MACROLENS: Read the Macros Without Opening the File
Somebody sent you a spreadsheet that wants you to enable content. The only honest way to decide is to read what the macro says, and the only safe place to read it is somewhere that cannot run it. This unzips the file, walks the OLE compound file inside, decompresses each module and prints the source, with a note against every line that deserves one. It is a reader. There is no interpreter here.
1. The file
A .docm, .xlsm, .pptm, .doc, .xls, .ppt, or a vbaProject.bin on its own. Drop a .docx, .xlsx or .pptx too: those are the forms that are meant to have no macros, and it is worth knowing when one does.
2. What is in it
Everything below was read out of the file. None of it was run.
What this is, and what it is not
It is a reader, and that is the whole point. The file is opened as bytes. The zip is expanded, the compound file inside it is walked, the streams are decompressed and the text is drawn on the page. There is no eval, no interpreter and nothing that hands a string to the browser to run. A macro cannot do anything here because there is nothing here that would carry out an instruction.
How it gets from the file to the source. A .docm or .xlsm is a zip with a vbaProject.bin in it, and that file is an OLE compound file: a small filesystem with a sector table, a second allocation for streams under 4 KB, and a tree of directory entries. Inside it, a storage called VBA holds one stream per module and a stream called dir. dir is compressed with the run-length scheme in MS-OVBA section 2.4.1 and lists every module, its stream name, and the offset in that stream where the compiled code stops and the compressed source starts. All of that is implemented here rather than handed to a library.
A clean report is evidence of nothing beyond what was looked at. The flag list below is a list of named patterns. When none of them appears, what that tells you is that those patterns are not in the source that was recovered, in the form the list expects. It does not tell you the file is safe. A macro can be dangerous in words nobody has thought to put on a list, and a file can be dangerous without any macro at all. Read the source.
Stomped code is reported as a ratio, not as a verdict. Each module stream holds compiled p-code first and the compressed source after it. Office runs the p-code. Replace the source with something dull and the file reads clean while the compiled half does the work. Two things are measured: the size of the compiled half against the size of the source it claims to have come from, and whether the readable strings inside the compiled half appear in the source. Both are circumstantial. Proving it needs the p-code disassembled, which this does not do, and it is said plainly in the module rather than dressed up as a finding.
What it will not open. An encrypted document, which Office writes as a compound file with the content locked, cannot be read without the password and is reported as encrypted rather than as clean. A PowerPoint 97-2003 file keeps its VBA inside the PowerPoint Document stream rather than in a storage, so it is not found; save that file as .pptm and drop the result. A file damaged in the middle of a stream gives what was recovered up to the damage and says where it stopped.
Nothing is uploaded, and nothing is kept. The file is read into this tab's memory, and the report is built there. Closing the tab ends it. The only thing written to this device is the tick box above, which remembers whether you like long lines wrapped.
Questions people ask
Does opening a file here run its macro?
No. Running a macro needs a VBA interpreter, and there is not one in a browser. The bytes are parsed as data, the text is decompressed and printed, and that is the end of it. The page contains no eval, no Function constructor and no code path that turns anything read out of the file into something the browser executes.
My .docx has a vbaProject.bin in it. Is that bad?
It is worth knowing about. The x forms of the Office formats are defined as the ones without macros, and Word will not run VBA from a .docx. But the project travels inside the file, so renaming it to .docm, or saving it from Word as macro-enabled, brings the code back to life. It is also a sign the file was made by something other than Word.
What does the compiled-against-source line mean?
Every module keeps two copies of itself: compiled p-code, which is what Office actually runs, and compressed source, which is what the editor shows you. They are supposed to agree. When the compiled half is much larger than the source, or holds strings the source does not, somebody may have edited one without the other. It is a reason to be careful, not a conclusion.
Why does it show line numbers against the flags?
So you can go and read the line. A flag on its own is an accusation; a flag with the line it came from and a sentence about why it was flagged is something you can check and disagree with. Every module is shown in full, with the flagged lines marked, for exactly that reason.
Can I get the source out?
Yes. One text file with every module and the flag list, or a zip with one file per module named .bas, .cls or .frm as the project has them. Both are written in this tab from what is already on screen.