I was asked where one can find VBA project references inside an ole file with VBA code.
Document [MS-OVBA] gives all the details: project references are found inside the dir stream (together with project and modules information), and a “compiled” version of that information (PerformanceCache) can be found inside the _VBA_PROJECT stream.
The content of the dir stream is compressed, and can be viewed like this:
The content of the _VBA_PROJECT stream is not compressed:
I developed a plugin to parse the records of the dir stream (as documented in [MS-OVBA]): plugin_vba_dir.
Since the PerformanceCache data is not documented (and optional), I don’t know how to parse it. But you can extract strings from it and infer references.
Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
