search

decalage2 / oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
http://www.decalage.info/python/oletools
Other
2.93k stars 563 forks source link

olevba - is it possible to get the frx files associated with forms #87

Open ntextreme3 opened 8 years ago

ntextreme3 commented 8 years ago

when exporting a form in excel you get a .frm and .frx for each form. the frx is needed to recreate the form. is there a way to get the .frx from VBA_Parser ?

decalage2 commented 8 years ago

The simple answer is no.

However, if forms are stored in MS Office files with the same structure as frm/frx files, it might be possible to extract them. This is specified in MS-OFORMS. Especially section 2.1.2 Control Streams.

I haven't found any specifications of the frm/frx formats, only partial information such as these: FRM: https://msdn.microsoft.com/en-us/library/aa241723(v=vs.60).aspx FRX: https://forum.powerbasic.com/forum/user-to-user-discussions/source-code/59945-extract-files-from-visual-basic-vb5-vb6-frx-form-resource-files

spences10 commented 7 years ago

I'm guessing you have found another solution to this, however if you need to export all forms from an excel project then there is VBA-IDE-Code-Export that is used from the VBA IDE [as the name suggests] there is a command line tool in the pipeline as well