VBA Project References, (Tue, May 2nd)

This post was originally published on this site

I was asked where one can find VBA project references inside an ole file with VBA code.

Document [MS-OVBA] gives all the details: project references are found inside the dir stream (together with project and modules information), and a "compiled" version of that information (PerformanceCache) can be found inside the _VBA_PROJECT stream.

The content of the dir stream is compressed, and can be viewed like this:

The content of the _VBA_PROJECT stream is not compressed:

I developed a plugin to parse the records of the dir stream (as documented in [MS-OVBA]): plugin_vba_dir.

Since the PerformanceCache data is not documented (and optional), I don't know how to parse it. But you can extract strings from it and infer references.

Didier Stevens
Senior handler
Microsoft MVP

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.