ASR Rule - Block Win32 API Calls from Office Macro

%3CLINGO-SUB%20id%3D%22lingo-sub-3115930%22%20slang%3D%22en-US%22%3EASR%20Rule%20-%20Block%20Win32%20API%20Calls%20from%20Office%20Macro%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3115930%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20does%20this%20ASR%20rule%20really%20do%20%3F%3CBR%20%2F%3EThis%20question%20because%20we%20see%20that%20not%20only%20Win32%20API%20Calls%20are%20blocked%20but%20also%20x64.%3CBR%20%2F%3EDuring%20tests%2C%20we%20used%20an%20Excel%2064-bit%20with%20VBA-code.%3CBR%20%2F%3E%3CBR%20%2F%3EFirst%20test%20was%20VBA-code%20written%20in%20%3CSTRONG%3E32-bit.%3C%2FSTRONG%3E%3CBR%20%2F%3EAs%20example%3A%26nbsp%3B%3CBR%20%2F%3EPrivate%20Declare%20Function%20GetTimeZoneInformation%20Lib%20%22kernel32%22%20(%20_%3CBR%20%2F%3ElpTimeZoneInformation%20As%20TIME_ZONE_INFORMATION)%20As%20%3CEM%3ELong%3C%2FEM%3E%3CBR%20%2F%3E%3CBR%20%2F%3E2nd%20test%20was%20same%20VBA-code%20but%20written%20in%20%3CSTRONG%3E64-bit.%3C%2FSTRONG%3E%3CBR%20%2F%3EAs%20example%3A%3CBR%20%2F%3EPrivate%20Declare%20%3CEM%3EPtrSafe%3C%2FEM%3E%20Function%20GetTimeZoneInformation%20Lib%20%22Kernel32%22%20(%20_%3CBR%20%2F%3ElpTimeZoneInformation%20As%20TIME_ZONE_INFORMATION)%20As%20%3CEM%3ELongPtr%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBoth%20are%20given%20the%20same%20result.%3CBR%20%2F%3EWe%20can't%20open%20the%20excel.%3CBR%20%2F%3EIt%20is%20given%20the%20message%20'Excel%20cannot%20access%20file.xlsm.%20The%20document%20may%20be%20read-only%20or%20encrypted.'%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20we%20change%20the%20ASR%20rule%20from%20Blocked%20to%20Not%20Configured.%20XLSM%20is%20perfectly%20going%20open.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

What does this ASR rule really do ?
This question because we see that not only Win32 API Calls are blocked but also x64.
During tests, we used an Excel 64-bit with VBA-code.

First test was VBA-code written in 32-bit.
As example: 
Private Declare Function GetTimeZoneInformation Lib "kernel32" ( _
lpTimeZoneInformation As TIME_ZONE_INFORMATION) As Long

2nd test was same VBA-code but written in 64-bit.
As example:
Private Declare PtrSafe Function GetTimeZoneInformation Lib "Kernel32" ( _
lpTimeZoneInformation As TIME_ZONE_INFORMATION) As LongPtr

 

Both are given the same result.
We can't open the excel.
It is given the message 'Excel cannot access file.xlsm. The document may be read-only or encrypted.'

If we change the ASR rule from Blocked to Not Configured. XLSM is perfectly going open.

0 Replies