Excel-Press is a Python implementation of Microsoft Office’s proprietary VBA compression and decompression algorithm.
Excel files with an ‘.xls’ file extension (Excel 97-2003) are essentially zip files. There are already tools widely available to unzip and decompress the contents of these VBA macros, however; I was unable to find a Python implementation of Microsoft’s VBA compression algorithm.
- excel-press.py: Python script to compress or decompress a VBA macro file
- macro_raw: VBA macro in compressed format
- macro_readable: VBA macro after decompression
- test.xls: Excel document containing VBA macro
- test: Contents of test.xls after the .xls extension is changed to .zip and unzipped
- Module1: Full VBA macro file after unzipping test.xls
Decompress an already compressed VBA macro file
python excel-press.py -d ./examples/Module1
Output just the VBA macro portion of the compressed VBA file
python excel-press.py -d ./examples/Module1 --raw
Compress the specified VBA macro
python excel-press.py -c ./examples/macro_readable
The decompress function of excel-press.py is largely adapted from Didier Stevens’ oledump.py script.
Information about Microsoft Office’s proprietary VBA compression and decompress scheme was found in the following MSDN documentation MS-OVBA.pdf.