0

I'm currently coding a program that will remove macro passwords from Word files, Excel files etc. This is made for word documents with no normal standard password, but a password set on the macros from the Tools > Project Options > Protections menu in Office.

I'm using method 3 on the below link to remove the password. However rather than editing it manually like method 3, I'm changing it via the Hex in method 2 but programmatically with VB. I have tested this method with a Hex editor and notepad ++ successfully. However notepad will not work.

Method of removing macro passwords

My Idea

  1. Change name of .docm to .zip
  2. Extract the contents of the Zip
  3. Open the Vbaproject.bin
  4. Change values from DPB to DPx
  5. Zip it back up
  6. Change format back .docm

I'm having issues with 4 as it changes the characters correctly in the output file, however it strips out other necessary content(special characters).

My vb.net code:

 Public Class Form1

    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click

        Try
            Dim filecontents = IO.File.ReadAllText("C:\Temp\Decrypter\Analysis\vbaProject.bin")
            filecontents = filecontents.Replace(Convert.ToChar(&H44) & (Convert.ToChar(&H50) & (Convert.ToChar(&H42))), (Convert.ToChar(&H44) & Convert.ToChar(&H50) & (Convert.ToChar(&H78))))
            IO.File.WriteAllText("C:\Temp\Decrypter\Analysis\vbaProject2.bin", filecontents)
        Catch
            MsgBox("Error")

        End Try

    End Sub
End Class

This code looks for DPB in the vbaproject.bin file (44, 50, 42), then changes it to DPx (44, 50, 78). When opening the output document I can see the changes happened successfully, however when writing the .bin file back in to the .zip and repackaging in to the .docm this did not work. It works manually when I change these hex values via a hex editor.

I believe that the way it reads and writes the output file takes out all the special .bin characters. Similar to how following the above process with notepad on Windows does not work (perhaps certain textboxes can't read / see certain chars / values in different formats). However doing the same with notepad++ does work.

How can I change my above code so it doesn't strip out any special characters / other formats in the .bin file when I make the changes from DPB to DPx?

Any ideas are greatly appreciated!

Samuel Everson
  • 2,097
  • 2
  • 9
  • 24
user3290171
  • 121
  • 1
  • 3
  • 19
  • 2
    That's a binary file, you cannot treat it as a text file. You need to open a Stream, find the sequence of bytes you're looking for and set new **byte** values. See an example of something similar [here](https://stackoverflow.com/a/61165946/7444103). Since the sequence may not be in a specific position, you have to go on a hunt (trying not to hit the wrong target). – Jimi Apr 27 '20 at 02:50
  • 1
    If the sequence is instead in a fixed position, the just jump there (with `[FileStream].Seek(Position, SeekOrigin.Begin)`). – Jimi Apr 27 '20 at 02:57

0 Answers0