Is a DEcompiled ACCDB still DEcompiled after signing?

[AHeyne]

The Microsoft Office Subject Interface Packages for Digitally Signing VBA Projects (https://www.microsoft.com/en-us/download/details.aspx?id=56617) sounded very interesting, but unfortunately it seems not to support Microsoft Access:

SUPPORTED FILE FORMATS

    MSOSIP:
        Excel: .xla, .xls, .xlt
        PowerPoint: .pot, .ppa, .pps, .ppt
        Project: .mpp, .mpt
        Publisher: .pub
        Visio: .vdw, .vdx, .vsd, .vss, .vst, .vsx, .vtx
        Word: .doc, .dot, .wiz

    MSOSIPX:
        Excel: .xlam, .xlsb, .xlsm, .xltm
        PowerPoint: .potm, .ppam, .ppsm, .pptm
        Visio: .vsdm, .vssm, .vstm
        Word: .docm, .dotm

Also in the binary "msosipx.dll" I couln't find any occurrences of the strings "accdb" or "accde" (whereas I was able to find "vsdm" or "docm").

 

[isladogs]

I hadn’t seen post #21 when I wrote this.
I have now successfully added a timestamp to a file signed with a self cert. As that is valid until 2031, I have no means of checking it remains valid after expiry.

However, as you have a valid certificate, you could easily test for yourself by downloading a trial version of 365 which will be valid for 30 days. Any files you sign will remain signed even if you cancel the 365 trial

 

[isladogs]

@AHeyne
Following on from post #22, I have been in discussion with both @sonic8 and the Access team regarding timestamping a VBA project and run a number of successful tests.

I can confirm that:

• By default, a timestamp is NOT added when a VBA project is signed
• The addition of several registry keys to HKCU\SOFTWARE\Microsoft\VBA\Security will cause a timestamp to be added when signing a project either from the VBE or using the new /sign command line switch.
• This functionality was added by another Office team towards the end of 2024
• Full details of the steps needed are in a MS help article: https://support.microsoft.com/en-us...-project-956e9cc8-bbf6-4365-8bfa-98505ecd1c01
• I have also written this up with additional info in a new article on my website: https://www.isladogs.co.uk/code-sign-timestamp/index.html

Thank you for raising the issue of timestamping.
I had previously thought it wasn't possible and knowing that it can be done has the important outcome that a digital signature with a timestamp will remain valid even after the certificate has expired.
For those who use certificates, this is good news and a very big issue!

 

[AHeyne]

Thanks a lot for this validated information, @isladogs , @sonic8 and the Access team!

The only 'problem' is that it is estimated that only around a third of our customers use Access 365 (if at all), the rest use the still supported versions 2016 - 2024. Unfortunately, they cannot verify a certificate.

But overall, this is a big step in the right direction, and time is playing in our favor.

 

[isladogs]

For info, neither 2016 nor 2019 are still supported though obviously they will continue to work. The oldest supported version is currently 2021.

 

[cheekybuddha]

For info, neither 2016 nor 2019 are still supported though obviously they will continue to work. The oldest supported version is currently 2021.

Out of curiosity, what does 'support' look like while a version is still in support? Do they get updates?

 

[AHeyne]

@cheekybuddha :
For me the most important part of support are security updates. But also functional updates are included.

@isladogs :
As far as I can see both, 2016 and 2019 have extended support until Oct 14, 2025.
But I agree, it seems that "extended support" only contains security updates.
So you are right, the oldest version of Access having mainstream support (and so having a chance to receive functional updates) is 2021.

 

[cheekybuddha]

For me the most important part of support are security updates.

How are they delivered? Via Wondows/Office update?

 

[AHeyne]

Yes, as far as I know, it only depends on the installation technique of Microsoft Office: MSI installations receive updates through Windows Update and C2R (click-to-run) installations through the dedicated C2R update mechanism.

 

[isladogs]

Just to confuse matters, occasionally feature updates are also rolled out to versions that are out of support. That can be done as all C2R versions from 2016 onwards share the same code base but with some features disabled according to version.

For example the new SQL query button will be added to the Create ribbon menu in all versions from 2016 onwards. However out of support updates are unusual.

2016 is available in both MSI and C2R. Since then, all versions are C2R only.