通过十六进制编辑器的 Excel VBA 密码

Excel VBA Password via Hex Editor

提问by BlueSkies 2020

I have used the "Hex Editor to modify DPB to DPx" many times in the past to bypass VBA project security on my old Excel VBA projects (.xls), so I definitely know how to do it and know that I can do it.

我过去曾多次使用“十六进制编辑器将 DPB 修改为 DPx”来绕过我旧 Excel VBA 项目 (.xls) 上的 VBA 项目安全性，所以我绝对知道该怎么做并且知道我可以做到。

However I have just tried to do it yesterday and found that it no longer seems to work. I tried using both Excel 2011 (Mac) and Excel 2003 (Windows) and in both cases, I got the same behaviour;

但是我昨天刚刚尝试这样做，发现它似乎不再起作用。我尝试同时使用 Excel 2011 (Mac) 和 Excel 2003 (Windows)，在这两种情况下，我都得到了相同的行为；

Opening the VBA editor gave a message saying that the project is corrupted and that the project will be removed. The VBA editor then opens and, sure enough, all VBA is stripped out from modules and worksheets.

打开 VBA 编辑器提示项目已损坏，项目将被删除。然后 VBA 编辑器打开，果然，所有 VBA 都从模块和工作表中剥离出来。

I have tried this method: Is there a way to crack the password on an Excel VBA Project?(ie. creating a spreadsheet with a known password and then copying across the relevant fields)

我试过这种方法： 有没有办法破解 Excel VBA 项目的密码？（即，使用已知密码创建电子表格，然后在相关字段之间复制）

But find that the length of the "GC" key created on my 'dummy' spreadsheet is shorter than the "GC" key on the spreadsheet that I am wishing to access (the "target"). I had read elsewhere that in cases where the "target" keys were longer, you could pad the "dummy" keys to the same length but there is nothing i can find to say what to do in the reverse case.

但是发现在我的“虚拟”电子表格上创建的“GC”键的长度比我希望访问的电子表格上的“GC”键（“目标”）短。我在其他地方读到过，在“目标”键较长的情况下，您可以将“虚拟”键填充到相同的长度，但在相反的情况下我找不到什么可说的。

So - my questions (s);

所以 - 我的问题（s）；

• Is anyone aware if a patch has been applied that makes the "hex editor" approach invalid?
• Can anyone help with what to do when the dummy keys are longer than the target keys?
• Can anyone else provide any updated onsite into this issue?

• 有没有人知道是否应用了使“十六进制编辑器”方法无效的补丁？
• 当虚拟键比目标键长时，任何人都可以帮助解决问题吗？
• 其他任何人都可以在现场提供有关此问题的任何更新吗？

EDITHaving now solved this (to some degree) i thought i'd add a summary here.

编辑现在解决了这个问题（在某种程度上）我想我会在这里添加一个摘要。

I HAVE NOTbeen able to get this to work on Mac Excel 2011. Something about changing the file from filname.xlsm to fielname.zip and back again results in a corrupted excel file which Excel 2011 refuses to recognise.

我HAVE NOT之所以能得到这个工作在Mac的Excel 2011年趣谈改变从filname.xlsm到fielname.zip文件，然后再返回结果，其中的Excel 2011拒绝承认损坏的Excel文件。

I DID manage to get this to work on an old windows machine (XP/Excel 2007) by modifying the .xlsm file name to .zip, editing the DPB= AND GC= values in the vbaproject.bin file with a hex editor then saving this in the .zip file before renaming the .zip back to xlsm. I used the "test" example given by Ricko at the bottom and it worked with ONE CAVEAT - i had to 'pad' out my GC value to make it that same length as the original one in my file.

通过将 .xlsm 文件名修改为 .zip，使用十六进制编辑器编辑 vbaproject.bin 文件中的 DPB= AND GC= 值，然后保存在将 .zip 重命名回 xlsm 之前，将其放在 .zip 文件中。我在底部使用了 Ricko 给出的“测试”示例，它与 ONE CAVEAT 一起使用 - 我必须“填充”我的 GC 值，使其与文件中的原始值具有相同的长度。

ORIGINAL:       GC="0F0DA36FAF938494849484"
NEW:  (TEST)    GC="BAB816BBF4BCF4BCF4"  (from Ricko below)
NEW:  (TEST)    GC="BAB816BBF4BCF4BCF40000"  (what i used and what worked)

回答by Morosho

I have your answer, as I just had the same problem today:

我有你的答案，因为我今天刚遇到同样的问题：

Someone made a working vba code that changes the vba protection password to "macro", for all excel files, including .xlsm (2007+ versions). You can see how it works by browsing his code.

有人制作了一个有效的 vba 代码，将 vba 保护密码更改为“宏”，适用于所有 excel 文件，包括 .xlsm（2007+ 版本）。你可以通过浏览他的代码来了解它是如何工作的。

This is the guy's blog: http://lbeliarl.blogspot.com/2014/03/excel-removing-password-from-vba.htmlHere's the file that does the work: https://docs.google.com/file/d/0B6sFi5sSqEKbLUIwUTVhY3lWZE0/edit

这是这家伙的博客：http: //lbeliarl.blogspot.com/2014/03/excel-removing-password-from-vba.html这是完成工作的文件：https: //docs.google.com/file /d/0B6sFi5sSqEKbLUIwUTVhY3lWZE0/编辑

Pasted from a previous post from his blog:

粘贴自他博客的前一篇文章：

For Excel 2007/2010 (.xlsm) files do following steps:

对于 Excel 2007/2010 (.xlsm) 文件，请执行以下步骤：

1. Create a new .xlsm file.
2. In the VBA part, set a simple password (for instance 'macro').
3. Save the file and exit.
4. Change file extention to '.zip', open it by any archiver program.
5. Find the file: 'vbaProject.bin' (in 'xl' folder).
6. Extract it from archive.
7. Open the file you just extracted with a hex editor.

8. Find and copy the value from parameter DPB (value in quotation mark), example: DPB="282A84CBA1CBA1345FCCB154E20721DE77F7D2378D0EAC90427A22021A46E9CE6F17188A". (This value generated for 'macro' password. You can use this DPB value to skip steps 1-8)

9. Do steps 4-7 for file with unknown password (file you want to unlock).

10. Change DBP value in this file on value that you have copied in step 8.

    If copied value is shorter than in encrypted file you should populate missing characters with 0 (zero). If value is longer - that is not a problem (paste it as is).

11. Save the 'vbaProject.bin' file and exit from hex editor.

12. Replace existing 'vbaProject.bin' file with modified one.
13. Change extention from '.zip' back to '.xlsm'
14. Now, open the excel file you need to see the VBA code in. The password for the VBA code will simply be macro (as in the example I'm showing here).

1. 创建一个新的 .xlsm 文件。
2. 在 VBA 部分，设置一个简单的密码（例如“宏”）。
3. 保存文件并退出。
4. 将文件扩展名更改为“.zip”，通过任何存档程序打开它。
5. 找到文件：“vbaProject.bin”（在“xl”文件夹中）。
6. 从存档中提取它。
7. 使用十六进制编辑器打开刚刚解压缩的文件。

8. 查找并复制参数 DPB 中的值（引号中的值），例如：DPB="282A84CBA1CBA1345FCCB154E20721DE77F7D2378D0EAC90427A22021A46E9CE6F17188A"。（此值是为“宏”密码生成的。您可以使用此 DPB 值跳过步骤 1-8）

9. 对未知密码的文件（要解锁的文件）执行步骤 4-7。

10. 根据您在步骤 8 中复制的值更改此文件中的 DBP 值。

    如果复制的值比加密文件中的短，您应该用 0（零）填充缺失的字符。如果值更长 - 那不是问题（按原样粘贴）。

11. 保存“vbaProject.bin”文件并退出十六进制编辑器。

12. 用修改过的文件替换现有的“vbaProject.bin”文件。
13. 将扩展名从“.zip”改回“.xlsm”
14. 现在，打开您需要查看 VBA 代码的 excel 文件。 VBA 代码的密码将只是宏（如我在此处展示的示例）。

回答by Ricko

New version, now you also have the GC= try to replace both DPB and GC with those

新版本，现在你也有 GC= 尝试用那些替换 DPB 和 GC

DPB="DBD9775A4B774B77B4894C77DFE8FE6D2CCEB951E8045C2AB7CA507D8F3AC7E3A7F59012A2" GC="BAB816BBF4BCF4BCF4"

DPB="DBD9775A4B774B77B4894C77DFE8FE6D2CCEB951E8045C2AB7CA507D8F3AC7E3A7F59012A2" GC="BAB816BBF4BCF4BCF4"

password will be "test"

密码将是“test”

回答by John

1. Open xls file with a hex editor.
2. Search for DPB
3. Replace DPBto DPx
4. Save file.
5. Open file in Excel.
6. Click "Yes" if you get any message box.
7. Set new password from VBA Project Properties.
8. Close and open again file, then type your new password to unprotect.

1. 使用十六进制编辑器打开 xls 文件。
2. 搜索 DPB
3. 替换DPB为DPx
4. 保存存档。
5. 在 Excel 中打开文件。
6. 如果您收到任何消息框，请单击“是”。
7. 从 VBA 项目属性设置新密码。
8. 关闭并再次打开文件，然后输入您的新密码以取消保护。

Check http://blog.getspool.com/396/best-vba-password-recovery-cracker-tool-remove/

检查http://blog.getspool.com/396/best-vba-password-recovery-cracker-tool-remove/

回答by Qbik

If you deal with .xlsmfile instead of .xlsyou can use the old method. I was trying to modify vbaProject.binin .xlsmseveral times using DBP->DBxmethod by it didn't work, also changing value of DBPdidn't. So I was very suprised that following worked :
1. Save .xlsmas .xls.
2. Use DBP->DBxmethod on .xls.
3. Unfortunately some erros may occur when using modified .xlsfile, I had to save .xlsas .xlsxand add modules, then save as .xlsm.

如果您处理.xlsm文件而不是.xls您可以使用旧方法。我试图修改vbaProject.bin在.xlsm多次使用DBP->DBx方法，通过它没有工作，也正在改变的价值DBP都没有。所以我很惊讶下面的工作：
1.另存.xlsm为.xls。
2. 使用DBP->DBx方法.xls。
3.不幸的是，使用修改后的.xls文件时可能会出现一些错误，我不得不另存.xls为.xlsx并添加模块，然后另存为.xlsm。