How to REALLY protect your code – making VBA project unviewable

You may think it’s easy – just open VB Editor (ALT + F11),  go to Tools > VBAProject Properties…, switch to Protection tab, check Lock project for viewing, set a password, hit OK and save your file. But is your code really safe now? No, it’s not. There are several methods or third-party software that can crack this protection in seconds. I have described two of them on my blog – here and here.

So is there a way to lock your VBA project for good? Yes, there is. For example Unviewable+ or Secure++ – both created by Petros Chatzipantazis from Spreadsheet1.com. How do they work? Usually when you try to expend protected VBA project you will be prompted for a password.

vba01

If you can see above window it means the file can be cracked. Using mentioned software you can make your project unviewable. Then, trying to expend VBA project, you should see below message.

vba02

This operation is irreversible so keeping the editable copy of your file is recommended! Now there is no way to crack VBA project and see what’s inside.

But software offered by Petros is quite expensive – you need to pay $100 for a single developer license. But you can have the same effect for free. How? Just follow the steps described below.

You will need two freeware programs:

  1. WinRAR
  2. Notepad++

Download and install both of them. Now make a copy of the Excel file you want to make unviewable (remember – once you do it there is no way back!) and change it’s extension to .zip. Right-click on the archive and go to Open with > WinRAR archiver – you should see below window.

vba03

Now double-click on xl folder and extract vbaProject.bin file. To do this you can either select the file and hit Extract To button or simply drag & drop the file onto your Desktop. Once you have it extracted, right-click on the file, go to Open with > Choose default program… – new window should appear. Hit Browse… – now navigate to the directory where Notepad++ is installed (“C:/Program Files (x86)/Notepad++/” in my case), choose notepad++.exe and hit Open.

vba03a

If you want to make Notepad++ a default program for all *.bin files check Always use the selected program to open this kind of file. Then hit OK.

vba04

vbaProject.bin file should now open in Notepad++. It will look somewhat like this.

vba05

Now scroll down until you find the section with CMG=, DPB= and GC=.

vba06

For Excel workbook files (tested on .xlsb) you can replace the CMG, DPB and GC strings between parenthesis with any even number of “F”s greater than or equal to the number of characters in the original strings and for Add-in files (tested on .xlam) you need to replace them with the exact same number of “F”s as the number of characters in the original strings.

vba07

Now Save the changes (CTRL + S), close Notepad++ and drag & drop the file back in the archive to replace the original with the updated one. When new window appears just hit OK.

vba08

You can be sure that the file was updated when it’s Modified date is changed.

vba09

Now you can close WinRAR and change the extension from .zip back to original Excel file extension (.xlsb, .xlam, etc.). Now when you open the file, go to VB Editor and try to expand the VBA project. Instead of password prompt you should see a message saying that the Project is unviewable.

vba02

You project is now uncrackable. No one (even you) can see or edit the VBA code.

Hope that helps!

36 thoughts on “How to REALLY protect your code – making VBA project unviewable

  1. The unviewable state in VBE can be achieved by a much easier method: by protecting the workbook with a sharing password. However, Unviewable+ locked files are defended by several protection layers behind the scenes. Please review the demo samples available at product page.

    Like

  2. I’ve tried this, it indeed makes the vba project unviewable, BUT unfortunately, you can easily open it by replacing the DPB by DPx and setting a new password. So sad.

    My 2 cents for VBA users, DO NOT follow this guide as it provide you a fault sense of security. If you are trying to protect your IP, don’t let the code leave your machine whilst there is no reliable vba protection solution available.

    Anyway, I highly appreciate the author for his/her good will in protecting IP.

    Like

    • Hi Peter, I’ve just tested it on .xlsb and .xlam file which I’ve saved as .xls file and then replaced DPB by DPx but the project is still unviewable. Could you please double check on your side if it truly does not work for you?

      Like

      • RatExcel
        I believe Peter is right. I do not want to describe in public the exact steps of doing so out of respect for people who use the trick. A lot of people may have not heard of the DPx trick yet. The Unviewable+ application deploys several tricks against this popular hack. Just because you see the ‘Project is Unviewable’ prompt in VBE, it does not mean that all protection methods are created equal.

        “Like others have alluded to, you are never going to find a product that is 100% hack-proof (I think everyone in the world is still looking for that kind of security for a digital product). But in the world of Excel/VBA, the Unviewable+ application is going to confuse a lot of the people who start getting curious out what’s behind the scenes… ”

        “If Unviewable+ keeps the 99% of amateurs out of the code, I can live with the others, as they know tons more than I do to begin with, and if they wanted to – they would write what I write – better – more efficient – and significantly cleaner to boot!!”

        Like

  3. it’s a awesome way for make a very secure code in vba , i tested it and it’s a working properly. i was searching this way from a long time now i got it and it’s so valuable way to protect vba code as a Unviewable. Thanks a lot !!

    Like

  4. After testing this method, I was unable to view the project with the DPx method. I, too, am interested in the steps Peter took in order to use the DPx method successfully.

    I appreciate the post! Look forward to more!

    Like

  5. Hello. I confirm i have also been able to unprotect the XSLB file that have been protected with the method described in this page… it required a little bit modified DPx method (it was really easy anyway). So using this method will not secure your VBA code. Regards

    Like

  6. A mi si me sirvió , me funciono con una extensión .xlsm me dejo el código protegido incluso ante el método DPx. Muchas gracias por compartir este método. Sin embargo me a causado intriga los comentarios de algunos compañeros que dijeron que si pudieron romper el código con el método DPx y me gustaría saber como lo hicieron por que como dije yo no pude romper el código con ese método DPx. Gracias.

    Like

  7. Well, after I ran into some issues with another workbook, I did stumble across the only method I’ve been able to use to successfully gain access to VBA code within a workbook protected using this and other methods.

    This method of getting code isn’t particularly pretty, but it’s also not particularly difficult. The DPx trick did not produce any fruit, but I was able to successfully save a file in the old .xls format (sometimes needing to use the immediate window to disable events and set the workbook password to a zero length string), and use a tool such as oledump.py to extract the VBA code from there.

    Like I said, not a particularly clean-cut method, but it helped me save some information from one of my own workbooks which got corrupted (all my fault because I mistook it for another workbook of mine which I meant to modify).

    Like

  8. The ultimate way to protect an excel worksheet is to first, save your project as a .xlsb file, then apply the method explained by RATEXCEL. You can change the file extension to .xlsm again if you want,

    Doing this makes the DPx method no longer functional, which does work if the original file extension when applying RATEXCEL’s was .xlsm.

    Hope this helps, now you can protect your vba code much much better without having to spend 100+$ on some application.

    Like

    • I was able to apply the DPx method and see the VBA code,saving the project as .xlsb then applying the RATEXCEL’S and then opening the file again and saving it as .xls.
      If you are able to save the file as .xls you are always able to apply the DPx method

      Like

  9. RatExcel,

    I’ve implemented a similar version of your method here: http://hidemyvba.com

    It might be interesting for people to test out. I know that often people avoid using server-side scripts, which is understandable. However, it can be used to test out the security of your method easily.

    Liked by 2 people

  10. Hi all, I tried to use Lance script and for me it worked, I think! Project unviewable for Excel 2016 xlsm file. After, saved it to XLS and tried to do the DPX trick. File corrupted, nothing inside the file or the VBA Project. Do you guys had the same results? Lance, your file gives me unexpected error 40230 while opening. despite working. Also, can´t we always force user to save the file as xlsm or xlsb? Would it help?

    Like

    • Had the same results. Once you saved as xls the Modules containing the code are gone. Also had the error 40230 while plaing around with the modified xlsm file. Good way to protect your work from 99% of the users out there. Thumbs up from me.

      Like

  11. it’s very easy to crack the vba if we modify the GC=/CMG=/DPB= to GC./CMG./DPB. whatever how you changed the code after them.
    So sad. I really want to find some way to protect my code.

    Like

  12. Tried this method with Visio (*.vsdm) Files and it works Great!. You have to exactly match the string sizes. (you need to replace them with the exact same number of “F”s as the number of characters in the original strings.) After converting the file to unviewable I then tried the DPx method to again view VBA, which failed. My first attempt failed, then I went back and manually counted the characters and numbers and carefully matched with F’s.

    Like

  13. Please note that UnviewablePlus is now easily hackable in 2 minutes using a publically available tool called “EvilClippy”. See https://medium.com/walmartlabs/vba-project-locked-project-is-unviewable-4d6a0b2e7cac You can the fully recover all VBA scripts using the also publically available tool olevba.
    I notified Petros of this but he refused to announce this on his website. People should know that this product is not secure at all, contrary to what the spreadheet1.com site says.

    Like

    • “EvilClippy” didn’t work for me once a file had been protected with UnviewablePlus “Ultimate” protection setting. Still Unviewable after latest version of EvilClippy with switch -uu. Tried a few files, complex and extremely simple. Will check out “olevba”.

      Like

      • Hello,
        I just wanted to have your fedd back please
        Have you tried olevba ? will it worth to buy unviewable +

        Like

  14. Neil Benson your statement is not entirely true. I used “EvilClippy” tool on my VBA file that was protected with Unviewable plus and was not successful. However I have to tried with olevba.

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s