PDA

View Full Version : Code Security (COM Add-In? .xll? What to do?)



Sock
08-13-2013, 10:59 AM
Hello again VBA Expressers,

I suppose it's common knowledge a passworded .xla(m) isn't truly secure (?).

It looks like a COM add-in or .xll file is the way to go to try to better-securing your code, right?

I've looked at this link (courtesy of good ol' Chip Pearson) http://www.cpearson.com/excel/creatingcomaddin.aspx however it references VB 6 which I don't have. I'm guessing there's a newer version now (visual studio?). Is there any advice or tutorial for taking a VBA-created add-in and putting it into a COM add-in format?

Is there any other advice you guys may have for me to make this secure?

Thank you so much once again!

Jacob Hilderbrand
08-13-2013, 02:58 PM
2003 has exploits so you can bypass the VBA project security, 2007 and up has fixed those as far as I know but the problem is that you can just save the file as 2003.

If you have Visual Studio 2010 you can create add-in projects for Excel. The user can then install the file like a normal exe would install and the code is secured as much as you can. In Visual Studio you can add a new project and select Office then you have options for 2007 and 2010 add-ins. As far as I know the add-ins should work in either version anyway.

See here as well.

http://msdn.microsoft.com/en-us/library/vstudio/cc668205.aspx?cs-save-lang=1&cs-lang=vb#code-snippet-1

Sock
08-13-2013, 09:35 PM
2003 has exploits so you can bypass the VBA project security, 2007 and up has fixed those as far as I know but the problem is that you can just save the file as 2003.

If you have Visual Studio 2010 you can create add-in projects for Excel. The user can then install the file like a normal exe would install and the code is secured as much as you can. In Visual Studio you can add a new project and select Office then you have options for 2007 and 2010 add-ins. As far as I know the add-ins should work in either version anyway.

See here as well.

http://msdn.microsoft.com/en-us/library/vstudio/cc668205.aspx?cs-save-lang=1&cs-lang=vb#code-snippet-1

Hi, DRJ! Thanks for the response! I do have Visual Studio, but it's 2012, and not 2010. I only see an option for an excel 2010 add-in (along with others). Unfortunately, 2007 functionality is still required. Will this be a problem or should I be able to proceed? That link you posted mentions Excel 2010 or 2013 as a requirement.

Thanks again for your help :)

Jan Karel Pieterse
08-13-2013, 10:35 PM
VBA password securit is as bad in 2007-2013 as it was in 2003 and before, the same trick works to remove the password.
Note that the learning curve for moving from VBA to VB.NET is steep.

Also note, that a .NET COM add-in requires the user to install software, which many companies do not allow their users to do. They will need their IT department to be able to install your software, which is often prohibitive.

Sock
08-13-2013, 11:20 PM
VBA password securit is as bad in 2007-2013 as it was in 2003 and before, the same trick works to remove the password.
Note that the learning curve for moving from VBA to VB.NET is steep.

Also note, that a .NET COM add-in requires the user to install software, which many companies do not allow their users to do. They will need their IT department to be able to install your software, which is often prohibitive.

I suddenly realize I am heading down quite the path for the sake of security and fortunately I did understand and expect the potential business-usage as well and it shouldn't be a problem. :)

With that said, I am looking into using Visual Studio as my method right now, despite having coded everything in VBA. To my understanding, I'll have to recreate my forms in Visual Studio (as Windows Forms) and when pasting my code, I'll have to make some adjustments (particularly with declarations) correct? I'm jumping back out of my element here, but it is also a little bit fun (until I'm pulling out my hair. of course). With that said, is it much more complicated than that? I'm using this (albeit outdated) posting on msdn as a reference for converting my VBA code in visual studio: http://msdn.microsoft.com/en-us/library/office/aa192490(v=office.11).aspx

Additionally, I'm concerned as to how I'll recreate my custom ribbon item. With the .xlam it's straightforward with the CUIE, but I'm willing to bet I won't be using that once I start using visual studio...

Jan Karel Pieterse
08-14-2013, 07:05 AM
VS has a ribbon editor...