Last Updated: 2023-05-02 06:38:09 UTC
by Didier Stevens (Version: 1)
I was asked where one can find VBA project references inside an ole file with VBA code.
Document [MS-OVBA] gives all the details: project references are found inside the dir stream (together with project and modules information), and a "compiled" version of that information (PerformanceCache) can be found inside the _VBA_PROJECT stream.
The content of the dir stream is compressed, and can be viewed like this:
The content of the _VBA_PROJECT stream is not compressed:
I developed a plugin to parse the records of the dir stream (as documented in [MS-OVBA]): plugin_vba_dir.
Since the PerformanceCache data is not documented (and optional), I don't know how to parse it. But you can extract strings from it and infer references.