Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg).
In a nutshell: the VBA code is stored inside an OLE file, that is embedded inside the DWG file. You can do a brute-force search for the embedded OLE file, or you can follow a pointer inside the header of the DWG file.
I wrote a small Python script (autocad.py) for this second case. It looks at a 32-bit pointer at position 0x24 inside the DWG file. This points to a 16-byte long header, followed by the embedded file. This 16-byte long header contains the length of the embedded file. You use the script together with my tool cut-bytes.py, like this:
cut-bytes.py -S autocad.py -P AutoCAD : 461ed52aeb75384133a8238b2eb481ae5d505d4961effa622673d65a889c8218.vir.zip | oledump.py
This command carves the DWG file (inside the ZIP file) and extracts the embedded OLE file, and pipes it into oledump.py for analysis.
When the pointer is zero, there is no embedded OLE file, and cut-bytes.py returns nothing.
Recently, I discovered 2 DWG files that are an exception: their pointer to the embedded OLE file is zero, but if you do a brute-force search, you will find an embedded OLE file with a VBA project.
For example this DWG file.
Its pointer to the embedded VBA project is zero:
But it contains an embedded OLE file:
And right in front of the embedded OLE file, there is the 16-byte long header that contains the lenght of the embedded file.
Using the AutoCAD script to extract the file gives nothing:
But oledump.py can find the embedded OLE file and analyze it:
So while using oledump.py to analyze DWG files you find a VBA project embedded inside a DWG file, then also verify if it is not orphaned: verify that the pointer at 0x24 is not zero (or use the autocad.py script).
Because when a DWG file contains an orphaned VBA project, the VBA code can not have executed when someone opened the DWG file with AutoCAD. AutoCAD “does not see” orphaned VBA projects.
Notice that a default installation of AutoCAD does not support VBA. VBA for AutoCAD is a separate install.
I don’t know how orphaning happens, but I did find an AutoLISP command to remove a VBA project from a DWG file:
(dictremove (namedobjdict) “ACAD_VBA”)
Maybe this dictremove command clears the pointer, but does not remove the embedded OLE file.
Didier Stevens
Senior handler
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.