none
Office 2007 macros get corrupted after modification RRS feed

  • Question

  • Hello,

    I'm a developer of LinkFixerPlus software that keeps links in documents from being broken. In particular the software reads links embedded in Offie macro modules and modifies their paths. I succeeded to do that for Office 97-2003 documents. Office 2007 macros look to have similar structure so at first I was sure that I wouldn't have any problems with them. However when I tried to open the resulting files in Excel 2007, I found out that the macros get corrupted! Looks like Office 2007 inserts several bytes in the module stream every time the stream is updated. Could anybody tell me what these bytes are? Thanks in advance!
    Tuesday, October 6, 2009 6:45 PM

Answers

  • Elena,

    As you are aware, we are discussing offline while I investigate and test this.  Just keeping you up to date on the forum.


    Best regards, Tom Jebo Senior Support Escalation Engineer Microsoft Open Specification Documentation Support
    • Marked as answer by Elena Yudovina Wednesday, January 13, 2010 5:29 PM
    Wednesday, December 16, 2009 9:16 PM
  •  

    Elena, 

    I wanted to followup with you on the forum so that others can see the results.  Here is the list of steps for modifying VBA macro source in an Excel spreadsheet.  Compression and decompression referred to below is per algorithm in section 2.4.1 of MS-OVBA.

     

    1) read the "dir" stream, decompress it and extract dir.PROJECTMODULES.MODULE.MODULEOFFSET.TextOffset (section 2.3.4.2.3.2.5)

    2) read the Module1 stream at offset specified in TextOffset from step 1.

    3) decompress the macro source from step 2, make whatever modifications are desired, compress it and write it back to the Module1 stream at the same TextOffset.

    4) read the _VBA_PROJECT_CUR\VBA\_VBA_PROJECT stream

    5) modify the  _VBA_PROJECT.Version (section 2.3.4.1) field to be 0xFFFF

    6) write  the modified _VBA_PROJECT stream back to the file

     

     

    I've verified that these steps will work across versions of Excel. 

    Best regards,
    Tom Jebo
    Microsoft Open Specifications Documentation

    • Marked as answer by Tom Jebo MSFT Thursday, January 14, 2010 2:51 PM
    Thursday, January 14, 2010 2:45 PM

All replies

  • Hello Elena - thanks for your question - I believe this may be documented in [MS-OFFMACRO] and the [MS-OFFMACRO2] documents (these can be found at http://msdn.microsoft.com/en-us/library/cc307432.aspx). I have alerted my team members to your question, and one of them will be in contact with you soon.

    Regards,
    Bill Wesse

    Escalation Engineer
    Tuesday, October 6, 2009 8:12 PM
  • Elena,

    Could you send me the two versions in question? One before the bytes are inserted and one after the bytes are inserted and subsequently causing corruption. This will allow us to isolate why these bytes are being inserted. You can send these files to dochelp @ winse.microsoft.com ?

    Dominic Salemno
    Senior Support Escalation Engineer

    Thursday, October 15, 2009 7:43 PM
  • Elena,

    Could you send me the two versions in question? One before the bytes are inserted and one after the bytes are inserted and subsequently causing corruption. This will allow us to isolate why these bytes are being inserted. You can send these files to dochelp @ winse.microsoft.com ?

    Dominic Salemno
    Senior Support Escalation Engineer


    Hello Dominic,

    I've sent a e-mail to your account but haven't received any answer yet. Could you please send it to elenta80@hotmail.com?

    Regards,
    Elena Yudovina.

     

    Wednesday, October 21, 2009 3:33 PM
  • Elena,

    I have received your file and I am investigating your inquiry. I will update you as things progress.

    Dominic Salemno
    Senior Support Escalation Engineer
    Wednesday, October 21, 2009 4:17 PM
  • Hi Elena,

    I'm assisting Dominic with this issue.  I've looked at your Module1 and Module1_Original stream files and I see that one byte was added:

    Original module stream:

    0370h: 03 00 63 3A 5C 00 27 00 18 02 19 00 2F 44 6F 00 ..c:\.'...../Do.

    0380h: FF FF 60 00 00 00 FF FF FF FF 58 00 00 00 FF FF ÿÿ`...ÿÿÿÿX...ÿÿ

    Modified by Excel 2007:

    0370h: 04 00 63 3A 5C 31 00 27 00 18 02 19 00 2F 43 6F ..c:\1.'...../Co

    0380h: 00 FF FF 60 00 00 00 FF FF FF FF 58 00 00 00 FF .ÿÿ`...ÿÿÿÿX...ÿ

    Notice the 0x31 inserted at 0x375 offset.

    Can you verify that this is the inserted byte in question?

    I will dig into this and let you know what I find out about why this gets added. 


    Regards, Tom Jebo Senior Support Escalation Engineer Microsoft DS Protocol Team
    Thursday, October 29, 2009 7:16 PM
    Moderator
  • Hi Elena,

    I'm assisting Dominic with this issue.  I've looked at your Module1 and Module1_Original stream files and I see that one byte was added:

    Original module stream:

    0370h: 03 00 63 3A 5C 00 27 00 18 02 19 00 2F 44 6F 00 ..c:\.'...../Do.

    0380h: FF FF 60 00 00 00 FF FF FF FF 58 00 00 00 FF FF ÿÿ`...ÿÿÿÿX...ÿÿ

    Modified by Excel 2007:

    0370h: 04 00 63 3A 5C 31 00 27 00 18 02 19 00 2F 43 6F ..c:\1.'...../Co

    0380h: 00 FF FF 60 00 00 00 FF FF FF FF 58 00 00 00 FF .ÿÿ`...ÿÿÿÿX...ÿ

    Notice the 0x31 inserted at 0x375 offset.

    Can you verify that this is the inserted byte in question?

    I will dig into this and let you know what I find out about why this gets added.


    Regards, Tom Jebo Senior Support Escalation Engineer Microsoft DS Protocol Team

    Hello Tom,

    This is not quite so. This 0x31 byte I have inserted myself programmatically (not in Excel), modifying all the appropraite offsets and lengths above in the file. When I add this macro module to Office 97-2003 document, it is displayed fine. However when added to Office 2007 the macro becomes corrupted. Then I made another experiment - just tried to add this '1' symbol within the Excel's VB editor. The resulting module appears to have several new bytes. Actually I'd like to know why the file I've done seem corrupted to Excel 2007.

    Thank you in advance!
    Elena.


    Friday, October 30, 2009 2:50 PM
  • Hi Elena,

    Thanks for the explanation.  I will try that and let you know what I find. 

    Did the experiment you just tried, adding the '1' in Excel's VB editor also result in corruption in Excel 2007?


    Best regards, Tom Jebo Senior Support Escalation Engineer Microsoft Open Specification Documentation Support
    Monday, November 16, 2009 6:11 PM
  • Hi Elena,

    Thanks for the explanation.  I will try that and let you know what I find. 

    Did the experiment you just tried, adding the '1' in Excel's VB editor also result in corruption in Excel 2007?


    Best regards, Tom Jebo Senior Support Escalation Engineer Microsoft Open Specification Documentation Support

    Hi Tom,

    If I add '1' in the VB editor, then everything is OK. The macros get corrupted only if I do this programmatically.

    Regards,
    Elena. 
    Tuesday, November 17, 2009 3:05 PM
  • Elena,

    As you are aware, we are discussing offline while I investigate and test this.  Just keeping you up to date on the forum.


    Best regards, Tom Jebo Senior Support Escalation Engineer Microsoft Open Specification Documentation Support
    • Marked as answer by Elena Yudovina Wednesday, January 13, 2010 5:29 PM
    Wednesday, December 16, 2009 9:16 PM
  •  

    Elena, 

    I wanted to followup with you on the forum so that others can see the results.  Here is the list of steps for modifying VBA macro source in an Excel spreadsheet.  Compression and decompression referred to below is per algorithm in section 2.4.1 of MS-OVBA.

     

    1) read the "dir" stream, decompress it and extract dir.PROJECTMODULES.MODULE.MODULEOFFSET.TextOffset (section 2.3.4.2.3.2.5)

    2) read the Module1 stream at offset specified in TextOffset from step 1.

    3) decompress the macro source from step 2, make whatever modifications are desired, compress it and write it back to the Module1 stream at the same TextOffset.

    4) read the _VBA_PROJECT_CUR\VBA\_VBA_PROJECT stream

    5) modify the  _VBA_PROJECT.Version (section 2.3.4.1) field to be 0xFFFF

    6) write  the modified _VBA_PROJECT stream back to the file

     

     

    I've verified that these steps will work across versions of Excel. 

    Best regards,
    Tom Jebo
    Microsoft Open Specifications Documentation

    • Marked as answer by Tom Jebo MSFT Thursday, January 14, 2010 2:51 PM
    Thursday, January 14, 2010 2:45 PM