![]() In stead, a hash is stored: the SHA1 hash of the password (MBCS representation) + 4 byte salt. The password itself is not stored inside the PROJECT stream. However, we might still want to recover the password, just for the fun of it. Thus a VBA password is no hindrance for staticanalysis. You can remove password protection by replacing the values of ID, CMG, DPB and GC with the values of an unprotected VBA Project. The VBA password is stored as the DPB value of the PROJECT stream: Tools like oledump.py are not hindered by a VBA password, they can extract VBA code without problem, as it is not encrypted. The password is not used to encrypt the content of the VBA project, it is just used as protection by the VBA IDE: when the password is set, you will be prompted for the password. VBA projects can be protected with a password. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |