Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Unhide Very Hidden Excel 97 Sheets
# Unhide all the very hidden sheets in an Office 97 Excel file.
from __future__ import print_function
import re
import sys
# Read in the Excel file for which to unhide sheets.
fname = sys.argv[1]
f = open(fname, 'rb')
data = f.read()
f.close()
# See https://inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files and https://github.com/InQuest/yara-rules/blob/master/Excel_Hidden_Macro_Sheet.rule for explanation.
hide_pat = r"(\x85\x00.{6})\x02\x01"
if (re.search(hide_pat, data) is not None):
# Edit the file to unhide the sheets.
new_data = re.sub(hide_pat, r"\1" + "\x00\x01", data)
out_name = fname + "_UNHIDDEN.xls"
f = open(out_name, 'wb')
f.write(new_data)
f.close()
print("Saved Excel file with unhidden sheets to " + out_name)
else:
print("No hidden sheets found.")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment