate the text in the file
    xmlStartProtectionCode = 0
    xmlStartProtectionCode = InStr(1, xmlFileContent, "<sheetProtection")

    If xmlStartProtectionCode > 0 Then

        xmlEndProtectionCode = InStr(xmlStartProtectionCode, _
            xmlFileContent, "/>") + 2 '"/>" is 2 characters long
        xmlProtectionString = Mid(xmlFileContent, xmlStartProtectionCode, _
            xmlEndProtectionCode - xmlStartProtectionCode)
        xmlFileContent = Replace(xmlFileContent, xmlProtectionString, "")

    End If

    'Output the text of the variable to the file
    xmlFile = FreeFile
    Open zipFilePath & "xlworksheets" & xmlSheetFile For Output As xmlFile
    Print #xmlFile, xmlFileContent
    Close xmlFile

    'Loop to next xmlFile in directory
    xmlSheetFile = Dir

Loop

'Read text of the xlworkbook.xml file to a variable
xmlFile = FreeFile
Open zipFilePath & "xlworkbook.xml" For Input As xmlFile
xmlFileContent = Input(LOF(xmlFile), xmlFile)
Close xmlFile

'Manipulate the text in the file to remove the workbook protection
xmlStartProtectionCode = 0
xmlStartProtectionCode = InStr(1, xmlFileContent, "<workbookProtection")
If xmlStartProtectionCode > 0 Then

    xmlEndProtectionCode = InStr(xmlStartProtectionCode, _
        xmlFileContent, "/>") + 2 ''"/>" is 2 characters long
    xmlProtectionString = Mid(xmlFileContent, xmlStartProtectionCode, _
        xmlEndProtectionCode - xmlStartProtectionCode)
    xmlFileContent = Replace(xmlFileContent, xmlProtectionString, "")

End If

'Manipulate the text in the file to remove the modify password
xmlStartProtectionCode = 0
xmlStartProtectionCode = InStr(1, xmlFileContent, "<fileSharing")
If xmlStartProtectionCode > 0 Then

    xmlEndProtectionCode = InStr(xmlStartProtectionCode, xmlFileContent, _
        "/>") + 2 ''"/>" is 2 characters long
    xmlProtectionString = Mid(xmlFileContent, xmlStartProtectionCode, _
        xmlEndProtectionCode - xmlStartProtectionCode)
    xmlFileContent = Replace(xmlFileContent, xmlProtectionString, "")

End If

'Output the text of the variable to the file
xmlFile = FreeFile
Open zipFilePath & "xlworkbook.xml" & xmlSheetFile For Output As xmlFile
Print #xmlFile, xmlFileContent
Close xmlFile

'Create empty Zip File
Open sourceFilePath & tempFileName & ".zip" For Output As #1
Print #1, Chr$(80) & Chr$(75) & Chr$(5) & Chr$(6) & String(18, 0)
Close #1

'Move files into the zip file
oApp.Namespace(sourceFilePath & tempFileName & ".zip").CopyHere _
oApp.Namespace(zipFilePath).items
'Keep script waiting until Compressing is done
On Error Resume Next
Do Until oApp.Namespace(sourceFilePath & tempFileName & ".zip").items.Count = _
    oApp.Namespace(zipFilePath).items.Count
    Application.Wait (Now + TimeValue("0:00:01"))
Loop
On Error GoTo 0

'Delete the files & folders created during the sub
Set FSO = CreateObject("scripting.filesystemobject")
FSO.deletefolder sourceFilePath & tempFileName

'Rename the final file back to an xlsx file
Name sourceFilePath & tempFileName & ".zip" As sourceFilePath & sourceFileName _
& "_" & Format(Now, "dd-mmm-yy h-mm-ss") & "." & sourceFileType

'Show message box
MsgBox "The workbook and worksheet protection passwords have been removed.", _
vbInformation + vbOKOnly, Title:="Password protection"

End Sub

Run the macro above. Select the file containing the password to be removed, then click OK. The macro will create a new file with the modify, workbook and worksheet passwords removed.

NOTE – The macro will not work on a Mac, only on a Windows PC.

Common error messages and solutions

If you get the following error messages, the reason could be one of the following:

Run-time error ’53’: file not found:

• The workbook is an xlsb file type; the macro only works on the xlsx file type.

Run-time error ’76’: file not found:

• The workbook is an xls file type; the macro only works on the xlsx, xlsm or xlam file types.
• The workbook has a file open password applied.

Run-time error ’91’: Object variable or With block variable not set:

• You are running the macro on a Mac, instead of a PC.

Run-time error ‘5’: Invalid function call on the xml read into the string

• Does not work with very large worksheets – The macro converts the XML file to a string. Therefore if the string is more than 2 billion characters, it will cause a VBA error.

Other tips to use this macro successfully:

• Ensure the workbook is saved on your local PC

Crack the VBA project binary password with a macro

Finally, we get to the VBA project binary passwords. Many tutorials suggest using a HEX editor to remove the password. But there is a better and simpler way.

There is an amazing macro that confuses the Visual Basic Editor into believing a valid password has been entered.

I could not have coded this macro in a million years. I don’t claim to be the author of this code, I have copied it from here: https://stackoverflow.com/questions/1026483/is-there-a-way-to-crack-the-password-on-an-excel-vba-project

If you are the copyright owner of the original code and wish me to remove the code below, please let me know.

Ensure the workbook containing locked VBA project is open.

Create a new workbook and copy all the code below into a standard VBA module, then run the VBAUnprotected macro (the one at the bottom).

The download file already includes this macro and can be used to remove the VBA password.

Private Const PAGE_EXECUTE_READWRITE = &H40

Private Declare PtrSafe Sub MoveMemory Lib "kernel32" Alias "RtlMoveMemory" _
    (Destination As LongPtr, Source As LongPtr, ByVal Length As LongPtr)

Private Declare PtrSafe Function VirtualProtect Lib "kernel32" (lpAddress As LongPtr, _
    ByVal dwSize As LongPtr, ByVal flNewProtect As LongPtr, lpflOldProtect As LongPtr) As LongPtr

Private Declare PtrSafe Function GetModuleHandleA Lib "kernel32" (ByVal lpModuleName As String) As LongPtr

Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, _
    ByVal lpProcName As String) As LongPtr

Private Declare PtrSafe Function DialogBoxParam Lib "user32" Alias "DialogBoxParamA" (ByVal hInstance As LongPtr, _
    ByVal pTemplateName As LongPtr, ByVal hWndParent As LongPtr, _
    ByVal lpDialogFunc As LongPtr, ByVal dwInitParam As LongPtr) As Integer

Dim HookBytes(0 To 11) As Byte
Dim OriginBytes(0 To 11) As Byte
Dim pFunc As LongPtr
Dim Flag As Boolean

Private Function GetPtr(ByVal Value As LongPtr) As LongPtr
GetPtr = Value
End Function

Public Sub RecoverBytes()
If Flag Then MoveMemory ByVal pFunc, ByVal VarPtr(OriginBytes(0)), 12
End Sub

Public Function Hook() As Boolean

Dim TmpBytes(0 To 11) As Byte
Dim p As LongPtr, osi As Byte
Dim OriginProtect As LongPtr

Hook = False

#If Win64 Then
    osi = 1
#Else
    osi = 0
#End If

pFunc = GetProcAddress(GetModuleHandleA("user32.dll"), "DialogBoxParamA")

If VirtualProtect(ByVal pFunc, 12, PAGE_EXECUTE_READWRITE, OriginProtect) <> 0 Then

    MoveMemory ByVal VarPtr(TmpBytes(0)), ByVal pFunc, osi+1
    If TmpBytes(osi) <> &HB8 Then

        MoveMemory ByVal VarPtr(OriginBytes(0)), ByVal pFunc, 12

        p = GetPtr(AddressOf MyDialogBoxParam)

        If osi Then HookBytes(0) = &H48
        HookBytes(osi) = &HB8
        osi = osi + 1
        MoveMemory ByVal VarPtr(HookBytes(osi)), ByVal VarPtr(p), 4 * osi
        HookBytes(osi + 4 * osi) = &HFF
        HookBytes(osi + 4 * osi + 1) = &HE0

        MoveMemory ByVal pFunc, ByVal VarPtr(HookBytes(0)), 12
        Flag = True
        Hook = True
    End If
End If

End Function

Private Function MyDialogBoxParam(ByVal hInstance As LongPtr, _
    ByVal pTemplateName As LongPtr, ByVal hWndParent As LongPtr, _
    ByVal lpDialogFunc As LongPtr, ByVal dwInitParam As LongPtr) As Integer

If pTemplateName = 4070 Then
    MyDialogBoxParam = 1
Else
    RecoverBytes
    MyDialogBoxParam = DialogBoxParam(hInstance, pTemplateName, _
        hWndParent, lpDialogFunc, dwInitParam)
    Hook
End If

End Function


''''RUN THE CODE BELOW''''
Sub VBAUnprotected()

If Hook Then
    MsgBox "VBA Project is unprotected!", vbInformation, "*****"
End If

End Sub

This code does not remove the password but tricks the Visual Basic Editor into thinking the correct password has been entered. To remove or change the password go into the VBA Project Properties settings to change the existing settings.

Please note, the macro only works with passwords created using Excel’s standard VBA password feature. VBA projects protected with Unviewable+ (or similar software) cannot be cracked.

Conclusion

There you have it, that’s how to crack Excel passwords with VBA.

For worksheet, workbook, modify and VBA projects, there is a solution.

If you were hoping to get instructions to crack the file open password, then I’m sorry, I don’t have an easy solution. Try investigating a brute force attack method from https://www.password-find.com