Excel Macro for Removing Worksheet Password---Can you explain?

[PP3321]

I found this code to unlock worksheet on the internet.
http://www.instructables.com/id/VBA...l-Sheet/step2/Cut-And-Paste-The-Code-Breaker/

Sub PasswordBreaker()

'Breaks worksheet password protection.

Dim i As Integer, j As Integer, k As Integer
Dim l As Integer, m As Integer, n As Integer
Dim i1 As Integer, i2 As Integer, i3 As Integer
Dim i4 As Integer, i5 As Integer, i6 As Integer
On Error Resume Next
For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
ActiveSheet.Unprotect Chr(i) & Chr(j) & Chr(k) & _
Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
If ActiveSheet.ProtectContents = False Then
MsgBox "One usable password is " & Chr(i) & Chr(j) & _
Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
Exit Sub
End If
Next: Next: Next: Next: Next: Next
Next: Next: Next: Next: Next: Next
End Sub

Can anyone please explain to me the following 2 points?

1. Why you can create valid password with the combination of letters A and B...?
Password can be combination of any random letters like dlakjdfdljdlkfjdljfdldd...right?

2. Why the last variable N contains the whole characters...?

(http://www.gtwiki.org/mwiki/?title=VB_Chr_Values)

 

[Debaser]

Because that's how the password is hashed and stored. Excel security is pretty weak.

 

[PP3321]

Thank you for your reply...
So does it mean when we enter passwords, each word is converted to A or B?

 

[Debaser]

No, the whole password is hashed using an algorithm. The resulting hash is always the same length and format no matter what password you actually used.

 

[PP3321]

OK but I wonder why they would do such a thing...?
It is better to keep the original words, then it could not be hacked by VBA macro...

 

[Debaser]

Well, you have to encrypt them somehow or you could just read them out of the file. They could certainly have done it better.

 

[Ashhu]

Excel 2013 has better protection, cant use above code.

 

[Debaser]

There is a well-written explanation here: http://www.thespreadsheetguru.com/blog/2014/8/20/understanding-excels-password-security-methodology

 

[PP3321]

Thank you for that.
But I am still struggling with my 2nd question.

Why do we need string like below to get the same hash?
Why last letter is not A or B...?

AABBAAAABAB@

 

[Debaser]

That's just the way the hash algorithm worked.

 

[YasserKhalil]

Excel 2013 has better protection, cant use above code.

Excel protection is very weak. I discovered a way without any programs that enables me to crack sheet protection ..even if in 2013 and 2016 ...

 

[Ashhu]

Excel protection is very weak. I discovered a way without any programs that enables me to crack sheet protection ..even if in 2013 and 2016 ...

Yasser
If you are referring Zip workbook way, it's not working for me... If you have other way share it.

 

[YasserKhalil]

I don't know if it is allowed to share such hacking ways here or not ...
Let us wait moderator to allow me to share it

 

[Marc L]

Hi !

Yasser, you can open a private conversation with Ashhu and me …
(let me in, I wanna know too !)
​

 

[YasserKhalil]

Ok Mr. Marc L I have started a conversation ..Done

 

[PP3321]

Oh wow...can you share with all the audience... I feel like I am left out...
But maybe you can get sued by Excel if you share it to public...? I dunno...

 

[NARAYANK991]

Hi ,

You may want to read this for more information :

https://possiblywrong.wordpress.com/2013/09/07/password-protection-of-worksheets-in-excel/

However , it is only the worksheet protection schemes which are weak ; using the Encrypt Document feature improves matters , since this scheme is not based on the same hashing algorithm alone.

Narayan