Manually Extract Word Macro

[comaboy]

Hi guys,

I've a dodgy word.doc file - on opening, word reports that it has macros, however, nothing shows in the VB Editor.

Not that I'm paraniod or anything (MUCH!) but I want to get to the bottom of this. I've searched the web and come up blank so far, so here's the question....

Anyone know how to extract Office Macros with a hexeditor or suchlike?

 

[dsi]

I have seen this happen before. Sometimes, if a document contained a macro and it was deleted, the file still indicates that a macro is present. I just open the document, disabling macros, copy the entire contents to a new document and save.

 

[comaboy]

dsi,

Sounds like a good idea. I've hex'd the file and come up with nothing searching for sub, function and end.

I found some info on the Word BIFF, and it makes a fleeting reference to an stwUser structure (where the Macro's ahould be stored).

My guess is that upon opening a document, Winword checks for the existance of this. Knowing MS ;-), the structure is created on first Macro creation, but not deleted if all the code is deleted, resulting in this 'phantom macro' condition.

If this IS the case, MS should really do something about it. Office docs are notoriously open to code abuse, and the possible existance of 'hidden' code rings alarm bells all over the place.

 

[Cassaro]

The following was copied from another post. I believe it may help with your problem.



My suggestion is to try to fool word into thinking that the macro is infact available.

open the Doc and Record a NEW macro.

make sure you use MACRO1 for the name. If it contains a higher number then change it to 1--if it says "Replace exiting macro" then there's your culprit and say YES.

record some key strokes and save it. (make sure there's some code in VBeditor) then File>Exit Word completely.

give it a few seconds to flush memory to disk then open the document again.

NOW...click Tools>Macros>Macros, highlight MACRO1 and click on DELETE button, confirm delete, close that Macros Windows.

open VBE, locate NewMacros and Remove from file, click NO on Exporting.

Close the Document by exiting Word and saving changes.

Again wait and open the doc and see if this has helped.




I hope this other persons post is able to help. Chuck
tek-tips@aspenpkg.com

If you feel a post has been helpful to you, click on the link at the bottom of this post to let me and others know the information was useful.

 

[AVChap]

One tool you can use to extract macros is HMVS. It's actually an AV program (command line version) which has the ability to remove macros in documents and spreadsheets. I use it to extract the code. Do a search and you should be able to find it.

AVChap