Unzip the VBA stream

Source: Internet
Author: User

In VBA Engineering, VBA code is stored in a composite document in a compressed form.

The extracted code is as follows:

 Public FunctionDecompression (Arrbyte () as Byte) as Byte()    'unzip the VBA stream    'Algorithm Description: https://msdn.microsoft.com/en-us/library/cc313094 (v=office.12). aspx    DimCompressedcontainer () as Byte    DimSignaturebyte as Byte    DimCompressedheader as Integer    DimCompressedchunksize as Integer    DimCompressedchunksignature as Integer    DimCompressedchunkflag as Integer    DimCompressedchunkdata () as Byte    DimDecompressedchunk () as Byte    DimCompressedcurrent as Integer    DimDecompressedbuffer () as Byte    DimDecompressedstart as Long    DimDecompressedchunksize as Integer        If LBound(Arrbyte) <>0  Then Exit FunctionCompressedcontainer=Arrbyte Signaturebyte= Compressedcontainer (0)    IfSignaturebyte <>1  Then Exit Functioncompressedcurrent=1Decompressedstart=0     Do  whileCompressedcurrent <UBound(Compressedcontainer) CopyMemory Compressedheader, Compressedcontainer (compressedcurrent),2compressedchunksize=extractcompressedchunksize (compressedheader) compressedchunksignature=extractcompressedchunksignature (compressedheader) Compressedchunkflag=Extractcompressedchunkflag (Compressedheader)IfCompressedchunksignature <>3  Then Exit Function                IfCompressedchunkflag =0  Then            PagerDecompressingrawchunkElse            ReDimCompressedchunkdata (0  toCompressedchunksize-1) CopyMemory Compressedchunkdata (0), Compressedcontainer (Compressedcurrent +2), CompressedchunksizePagerdecompressingtokensequence (Compressedchunkdata, decompressedchunk) compressedcurrent= Compressedcurrent +2+compressedchunksizeEnd Ifdecompressedchunksize=UBound(Decompressedchunk) +1        ReDim PreserveDecompressedbuffer (0  toDecompressedstart + decompressedchunksize-1) CopyMemory Decompressedbuffer (Decompressedstart), Decompressedchunk (0), DecompressedchunksizeLoopDecompression=DecompressedbufferEnd FunctionPrivate SubDecompressingtokensequence (Compresseddata () as Byte, Decompressedchunk () as Byte)    DimI as Integer    DimFlagbyte as Byte    DimFlagbit as Byte    DimIndex as Integer    DimDecompressedcurrent as Integer    DimCompressedcurrent as Integer    DimCompressedend as Integer    DimCopytoken as Long    DimOffset as Integer    DimLength as Integer        ReDimDecompressedchunk (0  to 4098) Compressedend=UBound(compresseddata) decompressedcurrent=0compressedcurrent=0Index=0         Do        IfIndex =0  ThenFlagbyte=compresseddata (compressedcurrent) compressedcurrent= Compressedcurrent +1            IfCompressedcurrent > Compressedend Then Exit  Do        End IfFlagbit=extractflagbit (Index, Flagbyte)IfFlagbit =0  ThenDecompressedchunk (decompressedcurrent)=compresseddata (compressedcurrent) decompressedcurrent= Decompressedcurrent +1compressedcurrent= Compressedcurrent +1        Elsecopymemory Copytoken, Compresseddata (compressedcurrent),2            PagerUnpackcopytoken (Copytoken, Decompressedcurrent, Offset, Length) fori =1  toLength decompressedchunk (decompressedcurrent)= Decompressedchunk (Decompressedcurrent-Offset) Decompressedcurrent= Decompressedcurrent +1            Nextcompressedcurrent= Compressedcurrent +2        End IfIndex= Index +1        IfIndex >7  ThenIndex =0    Loop UntilCompressedcurrent >CompressedendReDim PreserveDecompressedchunk (0  toDecompressedcurrent-1)End SubPrivate FunctionExtractflagbit (Index as Integer, Flagbyte as Byte) as ByteExtractflagbit= (flagbyte and(2^ Index))/2^IndexEnd FunctionPrivate SubDecompressingrawchunk ()'I have not encountered this situation, waiting to be encountered in the future commissioning    StopEnd SubPrivate FunctionExtractcompressedchunksize (Header as Integer) as Integerextractcompressedchunksize= (Header and&AMP;HFFF) +1End FunctionPrivate FunctionExtractcompressedchunksignature (Header as Integer) as Integer    DimTemp as IntegerTemp= Header and&H7000 extractcompressedchunksignature= Temp/&H1000End FunctionPrivate FunctionExtractcompressedchunkflag (Header as Integer) as Integer    DimTemp as IntegerTemp= Header and&H8000 Extractcompressedchunkflag= Temp/&H8000End FunctionPrivate SubUnpackcopytoken (Copytoken as Long, decompressedcurrent as Integer, Out_offset as Integer, Out_length as Integer)    DimBitcount as IntegerBitcount= -Int(-Log(decompressedcurrent)/Log(2))    IfBitcount <4  ThenBitcount =4Bitcount= --Bitcount out_length= Copytoken and(2^ Bitcount-1) Out_offset= (copytoken-out_length)/2^Bitcount out_length= Out_length +3Out_offset= Out_offset +1End Sub

Unzip the VBA stream

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.