How to Remove a Password
Now for the difficult part, although it’s really quite straightforward once you know what you’re doing. First, we’re going to need to download a hex editor. If you don’t have one already, HxD is a good free option, but there are plenty of alternatives available.
Our process differs slightly depending on whether we’re cracking a password in an older XLS file or a newer XLSM file. If you’re working with the former, feel free to skip the next section.
Preparing Our XLSM File
We need to perform a little extra preparatory work to remove a password from an XLSM file. Find it on your hard drive, then rename it, adding .zip onto the end.
Next, open it with archive compression software like WinRAR or 7-Zip. You should find a folder labelled xl.
Inside this folder, you’re looking for a file with the name vbaProject.bin.
Extract this file and open it with your Hex Editor.
Disabling the Password
Here’s where being able to set up a password comes in handy. Create a dummy Excel document, add a macro into it, and set a password as described at the beginning of this article. Next, we’re going to take the Hex code that stipulates what the password is, and we’ll insert it into the file we want to access.
Once you have that file set up, save it and perform the same process we did a minute ago so that you end up with another vbaProject.bin file. Make sure to remember the password!
You should now have both of your vbaProject.bin files open in your Hex Editor. Don’t get them mixed up or we’re going to have big problems.
Use Ctrl + F in the file you created to find the following string:
CMG=This is the start of the code that stipulates the current password. We need to copy and paste three values:
CMG=
DPB=
GC=Below you can see how I did it.
Transfer this code over to your other vbaProject.bin file, and place it in the corresponding position, making sure not to delete anything else. Save your edited hex file.
Now, delete the original vbaProject.bin file from the document we’re trying to remove the protections from. Replace it with your edited vbaProject.bin file, then change its filename back from .zip to .xlms or .xls.
Open up the file in Excel. Head to the Developer tab and click Visual Basic, and try to access the Project menu. You should see the password prompt, and with any luck, the correct password should be the one we set up in our dummy document.
We’re back in the document! Now you can get along with whatever you were meant to be doing.
Notes on Beating the System
This trick can be very handy when you’re in a bind, and you desperately need access to a password protected VBA macro. However, it should also illustrate a major security flaw that’s present in Excel.
If you’re using this kind of password protection to defend your VBA code, know that a workaround is out there. It’s a deterrent at best — anyone with the ability to run a Google search will know exactly how to cut through your defenses.
It just goes to show how important it is for us to constantly question our security practices. Applying password protection might seem to offer valuable piece of mind, but in a situation like this one, it’s not all that effective.
Reference: Brad Jones June 26, 2017
Comments