Unhide Very Hidden Excel 97 Sheets

gistfile1.txt

# Unhide all the very hidden sheets in an Office 97 Excel file.

from __future__ import print_function
import re
import sys

# Read in the Excel file for which to unhide sheets.
fname = sys.argv[1]
f = open(fname, 'rb')
data = f.read()
f.close()

# See https://inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files and https://github.com/InQuest/yara-rules/blob/master/Excel_Hidden_Macro_Sheet.rule for explanation.
hide_pat = r"(\x85\x00.{6})\x02\x01"
if (re.search(hide_pat, data) is not None):

    # Edit the file to unhide the sheets.
    new_data = re.sub(hide_pat, r"\1" + "\x00\x01", data)
    out_name = fname + "_UNHIDDEN.xls"
    f = open(out_name, 'wb')
    f.write(new_data)
    f.close()
    print("Saved Excel file with unhidden sheets to " + out_name)
else:
    print("No hidden sheets found.")