Access – Unlocking an Access VBA Project

I recently needed to unlock an Access VBA Project for which my client had lost the password. I was surprised to find that there was an incredibly simple hack that can unlock any Access password protected VBA project and I figured I’d share in case it could help others.

Make a copy of the database in question and only work with the copy.  Never work with the original database file just in case anything goes wrong.

Open the database file in any HEX Editor of your choosing.

Find any and all occurrences of the term DPB= and change the B to another value (many tutorials suggest x, but it doesn’t seem to truly make any difference)


Once you have replaced all the occurrences, perform a Save As to save these modification under a new file.

Open the newly saved file in Access (like you would normally) and then go into the VBA editor.  You will receive several error messages, simply dismiss them all (and yes, there can be quite a few!).


Open the Database Properties which will now have no password specified.


Enter a new password and confirm it to resecure the VBA Project with a known password.

Save the VBA Project

Close the database

That’s it, everything should now be in order.  Use your database as you normally do.

 

With regards to Access in particular, being unlike any of the other Office applications, this illustrates the critical importance of always distributing your front-end as an mde/accde (by converting the db to mde/accde the VBA is completely inaccessible, hack or no hack) to your end-users where security is even mildly a concern (which is pretty much everywhere nowadays!).  So take the extra 5-10 second, compile your databases and distribute the compiled version instead of the master mdb/accdb.

My Take and Hopes Regarding this Matter
This entire experience has drastically changed my opinion on overall Office/Access security and securing VBA projects as it appears to be completely futile! I’m surprised that with the importance of security in 2018 that Microsoft leaves it so very simple to hack this password. You can unlock an Access VBA project in about 30 seconds with freely available tools.

I’m also hoping that by shedding some light on this issue perhaps Microsoft will make the necessary changes to start protecting people’s information properly. This is completely unacceptable in 2018 IMHO.

 

24 responses on “Access – Unlocking an Access VBA Project”

  2. Robert E Cain

    I wish I had known this years ago…Thanks for sharing!! I had a client who had spent months trying to track down the contractor who password protected their Access VBA code. (His work-Visa expired and was sent back to his home in Vietnam!!) It was a nightmare! If I had known this, back then…I would have been the hero 🙂

  3. John A. Cross

    I usually set up Front End databases as .accdr. My suggestion for what should be a very hard to break option would be to save your DB as .accde, and then rename to .accdr.

    When the DB opens run VBA code to make sure it is still an accdr. if not then exit the DB. If a ‘savvy’ user tries to rename the .accdr to .accdb they will be out of luck, and if the base file is .accde format they have no way of modifying the VBA code to keep the DB open.

    John Cross
    Database Analyst at Operation A.B.L.E. of Greater Boston

  8. Robert Joven

    I tried it to my database but it’s not working. Can i share my file to you and further check it?

    2. John

      If you look to hex document name near DPB you will notice that its not your document name, but “Database1”, which is default name for the Access while once you open it up. So we cant even edit DPB of password protected one.

  10. Sk Sabbir Ali

    I have open the .accdb file through Hex Editor but there is no single instance of dpb. How can I edit sir. how to crack the password??

  11. Hudaifa

    I get to the point of giving in a new password under properties and protection. when I save and exit the access to reopen the file, it again warns me of “invalid key DPX”.
    I click ok and exit the program. when I reopen the database it still warns me of “invalid DPX”. when I enter VB environment, it behaves as nothing has change.

  12. TxGeekGirl

    I am getting database engine cannot find the object ‘MSysDb’. My database was converted to an accdb.

    I am having my Network Admin grab the backup. Any idea how to get around this error?

  14. Aftab Ahmad Joiya

    This is the not proper way anyhow as code written in the VBA also removed using this trick. Do you have any other way to unlock the file without lossing vba codes?

    1. Daniel Pineault Post author

      That was not the case when I wrote the articles (and yes, I did test at the time of writing). Sorry, no, I’m not aware of any other approaches.

      Sadly, I don’t have the time right now to validate that it no longer works. It would be nice to know MS has secured things much better with some update!