{"id":13140,"date":"2026-05-26T04:03:58","date_gmt":"2026-05-26T04:03:58","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/05\/26\/33012\/"},"modified":"2026-05-26T04:03:58","modified_gmt":"2026-05-26T04:03:58","slug":"33012","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/05\/26\/33012\/","title":{"rendered":"Microsoft Access VBA, (Mon, May 25th)"},"content":{"rendered":"

Microsoft Access VBA, (Mon, May 25th)
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Microsoft Access files (Microsoft Office’s Database) can contain VBA code.<\/p>\n

But they are not ole or OOXML files. You can’t analyze them with oledump.py<\/a>:<\/p>\n

\"\"<\/p>\n

Neither do they contain an embedded OLE file:<\/p>\n

\"\"<\/p>\n

Microsoft does not publish official documentation for the Microsoft Access file format, like it does for CFB (ole) and OOXML.<\/p>\n

That inspired me to add support for VBA compression to my search-for-compression.py<\/a> tool.<\/p>\n

search-for-compression.py is a tool that searches through binary files, looking for data that is ZLIB compressed. I’ve now added the option to search for compressed VBA code too. That is done with option -t:<\/p>\n

\"\"<\/p>\n

There are 3 entries. The first 2 decompress to binary data (01 00 04 …). These are similar to dir streams in ole files. dir\u00a0streams specify VBA project properties, project references, and module properties. They can be dumped:<\/p>\n

\"\"<\/p>\n

The 3th one starts with ASCII data (Attritut). This is VBA code that can be selected and dumped:<\/p>\n

\"\"<\/p>\n

This example is simple, because it’s just an empty database that I created for this diary entry.<\/p>\n

Real samples are a bit more complex. I’ll cover some examples in an upcoming diary entry.<\/p>\n

\u00a0<\/p>\n

Didier Stevens
\nSenior handler
\nblog.DidierStevens.com<\/a><\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n

\t

\n
<\/BR><\/p>\n

\t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft Access VBA, (Mon, May 25th) Microsoft Access files (Microsoft Office’s Database) can contain VBA code. But they are not ole or OOXML files. You can’t analyze them with oledump.py: Neither do they contain an embedded OLE file: Microsoft does not publish official documentation for the Microsoft Access file format, like it does for CFB […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-13140","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13140"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13140"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13140\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}