Excel-Press

Summary

Excel-Press is a Python implementation of Microsoft Office's proprietary VBA compression and decompression algorithm.

Excel files with an '.xls' file extension (Excel 97-2003) are essentially zip files. There are already tools widely available to unzip and decompress the contents of these VBA macros, however; I was unable to find a Python implementation of Microsoft's VBA compression algorithm.

Files

• excel-press.py: Python script to compress or decompress a VBA macro file
• macro_raw: VBA macro in compressed format
• macro_readable: VBA macro after decompression
• test.xls: Excel document containing VBA macro
• test: Contents of test.xls after the .xls extension is changed to .zip and unzipped
• Module1: Full VBA macro file after unzipping test.xls

Examples

Decompress an already compressed VBA macro file

python excel-press.py -d ./examples/Module1

Output just the VBA macro portion of the compressed VBA file

python excel-press.py -d ./examples/Module1 --raw

Compress the specified VBA macro

python excel-press.py -c ./examples/macro_readable

Credits

The decompress function of excel-press.py is largely adapted from Didier Stevens' oledump.py script.

Information about Microsoft Office's proprietary VBA compression and decompress scheme was found in the following MSDN documentation MS-OVBA.pdf.